Checking for Update
{{ $message }}
Thank you for you submission.
``` [GitHub Source](https://github.com/iBotPeaches/cicada%5F3301/blob/master/onions/ut3qtzbrvs7dtvzp.onion/post2/index.html?ref=connortumbleson.com)    Pages [14](https://github.com/iBotPeaches/cicada%5F3301/blob/master/liber%5Fprimus/markdown/14.md?ref=connortumbleson.com), [15](https://github.com/iBotPeaches/cicada%5F3301/blob/master/liber%5Fprimus/markdown/15.md?ref=connortumbleson.com) and [16](https://github.com/iBotPeaches/cicada%5F3301/blob/master/liber%5Fprimus/markdown/16.md?ref=connortumbleson.com) of Liber Primus So I had to quickly run outguess over these new book pages, but came up empty with no messages packed within. It was time to get to work to decode these pages, but first I had to laugh as the magic square I spent months on to find was now just given to us on the 3rd page. After the slow painful process of converting these book pages to runic characters I had a single string that represented each page. ``` ᚪ ᛋᚹᚪᛁ ᛈᚢᛟᚫ ᛈ ᚠᛖᚱᛋᛈᛈ ᚦᛗ ᚾᚪᚱᛚᚹᛈ ᛖᚩᛈᚢᛠᛁᛁᚻᛞ ᛚᛟ ᛠ ᛄᛖ ᛠ ᛁᚫ ᚷᛖ ᚦᛟᛁᛞᛟ ᛝᚠ ᛄᛖ ᛞᛁᛉᚾᚢᛚᚠᚻᚱᚹᛈᛞᛡ ᚻᚹ ᛋᚳᛉᛞ ᚻᛡᛖᛡ ᛠᚱᛉᛖᛇ ᛒᚹ ᛠ ᛋᛒᛚᛞᚹᛈᚳ ᚫᚩ ᚹᛉᛞᚪᚪᛄᛠ ᚹᚣᛠᚳ ᛄᚪᚳ ᛗᚾᛈᛏ ᚩᚻ ᛗᛈᛗᚳᛡᚱ ᚱᚪᛚᛡ ᛁᛒ ᚠᛋ ᛈ ᚳᛝᛗᚳᚹ ᛁᛗᛗᛁᚪᚻ ᚣᛝᚳᛟ ᛒᛠᛇ ᛁ ᚱᚹᚾᛒ ᛡᚪᛗᛟ ᛈ ᛁᚩᛠᚳᛠ ᛉᚾ ᛚᛏ ᚻᛒᛡ ᛚᛇᚢᚪᚻᚣ ᚷᛖ ᛏᚷᚢᛇᛟᛡᚫ ᚪᛡᛞ ᛖᛟ ᚱᚫᚠᛋᚹᛡ ᚣᛗᛋ ᚣᚪᛗᛡ ᛏᚱ ᚷᛖᚾᚪ ᛚᛡ ᛗᛈᛋᚣᛟᚱ ᚩᚻ ᛗᛈᛗᚳᛡᚱ ᚱᛏᛈᛒ ᛈᛗᛈ ᚦᚹ ᛗᚳᛁᛞᚹᚾᚣ ᛠᚾᚪ ᚳᚪᛠᛡ ᛚᛡ ᚢᛝᛁᛋᛟ ᚦᚫᚷ ᛄᛗᛗᚳ ᚪᚪᛠᛞ ᚹᚹᚢ ᚾᛉᚢᚹ ᛈᛝ ᛁᚩᛠᚳᛠ ᛉᚾ ᛡᛟᚢᛟ ᛇᛒᚩ ᛁᚱ ᚦᛠ ᛉ ᚪᛁᛈ ᚦᚹ ᛗᚳᛁᛞᚹᚾᚣᛗ ᚹᛗᛞᛖ ᚹᛈᚾᛗᚷᚣᛏᛠᛈᛖᚪ ᚪᚾ ᛁᚾᛋᛏᚱᚢᚳᛏᛡᚾ ᚳᚹᛖᛋᛏᛡᚾ ᚪᛚᛚ ᚦᛝᛋ ᛞᛁᛋᚳᚩᚢᛖᚱ ᛏᚱᚢᚦ ᛁᚾᛋᛁᛞᛖ ᚣᚩᚢᚱᛋᛖᛚᚠ ᚠᚩᛚᛚᚩᚹ ᚣᚩᚢᚱ ᛏᚱᚢᚦ ᛁᛗᛈᚩᛋᛖ ᚾᚩᚦᛝ ᚩᚾ ᚩᚦᛖᚱᛋ ᚳᚾᚩᚹ ᚦᛁᛋ 434 1311 312 278 966 204 812 934 280 1071 626 620 809 620 626 1071 280 934 812 204 966 278 312 1311 434 ``` I ran each string through a basic translate/reverse and surprisingly the last page decoded successfully. ``` AN IN[S|Z]TRU[C|K]T[IA|IO]N [C|K]WE[S|Z]T[IA|IO]N ALL TH[NG|ING][S|Z] DI[S|Z][C|K]OUER TRUTH IN[S|Z]IDE YOUR[S|Z]ELF FOLLOW YOUR TRUTH IMPO[S|Z]E NOTH[NG|ING] ON OTHER[S|Z] [C|K]NOW THI[S|Z] 434 1311 312 278 966 204 812 934 280 1071 626 620 809 620 626 1071 280 934 812 204 966 278 312 1311 434 ``` The oddity occurs with what is clearly "*Question All Things*". You can see the only options we have is C or K, when we expected Q. ``` [C|K]WE[S|Z]T[IA|IO]N ALL TH[NG|ING][S|Z] ``` However, we know from the Gematria Primus that we don't have the letter Q as a possibility. So the last page (Page 16) breaks down to: ``` AN INSTRUCTION KWESTION ALL THINGS DISCOUER TRUTH INSIDE YOURSELF FOLLOW YOUR TRUTH IMPOSE NOTHING ON OTHERS KNOW THIS 434 1311 312 278 966 204 812 934 280 1071 626 620 809 620 626 1071 280 934 812 204 966 278 312 1311 434 ``` Now I was back to the other 2 pages that didn't seem to decode in that same manner. So I began running some brute-force little scripts I wrote. I took the first few characters (`ᚪ ᛋᚹᚪᛁ ᛈᚢᛟᚫ ᛈ`) of the 1st page and used it to test some column shifts, rotation shifts and vigenere shifts. 0:00 /0:17 1× As I was scrolling the output on the vigenere shift I saw something interesting. ``` | Word | Translation | | circumference | M [C|K]OMN DUR[NG|ING] A | ``` This appeared to spell the word "During" with a vigenere key of "circumference", but it didn't look perfect. In one of the earlier parts ([Part 3](https://connortumbleson.com/2024/06/03/the-cicada-3301-mystery-puzzle-3-solve-part-3/)) of this puzzle we spent a lot of time on decoding a koan. As I look at this failed decoding - the phrase looks pretty close to "*A Koan - During a*" So now we have a problem - I'm fairly sure the key is circumference, but not spelled exactly that way. So if we take the original runic to human letter conversion we get this: ``` A [S|Z]WAI PUOEAE P ``` Which suggests the first character is already correct. However, by the time we move down the key (circumference) we fix the word of PUOEAE to DURING. So this suggests if we examine the key in detail the 1st character (`c`) is affecting the shift, but the 2nd and 3rd seems fine. We also know the 4th character (`c`) is also breaking the decoding, so I believe we have a pattern. I believe the leading `c`'s in circumference (or maybe all) need to be changed. This is classic behavior of Cicada puzzles to thwart basic automation. So there are 2 paths to take with this - we can assume a single character (`a`|`ᚪ`) shouldn't be shifted or we record the runic indexes to skip. Neither of these options worked. - If you ignore a specific letter - decoding falls apart into unreadable text. - If you skip specific indexes you break the string as it shifts the key into phrases that we previously correct. We basically need to change the key to something that won't break our parser and there is one special character in the Gemetria Primus. The first character (0 index) in the translation guide is the letter `f`. So if we adapt our vigenere key to "firfumference" we may have better luck as that letter in a key will cause the character to not shift any direction. ``` ➜ php cicada app:vigenere Enter a sentence to translate: > ᚪ ᛋᚹᚪᛁ ᛈᚢᛟᚫ ᛈ Enter the key.: > firfumference Enter the indexes to skip.: > Translation: A [C|K]OAN DUR[NG|ING] A ``` [https://github.com/iBotPeaches/cicada\_3301/blob/master/tool/app/Commands/TranslateVigenere.php](https://github.com/iBotPeaches/cicada%5F3301/blob/master/tool/app/Commands/TranslateVigenere.php?ref=connortumbleson.com) This seemed to work but I was only decoding 15\~ characters so time would tell if that was the full string. To help understand how this worked it may help to first visualize how this algorithm was working for the original key of "circumference".  A visual understanding of runic vigenere cipher with key "circumfer" to plaintext. As you can see above - we take the original runic character and identify its index starting at 0\. We take our key and convert/translate it to runes in order to find its index (also 0 based) in the Gematria Primus. Once we have a numeric for both the string and key - we do a simple subtraction. If we happen to go into the negatives we add the amount of runes (29) to the value to wrap it back into positive values. This gives you the shifted numbers which can be easily translated into letters. Now visually you can see that the letter F above represents 0 which means the value did not shift from its original numeric index. So we can remake the image above with the corrected key to see the impact.  A visual understanding of runic vigenere cipher with key "firfumfer" to plaintext. Now you can see how the string decodes correctly without affecting the other characters. So I grabbed the entire single line runic string and attempted a decoding and it quickly fell apart after "During". However, I saw another letter "c" towards the end of the word circumference, so I tried using `firfumferenfe` where I changed all letter C's to F's. This had more success, but then fell apart a bit into the sentence. ``` Translation: A [C|K]OAN DUR[NG|ING] A LE[S|Z][S|Z]ON THE MA[S|Z]TER EXPLAINED THE I THE I I[S|Z] THE UOI[C|K]E OL JF DFINFUFMFERDN ``` Thankfully a few onions ago we had developed indexes to skip as an optional extension to the vigenere cipher, so I carefully started recording indexes where the decoded string fell apart. It only took two indexes (65, 76) skipped and the entire page decoded into something readable. ``` A [C|K]OAN DUR[NG|ING] A LE[S|Z][S|Z]ON THE MA[S|Z]TER EXPLAINED THE I THE I I[S|Z] THE UOI[C|K]E OF THE [C|K]IR[C|K]UMFEREN[C|K]E HE [S|Z]AID WHEN A[S|Z][C|K]ED BY A [S|Z]TUDENT TO EXPLAIN WHAT THAT MEANT THE MA[S|Z]TER [S|Z]AID IT I[S|Z] A UOI[C|K]E IN[S|Z]IDE YOUR HEAD I DONT HAUE A UOI[C|K]E IN MY HEAD THOUGHT THE [S|Z]TUDENT AND HE RAI[S|Z]ED HI[S|Z] HAND TO TELL THE MA[S|Z]TER THE MA[S|Z]TER [S|Z]TOP... ``` So I quickly had to check if the next page (Page 15) stood on its own or had to be decoded with the same key alongside the previous page. The next page had to be decoded after it was added to the end of the previous page. This added the following snippet. ``` [S|Z]TOPPED THE [S|Z]TUDENT AND [S|Z]AID THE UOI[C|K]E THAT JU[S|Z]T [S|Z]AID YOU HAUE NO UOI[C|K]E IN YOUR HEAD I[S|Z] THE I AND THE [S|Z]TUDENT[S|Z] WERE ENLIGHTENED ``` So with a bit of cleanup. I could clean up the entire 3 pages into a one solid story. > A Koan > During a lesson the master explained the I: > > "The I is the voice of the circumference" he said. > > When asked by a student to explain what that meant, > the master said, "It is a voice inside your head." > > "I don't have a voice in my head," thought the student > and he raised his hand to tell the master. > > The master stopped the student and said: "The voice > that just said you have no voice in your head is the I." > and the students were enlightened. > > An Instruction > Question all things > Discover truth inside yourself > Follow your truth > Impose nothing on others > > Know this: > 434 1311 312 278 966 > 204 812 934 280 1071 > 626 620 809 620 626 > 1071 280 934 812 204 > 966 278 312 1311 434 It seemed we successfully understood these 3 pages - now we were just waiting for Cicada to utilize our onion service we uploaded. For some in early May 2014 (and others a bit earlier) Cicada triggered 3 web requests to your onion server. 1. `GET /key.asc` with `Cicada/33.01 CicaDOS 1.033 E Edition` User Agent. 2. `GET /` with `Cicada/33.01 CicaDOS 1.033 E Edition` User Agent. 3. `POST /cgi-bin/upload` with `Cicada/33.01 CicaDOS 1.033 S Edition` User Agent. Cicada obtained your public key to be able to encrypt communication solely to you and then confirmed your onion was accessible before uploading a signed message to your host. For some their journey was over and instead a welcome questionnaire message was uploaded which awaited their results. For the majority of folks - the puzzle was not yet over as they received a message to another onion. ``` -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello. Your enlightenment awaits you. ky2khlqdf7qdznac.onion We look forward to hearing from you. Good luck. 3301 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJTO88vAAoJEBgfAeV6NQkPEfsQAI0jGcmBaQr2AGGr1/ic839I fc58EyVNLgWs6Aox0/Dc2Tj8dXOxc0sBNWY98tICIy2T0Vbpf1VF65nFs+cVcxXI pXIU5X0O3XKRfxequIZQQUnt4elLIfFAIgrXbE9N7K5qkD47xg4kaYkPQh7/mDBa NBVHsLkw8bbLUo7lBtv5VFHTeTikSnT3m7FsoSHl5WlsY9WvITO5VcYd48jFbBSS P9Uk7v7cg1ohWpDB0BiYUTfOVxXYuZpnFiR6vAADP5KkY/qrFF7wrpYbhSmageId Qcxyc/dajUTlwK7dl+OwAJn4XRPceBPMjW9SbCr33y1C3ijCuxn06penu0KnUyge yYjyedXg11UPb/B6eT+hwAOPg/DLDTQ57QOQlGOX19lB56iZbHKuglQZUZ5kJq54 dTobWhi6FBtwu+QLnJCz2SASLCuKDIWFkwSoYro/F9Zlo7b0UUO2IOkcKw7tKzq9 uyPtBDQayCSIIHJhVjAtNiVFjNe+TcBf1VppAGY/7jfUfwxJ7Sfbv5Jwll+6MDYr YdsnJBZjhLuoxFyr9g4TF0OTXmxT+TyAZ4qoItu4C0bcEncBcfLJz+J74X1upsZl DMq7On1paQAkXvzr6ywDBpMJbDZETkl9gZbzHn1Ji+9f3fANrqU+5kZ1su2OReQf ++CO13gAUF4WohKip4mC =VAo/ -----END PGP SIGNATURE----- ``` [GitHub Source](https://github.com/iBotPeaches/cicada%5F3301/blob/master/messages/2014/hello-your-enlightenment.asc?ref=connortumbleson.com#L6) As folks quickly arrived at a new onion they were left with an alarming sight. Which can best be captured with this little video below. 0:00 /0:15 1× scrolling "ky2khlqdf7qdznac.onion" at 30% zoom. It seemed we now had the [full book](https://github.com/iBotPeaches/cicada%5F3301/tree/master/liber%5Fprimus?ref=connortumbleson.com) titled Liber Primus in front of us, which was a daunting 75 pages of runic characters. Sure we had probably already decoded 17 of those, but there was nearly 60 remaining. At this point with a huge book and no clear path on the direction to take - things slowed down massively among the public Cicada researchers. We can only assume those really progressing the puzzle succeeded enough to go silent, but surely most folks just worked in private not sharing their success as Cicada recommended. So Part 4 comes to an end and our next post will be less of a linear journey in parts, but a deep dive into a group/single page of the Liber Primus. --- - [Puzzle 1](https://connortumbleson.com/2019/09/30/the-cicada-3301-mystery/) (2012) - [Puzzle 1 - 2nd Chance](https://connortumbleson.com/2021/04/12/the-cicada-3301-mystery-puzzle-1-extra/) (2012) - [Puzzle 2](https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/) (2013) - [Puzzle 3 - Part 1](https://connortumbleson.com/2021/02/15/the-cicada-3301-mystery-puzzle-3-part1/) (2014) - [Puzzle 3 - Part 2](https://connortumbleson.com/2024/02/05/the-cicada-3301-mystery-puzzle-3-solve-part-2/) (2014) - [Puzzle 3 - Part 3](https://connortumbleson.com/2024/06/03/the-cicada-3301-mystery-puzzle-3-solve-part-3/) (2014) - Puzzle 3 - Part 4 (2014) - You are here. ### Olive Oil & Vinegar URL: https://connortumbleson.com/2024/12/16/olive-oil-vinegar/ Last updated: 2025-02-04T11:42:04.000Z  4 different local (Tampa) Olive Oil shops Like probably most folks I head to the grocery store and commonly refresh on some olive oil and vinegar (red wine or apple cider) every once in awhile. I've probably been doing this for as long as I remember, but a few months ago a friend gave me a bottle of olive oil from Italy. I'm not sure how else to bluntly say it - everything I used with that oil tasted better. It was like my salad dressings got a permanent upgrade in the flavor department. Anything I cooked in a pan with that oil just had a new touch of zing. It of course also worked as just a plain mixture of oil/spices for a bread dip. So as I walked through the grocery store sad my better olive oil had run out - I was determined to explore and try more olive oils locally. However, I needed something in that moment so left with my favorite grocery store brands.   Publix oil/vinegar pair I normally get I was lucky that my girlfriend has lived here in Tampa her whole life - so she knew exactly where to go to between stores and farmer markets to stumble upon some robust olive oil. I already blogged about our first stop, but after attending the [Keel Farm's Farm Weekend](https://connortumbleson.com/2024/10/28/food-and-fall-weekend/) we stumbled upon our first purchase of new oils. This led to the purchase of a few balsamic and extra virgin oils - or exactly as below: - 2 Mango Sriracha Infused White Balsamic Vinegar - 2 Robust Extra Virgin Olive Oil - 1 Elderberry Infused While Balsamic Vinegar  [https://www.15olives.com](https://www.15olives.com/?ref=connortumbleson.com) These were purchased from 15olives and I learned pretty quickly that the mango sriracha white balsamic is amazing. For someone who loves a bit of heat and spice this was an unmatched flavor that did great on anything from chicken to salad to pizza. I will probably continue to re-buy the sriracha balsamic as I run out, because its just too good to ignore. The olive oil was a jump above the grocery store, but I didn't feel it matched the unnamed gifted oil that started this off. ---  [https://www.olive-the-world.com](https://www.olive-the-world.com/?ref=connortumbleson.com) A few weeks passed and once again I found myself at a farmers market and stumbled upon a different stand called "Olive the World". I really enjoyed how most of these stands allowed me to try the items before purchased, so I left with some real tiny bottles of: - Roasted Garlic Extra Virgin Olive Oil - Meyer Lemon Extra Virgin Olive Oil - Traditional Style White Balsamic Vinegar - Blood Orange White Balsamic Vinegar This one was unfortunately more miss than hit with both of the oils just having an overwhelming amount of either garlic/lemon present. Now I figured with such small bottles you probably are meant to mix these oils with others, but I found with a tiny amount of either of these oils it overpowered the dish. However, the balsamic vinegars had a great taste and I used them commonly to caramelize some mushrooms and provide some kick to some dressings. ---  [https://www.dzhomemadegoods.com](https://www.dzhomemadegoods.com/?ref=connortumbleson.com) Now on a different mission for some veggies, salsa and potatoes we stumbled upon an Italian stand that was offering some Italian olive oil and some pepper infused oil. Immediately I had to try the infused oil and it lived up to my expectation. It took any dish and just elevated the heat factor of it, which I thoroughly enjoyed. As this stand was all about pastas, sauces and oils I tried a basic oil/pesto pasta with the olive oil and it delivered - with a robust crisp flavor. However, I still oddly just prefer a red/white sauce over an oil based pasta. --- Finally after all these farmers markets - it was time to go to the real deal. A real brick and mortar store that specialized in olive oils.  [https://www.joeandsonsoliveoils.com](https://www.joeandsonsoliveoils.com/?ref=connortumbleson.com) This store is what I was missing in my life. The instant we walked in we were greeted and asked what we were looking for. I explained I wanted a robust olive oil, but also some spicy/heat induced oils or vinegars and we were off. As the photo above shows I was guided between all these different oils (or vinegars) and tried them out one by one. Price can go up quick in a visit like this, but I knew I had to get some Christmas shopping done. After I picked a few I knew I wanted to purchase I was surprised to see they just pluck an empty bottle from a box and fill up your requested choice from the containers pictured above. So I left with bottles of: - Green Chili Infused Olive Oil - Oregano White Balsamic - Neapolitan Herb Dark Balsamic I haven't got to use these yet as they were just purchased yesterday, but I'm excited to try out more and more oils/vinegars in an attempt to elevate some cooking creations. As Christmas and New Years arrive I'll probably have plenty of chances to use more of these, I'll probably have to slow down now that I've got a solid amount of olive oil, but who knows what it'll happen if another olive oil stand is near. ### Goodbye cPanel URL: https://connortumbleson.com/2024/12/09/goodbye-cpanel/ Last updated: 2025-02-04T11:42:04.000Z  License cancelled - cPanel As I planned [roughly 14 months ago](https://connortumbleson.com/2023/09/18/bye-centos-and-cpanel/) I finally terminated my cPanel license and said goodbye to some software I started using more than a decade ago. This journey took far longer than I expected, but it was worth the effort. It all started way back in January of 2020 when cPanel decided to end the $170/year single VPS license. Of course I can understand with the increase of server power - some folks had thousands of sites on a single server. However, for me hosting roughly 17 websites my price was changing to $360/year for the same hosting. This was basically a \~111% increase in prices. This is because I landed in the **cPanel Pro Cloud (30 Accounts)** plan, but the other available options were: - Solo - 1 account - Admin - up to 5 accounts. - Pro - up to 30 accounts. - Premier - up to 100 accounts. Now knowing I could terminate 3 sites instantly my new website count in June of 2020 was 14\. The jump between Admin/Pro plans upset me as I was sitting at 14 websites but paying for up to 30\. What I really wanted was some plan that got you 15 accounts. - As the year came to a close 2021 arrived with a new monthly price of $32.25 (from $30) and thus my new yearly bill was $387. - Another year went by and 2022 arrived with a newly raised price of $35.99 (from $32.25) and thus my higher yearly bill was $431.88. - Like clockwork another year (2023) another increase to $39.99 (from $35.99) and thus my yearly bill jumped to $479.88. - As expected 2024 hit and the prices went up again - this time to $42.99 (from $39.99) and thus my yearly was $515.88. - Unexpected in the middle of 2024 (August) my price went up again due to running CentOS 7 and being subjected to extended support which moved my price to $47.29 (from $42.99) and thus my yearly was now $567.48. > **Additional Fees:** BeginningAugust 1, 2024, there will be an additional monthly fee per qualifying license for ELS Support. The ELS Support fee will continue being applied until the underlying operating system is upgraded to a supported version. We are offering one **month of free ELS Support** for the month of **July 2024**. The ELS Support fee may be increased beginning **January 1, 2025**. I was now determined in 2024 to not hit 2025 for another price increase which may be double due to my ELS support + the cPanel license. I got to work in January of 2024 with my remaining 13 websites. I was just getting exhausted from this slow boil of price increases and how my cPanel license was now more expensive than the server it was on. 💡 My cPanel box was hosted on a 8GB Linode instance for $40/month. Pretty quickly I plucked the websites that were WordPress and I pushed those owners to move to a different service ([Hostinger - referral](https://hostinger.com/?REFERRALCODE=XXACONNORQAI&ref=connortumbleson.com)) which was very easy to migrate. I even migrated the domains and email over so these individuals had everything to manage in one location. As I migrated those domains I realized my DNS for a good chunk of my sites were controlled via my cPanel server and I didn't want to manage my own DNS in the future. So knowing DNS propagation takes awhile I setup my new DNS on either Porkbun/[Linode](https://www.linode.com/lp/refer/?r=e92c46a37fb8d23182a473696f336b261ff2ec78&ref=connortumbleson.com) depending on some personal organization. Nothing changed at this point except some DNS entries as they were clones of the existing DNS zone. I was ready to get back to moving some websites now that DNS was out of the picture. I had a few sites that were nothing more than a little static HTML page, so I migrated those over to the same server this blog runs on and pretty quickly I had only 9 websites left. These broke down to: - 4 regular Laravel projects that ranged from PHP 8.0 to PHP 8.3 - 2 very old Laravel projects (5.1.x) - 1 very old Invision Power Board forum (IPB 3.x) - 1 very large modern Laravel project (30GB DB) - 1 Ghost blog So at this point I was considering a migration to a modern operating system using [cPanel Elevate](https://cpanel.github.io/elevate/?ref=connortumbleson.com), but in my test runs it was not a viable option. This was because it would not install the older PHP versions and this was breaking a solid amount of my websites. So I proceeded with a different approach. I looked at the website that I utilize to capture my Pi-hole stats and it was a website on the Internet that was getting data API\`d out from my local network Raspberry Pi. So at that point I finally realized the purpose of my unused Raspberry Pi 5. ``` ibotpeaches@warlock:/var/www/html $ php artisan about Environment ............................. Application Name ............... Pi Stats Laravel Version ................ 10.48.23 PHP Version ...................... 8.3.14 Composer Version .................. 2.8.2 Environment .................. production Debug Mode .......................... OFF URL ........................... 127.0.0.1 Maintenance Mode .................... OFF ``` A few hours later I had warlock provisioned and serving my API that my Pi-hole a few inches away on a different Pi was sending. I had 8 websites remaining, but 4 weren't mine so I passed that responsibility onto the responsible party and focused my effort on the final 4 sites around the Thanksgiving break from work. Thus remaining was: - A Laravel 5.1 (PHP 7) website serving an Ingress project. - A Laravel 10 (PHP 8.1) website serving an Ingress project. - A Laravel 11 (PHP 8.2) Halo Infinite website with a 30GB database. - An IPB 3.x Halo 2 forum requiring PHP 5.6. So boy only one of these were going to be easy. I immediately started with buying an equivalent $40 Linode to begin with a modern Debian version and recent PHP version. Seeing how work occasionally has a client come in the door with a very old Laravel application and requires support. I decided to manually upgrade my Laravel 5.1 project all the way to Laravel 11 with a modern PHP version to refresh my memory on older upgrades. This took about 15 hours as there was a good deal of changes in the resources/assets ([SemanticUI](https://fomantic-ui.com/?ref=connortumbleson.com)) and packages that were no longer needed and directly in Laravel. With a quick host file change everything looked good and I solidified on using [Certbot](https://certbot.eff.org/?ref=connortumbleson.com) on all new servers, instead of mix/matching solutions like acme.sh/Certbot. I was excited to try out the "IP Transfer" functionality of Linode to simply re-claim my 12 year old IP on the new server once all sites were transferred.  Client area of Invision Community Software After a large internal discussion about containerizing a PHP 5.6 application to support an older version of forum software - I decided against it. I feel comfortable with Docker on Amazon and ECS, but I didn't want the costs associated with that. I didn't feel comfortable with my knowledge of self-hosting Docker in a manner that was secure. So I payed the renewal of my software which had been expired for almost a decade and got the latest and greatest version. To my utmost surprise, I ran a test migration from my mega old version to latest and it just worked first time. Yeah I lost a few tweaks here and there, but as my goal was to just persist content I didn't lose that aspect.  The migrated ibotmodz.net However, the latest forum software (IPB v4) couldn't work on the latest and greatest PHP (8.4) so I decided to spin up a new $5/month Linode to host just this website. I ran the real migration and ported my [cbox](https://www.cbox.ws/?ref=connortumbleson.com) over to the new version. This time I just gave it my old 70 lines of code I custom wrote and asked OpenAI to convert it to the latest version of IPB software and it did. I was impressed because I sure didn't know the names of new functions/methods, but AI proved successful in this case. I was down to 2 sites and one of them was a small modern Laravel application. So I took a database export, changed my CI pipeline to the new server and deployed it. It failed a few times for missing some PHP extensions, but then it was complete and moved. I wish all the sites transferred as easy as that one. I was down to 1 site with a massive 30GB database. Thankfully the site was [Leaf](https://connortumbleson.com/2023/04/17/project-leaf/) which could survive in read only mode while I transferred it. So I took a backup, did a little [scp](https://linux.die.net/man/1/scp?ref=connortumbleson.com) transfer and painfully waited 12 hours for it to complete a SQL import. I'm sure there was a more optimized way to do that, but this worked. I tweaked my hosts file and confirmed no issues, so was ready to swap IPs.  Snippet of my new $40/month Linode - code-named "deltatap" I transferred the IP from my old Linode to my new Linode and immediately triggered Certbot to obtain some SSL certificates – everything just worked immediately. I was quite surprised outside of doing a large forum migration how well everything transferred. Hopefully when 90 days elapses and certificates renew I'll still be able to say that. When the year clocks into 2025 and I no longer see a cPanel bill - I'll be happy. It was an amazing piece of software when I lacked the technology skills to manage a Linux server, but those times have changed. I might have continued to pay for it instead of migrating everything away, but boy a price hike every year was insanely depressing. Imagine if every piece of subscription software you depend on changed prices every single year. I'm glad this is probably last time I'll write the word cPanel and won't have to worry about it ever again. ### Travel Blog: Roanoke, VA (2) URL: https://connortumbleson.com/2024/12/02/travel-blog-roanoke-va-2/ Last updated: 2025-02-04T11:42:04.000Z  For the first time in awhile on a travel day I awoke at a normal time without an early flight. This time my flight to Roanoke for Thanksgiving was scheduled to leave at 6:50pm on a Tuesday. In comparison to [last year's trip](https://connortumbleson.com/2023/11/27/travel-blog-roanoke-va/) I wasn't traveling on actual Thanksgiving this time. Sadly delays struck as I got an email at 2:37pm delivering the bad news. > Flight 1057 scheduled to depart St. Petersburg / Clearwater International (PIE) to Roanoke Regional-Woodrum Field (ROA) on Tuesday 26 November 2024 at 6:50PM has been delayed. > > Departing: St. Petersburg / Clearwater International (PIE) at 8:17PM Tuesday 26 November 2024 We didn't end up leaving Florida until 9:07pm local which sucked since I rarely have good experiences with Allegiant. However, I cannot argue with their business model of creating direct flights to cities that the big name flights don't visit. Flying direct from St.Pete to Roanoke is immensely better than taking Tampa to Charlotte to Roanoke. Once arriving I was happy I was in row 2 as it meant I de-boarded quickly and passed folks walking as I made my way to the cars. An army of cars awaited just waiting in a massive line around the airport. I was surprised seeing this, because no way in Tampa you are allowed to just form a line and wait for your arriving party/person. If you aren't actively loading a car - you are getting yelled at or ticketed. Thankfully this wasn't Tampa and a family member was sitting in one of those cars waiting for me. It was around midnight when I finally arrived to my destination and it was straight to bed. The morning brought visibility to the dogs & farm animals.   Highland Cow & 3 Poodles This wasn't Tampa anymore and the temperature floated around 28 to 40°F with even little bits of snow falling every once in awhile. Though even with the cold weather we had to take a break and explore a nearby trail. Turns out we were in the midst of the Jefferson National Forest and the [Hoop Hole Hike](https://www.hikingupward.com/jnf/hoophole/?ref=connortumbleson.com).     Hoop Hole Trail/Hike This park had two loops with the lower loop completing in 3.8 miles, but you could join on the upper loop to make it a 9.7 mile loop. You could also optionally tack on the Iron Ore Trail once on the upper loop to make it a 14.5 mile hike. We did none of that and basically walked a mile down the lower loop trail and turned around and came back. The temperature was bouncing around freezing so it was pretty cold to be hiking on a trail. The stream was extremely low compared to other visitor's videos, so I had a chance to jump into the stream bed for some close up photos. As Thanksgiving came and went it was time to drive into Roanoke to spend the day before my flight home. We went up the little mountain to Roanoke's prime attraction - The Mill Mountain Star. For a brisk "*feels like*" 26°F the visit was rough with a blistering wind coming across the mountain into your face.    Photos from beneath the Mill Mountain Star overlooking the city 💡 These images (above) are not optimized/cropped. Full original quality. However, despite the cold weather we successfully experienced the attraction and learned all about the history of this massive structure. We weren't the only folks visiting the star in the cold weather, so I'm guessing the other visitors were also temporary Thanksgiving arrivals. We probably spent under 5 minutes in the wind and went off for a drink at a local place. This next place is a bit insane to explain. It previously was a fire station and was converted into a boutique hotel. However, it offered not only drinks and food, but the furniture you sat on was Txtur brand, which was sold in the same building. A manufacturer based in Roanoke selling furniture out of a fire station, bolstering a full bar was a sight to see.  Lingonberry Bramble at [Fire Station One, Roanoke (VA)](https://firestationone.com/stock/?ref=connortumbleson.com) So of course we had to sit down and try a drink. I wanted a bramble, but none of the normal berries (black, straw, blue) were available so I experimented with a lingonberry. It packed such a unique taste it was definitely a drink I'll have to try and replicate again. As time passed we were approaching my final dinner in Roanoke and that was a dinner reservation at [Bloom](https://www.bloomrke.com/?ref=connortumbleson.com). This was another restaurant only opened for a few hours a day and rocked a menu that depended on the season & farmer's deliveries. We arrived at the opening alongside a handful of other parties waiting to eat. With another fancy set of drinks ordered we picked a solid amount of little dishes to share. Unfortunately the menu is probably different every night so no amount of screenshots of the menu will help here. We had some bread, mushrooms, fish, beef, potatoes, pasta and a pear salad in little dishes like pictured below.   Raspberry sweet potato & beef kebab at [Bloom](https://www.bloomrke.com/dine?ref=connortumbleson.com) As each dish came out in a steady stream our table of 5 quickly devoured each dish each sharing a little portion of each entree. It reminded me of omakase sushi, but instead little plates of farm local food. Each dish paired flavors together I wouldn't expect, but they delivered a powerful flavor punch to the mouth. Unfortunately as time went on we were nearing the time of my flight and had to cut the dining short to get me to the airport. Once I made it through security I heard the staff call out "*row 1 & 2 boarding now*" and that was me! I was a bit confused as I was zone 8 (nearly last for boarding), but I was in row 2, seat F. On the way there I boarded near last, but had a seat in the front of the plane (2F) and unfortunately no bag storage existed for me. I was a bit mad as I was convinced someone put their bags in the first available slot they found, causing me – someone actually sitting in row 2 to have to place their bags in row 8. I wasn't going to sit around and figure out why I was given this chance, so I boarded the plane first and set my bags perfectly up in the bin on row 2\. The only downside is I then had to sit there for 20+ minutes while the rest of the plane slowly boarded. A short 1hr 30 minute flight later I was on the tarmac in St Pete and walking out to meet my girlfriend awaiting my arrival. That set the end of the Thanksgiving travel and this blog post. ### Internet Sleuths & The Yi Peng 3 URL: https://connortumbleson.com/2024/11/25/internet-sleuths-the-yi-peng-3/ Last updated: 2025-02-04T11:42:05.000Z  [Photo of Yi Peng 3 via Ray Hensel](https://www.marinetraffic.com/en/photos/of/ships/shipid:213234/shipname:YI%20PENG%203?order=date%5Fuploaded&ref=connortumbleson.com) A few days ago I signed up for [Blue Sky](https://bsky.app/profile/connortumbleson.com?ref=connortumbleson.com) and one of the first things I randomly spotted in my zero follower "discovery" tab was this [thread](https://bsky.app/profile/auonsson.bsky.social/post/3lbc5va7f722p?ref=connortumbleson.com). It was discussing how the above Yi Peng 3 ship crossed both the C-Lion1 and BCS undersea Internet cables when they were mysteriously cut.  [Submarine Cable Map](https://www.submarinecablemap.com/multiselect/submarine-cable?ids=bcs-east-west-interlink,c-lion1&ref=connortumbleson.com) \- C-Lion1 & BCS East-West Interlink Those two cables have been selected above to show their connection points which break down to: **BCS** - Sventoji, Lithuania - Katthammarsvik, Sweden **C-Lion1** - Rostock, Germany - Helsinki, Finland - Hanko, Finland Thankfully for all these countries - the loss of both of those cables did not severely disrupt their internet traffic as proven via [Cloudflare Radar](https://blog.cloudflare.com/resilient-internet-connectivity-baltic-cable-cuts/?ref=connortumbleson.com). It was simply re-routed automatically through less optimized routes. However, some of those less optimized routes include Russia controlled cables which fuels my paranoia. When I saw this post by [auonsson](https://bsky.app/profile/auonsson.bsky.social?ref=connortumbleson.com) I was hooked immediately.  [bsky post via auonsson](https://bsky.app/profile/auonsson.bsky.social/post/3lbc5va7f722p?ref=connortumbleson.com) This took public AIS (Automatic Indication System) data of ship travel times and compared it with the loss of connectivity on the two undersea cables. Sure enough it was proved the Yi Peng 3 ship crossed both of those cables at the exact times they were disrupted. Now that might not prove the cables were broken by that action, but it sure is convincing given the timing. So I kept reading on - this time the author looped in others ([pekka](https://bsky.app/profile/did:plc:yzywgiiou7cx63uddiru6m2o?ref=connortumbleson.com) & [garygnutter](https://bsky.app/profile/did:plc:26rid3megkunzvet6xtv6arw?ref=connortumbleson.com)) who provided further context on this situation. This time with images showing the track Yi Peng 3 took as it left Russia.   [bsky post via auonsson](https://bsky.app/profile/auonsson.bsky.social/post/3lbc5va7f722p?ref=connortumbleson.com) So of course given the present situation with Russia - seeing a massive bulk carrier Chinese ship departing from Russia and allegedly breaking 2 undersea cables seems like sabotage. I had to look up the last time this happened and it was October of 2023 when yet again another Chinese vessel ([Newnew Polar Bear](https://en.wikipedia.org/wiki/Newnew%5FPolar%5FBear?ref=connortumbleson.com)) broke gas pipelines and undersea cables. Now of course the owner of a ship and who is pilot/crew of a ship don't have to be the same country. So I read on this time seeing an image from [garygnutter](https://bsky.app/profile/garygnutter.bsky.social?ref=connortumbleson.com) who plotted Yi Peng 3's movement which clearly changes right before crossing the BCS cable.  [bsky post via garygnutter](https://bsky.app/profile/garygnutter.bsky.social/post/3lbc4tcraz22m?ref=connortumbleson.com) At this point I'm convinced the Yi Peng 3 intentionally did this and absolutely mind blown that these random people I stumbled upon were a treasure trove of information. Sure enough they are quick on providing updates showing the military getting involved. 0:00 /0:06 1× [bsky post via auonsson](https://bsky.app/profile/auonsson.bsky.social/post/3lbcl4dq2wc2o?ref=connortumbleson.com) It feels like I'm part of a live investigation and I'm thousands of miles away watching some feeds. I'm hoping we all learned from the last sabotage via NewNew Polar Bear and not letting this ship go without boarding it and performing an investigation. Sure enough I scroll again and get excited - the boat has been chased down and slows to a crawl. 0:00 /0:20 1× [bsky post via auonsson](https://bsky.app/profile/auonsson.bsky.social/post/3lbd3ks7fts2o?ref=connortumbleson.com) It seems a large military presence is growing on the Yi Peng 3 with many countries in support. The ship is passing between international waters and specific country water so either very much intentional or something greater in play. While The Yi Peng 3 sits in the water guarded by a few war ships, others are researching the owner of this ship. > Helsingin Sanomat visited Yi Peng 3 ship's management company Win Enterprise Ship Management and interviewed them briefly. They also visited the address of the OWNER, Ningbo Yipeng Shipping Co., LTD. Address was empty. It's currently marked as a “Military Management Zone”. > [https://bsky.app/profile/ainorautahuopa.bsky.social/post/3lblxmascss2k](https://bsky.app/profile/ainorautahuopa.bsky.social/post/3lblxmascss2k?ref=connortumbleson.com) This was a bit expected - the management company knew nothing and the owner of the ship's registration pointed to some business that had been closed for 8 years. Instead the military is using the area as a "management zone" and request the investigative journalists to leave.  [bsky post via auonsson](https://bsky.app/profile/auonsson.bsky.social/post/3lbkskux7us2c?ref=connortumbleson.com) So now we have a ship ([Yi Peng 3](https://www.marinetraffic.com/en/ais/details/ships/shipid:213234/mmsi:414270000/imo:9224984/vessel:YI%5FPENG%5F3?ref=connortumbleson.com)) that is being watched by war ships ([Bad Dueben](https://www.marinetraffic.com/en/ais/details/ships/shipid:5984242/mmsi:211815690/imo:9830032/vessel:BAD%5FDUBEN?ref=connortumbleson.com) & [P523](https://www.marinetraffic.com/en/ais/details/ships/shipid:159219/mmsi:220434000/imo:0/vessel:DNK%5FNAVY%5FPATROL%5FP523?ref=connortumbleson.com)) owned by a company/entity that is difficult to pinpoint. Every day a new ship is discovered getting involved and tensions rise. All I know is huge undersea cables that carry immense amounts of Internet traffic seems like an attractive target for an increasingly cyber warfare. Head on to [auonsson's Blue Sky](https://bsky.app/profile/auonsson.bsky.social?ref=connortumbleson.com) account if you want to follow this story further. ### A Halo 2 Tournament - 20 years later. URL: https://connortumbleson.com/2024/11/18/a-halo-2-tournament-20-years-later/ Last updated: 2025-02-04T11:42:05.000Z  [LVL50 Homepage](https://www.lvl50.gg/?ref=connortumbleson.com) A week or so ago from November 8 to 10 in the year 2024 a Halo 2 tournament took place. This was very interesting for a few reasons. 1. Halo 2 was released November 9, 2004 - this was exactly 20 years later. 2. Halo 2 is my favorite video game of all time. 3. The tournament was played on original Xbox consoles. 4. The tournament was played on original Halo 2 + a bit of [Insignia](https://insignia.live/halo2?ref=connortumbleson.com) patching. 5. The tournament was played with original CRT TV's. 6. The tournament had Chris Puckett returning as host. For those who got to experience the release of Halo and Halo 2 - I'm sure you remember how revolutionary this game was. This game practically invented online competitive matchmaking with voice chat to unite the teams in drama.  #### Halo MCC Revisited Halo MCC launched November 11, 2014\. Some would argue it wasn't a working game until August 27, 2018\. We take a look into why. [Halo MCC Revisited](https://connortumbleson.com/2018/09/02/halo-mcc-redux/) Sure there is Halo 2 on the Master Chief Collection, but as I blogged about 6 years ago that game was launched terribly. Only after 1,200\~ days passed did the game finally act stable, but at the cost of not really feeling like the original Halo 2\. So my hopes of a return of competitive Halo 2 faded away.  #### Halo 2 & Insignia The original Halo 2 and Xbox Live is reborn thanks to the Insignia project. [Halo 2 & Insignia](https://connortumbleson.com/2024/03/18/halo2-insignia/) Earlier this year though, Insignia launched with support for Halo 2 and offered an original Xbox experience. I was blown away with how well this software worked. I setup my [Insignia](https://insignia.live/?ref=connortumbleson.com) account through the regular Xbox Live interface from two decades ago and started playing Halo 2 on my original Xbox with a few hundred other people. Hearing news from the faces behind Insignia that stats were being kept - it just made sense that a tournament was near. Sure enough a few months later news about a Halo 2 tournament came across my socials and I was ready. Unfortunately a few moments later I realized the weekend it fell on did not work for my schedule. So instead I prepared a $501 donation to grow the prize pool from what I would have probably spent on a flight/lodging. As the days neared and I joined the Discord for the event I learned the names behind this tournament was: - [Alex "SwiftKill" Ramirez](https://x.com/Swift%5FKill?ref=connortumbleson.com) - [Dylen "PROVERB" Roberts](https://x.com/PROVERBDR?ref=connortumbleson.com) - [Martin "Voodooman" Omes](https://x.com/MartinOmes?ref=connortumbleson.com) - Plenty of others It wasn't names I recognized personally, but I was excited to see this major team effort from folks all over to make this event real. What I was ultimately curious about was the logistics of hundreds of original Xbox consoles and CRT's and how these would end up being configured, patched, shipped and configured for a weekend. This isn't a huge business putting on a tournament so where this stuff was sourced from just piqued my curiosity.  [https://x.com/LVL50LAN/status/1854660351788195955](https://x.com/LVL50LAN/status/1854660351788195955?ref=connortumbleson.com) As the tournament got closer the stream sources were announced. This time it solidified that Chris Puckett who was the face of MLG (Major League Gaming) tournaments decades ago would reprise the role. Of course Puckett didn't stop with Halo and has continued to take video game broadcasting to a new level, but this was big to me. This was the voice that people heard as Halo grew from each event. It was more than likely the voice people heard as some of the original winners took tournament after tournament long ago.    Photos from the early MLG events from LoadingWharf172 Of course with teams in the past like Final Boss, Carbon, Instinct and Str8 Rippin - I wondered which teams would dust off 20 years of rust and revisit the game. Would we see the OGRE twins make an appearance? News was some retired professionals would attend, but the exact list remained a mystery a few days out.  Preview of [Insignia.Live](https://insignia.live/?ref=connortumbleson.com) Halo 2 Stats As the days counted down we even saw some hints that Insignia was running on all the Xbox consoles capturing game stats. I was hopeful that we'd have stats to review all the data of the event before the event even started. I'm personally obsessed with Halo stats ever since experiencing [bungie.net](https://www.bungie.net/7?ref=connortumbleson.com) eons ago. This was a video game that launched 20 years ago that included live web game stats. That's sometimes unheard of with releases of today's games which sometimes launch with no web component. 💡 I logged in Halo 2: Total Games: 6,987 | Last Played: 11/30/2006 7:36:53 AM | Total Kills: 20,928 | Total Deaths: 25,423 | Total Assists: 6,328. That decades ago pushed me into building a stat site for every single Halo game, which presently is [Leaf](https://connortumbleson.com/2023/04/17/project-leaf/) \- a stat site for Halo Infinite. With under one day to go a little trailer montage went up by All-in-JUAN and it set the stage. This was going to be a major nostalgic trip to the past. 0:00 /0:42 1× [https://x.com/All\_in\_JUAN/status/1855122202523271443](https://x.com/All%5Fin%5FJUAN/status/1855122202523271443?ref=connortumbleson.com) Sure enough taking 20 years of enhancements to technology for live-streaming, audio, visuals and more while playing an original game on original equipment was a sight to see. I can't fathom the effort it took to take technology of the past and stabilize it for technology of today to enable the viewing experience we got.  Roy, Walshy, StrongSide, Lunchbox & Clutch (Coach) - Final Instinct The photo above helps explain the situation the easiest. CRT TV's with a modern setup with a loaded roster of retired Halo legends. It was simply unbelievable watching legends of the past compete at a high level against folks that have kept playing Halo 2 for the better part of the last decade.     [https://x.com/LVL50LAN/status/1855310696650858655](https://x.com/LVL50LAN/status/1855310696650858655?ref=connortumbleson.com) As the night fell on Saturday this was quite an event to remotely witness with a couple thousand people growing a prize pool every hour. As the prize pool passed $80,000 I felt an urge to donate again.  [https://www.lvl50.gg/donations](https://www.lvl50.gg/donations?ref=connortumbleson.com) It was a bit odd to donate online as it only took Coinbase, but I figured I was sitting on crypto for a decade doing nothing I could afford to send some bitcoin for a good cause. For those who can't fathom donating $1,002 to some tournament I figured I would spend that much traveling there if I did and I owed this game a lot as Halo 2 helped drive my career trajectory. 0:00 /0:20 1× [https://x.com/HCS/status/1855776895474024847](https://x.com/HCS/status/1855776895474024847?ref=connortumbleson.com) It was pretty cool to see my 2nd donation ending up on screen at the same time as Roy getting a triple, which then made its way on Twitter. This was just one of probably hundreds of moment's over the weekend that were clip worthy. If you don't have 20-30 hours to kill re-watching the VODs - you can watch this [6 minute supercut](https://www.youtube.com/watch?v=gLY9mhOQU48&ref=connortumbleson.com) by OozyGorilla. As Sunday arrived it was championship Sunday – when generally you just have the winners finals, loser finals and then the grand finals.  [https://www.start.gg/tournament/lvl50-halo-2-lan/event/halo-2-4v4-bracket](https://www.start.gg/tournament/lvl50-halo-2-lan/event/halo-2-4v4-bracket?ref=connortumbleson.com) The bracket above showed how things broke down and a few call outs: - Oats Overnight vs Final Instinct (*Winners Quarters*) was legends vs legends. - Zanada vs Final Instinct (*Winners Semis*) was a great series. - Oats Overnight vs Zanada (*Losers Semis*) was amazing. - Zanada vs Final Instinct (*Losers Finals*) was absolutely insane to watch. - LVT 3-0'd every team in their path. These games were absolutely nostalgic to watch as players warmed up to the game they competed in decades ago. 0:00 /0:15 1× [https://twitter.com/MLGPuckett/status/1855738069443567808](https://twitter.com/MLGPuckett/status/1855738069443567808?ref=connortumbleson.com) Take this clip of StrongSide getting an insane double kill - it was crazy to see him compete like it was just yesterday. 0:00 /0:30 1× [https://twitter.com/MLGPuckett/status/1855791753284268142](https://twitter.com/MLGPuckett/status/1855791753284268142?ref=connortumbleson.com) Or this clip of Final Instinct pulling a flag with 1 second left in a crazy pile of bodies to score the tying flag. This felt like Halo and crazy enough this game and older equipment never seemed to have an issue. Let me stress that watching modern HCS (Halo Esports) you just naturally accept and deal with constant game crashes, pauses and equipment swaps. This was a tournament that ended up going crash free on a 20 year old game & console. Is this because Halo 2 just had to contend with one type of platform that was constant?  Consoles getting ready for the event. > Can confirm we had zero crashes the entire tournament. Even in the pit. > Was a pain to set up all the equipment but damn well worth it. > \- [Voodewman](https://old.reddit.com/r/CompetitiveHalo/comments/1govfnx/lvt%5Fwins%5Fthe%5Flvl50%5Fvegas%5Fopen%5Fog%5Fhalo%5F2%5Flan%5F32000/lwmc32u/?ref=connortumbleson.com) Or was this because Bungie the studio had immense stress for [18 months to deliver](https://www.gamespot.com/articles/halos-co-creator-left-bungie-after-enduring-life-a/1100-6472943?ref=connortumbleson.com) a perfect game. Making reasons why modern Halo crashes constantly wouldn't be fun to dive into, but maybe a large reason is what pushed [343 (Halo Studios)](https://news.xbox.com/en-us/2024/10/06/halo-studios-unreal-engine-interview/?ref=connortumbleson.com) to leave their home-grown game engine and instead move to Unreal Engine. It's probably tough being both a game engine company and a video game company as the ecosystem evolves with consoles & computers. So as the legends fell one by one to teams still playing Halo 2 - we arrived at the grand finals with LVT vs Zanada. The LVT team looked like a subset of the [Halo 2 Real Ones](https://www.twitch.tv/h2realones?ref=connortumbleson.com) \- a group of folks that continue to play Halo 2. LVT, the brand, continues to support Halo in every single possible way. We had two streams the entire tournament between Puckett (Main) and LVT (Feature) where some of the games in the pit were being covered. Halo is lucky to have LVT who try and cover all competitive Halo games no matter the tournament.  [https://old.reddit.com/r/CompetitiveHalo/comments/1govfnx/lvt\_wins\_the\_lvl50\_vegas\_open\_og\_halo\_2\_lan\_32000/](https://old.reddit.com/r/CompetitiveHalo/comments/1govfnx/lvt%5Fwins%5Fthe%5Flvl50%5Fvegas%5Fopen%5Fog%5Fhalo%5F2%5Flan%5F32000/?ref=connortumbleson.com) With the stage set and rosters facing each other. LVT continued its dominance and put a 3-0 victory in the grand finals. With that the event came to a close and the winners remained. [**Halo 2 FFA**](https://www.start.gg/tournament/lvl50-halo-2-lan/event/halo-2-ffa-tournament?ref=connortumbleson.com) - 1st - Stormy v2 - 2nd - GuN ShoT - 3rd - Moniz [**Halo 2 4v4**](https://www.start.gg/tournament/lvl50-halo-2-lan/event/halo-2-4v4-bracket?ref=connortumbleson.com) - 1st - LVT (GuN ShoT, Havok, Stormy v2, c0n) - 2nd - Zanada (Moniz, Zildj, DoRdY, CrAzYv2) - 3rd - Final Instinct (Walshy, StrongSide, Lunchbox, Roy) [**Halo CE 2v2**](https://www.start.gg/tournament/lvl50-halo-2-lan/event/halo-ce-2v2-bracket?ref=connortumbleson.com) - 1st - Team Col (Kaiser, Cobbyt) - 2nd - VGA Legendz (Mack, C6 Jordy) - 3rd - Team Canada (Silos, Vinny Mendoza) --- So after a good nostalgic trip to the past I am debating growing my collection of Halo posters.   All purchased from [Nerd Herd Printing](https://www.nerdherdprinting.com/gaming-posters?Category=XBox&ref=connortumbleson.com) While I debate purchasing more posters - if you missed the event. You can catch up on the recorded videos here: - [Day 1](https://www.twitch.tv/videos/2297062092?ref=connortumbleson.com) \- FFA - [Day 2](https://www.twitch.tv/videos/2297666779?ref=connortumbleson.com), [LVT Day 1](https://www.twitch.tv/videos/2297664709?ref=connortumbleson.com) \- 4v4 - [Day 3](https://www.twitch.tv/videos/2298589238?ref=connortumbleson.com), [LVT Day 2](https://www.twitch.tv/videos/2298514131?ref=connortumbleson.com) \- Championship Sunday ### Countries & Video Games URL: https://connortumbleson.com/2024/11/11/countries-video-games/ Last updated: 2025-02-04T11:42:06.000Z  OpenAI Image A few weeks ago I joined a Discord call and saw a few friends watching the League of Legends 2024 World Championship. This is a game that I've never played nor really had an interest in watching, but I saw 2.5\~ million other people watching the stream. As the teams were introduced, I couldn't help but notice the rosters were unified between Korea (T1) and China (Bilibili Gaming) and it was always so interesting to me to see what country represented the best players of any game. So I decided to do some research between a few categories to see what countries tend to produce the best gamer of said game. I wanted to look at games that bring in the most money (top 5) and games I play (random 5) and see what countries hold the highest winning player. ## Top Prize Money Games 1. **Dota 2** \- 362\~ million 2. **Fortnite** \- 191\~ million 3. **Counter-Strike: Global Offensive** \- 162\~ million 4. **League of Legends** \- 115\~ million 5. **Arena of Valor** \- 98\~ million Right out of the gate - I've only played one of these games (Fortnite) so perhaps I'm not as much as a gamer as I thought. Before I jump into the details of all the games, I want to list my own games I play or played. ## Top Money for Games I Play 1. **Fortnite** \- 191\~ million 2. **Overwatch** \- 35\~ million 3. **Halo 5** \- 7.1\~ million 4. **Halo Infinite** \- 7\~ million 5. **Age of Empires 2** \- 3.9\~ million 6. **Gears of War 4** \- 3.1\~ million 7. **Halo 3** \- 2.3\~ million 8. **Halo 2** \- 1.6\~ million So you could sum all the games I play winnings and they don't even come near Dota 2's prize pool. So I'll go through each of these games and look at the top 3 players to see how the countries break down. --- **Dota 2**  [https://www.esportsearnings.com/games/231-dota-2/top-players](https://www.esportsearnings.com/games/231-dota-2/top-players?ref=connortumbleson.com) - N0tail - Denmark - 7\~ million - JerAx - Finland - 6.4\~ million - ana - Australia - 6\~ million Now unfortunately I don't know anything about Dota 2, but seeing the top 3 players in different countries helps destroy my idea that certain countries are better at certain games. I thought about summing all the winnings of all players then group by country, but its a bit unfair when countries like China and Russia have over 600 players and other countries barely pass 200. I then thought I would just average the winnings to get a winnings per country per game, but countries with so little players but high winnings absolutely destroy that comparison. I then saw some players with a huge amount of wins, but no money. It just seems year after year prize pools grew - so I'd need to account for that. After all that thinking though - I just want to see which countries correspond to which game, so lets just go back to looking at top 3. --- **Fortnite** - Bugha - United States - 3.7\~ million - Aqua - Austria - 2.2\~ million - psalm - United States - 1.8\~ million Fortnite had 2 Americans in the top 3, with an interesting backstory. For both Bugha and psalm they struck gold with their placings in the Fortnite World Cup Solo Finals 2019\. This was a tournament that is still placed at #1 in terms of the largest prize pool. Especially since it was a solo tournament all the funds were reserved for the winner. This is where Bugha scored a 3 million dollar single tournament win. Outside of that it seems there is a healthy mix of countries in the top 20\. I attribute this to the quick rise of Fortnite and serious money that was being offered at tournaments. This of course attracted players from everywhere to compete. --- **Counter-Strike: Global Offensive** - dupreeh - Denmark - 2.1\~ million - Xyp9x - Denmark - 2\~ million - dev1ce - Denmark - 1.9\~ million Finally just what I wanted to investigate. We have the top 5 players all being from Denmark, so why did Denmark get so good at Counter-Strike? It may be because Denmark supports gamers and treats it like any other sport. They have trainings, integration with school and pro teams centralized right there in Denmark. A few of the top pro teams in Counter Strike are based right there in Denmark, which may play into things as well. However, that could be true for any game or country so perhaps it remains a mystery. --- **League of Legends** - Faker - Republic of Korea - 1.8\~ million - Duke - Republic of Korea - 1\~ million - Bang - Republic of Korea - 1\~ million Another very interesting bit of research. While the top 3 are all Republic of Korea (South Korea) - we have South Korea & China holding nearly all in the top 50\. I wondered why this was, but it seems in my brief research its all about popularity. The server population of Korean servers is nearly double of all of United States, but I think its mainly about support. League of Legends is huge and the community and companies support it locally when compared to other games. When you compare/contrast with games in the states - its like every other month we hear of a gaming organization or sponsor leaving. --- **Arena of Valor** - HuHai - China - 1.8\~ million - Fly - China - 1.7\~ million - 1dao - China - 1.5\~ million I've never heard of this game in my life until this blog post and its insane. The top 57 people are all from China, its not till the 58th person do you have another country (Thailand) represented. It seems this game was built by TiMi Studio Group, which is a subsidiary of Tencent Games. Tencent keeps attempting to go global, but just doesn't have much success in my personal opinion. --- **Overwatch** - Striker - Republic of Korea - $500k\~ - smurf - Republic of Korea - $400k\~ - Fleta - Republic of Korea - $400k\~ Another game that is primarily dominated by Republic of Korea (South Korea), but the winnings are so normalized between all the parties. I know from playing and watching this live that Overwatch started The Overwatch League that had organizations with salaries and players. So as teams won events the winnings went back to the organization that probably issued bonuses, but it otherwise kept the salaries rolling. With a business model so different than other leagues - it was bound to fail and sure enough a few later - it did. --- **Halo Infinite, Halo 5, Halo 3 and Halo 2**  - SnakeBite - United States - 1\~ million - Royal2 - Canada - 950k\~ - Frosty - United States - 900k\~ Now I combined all the Halo's here because some of these folks played between games. What I found so interesting is that Ogre 2 who I thought would be pretty high up there, was at 17th place with 250k\~. I guess winning a ton of tournaments during the rise of e-sports didn't net much money. It just shows that prize pools kept growing year after year and if you look at the top 20 of these players its mainly United States, with exception of 1 Canada and 1 France contender. I have no idea why Halo was never competitive in more countries, but I'm guessing it was because of Halo's slow movement into the PC realm. --- **Age of Empires 2**  - TheViper - Norway - 350k\~ - Hera - Canada - 300k\~ - Liereyy - Austria - 230k\~ Another game that has an insane amount of different countries present in the top 20\. Age of Empires has been around for over 20 years and with such a worldwide historic game - it stands to reason that you'd have a worldwide player base. While the monetary gains don't compare to some of the more popular titles - its clear that any country can represent a top competitor. When you look at the top 15 - its a different country represented on each place until you hit that 15th place. --- I don't think I can draw any conclusion from any of this data. With any pattern its broken with another game. I did learn that some games draw some serious money in compared to others, but that correlates pretty well with the popularity of said game. ### HTML to PDF (PHP) in 2024 URL: https://connortumbleson.com/2024/11/04/php-html-to-pdf-in-2024/ Last updated: 2025-02-04T11:42:06.000Z  Lately I've been obsessed with PDFs and how you produce them while working in a PHP project and the more I dig and learn - the more stressed I feel. So I started to refresh my knowledge on a basic search of "pdf" on Laravel packages ([Packalyst](https://packalyst.com/s/pdf?ref=connortumbleson.com)) and decided to pluck out a few near the million download mark to review. - [laravel-dompdf](https://packalyst.com/packages/package/barryvdh/laravel-dompdf?ref=connortumbleson.com) (barryvdh) - 17\~ million downloads - [laravel-snappy](https://packalyst.com/packages/package/barryvdh/laravel-snappy?ref=connortumbleson.com) (spatie) - 7\~ million downloads - [browsershot](https://packalyst.com/packages/package/spatie/browsershot?ref=connortumbleson.com) (spatie) - 4.5\~ million downloads - [laravel-pdf](https://packalyst.com/packages/package/niklasravnsborg/laravel-pdf?ref=connortumbleson.com) (misterspelik) - 1\~ million downloads Of course I was curious what tools under the hood these all used. It took a bit, but those same packages break down to: **Dompdf** An interesting PHP based package that wraps 3 different drivers, but defaults to CPDF. - CPDF by Wayne Munro - PDFLib by Apryse ($$$) - GD by PHP **Snappy** A PHP library that wraps [wkhtmltopdf](https://wkhtmltopdf.org/index.html?ref=connortumbleson.com), which has sadly been abandoned at this point in time. Such a revolutionary package in its time (2008) as it created a headless way to take HTML to PDF with QtWebKit. The amazement with this timing and package is Chrome didn't get this feature until late 2017\. Unfortunately a package built on WebKit in 2008 has decayed quite heavily and won't stand up to some of the more modern CSS features. **Browsershot** This PHP package leverages [Puppeteer](https://github.com/puppeteer/puppeteer?ref=connortumbleson.com) to control/manage Google Chrome - an attractive option to use a highly stable & tested option. With the amount of configuration required to get a working Chrome & Puppeteer within Docker made this a less attractive option to start with. **Laravel PDF** This package is a wrapper for [mPDF](https://mpdf.github.io/?ref=connortumbleson.com), which appears to be a forked/modern iteration of [FPDF](http://www.fpdf.org/?ref=connortumbleson.com). A pure PHP implementation, which has also fallen behind in the modern specifications of CSS. So I really wasn't truly happy with my results so far and thus expanded it further with some Google searches. This led to finding more options such as: - [Gotenberg](https://gotenberg.dev/?ref=connortumbleson.com) \- A docker-powered stateless API for PDF files. - [Pop PDF](https://github.com/popphp/pop-pdf?ref=connortumbleson.com) \- A modern PHP library for the PDF specification. - [PrinceXML](https://www.princexml.com/?ref=connortumbleson.com) \- Convert HTML to PDF - [DocRaptor](https://docraptor.com/?ref=connortumbleson.com) \- The SaaS service for the above. - [Typeset.sh](https://typeset.sh/en?ref=connortumbleson.com) \- PDFs with PHP using HTML & CSS So before I tried some out, I decided to toss some from my list immediately: - **Snappy** \- Not building something against *wkhtmltopdf* \- its been abandoned for years. - **Browsershot** \- If I'm going to try one headless Chrome - it'll be Gotenberg. - **Laravel PDF -** If I'm going to try a pure PHP one - it'll be the 17\~ million download one. - **PrinceXML -** Steep **($**2,000**)** license cost, but I'll try the SaaS offering. Thus with the remaining left - I decided to give them a whirl. ---  #### Dompdf ($?) Amazing drop-in use with little to no configuration, but falls apart quickly with any complex HTML document. [Dompdf GitHub](https://github.com/dompdf/dompdf?ref=connortumbleson.com) I tested out Dompdf first and I was amazed with a Laravel application how with 0 dependencies outside of my existing installed Imagick - I ran one line of code and converted my HTML to PDF. Now the fun ended pretty quickly when I realized the alignment was busted majorly. Digging into a project with 500+ open issues and all these workarounds I stumbled upon different adapters. Little did I know I was using the default CPDF, which is some 20+ year old PDF code that fell into public domain and has been patched over a decade. So I wanted to research the GD (PHP Image Extension) and PDFLib (Paid extension) for some comparison. Very quickly I learned the GD extension refused to render more than 1 page, which I also had to install since I was running only Imagick. So I tossed that aside as I didn't really want to install GD and then fight with it. The final adapter was PDFLib so I changed my config and generated a PDF and nothing changed - it was still authored by CPDF. So I checked the PDFLib website and saw they charged per server, including load balanced containers so I just skipped it before digging further into why my adapter switch didn't work. I didn't want to spend time on something that I knew was going to be an expensive option if I wanted to horizontally scale a solution across some containers. ---  #### pop-pdf A refreshed from scratch modern PHP implementation of the PDF specification. However with 1 contributor and not much traction tough to trust for prime time. [POP PDF Docs](https://docs.popphp.org/user-guide/pdfs?ref=connortumbleson.com) After slamming my head against a wall trying to use all these older CSS tricks to position images with dompdf - I wanted to go in a completely different direction and try out an implementation that just had an API for direct PDF manipulation. The API looked quite sane and attractive to try out. ```PHP $document = new Document(); $document->addFont(Font::ARIAL); $page = $document->createPage(Page::LETTER); $page->addText(new Text('Hello World', 12), Font::ARIAL, 50, 742); Pdf::writeToFile($document, 'my-document.pdf'); ``` However, pretty quickly after the docs saying one thing and my code saying another. I felt this project was just way too new to try out. However, its not fair to say new when this project has been around since 2014\. It just hasn't gotten the popularity that other PHP frameworks have which help refine its API. Perhaps in time if adoption occurs and framework growth - this may become a powerful little piece of PHP software for direct PDF drawing. ---  #### DocRaptor ($) A SaaS offering of the Prince software which works very well with modern CSS features, but you pay per document generated. [DocRaptor Website](https://docraptor.com/?ref=connortumbleson.com) So after trying out some free software - I wanted to break into the paid software realm to test out the difference of features. Immediately it was a night & day difference of the HTML generated. Features I was unaware were stripped in my previous solutions were rendered with pixel perfect accuracy. However, knowing I wanted to generate some large PDFs full of images - it seemed the SaaS offering was just a bit too expensive and limited for what I wanted to do. I once again didn't want to dive further into integration with a platform when the cost barrier would rise high until I eliminated all my other options. ---  #### Gotenberg A docker container powering queue systems for headless Chrome, LibreOffice and various other PDF engines. Pack full of configuration and excels at any task. [Gotenberg Website](https://gotenberg.dev/?ref=connortumbleson.com) Once I got a successful run on Gotenberg I believe I found my winner. The documentation started with a very basic sample with a CURL command. ```curl curl \ --request POST http://localhost:3000/forms/chromium/convert/url \ --form url=https://my.url \ --form landscape=true \ -o test.pdf ``` It booted up Chrome and handled all the stress that I previously encountered when it was my responsibility to wire up Chrome with another option. Just like that a PDF was generated and it looked pixel perfect - holding the power of the large Chromium behind it. As I ramped up the pages and the image count - it offered an asynchronous mode and built in queue system. Having these features built in were amazing as you could queue up many document converts and let it do the rest - sending a webhook when done. As I configured this service further I loved the configuration it offered. Don't use LibreOffice? Just don't start it - so the container remains quite slim with memory use to only what you are using. Scaling horizontally with many containers couldn't be easier and with a $0 price tag and over 40 million downloads - it seems like others agree. ---  #### Typeset.sh ($) A PHP solution with not much documentation, but a demo that shines with flexibility and features. [Typeset Website](https://typeset.sh/en?ref=connortumbleson.com) At this point I was pretty solidified on Gotenberg, but I had to push forward to try my final option. As I extracted my HTML from the previous solution I shoved it into Typeset's demo and a few seconds later I had a fairly amazing looking PDF. A test 2x2 image grid looked malformed and pushed onto a new page, but otherwise looked crisp and clean. However, knowing I had a $0 option and this holding a price tag I wasn't going to spend much effort on it. It may very well be a cheap professional option compared to the offerings of say Prince, but neither of those presently could compare to Gotenberg. --- All in all if you scroll to the bottom of this. [Gotenberg](https://gotenberg.dev/?ref=connortumbleson.com) is the way to go and my winning HTML to PDF solution. It surpassed my expectation in every test and was easily configured in both deployment and local usage. ### Food & Fall Weekend URL: https://connortumbleson.com/2024/10/28/food-and-fall-weekend/ Last updated: 2025-02-04T11:42:07.000Z  Fall Fest at [Keel Farms](https://www.keelfarms.com/?ref=connortumbleson.com) As the weekend neared the girlfriend and I had one more fancy dinner prior to the two day break. As we both enjoy a great steak we have been visiting the fancy steakhouses around Tampa. This time we were visiting [Ocean Prime](https://ocean-prime.com/locations-menus/tampa/?ref=connortumbleson.com) that offered both an extensive seafood and steak menu. I couldn't rock my usual shorts/t-shirt where we were going. A bit of a fancier set of an attire to match the gorgeous +1 and we were off. Something about the venue at an elegant place just sets the mood for the meal. From walking in and getting greeted and being sat with champagne immediately poured is quite the experience. Unfortunately for myself with such an elegant meal - I failed to take photos of all the food and instead only have my wedge salad.  Ocean Prime - Wedge Salad The steak melted in my mouth and was extremely good. Each bite had the perfect combination of fat & meat with a side of hollandaise sauce. As we ate I was always amazed as the cocktails came out in a mixer glass and were poured into chilled glasses at the absolute perfect level - never overflowing the glass. One drink even had dry ice in it making a constant smoke cloud that drifted onto the table. 💡 Once we finish hitting the top ten steak houses in Tampa - a new blog will be made. As the weekend arrived - we were off again this time to [Keel Farms](https://www.keelfarms.com/?ref=connortumbleson.com) in Plant City. I live in Temple Terrace so it makes a trip to Keel Farms just one road winding through the rural part of Florida to the farm. It was crazy to see so much flooding and destroyed homes as far inland as we were. It just showed that with back to back hurricanes of [Hellene](https://connortumbleson.com/2024/09/30/hurricane-helene-tampa/) and [Milton](https://connortumbleson.com/2024/10/14/hurricane-milton-tampa/) \- a lot of folks lost homes. As we arrived, things at Keel Farms looked a bit different with police presence and traffic cones everywhere. We went along our way through guides and parked in an assigned spot - it turns out we had arrived during Fall Fest. An event every single weekend in October where Keel Farms hosts 40+ vendors, offers hay rides and much more.   Cider flight & nacho fries. So while folks hurried out to the vendors as the farm opened - we opted to grab a seat at the bar and enjoy some cider & food. The place got busier by the minute and what was once an empty bar and restaurant had almost every single table/seat taken. Now that I've tried every single cider I'm less tempted to get a flight of varieties I know I might not enjoy. Paired with not being a fan of pumpkin drinks led to me getting ciders I know I'd drink. We got some nacho fries and any time a dish has pickled red onions I'm immediately a fan. After our drinks were done - we got one to go for exploring the vendors. Lesson learned its a bit difficult to wander among hundreds of people with a plastic glass of water & cider. We passed one vendor ([15olives](https://www.15olives.com/?ref=connortumbleson.com)) selling olive oil and flavored vinegar and I was already convinced I was spending some money.  vinegar & olive oil from 15olives I left with: - 2 Mango Sriracha Infused White Balsamic Vinegar - 2 Robust Extra Virgin Olive Oil - 1 Elderberry Infused While Balsamic Vinegar I've already tried the mango vinegar with some chicken and it added a nice blast of flavor. I burn through olive oil so much so can't wait to try out some salad, steak, onions and other items with this new robust olive oil. With one quick trip back to the car to drop off the heavy olive oil we went back inside to grab a real meal after only eating some french fries. A salad for both of us that I forgot to snap pictures of and we were exhausted. Wandering around in the sun with hundreds of other people really does steal the energy. The weekend went on with friend's birthday and watching their band perform, but I crashed early in the night from the exhaustion of a workout and fall fest. When Sunday morning arrived I knew it was going to be a breakfast burger type of day.  [Bulla](https://bullagastrobar.com/locations/tampa/?ref=connortumbleson.com) Burger The burger was great, but as this blog hinted at - a jammed packed weekend meant the chores had caught up to me. Open source work, a work emergency, mowing, laundry and more stole the rest of my weekend. Halloween is near which means October is almost over, which means this year is going by fast. At least I get to slow down every once in awhile and enjoy some ciders with some company. ### Decaying Technology URL: https://connortumbleson.com/2024/10/21/decaying-technology/ Last updated: 2025-02-04T11:42:07.000Z  OpenAI creation A few weeks ago I received an email about a price update to my cPanel software. > Thank you for being a valued cPanel customer. > > We want to inform you of an upcoming price adjustment that will take effect for all cPanel accounts and services starting **January 1, 2025**. New pricing will also apply to any orders placed after **December 16, 2024**. I don't really want to use cPanel anymore, but there is this fatigue about change compared to the effort of moving off a solution. Hell, I used to pay $170/year for a cPanel license and now I pay over $50/month and been doing so for years. Now I want to finally get rid of this server (cPanel box), but its been a multi-year problem. To roughly summarize some of them: - Moving friends/family off the server who aren't very technical to their own solution. - Moving sites so old they only run on PHP 5.6. - Moving sites when I don't control the DNS and unable to reach the respective party. - Moving a site that is successful with a 40gb database with 0 downtime. Now every year during price hikes I've just accepted it on the account of fatigue and 0 time. Now with cPanel upping my price even further because of an End of Life (EOL) operating system - my needle is being pushed further to resolving this.  At times I just want things to work and work for near forever and I know that's a selfish belief. I'm happy at least with Linode that continues to just migrate my Linode with 0 effort on my part between new virtualization and data-centers. This is a stark comparison to some of the big cloud providers who deprecate something as fast as they introduce it thus breaking something I depended on. It reminds me when TOR broke all v2 URLs forever because they were insecure. For all the solutions/sites that hadn't migrated - they were lost forever as the amount of nodes running v2 compatible relays fell. 💡 In September 2020, Tor started warning onion service operators and clients that v2 will be deprecated and obsolete in version 0.4.6\. Tor Browser started warning users in June, 2021. In October 2021, we will release new Tor client stable versions for all supported series that will disable v2. [https://support.torproject.org/onionservices/v2-deprecation/](https://support.torproject.org/onionservices/v2-deprecation/?ref=connortumbleson.com) It reminds me of this one work exchange we had. We had a piece of purchased software we used and as updates came out - they announced they would no longer support version x of the underlying code it ran on. We knew about this, but the software still worked so it was a tough sell to the client until something actually broke. Years went on and the client had an issue with the software. We triaged and determined we finally had a forced reason to upgrade to the new version of this piece of paid software. However, we took so long that this wasn't a simple little upgrade as tons of pieces under the hood needed to move with it. So I always wonder whether in work or hobby - do you do the little amount of tech debt cleanup every so often or push it off until it becomes absolutely required in a huge mess of related items? I'm torn because if you look at the Node ecosystem that stuff moves very quickly - I remember just a few years ago using "[gulp](https://gulpjs.com/?ref=connortumbleson.com)", then it was "[webpack](https://webpack.js.org/?ref=connortumbleson.com)" and now its "[vite](https://vite.dev/?ref=connortumbleson.com)". If you look at the open source space of software its a never ending battle of monetizing free software (Redis, Elasticsearch, Terraform) which pits licensing vs forking into a constant battle. You follow your favorite OS and one day they decided to end it entirely (CentOS) and tons of forks emerge. Where do you go? What do you do? All I know is I have a greater respect for the "maintenance" cost of anything digital. This stuff never stops moving and if your software/project/thing doesn't - it'll just stop working one day. ### Hurricane Milton & Tampa URL: https://connortumbleson.com/2024/10/14/hurricane-milton-tampa/ Last updated: 2025-02-04T11:42:07.000Z  It was just a few weeks ago that [Hurricane Helene](https://connortumbleson.com/2024/09/30/hurricane-helene-tampa/) struck Florida and left my folks and others home completely flooded. So when news of a CAT5 hurricane in the gulf approaching Florida was known - people of course had a reason to panic. In masses people evacuated Florida ahead of the late Wednesday storm. With that rush of people leaving we saw grocery stores, gas stations and home tools (plywood, generators, etc) emptied out. Personally after evacuating for Hurricane Irma and finding my evacuation home more damaged than my home - I opted to stay regardless of what the forecast or trajectory had. Going to the grocery store prior to a major hurricane is an absolute madhouse. I remember seeing the water isle completely empty and people crowded around the employee back storage just awaiting a pallet of water to be rolled out. However, none of that compares to what happened after the storm. As we sat watching the live weather reports - the rain pelted and the wind picked up. Each gust eerie as the windows and doors rattled/bent in the power of a hurricane. 0:00 /0:10 1× A short 10 second video I made while trying to catch some of the storm, but the wind was so powerful and the rain hurt against the skin that it ended up being quite a brief clip. The rain captured though was a perfect example of how much rain we got in such a short time.  My Weather Station rain report Now I'm not sure why my weather station looks the way it does, but this helps show my little rain station got plenty of rain until the hurricane passed my area. So when I awoke I quickly went out to check the backyard - I wanted to see if I lost any trees or fence posts. Prior to that though, I was amazed as I checked my network that I never lost power once. As I stepped into the backyard - to my amazement - not a single fence piece was broken and outside of some branches and fallen avocados - nothing in the backyard was damaged. I wanted to see how my mailbox handled the situation and that's when my attitude changed. I opened my front door and was immediately startled.   6:00am photos outside home on October 10, 2024 I saw standing water in the street and partially covering my driveway/sidewalk. This made no sense to me as I looked to the right and saw no water, looked to the left and saw even deeper water. I was trying to figure out what happened, so I busted out my kayak and started building it.  6:30am kayak adventure As I kayak\`d around at 6:30am I ran into people filming me - who were probably going through the same set of emotions to see their street flooded. At this point as I saw trees collapsed and couldn't quite figure out where all this water came from. Sure some of the retention ponds had crested, but the tiny stream that connect the retention ponds had not. So at this point I was starting to believe it was the storm drains that weren't draining. Now unfortunately I don't have any GIS data or topographical map and my assumptions would probably be wrong, but this is what it seems like. 0:00 /0:04 1× City pumping water machine Some storm drains work, others do not. The city arrives with pumps and moves the water from one flooded storm drain to a working one. This makes no sense to me as it would suggest different underground network of water. So after failing for an hour to find any maps to validate my concerns - I requested this information from my local government (Temple Terrace, FL). The water with a single pump was working extremely slow as it was probably draining a few retention ponds, storm water and more. The water didn't drain that quickly - my car (Hyundai Sonata) could not pass through the water until Sunday. 0:00 /0:07 1× 8:30am kayak adventure So while it looked beautiful, it was quite sad we still had damaging amounts of water not yet drained. It was damaging because you always have assholes even in your own community. These were people who drove through lawns to try and avoid the water - at the cost of breaking automatic sprinklers and damaging the lawn. You had people who drove lifted jeeps and trucks through the water causing wakes that crashed into cars and garages, which might have been the extra inches that ruined a car or garage. As Sunday arrived and the water was finally almost gone - it was time to get to work preparing debris piles for pickup. While that was going on I noticed a large amount of police cars in the neighborhood and they were just going house to house. Getting curious why that was - they finally arrived to my house and walked up. The conversation in bullet points went roughly like this: - Water from Pasco (north of Hillsborough) is releasing water into Cypress Creek. - Cypress Creek runs into Hillsborough River. - Ponds in our neighborhood are fed with runoff from that. - They expect water levels to rise and urging homes to consider moving their cars off the street/homes as the storm drains are still at capacity and not yet drained. - They issue a volunteer evacuation in case the water arrives for select homes. - They are bringing more pumps and building makeshift dams to prevent damage to homes. So of course that catches me off guard as I figure I'm almost out of this mess. I check our local neighbor group and everyone is discussing the various iterations of the story they got. So I decide to go investigate these claims in person.    All I learned was it gets dark quick once the sun goes down. The damage from the assholes who crossed lawns was visible and having multiple pumps cleared the standing water extremely quick. I didn't see any dams or higher water level, so I returned home with some pictures and bug bites. So for now I don't know what to expect, but perhaps I'll wake up with more water outside. ### MKBHD & Wallpapers. URL: https://connortumbleson.com/2024/10/07/mkbhd-wallpapers/ Last updated: 2025-02-04T11:42:08.000Z  About a week ago I saw a [tweet](https://x.com/MKBHD/status/1838359406976590101?ref=connortumbleson.com) from Marques (MKBHD) advertising a wallpapers app. For those unaware Marques is a YouTuber who reviews technology and has been doing it for a long time. I trust him on reviewing technology and \~20 million other people watch him do just the same. So when I saw this advertisement for a wallpaper application I was skeptical because I personally don't understand why folks would need more wallpapers than what the stock application provides. I then saw the price tag for premium features: **$12/month** OR **$50/year** This is a guy I respect during tech reviews shelling some application to his followers that had a huge optional price tag for wallpapers. Like I continue to think about this and can't fathom who would think spending a recurring charge on wallpapers is a good idea. Like this price rivals streaming services and these are wallpapers for your phone. I can understand supporting artists and their work, but as I glanced photos of the wallpapers a large majority just felt like instantly generated AI creations so I wasn't convinced.  I then saw folks [online](https://www.reddit.com/r/mkbhd/comments/1frixv8/megathread%5Fmkbhd%5Freleases%5F50yr%5Fpanels%5Fwallpaper/?ref=connortumbleson.com) (Reddit) complaining about the permission requirements for this application and it looked like a serious set of permissions. Though I knew from submitting applications via work that you include one advertising library and all of these tracking permissions come along - unless you strip down your analytics to a bare minimum. So then I started thinking - did MKBHD test his own application? If I tested my own wallpaper application and it requested location permission and more - I'd feel uneasy no matter the financial gain of such data. I mean I lose money monthly on [Leaf](https://connortumbleson.com/2023/04/17/project-leaf/), but it has 0 ads, 0 trackers and provides benefit to Halo players. At this point I thought I was complaining about something when I can simply ignore it, which is true, but I had to dig further. I saw this quote from Marques (MKBHD) that showed the profit split was 50%. > We have a bunch of awesome artists over there that we are splitting profits with 50/50 and there’s already a ton of great collections of art and much more incoming... > [https://beebom.com/mkbhds-panels-wallpaper-app/](https://beebom.com/mkbhds-panels-wallpaper-app/?ref=connortumbleson.com) It just seemed so odd to me. The app stores (Apple/Google) generally take 30% of all in-app purchases, but this profit share was 50/50\. If you consider other services like Spotify or Etsy it ranges from 6% to 30%. So the infrastructure to host some images for download seemed like a relatively cheap cost per user, so the 50% cut seemed high. So then I peeked the [terms](https://app.termly.io/policy-viewer/policy.html?policyUUID=c66ff611-4613-482d-bae5-d6cdb362d1c6&ref=connortumbleson.com) / [privacy](https://app.termly.io/policy-viewer/policy.html?policyUUID=ac8195d8-fe69-4d17-9420-08be363bdc13&ref=connortumbleson.com) and it seemed like a ton of text for a simple application.  However, I started thinking about the regulation around a marketplace and the legal department that may surround a highly popular YouTuber and it seemed at that point like a normal amount of text. So at this point I was ready to just ignore this and call it a day, until I spotted a GitHub repository that had a bit of fun. ``` /$$ /$$ /$$ /$$ /$$$$$$$ /$$$$$$ /$$$$$$$ | $$$ /$$$| $$ /$$/| $$__ $$ /$$__ $$| $$__ $$ | $$$$ /$$$$| $$ /$$/ | $$ \ $$| $$ \__/| $$ \ $$ | $$ $$/$$ $$| $$$$$/ | $$$$$$$ | $$$$$$ | $$ | $$ | $$ $$$| $$| $$ $$ | $$__ $$ \____ $$| $$ | $$ | $$\ $ | $$| $$\ $$ | $$ \ $$ /$$ \ $$| $$ | $$ | $$ \/ | $$| $$ \ $$| $$$$$$$/| $$$$$$/| $$$$$$$/ |__/ |__/|__/ \__/|_______/ \______/ |_______/ Because selling out is bad ``` source redacted due to arguable theft. It seemed this researcher discovered that the API in the application had no authentication between free/premium wallpapers. So they just provided a script that downloaded every single wallpaper from the application for free instantly. Now I can't really support that behavior, but I can sure confirm it.  All wallpapers easily accessible. So I started just summarizing this and it felt just sour. - An ad/privacy-invasive application for the "free usage". - An insane cost ($12/month or $50/year) for premium wallpapers. - A marketplace chuck full of AI images. - An application with no security on endpoints. - An application full of ads for every single action. The good news I can just ignore the application, however prior to ignoring it wouldn't be fair to leave out the updates and response to this negative feedback.   It seems MKBHD is trying to course correct after a rocky launch of a product and the updates promised are being delivered one by one. I'm not interested in a wallpaper app and my journey investigating this application is over. The app may thrive or fail - I just won't know it. ### Hurricane Helene & Tampa URL: https://connortumbleson.com/2024/09/30/hurricane-helene-tampa/ Last updated: 2025-02-04T11:42:08.000Z  A few days ago Hurricane Helene struck Florida as a CAT4 storm bringing some large storm surge and destroying homes all around. This storm geographically though didn't really go near Tampa and instead went up to the panhandle portion of Florida for a direct hit around Cedar Key. However, the rain it brought into Tampa was way more than we previously had with the heavy rain in the beginning of [September](https://connortumbleson.com/2024/09/09/tampa-flooding-sept-2024/) \- this was enough water to destroy homes. I sadly knew when I awoke on September 27 that things were going to be bad based on one image. For context - lets jump back to August of 2023 during Hurricane Idalia when I tweeted this image out.  [https://x.com/iBotPeaches/status/1696877317165846687/photo/1](https://x.com/iBotPeaches/status/1696877317165846687/photo/1?ref=connortumbleson.com) I found the tide and currents data for the marker nearest to my parent's place was the best indicator of the water level of the bay. At this point in 2023 the water level had breached the seawall and was inching its way up the grass to the house. So figured if that happened at simply "minor" flooding it would only take \~1.5ft more to have water touching the house. So when I awoke on September 27 and checked the same marker it looked far worse as it breached into the "major flooding" category.  [https://tidesandcurrents.noaa.gov/waterlevels.html?id=8726384](https://tidesandcurrents.noaa.gov/waterlevels.html?id=8726384&ref=connortumbleson.com) At this point I knew the parent's house was going to be in some trouble as that would mean an increase of roughly 2.5ft of water level compared to the last "close call". However, I was behind time because they knew at \~1am when their camera caught the sad truth.  A simple set of photos which includes a photo from two days prior to the storm and a photo at 1:15am on hurricane day. It's clear once you realize the depth of water against the pillars that this is 1-2ft of water against the house. Too bad the hurricane struck at night when it was tougher to see what was going on. What I knew though looking at this photo is that the marker chart showed the highest level at 1:23am which then would begin receding so this photo was pretty much as bad as it got. So at this point there was nothing left to do but wait for roads to be passable and head on down there to investigate. What was misleading from Google Maps is the roads said open, but nearly all lights were out on the specific road down. There is nothing more infuriating than pulling up to a multi-lane intersection with no working stoplights. Some cars just assume it means blast through the intersection to the risk of anyone. Others sit calmly with never enough confidence to move and most just push into the intersection honking non-stop. Though once I made it onto the final street towards the house - I knew it was going to be bad. The dash-cam video doesn't give it justice because you don't know the prior, but seeing the debris in places it shouldn't be gave me a rough idea of the water line. 0:00 /0:08 1× driving into the neighborhood The first photo I took when I arrived was not much until you look deeper.  initial damage photo At first glance it may look like just a rough storm, but then you started noticing the debris line and its uniformed line all around the house. The mind then starts drawing the visual that water was up and against the home in a full circle. I walk around recording some videos and realize the once full set of 5G bars I had has been reduced to 1\. The house has no power so my ability to send videos and images back to others is extremely limited, so I just explore and prepare to go inside. Before I get a chance though I see some folks walking the street and a conversation sparks. They are apparently a few homes down and mentioned 3-4ft of water and how the water came from the street before it came from the bay. These folks were more interested in discussing the house of someone who was out of town - as the expensive cars in the garage were floating at the high point. Not my neighborhood or people so the conversation ended and I went back to exploring. One thing I was trying to figure out as I walked around the house is whether anything was broken for entry for the water. However, that's a childish thought because water can get in through anything. So while I spotted zero damage on the outside it was clear as day through the windows that water was inside. Not my place to go further into this blog with a place that is not mine, so I'll end this blog with one other photo I took and a few comments.  measuring water line inside the house As I walked through the parent's house documenting photos & videos for insurance - the smell in some areas was absolutely disgusting. It had to be a mix of sewage and bay water that saturated the ground. It also feels extremely weird when your shoe steps cause squishy noises when walking around inside on hardwood. It seems the effort that was taken prior to the storm of just putting stuff on top of other stuff saved some major things (chairs, belongings, computers, etc). As I walked room to room examining the water/debris line - it seemed extremely lucky that the water line was never above the outlet. Our restarting of the power was done carefully and went roughly like: - Unplug everything. - Turn all breakers off. - Turn main breaker on. - Walk around & wait. - Turn on AC breaker(s). - Wait around & wait. - Turn on X breaker & walk around and wait. 💡 A circuit breaker full of unlabeled breakers absolutely sucks. You get the idea - we quickly learned there was an outlet on the ground that was submerged in water - it sparked and smoked when given power instead of throwing the breaker. Clearly the guides say wait for a professional when messing with electricity, but for a sub 12 hour turnaround to getting AC back on and that 94% humidity cleared out will work wonders for the repairs. I'm guessing in the long run whether appliances power up or not - they'll probably have a shortened life due to submersion of disgusting water. This isn't my house/story to share. The damage is done - the recovery begins. ### Conferences URL: https://connortumbleson.com/2024/09/23/conferences/ Last updated: 2025-02-04T11:42:09.000Z  Photo by [Teemu Paananen](https://unsplash.com/@xteemu?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) Over the last month I attended three different conferences around Tampa and that was more than I attended all of last year. Every conference I feel like I want to dump some thoughts on somebody about said event, but this time I just want to generalize it all from 10 years of conferences and blog about it. ### Networking There is no doubt in my mind that networking at conferences is the best use of attending one. You just never realize if that connection you made, conversation you had ends up helping you down the line or in reverse you helping someone else. Not only that but catching up with previous coworkers or technology like-minded folks is amazing. Trading conversation about projects, tools or rants with people that understand the context is something you didn't have when explaining mod chips at the dinner table 20 years ago. So always a wonderful change of pace to talk some real nerdy stuff with a different group of people to hear different perspectives than you might not find with friends/coworkers. ### **Talks** This is where I have the most conflicting thoughts in my head regarding conferences. The amount of times I read a synopsis or title and attend a talk and then have the talk let me down is larger than I'd like. Take for example a topic that was "xxx security" and then the first 30 minutes was explaining in mega details of what "xxx" was. I just felt so depressed sitting in that talk learning the absolute basics of some terms and then learning next to nothing about the security aspect. If talks offered a scale between "novice" and "advanced" perhaps that might help folks judge whether to attend a talk or not. Next is the talks that are clearly just a long winded advertisement for some company. A few talks I've attended just felt so odd - like Wikipedia level explanations of topics followed by far in-depth details about some platform/service that would make something better. I understand these companies probably sponsored a large chunk of said conference, but to misrepresent a talk to sell a service/product is just insulting to me. However, the times I sit in a talk and are blown away from the knowledge or speaking skills of an individual outweigh the negative and these experiences make it worthwhile. ### Swag  [Double Conference Day](https://connortumbleson.com/2024/04/08/double-conference-day/) blog post Conference swag is a mixed bag for me. At one point in my life where I was attaching every sticker I got onto my desktop - I wanted more of them. Now at a different point in life with computers without stickers, it just seemed like stuff I had to carry along all day and just wasn't interested. Now a t-shirt I'm always down to obtain because that's a great shirt to wear at local meetup events to spark conversations. I just believe I am attending a conference for networking and talks so grabbing a bunch of swag like items is never high up on my list. Generally swag I obtained (like pictured above) is when its given in batch along with the t-shirt. ### Venue I've come to really appreciate any venue a conference is hosted, especially if the cost of attending was zero. I say this because just organizing little technology meetups there is often a challenge of finding a venue that is either free or relatively cheap to book. If you find success with a topic/meetup that only grows the following which makes finding the next sized venue just a bit more difficult. So when I attend a local Tampa conference whether its 20 people, 200 people or 1,200 people I'm just extremely appreciative of the effort of organizers who solidified that choice. I can't imagine the logistics for a large conference and the trust a venue places in a group of random people to not absolutely regret their choice. --- Now I'm far from a conference regular, but I'll make a solid effort to attend interesting conferences around the Tampa area. Hopefully I can speak at most of those, but much like I tend to critique every aspect of a conference that doesn't exclude me - as I can always improve on my own speaking. A Cicada 3301 talk awaits in October 2024, but this is a simple meetup so I'll probably have to wait till 2025 for another round of conferences. ### Apktool v2.10.0 Released URL: https://connortumbleson.com/2024/09/17/apktool-v2-10-0-released/ Last updated: 2025-02-04T11:42:09.000Z  Apktool v2.10.0 has been released! This release is feature packed including parallelization, reproducible builds, retiring Proguard and an upgrade to baksmali/smali. If you aren't interested and just want the changes and download - head on the bottom or the [doc site](https://apktool.org/blog/apktool-2.9.0?ref=connortumbleson.com). --- **Parallel Execution** Lets start with the introduction of parallel jobs to speed up Apktool's execution. Contributed via Gregrant this now automatically detects the amount of core available (or respects the `--jobs n` parameter) and can be seen in Apktool's output. ``` ➜ apktool-2.10.0.jar d facebook.apk -f I: Using Apktool 2.10.0 on facebook.apk with 8 thread(s). // 23.72 seconds ``` For those interested in the technical details - we don't yet parallelize the actual resource tasks - those are treated as one job, but simply off-load each baksmali/smali task to its own thread. ``` ➜ apktool-2.10.0.jar d facebook.apk -f -j 1 I: Using Apktool 2.10.0 on facebook.apk with 1 thread(s). // 80.56 seconds ``` Take for example the Facebook application that went from 81 seconds to 24 seconds for a full disassembly. This is slicing more than half of the execution time! **Reproducible Builds** In today's age its becoming increasingly valuable to audit open source software so you the reader can confirm the archive I distribute is equal to what is living in source control. Prior to Apktool 2.10.0 a generation of an archive would not often create a release with the same hash as the prior. Research and execution was put to follow [reproducible build's](https://reproducible-builds.org/?ref=connortumbleson.com) guide  left (2.9.3) & right (2.10.0) The greatest win was ensuring the packed jar did not touch each file with the day/time that the archive was created. This plus a few other changes helped Apktool have a reproducible build. The next release will take this further as we explore [attestation](https://github.com/iBotPeaches/Apktool/issues/3589?ref=connortumbleson.com) and moving the release process into GitHub Actions for a fully automated solution. **Retiring Proguard, Hello R8**  [r8 docs](https://r8.googlesource.com/r8?ref=connortumbleson.com) While on the journey to reproducible builds I learned Proguard was part of the reason I could not have a reproducible build. I started with an [issue report](https://github.com/Guardsquare/proguard/issues/394?ref=connortumbleson.com), but I knew that it was time to retire away from Proguard. Google had been working on R8 for years at that point and open source Proguard was starting to age so Apktool transitioned to R8. v2.11.x will be the next large feature release, but a branch v2.10.x exists for security/urgent fixes. We will try and support the last release or two until it doesn't seem worthwhile. --- **Sponsors** I launched [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com) to help provide another alternative for folks showing appreciation. I want to remind folks of two companies that continue to hold a monthly donation for the project. - [Emerge Tools](https://www.emergetools.com/?ref=connortumbleson.com) came online to sponsor the tool. - [Sourcetoad](https://sourcetoad.com/?ref=connortumbleson.com) (self employer) additionally joined to sponsor (as well as a few other projects). --- **This release had 144 commits by 11 people & 1 robot.** - 99 commits - Connor Tumbleson - 34 commits - Dependabot (Robot) - 2 commits - tutacat - 1 commit - Al Sutton - 1 commit - Aleksey - 1 commit - Alex Popov - 1 commit - Arjuna Kumar Mohanta - 1 commit - Matvei - 1 commit - Pavel - 1 commit - codebymikey - 1 commit - luk1337 - 1 commit - topminipie --- # Changes since 2.9.3 - \[[#3476](https://github.com/iBotPeaches/Apktool/pull/3476?ref=connortumbleson.com)\] Add parallelization to `decode|build` command. (Thanks Cregrant) - \[[#3559](https://github.com/iBotPeaches/Apktool/pull/3559?ref=connortumbleson.com)\] Add reproducible builds (drop Proguard for R8). - \[[#3683](https://github.com/iBotPeaches/Apktool/pull/3683?ref=connortumbleson.com)\] Add automatic selection of latest apktool to helper scripts. (Thanks codebymikey) - \[[#3681](https://github.com/iBotPeaches/Apktool/pull/3681?ref=connortumbleson.com)\] Add support for final API 34 (Vanilla Ice Cream) - \[[#3602](https://github.com/iBotPeaches/Apktool/issues/3602?ref=connortumbleson.com)\] Fix stripping of `META-INF` files for xmlpull. - \[[#3512](https://github.com/iBotPeaches/Apktool/issues/3512?ref=connortumbleson.com)\] Fix disassembly of Facebook. - \[[#3536](https://github.com/iBotPeaches/Apktool/issues/3536?ref=connortumbleson.com)\] Fix treating `stamp-cert-sha256` as unknown file. - \[[#3578](https://github.com/iBotPeaches/Apktool/issues/3578?ref=connortumbleson.com)\] Fix treating non-main class dex files as compressed. - \[[#3583](https://github.com/iBotPeaches/Apktool/issues/3583?ref=connortumbleson.com)\] Fix misalignment on namespace restriction from serializer. - \[[#3618](https://github.com/iBotPeaches/Apktool/pull/3618?ref=connortumbleson.com)\] Fix resource leak on unclosed ZipFile on framework install. - \[[#3634](https://github.com/iBotPeaches/Apktool/pull/3634?ref=connortumbleson.com)\] Fix resource leak on unclosed streams on manifest disassemble. (Thanks azotzot) - \[[#3657](https://github.com/iBotPeaches/Apktool/pull/3657?ref=connortumbleson.com)\] Fix sort order of files on tmpfs filesystems. (Thanks luk1337) - \[[#3676](https://github.com/iBotPeaches/Apktool/pull/3676?ref=connortumbleson.com)\] Fix tabs/spaces in linux helper script. (Thanks alexpopov) - \[[#3519](https://github.com/iBotPeaches/Apktool/pull/3519?ref=connortumbleson.com), [#3601](https://github.com/iBotPeaches/Apktool/pull/3601?ref=connortumbleson.com), [#3690](https://github.com/iBotPeaches/Apktool/pull/3690?ref=connortumbleson.com)\] Upgrade baksmali/smali to `3.0.8`. - \[[#3459](https://github.com/iBotPeaches/Apktool/pull/3459?ref=connortumbleson.com), [#3595](https://github.com/iBotPeaches/Apktool/pull/3595?ref=connortumbleson.com)\] Upgrade Gradle to `8.7`. (Thanks ArjunaKumarMohanta) - \[[#3509](https://github.com/iBotPeaches/Apktool/pull/3509?ref=connortumbleson.com)\] Upgrade `proguard-gradle` to `7.4.2`. - \[[#3671](https://github.com/iBotPeaches/Apktool/pull/3671?ref=connortumbleson.com)\] Upgrade `r8` to `8.5.35`. - \[[#3577](https://github.com/iBotPeaches/Apktool/pull/3577?ref=connortumbleson.com), [#3607](https://github.com/iBotPeaches/Apktool/pull/3607?ref=connortumbleson.com), [#3672](https://github.com/iBotPeaches/Apktool/pull/3672?ref=connortumbleson.com)\] Upgrade `commons-cli` to `1.9.0`. - \[[#3560](https://github.com/iBotPeaches/Apktool/pull/3560?ref=connortumbleson.com), [#3570](https://github.com/iBotPeaches/Apktool/pull/3570?ref=connortumbleson.com)\] Upgrade `commons-io` to `2.16.1`. - \[[#3670](https://github.com/iBotPeaches/Apktool/pull/3670?ref=connortumbleson.com)\] Upgrade `guava` to `33.3.0`. - \[[#3576](https://github.com/iBotPeaches/Apktool/pull/3576?ref=connortumbleson.com)\] Upgrade `commons-text` to `1.12.0`. - \[[#3646](https://github.com/iBotPeaches/Apktool/pull/3647?ref=connortumbleson.com), [#3663](https://github.com/iBotPeaches/Apktool/pull/3663?ref=connortumbleson.com), [#3680](https://github.com/iBotPeaches/Apktool/pull/3680?ref=connortumbleson.com)\] Upgrade `commons-lang3` to `3.17.0`. - \[[#3585](https://github.com/iBotPeaches/Apktool/pull/3585?ref=connortumbleson.com)\] Upgrade `xmlunit-legacy` to `2.10.0`. - \[[#3510](https://github.com/iBotPeaches/Apktool/pull/3510?ref=connortumbleson.com), [#3515](https://github.com/iBotPeaches/Apktool/pull/3515?ref=connortumbleson.com), [#3550](https://github.com/iBotPeaches/Apktool/pull/3550?ref=connortumbleson.com), [#3572](https://github.com/iBotPeaches/Apktool/pull/3572?ref=connortumbleson.com)\] Upgrade `wrapper-validation-action` to `3.3.0`. - \[[#3470](https://github.com/iBotPeaches/Apktool/pull/3470?ref=connortumbleson.com), [#3479](https://github.com/iBotPeaches/Apktool/pull/3479?ref=connortumbleson.com), [#3500](https://github.com/iBotPeaches/Apktool/pull/3500?ref=connortumbleson.com), [#3511](https://github.com/iBotPeaches/Apktool/pull/3511?ref=connortumbleson.com), [#3522](https://github.com/iBotPeaches/Apktool/pull/3522?ref=connortumbleson.com), [#3566](https://github.com/iBotPeaches/Apktool/pull/3566?ref=connortumbleson.com), [#3571](https://github.com/iBotPeaches/Apktool/pull/3571?ref=connortumbleson.com), [#3575](https://github.com/iBotPeaches/Apktool/pull/3575?ref=connortumbleson.com), [#3586](https://github.com/iBotPeaches/Apktool/pull/3586?ref=connortumbleson.com), [#3624](https://github.com/iBotPeaches/Apktool/pull/3624?ref=connortumbleson.com), [#3628](https://github.com/iBotPeaches/Apktool/pull/3628?ref=connortumbleson.com), [#3648](https://github.com/iBotPeaches/Apktool/pull/3648?ref=connortumbleson.com), [#3662](https://github.com/iBotPeaches/Apktool/pull/3662?ref=connortumbleson.com), [#3679](https://github.com/iBotPeaches/Apktool/pull/3679?ref=connortumbleson.com), [#3692](https://github.com/iBotPeaches/Apktool/pull/3692?ref=connortumbleson.com)\] Upgrade `gradle/actions` to `4.1.0`. - \[[#3471](https://github.com/iBotPeaches/Apktool/pull/3471?ref=connortumbleson.com)\] Upgrade `github/codeql-action` to `3`. - \[[#3528](https://github.com/iBotPeaches/Apktool/pull/3528?ref=connortumbleson.com)\] Upgrade `actions/upload-artifact` to `4`. ## Notes - The v2.9.x releases have moved to aapt2 being the default. If you'd like to return to the previous behavior, please use `--use-aapt1` during build stage. ## Download [Download Apktool 2.10.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.10.0.jar?ref=connortumbleson.com) - [Apktool 2.10.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.10.0.jar?ref=connortumbleson.com) - `5505ce560213730c7366589389469a1b` (md5) - `c0350abbab5314248dfe2ee0c907def4edd14f6faef1f5d372d3d4abd28f0431` (sha256) - Rename to `apktool.jar` and follow the [Instruction Guide](https://apktool.org/docs/install?ref=connortumbleson.com) if you need help. - [2.10.0 Doc Site Post](https://apktool.org/blog/apktool-2.10.0?ref=connortumbleson.com) ## Links - [Project Site](https://apktool.org/?ref=connortumbleson.com) - [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com) - [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com) - [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com) - [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com) - [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com) ### Speak, Steak & Sinkholes URL: https://connortumbleson.com/2024/09/16/speak-steak-sinkholes/ Last updated: 2025-02-04T11:42:10.000Z  badge for BSides St Pete. While sitting at work on a Friday I'm enjoying a late lunch and notice an email from the account that a few months prior declined my submission for a conference talk. > I hope this email finds you well. I'm writing to inform you of an opportunity that has arisen due to a last-minute speaker cancellation. One of our scheduled speakers had to drop out after testing positive for COVID-19. > > As a result, we have an open slot at 2:00 PM tomorrow. We would be honored if you could step in and present your submission "Reviewing Xbox & Xbox 360 Security from a Halo modder" to fill this vacant spot. I knew my idea didn't really blend to any of the tracks, so I kinda expected a decline. I didn't however expect less than 24 hours away from the conference being asked to speak at it. Before hearing of the decline I was in progress of rewriting my deck from Keynote to Canva, but I of course paused that effort when I heard of the decline. So I woke up my older Keynote deck of this talk I did way back in November 2022\. I adjusted a few things that had changed in the past few years and tried to memorize the slides and was hopefully prepared for the next day.  [slides from talk](https://connortumbleson.com/slides/2024-09-14-BSidesStPeteXboxHaloHacking.pdf) I was ready to present and hit one technicality out of the gate that my speaker notes did not appear because the computer was mirrored. So I undid mirroring and the screens were reversed - ie speaker notes to the crowd and slide deck on my screen. I could have sworn swapping those screens was in preferences, but I couldn't find the setting and I had no Internet on the device for a quick search. So I went ahead in mirror mode, which left me unaware to see the next slide or timer. Lesson learned for next time to not do that - I definitely needed the next slide to remember my place. I thought I could keep in memory a slide deck I made 2 years ago, but clearly I could not.  slide deck in gif form In my opinion my talk was a bit more rushed than I intended and folks could probably tell the few times I lost where I was in my own deck. However saying that I got plenty of questions and folks appeared to be interested so for a sub day turnaround I was happy. Every time I attend a conference I have mixed feedback from excellent talks, great networking and poor talks. Take for example this talk I attended about API security from a co-founder of a company. I was expecting to hear about some cool techniques for security, but instead the first 30 minutes was learning about terminology at a near basic level between backends and an API. We finally at one point hit a slide about techniques for API security and it was just a bullet point list of tools of like Burp, Postman, etc. I went into this talk expecting some deep dive into APIs with tooling to execute payloads, but instead it felt like a freshman class refreshing terminology and naming some tools. Perhaps what I'm looking for is a novice|intermediate|advanced marker on talks to plan out my conference day. As my talk ended I had to leave the conference early to make it across town for a fancy dinner at [Bern's Steak House](https://bernssteakhouse.com/?ref=connortumbleson.com).   steak & mint chocolate sundae I've only been to this place a few times and this visit was easily the best. I ordered the steak rare and it absolutely melted in the mouth with each bite. From running around a conference all morning and speaking I worked up quite an appetite which allowed me to eat everything on my plate. Our waiter was excellent providing an explanation of what each type of meat cut was, including how its sliced and which direction and more. It just felt like the guy was extremely knowledgeable about beef which was cool to hear. We ended up grabbing some dessert and that pushed my stomach to the limit - I could not finish the mint ice cream. The next day it was time to visit some sinkholes at a nearby park.    Existing sink hole & two new ones. A water filled sinkhole just looks like a body of water, so a bit underwhelming. However, seeing a hole cautioned off with tape suggests a new formation of a sinkhole or a soil depression. There was even another depression of soil that hadn't been fully taped off. For some reason I just expected a big cylinder to look down into and that is not what this exploration had. I'm guessing the constant rain we've been dealing with in Tampa is causing a bit of [flooding](https://connortumbleson.com/2024/09/09/tampa-flooding-sept-2024/) and increased sinkholes. Thankfully outside of a tiny storm during the conference the rest of the weekend was rain free. ### Tampa Flooding - Sept 2024 URL: https://connortumbleson.com/2024/09/09/tampa-flooding-sept-2024/ Last updated: 2025-02-04T11:42:10.000Z  On Wednesday September 4, 2024 I was about to leave work around 5:30pm and the rain was coming down hard. I opened Google Maps and everything looked pure red and my ETA home was +30 minutes higher than normal. So instead I decided to kill an hour browsing social media and then drove south to visit the girlfriend once the rain died down. The drive down was such an interesting drive as I ran across so many stalled/flooded cars. The rain had stopped but the flooding was still receding, so I got a chance to find the flooded areas. 0:00 /1:00 1× random puddle on way home. I hit one area that just messed with my head and sadly I had to cut the audio from this minute dash-cam footage due to being on the phone. As I approached this stop sign I heard a guy yelling on my right, two cars with hazards on, a train approaching, someone reversing and people splashing major water over this puddle. I took advantage of a train coming - reversed a bit and just waited till the puddle had calmed down & train had passed for a safe transition. In this one relatively safe drive for myself I saw so many cars that I presume were ruined. I'm happy I just wasted an hour at work which largely improved my drive. I can't imagine being one of those cars who rushed home at 5pm and got stuck in situations where roads got closed, people reversing off the highway and more. Lets start with a [Reddit post](https://old.reddit.com/r/tampa/comments/1f9dskg/after%5Fsitting%5Fstill%5Fon%5Fthe%5Fofframp%5Ffrom%5F275%5Fs/?ref=connortumbleson.com) I noticed where people were making 3 point turns on the on-ramp to turn around. Eventually as the police arrived and closed the ramp - they did usher the cars to officially turn around and come down the on ramp, but in the moment with no police this sounds like pure chaos. 0:00 /1:19 1× As I started watching Snapchat and reading Twitter I realized not only do you have to be worried about your own driving - you have to be worried about what a larger car will do to you. Some of these high rise trucks roll through the water at high speeds proud they have a vehicle that can traverse this condition. The wave/wake they leave behind them adds inches to an already high flood - that may be the push your car needs to flood itself. It reminds me of this news report I saw where a truck clearly provides enough power to generate waves that move stalled vehicles. 0:00 /0:36 1× Now obviously those cars were probably total losses before trucks went by, but if you trust only 10% of the comments you see online. Chances are a large vehicle going fast through water ended up causing the total loss of another without touching it. This bugs me as I saw plenty of larger vehicles plowing through water creating a wave.  image from [drivingfast.net](https://drivingfast.net/driving-in-deep-water/?ref=connortumbleson.com) It just doesn't make sense to me - its clearly better to go slow through water, but most people go fast. I guess people just wanted to get home from work at the cost of destroying other vehicles. So then I just started "doom scrolling" this weather situation and finding more and more photos that were just eye opening.  [https://x.com/Liz\_in\_TampaBay/status/1831465476578537858/photo/1](https://x.com/Liz%5Fin%5FTampaBay/status/1831465476578537858/photo/1?ref=connortumbleson.com) Take this photo which shows deep water on lanes and people encroaching into the outer/inner lane for the high ground. Some cars attempted (or missed the deep water) and ended up destroying their cars. Others just ramped onto the curb and waited on high ground for the water to recede. This wasn't a hurricane, just a regular Wednesday so folks were busy with regular routines and thus caught off guard. I live in Temple Terrace pretty far from intense flooding, but my weather station showed some insane rain with 3.42 inches an hour at 6:17pm that day. Paired with the 2.83 inches the previous day - we hadn't gotten a chance to recover the previous days rain.  [My Weather Station](https://ambientweather.net/dashboard/b23d4f26d214b45fa5f8acd00cb9313c/graphs?ref=connortumbleson.com) Once I got home I kinda lost the urge to review all the flooding damage and instead wrote this post. I believe with Tampa growing, buildings going up and more we might need to revamp some water related infrastructure.  [https://mwrd.org/what-we-do/tunnel-and-reservoir-plan-tarp](https://mwrd.org/what-we-do/tunnel-and-reservoir-plan-tarp?ref=connortumbleson.com) So I started researching massive water infrastructure projects and found the [Chicago tunnels](https://mwrd.org/what-we-do/tunnel-and-reservoir-plan-tarp?ref=connortumbleson.com) which blew my mind: - 110 miles of tunnels. - 8 to 33 feet in diameter - 150 to 300 feet below ground - 11 billion gallons of storage - Started in 1975 Sure took awhile to build, but looks like a solid solution to move huge amounts of water or even store it. I wonder if Tampa has anything in progress or started that I'm completely unaware of. I know Tampa built out the [C-135 bypass canal](https://connortumbleson.com/2023/09/11/c-135-tampa-bypass-canal/) to prevent river flooding, but this is a different type of beast of urban flooding. ### Travel Blog: Naples, FL URL: https://connortumbleson.com/2024/09/02/travel-blog-naples-fl/ Last updated: 2025-02-04T11:42:11.000Z  Photo by [Joseph Biscocho](https://unsplash.com/@biscodisco?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) As the morning struck on Saturday it was another travel weekend, making back to back travel posts on this blog. The girlfriend and I jumped in the car around 6:30am and started the navigation to Naples. An easy drive with one stress inducing event - an unsecured load being released on the highway. It all happened so fast at 80mph, but a car lost some wood/umbrellas from their car and a car behind rammed into it. This exploded the debris into thousands of pieces and that car swerved into the shoulder with junk stuck to the front of car. Brakes slammed everywhere and people swerved in/out of the settling debris. Thankfully we went through with no flat tires and no crash.  view from Pelican Bay condo About an hour later we arrived in Pelican Bay, which was an elegant expensive looking collection of homes and condos. It was the off-season, so construction was in progress and plenty of parking spaces around. We met up with some friends and decided to head to the beach, but we were 2.7 miles away by foot. This is where Pelican Bay shines in both security and elegance. You end up at a checkpoint where licenses and guest passes need to be checked. Once done you await a tram (golf cart) that takes you to one of the many beach spots.  waiting for tram at Pelican Bay Due to hurricane damage only the north beach had a working bar/grill so that was our first stop. However, the bar didn't open till 11am and we were there at 10 so our trip ended relatively quickly as we had a fancy brunch to attend. The brunch was at [Sails](https://www.sailsrestaurants.com/page/menu/champagne-brunch-menu.html?ref=connortumbleson.com), which surprised me the instant we got in range of the building. This was a brunch that had a single sitting time, but allowed folks to start their tab outside with mimosas. When we saw people dressed in suits holding champagne I felt a bit under dressed and a bit out classed.  The menu cover at Sails As we were seated alongside a few other tables - live music began immediately and staff came by with trays of donuts and more. Our table opted for "Chef's Touch" which meant we just got dish after dish delivered to share among the table. What was interesting again is we did not distribute the food delivered to our table. Once placed another staff member would divide up the servings and pass around our table.  1 oz of caviar We opted into 2 orders of 1 oz of caviar, which was a new experience for me. Learning from strict teachings from our wait staff - don't ever use a metal spoon when scooping out caviar. I guess our table was too eager as the caviar was delivered and then the porcelain spoons later. After rounds of dishes we finally hit dessert which was a ton of sugar. The video below shows just one of the various dishes we tried. It was the most elegant brunch I've ever attended and probably will remain that way for a long time. 0:00 /0:15 1× Valrhona Chocolate Soufflé When the clock struck almost 2pm - our brunch was over and I felt like a whale. I had consumed so many donuts, dishes and desserts that I felt so full. This turned out to be a problem as we had a steakhouse dinner planned that night. When dinner approached at [Chops City Grill](https://www.chopscitygrill.com/?ref=connortumbleson.com) I knew my stomach didn't have the power to consume a large steak, so I opted for a tiny 5 oz wagyu. This restaurant had the tables packed so close together and it seemed like the go-to place for Naples steak.  cheesecake at Chops City Grill We quickly learned the packed seats were related to a 30% off any wine bottles so we of course had to get two bottles of wine for the table. While I was full from the instant we got there it was a fun time and a good chance to experience a tiny amount of wagyu. The cheesecake was dense and ended up being a perfect breakfast item for the next day. --- As the next day arrived it was beach day. A long tram ride ended us at the southern part of the beach on a windy overcast day. As a Florida local the heat wasn't that strong to necessitate a constant dive into the water. So as we tanned it was becoming clear our beach day would be ended by storms and lightning. Sure enough as we were packing up it began to drizzle/rain and for myself and the girlfriend trapped on the back of a golf cart - we got partially soaked. We ended up at the north beach to grab a bite to eat under the cover of a building at [Marker 36](https://pelicanbay.org/marker-36?ref=connortumbleson.com).  Fish n' Chips at Marker 36 This was a good cheaper meal on the beach and just what I needed as my first meal of the day. A solid amount of tarter sauce, malt vinegar and ketchup was in my future as I ate every fry and fish chunk in front of me. With rain in the air we cleaned up post beach and went off to mini golf, which isn't really worth blogging about as once again - we got rained out. However, it's interesting to note that a real live iguana was sitting on one of the holes - I honestly thought it was part of the hole until it moved as a ball approached it. A couple holes later - a staff member came out onto the course and asked for us to leave as lightning was 4 miles away and he was required by law to close within 10 miles. The last two times I've been mini golfing have both been rained out unfortunately.  Filet Mignon (Prime Beef Tenderloin) This meant we were approaching our final dinner in Naples and this time we ended up at [Mediterrano](https://www.mediterrano-naples.com/?ref=connortumbleson.com) in South Naples. Sure enough with a day break to recover on my stomach I went straight back to steak and got a Filet Mignon. It was a great place with excellent tzatziki and hummus with creative decor around. You sat outside with plants suspended in the air with fans rotating & blowing the plants and sometimes leaves into your food/face. I enjoy the night humidity and feel of Florida air so felt right at home. As dinner ended we were approaching late Sunday which is when this blog needs to go live. With my first visit to Naples I was surprised on how elegant some of the meals were - I just didn't expect it. We have 1 more day in Naples, but the post must go out on Sunday. ### Travel Blog: Anna Maria, FL URL: https://connortumbleson.com/2024/08/26/travel-blog-anna-maria-fl/ Last updated: 2025-02-04T11:42:11.000Z  Photo by [Paul Crook](https://unsplash.com/@goldenplover31?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) As 4pm arrived on a Friday - it was just like déjà vu that I was leaving early for another weekend adventure, but this August was jam packed with travels and more. The rush hour traffic paired with a brief intense storm turned a 80 mph highway into a 30mph crawl. The road we were on had an overpass above so the water draining (perhaps improperly) was creating an absolute monsoon as it blew across the highway. 0:00 /0:04 1× warning - loud rain sounds. The dash cam didn't have the storage loaded so the only footage I have is the girlfriend's random video of the overpass splashing water down. Thankfully that storm was brief and we finally about an hour later pulled into our cottage.  An elegant little place that was 40 steps away from the beach - however on Friday night that was a bit too late for a beach visit. It was off to walk towards our first dinner in Anna Maria and we ended up at Harry's. A place with about 8 tables inside and probably 20 outside and we got there as it started to rain so inside we went.  Burger & Harry's I got a burger with a house salad and mushrooms and it wasn't the best. The ciabatta bun probably sat with a burger on it for a bit until it was served - this meant it was soggy and just collapsed on first bite. I didn't realize ordering mushrooms was going to give me a bowl with enough mushrooms to coat 3 steaks, so that caught me off guard. However, the salad was amazing and so was our appetizers. I've been there a few times before and it's always great - so I'll let this not so great burger slide. We grabbed some ice cream on the way home and soon enough Saturday morning was here. I took off on a run and it was a bit difficult to run without hitting a dead end or water and needing to change directions.  Saturday morning run I thought I ran to the end of the island, but clearly I was mistaken so I cut across towards the pier and went the wrong direction. I was intending to go north in one large semi-circle all the way back home, but ended up with the path above. Beach day was here and boy the heat was immense. If you don't have a shade setup, then you are probably in danger of some heat problems.  A picture of a Sun Ninja, since I have no pics of our setup. We used this Sun Ninja that I'm accidentally advertising because it worked quite well even though we only had two poles with us. When I saw other groups rolling out complex solutions and I had a 8lbs bag on my back - it seemed to be better for a quick and easy setup. The sun pelted down and even trips to the gulf was not enough - we were soon exhausted as the day struck 2pm. A quick trip to the cottage pool to cool down and we were prepping for a real early dinner. This dinner (at "The Porch") was the type of meal I was looking forward to. A medium expensive, but most excellent meal. I'm glad we isolated our search to "steak" dinners as we probably wouldn't have found this place otherwise.   House Salad & Steak The salad was amazingly fresh and the steak (slightly overcooked for a medium-rare) but otherwise was perfect. Paired with sangria's and some french fries I ate food until I felt uneasy. So of course we had to get more ice cream for the walk home. Still tough to walk and eat ice cream when its above 80 degrees outside without getting a bit on you. Sunday was soon here and it was amazing how quick Friday & Saturday had passed so it was time for another run.  Sunday morning run This time I was convinced I would run to the north end of the island and I did. However, the winding roads towards the end for sure confused my reference point. My goal was the same as last time to run a semi-circle from starting point all the way around the edge of the island. Clearly I got spun around in the north, I ran back thinking I was a different way and ran the opposite direction of our cottage. For being prescribed a 30 minute run by a watch and clocking in at 49 minutes meant I had a 19 minute delay for my once again confusion. Thankfully made it back eventually and the day was starting with visiting all the little shops in town. I'm not much of a shopper but the break of getting air conditioning to look around at clothes was a positive break from the heat. We shopped the entire morning and into the afternoon and it was soon time to eat lunch and pack it up to leave. We wanted to head right back to The Porch to try more of the menu, as the lunch menu was different than dinner.   Bruschetta & Po'Boy / Salad The place delivered again with amazing quality. The tomatoes and balsamic on the bruschetta was so fresh - the bread perfect without an ounce of staleness. I moved onward to a po'boy with locally caught grouper that just melted in each bite. I had to repeat a house salad, because the dressing rivaled creations I make at home. As an excellent meal came to an end so was our weekend adventure in Anna Maria. It was apparently "off season" which surprised me so we probably won't get as lucky to get tables and meals just casually walking around with no reservations. Anna Maria looks to be primarily vacation rentals so we'll probably be back when we want a trip away from home. One more trip lined up in August to end the Travel Blog August spam as I visit Naples - in the meantime this travel post is over. ### 2024 Tour de France Femmes URL: https://connortumbleson.com/2024/08/19/2024-tour-de-france-2/ Last updated: 2025-02-04T11:42:11.000Z  On August 18, 2024 the Tour de France Femmes ended again. This time instead of directly following the [men's tour](https://connortumbleson.com/2024/07/22/2024-tour-de-france/) \- it occurred after the Olympics. The winners this year of the respective jerseys were: - Kasia Niewiadoma - Yellow (General Classification) - Marianne Vos - Green (Points) - Justine Ghekiere - Poka Dots (Mountains) - Puck Pieterse - White (Youngest "GC") For those following along last year, Demi Vollering, who I expected to win came in 2nd place by only 4 seconds. So lets recap the stages. ---  [Stage 1 Photo Gallery](https://www.letourfemmes.fr/en/stage-1/image-gallery?ref=connortumbleson.com) Stage 1 had an explosive ending with Demi Vollering leading out a presumed teammate for a sprint finish, but Charlotte Kool sped on by out-sprinting everyone for a victory by many bike lengths. This seemed odd to me as the winner of the last year's tour was leading out the sprinter(s) on her own team. I couldn't tell at this point if Vollering's team was going to target both the yellow and green jerseys, since it seemed odd that your presumed GC contender was doing a lead out train.  [Stage 2 Image Gallery](https://www.letourfemmes.fr/en/stage-2/image-gallery?ref=connortumbleson.com) Stage 2 was short (70\~ km) compared to the other days so I was confused on what was occurring and then I realized the time trial was later that day. So both stage 2 & 3 were on the same day (August 13). When Stage 2 ended we had another victory from Charlotte Kool which solidified she was a solid sprinter winning 2 stages in a row.  [Stage 3 Image Gallery](https://www.letourfemmes.fr/en/stage-3/image-gallery?ref=connortumbleson.com) Stage 3 was a time trial and it came down to just 5 seconds between 1st, 2nd and 3rd. Demi Vollering re-asserted dominance as last years winner and won the best time of the time trial at 7 minutes and 25 seconds. Having a time trial on the 2nd half of the day was such an interesting twist, because I wondered if the riders were taking the 1st stage of the day differently depending on how they wanted to preform on the 2nd stage of the day.  [Stage 4 Image Gallery](https://www.letourfemmes.fr/en/stage-4/image-gallery?ref=connortumbleson.com) Stage 4 ended with Vollering, Niewiadoma and the new young rider Pieterse all fighting for the stage win. In what surprised me - Pieterse won by a tiny bit of the bike length stopping Vollering from winning back to back stages. This stage set the stage for what I believed would be the two competing yellow jerseys - Vollering & Niewiadoma.  [Stage 5 Recap](https://www.letourfemmes.fr/en/stage-5?ref=connortumbleson.com) Stage 5 is why the Tour de France is so crazy - a crash occurred that took down the yellow jersey. Her teammate tore off from the crash and left the yellow jersey behind. My mind was blown - teammates normally support their yellow, but in this case it did not look like it was. The front of the race had Niewiadoma, Vas and Lippert racing for 1st place and Vas took the stage win which made the yellow jersey crash so much more interesting. SD Worx (Protime) won the stage, but their yellow jersey (Vollering) was lost to Niewiadoma. We then had to watch the bruised and bleeding yellow jersey ride solo the best she could as she lost time.  [Stage 6 Image Recap](https://www.letourfemmes.fr/en/stage-6/image-gallery?ref=connortumbleson.com) Stage 6 had an attack come from Kerbaol with nearly 15km left and she held on to win the stage. Not to mention a French rider winning a French race is always a celebration. For the yellow jersey we saw Niewiadoma keep an eye on Vollering as she knew she just couldn't give up seconds on a hilly stage. The top 3 changed a bit with Kerbaol jumping to 2nd with her performance only 16 seconds behind Niewiadoma. However, 2 stages of mountain racing remained which would surely shake up the rankings.  [Stage 7 Image Gallery](https://www.letourfemmes.fr/en/stage-7/image-gallery?ref=connortumbleson.com) Stage 7 was the 2nd to last stage and it was a mountain stage which changed up the placements all around. Ghekiere took the stage and solidified a good chance she'd take home the mountain jersey. What was interesting on this finish was Vollering placing ahead of the yellow jersey (Niewiadoma) by just enough to steal the bonus seconds. It was only 4 seconds stolen, but that decreased the lead to 1min 15s from Vollering - it would all come down to the final stage.  [Stage 8 Image Gallery](https://www.letourfemmes.fr/en/stage-8/image-gallery?ref=connortumbleson.com) The final stage ended in crazy fashion with attacks on attacks. On the 2nd to last mountain climb - Vollering took off and started distancing the yellow jersey (Niewiadoma) and started putting time on her. She had a minute 15s to make up, but knowing the bonus seconds of 10 for winning meant she only had to put 1 minute and 5 seconds between her and the leader. The clock on the screen jumped between 47s and 1min 15s so it was a constant battle back n forth between Niewiadoma trying to catch Vollering and Vollering trying to strengthen the gap between them. As the final kilometers approached all riders looked like they were hitting their absolute max of physical abilities with extreme pain visible on their face. Vollering finished first with an accelerated sprint finish and collapsed at the finish line to see what the next minute would hold. She won the stage so got the bonus 10 second subtraction - so Niewiadoma had to finish the race within 1 minute and 5 seconds. The camera crews showed her hitting +40 seconds with the final curve/stretch to go so it was going to be very close. Niewiadoma was racing alongside Muzic which made this further interesting because there was still 4 bonus seconds up for grabs for 3rd place. Niewiadoma and Muzic sprinted for the line as the clock hit 1 minute, then 1 minute 1 second and Niewiadoma got 4th on the day. Without the bonus seconds awarded the winner's announcement was delayed as all math was checked. Sure enough Niewiadoma kept the yellow jersey and won the Tour de France Femmes. --- As the dust settled and tour ended I still kept wondering what happened to Vollering's team and what really went down on stage 5, but I'm happy to see Niewiadoma win the tour. ### Travel Blog: St. Pete, FL URL: https://connortumbleson.com/2024/08/12/travel-blog-stpete-beach/ Last updated: 2025-02-04T11:42:12.000Z  Credit to [Sirata Photo Gallery](https://www.sirata.com/gallery?ref=connortumbleson.com) The watch ticked over 4pm on a Friday and I was sitting in a client meeting going over at work - that was the time I supposed to leave to pickup the girlfriend on the way to a weekend vacation. A few minutes later I was out the door with a car packed on the way to pick her up and head to the Sirata St. Pete Beach Resort. This was my first time spending a weekend on the St. Pete beach so I was excited to take advantage of this resort that was under an hour drive away. Immediately on arrival things looked a bit odd with a few police cars disrupting the entrance of the hotel with the parking attendant describing a "situation" ongoing. However, a few minutes later they were gone and we were parked & checked into the hotel for the weekend.  Map for Sirata Beach Resort Once we got the above map it set in that I don't really have to travel far away to attend a resort - they feel comparable and this one is under an hour away. What I mean is my car was parked on Friday and did not move an inch until we left on Sunday - the resort had us covered and we could walk to anything we needed. As dinner approached we walked next door to a beach bar that had the tables literally in the sand. It was of course all about the view and atmosphere for this place as the cold frozen drinks melted insanely fast and the food wasn't that great. Sometimes though its about convenience over quality and this was 50 steps away in the sand. As the night got darker it was time to visit the pool which would hopefully have way less little kids than the day. The cool thing we noticed is one pool was tinted red at night and the other blue. The sign said "Open dusk to dawn" and we were clearly in the pool past that with others, so guess that really isn't enforced. Same with the "no outside drinks" rule as nearly everyone had a personal tumbler cup.  6 mile run on the beach. When the morning struck on Saturday it was time to slip out for a beach run, which was a challenge of finding the best place to run that wasn't wet, but had strong enough sand to prevent your foot from sinking in. I guessed the wrong direction to run at first and hit the end of the beach just as my watch clicked at the first mile. So I double backed and went the other direction for mile 2,3 and 4 which left mile 5 & 6 for the return to the hotel. Beach running was an experience, but not something I would see doing daily if I lived on a beach. The consistency of a trail or sidewalk just makes everything so much safer on the feet.  Laying on the beach The large chunk of Saturday was beach day and boy it was hot. Even with some shade, towels, long-sleeved shirt and sunscreen re-applied consistently I still got burned. It was a fun time people watching and cooling off in the water every once in awhile. One odd thing was a family deciding to setup their tent within a few steps of us, which made no sense given that there was plenty of space everywhere else. Only after the full weekend did I begin to fully understand the "style" of each beach resort and we were generally in what I describe as the family friendly one. Other resorts looked like party central or so elegant it was for folks wanting to spend a few thousand dollars for the weekend. As the afternoon ended it was time to head to the birthday party of a friend located at Postcard Inn (PCI) Beach Bar. This party started a bit rough with the venue not remembering the agreement of the party - missing tables and catering, but with a few escalations it was resolved. The drinks at this place were a bit better than our resort, but boy it was an endless stream of what looked like college kids obsessed with non-stop partying. As the party ended and the after party began we found ourselves at Jimmy B's Beach Bar which was absolutely jammed packed with people. It was quite dark and loud so I struggled to hear or understand friends around me. I guess unless I'm also toasted beyond belief this jammed packed popular bar scene isn't much of my cup of tea anymore. As Sunday came - a recovery beach run was had and it was time to pack up and leave before things got hot. The beach weekend was over and it rained on the way home - so perfect timing with heading out on Sunday. This post ends here, but with the birthday near another beach weekend approaches. ### First Comedy Show URL: https://connortumbleson.com/2024/08/05/first-comedy-show/ Last updated: 2025-02-04T11:42:12.000Z  [https://sidesplitterscomedy.com/locations/tampa/](https://sidesplitterscomedy.com/locations/tampa/?ref=connortumbleson.com) A few days ago I attended my first comedy show in Tampa at the Side Splitters Comedy Club for a Frank Caliendo show. I was gifted a ticket to join by the girlfriend, so was excited to experience this with someone who could answer my dumb questions. I didn't know who Frank was prior to this event as comedy isn't really my thing - so this is my experience. --- # Venue Pulling into a common Carollwood area unaware that the building at the end of the strip is a comedy club was an interesting discovery. I had this notion in my head that attending a comedy show would be at like a concert venue, but this was a tiny building near an ice cream shop.  Google Maps of Side Splitters # Atmosphere Walking in I was met with photos of people everywhere which must have represented all the folks who've performed at this location. My first thought was the place looked rather cheap with very rigid metal chairs.  The waiting area prior to the show room. It kinda felt like those old school sports bars that never remodeled in 20 years. It wasn't anything to be negative about, but it just felt old. I was hopeful that once those doors opened and we were seated that the atmosphere would change, but it didn't. The chairs for someone with a bad back weren't great at all. Thankfully this wasn't a 2 hour movie, but under 2 hours of sitting in one place with solid AC. # Processes Prior to seating I was struggling to understand how this 2 food/drink minimum would be tracked, but they made it clear with signs everywhere. Drinks in the lobby did not count towards that total and your wait staff made it clear when you were at minimum. With all of us collecting in the lobby I was wondering how we were going to collectively find our seats, but Side Splitters had this down to a science. As groups walked through the door they were checked for a ticket and a revolving line of wait staff was ready to escort the group to their seat. I didn't expect the chairs to be seated around tables all facing the stage, as it made our seats (on the front) have the table behind us. When trying to place 4 drinks and a pretzel it was some awkward movement to constantly turn around for a sip or a bite. # Food/Drink The drinks were high in either sugar or liquor and once again reminded me of a cheap old sports bar that keeps people by contributing large amounts of liquor to their thought process. I was excited to order a buffalo chicken dip, but alas that item was not available this time so we ended up with a pretzel. After two years of doing bar trivia at a modern bar when this pretzel came with 2 individual long bread pieces with packets of mustard I knew I was going to be disappointed and I was. I guess that's to be expected though - this is a comedy club and not a bar/restaurant. So it was a nice snack with some liquor heavy drinks, which warmed me up for the performance. # Opening Act The performance started with videos being played about how cool Side Splitters is as well as a comedy iteration of "here are the rules". When a comedian finally went on the stage without an introduction I was confused if this was an opener or the show. Thankfully in like 2 seconds I realized this was an opening act followed by another opening act before the main comedian took the floor. For my first comedy show the 2 opening acts were rough. It seemed like both individuals were going for a "shock and awe" approach where they tested the crowd with some hot topic issue in a joke, then pushed forward or reversed depending on the crowd's reaction. One tended to tie everything back to his weight while the other tied everything back to him marrying a Cuban woman. I couldn't really get into a laugh or flow with either of the opening acts, but I guess everyone needs practice to tune this art. # Main Act When Frank finally took the stage - it started with energy and laughs near instantly. His ability to mimic voices of past and present presidents was insanely cool. Having someone jump between voices on a moment's notice is an acquired skill that is amazing to witness live. Additionally his ability to jump in/out of character was extremely elegant, which led me to understanding that impressions is just as much facial behavior as the voice. It was very fun listening to each character he could pull off and I was further surprised when the audience kept calling out more names for him to show off his skills and he delivered. I'm not sure where the line in the sand is between impressions and comedy, but they are clearly interlinked. It just seems like I can't draw comparisons to the opening acts as they had no forms of impressions. # Parking When all things were said and done - it was time for \~200 people to rush out into the parking lot to leave. Since we are trapped in a little strip center of stores in a tiny parking lot with \~200 people arriving for the next show - it was a mess. Nothing like \~200 people trying to leave and \~200 people showing up.  Long corridor of 2 entrances/exits I kid you not cars were just sitting in the parking lot trying to find a place to park, which blocked cars trying to reverse or leave. People were walking around with no care for heavy vehicles getting increasingly anxious to find a way out. Backing into a spot would have made this easier and cars arriving for the later show not clogging the parking lot would have made everyone's life easier. What felt like 10 minutes was probably not, but it took forever once in my vehicle to move a few feet. --- All in all - I had fun once the main act started and enjoyed it greatly. I guess everything else you just deal with in hopes that the main performance will be worth it. I don't think these are the type of events I'll actively seek out myself, but if another opportunity arises - I'll probably attend. ### Fast Food URL: https://connortumbleson.com/2024/07/29/fast-food/ Last updated: 2025-02-04T11:42:12.000Z  Photo by [Fernando Andrade](https://unsplash.com/@thisisnando?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) Roughly a month ago (June 8, 2024) I was driving home from a day trip to Tallahassee and I skipped dinner. Throughout the hours of driving I passed so many familiar fast food places and wanted to stop, but I didn't. I've tried to avoid fast food for the greater part of the last 6 years. It wasn't always like that - in my childhood years of being driven around to school events was a common time for a fast food stop. Carpooling with other kids meant that it often landed on the parent driving to select a place to feed the army of kids in the car. This led to a near weekly experience of places like Culvers, Sonic, Panda Express, Wendys, Goodcents, Fazolis, Schlotzskys, etc. I got pretty good at eating in a car no matter the place we went. I also discovered a crave for certain items at certain places for a quick meal.  Sonic Burger & Tots As I left high school, had a car and went to college I commonly still visited fast food places when coming back home on a day that I wasn't on campus. Of course posting a 10+ year old picture with a mess of drinks, some cloth and an order of Sonic is embarrassing. I can't believe I would order a sugary drink, ice cream, a double cheeseburger and a ton of tater tots. Of course life was different back then - I was working out in the mornings with pickup soccer during the evening. When I wasn't directly working out - I was walking around the hilly University of Arkansas campus. I could afford to eat a ton more calories than normal as my lifestyle consumed them. These days while I may workout - a good chunk of my work life is sitting in front of a computer working. So my ability to consume large amounts of unhealthy food is decreased as it'll go straight to increased weight. Though, I know fast food tastes good and I remember back to the days of frequently ordering Wendy's.  Wendy's Burger & Fries I miss a Wendy's burger with a ton of ketchup and fries, but I know what that food will do to me at this point in my life. I just don't understand how fast food is excellent from the single bite to the last - it just must be packed full of salt and chemicals. The appear has something more to be desired for some fast food, but I don't think most are judging the convenient food on the look. I have found some replacements though for the food I sometimes crave, but it'll never match the speed and convenience of pulling through a fast food line. Sandwich shops and the increase of sushi bowls / poke bowls have become my healthier option that would have previously been a stop for a burger.  Half Moon Seafood I'm happy that places like Half Moon Seafood exist - which offer what reminds me of a BBQ sandwich, but instead its fish & buffalo. A combination I would never have tried myself, but an excellent tasting sandwich that I can deem as not fast food. When I look back at my past and fast food though - what has happened to present day fast food? It seems like the brands of the past are collapsing for new blood to take its place. I researched why my local Boston Market was closing to become a "Cook Out" and the reason was funny. > When the Boston Market at East Fowler Avenue and 56th Street closed in October, it was no surprise as the rotisserie chicken chain was handling more lawsuits than customers and has now shut down all its restaurants. > [Source - Tampa Beacon](https://www.tampabeacon.com/opinion/optimism-over-options-at-temple-terrace-s-old-boston-market-abounds/article%5F48f15fb4-b705-11ee-bde4-d74af6c8be5b.html?ref=connortumbleson.com) They take a stab at the lawsuits, but I'd believe it. As I slowed my eating of fast food - it was also because every encounter was becoming just a 1 star review. Perhaps its because we as a civilization insult those working the gig, while demanding they support us as a global pandemic rolls through. Perhaps its the increasingly expensive economy to survive in with positions that can't or barely support people through it. Perhaps its any combination of something that results in experiences at fast food places that just suck. I couldn't believe it was possible to get a cold burger at Wendy's - until I did. I couldn't believe I could get entire parts of my order forgotten, yet I don't want to be the person that checks their bag sitting in a drive through line. As the customer experience took a nose dive and the quality collapsed - only a few giants probably remain as the pillars of fast food. I know I've grown past fast food, but I won't lie I crave it every now in then. ### 2024 Tour de France URL: https://connortumbleson.com/2024/07/22/2024-tour-de-france/ Last updated: 2025-02-04T11:42:13.000Z  On July 21, 2024 the Tour de France ended again. This time ending in Nice instead of the normal Champs-Élysées in Paris due to the arrival of the Olympics. The winner changed hands back to Tadej Pogačar of UAE who had claimed 2020 and 2021, but lost 2022 and 2023 to Jonas Vingegaard. This tour was going to be insane and delivered - from just a pure bullet point hit list we had prior to the start. - Tadej Pogačar returning to attempt to claim his 3rd title. - Jonas Vingegaard returning after a severe crash months prior. - Sepp Kuss catches COVID-19 and misses out on the 2024 Tour. - Primož Roglič left Team Visma to join a new team (Bora) and compete for yellow. - Remco Evenepoel joining his first Tour de France. - Mark Cavendish doing one last tour to attempt to beat the stage win record. - Jasper Philipsen returning to attempt another green jersey win. ---  [https://www.letour.fr/en/stage-3/image-gallery](https://www.letour.fr/en/stage-3/image-gallery?ref=connortumbleson.com) When the sprint stage rolled around on stage 3 it was hectic finish with a crash occurring at roughly the 2km to go mark - this meant some stage favorites were out of contention with the sprint finish. This time we had Biniam Girmay from Eritrea securing a win and that was historic in itself. We had the first black African cyclist to win a stage and it seemed we had a new top contender for the green jersey.  [https://www.letour.fr/en/stage-4/image-gallery](https://www.letour.fr/en/stage-4/image-gallery?ref=connortumbleson.com) Stage 4 was our first trip early into the mountains and this stage delivered. The pacing of UAE destroyed the peloton and we quickly saw only the few favorites left in the front of the race with a few kilometers to go on the climb. Tadej attacked and we saw that no one, not even Jonas, could stay on his wheel. With the bonus seconds awarded at top of the climb and end - it was an interesting battle. We had Remco coming in 2nd and Primož 3rd which meant the competition for the yellow jersey was already well underway.  [https://www.letour.fr/en/stage-5/image-gallery](https://www.letour.fr/en/stage-5/image-gallery?ref=connortumbleson.com) Stage 5 was the stage Mark Cavendish secured a win and broke a nearly 50 year old record of 34 stage wins by a single person. Mark now had 35 wins and sits alone with most stage wins in the Tour de France than anyone else. The last kilometer of this stage was available on my rant about [Peacock in this previous blog](https://connortumbleson.com/2024/07/08/nbc-and-peacock-tour-de-france/). It was an excellent final kilometer to watch as Mark moved around to sprint for the finish and succeed.  [https://www.letour.fr/en/stage-7/image-gallery](https://www.letour.fr/en/stage-7/image-gallery?ref=connortumbleson.com) Stage 7 had the first time trial and we had Remco winning by 12 seconds over Tadej. Remco who crashed off a bridge a few years ago was coming back stronger than ever winning more and more races. When he started the time trial the estimations showed he was going to beat the current record by about a minute, which is insane. Prior to that nearly 170 riders had raced and he was going to be the best time by a minute. It looked to solidify that Remco was a solid contender for the GC (yellow).  [https://www.letour.fr/en/stage-8/image-gallery](https://www.letour.fr/en/stage-8/image-gallery?ref=connortumbleson.com) Stage 8 was explosive with all the sprinters in contention (no crashes) and Biniam still won. This silenced a few that believed Biniam only won his last stage due to the favorites crashing out. This sprint finish was on a tiny incline so it was pretty cool to see a sprint stage slowing down due to the incline.  [https://www.letour.fr/en/stage-10/image-gallery](https://www.letour.fr/en/stage-10/image-gallery?ref=connortumbleson.com) Stage 10 came after a rest day and we saw the sprint favorite Philipsen seal the victory over the others by a solid bike length. What I noticed in this sprint is how insane it is to have Mathieu van der Poel (the UCI World Champion) leading Philipsen out - the air stream he generates and thus resting Philipsen's legs gives him such an edge to coast to the finish line with a strong kick. Not all teams are lucky enough to have such a decorated champion leading another out.  [https://www.letour.fr/en/stage-11/image-gallery](https://www.letour.fr/en/stage-11/image-gallery?ref=connortumbleson.com) Stage 11 ended with a bang having Jonas out sprint Tadej at the finishing line after crawling his way back to Tadej's wheel. This was big news as it showed that Jonas after spending almost 2 weeks in the hospital recovering from a crash was back and ready to compete. However, due to the bonus seconds being at end and top of climb - the only difference between the 2 riders was 1 second when all the bonus seconds were calculated. This was a big sign that the competition to win was going to be close.  [https://www.letour.fr/en/stage-14/image-gallery](https://www.letour.fr/en/stage-14/image-gallery?ref=connortumbleson.com) Stage 14 came after 2 sprint stages (12, 13) in which Philipsen and Biniam both won one a stage a piece. This stage though was the first sign that Tadej was just the better rider out there - putting 40 seconds on Jonas and 1+ minute on the rest of the top ten. It was quite a sight to watch Team UAE lead Tadej up the climbs until he attacked and went solo the rest of the way up. This would be a pattern we'd see on the next stage (15) as well.  [https://www.letour.fr/en/stage-17/image-gallery](https://www.letour.fr/en/stage-17/image-gallery?ref=connortumbleson.com) Stage 17 was another stage where the breakaway ended up taking the stage with Richard Carapaz (EF) winning 30 seconds ahead of Simon Yates (UAE). Richard was briefly in the yellow jersey in the beginning of the race, so to win a stage was a pretty large accomplishment for the pink jerseys of EF Education - Easypost. The GC timing stayed the same, but the polka dot jersey was moving closer and closer to Richard.  [https://www.letour.fr/en/stage-18/image-gallery](https://www.letour.fr/en/stage-18/image-gallery?ref=connortumbleson.com) Stage 18 had the breakaway winning again, but this time the fan favorite Victor Campenaerts took the victory. His interview at the end rivaled Matej Mohoric [interview](https://youtu.be/zgVp-CfNRrs?t=328&ref=connortumbleson.com) which peeked a light into the life of a pro cyclist. Victor is one who normally is always leading a breakaway, jumping the start in the beginning of every day and such a fun rider to watch compete.   Stage 19 & Stage 20 Stage 19 & 20 had Tadej just reinforce he was the best in this year's race. Both stages followed the same type of pattern where the fast pace setting of UAE dropped most of the peloton, then Tadej as the final climb approached would attack and drop the entire field. Of course these stages it went a bit different with others attacking first, but Tadej followed and counter-attacked winning both stages for stage win 4 & 5.  [https://www.letour.fr/en/stage-21/image-gallery](https://www.letour.fr/en/stage-21/image-gallery?ref=connortumbleson.com) Stage 21 was the last stage and ending on a time trail - Tadej blew my expectations out of the water and beat the best time trial time by over a minute. He even had time at the end of the trial to celebrate and put 6 fingers in the air - for 6 stage wins in the 2024 race. I believe after watching this race that Tadej, assuming he keeps his current pace, will become the greatest of all time. --- With another tour over - it'll be interesting to see the recoveries of Primož, Sepp, Jonas and growth of Remco. The upcoming 2025 Tour de France will be bound to pack a punch with either Tadej inching closer to GOAT status or a competitor taking the yellow away. ### Adult Life & Mortgages URL: https://connortumbleson.com/2024/07/15/adult-life-mortgages/ Last updated: 2025-02-04T11:42:13.000Z  Photo by [Precondo CA](https://unsplash.com/@precondo?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) Way back in October of 2020 I purchased my first home and left the apartment life behind. It was an exciting and nervous time as I paid out a down payment and moved more money at once than I'd ever done before. Who knew how many scams and spam I would get sent to me directly after the creation of a new loan. - The "[Environmental Water Resource](https://connortumbleson.com/2021/01/04/environmental-water-resource/)" scam - The "[Welcome Gift](https://connortumbleson.com/2021/01/18/welcome-gift-scam/)" scam - The "[Mortgage Life Insurance](https://connortumbleson.com/2022/10/24/mortgage-life-insurance/)" scam All this taught me was to ignore most things that arrived in my mailbox and I even blogged about that experience of [collecting 3 months](https://connortumbleson.com/2023/02/20/3-months-of-mail/) of mail. Some of these letters are pretty convincing much like the evolving landscape of scams. I wish we had a class in school that helped just run through big life choices (car, house, etc) and run through common scams and how those transactions commonly work. Take for example my first mortgage as I was closing in on my first house purchase. They explained to me an escrow account and it was the first time I'd heard of it. This was going to be a chunk of money managed by the lender that I paid forward to help cover things like home insurance & taxes. It sounded pretty cool - a few less things to manage payment for and it was built into my mortgage payments. Whether those costs were pass through or ended up being used to fund this enhancement - I don't know. I do know it was a requirement with my lender to utilize this escrow. I'm guessing its in the lender's best interest to ensure some of the heavier yearly fees are covered especially when it comes to the changing landscape of taxes and insurance. It seemed having a mortgage wasn't bad at all - you just pay and some dependent things are automatically paid on a schedule. Not to mention when you consider your monthly mortgage is basically half what you paid renting month to month - the low interest mortgage payment is an attractive way to live if you can sustain the every once in awhile large payment to fix something. This wouldn't be a blog post though if it was all fine and dandy - so lets talk about what happened when my lender decided to sell/transition my loan to a new provider: Newrez.  The warnings about loan transition Prior to October of 2023 I get the above letter and email about this transition explaining everything is getting transferred. I don't really think too much about it - my information transferred including my auto-pay and sure enough on October 1st 2023 - my monthly payment was pulled with no issue. A month later I got an email about my taxes being paid and I figured all was okay. Turns out I was far from right and should have triple checked everything the instant my loan moved companies. In December of 2023 just a few months later - I get a letter in the mail that says. > Our records show that your **hazard insurance expired** and we do not have evidence that you have obtained new coverage. Because hazard insurance is required on your property, we plan to buy insurance for your property. You must pay us for any period during which the insurance we buy is in effect but you do not have insurance. I was very confused because my home insurance was still active and the panel (Heritage) where I can review it was in good standing. So I emailed my insurance agent explaining this and they faxed over my policy back to Newrez. This is where a mistake occurred - turns out when all these parties were talking to each other - my home insurance still did not get paid. However, it did get loaded into Newrez so I was no longer in danger of getting "forced insurance". In the moment I wasn't looking into whether it was paid or not, but whether my lender knew about it. So I thought and believed everything was alright until July of 2024 when I checked my mail and had a letter from my insurance saying it was cancelled. I was quite alarmed at this and waited for business hours the next day to call Heritage.  Heritage picks up and is way more friendly and quicker than the staff at Newrez and we get to work. They understand the story, but there has been a gap due to unpaid coverage and with immediate payment and some document proving I had no claims in the uncovered time - I could reclaim my coverage. I'm excited and loop in my insurance agent to help me with that document. I prepare a credit card for immediate payment as I don't trust Newrez to dispatch a payment and sadness rolls in. The staff member mentions the effective cancellation date was 10/16/2023, so even with an active payment in early July 2024 - it will not work. She gets confused on the call and asks for a hold - how could I react to something when I only get notified in mail when it was already cancelled? Quick aside - if any company wants anything urgently I wish they would just email or call. Sending a letter for something urgent is such a time suck. The hold is over and apparently "the system" is unable to accept payment for a cancellation dated more than 90 days old. I'm getting flustered now and trying to explain the moving of loans and lack of any notification of missed payment. I'm getting flustered with Heritage who sent me a notice back-dated preventing me from even solving this myself. They won't budge and apparently I've escalated as high as I could go, so I give up and contact my lender again. They now know my insurance is cancelled and I'm back in this situation of getting lender forced insurance which is easily 3k more a year than my last. So now I'm back to contacting my insurance agent to find a different carrier after they tried themselves to get the old policy back. Turns out trying to get insurance in Florida during hurricane season when you have an accidental gap of 7-8 months of missing coverage makes this very difficult. I will survive this with a bit of extra money spent and hopefully when things calm down - my lender will accept fault and meet me half way with this difference of cost. Going forward I learned to never put too much faith into corporations that can dictate a solid amount of stress for yourself. So I went off to leave a bad review and I guess I wasn't alone.   Now I'll look into how to manage paying for my own insurance and taxes (aka without escrow) as I'm not risking this again. ### NBC & Peacock - Tour de France Viewing Experience URL: https://connortumbleson.com/2024/07/08/nbc-and-peacock-tour-de-france/ Last updated: 2025-02-04T11:42:14.000Z  On June 29, 2024 the Tour De France started again. This time the route was a bit different with the Olympics going in France. This meant we wouldn't have the common Champs-Élysées ending, but instead ending with a time trial. As day one started I struggled to find the world feed on Peacock which just fueled my anger. For those unaware in previous years you had two options to watch the Tour. - NBC - Bob Roll & Phil Liggett with studio interruptions & commercials. - World Feed - Anthony McCrossan & Nicolas Roche with no commercials. Now I'm not exaggerating here that watching live sports via NBC has declined massively over the years. I'm not excited for another Olympics where we get to see less and less of live coverage of the world's best athletes competing. Its incredibly annoying to watch live sports on NBC as coverage is constantly interrupted with inline advertisements, actual advertisements, jumping back to the studio for analysis and more. Take an example here where the NBC feed is completely interrupted while the world feed overlays the break with the live coverage. People watching hours and hours of bike racing are well equipped for down time - we don't need to kill the coverage.  When you compare that with a world feed that stays on the riders the entire time - its a night and day difference. The sad part - they are mostly the same video feeds. You just choose to subject yourself to a worse viewing experience when watching a NBC (Peacock) feed instead of an alternative source. However, this year the International (World) Feed is missing from Peacock so they've made their choice for you. I tried to complain to NBC about this removal and got a canned response back. > We do apologize for any inconvenience. This year Peacock will stream all stages of the Tour de France live and select stages will be simulcast on NBC and Peacock. All Peacock coverage of the Tour will exclusively be the NBC Sports feed and feature the “voice of cycling” Phil Liggett, who is covering his 52nd Tour. > Thank you so much for providing this feedback, and we will be sure to give it to the proper teams. The Tour de France commonly starts before 6am eastern, which makes a very early live viewing experience for those on the west coast. So I'm trying to figure out what market NBC is trying to target. I can assure you that folks watching between 3-6am do not need as many advertisements and studio discussions as they are giving. It's like NBC is trying to coup back all their costs from having two mobile NBC reporters on the ground with Steve Porino & Christian Vande Velde as well as the entire studio. I have a crazy idea, but NBC could just use the world feed that every other production uses and throw some commentators on top of it. They wouldn't spend money on all the bells and whistles they provide and could stop injecting advertisements every 3 minutes.  The Studio & Phil (left) / Bob (right) I haven't even begun to mention the commentators themselves and sorry Phil, but you are getting a tad bit too old. Phil Liggett has been covering the Tour de France for over 50 years and at some point maybe he should retire. I personally thought he was going to retire on his 50th year, but here he is pushing 81 and still commentating the race. Its tough to explain, but when you notice the instantaneous ability to recognize riders collapse and forgetting things we saw on the screen moments ago - its embarrassing when compared with the world feed. The world feed would have injected live analysis and background of the riders while it was occurring, but for NBC that is delegated to the studio or others. I feel bad because I did really like Bob and Phil when I was introduced to the tour, but then I learned of other commentators. I even feel bad for Phil as hes forced to mention Kung Fu Panda 4 anytime the number four comes up in discussion. We have these talented commentators that are subject to inline advertisements on every single segment. The grip NBC/Peacock is increasingly yearly to squeeze profits at any point or advertise on top of paid platform is becoming annoying to the point of finding alternatives. You watch the world feed once and it just feels different in a good way. They commentate on the land art that you see, explain the buildings around, provide history of the players, snapshots of the past of that stage and even provide a recorded feed of biking the last kilometer so us the viewers can understand the twists/turns that await. You watch the NBC feed and it roughly works like this: - Phil/Bob covering the race with mistakes here and there. - Overlay advertisements for Peacock exclusive movies and more. - Phil/Bob passing the mic over to Christian (on a bike) - Phil/Bob passing the mic over to Steve (on the ground/car somewhere) - Phil/Bob passing it back the studio to discuss the stage. - Studio/Interview/Video about the 3 Americans racing (Out of 176) constantly. - The studio talking about the race WHILE its occurring with 0 coverage of it. However, NBC having exclusive broadcast rights means being in the United States and wanting to watch the world feed is not easy. I had to VPN myself into Canada and check out FloBikes for better coverage. Saying all of this I thought I was just being an ass, so I went off to Reddit and they confirmed my suspicion.  [https://www.reddit.com/r/tourdefrance/search?q=peacock&restrict\_sr=on](https://www.reddit.com/r/tourdefrance/search?q=peacock&restrict%5Fsr=on&ref=connortumbleson.com) Granted people only seem to post things online when things go south - it does seem I'm not alone with not liking this exclusive NBC feed of the race. I wish I could post videos of NBC vs World Feed, but the lawyers won't like that. Instead I'll find a press sample from [https://letour.com](https://letour.com/?ref=connortumbleson.com) which is funny enough the world feed. 0:00 /1:07 1× This shows the energy, live analysis and reaction to the last kilometer of a sprint stage. If you have Peacock this [link](https://www.peacocktv.com/watch/playback/event/PCKSLE:Replay-5011893/ad25344d-36b4-3086-ae7b-2230357b92a4?destinationRailId=8a2a4c02-c443-11ee-b790-7bf6c311a3e1&destinationRailUrl=https%253A%252F%252Fweb.clients.peacocktv.com%252Fbff%252Fbrowse%252Fv1%252Frails%252F8a2a4c02-c443-11ee-b790-7bf6c311a3e1%253Fpage%5Fid%253D27dfd19e-d3d3-11e9-965c-c7a445ae5817%2526mode%253DCONNECTED%5FNAV&groupParent=ee541232-2d73-11ef-a203-77fd4a2b8818&ref=connortumbleson.com) should be the final kilometer of the NBC feed for comparison. I can only hope the coverage for the next tour is no longer in Peacock/NBC hand, because it just isn't fair to people who like watching cycling. It doesn't matter that we pay for the service to watch the live sports - we (the viewer) are still treated in a way that I don't think is in the best interest for cyclist watchers. ### Sushi URL: https://connortumbleson.com/2024/07/01/sushi/ Last updated: 2025-02-04T11:42:14.000Z  Water + Flour in Tampa Last week, by chance, I ended up at sushi twice in the same week. A meal that is every so often, but impresses me each time none-the-less. I can't quite understand how I can eat 3 rolls of sushi and walk out of a sushi place and yet not feel stuffed. If I for example eat 18 boneless wings - I'll be feeling that in my stomach and body for a solid minute. Granted maybe 18 wings and 3 sushi rolls aren't comparable - it always seems I'm never stuffed when eating sushi. Like you have dipping sauce for wings, the combination of soy sauce mixed with wasabi and ginger builds such a strong sauce to dip sushi bites - I'm surprised more people don't mix and match these strong competing flavors. Finish a roll and want to cleanse your palate? Just enjoy a bite of pickled ginger and you are well on your way. Want to clear out sinuses and take a breath of fresh air? Just add a little dollop of wasabi onto your next sushi bite. Want a bit of greenery prior to your sushi? Enjoy a ginger salad which is such an interesting twist on the basic house salad.  Black Widow & Fire On You - Sticky Rice So what do I normally get in terms of sushi? My go-to is always some form of tuna, whether white tuna, spicy tuna, fatty tuna, etc. Those two rolls pictured above are: - Black Widow (top) - spicy tuna, cucumber, tuna, eel sauce, spicy mayo, green onions - Fire On You (bottom) - spicy tuna, crab mix, crunch, soy paper, white tuna, spicy mayo, eel and chili sauce Any roll that is tuna based attracts my attention. I don't know how to explain but the taste of raw tuna is absolutely amazing. Once I learned about fatty tuna I learned the taste could get even better. White tuna isn't exactly better, but has a more salty taste than the regular and a good companion to any tuna role. This means often times I'll have to take part in sashimi/nigiri depending if I'm in the mood for rice or not.  Sushi Boat Some places are fancy and like to give little boats to house the sushi. Personally not a fan and would appreciate just a regular plate, but it was interesting the first time. Pictured above is 4 slices of fatty tuna sashimi style. So my trips to sushi break down to the following: - ginger salad - 2-3 rolls that are tuna based - a solid amount of consumed ginger and wasabi - ice cold water to handle the heat Once thing I've learned to detect great sushi from okay sushi is the color of the ginger. If you find yourself with pink/red ginger - chances are that food won't be as good as the sushi place serving white colored ginger. Now every once awhile a real special occasion arises to elevate the sushi experience even further. This can be done with seasonal Omakase which literally translates to "*I leave it up to you*". This means you generally sit through 10-20 courses of trying a single slice of very high quality sushi from the chef.    Shunji in California This experience might have fresh wasabi where its actually grated finely from the underground root of the plant. They may even be pickling the ginger themselves keeping the original color. You might not like every course served, but its worth it to try each course once. You can't do fancy sushi every week, but thankfully poke-bowls have spread far n wide. You can get your favorite ingredients from a sushi roll deconstructed into a bowl.  This picture doesn't give it justice, but a bowl of spicy sauces, jalapeno, tuna, ginger and wasabi is a great mixture. You can control each bite whether its a bit of everything or just enjoying a palate cleanser break with a bite of ginger. Sushi twice in one week was great - next time I won't blog about it, but I'll still enjoy it. ### Social Etiquette URL: https://connortumbleson.com/2024/06/24/social-eqtuitte/ Last updated: 2025-02-04T11:42:14.000Z  Photo by [Igor Miske](https://unsplash.com/@igormiske?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) A few weeks ago I went out to a semi-fancy dinner on date night. This place was so small and had to have about 10 tables in total. That small atmosphere paired with quiet music and not many patrons made it a very quiet and elegant dining experience. As we enjoyed some dumplings and sangria the door opened into the restaurant and immediately I could recognize the audio of a phone on speaker. This became the loudest noise in the restaurant within the moment of entering. Not only was the phone on speaker, but the woman holding the phone spoke back quite loudly into the device. I was immediately tilted and looking across from me - so was she. Who uses speaker phone in a public area? Not only that, but who walks into a fancy establishment and continues to talk on speaker phone? It appeared the individual was here to pick up some food for one of the delivery services, but it wasn't ready. Watching this individual then sit down on a 4-top table and still be talking on her speaker phone blew my mind. Did she not parse the vibe of the establishment and/or pick up on the patrons social cues all looking over at her? As we discussed this at our table together - thankfully a restaurant staff member walked up to her carrying a bag of food. She stood up talking on the phone and walked out with the delivery. As she left I thought quickly in my head that either it had to be 1 of 2 things. 1. This person gives zero fucks about anything and anyone - their way or the highway. 2. This person is obnoxiously oblivious to social surroundings. Now of course it could have been an emergency or a combination of a few other things, but this just tilted me beyond belief.  Kotlety @ Babushka's At least an excellent meal arrived to distract from that annoyance. This got me thinking to how its nearly a daily experience to have someone just not respecting someone else in terms of social etiquette. Nothing like standing in line for a burrito and the individual in front of me is balancing yelling into their phone while talking to the employee. Asking them to repeat everything because they are balancing two conversations at once. Have our lives become so busy we have to stay on a call for the minute it takes to order a burrito? At least in that situation I wasn't in a rush and could instead watch this odd encounter as someone balanced a conversation on the phone while trying to order 2 burritos. Even more recently - a group of 4 walking on the park trail who refused to budge when runners approached them. Who takes up the entire trail and doesn't split when others are approaching? I sure didn't like having to run through the swampy muddy grass as I passed them. We are all on this Earth together and time and time again I'm blown away from the inept social etiquette others have. Instead of doing anything in the moment to call out any behavior - I'll write a post to rehash the memories. ### The disappointing starknet.io URL: https://connortumbleson.com/2024/06/16/the-disappointing-starknet/ Last updated: 2025-02-04T11:42:15.000Z  Early this week I got an email that roughly said I had $2,200 in unclaimed money. That email is below. > Hello, Connor > > I'm writing in regards to your github profile. I found your github profile username listed [here](https://github.com/starknet-io/provisions-data/tree/main/github?ref=connortumbleson.com). This is the [repository](https://github.com/starknet-io?ref=connortumbleson.com) of the project. They have been awarding their tokens (a form of cryptocurrency) to developers who have made commits to top repositories or any web3 contributions over the last few years. You can visit their repository yourself and find your profile name listed there. Your github profile is eligible to claim 1800 of their tokens, which is approximately valued at $2200\. These tokens can be exchanged for USD on any exchange platform. I don't expect anything from you, however, if you do collect your tokens, it would be appreciated if you could share a percentage with me later for this information. If there are any additional questions, I will be happy to answer. > > To make sure it's not a fraud, you can google "Starknet provisions" or there is official twitter post with claim link (340.000 followers): [https://twitter.com/Starknet/status/1759966139780620797](https://twitter.com/Starknet/status/1759966139780620797?ref=connortumbleson.com) > > best regards, In the moment I deleted it and thought nothing about it. There were so many "scam" signs in the email like a seemingly random Google account & name mismatch that I was fine just deleting it, Until I got another email. > My name is \_\_\_\_\_ and I'm a crypto-degen > > You are eligible to participate in the StarkNet airdrop program. Sounds like a scam, but read to the end. I am not a spammer or a scammer. > > ... > > Many developers don't even know about this. I find such people in the github file, let them know about it and ask for a percentage of the drop for the information. At this point I even had a new private message on Twitter of the same message! This I knew was going to be another blog, much like my [tea.xyz experience](https://connortumbleson.com/2024/02/26/the-disappointing-tea-xyz/) and I got to work investigating. --- In my research it appears this was about the [provision program](https://www.starknet.io/blog/starknet-provisions-program/?ref=connortumbleson.com) where Starknet Foundation was issuing 700 million STRK tokens around. I wondered how I (a random individual) was allocated some tokens despite no involvement with the project. That didn't take long until I stumbled upon a pie chart that broke it down.  Official (6/12/2024) Starknet Allocation This pie chart made it clear to me that I fit into a bucket of "Open-Source Developers" and 1 of the 137,256 people that were allocated some tokens. That category is explained by Starknet: > As mentioned before, blockchain infrastructure, including Ethereum and Starknet, emerged as a result of previous science and engineering advances of what are now, in many cases, open-source public goods. > In order to acknowledge the contribution of the developers who worked on these projects, and in order to encourage more developers outside of blockchain to participate in the blockchain space, some of these developers will be able to claim tokens. > > **Criteria**: Developers who committed at least three times before November 15th, 2023, and with at least one commit between January 1st, 2018, and November 15th, 2023, to one of the [top 5,000 GitHub projects](https://gitstar-ranking.com/repositories?ref=connortumbleson.com) (ranked by GitHub stars), and their GitHub profiles can be extracted from their email through the GitHub API, are eligible for Provisions. So then I wanted to figure out what the data structure of this scraped GitHub was and poked around the GitHub repository until I found a JSON file and found my username within. ```json { "identity": "ibotpeaches", "amount": "1911.1" }, ``` [github-1.json](https://raw.githubusercontent.com/starknet-io/provisions-data/master/github/github-1.json?ref=connortumbleson.com) My first thought looking at this wondered why they picked usernames as those can change and sure enough my gut was right. I spotted only one other commit and the title of the commit caught my eye with "*Add renamed (originally squatted) usernames*"  [https://github.com/starknet-io/provisions-data/commits/main/github](https://github.com/starknet-io/provisions-data/commits/main/github?ref=connortumbleson.com) This [commit](https://github.com/starknet-io/provisions-data/commit/8736c32b68f57bca4cc4de6cfc6d2f8ff4cfb239?ref=connortumbleson.com) called out some issues encountered with this approach. > The issue involves 1796 GitHub usernames identified as squatted. These usernames were originally eligible for provisions but were taken over by individuals who allegedly did not make qualifying contributions, thus being deemed ineligible for inclusion in the Provisions program. > ... > We started the process with a list of 1796 squatted usernames. Of the eligible accounts, 866 were renamed, and for 930 accounts, no new username was found, possibly due to account deletion, inactivity during 2018-2023 period, or changing their username before 2018. I mean who didn't see that coming? You scrape public events from an archive dataset that is 5 years old and work off the username? This explains the mass craze of these individuals frantically researching every username on the sheet in order to find missing usernames. Once Starknet started noticing this abuse - they audited GitHub usernames which led this army of crypto individuals to find a new method to make money. So I wanted to open a bug report about this spam I was receiving for something I wanted no part in. However, I wasn't the first to be annoyed by this. There was already 2 other bug reports about other individuals in the same situation as me.   [Issue 95](https://github.com/starknet-io/provisions-data/issues/95?ref=connortumbleson.com) & [Issue 98](https://github.com/starknet-io/provisions-data/issues/98?ref=connortumbleson.com) I kept reading more of this GitHub repository and just felt fueled with anger. This is a huge public repository with a scraped collection of GitHub usernames and what do I instead see? An army of people writing stories about how they were missed, wrong username, etc. Completely unverifiable stories with all the same intent - change something to move tokens elsewhere. What continued to blow my mind is how many seemingly brand new GitHub accounts exist for every crypto project. We saw this same situation during the tea.xyz spam - all these new GitHub accounts are at the center of all the spam and questions.    Quickly registering accounts as quick as possible to reclaim old usernames? Who knows exactly what is occurring here. I do know that as a citizen of the United States I cannot even legally use this platform as I'm blocked from accessing the provision panel. > **Can’t reach the Starknet Provisions Program portal?** > Note that due to regulatory constraints and/or an uncertain regulatory environment, the Starknet Provisions Program and STRK will not be available to the following entities: > ... > Any person or entity in the **US**, and any countries designated by the US or the UK as sanctioned jurisdictions. So instead I get my username included with a batch of others - leading to increased spam. People associated with Starknet appear (albeit very slowly) to be removing usernames as [requested](https://github.com/starknet-io/provisions-data/commit/ca80c3a16059a0a0a590cbb9f9c10ca001061b04?ref=connortumbleson.com) \- I thought adding my 2c to the thread would include me in that bucket, but I guess not. Instead, I just opened my own [bug report](https://github.com/starknet-io/provisions-data/issues/107?ref=connortumbleson.com) to get my name removed. In the meantime I'll just blog about my displeasure about Starknet.io and this entire experience. --- EDIT It seems this is just starting to accelerate as 3 users asking for removals is now 8 a few days later. ``` https://github.com/starknet-io/provisions-data/issues/100 https://github.com/starknet-io/provisions-data/issues/102 https://github.com/starknet-io/provisions-data/issues/105 https://github.com/starknet-io/provisions-data/issues/106 ``` ### the non-stop hustle URL: https://connortumbleson.com/2024/06/10/the-nonstop-hustle/ Last updated: 2025-02-04T11:42:15.000Z  Photo by [Garrhet Sampson](https://unsplash.com/@garrhetsampson?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) Attending a little nerd gathering of local Tampa engineers a few weeks ago someone mentioned that they enjoyed reading my blog because it felt like a glimpse into the past of the web. Of course with a bit of a positive comment my direction I had to dive deeper and ask this individual why. They mentioned it felt like sites in the early days of the Internet with no ads and no attempt to attract their focus/attention/money toward some product/service. I mentioned that a few of those sites still exist and even kept their design from the past - this site has JavaScript which to some is a no no. Either way it got me thinking. If you were to browse a large chunk of the Internet today - you aren't reading content just because someone decided to put content on the web. You are reading something that was produced in an attempt to draw your attention towards something or buy something. Not everything though starts like that - take a high school classmate who works as a flight attendant that would photograph everything about the plane, the city and the travel as they bounced around to cities around the world. They naturally grew to a large following with just quality original photos that were of places all around the world. As years passed I noticed the amount of hash tags per post were hitting the 30-40 mark which seemed like an intentional effort to spread these posts even further or some automation in play. This friend appeared to have success with a large following (100k\~) of photos/videos of flying around. One day I realized I hadn't seen a new photo/video in quite a while and got curious. I looked for their page and saw they had a call out for a new profile & book. This was a professional book with branding and more with a far less sum of followers. Did their hobby turn into a business? Ultimately I don't know, but I'd like to believe what started as a hobby turned into a something more for that individual.  Photo by [Diggity Marketing](https://unsplash.com/@diggitymarketing?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) Other friends take part in social media to attract attention from brands to become "influencers". They get shipped some product and have to spam their network about this new great thing - even if it turns out its garbage. You quickly realize that those interacting with these ad messages are others in the same situation. You realize this is a friend from 10+ years ago and you don't care too much about this constant stream of advertisements masquerading as a social media post - so you mute or stop following said individual. Is it still possible to contribute to the Internet without an ulterior motive? I think about myself blogging a lot about that. I've gotten countless [requests](https://connortumbleson.com/2020/10/19/blog-spam-sponsored-content/) to just hyperlink words to specific websites or one single guest post and I say no every-time. I don't want my hobby of blogging to turn into something that forces my hand in any other direction. My blog has no ads and no trackers. I don't know if 0 people read this or 1,000\. I like writing weekly so I can build a public journal of my life. I just have to figure out a more long-term storage (ie static site generation) to prepare my content to survive past me. So I may not be hustling the web, but I'm sure blogging weekly. ### The Cicada 3301 Mystery (Puzzle 3 Solve) - Part 3 URL: https://connortumbleson.com/2024/06/03/the-cicada-3301-mystery-puzzle-3-solve-part-3/ Last updated: 2025-02-04T11:42:15.000Z  Photo by [Shannon Potter](https://unsplash.com/@cifilter?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) We pick up where we left off in the January 2014 puzzle - this is Part 3. 💡 If you missed [Part 1](https://connortumbleson.com/2021/02/15/the-cicada-3301-mystery-puzzle-3-part1/) or [Part 2](https://connortumbleson.com/2024/02/05/the-cicada-3301-mystery-puzzle-3-solve-part-2/) of the 2014 Puzzle - head on back to catch up. We ended the last part after successfully discovering another onion after a long process of a Vigenère cipher on Liber Primus book pages. So we went off to the URL and got an odd little HTML page. ```html bf1d5574ca36efd524e6c34c26cbd628b19aa835aceb94ea7f2ca7f33d1b8f51476bc597d4bf9ad5111d8f39ef5351b3b090bce47f023002fe69928e79f6f8147f6fe051f2f159041f932f5190308d7441fc3cecead0851662d3217485827e640a4183fa5bc8cef5ff7d1473d2746a37fbc8b94318ff0d3aeb467017c0ea5cb33b3e6967453986e1450b35ad47861f679cf7db5a6c170bcfb67544983ec1e36b27ee8c5721da39d27dbfa0cdc15ba3cbaa425e8a8b96b81ab665f3ebc41563a0e9270695d3d68887cfab2c07b290718307f764afba684b17fcfd71323f64206e5fa378b4ee89e80885733080065dd34a5c838898906b8d43de9f1d8eb6922bad
Apache Server at 127.0.0.1 Port 5243 ``` It almost felt broken with mismatched tags, but now that we've seen it a few times - this has to be a pattern. The page starts as a little payload with an HTML comment that calls out something Cicada 3301 related, then some point later it changes. This data which appears to be consistent as a 512 character string prior to the real onion, must be utilized somehow. At the moment we will just [collect](https://github.com/iBotPeaches/cicada%5F3301/blob/master/other/512%5Fhex%5Fchars.md?ref=connortumbleson.com) those strings and organize them with the Cicada number associated with the payload for later processing. Just as we expected after a quick offline/online shift of the onion it changed - this time packing a much larger payload. ``` 1f8b0808a4c8e2520003646174612e6f757400ecfd65545c5db72e8a169a e0c12d40d020c1dd09c1ddb580e0eeee24b8bb6b702778e1047702145eb8 17ee0e87f75bfbb67bdadef7b6b3cf9ff3add5ce7a5a9b3565688d31677f 7a9fa38f315f175ed7011f6424a42500306f88838903005e9701df0070b0 ffe09f5fb837c023c2ff83f78888088848ef919191de232121a362a022a3 // snipped ``` [full file](https://github.com/iBotPeaches/cicada%5F3301/blob/master/onions/avowyfgl5lkzfj3n.onion/post/index.html?ref=connortumbleson.com) I'm sure you know the pattern at this point - lets convert back to binary and run binwalk over this. ``` ➜ xxd -p -r file file.bin ➜ binwalk file.bin DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------------- 0 0x0 gzip compressed data, has original file name: "data.out", from Unix, last modified: 2014-01-24 20:10:12 ``` It appeared the downloaded stream of bytes was actually a gzipped blob of contents. So lets just decompress this file and see what we have. ``` ➜ mv file.bin archive.gz ➜ gzip -d archive.gz ➜ binwalk archive DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 823807 0xC91FF JPEG image data, JFIF standard 1.01 ``` Binwalk detected two images, but it didn't parse the the 2nd half of the file. I'm guessing much like the other puzzle some images are reversed. ``` ➜ perl -0777pe '$_=reverse' archive > archived.rev ➜ binwalk archived.rev DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 638805 0x9BF55 JPEG image data, JFIF standard 1.01 ``` Sure enough that was it - we have 4 images hidden within this blob. We can follow the same pattern we did in the past with using dd to extract the chunks of these images hidden within. A quick visit with a hex editor we can find the trailer (`FF D9`) of the images to record the length of each respective image.  - Regular File - 0 start, 0xC91FF length. - Regular File - 0xC91FF start, 0x1922D9 ending. - Reversed File - 0 start, 0x9BF55 length. - Reversed File - 0x9BF55 start, 0x14CDB6 ending. ``` ➜ dd if=archive of=1.jpg bs=1 count=$((0xC91FF)) 823807+0 records in 823807+0 records out 823807 bytes (824 kB, 804 KiB) copied, 2.54258 s, 324 kB/s ➜ dd if=archive of=2.jpg bs=1 skip=$((0xC91FF)) count=$((0x1922D9 - 0xc91FF)) 823514+0 records in 823514+0 records out 823514 bytes (824 kB, 804 KiB) copied, 2.54878 s, 323 kB/s ``` splitting images on regular file. ``` ➜ dd if=archived.rev of=3.jpg bs=1 count=$((0x9BF55)) 638805+0 records in 638805+0 records out 638805 bytes (639 kB, 624 KiB) copied, 1.94638 s, 328 kB/s ➜ dd if=archived.rev of=4.jpg bs=1 skip=$((0x9BF55)) count=$((0x14CDB6 - 0x9BF55)) 724577+0 records in 724577+0 records out 724577 bytes (725 kB, 708 KiB) copied, 2.20165 s, 329 kB/s ``` splitting images on reversed file. Sure enough we got 4 images that look like more pages of a book.     Our first check before we figure out these runes should be running outguess against these images. ``` ➜ for file in *.jpg; do outguess -r $file $file.out; done; Reading 1.jpg.... Extracting usable bits: 800881 bits Steg retrieve: seed: 41408, len: 58152 Reading 2.jpg.... Extracting usable bits: 804376 bits Steg retrieve: seed: 41408, len: 58152 Reading 3.jpg.... Extracting usable bits: 578114 bits Steg retrieve: seed: 38, len: 140 Reading 4.jpg.... Extracting usable bits: 704507 bits Steg retrieve: seed: 41408, len: 58152 ``` We do get a successful disassembly on every file, but 3 of the files have the same unknown blob of data. Binwalk has no idea what it could be, but one of the files is in plaintext. The 3rd image (technically page 8 of Liber Primus) we find this message hidden within. ``` For those who have fallen behind: TL BE IE OV UT HT RE ID TS EO ST PO SO YR SL BT II IY T4 DG UQ IM NU 44 2I 15 33 9M Good luck. 3301 ``` This looks like another grouping of characters that are part of a transposition cipher - more than likely another column based one. The key to shift by might be discoverable, but much like we did in a previous puzzle. We can just write something to brute-force columns and look for human readable words. The first challenge with any column based cipher is to figure out how many columns you need. I'm not sure we can trust Cicada here with 14 columns of text between 2 rows with 2 characters per group. Our safest bet is to assume a rectangle and use any divisor that divides evenly. So our options are: 1, 2, 4, 7, 8, 14, 28 for key length. A column of 1 is clearly not it and 2 you can check visually - so we will start with 4 then move onward to 7 and 8\. For those unaware what I mean - if we used an interface based tool we are simply moving columns around much like this animation below. It should help visually understand how the column indexes can be moved around to correct the demo puzzle.  An example solve for "THISISATEST" Our script took a bit to write, but it seemed to generate some human like words when ran. ``` ➜ php cicada app:bruteforce-column-key Enter a sentence to bruteforce: > TL BE IE OV UT HT RE ID TS EO ST PO SO YR SL BT II IY T4 DG UQ IM NU 44 2I 15 33 9M Sentence: TLBEIEOVUTHTREIDTSEOSTPOSOYRSLBTIIIYT4DGUQIMNU442I15339M +---------+-----------+ | Key (4) | Plaintext | +---------+-----------+ +---------+----------------------------------------------------------+ | Key (7) | Plaintext | +---------+----------------------------------------------------------+ | 0623145 | TOBELIEVETHUTRISTSDEOTROSPOYSIBTLIIYQ4DTGUI2NUM44IM53139 | | 0625143 | TOBELIEVETRUTHISTODESTROYPOSSIBILITYQ4UTGDI2N4M4UIM59133 | +---------+----------------------------------------------------------+ ``` [GitHub script](https://github.com/iBotPeaches/cicada%5F3301/blob/master/tool/app/Commands/BruteforceColumnKey.php?ref=connortumbleson.com) The last item appears to say `TO BELIEVE TRUTH IS TO DESTROY POSSIBILITY`, then some random characters. This key corresponded to aligning the columns in `0, 6, 2, 5, 1, 4, 3` order. The characters at end could be another onion site, which if extracted with a `.onion` tacked on end becomes `q4utgdi2n4m4uim9133.onion` \- however it is invalid. The last 4 numbers at end don't really follow the pattern. We know the ports used have commonly been like 52xx, so maybe that's a port? If we remove it and just use: `q4utgdi2n4m4uim.onion` it works. We could jump onward to another onion, but we haven't figured out what these 4 pages of the book say. So lets start with just iterating through all our previously written scripts and see if they work. We will start with the first line and run through the below commands we've since written - `ᚹ ᚣᛠᚹᛟ ᚹ ᛇᚹᛟ ᚻᛈᚣᛝᚻᛈᚻ ᛋᛠ`. - Direct translation - Failed. - `php cicada app:translate` ([GitHub](https://github.com/iBotPeaches/cicada%5F3301/blob/master/tool/app/Commands/TranslateSentence.php?ref=connortumbleson.com)) - Reversed translation - Failed. - `php cicada app:translate` ([GitHub](https://github.com/iBotPeaches/cicada%5F3301/blob/master/tool/app/Commands/TranslateSentence.php?ref=connortumbleson.com)) - XOR with Puzzle 2 files - Failed. - `php cicada app:bruteforce-xor` ([GitHub](https://github.com/iBotPeaches/cicada%5F3301/blob/master/tool/app/Commands/BruteforceXor.php?ref=connortumbleson.com)) - Brute-force Vigenère Key w/ word-lists - Failed. - `php cicada app:bruteforce-vigenere` ([GitHub](https://github.com/iBotPeaches/cicada%5F3301/blob/master/tool/app/Commands/BruteforceVigenereKey.php?ref=connortumbleson.com)) - Brute-force Column based Key - Failed - `php cicada app:bruteforce-column-key` ([GitHub](https://github.com/iBotPeaches/cicada%5F3301/blob/master/tool/app/Commands/BruteforceColumnKey.php?ref=connortumbleson.com)) Unfortunately we had no luck - one thing we are missing though is a rotation based cipher that works off runes instead of text. I took the direct/reversed translation and rotated them through all 26 shifts, but nothing looked like English. So lets build two new scripts that works roughly like. - Start with rune to English letter translation. - Perform permutation on the phrase to permute any decoding that could be multiple characters. - Do one of the following: - Find the character (ie `TH`) in the runic mapping and shift 1-26 in the runic alphabet (`f`, `u`, `th` ...) - Once corresponding English character is identified shift 1-26 in the English alphabet (`a`, `b`, `c` ...) - Then - Look for human readable words from the word-lists. - Run it again with the reversed translation instead of direct. So after writing that script - we had mixed success. When shifting via human letters we found 0 results that resembled English words. However, shifting via runic indexes gave us 25+ results to review.  php cicada app:bruteforce-rotation-cipher --runic-shift This appears to be generating an English like string as we permute the different iterations the string can have. Lets slow this down and see how this worked. - We started with `ᚹ ᚣᛠᚹᛟ`. - We converted that back into English from the reversed Gematria Primus to become `[NG|ING] THF[NG|ING]G`. - We took the first permutation of that - `NG THFNGG`. - We exploded those back into runes - `NG`, `TH`, `F`, `NG`, `G`. - We took first Rune/Character (`NG`) at index 21 of the Gematria Primus. - We took the successful rotation number (3) and shifted +3 to become 24. - We asked for the Rune/Character at 24 - which was `ᚪ` (A). - We moved down the string keeping shift constant to get `A [C|K]OAN` - Since we went back to Runes - we have to re-permute, so we get: - `A KOAN` - `A COAN` A Koan is a term for a story in [Buddhism based](https://en.wikipedia.org/wiki/Koan?ref=connortumbleson.com) cultures. We know from the upcoming word `DECIDED` that our shifts change between `K` and `C` depending on the word. Cicada always says "stay true to the book" - however we can't be sure if the decoding was meant to become constant in terms of resolving `C` and `K`. For such a small string decoded we can use the permutation that makes the most sense with grammar. Now that we know the pattern we don't have to brute-force it anymore. We just need a script that takes a sentence, direction and rotation number. So lets load up the entire page from the book. ``` ➜ php cicada app:rotation-cipher --runic-shift --rotation=3 Enter a sentence to translate: > ᚹ ᚣᛠᚹᛟ ᚹ ᛇᚹᛟ ᚻᛈᚣᛝᚻᛈᚻ ᛋᛠ ᚫᛠ ᚹᛟᚻ ᛏᛋᚢᚻᚳ ᚪᛝᚠ ᚹ ᛇᚹᛏᛋᛈᛡ ᛞᛈ ᚪᛈᛟᛋ ᛋᛠ ᚠᛈ ᚻᛠᛠᛡ ᛠᚦ ᚠᛈ ᛇᚹᛏᛋᛈᛡ ᚪᛞᛠ ᚹᛡᛈ ᚳᛠᚢ ᚪᛞᛠ ᚪᛝᛏᛞᛈᛏ ᛋᛠ ᛏᛋᚢᚻᚳ ᛞᛈᛡᛈ ᚹᛏᚣᛈᚻ ᚠᛈ ᛇᚹᛏᛋᛈᛡ ᚠᛈ ᛏᛋᚢᚻᛈᛟᛋ ᛋᛠᛄᚻ ᚠᛈ ᛇᚹᛏᛋᛈᛡ ᛞᛝᛏ ᛟᚹᛇᛈ ᚠᚹᛋ ᛝᛏ ᛟᛠᛋ ᚪᛞᛠ ᚳᛠᚢ ᚹᛡᛈ ᚠᚹᛋ ᛝᛏ ᛠᛟᛄᚳ ᚪᛞᚹᛋ ᚳᛠᚢ ᚹᛡᛈ ᚣᚹᛄᛄᛈᚻ ᚪᛞᛠ ᚹᛡᛈ ᚳᛠᚢ ᚪᛞᛠ ᚪᛝᛏᛞᛈᛏ ᛋᛠ ᛏᛋᚢᚻᚳ ᛞᛈᛡᛈ ᛞᛈ ᚹᛏᚣᛈ A [C|K]OAN A MAN DE[C|K]IDED TO GO AND [S|Z]TUDY WITH A MA[S|Z]TER HE WENT TO THE DOOR OF THE MA[S|Z]TER WHO ARE YOU WHO WI[S|Z]HE[S|Z] TO [S|Z]TUDY HERE A[S|Z][C|K]ED THE MA[S|Z]TER THE [S|Z]TUDENT TOLD THE MA[S|Z]TER HI[S|Z] NAME THAT I[S|Z] NOT WHO YOU ARE THAT I[S|Z] ONLY WHAT YOU ARE [C|K]ALLED WHO ARE YOU WHO WI[S|Z]HE[S|Z] TO [S|Z]TUDY HERE HE A[S|Z][C|K]E ``` We are now rolling - hopefully the next 3 pages follow this exact form of decoding. I'm guessing they do because the first page/chunk ends in a partial word of "aske" which I'm sure will become "asked" when the next page is solved. Thankfully all [4 pages](https://github.com/iBotPeaches/cicada%5F3301/blob/master/other/A%5FKoan%5FPage6%5F7%5F8%5F9.md?ref=connortumbleson.com) do have the same exact decoding, which end up telling an interesting tale. > A Koan > > A Man decided to go and study with a master. He went to the door of the master. > > "Who are you who wishes to study here?" - asked the master. > > The student told the master his name. > > "That is not who you are, that is only what you are called. Who are you who wishes to study here?" - he asked again. > > The man thought for a moment and replied - "I am a professor". > > "That is what you do, not who you are" - replied the master. > > "Who are you who wishes to study here?" > > Confused, the man thought some more. > > Finally, he answered - "I am a human being". > > "That is only your species not who you are, who are you who wishes to study here?" asked the master again. > > After a moment of thought the professor replied - "I am a conscious inhabitant of an arbitrary body." > > "That is merely what you are, not what who you are - who are you who wishes to study here?" > > The man was getting irritated, "I am" he started, but could not think of anything else to say so he trailed off. > > After a long pause the master replied - "Then you are welcome to come study" After the story (Koan) an instruction was injected at the end. > An Instruction > Do four unreasonable things each day On first inspection it doesn't look like we have anything here so we might as well just go onward to the onion we discovered in the outguess data on page 8. So back off to `q4utgdi2n4m4uim.onion` we went. --- This web page started off with a rather large signed PGP message. ``` -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 4944330300000000002c5449543200000013000000496e746572636f6e6e // snipped 555555 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJS2dL9AAoJEBgfAeV6NQkPkKMP/AyOipTsnGC50Ch2Mtomw87Y ``` [full file (GitHub)](https://github.com/iBotPeaches/cicada%5F3301/blob/master/onions/q4utgdi2n4m4uim5.onion/pre/index.html?ref=connortumbleson.com) So of course we extract the payload and convert it back to binary. Before I can run binwalk over the binary - my computer automatically detects it as an audio file. ``` ➜ xxd -p -r pre pre.bin ➜ file pre.bin pre.bin: Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 192 kbps, 44.1 kHz, JntStereo ``` We can leverage [ffprobe](https://ffmpeg.org/ffprobe.html?ref=connortumbleson.com) to dump out the metadata from this song to see if anything is hiding. ``` Input #0, mp3, from 'pre.mp3': Metadata: title : Interconnectedness artist : 3301 Duration: 00:04:37.16, start: 0.000000, bitrate: 192 kb/s Stream #0:0: Audio: mp3, 44100 Hz, stereo, fltp, 192 kb/s ``` Interconnectedness by 3301 0:00 /277.159125 1× Another interesting Cicada song that probably packs secrets within while producing a real nature guitar heavy melodic tune. However, before the investigation could continue the (`q4utgdi2n4m4uim`) onion updated and the payload was replaced - this time packing an image. So our focus is pulled away from the audio file to this image. ``` ➜ binwalk post.html DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 ```  Thankfully [Tinyeye](https://tineye.com/?ref=connortumbleson.com) exists which finds this image almost instantly and tells us: *Francisco de Goya y Lucientes - Portrait of Andrés del Peral.* With another image though we have to try outguess immediately. ``` ➜ outguess -r q4utgdi2n4m4uim.jpg q4utgdi2n4m4uim.jpg.bin Reading q4utgdi2n4m4uim.jpg.... Extracting usable bits: 222054 bits Steg retrieve: seed: 212, len: 12683 ➜ binwalk q4utgdi2n4m4uim.jpg.bin DECIMAL HEXADECIMAL DESCRIPTION ----------------------------------------- 0 0x0 bzip2 compressed data, block size = 900k ``` So we have some compressed data hiding within the file, but you can briefly see some image artifacts so before we take a look at that compressed data lets review this image. [FotoForensics](https://fotoforensics.com/?ref=connortumbleson.com) confirms our suspicion that we have some additional packed images within this image.  There doesn't seem to be any consistent technique though to reveal all the subset images at once. As we mess with filters we see: - Cicada logo in top left - Person in top right - Numbers in bottom left - Numbers in bottom right  An example of adapting some layers to reveal a person and cicada logo. At this point though we've spent enough time messing with an image - lets look at the packed outguess data. Once we decompress the bzip2 file (`bzip2 -d`) we find a signed message packed within. ``` -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Very good. You have done well to come this far. ffd8ffe000104a46494600010101004800480000fffe0013437265617465 // snipped ONION Good luck. 3301 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) ``` [full file (GitHub)](https://github.com/iBotPeaches/cicada%5F3301/blob/master/messages/2014/very-good-you-have-done-well.asc?ref=connortumbleson.com) This message appears to have 3 different hex payloads spaced apart in this message. If we extract that text into their own chunk files and reverse them back to binary we get. ``` ➜ xxd -p -r chunk1 chunk1.bin ➜ xxd -p -r chunk2 chunk2.bin ➜ xxd -p -r chunk3 chunk3.bin ➜ file chunk1.bin chunk1.bin: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, comment: "Created with GIMP", progressive, precision 8, 163x79, components 3 ➜ file chunk2.bin chunk2.bin: JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, comment: "LEAD Technologies Inc. V1.01", progressive, precision 8, 197x173, components 3 ➜ file chunk3.bin chunk3.bin: MPEG ADTS, layer III, v2, 24 kbps, 24 kHz, JntStereo ``` So it appears we have 2 new images and a new audio file hiding within this message which was hidden within the original image. So if we were to visualize this signed message it was packed roughly as depicted below.  With the two images being:  chunk 1  chunk 2 and the audio file: Chunk 3 0:00 /3.096 1× So now we have 3 new artifacts and paired with this text below seems like another complex book code on initial inspection. ``` 3PI:6:1:3 LML:1:1:1 3 ETOATS:19:9:1 ...AF:5:3:1 AMO:13:10:1 CC:8:6:1 CBIA:3:7:2 CFAF:5:23:6 SPR:1:8:1 7 C[1]:4:5:3 AWDV:6:2:1 C[2]:2:17:5 SC:3:17:1 AOGS:2:8:1 ONION ``` The challenge with this presumed book code is `onion` is not part of it. This was a helpful static string we could previously use to ensure our decoding was working. Otherwise you just have a random group of letters/numbers that hopefully resolve as a valid website. Starting with the first equation that seems to be written as `Bew(y) = 3 x` so we start with a basic Wikipedia search for [BEW](https://en.wikipedia.org/wiki/BEW?ref=connortumbleson.com). One result has: - [*Bew (mathematical logic)*](https://en.wikipedia.org/wiki/Bew%5F%28mathematical%5Flogic%29?ref=connortumbleson.com)*, a mathematical provability formula introduced by Kurt Gödel.* It seems this is theorem for incompleteness. So lets look up the eye image on Tinyeye and see what we find.  What we see as common is "escher" on a few of the results. So with a quick Google search of "eye escher" and we find [Eye (1946) by Maurits Cornelis Escher](https://www.artchive.com/artwork/eye-maurits-cornelis-escher-1946/?ref=connortumbleson.com). So at this point we just have to make sense of this tiny audio file. There is no metadata attached, but we are in 2024 now. I can just upload this audio file to a [service](https://aha-music.com/identify-songs-music-recognition-online?ref=connortumbleson.com) (aha-music) and get it detected. Sure enough within seconds the results come back: *Johann Sebastian Bach: Trio Sonata in G major, BWV 1039 - I. Adagio.* So now we have: - Equation - Gödel's Incompleteness Theorem - Eye - Painting (Eye) by Maurits Cornelis Escher - Audio - Bach BMV 1039 So I googled all 3 of those things together and find a [Medium](https://philosophygeek.medium.com/why-g%C3%B6del-escher-bach-is-the-most-influential-book-in-my-life-49d785a4e428?ref=connortumbleson.com) blog titled - *Why Gödel, Escher, Bach is the most influential book in my life.* It clicks just like that - this is how we were supposed to find the book. All these items have authors and those authors combined result in this book published in 1999.  We have to discover what this book code means. If we look at the first few lines we get: ``` 3PI:6:1:3 LML:1:1:1 ``` The final 3 numbers have to be some form of paragraph, word, letter, line or something. The first chunk is the complicated part. Unsure of legality of attaching a PDF of the ****Gödel, Escher, Bach: An Eternal Golden Braid** book - so please find that on your own. If we take another look at the table of contents we can start to make some assumptions.   If we see "*3PI*" can we assume that means "*Thee-Part Invention*"? Likewise maybe "*LML*" is "*Little Harmonic Labyrinth*"? Lets try and match up all the prefixes: - 3PI - *Three-Part Invention* - LML - *Little Harmonic Labyrinth* - 3 - ETOATS - *Edifying Thoughts of a Tobacco Smoker* - ...AF - *Ant Fugue* - AMO - *A Mu Offering / A Musico-Logical Offering* - CC - *Crab Canon* - CBIA - *Canon by Intervallic Augmentation* - CFAF - *Chromatic Fantasy, And Fued* - SPR - *Six-Part Ricercar* - 7 - C\[1\] - *Contracrostipunctus / Contrafactus* - AWDV - *Aria with Diverse Variations* - C\[2\] - *Contrafactus / Contracrostipunctus* - SC - *Sloth Canon* - AOGS - *Air on G's String* This might work out, but we have a few codes that resolve to a few different possibilities. If we go under that assumption we have a few possibilities of the book code meaning: - `
ffd8ffe000104a46494600010101019001900000ffdb0043000302020202
02030202020303030304060404040404080606050609080a0a090809090a
```
[full file](https://connortumbleson.com/uploads/2024/01/fv7lyucmeozzd5j4.onion.adjusted-status-page.txt)
Now at this point you should be able to spot the magic of a JPEG - you can see `ff d8 ff e0` which is the header. So we know there is an image hiding in this status page. No need for any fancy tools - this is a relatively small file, so lets isolate the payload in the middle.
```
ffd8ffe000104a46494600010101019001900000ffdb0043000302020202
02030202020303030304060404040404080606050609080a0a090809090a
0c0f0c0a0b0e0b09090d110d0e0f101011100a0c12131210130f101010ff
db00430103030304030408040408100b090b101010101010101010101010
101010101010101010101010101010101010101010101010101010101010
```
[full file](https://connortumbleson.com/uploads/2024/01/fv7lyucmeozzd5j4.onion.payload.txt)
So one quick conversion back to binary with xxd and we detect one image with binwalk.
```
➜ xxd -r -p payload payload.bin
➜ binwalk payload.bin
DECIMAL HEXADECIMAL DESCRIPTION
----------------------------------------------------
0 0x0 JPEG image data, JFIF standard 1.01
```
However, there has to be another image because the ending of the file is `e0 ff d8 ff`, which as you can tell is the JPEG magic reversed. Thankfully in Part 1 we learned about `tac` (reverse of cat) so we can easily flip the file if we keep it in the plaintext state. However it won't be that easy this time because there appears to be some data in between the images.
ghex view of payload.bin
We can tell the JPEG header doesn't have the size embedded so we must have the trailer bytes of `ff d9` which help denote the end of the image. You can even tell after what appears to be a random blob of characters we have `d9 ff` which is the reversed JPEG trailer. So this binary blob appears to be structured as `[jpeg][characters][reversed jpeg]`.
So to make this easier - we can leverage dd to extract a chunk of the file. We know from the above screenshot that the first image ends at offset: `0x521e1`, so a little quick command to extract that chunk.
```
➜ dd if=payload.bin of=slimmed.bin bs=1 skip=$((0x521e1))
336713+0 records in
336713+0 records out
336713 bytes (337 kB, 329 KiB) copied, 1.31176 s, 257 kB/s
```
We keep our block size at 1 to work byte by byte and skip the full size of the initial image. Our file is now just the random characters and reversed JPEG. At this point since the file is already binary - we can't use tools like rev and tac as they work best on text. Thankfully Perl is pretty good at reversing even binary blobs.
```
➜ perl -0777pe '$_=reverse' slimmed.bin > reversed.bin
```
- We use `0777` to read the entire file at once without splitting.
- We use `-p` to loop each line.
- `-e` just executes the upcoming Perl code.
- `$_=reverse` reverses the argument (the file content) and since no output variable will reverse the argument
So basically we read the entire `slimmed.bin` file, reverse its contents and write to `reversed.bin`.
So now we have 2 images and a set of 358 characters we extracted from between the images.
```
a02373230202020202833313020202020213433302020202021333130202020202135313a06363330202020202939313020202020203331302020202020323330202020202028313a06323230202020202534323020202020202139302020202025343230202020202632323a083130202020202032333020202020203331302020202029393130202020202636333a01353130202020202133313020202020213433302020202028333130202020202237323
```
The 358 characters
With the two images being:
At first I thought I made a mistake, but after a few replications I confirmed both images are the same. We have some runes, then a little matrix of numbers/runes. Neither appear to have any outguess data embedded within.
Our goal now is to decode these runes. Crazily enough these puzzles are connecting as we had a little decoding table in [Puzzle 2](https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/) known as the Gematria Primus. So we spend a bit of time reversing runes to characters and we start to understand this page:
- ᛋᚩᛗᛖ (some) •ᚹᛁᛋᛞᚩᛗ (wisdom)
- ᚦᛖ (the) •ᛈᚱᛁᛗᛖᛋ (primes) •ᚪᚱᛖ (are) •ᛋᚪᚳᚱᛖᛞ (sacred)
- ᚦᛖ (the) •ᛏᚩᛏᛁᛖᚾᛏ (totient) •ᚠᚢᚾᚳᛏᛡᚾ (function) •ᛁᛋ (is) •ᛋᚪᚳᚱᛖᛞ (sacred)
- ᚪᛚᛚ (all) •ᚦᛝᛋ (things) •ᛋᚻᚩᚢᛚᛞ (should) •ᛒᛖ (be) •ᛖᚾᚳᚱᚣᛈᛏᛖᛞ (encrypted)
- ᚳᚾᚩᚹ (know) •ᚦᛁᛋ (this)
Or in plain English:
"*Some wisdom: The primes are sacred, The totient function is sacred, All things should be encrypted.*
*Know this.*"
So now we have to make sense of this matrix of numbers. Using the Gematria Primus we can take runes to words/numbers.
- Shadows (ᛋᚻᚪᛞᚩᚹᛋ): 341
- Aetheral (ᚫᚦᛖᚱᛠᛚ): 366
- Buffers (ᛒᚢᚠᚠᛖᚱᛋ): 199
- Void (ᚢᚩᛁᛞ): 130
- Carnal (ᚳᚪᚱᚾᚪᛚ): 320
- Obscura (ᚩᛒᛋᚳᚢᚱᚪ): 245
- Form (ᚠᚩᚱᛗ): 91
- Mobius (ᛗᚩᛒᛁᚢᛋ): 226
- Analog (ᚪᚾᚪᛚᚩᚷ): 320
- Mournful (ᛗᚩᚢᚱᚾᚠᚢᛚ): 199
- Cabal (ᚳᚪᛒᚪᛚ): 341
Now we replace runes with numbers and get this matrix.
```
272 138 341 131 151
366 199 130 320 18
226 245 91 245 226
18 320 130 199 366
151 131 341 138 272
```
5x5 Matrix
So it appears we have a 5x5 matrix - one quick Google search on that has "risk matrix" and "magic square". It's clearly not a risk matrix and if we add all columns, all rows and the diagonal they all oddly sum to 1033.
So this is a magic square with all values of course being 1033\. At this point we might have to head back to the random set of characters discovered in between the images, because we've hit a dead end.
So knowing this random blob of data was in between two images - we aren't really sure what direction its intended to be. It appears to be hexadecimal as I don't see a single character higher than `f` and the rest is numeric. So before we do anything complex - lets just take it back to binary. Back to the power of xxd.
```
➜ cat 358chars | xxd -p -r
�#s#�3C33S�cc3��3#3��c##SC#�SC#c##��#33��cc3�S3C3�3#s#%
➜ cat 358chars | rev | xxd -p -r
272 138 341 131 151
366 199 130 320 18
226 245 91 245 226
18 320 130 199 366
151 131 341 138 272
```
It turns out it did have to be reversed to make human readable text, but sadly appears to be the same exact magic square we just decoded from the images. Maybe something has to do with the totient function we extracted from the hints in the runes? Without a discovery in a short period of time, but before additional research could continue the Apache status page updated.
It appeared that the embedded data had changed. We were now looking at a page that was just bluntly a dump of data.
```
HTTP/1.1 200 OK
Date: Sat, 11 Jan 2014 22:19:20 GMT
Server: Apache
Last-Modified: Sat, 11 Jan 2014 22:07:12 GMT
ETag: "d3e7-41a795-4efb910854400"
Accept-Ranges: bytes
Content-Length: 4302741
Vary: Accept-Encoding
Content-Type: text/html
ffd8ffe000104a46494600010100000100010000ffdb0043000806060706
```
[full file](https://raw.githubusercontent.com/iBotPeaches/cicada%5F3301/master/infotomb/laqs9.txt?ref=connortumbleson.com)
If we take this blob of characters back to binary (`xxd -p -r`) and we find once again a JPEG then a JPEG in reverse.
Updating our graphic above - it resembles this setup. So lets find the end point and rip out the images. We can probably search for `ff d9 d9 ff` and find the end points of both images squished together.
```
➜ dd if=data.bin of=2.bin bs=1 skip=$((0xD9F57))
1223337+0 records in
1223337+0 records out
1223337 bytes (1.2 MB, 1.2 MiB) copied, 4.67677 s, 262 kB/s
➜ perl -0777pe '$_=reverse' 2.bin > 2.jpg
➜ dd if=data.bin of=1.jpg bs=1 count=$((0xD9F57))
892759+0 records in
892759+0 records out
892759 bytes (893 kB, 872 KiB) copied, 3.42165 s, 261 kB/s
```
So what we did here is first skip the entire first image - then reversed that output to get the reversed JPEG into regular format. Once that was done we just adapted one parameter on dd to extract the first image instead.
Page 3 & 4 from Liber Primus
It seems we are getting more and more pages of this book. With more images we always have to check if outguess can detect data - sure enough this time it did.
````
➜ outguess -r 1.jpg 1.txt
Reading 1.jpg....
Extracting usable bits: 811192 bits
Steg retrieve: seed: 127, len: 31809
➜ outguess -r 2.jpg 2.txt
Reading 2.jpg....
Extracting usable bits: 1164245 bits
Steg retrieve: seed: 38370, len: 7524
➜ file 1.txt
1.txt: PGP signed message
➜ file 2.txt
2.txt: data
```
The 1st image appears to be another valid PGP message with some data contained within. The 2nd image is a blob of data that presently doesn't have any known magic header/footer so we will ignore that one for now.
So lets start with decrypting these runes on the above two pages. If we start with the first image we don't get anything on first glance that converts easily to English.
- `ᚢᛠᛝᛋᛇᚠᚳ ᚱᛇᚢᚷᛈᛠᛠ ᚠᚹᛉ` \-> `UEA[NG|ING][S|Z]EOF[C|K] REOUGPEAEA FWX`
As you can tell - since Gematria Primus can decode a rune to a variety of characters for `NG/ING` , `S/Z` and `C/K` we don't know exactly what it should be. When we went strictly from runes to English it was pretty obvious what letter it was intended to me in Part 1\. So at this point we are probably missing some form of transformation.
I always like to start with a rotation (ROT) for any type of string that looks vaguely already like text. At this point rotating through every possible rotation results in nothing.
#### ROT 0-26 of "UEA" String
****ROT-0**: UEA\[NG|ING\]\[S|Z\]EOF\[C|K\] REOUGPEAEA FWX
****ROT-1**: VFB\[OH|JOH\]\[T|A\]FPG\[D|L\] SFPVHQFBFB GXY
****ROT-2**: WGC\[PI|KPI\]\[U|B\]GQH\[E|M\] TGQWIRGCGC HYZ
****ROT-3**: XHD\[QJ|LQJ\]\[V|C\]HRI\[F|N\] UHRXJSHDHD IZA
****ROT-4**: YIE\[RK|MRK\]\[W|D\]ISJ\[G|O\] VISYKTIEIE JAB
****ROT-5**: ZJF\[SL|NSL\]\[X|E\]JTK\[H|P\] WJTZLUJFJF KBC
****ROT-6**: AKG\[TM|OTM\]\[Y|F\]KUL\[I|Q\] XKUAMVKGKG LCD
****ROT-7**: BLH\[UN|PUN\]\[Z|G\]LVM\[J|R\] YLVBNWLHLH MDE
****ROT-8**: CMI\[VO|QVO\]\[A|H\]MWN\[K|S\] ZMWCOXMIMI NEF
****ROT-9**: DNJ\[WP|RWP\]\[B|I\]NXO\[L|T\] ANXDPYNJNJ OFG
****ROT-10**: EOK\[XQ|SXQ\]\[C|J\]OYP\[M|U\] BOYEQZOKOK PGH
****ROT-11**: FPL\[YR|TYR\]\[D|K\]PZQ\[N|V\] CPZFRAPLPL QHI
****ROT-12**: GQM\[ZS|UZS\]\[E|L\]QAR\[O|W\] DQAGSBQMQM RIJ
****ROT-13**: HRN\[AT|VAT\]\[F|M\]RBS\[P|X\] ERBHTCRNRN SJK
****ROT-14**: ISO\[BU|WBU\]\[G|N\]SCT\[Q|Y\] FSCIUDSOSO TKL
****ROT-15**: JTP\[CV|XCV\]\[H|O\]TDU\[R|Z\] GTDJVETPTP ULM
****ROT-16**: KUQ\[DW|YDW\]\[I|P\]UEV\[S|A\] HUEKWFUQUQ VMN
****ROT-17**: LVR\[EX|ZEX\]\[J|Q\]VFW\[T|B\] IVFLXGVRVR WNO
****ROT-18**: MWS\[FY|AFY\]\[K|R\]WGX\[U|C\] JWGMYHWSWS XOP
****ROT-19**: NXT\[GZ|BGZ\]\[L|S\]XHY\[V|D\] KXHNZIXTXT YPQ
****ROT-20**: OYU\[HA|CHA\]\[M|T\]YIZ\[W|E\] LYIOAJYUYU ZQR
****ROT-21**: PZV\[IB|DIB\]\[N|U\]ZJA\[X|F\] MZJPBKZVZV ARS
****ROT-22**: QAW\[JC|EJC\]\[O|V\]AKB\[Y|G\] NAKQCLAWAW BST
****ROT-23**: RBX\[KD|FKD\]\[P|W\]BLC\[Z|H\] OBLRDMBXBX CTU
****ROT-24**: SCY\[LE|GLE\]\[Q|X\]CMD\[A|I\] PCMSENCYCY DUV
****ROT-25**: TDZ\[MF|HMF\]\[R|Y\]DNE\[B|J\] QDNTFODZDZ EVW
So probably not rotation like the first ever Cicada puzzle. The next puzzles used shifting even to the point of having a different shift of each character depending on some key (like we saw in the midi solve). However, we don't really have a obvious key thus far in this puzzle. We have however had reversed/rotated images quite often.
We can reverse these strings and nothing makes sense as [proven](https://theblob.org/rot.cgi?text=XWF%20AEAEPGUOER%20]K|C[FOE]Z|S[]GNI|GN[AEU&ref=connortumbleson.com) by another rot cipher on the reversed string, but there is a large difference of rotating a character after translation and prior.
We should try reversing the Gematria Primus and then try our rotation/shifts.
```
➜ php cicada app:translate
Enter a sentence to translate:
> ᚢᛠᛝᛋᛇᚠᚳ ᚱᛇᚢᚷᛈᛠᛠ ᚠᚹᛉ
Reverse the translation? (y/n) [n]:
> y
[IA|IO]FWPTEAD AT[IA|IO]OE[S|Z]FF EA[NG|ING]X
```
However, sadly even after reversing the Gematria Primus and shifting the string in every possible way - no go. At this point we must have a key - we just don't know what it is. That would open us up to many different types of ciphers much like the Vigenère cipher used in the first puzzle.
The problem we face is our string is in runes - not text. We can't assume that our translation from runes to text is the right one. We know from the book codes that jump around to a variety of different characters - our code may not be as easy as straight forward or reverse.
We should build a script that takes a runic word and uses it to shift characters. Remember in the very first puzzle we shifted each letter increasing throughout the key wrapping around when done. The problem is we are either blind and missing the key to attempt shifting or we are meant to brute force it.
Lets collect all the words used in some recent Cicada things and start to build a word list. To start I've extracted the [Instar Emergence](https://github.com/iBotPeaches/cicada%5F3301/blob/master/wordlists/instar%5Femergence.txt?ref=connortumbleson.com) poem from the song, then one of the books ([Voice of Devil](https://github.com/iBotPeaches/cicada%5F3301/blob/master/wordlists/voice%5Fof%5Fdevil.txt?ref=connortumbleson.com)) from a previous puzzle.
Now lets run this through all the words we extracted and attempt a translation on the first rune line (`ᚢᛠᛝᛋᛇᚠᚳ ᚱᛇᚢᚷᛈᛠᛠ ᚠᚹᛉ`) we see above.
[app:bruteforce-vigenere](https://github.com/iBotPeaches/cicada%5F3301/pull/33?ref=connortumbleson.com) (GitHub)
In the first output of this brute-force we see something interesting - towards the bottom `divinity` looks to spell something in English. So guess we got a hit from the song used in an earlier puzzle. It reads as `WELCOME WELCOME PIL` which appears to be the start of a valid sentence. It seems we've found the key, even if brute-forcing felt a bit sour. Maybe we missed something with the magic square that resulted in "divinity".
So lets start decoding this line by line.
- `ᚢᛠᛝᛋᛇᚠᚳ ᚱᛇᚢᚷᛈᛠᛠ ᚠᚹᛉ` \-> `WEL[C|K]OME WEL[C|K]OME PIL`
- `ᛏᚳᛚᛠ ᚣᛗ ᛠᛇ ᛏᚳᚾᚫ ᛝᛗᛡ` \-> `OEAME BN EO[S|Z] OEAH[S|Z] EONJ`
We've already missed something - the 2nd line doesn't appear to be valid. However, I broke the lines based visually on the book above. Maybe we need to break to a newline on a specific rune (2 dots, 4 dots, etc).
```
ᚢᛠᛝᛋᛇᚠᚳ ᚱᛇᚢᚷᛈᛠᛠ ᚠᚹᛉᛏᚳᛚᛠ ᚣᛗ ᛠᛇ ᛏᚳᚾᚫ ᛝᛗᛡᛡᛗᛗᚹ ᚫᛈᛞᛝᛡᚱ ᚩᛠ ᛡᛗᛁ ᚠᚠ ᛖᚢᛝ ᛇᚢᚫ
WEL[C|K]OME WEL[C|K]OME PILGRIM TO THE GREAT JOURNEY TOWARD THE END OG HFJ OLN
```
That looks to work much better, but we oddly fail decoding somewhere around the 62nd character. We don't have any permutations left with the spacing so time for some research on the cipher. A few Google searches and we discover that a ciphertext can contain a manual reset that occurs at seemingly random points in the string.
debugging tool
So if we set a break point on the character that looks bugged - we see something interesting. Our shifted character becomes (`G`) which is invalid, but the original character prior to shift was (`F`) which seems correct. However, if we make an exception for `F` the decryption falls apart badly.
- `WEL[C|K]OFA B[S|Z]WAEEOEM FY[IA|IO]MJI[IA|IO]`
As you can see - this time since we made an exception for `F` it crashed way earlier. Now we know its the 62nd character by the time we've converted out of runes, but runes can decrypt to multiple characters. Therefore instead I think its safer for a test to use the runic index (`59`) for this test instead of the output character number.
- `WEL[C|K]OME WEL[C|K]OME PILGRIM TO THE GREAT JOURNEY TOWARD THE END OF ALL TH[NG|ING][S|Z]`
Sure enough that appeared to work. We can make sense of the string in its entirety. Sadly this appears to be a time consuming task, as we paste the entire string into our decoder and we only get a bit further until the string falls apart.
```
WEL[C|K]OME WEL[C|K]OME PILGRIM TO THE GREAT JOURNEY TOWARD THE END OF ALL TH[NG|ING][S|Z] IT I[S|Z] NOT AN EA[S|Z]Y TRIP BUT MMEA
```
It appears we might have more than one index to skip our decoding. Each time the string looks to fall apart - we will add that runic index to our list. The 2nd time it appeared to be index (`95`). When we are done setting break points and developing a list of indexes we get all the runic indexes to skip and string of:
💡
These indexes are based on the spacing of the runes in this [file](https://github.com/iBotPeaches/cicada%5F3301/blob/master/liber%5Fprimus/markdown/03.md?ref=connortumbleson.com).
- 59, 95, 108, 170, 204, 205, 312
```
WEL[C|K]OME WEL[C|K]OME PILGRIM TO THE GREAT JOURNEY TOWARD THE END OF ALL TH[NG|ING][S|Z] IT I[S|Z] NOT AN EA[S|Z]Y TRIP BUT FOR THO[S|Z]E WHO FIND THEIR WAY HERE IT I[S|Z] A NE[C|K]E[S|Z][S|Z]ARY ONE ALO[NG|ING] THE WAY YOU WILL FIND AN END TO ALL [S|Z]TRUGGLE AND [S|Z]UFFER[NG|ING] YOUR INNO[C|K]EN[C|K]E YOUR ILLU[S|Z][IA|IO]N[S|Z] YOUR [C|K]ERTAINTY AND YOUR REALITY ULTIMATELY YOU WILL DI[S|Z][C|K]OUER AN END TO [S|Z]ELF
```
We don't really need to run this through our permutation code because its pretty clear what its supposed to say.
> Welcome
> Welcome pilgrim to the great journey towards the end of all things.
> It is not an easy trip, but for those who find their way here it is a necessary one.
> Along the way you will find an end to all the struggle and suffering.
> Your innocence, your illusions, your certainty, and your reality.
> Ultimately you will discover an end to self.
Now remember back in Part 1 it called out - `DO NOT EDIT OR CHANGE THIS BOOK`, which we did here. When I wrote the brute-force code - it crashed immediately because we had no translation for the letter V. I just treated it as the same rune as letter U. So I am seriously doubting the only way to obtain the key `divinity` was brute-force - we must be missing something.
Onward to the 2nd page above - lets hope that its the same key and cipher we just discovered. Sadly in one quick test of the first line you can see below it didn't.
- `ᛗᚣ ᚣᛇ ᚫᛉᚱᛄᛋᛖ ᛖᚹᚾ ᛞᛄᚢᛋᛉᚣᛏ` \-> `AET AETH TRBX[NG|ING]H BYF PAR[NG|ING]RAEG`
However, the 4th page starts with the 4 dot runic symbol. It appears like a book to just be a continuation of the last page. We should try and add these runic symbols at the end of page 3 - perhaps the shift continues as-is into page 4.
- `ᛗᚣ ᚣᛇ ᚫᛉᚱᛄᛋᛖ ᛖᚹᚾ ᛞᛄᚢᛋᛉᚣᛏ` \-> `IT I[S|Z] THROUGH THI[S|Z] PILGRIM`
This appeared to be the solution. Page 3 and 4 continue (perhaps even more pages) on the same shift of `divinity` with presumably more indexes to skip. So lets start with combining all the runes in one solid line and go back to the slog of running through this decryption and manually flagging indexes to skip when the translation appears to break.
```
ᚢᛠᛝᛋᛇᚠᚳ ᚱᛇᚢᚷᛈᛠᛠ ᚠᚹᛉᛏᚳᛚᛠ ᚣᛗ ᛠᛇ ᛏᚳᚾᚫ ᛝᛗᛡᛡᛗᛗᚹ ᚫᛈᛞᛝᛡᚱ ᚩᛠ ᛡᛗᛁ ᚠᚠ ᛖᚢᛝ ᛇᚢᚫ ᚣᛈ ᚱᚫ ᛁᛈᚫ ᚳᚫ ᚫᚾᚹ ᛒᛉᛗᛞ ᚱᛡᛁ ᚠᛈᚳ ᛇᛇᚫᚳ ᚱᚦᛈ ᚠᛄᛗᚩ ᛇᚳᚹᛡ ᛒᚫᚹ ᛒᛠᛚᛋ ᚱᚣ ᛄᚫ ᚱ ᛗᚳᚦᛇᚫᛏᚳᛈᚹ ᛗᚷᛇ ᚳᛝᛈᚢ ᛇᚳ ᚱᛖᚹ ᛡᛈᛁ ᛒᚣᛒᛉ ᚠᛚᛁᚱ ᚱᛗ ᚳᚷᛒ ᚣᚱ ᚳᚠᚢ ᚦᛈᛡᛄᚹᛏᚠᛠ ᛄᚷᛒ ᚫᚦᚠᚠᛠᛈᚦ ᛈᚠᚪᛉ ᛄᛗᛖᛈᛝᛋᚩᛋᛗ ᚹᛇᛄᛚ ᚹᛉᚢᚦᚫᚹᛗᚦ ᛞᚣᛄᚳ ᛋᛡᛉᚩᛝᚱᛗᛒᚹ ᚱᛗᛁ ᛞᚣᛄᚳ ᛉᚻᚢᚣᛈᛚ ᛄᛝᚣᛗᚠᛄᛈᛇᚢᛡ ᚹᛇᛄ ᛞᚹᛉᚢ ᚪᛚᚪᛋᛗᛡᛇᛉ ᚫᛗ ᛡᛗᛁ ᛈᚣ ᚫᛗᚢᚠ ᛗᚣ ᚣᛇ ᚫᛉᚱᛄᛋᛖ ᛖᚹᚾ ᛞᛄᚢᛋᛉᚣᛏᛖᛏᛗ ᛇᚱᚣ ᛞᛋ ᚾᛖᚫᛞᛡ ᛈᛒᚢᚾᛠᛝᛄᛡᚫ ᛄᚷᛒ ᛈᚦᛉ ᛈᚾᚹᚹᛁᛚᛗᚫ ᛚᛈᛒᚢᚩᛠᛡ ᚱᛡᛠᚠ ᚱᚱᛇᛄᛗ ᚱᛗᛁ ᛞᚣᛄ ᚻᛚᚠᚢ ᛄᚢᛡᛚᚦᛠ ᛇᛄᚩᛇᚱᚱᛗ ᚢᛗᛋᚳ ᛠᛇ ᛚᛁᚫᚫᚳᛚ ᚹᛁ ᛚᛏ ᛈᛖᚢᛈ ᛠᛡᛈᚦᛏᛒ ᛏᛗᛖ ᚢᛚᚩᛚᛖ ᛇᛄᛈ ᚢᛠ ᛚᚳᚷ ᛠᚷᛋᛡᛏᛗ ᛒᛗᚱᚦᚠᛈ ᚹᚱᛄ ᚱᛉᚳ ᛝ ᛄᛠᛟ ᛄᛖᚣᛗ ᛞᚣᛄᚳᚫᛡᚢᚠ ᛈᚠᚪ ᚳᚳᛠ ᚱ ᚢᛄᚱ ᚪᛗᛒᛈ ᚷᛈᛒᚢᚾᛠᛝᚠ ᚾᛉᛖ ᚣᚷᛁᛠᛝᚢᛗᛏᚳᚷᛠᛠ ᛄᚫ ᛒᛈᚹᛞ ᚠᚣᛉ ᚫᚢᚠ ᛇᛄᛈ ᛉᛚᚦᛠᚪ ᛚᚦ ᚳᚣᚢᛡ ᚳᛖ ᛚᚫᛇᛁᛉᚦᛋᚫᚻᚫ ᚦᚣᚠᛚᚳᛖᚱ ᛈᚠᚪᛉ ᚱᛒᛖ ᚫᚳᛒᚠ
```
This time we expand our indexes to skip shifting of the following:
- 59, 95, 108, 170, 204, 205, 312, 523, 551, 578, 638
Which now generates the additional block of:
```
IT I[S|Z] THROUGH THI[S|Z] PILGRIMAGE THAT WE [S|Z]HAPE OUR[S|Z]ELUE[S|Z] AND OUR REALITIE[S|Z] JOURNEY DEEP WITHIN AND YOU WILL ARRIUE OUT[S|Z]IDE LI[C|K]E THE IN[S|Z]TAR IT I[S|Z] ONLY THROUGH GO[NG|ING] WITHIN THAT WE MAY EMERGE WID[S|Z]OM YOU ARE A BE[NG|ING] UNTO YOUR[S|Z]ELF YOU ARE A LAW UNTO YOUR[S|Z]ELF EA[C|K]H INTELLIGEN[C|K]E I[S|Z] HOLY FOR ALL THAT LIUE[S|Z] I[S|Z] HOLY AN IN[S|Z]TRU[C|K]T[IA|IO]N [C|K]OMMAND YOUR OWN [S|Z]ELF
```
Or cleaned up into:
> It is through this pilgrimage that we shape ourselves and our realities
> Journey deep within and you will arrive outside
> Like the Instar it is only through going within that we may emerge.
>
> Wisdom
> You are a being onto yourself
> You are a law onto yourself
> Each intelligence is holy
> For all that lives is holy
> An instruction: Command your own self
It was nice for this page to call out the Instar Emergence which helps solidify our key (`divinity`) - remember this key came from that song:
```
The Instar Emergence
Parable 1,595,277,641
Like the instar, tunneling to the surface
We must shed our own circumferences;
Find the divinity within and emerged
```
[Puzzle 2](https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/)
However saying all of that - we finally understand these two pages and haven't appeared to discover anything to progress this puzzle forward. So lets jump back to the data embedded in the images themselves. The 1st page (Page 3 of Liber Primus) had a PGP message contained within the payload.
If we examine that payload - we get a message and payload.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Let the text guide you.
Good luck.
3301
ffd8ffe000104a46494600010101019001900000ffdb0043000302020202
// snipped
```
[full file (GitHub)](https://github.com/iBotPeaches/cicada%5F3301/blob/master/messages/2014/let-the-text-guide-you.asc?ref=connortumbleson.com)
So we pull that snippet of hex out of the signed message and proceed to run our basic test - convert to binary, run binwalk.
```
➜ xxd -r -p payload payload.bin
➜ binwalk payload.bin
DECIMAL HEXADECIMAL DESCRIPTION
----------------------------------------------------
0 0x0 JPEG image data, JFIF standard 1.01
```
Sure enough we have an image. Once extracted it becomes:
Page 4 Liber Primus outguess data
Now we have a runic short string - lets get this into text and run it through our translation code.
```
ᚦᛗᛞᛇᚠᛗᚪᚱ5ᚢᚫᛝᚱᛝ3 ᛠᛗᛇᚠᛡ
```
Unfortunately in the following tests - all failed.
- Pure translation
- Pure reversed translation
- Vigenere cipher with `divinity` key.
- Vigenere reversed cipher with `divinity` key.
- Brute force with existing word lists.
The last few pages decoded though had some very interesting Cicada 3301 words. Lets load those pages into our word lists. This is a useless endeavor as we are presumably based on the string size looking for `{random}.onion` so we can't really tell whats right or wrong unless we see "onion" at end.
However, the hint is "*let the text guide you*" - does that mean the runic text we just translated? What if the key is the entire decoded text? It couldn't possibly be that because the ciphertext isn't that long and the Vigenere cipher can't leverage a key that is larger than the decrypted text.
So lets start with just the first few words like - `welcomewelcomepilgrimtothegreat`. This fails miserably, but we duplicated `welcome` and included red words.
There is only one red word on this page, so perhaps we skip it. Lets try using `welcomepilgrimtothegreat`.
```
➜ php cicada app:vigenere
Enter a sentence to translate:
> ᚦᛗᛞᛇᚠᛗᚪᚱ5ᚢᚫᛝᚱᛝ3 ᛠᛗᛇᚠᛡ
Enter the key.:
> welcomepilgrimtothegreat
Translation: AUOWYFGL5L[C|K][S|Z]FJ3 NON[IA|IO]N
```
This looks very promising, we can see `ONION` at the end of the string. We probably don't need a key that long, but it worked. Lets run our permutation code and toss out any that don't result in `.onion`.
```
AUOWYFGL5LCSFJ3N ONION
AUOWYFGL5LCZFJ3N ONION
AUOWYFGL5LKSFJ3N ONION
AUOWYFGL5LKZFJ3N ONION
```
With only 4 chances this won't be hard. However, none of them worked. What interests me in this string though is we have both `U` and `F`, both of which have acted weirdly throughout this puzzle.
- `U` is what we mapped `V` towards in our word list code.
- `F` is what normally caused the decoding to skip a shift.
So lets go again and do a ton more permutations on this until the domain is valid. We will swap `[U/V]` for another set of permutations. Sure enough it was the `U/V` switch as one of those domains resolved correctly.
- `ᚦᛗᛞᛇᚠᛗᚪᚱ5ᚢᚫᛝᚱᛝ3 ᛠᛗᛇᚠᛡ` \-> `avowyfgl5lkzfj3n.onion`
We finally had a new onion, but we will discuss the 4th onion (and more) in [Part 3](https://connortumbleson.com/2024/06/03/the-cicada-3301-mystery-puzzle-3-solve-part-3/).
---
- [Puzzle 1](https://connortumbleson.com/2019/09/30/the-cicada-3301-mystery/) (2012)
- [Puzzle 1 - 2nd Chance](https://connortumbleson.com/2021/04/12/the-cicada-3301-mystery-puzzle-1-extra/) (2012)
- [Puzzle 2](https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/) (2013)
- [Puzzle 3 - Part 1](https://connortumbleson.com/2021/02/15/the-cicada-3301-mystery-puzzle-3-part1/) (2014)
- Puzzle 3 - Part 2 (2014) - You are here.
- [Puzzle 3 - Part 3](https://connortumbleson.com/2024/06/03/the-cicada-3301-mystery-puzzle-3-solve-part-3/) (2014)
- [Puzzle 3 - Part 4](https://connortumbleson.com/2024/12/23/the-cicada-3301-mystery-puzzle-3-solve-part-4/) (2014)
### AI & Cicada 3301
URL: https://connortumbleson.com/2024/01/29/ai-cicada-3301/
Last updated: 2025-02-04T11:42:23.000Z
A few weeks ago I got the urge to work on some [Cicada 3301](https://connortumbleson.com/tag/cicada-3301/) things, but the test of time has caused a good deal of research and sources to vanish. The 2014 puzzle remains unsolved, but every once in awhile a YouTube video, podcast or news article attracts some old/new faces back to the puzzle.
I've been reworking the puzzles one by one - slowly getting to the point that I'm in unsolved territory. I find solving previously solved puzzles, but forcing myself to just use the source material and attempt solves myself are the most rewarding. Lots of guides jump rather quickly or go from one step to another with no description on why.
When you work to solve them without just following an older guide - you understand the puzzles far better. So I've started working on the puzzles again, but wanted to leverage the type of technology available in this day in age.
So I decided to build my own tools for understanding the Liber Primus as well as leveraging AI models to help me in this journey. This post is describing some of that success.
---
While I wrote this post - a good deal of the graphics and quotes were generated from OpenAI GPT4 between December 2023 and January 2024\. This was an experiment to see how AI could help Cicada 3301 research and not an attempt to move towards AI for future blog content generation.
At first I wanted to refresh my AI prompt handling and start small with the magic square available in the 2014 puzzle.
#### AI Prompt: Magic Square
272 138 341 131 151
366 199 130 320 18
226 245 91 245 226
18 320 130 199 366
151 131 341 138 272
Can you determine anything from these numbers? What makes them important?
A simple warm up and it excelled perfectly on 1st try.
> The numbers you've presented form a 5x5 grid. This arrangement and the specific numbers could imply several things, such as being part of a puzzle, a mathematical problem, or a coded message. Let's analyze a few possibilities:
> **1) Magic Square:** A magic square is a grid where the sum of numbers in each row, column, and sometimes diagonals is the same. We can check if this grid forms a magic square.
> **2) Pattern or Sequence:** There might be a numerical pattern or sequence within the grid, such as arithmetic or geometric sequences, or some other mathematical relationship between the numbers.
> **Encoded Message:** It could be a form of coded message where numbers represent letters or other symbols, commonly used in cryptography.
> Let's first check if this is a magic square by summing the rows, columns, and diagonals. If the sums are equal, it's a magic square. If not, we'll consider other possibilities. I'll calculate the sums now.
> The sums of the rows, columns, and both diagonals in your grid are all equal to 1033\. **This indicates that the grid is a magic square**. A magic square is a square grid of numbers where the sum of the numbers in each row, column, and both main diagonals is the same. This particular property makes your grid of numbers significant and interesting from a mathematical perspective. Magic squares have been studied for centuries and are often associated with mathematical puzzles and recreational mathematics.
Of course I knew this was a magic square before asking, but I was wondering if OpenAI could deliver with one simple prompt. So I went onward to see how well it could recap what Cicada 3301 even is.
#### AI Prompt: What is Cicada 3301
What is Cicada 3301?
> Cicada 3301 is a name given to an enigmatic organization that, on three occasions between 2012 and 2014, posted a series of complex puzzles and alternate reality games online, ostensibly to recruit highly intelligent individuals. The puzzles utilized a wide range of knowledge areas including cryptography, stenography, data security, and internet anonymity.
> The first puzzle appeared on January 4, 2012, on a message board, inviting participants to find a hidden message within an image. This led to a series of other challenges, involving code-breaking, book references, hidden websites, and physical clues placed in various locations around the globe. The puzzles often led to more questions than answers, with many participants collaborating online to try to solve them.
> The true purpose and the organization behind Cicada 3301 remain shrouded in mystery. Speculation about its nature ranges from it being a recruitment tool for a spy agency, to a private think tank, to a sophisticated alternate reality game created simply for the challenge. The organization itself stated that its goal was to find "intelligent individuals" and that it was not connected to any commercial interests, but these claims have not been verified.
> Despite extensive interest and investigation, the identities of the creators or the participants who successfully completed the puzzles have not been publicly revealed, nor has the nature of the organization been definitively established. This has added to the allure and enduring mystery of Cicada 3301.
So at this point I wanted to work on its skills given a page of the Liber Primus. While it knew the book was runic in nature - it suffered badly at attempting OCR based transcriptions. So I started working on a little [open source project](https://github.com/iBotPeaches/cicada%5F3301?ref=connortumbleson.com) to help automate my prompt building.
So I started with at first copying runes (in their Unicode component).
#### AI Prompt: Translate Runes
ᛋᚩᛗᛖ•ᚹᛁᛋᛞᚩᛗ
ᚦᛖ•ᛈᚱᛁᛗᛖᛋ•ᚪᚱᛖ•ᛋᚪᚳᚱᛖᛞ
ᚦᛖ•ᛏᚩᛏᛁᛖᚾᛏ•ᚠᚢᚾᚳᛏᛡᚾ•ᛁᛋ•ᛋᚪᚳᚱᛖᛞ
ᚪᛚᛚ•ᚦᛝᛋ•ᛋᚻᚩᚢᛚᛞ•ᛒᛖ•ᛖᚾᚳᚱᚣᛈᛏᛖᛞ
ᚳᚾᚩᚹ•ᚦᛁᛋ
what does this say?
> The text you've provided is written in the Elder Futhark runic alphabet, which was used in ancient Germanic languages before the adoption of the Latin alphabet. Here's the transliteration and translation of the text:
> ᛋᚩᛗᛖ (some) •ᚹᛁᛋᛞᚩᛗ (wisdom)
> ᚦᛖ (the) •ᛈᚱᛁᛗᛖᛋ (primes) •ᚪᚱᛖ (are) •ᛋᚪᚳᚱᛖᛞ (sacred)
> ᚦᛖ (the) •ᛏᚩᛏᛁᛖᚾᛏ (totient) •ᚠᚢᚾᚳᛏᛡᚾ (function) •ᛁᛋ (is) •ᛋᚪᚳᚱᛖᛞ (sacred)
> ᚪᛚᛚ (all) •ᚦᛝᛋ (things) •ᛋᚻᚩᚢᛚᛞ (should) •ᛒᛖ (be) •ᛖᚾᚳᚱᚣᛈᛏᛖᛞ (encrypted)
> ᚳᚾᚩᚹ (know) •ᚦᛁᛋ (this)
> In modern English, this can be translated as:
> "Some wisdom: The primes are sacred, The totient function is sacred, All things should be encrypted.
> Know this."
> This message seems to be referencing mathematical concepts like prime numbers and the Euler's totient function, both of which are fundamental in number theory and cryptography. The emphasis on encryption suggests a theme of data security or cryptographic wisdom.
I was quite amazed by this, but the more I thought about it the less impressed I became. I gave the AI the Unicode components of the runes - that meant it probably had the entire Unicode character library catalogued. At that point it was probably a simple lookup table to turn runes to letters and spelling it out.
It would be more crazy if I could just give the AI the image of a page and see how it handled. This did not work in any shape in form in a few hours of prompt engineering.
I started with an image like so
It started off just failing to OCR.
> It appears that the OCR process did not return any text, which can happen if the characters are not recognized or are outside the expected character set for the OCR engine.
So I provided the rune set (U+16A0..U+16FF) in play and AI converted it to black and white and still failed.
> Given that the runes fall within the Unicode range U+16A0 to U+16FF, a different approach would be to use a rune recognition tool or software specifically designed for this purpose, or to manually map the image against a chart of rune characters within that Unicode block.
> As my capabilities are based on general OCR technology, I'm unable to directly transcribe these runes. However, if you have a reference for the runes, I could assist.
So I started working on a little [extension](https://github.com/iBotPeaches/cicada%5F3301/blob/master/tool/app/Commands/BuildPrompt.php?ref=connortumbleson.com) to my Cicada repository to formulate prompts to aid these discussions. It worked well with output like so:
```
As I give you images - please return the transcription in a short reply. I'm basically looking for the
unicode runes that are represented in the image. Please keep the spacing as I have it in the image, which may be
represented by dots between runes - consider those spaces.
ᚠ - F
ᚢ - U
ᚦ - TH
// ...
```
However, even doing that - it was wrong.
> The transcription of the runes from the provided image is as follows:
> ᛖᛗᚢᚱᛞ-ᛈᚱᛁᛗᚢᛋ-ᛈᚾᛖᚢᛗᛖᚱᚩᛏᛇᛝᚳᛖᚹᚾᛗᚫᚳᛚᛚᚹᛗ-ᚾᚹᛗ-ᚹᚦᚳ.
There was only 7 runes in that, but it generated way more. As I pushed the machine to refine the results - it ended with giving up. Perhaps trying to hammer OCR behavior into AI without a solid amount of training isn't worth it.
It seems that the runes box size (size each character takes up) is wildly different for each runic character. I'm not well versed in the OCR process or tools, but it seems [one author](https://github.com/dude123124144/Liber-Primus-Runes-OCR?ref=connortumbleson.com) has been spending time on just that - refining an OCR process to review the pages.
So as I spent more time with GPT4 - I realized I wasn't really gaining anything in regards to progressing with Cicada research. However, it did excel massively in helping me remember the exact parameters to utilize when working with Perl and dd.
So while a bit of training and effort may prove to have a helpful Cicada 3301 AI helper - at the moment it only knows what is a quite search away.
### Crowd Funding Products
URL: https://connortumbleson.com/2024/01/22/crowd-funding-products/
Last updated: 2025-02-04T11:42:24.000Z
Photo by [Austin Distel](https://unsplash.com/@austindistel?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A long time ago in my years of college the popularity of funding projects was pretty large. Perhaps it was the websites and "scene" I hung out in, but I started my funding with the Pebble watch.
[Pebble Watch - Kickstarter](https://www.kickstarter.com/projects/getpebble/pebble-e-paper-watch-for-iphone-and-android/description?ref=connortumbleson.com)
I watched the video and description of this product and was blown away - remember this is 2011/2012 at this point. The Apple Watch and Android Wear were still a few years out, maybe they even reacted to the release of this product.
Watching a video of a nerd explaining some technology and how they just needed a bit of crowd-funding to turn their proof of concept into a real product convinced me. I funded the project and followed along with each update. They kept us in the loop, provided explanations for changes or delays and about a year or more later - I got one in the mail.
I wired it up with my Android device and it was the nerd tool I wanted. At this point though more than a year had passed since I funded this and technology felt a bit dated with the fast moving "smart" device technology.
Sure I had a cool toy, but then I saw at CES that year that Pebble was launching a new designed Pebble called "Pebble Steel". It was probably all the changes they wanted to make during the Kickstarter campaign, but couldn't due to causing shipping delays.
At that moment I felt a bit odd. Roughly by the time I got the item I paid for - the 2nd iteration was already announced a month out. Sure this is true for all products ever, but buying something and getting it a year or more later felt odd. So I ignored the Pebble Steel and just kept using my original Pebble.
At one point my Pebble broke - forgot exactly how, but it wouldn't turn on despite getting power. Going from never wearing a watch to wearing one - when it broke I felt no need to obtain another.
Projects created by Pebble Technology
I watched from afar as Pebble launched two more extremely successful campaigns this time netting 20 million dollars instead of \~13\. It was insane how much success these guys had with crowd-funding, but I stayed away. What happened next I'm not truly positive how it all went down.
In short:
- Pebble filed for insolvency.
- Fitbit acquired Pebble assets and intellectual property.
- Fitbit somehow did not ingest debts.
- All Pebble 2 shipments were cancelled and Kickstarter refunded.
It was crazy and I didn't understand how a company with a few people somehow burned through millions of millions of dollars and collapsed. Turns out I didn't have the full story as between VC investors and fast booming of the company - a few decisions and desire to compete with the rising Apple/Google probably led to the demise.
So I felt a bit validated not supporting anything after the original Pebble Kickstarter, but then I stumbled upon the [Canary Indiegogo](https://www.indiegogo.com/projects/canary-the-first-smart-home-security-device-for-everyone?ref=connortumbleson.com#/).
[Canary - Indiegogo](https://www.indiegogo.com/projects/canary-the-first-smart-home-security-device-for-everyone?ref=connortumbleson.com#/)
As quick as I had promised to avoid crowd-funding, I folded and funded the Canary at $199 for a security system. My life was at the point of many computers and Xboxes and leaving home in the odd part of Arkansas I wanted some peace of mind. Probably was the place I lived and the unfortunate neighbors below, but when I came home to police at my complex a few times I realized I wanted to up the security in my apartment.
I was attracted to the idea that this worked with my smartphone and had no contracts or requirements to build onto the apartment. So in August of 2013 I pledged the product with an estimated delivery of May 2014, but I didn't get it until January of 2015\. At that point I honestly forgot about it and I had moved addresses.
Either way though I loaded it up and enjoyed having a view back home no matter where I went. It tended to alert on the fan moving and sunlight entering the place so it got annoying getting alerts often, but other than that worked as expected.
What sadly happened is every few years a feature that was previously free was moved onto the premium plans and competitors were released. You could buy Google cameras now (which I did) or even brand-less cameras that just worked on your internal network. Others were far more angry than I was calling the crowd-funding a bait/switch, but I realized that all the logic they were doing with video feeds for free couldn't last forever. Ultimately unless you are Google and can lose money on a product to make money on others - they needed recurring revenue to pay for costs and didn't get it.
However, much like the Pebble waiting more than 18 months for a product you paid for is just not my cup of tea. By the time I got the product the Google Nest product line was booming and Ubiquiti looked excellent if I had a bit more money to spend. Not to mention learning month after month the product you funded get slightly changed and tweaked and delayed was a common pattern.
So I stopped supporting Canary and basically stopped supporting crowd-funding until March of 2023 when I stumbled upon The Flux Keyboard.
[Flux Keyboard - Kickstarter](https://www.kickstarter.com/projects/fluxkeyboard/flux-keyboard-the-keyboard-reinvented?ref=connortumbleson.com)
I'm not sure what enticed me to pledge this, but seeing how I put zero effort into my keyboards and others in my position are quite addicted to their design/type/feel I saw something that looked cool in my eyes.
However, much like has been the pattern for other projects we are currently in the phase of delays and delays. They were originally slated to ship in November of 2023, which became December 2023, then January 2024, then February, then March and now April 2024\. Not only has time been extended, but the product continues to have changes that make it less and less what was promised.
Folks are upset that there are no videos and lack of progress. While monthly updates occur they are on the last day of the month and tend to carry sad news with no rich media. I'll admit I'm worried that it'll be another gimmick that serves no real purpose in daily usage by the time it shows up. If running by my luck with my previous two crowdfunding projects it'll probably arrive in late 2024.
A short video showing some pre-production units and discussing the challenges would go a long way for this company. Nothing like the start of a 6 month delay with nothing but text and a few rendered images as the reason for the delay.
---
I promised to not crowdfund things after the Pebble and Canary, but I folded for the Flux Keyboard. I'll learn quite soon whether to reinforce that thought to avoid crowd-funding or I'll own a cool keyboard and find something else to pledge.
### Apktool v2.9.3 Released
URL: https://connortumbleson.com/2024/01/20/apktool-v2-9-3-released/
Last updated: 2025-02-04T11:42:24.000Z
Apktool v2.9.3 has been released! This release is a hot-fix on top of the previous v2.9.2 release for a related security fix.
Discovered by [Cl0udG0d](https://github.com/Cl0udG0d?ref=connortumbleson.com) the previous path traversal fix was not hardened when running against Windows. It was learned that Windows will handle both path separators (`/` and `\`) which v2.9.2 had previously isolated to the intended OS. Now cleansing of resource names will include both path separators no matter the OS.
Apktool has had a few CVEs over the last decade, but the last one was the most public for sure. I attribute that to the rise of automated detection logic which flagged systems and tools to update their version of Apktool. This meant lots of folks asked for patches to various old versions. Apktool hasn't really taken care in supporting older versions, but will take a more serious effort now.
v2.10.x will be the next large feature release, but a branch v2.9.x exists for security/urgent fixes. We will try and support the last release or two until it doesn't seem worthwhile.
**Sponsors**
I launched [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com) to help provide another alternative for folks showing appreciation. I want to remind folks of two companies that continue to hold a monthly donation for the project.
- [Emerge Tools](https://www.emergetools.com/?ref=connortumbleson.com) came online to sponsor the tool.
- [Sourcetoad](https://sourcetoad.com/?ref=connortumbleson.com) (self employer) additionally joined to sponsor (as well as a few other projects).
---
**This release had 3 commits by 1 person**
- Connor Tumbleson (iBotPeaches) - 3 commits
---
# Changes since 2.9.2
- \[[#3492](https://github.com/iBotPeaches/Apktool/pull/3492?ref=connortumbleson.com)\] Fix #GHSA-vgwr-4w3p-xmjv (Arbitrary file writes on Windows). (Thanks Cl0udG0d)
## Notes
- The v2.9.x releases have moved to aapt2 being the default. If you'd like to return to the previous behavior, please use `--use-aapt1` during build stage.
## Download
[Download Apktool 2.9.3](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.9.3.jar?ref=connortumbleson.com)
- [Apktool 2.9.3](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.9.3.jar?ref=connortumbleson.com)
- `e28e4b4a413a252617d92b657a33c947` (md5)
- `7956eb04194300ce0d0a84ad18771eebc94b89fb8d1ddcce8ea4c056818646f4` (sha256)
- Rename to `apktool.jar` and follow the [Instruction Guide](https://apktool.org/docs/install?ref=connortumbleson.com) if you need help.
- [2.9.3 Doc Site Post](https://apktool.org/blog/apktool-2.9.3?ref=connortumbleson.com)
## Links
- [Project Site](https://apktool.org/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### Exploring Trails
URL: https://connortumbleson.com/2024/01/15/exploring-parks/
Last updated: 2025-02-04T11:42:24.000Z
Snead Island
Every so often I visit a park and what I'm looking for is no people around so I can capture a shot of the path/trail you walk. I realized after a few years that I haven't really done anything with these Android quality photos, so I've collected them all.
Something about the human produced pathway in between encroaching nature is just a perfect photo to take in my eyes.
Weedon Island - St. Petersburg, FL
Weedon Island is located on the far north-east side of St. Petersburg and is an enormous park. The trails range from complete dirt extremely wide trails to regular boardwalk style paths. A cool free admission park that comes in around 3,200 acres large.
Brooker Creek - Tarpon Springs, FL
Brooker Creek is a far more rural park also free clocking in around 8,700 acres of preserves. These trails depending on how far you go decay further and further into what nature wants. In the summer months this park is brutal with immense amounts of mosquitos and lack of shade when you hit the Blackwater Cutoff. For most visitors they will stay on the Ed Center Trail which is mostly a boardwalk.
IRB Nature Preserve - Indian Rocks Beach, FL
In the heart of Indian Rocks Beach lies the Indian Rocks Beach Nature Preserve which has a playground, but also a really elegant boardwalk that intertwines around the mangroves. You'll encounter plenty of birds and have a great view of the ocean/beach - the park is free to visit, but chances are the few parking spots will be taken. You might end up paying a price to park in the highly condense/busy area.
Lake Rogers Conservation Park - Odessa, FL
An enormous park that I've blogged about [specifically](https://connortumbleson.com/2016/03/03/ingress-a-morning-hike/) before. This park has a variety of trails that circle around Lake Rogers itself. You'll pay $2 (or have a park pass) on a honor system to visit this park. The payment makes sense when you realize there are water stations around the park that are kept filled, cool and full of temporary cups. This park like others ranges between plowed and just a mowed chunk of nature.
Citrus Park bridge between Publix/neighborhood.
This isn't even a park, but it felt out of place when I lived in Citrus Park. Here is this little elegant boardwalk as a bridge over a river. I ended up [blogging](https://connortumbleson.com/2019/04/22/fallen-shopping-carts/) about this bridge/trail as I found tons of shopping carts just dumped in the river alongside it. How I found this trail was pretty funny - I was drinking at the local Ballyhoo's Grill and walked home intoxicated. I thought there had to be a shortcut and went exploring - sure enough found this little trail that went to the Publix which was basically next to my apartment.
Bradenton Riverwalk - Bradenton, FL
The riverwalk in Bradenton is much like any other with an elegant boardwalk that sits on the river and many miles in length. You can take this path from the skate parks all the way to the fancy restaurants on the pier. When it cuts under the highway it creates this shot you see above where the trail has a very short ceiling. Anytime I find myself in Bradenton I like to walk this trail for the Ingress benefit.
John B. Sargeant Conservation Park - Thonotosassa, FL
John B. Sargeant is another $2 entry park that boasts a boardwalk that surrounds a swamp normally supporting a gator or two. The parking lot is the coolest one I've ever seen though having the lattice like concrete structure. The park is quite small though for someone just walking around - it really shines if you are using a picnic table or going onto the water.
Glen Burney Trail - Blowing Rock, NC
Prior to attending my sisters graduation it was time to explore the city and I stumbled upon this little trail. It wasn't relaxing by any stretch - after probably a solid 1000ft downhill I realized I had to turn around and go right back up the large elevation I had just declined. Either way the historic aspect was sweet - stumbled upon something called "The Ruins" which was the first modern sewage treatment system designed in the early 1900s.
Elk Knob State Park - Todd, NC
On that same trip I stumbled upon an Ingress portal on top of a mountain that was being used by the enemy for a large field. Seeing how I was in the area with a rental car I took off on a little journey to visit this. I arrived quite late in the day to someone saying it would close before I could get back down. Thankfully I said I would move quick and that was good enough to let me climb said trail. Made it to the top, took some photos and played Ingress and booked it back down.
Cypress Forest Spray Park - Oldsmar, FL
This park I found by accident exploring a trail full of Ingress portals - as you walk around this business park on a trail you end up at a recreation center. That center and park is the start point of a trail that curls all the way around to an electrical substation. So I'm not quite sure of the purpose of this trail - its only a few miles and runs into a highly gated and monitored electrical structure. Either way - the boardwalk is wide and keeps the nature at bay.
Wilderness Park - Thonotosassa, FL
One day my regular park I workout at was closed instead giving out sandbags at the entrance for an upcoming hurricane. That storm was days out and I still wanted to workout so I went up the road and ran into this park. This park was basically a natural environment with a few intersecting trails. Each trail hits a point where you have like 6 different directions to go which can lead to some immense confusion. First time at a park I felt lost, but I just opened Google Maps and redirected myself back towards my car.
Emerson Point Preserve - Palmetto, FL
This is another free park in the tiny bit of land that separates St. Petersburg from Bradenton. This is a more historical park heavy with trails that tells the story about the mound civilizations that lived there. Brutal when hot as only a small chunk of these trails are within the cover of trees. A great park though that had water, hiking, observation towers and much more.
---
All in all - a few years of visiting parks and trails.
### We are all guests
URL: https://connortumbleson.com/2024/01/08/we-are-all-guests/
Last updated: 2025-02-04T11:42:24.000Z
Photo by [Erik Mclean](https://unsplash.com/@introspectivedsgn?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few days ago I saw someone online begging for anyone to help as their Google account of 10+ years was suspended for an unknown reason. Imagine yourself in that situation where your primary email account disappears and you are left trying to figure out how to recover an account that may have 100s of accounts associated with said email.
I have a related experience that occurred roughly \~12 years ago on Xbox Live which I [blogged](https://connortumbleson.com/2013/10/12/life-of-a-banned-xbox-live-consumer/) about with a bit less elegance than I have today. You are a guest on Xbox Live and your account is a privilege when you look at the perspective of accessing the service from Microsoft. Before I joined doing security for the good - I messed around on Xbox Live doing cheats/mods for the bad. Of course I thought I was being smart separating my cheat life from legit life, but something caught up to me at one point.
I got suspended till year 9999 and a hardware ban on all consoles I had used, which due to going to college ended up being my brother's Xbox, my Xbox and my roommate's Xbox. This effectively turned these consoles into useless machines that could only do offline content and were blocked from Xbox Live.
The account banned permanently was "Bio Toxic Peach".
This was a big wake up call to someone who didn't yet have a full time job as all the DLC and digital games obtained were no longer available. I lost access to games I purchased because they were "technically" licensed to me. On that same regard even games I had physical copies required another purchase as those dumb EA games contained an "online code" which had to be used to register in order to play online.
What I didn't realize is that my ban was more towards my Microsoft account instead of isolated to my Xbox account. I lost my Dreamspark license, my Skydrive and my email account. I spent months and months attempting to get that account working and it was worthless. I could do password resets and recovery, but anytime I signed in I would get some cryptic error.
At one point I escalated my case further and further with Microsoft and got the shortest response ever - "*The suspension will stand as issued.*". Of course at this point in my life I was trying to pass classes and the family listening to me complain about this vendetta with Microsoft showed my priorities were out of wack. I just couldn't fathom why my Xbox ban continued onward to all services associated with that Microsoft account.
If we look at today's world - a good deal of dependencies we have are on licensed/borrowed time. Imagine losing one of the following:
- Google Account
- 1Password Account
- GitHub Account
- Linode Account
Of course these services you can live without, but imagine building a solid chunk of your life on said service for it to disappear. If I lost my GitHub account, which I've been using for 15 years to house my programming creations - I'd probably lose a solid chance of getting interviews during a job hunt.
If you move into the physical world - my electric company sent me a very legal looking letter asking for my signature for permission to build equipment in my yard (as part of a easement) to support moving overhead wires underground. I ignored it because there isn't a single overhead power line in my entire cul-de-sac, so I imagine it was just a mistake.
Months went by and I got a call from said electric company asking me if I received the letter and what was withholding my approval to calm any concerns I had. I had no concerns except the fact that why should I have to give permission to a chunk of my tiny yard for a reason that doesn't apply to me. I told the person on the call to bring a representative out to my house - show me the overhead lines they are talking about and I'll sign it in front of them.
No one ever showed up and its been at least a year now. I started thinking though if you go to war against your electric company - whose to say they won't find some cryptic reason to no longer service you. Thankfully since they are a public utility that's not probably something that can occur.
I say that because something odd happened with my local town of Temple Terrace. When I moved in I was trying to figure out how to get trash/debris/recycle service - in short its confusing. Some even require a specific type of trashcan in order to be picked up, so it explains why my pickup was ignored. So right when you move into a place - I had a lot of trash. Moving things, reworking things, cleaning things and I struggled to get working trash pickup.
Once that finally was resolved - Temple Terrace comes by to leave me a note that I'll be fined if I don't fix my "algae driveway" which I thought was laughable. My driveway looked identical, if not better, than all my neighbors. Yet I'm called out to do some cleaning. I thought it was the classic behavior of - if you treat a company badly they'll work to make your life a bit stressful.
It just kept me thinking - we are just guests for most services in this world and a few missteps can turn you into a malicious guest in the eyes of the company/service. Continue in the negative light and you might end up without an account, which may be quite a disaster.
### Apktool v2.9.2 Released
URL: https://connortumbleson.com/2024/01/05/apktool-v2-9-2-released/
Last updated: 2025-02-04T11:42:25.000Z
Apktool v2.9.2 has been released! This release is a hot-fix on top of the previous v2.9.1 release for 1 security fix.
Discovered by Yusuf at Denuvo Apktool would infer file names from the respective resource names, which if made malicious would result in a file being written outside of the directory in which Apktool was operating (ie path traversal). This can be read in more detail at the issue report: [CVE-2024-21633 (GHSA-2hqv-2xv4-5h5w)](https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5w?ref=connortumbleson.com)
**Sponsors**
I launched [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com) to help provide another alternative for folks showing appreciation. I want to remind folks of two companies that continue to hold a monthly donation for the project.
- [Emerge Tools](https://www.emergetools.com/?ref=connortumbleson.com) came online to sponsor the tool.
- [Sourcetoad](https://sourcetoad.com/?ref=connortumbleson.com) (self employer) additionally joined to sponsor (as well as a few other projects).
---
**This release had 3 commits by 1 person**
- Connor Tumbleson (iBotPeaches) - 3 commits
---
# Changes since 2.9.1
- \[[#3484](https://github.com/iBotPeaches/Apktool/pull/3484?ref=connortumbleson.com)\] Fix [#GHSA-2hqv-2xv4-5h5w](https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5w?ref=connortumbleson.com) (Arbitrary file writes). (Thanks 0x33c0unt)
## Notes
- The v2.9.x releases have moved to aapt2 being the default. If you'd like to return to the previous behavior, please use `--use-aapt1` during build stage.
## Download
[Download Apktool 2.9.2](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.9.2.jar?ref=connortumbleson.com)
- [Apktool 2.9.2](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.9.2.jar?ref=connortumbleson.com)
- `352f85721fa95847f03a10fa7ea78322` (md5)
- `831f0ffc97b6f20f511d6183cbf6785464d341aacb0fb7e6f22ef0c7b228911a` (sha256)
- Rename to `apktool.jar` and follow the [Instruction Guide](https://apktool.org/docs/install?ref=connortumbleson.com) if you need help.
- [2.9.2 Doc Site Post](https://apktool.org/blog/apktool-2.9.2?ref=connortumbleson.com)
## Links
- [Project Site](https://apktool.org/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### A Year of Blogging (2023)
URL: https://connortumbleson.com/2024/01/01/a-year-of-blogging-2023/
Last updated: 2025-02-04T11:42:25.000Z
Photo by [Kajetan Sumila](https://unsplash.com/@kajtek?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As 2018 ended, I had successfully blogged every week for the [entire year](https://connortumbleson.com/2018/12/30/a-year-of-blogging/). This was a new years resolution that I've somehow kept for now five years and counting.
So lets recap my favorite posts from 2023.
---
[Evolution of Food Taste](https://connortumbleson.com/2023/01/09/evolution-of-food-taste/)
This post was a fun deep dive into how my food taste has changed over the last twenty years and comparing the fast food, meal kits and good ole fashioned home cooked meals. Pictured above was a creation of guacamole using only limes and avocados from my backyard.
---
[Callous Tampa](https://connortumbleson.com/2023/01/16/callous/)
Feeling as people are getting more aggressive in day to day life I take a single recorded dash cam experience to review how I feel people have changed in the past few years. Perhaps it was COVID-19 or maybe its just how the world has evolved to "eat or get eaten" mentality.
---
[Dangling Domain Abuse](https://connortumbleson.com/2023/01/23/dangling-domain-abuse/)
Little did I know how quick attackers could react when releasing an IP into the world. I deleted an old server which left a dangling DNS record to an IP I no longer controlled. The new owner of this IP quickly determined that fact - validated their ownership of a domain the didn't own and proceeded to submit millions of SEO spam to Google. It cost damage to this domain (`connortumbleson.com`) and took a few days to unwind how the attack occurred.
---
[Personal Weather Station](https://connortumbleson.com/2023/02/13/personal-weather-station/)
A short obsession with weather led me to finding and purchasing my own little personal weather station. Wiring up the stream of data to a local service (Prometheus/Grafana) is where the challenge remains. I can't stream straight from the station to Prometheus without a little intermediate service and those options range from paid, abandoned or build my own.
---
[Lost Treasure: K'NEX](https://connortumbleson.com/2023/05/08/lost-treasure-knex/)
After doing blog posts about old events I lived through (ice storm, flood, etc) I realized that there is a large population that likes reading 1st hand experience from an event. It is relatable and folks research these events to remember them. On that same vein old children's toys seem to fit that bill. I started diving into a variety of toys I really enjoyed and K'NEX was one of them. I was the kid that preferred K'NEX to LEGOs.
---
[Camera in the Attic](https://connortumbleson.com/2023/05/01/camera-in-the-attic/)
Documenting build outs of this home has been always a fun interest - from building out the home-lab to adding some random camera in the attic. I wish this post could show how many wires I've now fit into one little wall passage into my attic. This was the 5th cable and now I'll probably have to figure out an alternative to fit any more additions. Either way its still funny to look back and say - "*I've got a camera in my attic*".
---
[The FP Movies](https://connortumbleson.com/2023/06/05/the-fp-movies/)
What started as a "bad movie" night with friends we ended up picking the first movie of a series of incredibly odd movies. I pushed through and watched the remaining three movies on my own and produced this large multi-thousand line recap of the movies. These movies are what happens when you take a talented individual with his childhood idea and end up producing a few films which are odd, but a good form of entertainment.
---
[C-135 Tampa Bypass Canal](https://connortumbleson.com/2023/09/11/c-135-tampa-bypass-canal/)
Confused as I drove by a huge river that was always without boats and full of caution/warning signs. I was curious why this existed and soon found out it was built to take huge amounts of water during flood/hurricane instead of it funneling through the city. A huge task completed a long time ago with the forethought to protect the growing city - I look back at that and think that's amazing. I struggle in present terms to know a comparable enhancement at that scale in the Tampa area.
---
2024 is just a few hours away and I'll still be here blogging weekly. Thanks for reading and here is to another year.
### Too much Car Safety
URL: https://connortumbleson.com/2023/12/25/too-much-car-safety/
Last updated: 2025-02-04T11:42:25.000Z
Photo by [Joe Dudeck](https://unsplash.com/@joetography?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few weeks ago I got a new 2023 Hyundai Sonata which replaced my 2019 Hyundai Sonata, which had previously replaced my 2008 Hyundai Sonata. I quickly realized that features in modern cars have caught up in terms of things they deem as safety enhancements, but I'm trying to figure out how to disable most of them.
**Lane Monitoring**
At first this feature sounded pretty cool - help me stay in my lane. However, in one month time I don't think I've once felt like it helped me and instead only annoyed me. Trying to drive around the pothole filled roads and duck/dodge into a specific driving pattern? Good luck - the car will guide you back to the center of the lane.
The first time it happened I thought the car was taking over control, then I learned you either let it happen and guide you back or you double down on the change against its additional constraint on the wheel and it'll back off.
So I started learning how it acts, but boy you hit this specific area in Tampa where a school zone lines intersect with the road and the car hates this. It freaks out every single time I drive over it with a little warning nudge and chime - it thinks I'm going out of my lane, but I'm not. I actually become in a split second a danger to the road as my car is trying to guide me into a lane that doesn't exist, but it learns before that second is over and gives up.
Once I'm on the highway there are many flyover exits in Tampa that are huge single car lanes - you could easily make it two lanes, but instead its just one large lane. The Hyundai hates this - it thinks hugging the right side of this massive lane is drifting and pulls me back. Sorry I'm just letting my car handle this turn naturally without abrupt changes to the circular angle I'm turning at.
I've figured out how to disable this, maybe this technology in smarter in the full self driving models.
**Collision Detection**
This feature seems great on paper and I haven't tested if it will actually inject brake pushes automatically, but it turns the dash red and emits a loud warning tone when this occurs.
This has happened a few times when I feel I'm in zero danger of actually colliding with anyone or anything. It seems to interject when my speed is approaching an object that is not moving at the pace expected to prevent a collision. It gets really mad when you are coasting when cars ahead brake. Yes you can hit your brakes immediately and join the line of cars, but I'm safely far enough back I can coast this slowdown. With regenerative braking I get quite a slowdown by simply letting off the gas. It's a bit more elegant than this constant accelerate and stop traffic people seem addicted towards doing.
The car hates this - it emits the loudest tone and red warning symbols of collision warning. Tap the brakes a bit and its happy and quiet even if the coasting would have accomplished the same thing in a bit less space. This means my brake lights go on - the people behind me react to that and so on and so on. Even if I could have simply let off the gas and coasted and accelerated a few seconds later. I might have just caused a ghost pocket of braking when it could have been avoided.
**Turn Warning**
Sitting in a lane you put on your turn signal, this is the yellow blinking turn lane, so you can go when the traffic is clear. You inch into the intersection seeing a gap approaching in the cars and your car goes off with beeps and tones. It thinks you are about to turn into a wall of cars and its warning you. The first time this occurred I thought I was doing something dangerous and/or danger was near to me. It calmed down and I did my left turn and went about my day.
Should I have stayed out of the intersection? Probably according to the law as I believe you shouldn't enter the intersection until you are clear to exit it, but with how Tampa drivers act you gotta take the chances you have otherwise you aren't going anywhere.
So I'll keep this one on - I should stay out of intersection until I'm clear to make my entire left turn. People behind me may hate it, but my car won't go crazy with that choice.
**Seat-belt Warning**
This one has only happened once, but boy put me into a few seconds of unsafe driving. Just driving along and the dog moves from the backseat to sitting in passenger seat which then sets off the weight detection of that seat. Now its non-stop beep which is beyond annoying, then the dog jumps back to the back seat and it still goes off. It takes a solid 30-45 seconds until it detects no heavy bodied animal/person is no longer sitting there.
He jumps back into the front seat and it goes off again - this time I'm trying to pull the seat-belt over and plug it in while interstate driving just so the tone can stop. This is a red illuminated dash icon and very loud beep that overpowers even the music playing. Meanwhile this 60-80 pound dog is just not helping at all in this situation as I try to plug in a seat-belt under his mess of fur.
---
It seems most of these features all have a possibility of great benefits at the increased cost of a slight increase in overall danger and increased annoyance.
### It's Relative
URL: https://connortumbleson.com/2023/12/18/its-relative/
Last updated: 2025-02-04T11:42:26.000Z
Photo by [Tolga Ulkan](https://unsplash.com/@tolga%5F%5F?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few weeks ago my 2019 Hyundai Sonata seized again on the way home from trivia - this time I was pretty lucky to abruptly coast/stop in a turn lane. This at least kept me out of blocking traffic even if multiple times someone pulled in behind me and honked at me. I don't understand what people think a stopped car with hazards on means and what honking will accomplish.
The long and short of that is I ended up with a new 2023 Hyundai Sonata and sold the busted car back to the dealership before this type of incident escalated even further. Losing power breaking and steering isn't exactly the easiest thing to control so I'd been so far lucky to not cause any accidents.
The next day I'm having a conversation with a friend and they mention some some unlucky event that occurred for them. Childish of me looking back at it used that chance to mention some unlucky events that happened to me instead. It seemed like I was trying to 1-up a sucky situation by comparing the events together.
On the extreme side I once was complaining that it was raining while I was trying to grill. This got me a response of - "*At least you have a grill*" which was an odd thing I felt like for someone to say. I ended up discovering a workaround so I could continue grilling without water cooling down my cook.
grilling in rain technique.
So I researched what that is described as, because it has to be something. I stumbled upon the fallacy of relative privation.
> The fallacy of relative privation rejects an argument by stating the existence of a more important problem. The existence of such a worse issue, the fallacy insists, thereby makes the initial argument irrelevant. This fallacy is also known as the appeal to worse problems or “not as bad as”.
> \[[source](https://academy4sc.org/video/fallacy-of-relative-privation-all-problems-are-relative/?ref=connortumbleson.com)\]
It felt like I found the fallacy that explained this situation if I stretched the explanation to fit this specific example. During that research though it became interesting to me discovering how some researchers say "everything is relative".
It started to click immediately with me especially when discussing the weather in Florida. For the natives who have only lived here the summers are insanely humid and hot - that is true also for newly moved Floridians. The difference being after spending years and years in the brutal cold with snow - you start to appreciate the heat only because you've really experienced cold.
Probably why our learning starts so slow at birth - with no previous experiences to relate knowledge with we must learn things one by one to develop a bank of relationships. Probably makes sense why schools hit such a wide variety of topics in order to develop the brain with a solid set of related things to reflect back on.
I guess that is what makes us human - since if we all collectively had some combined singular experience we'd all perceive things the same. It's that we all experience things differently and thus relate to things differently that makes us human.
### Impersonating Projects
URL: https://connortumbleson.com/2023/12/11/project-impersonation/
Last updated: 2025-02-04T11:42:26.000Z
A few days ago I got an odd message sent to me - someone was curious if I was the owner behind *`exedecompiler[.]com`*. I of course was not and was curious why I was being asked.
Turns out this individual was trying to chase down the owner of this site as they were communicating with them and ended up getting scammed out of $500\. They sent some snippets of the chat conversation and it looked pretty suspicious.
Maybe at my age and time on the Internet - I've learned that you rarely, if ever, trust a business transaction on Telegram with a cryptocurrency as the payment. So an expensive lesson learned for this individual.
Shortly after the payment was confirmed - the telegram account blocked the individual as well as clearing the chat. For some reason he had some various photos saved from this exchange which ended up being the photos you see above.
So how did this site point back to me?
Wayback Machine - "exedecompiler\[.\]com"
As you scrolled down the site - it listed four projects as "Recent Work".
- Apktool
- Leaf
- Halo Depot
- Panda Love
These are projects I've either created from scratch or been maintaining on my GitHub. The descriptions were copies of the GitHub repositories with honestly zero effort in adapting it to fit the website design. As you can tell some of the description is literally the setup guide for one project.
I was furious yet again - this time a site was selling a service for $50 for disassembly of `.apk` and `.exe` files and using my username/projects as the portfolio. This was now the 2nd time myself/my-work was being impersonated - the [first being this odd interview tale](https://connortumbleson.com/2022/09/19/someone-is-pretending-to-be-me/).
Ignoring the obvious fact this is impersonating my accomplishments and successful projects - this is an odd business model because both of those services have free open-source tools to accomplish said task.
- [Apktool](https://apktool.org/?ref=connortumbleson.com) (`.apk`)- $0
- [ILSpy](https://github.com/icsharpcode/ILSpy?ref=connortumbleson.com) (`.exe`) - $0
So once again I decided to message the perpetrator behind this scheme.
It seemed pretty obvious that my profile wasn't "random" when it came to this site. You don't build a scam site marketing reverse engineering services then happen by chance to come upon an author (me) who maintains the most popular `.apk` disassembler.
As I am trying to balance submitting abuse reports to the domain (Namecheap), host (Cloudflare) and Messaging (Telegram) I realize my chat with this individual is now over - I am also blocked and the chat history is cleared.
I don't really like Telegram's ability to do that, which I guess is why many flock to it for illicit business. I just happen to use it heavily for Ingress.
In my last screenshot I had with this individual I was trying to get a refund for an individual scammed. This was never going to work, but I was surprised to find this individual claim a "*business gone wrong*" instead of a scam.
Is this site really trying to do something legit? I seriously doubt it, because as I write this post - the site has changed again.
My four projects are gone - now we find another collection of random projects I'm 100% confident are NOT built by this individual. This time the scammer has learned and is no longer hyperlinking these projects so its a bit more difficult to track down the original owner of them.
They must be upset as the prices have changed from $50 to $100\. Maybe one of my abuse reports will end this scam - who knows.
Each time I get wind of one of these situations - I wonder how many go unnoticed.
### Apktool v2.9.1 Released
URL: https://connortumbleson.com/2023/12/06/apktool-v2-9-1-released/
Last updated: 2025-02-04T11:42:26.000Z
Apktool v2.9.1 has been released! This release is a fast follow with bug fixes from the quite large [v2.9.0 release](https://connortumbleson.com/2023/10/08/apktool-v2-9-0-released/). Overall - very happy with only 1 regression from the huge amount of changes we did during the v2.9.0 release. I did remove the docker images recently added in v2.9.0 as those haven't quite stabilized at the level I expect. I've got a bit more to learn with docker with all the file system requirements Apktool has - then that will return.
Dependabot has become quite a life saver and keeps dependencies up to date whether its the CI pipeline or child dependencies.
This release continues the battle against Apktool's challenge of building applications on build tools that are almost always newer than the source application was built from. This led to changes for references, null values and stripping duplicate attribute properties.
It also has a quick patch for supporting disassembly of the new Android 14 QBR2 beta applications.
**Sponsors**
I launched [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com) to help provide another alternative for folks showing appreciation. I want to remind folks of two companies that continue to hold a monthly donation for the project.
- [Emerge Tools](https://www.emergetools.com/?ref=connortumbleson.com) came online to sponsor the tool.
- [Sourcetoad](https://sourcetoad.com/?ref=connortumbleson.com) (self employer) additionally joined to sponsor (as well as a few other projects).
---
**This release had 38 commits by 4 people and 1 robot**
- Connor Tumbleson (iBotPeaches) - 27 commits
- Dependabot (BOT) - 8 commits
- ArjunaKumarMohanta - 1 commit
- Andrew Szeto - 1 commit
- Josh Miers - 1 commit
---
# Changes since 2.9.0
- \[[#3362](https://github.com/iBotPeaches/Apktool/issues/3362?ref=connortumbleson.com)\] Add support for building on Java 21.
- \[[#3425](https://github.com/iBotPeaches/Apktool/issues/3425?ref=connortumbleson.com)\] Add test for `isAccessibilityTool`.
- \[[#3428](https://github.com/iBotPeaches/Apktool/issues/3428?ref=connortumbleson.com)\] Add support for Android QBR2.
- \[[#3399](https://github.com/iBotPeaches/Apktool/pull/3399?ref=connortumbleson.com)\] Fix regression with api-level not passing to baksmali. (Thanks JoshMiers-FS)
- \[[#3378](https://github.com/iBotPeaches/Apktool/pull/3378?ref=connortumbleson.com)\] Fix issue with docker building closed prs.
- \[[#3400](https://github.com/iBotPeaches/Apktool/issues/3400?ref=connortumbleson.com)\] Fix issue with duplicated attribute names in styles.
- \[[#3416](https://github.com/iBotPeaches/Apktool/issues/3416?ref=connortumbleson.com)\] Fix issue with writing null value resources.
- \[[#3421](https://github.com/iBotPeaches/Apktool/issues/3421?ref=connortumbleson.com)\] Fix issue with aapt2 falling on private resources.
- \[[#3427](https://github.com/iBotPeaches/Apktool/issues/3427?ref=connortumbleson.com)\] Fix issue with treating warnings as errors in aapt2.
- \[[#3377](https://github.com/iBotPeaches/Apktool/issues/3377?ref=connortumbleson.com)\] Remove Docker published package.
- \[[#3376](https://github.com/iBotPeaches/Apktool/pull/3376?ref=connortumbleson.com)\] Upgrade Gradle to `8.4`. (Thanks ArjunaKumarMohanta)
- \[[#3414](https://github.com/iBotPeaches/Apktool/pull/3412?ref=connortumbleson.com), [#3453](https://github.com/iBotPeaches/Apktool/pull/3453?ref=connortumbleson.com)\] Upgrade `commons-io` to `2.15.1`.
- \[[#3413](https://github.com/iBotPeaches/Apktool/pull/3413?ref=connortumbleson.com)\] Upgrade `commons-cli` to `1.6.0`.
- \[[#3443](https://github.com/iBotPeaches/Apktool/pull/3443?ref=connortumbleson.com)\] Upgrade `commons-lang3` to `3.14.0`.
- \[[#3414](https://github.com/iBotPeaches/Apktool/pull/3414?ref=connortumbleson.com)\] Upgrade `commons-text` to `1.11.0`.
- \[[#3454](https://github.com/iBotPeaches/Apktool/pull/3454?ref=connortumbleson.com)\] Upgrade `actions/setup-java` to `4`.
- \[[#3384](https://github.com/iBotPeaches/Apktool/pull/3384?ref=connortumbleson.com)\] Upgrade `docker/build-push-action` to `v5`.
- \[[#3445](https://github.com/iBotPeaches/Apktool/pull/3445?ref=connortumbleson.com)\] Upgrade `gradle/gradle-build-action` to `2.10.0`.
- \[[#3386](https://github.com/iBotPeaches/Apktool/pull/3386?ref=connortumbleson.com)\] Upgrade `docker/setup-buildx-action` to `v3`.
- \[[#3385](https://github.com/iBotPeaches/Apktool/pull/3385?ref=connortumbleson.com)\] Upgrade `docker/login-action` to `v3`.
- \[[#3444](https://github.com/iBotPeaches/Apktool/pull/3444?ref=connortumbleson.com)\] Upgrade `proguard/gradle` to `7.4.1`.
## Notes
- The v2.9.x releases have moved to aapt2 being the default. If you'd like to return to the previous behavior, please use `--use-aapt1` during build stage.
## Download
[Download Apktool 2.9.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.9.1.jar?ref=connortumbleson.com)
- [Apktool 2.9.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.9.1.jar?ref=connortumbleson.com)
- `40705d4cf2fd3b4f605872e993f0d4a3` (md5)
- `de7ce8aa109acb649e7f69cfe91030ffc20dbcc46edd8abbf6c2d1e36cfccd7b` (sha256)
- Rename to `apktool.jar` and follow the [Instruction Guide](https://apktool.org/docs/install?ref=connortumbleson.com) if you need help.
- [2.9.1 Doc Site Post](https://apktool.org/blog/apktool-2.9.1?ref=connortumbleson.com)
## Links
- [Project Site](https://apktool.org/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### A Lost Friend
URL: https://connortumbleson.com/2023/12/04/a-lost-friend/
Last updated: 2025-02-04T11:42:27.000Z
Photo by [Alexander Lam](https://unsplash.com/@alxznder?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
If we roll the clock back to January 2020 - we have a [blog post](https://connortumbleson.com/2020/01/27/lets-talk-epidemics/) I wrote related to Epidemics about the start of the Wuhan outbreak. I ended that post with this line:
> There is even rumor as of writing this post that the 3rd confirmed case in USA has been identified.
Little did I know while writing that what would later happen, because as you know we had way more than 3 confirmed cases. What I couldn't predict would happen is how this event of COVID-19 sparked so many events that resulted in losing an individual as a friend.
In group chats the first event that started debates among friends was the rise of wearing a mask.
masks on masks
This led to what I would describe as a heated argument amongst a group of random friends. There was this one friend in specific that couldn't believe he was being forced to wear a mask and frequently ignored the request. This boiled down to being American, but spawned so many debates in our chat. I'm sure these discussions were prevalent in thousands of chats around the world.
Our group was getting divided - those who wouldn't mind putting some cloth on their face to protect the safety of others and thus who felt it was a violation of their rights and disgusting to breath their own exhale. At this point though we were still all friends even if discussions got heated at times.
Boy though - it was getting old fast. It seemed for this one individual that he was turning to avoiding business at any place that refused him service for refusal of wearing a mask. When that occurred - it was straight to the group chat to release that rant of that business and start all the discussions up again. Personally, I was convinced this friend was just going door to door in order to find places that would react to his disobedience, because it seemed like this guy shopped a lot.
This is when we lost someone in the group chat - this I believe occurred when arguments got heated.
Photo by [Towfiqu barbhuiya](https://unsplash.com/@towfiqu999999?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I couldn't have predicted that this would have further accelerated to extreme drama when the COVID-19 vaccine was available. When December 2020 hit our friend group again had folks posting and discussing the different brands of vaccination. This was more a discussion of the shot, the feeling and recovery and everything in between.
I'm sure you can tell where this is going - that one friend was livid that anyone would subject themselves to an alleged rushed, controlling and poisonous cocktail. This is what basically broke the chat because like all arguments they all get back to politics at some point. It seemed someone found a trigger point with some discussion item for this individual. It seemed this awoke a beast within him - it went into realms that I thought were legitimately jokes.
We were now in discussions about mind control, 5G towers and Bill Gates sponsoring vaccine development. I'm fairly sure that a good chunk of this group muted this chat somewhere around this point as the responders of these discussions basically became the same three people.
For the most part - the chat died after this event and stayed dead. When I peeked back at some point - there was only 4 of us left. My guess is the others read up on the chat when they had time and didn't like what they saw and left.
I stayed in the chat because much like on Twitter if I unfollowed everyone I disagree with, then my feed becomes a never ending circle of things I want to see and agree with. I need to see some things I don't agree with to keep me on edge from falling into an algorithm trap of a warped perception. Now of course typing that staying in a group chat vs following someone on a social media site seem completely different.
As months passed - it was clear this group of random engineers chatting was dead, but we still interacted a bit on GitHub/Twitter when paths crossed. Since COVID-19 gave us a lot of time at home - we were programming a lot.
One morning I jumped onto GitHub and saw a comment from this same individual asking a very odd question on a repository. This was some repository about visualizing police brutality in response to the George Floyd death. I don't even feel comfortable posting what was said, but the comment was intended to evoke a response about the situation and had nothing to do with the project.
I was pretty upset reading this because in my head I was trying to figure out if this friend/individual had his beliefs warped in the short period of a pandemic or had actually believed these things himself since forever.
This is where I realized I had to do something, but out of selfishness. It turns out this individual had not stopped growing into this realm of just pure hate, racism and misinformation. They were not afraid of posting it everywhere now from images, responses and more. It seemed this individual just wanted to argue with people on the Internet and I realized my affiliation was public with this individual.
I looked at some of my recent follows and interactions on Twitter and I didn't like what I saw. It seemed association with a friend had caught up to me.
Photo by [BUDDHI Kumar SHRESTHA](https://unsplash.com/@aresbuddhi?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
So I messaged him and asked him what was going on. That was a terrible idea. There was a loud rejection for everything I asked: I'm being brainwashed, I get my news from fake sources, I'm turning into every possible bad word. Even when I broke questions down to their absolute basic form he doubled down or even tripled down to some very morally/ethically wrong points. I couldn't even have a good adult conversation about differing opinions without getting tilted.
For a brief moment I wondered if some of it could be true. Could I inadvertently be getting my news/research/ideas from warped sources? That only lasted for a few microseconds when I realized we were talking about simple ethical and moral issues at the end of it.
So I started with a friend I thought I knew - we built some great projects together. Now this individual is blocked on every platform and my association has been broken. So I lost a friend and I'm guessing this story isn't unique to me, but this draft has been sitting for years - so time to finish it.
### Travel Blog: Roanoke, VA
URL: https://connortumbleson.com/2023/11/27/travel-blog-roanoke-va/
Last updated: 2025-02-04T11:42:27.000Z
Photo by [B R](https://unsplash.com/@mytest223?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The clock struck 4:30am again on a weekend with back to back travels occurring. This time going from [Atlanta for Ingress](https://connortumbleson.com/2023/11/20/travel-blog-atlanta/) to Roanoke for Thanksgiving and leaving out of the PIE airport instead of TPA, which is always a difference experience than I'm used to.
\~5:00am in Ruskin prior to PIE.
Expecting a good deal of travel on Thanksgiving itself and surprised to experience that the airport was quite empty. There was no line for security or entering the airport - this could be have also been a by-product of us arriving 2 hours early. This time a budget airline of Allegiant was being used because they offered a direct flight from PIE to ROA, which is always preferred when I'm traveling.
Each time I fly Allegiant I realize how the ultra low-cost airlines make that promise.
Allegiant planes prior to boarding.
The largest difference is the lack of boarding via a cat walk. This time we go onto the tarmac and board directly from the ground onto the plane. Once that is done you can instantly feel how cheaper the seat and experience is once you are on the flight. Throughout the flight you are reminded that nothing is free - if you want drink or food that is a tiny charge. You are reminded once again prior to landing with spoken advertisements to sign up for a credit card.
Once landed it was Thanksgiving Day and I was one of the roughly hundred people traveling to their final destination out of this tiny airport. Surprised to find a gas station that resembled that of Wawa in Florida - this time it was Sheetz. The interactive kiosk allowed me to build a custom chicken sandwich which was the prefect meal at 9am to hold me over till the official Thanksgiving meal.
I was now in Roanoke, but the final destination was 30 minutes north in a town that looked like built for farmers by farmers. The sister's place was basically a farm house on 20 acres of land with farm animals, a barn and more. When we wanted to get groceries, run an errand or hit a bar - it was a 15-30 minute drive to civilization. That may be the perfect life/vision for some, but I need a bit more modern civilization nearby.
The best way to explain this might be the color of the base Google Map between these cities. In Tampa we have a white base layer which basically means urban/suburban - however Roanoke is green base layer for rural and that is no joke. This can be further explored by looking at the parcel map of the area.
Yellow lines represent parcels - [AcreValue](https://www.acrevalue.com/plat-map/VA/Botetourt/?lat=37.511111&lng=-79.875892&zoom=15&ref=connortumbleson.com)
These property/parcel lines zoomed in may look small, but they range from 700 to 10 acres of land. This is the ultra rural area - towns of under 200 people and emergency services, food and more always a solid drive away. Oddly though, amazing Internet connection and 5G service in all the areas I was at, so perhaps its a bit easier to develop an infrastructure when there isn't so much stuff and legal process in the way.
Rural or not though - visiting puppies is a fun experience. An army of 6 little poodles awaited who were getting experience with the colder degree weather.
0:00
/0:12
1×
6 puppies eating with Laz (small) & Blondie (white) front and center.
They have bursts of energy, sleep, eat and repeat. The personalities are already developing among them and some are growing faster than others. A few more weeks and these little pups will be on their way to a new home.
One day towards night we jumped into a car and drove \~30 minutes south into downtown Roanoke to visit a bar. This now resembled a city structure I would recognize with street parking, people walking around and bars on every corner. It seems the style of converting a warehouse into a bar reigns supreme here with the few places we visited both resembling a converted warehouse into a bar/brewery.
As the temperature dropped further our plans of exploring more and more of Virginia collapsed. We are Florida folks at the end of the day and temperatures hovering around freezing makes it quite a challenge to go hike a mountain, explore a park or visit a winery. We did push through though and visited a local winery just up the road.
Winery in cold weather towards end of season - [Virginia Mountain Vineyard](https://vmvines.com/?ref=connortumbleson.com)
Speaking with the owners - just two more weeks and they close down for the winter until February. So for sure it seemed the visitors at this time of the year was us and some locals who just wanted to sit around a fire and sip on some wine.
When a bunch of family and friends meet up though - it never fails that someone falls ill and this trip was no exception. Thankfully thus far on the last day of the trip I remain in the clear with no signs of illness even if others have fallen to some sort of bug.
With the airport trip near though we went back into downtown in the search of food and shops prior to be dropped off the airport. This kept us closer to airport for a quick exit when our exploration was done.
All American Burger @ [Billys](https://billysroanoke.com/?ref=connortumbleson.com)
A recommendation led us to Billy's which was way more fancier than myself dressed in athletic shorts and airplane attire. Thankfully even though the sign said "*neat dress required*" I was not turned away and got the burger you see above. A few gin and tonics and we were off to the airport.
This airport was empty again with no line for security, which in comparison to Tampa is tough to believe. You walk into the airport right through all of the lines directly into security without a single person in front of you. This time though my "swimsuit area" was flagged during the body scan and I had to wait for a pat down after many verbal confirmations of what was about to occur.
Once the pat down was done the trip was almost over. Just a quick easy flight to St. Pete and we were there. Allegiant is doing one thing right and that is having direct flights to those most random areas. Tampa International is closer, but they have no directs to at least two places that PIE has filled.
We boarded the shuttle back to the overflow lot and surprisingly ran into the same person who we saw on the shuttle into PIE 4 days earlier at 5am. So that is a small world to board the same shuttle to/from the airport, which suggests and confirmed we went to the same city and left on the same day. It may be raining here in Florida, but the travel weekend is over and so is this blog.
### Travel Blog: Atlanta
URL: https://connortumbleson.com/2023/11/20/travel-blog-atlanta/
Last updated: 2025-02-04T11:42:27.000Z
Photo by [Samuel Agbetunsin](https://unsplash.com/@batu2sai?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The clock struck 4am and it was another 3 day weekend of travel beginning - a short drive and I was back at the airport. Had been awhile since I flew Southwest and I was reminded sadly on just how dumb some people are. Hearing that A1-30 and A30-60 should line up in the respective two lines I was surprised how many people did it completely wrong. When someone at A44 tried to go in the first 15 people - the staff member pulled them aside to board at the right time. The real kicker though was a B33 person trying to board at the end of A1-30 line. Granted this could have been a simple mistake of A vs B - it just was interesting to see how many times people just couldn't follow basic instructions.
The flight was short and a bit bumpy towards the end, but then we arrived in Atlanta in an enormous airport. As I attempted to find the entrance to the Marta train network - I got lost. I kept following signs but then when I got to the entrance it said "*North entrance closed - please use south*", so I turned around and walked to the other end of the hallway. This time I was walking back into the security lines and lost.
Quick conversation with someone and I figured out where I needed to go and finally found the train to take me into downtown. This train went from empty to nearly fully packed by the time we hit my exit (Peachtree), but then I was finally there in downtown Atlanta at 8am on a Friday.
Classic Italian @ Quiznos
My hotel was packed and unable to let me check-in until more closer to check-in time, so I dropped my bags and went out for some breakfast. I saw a Quiznos and had a flashback to my college years in Arkansas eating this basically weekly. So I had to try it and it wasn't as good as I remembered, but still was a wonderful experience getting to overload your sandwich with more pickles and red wine vinegar from the "extras" station.
I started exploring the city and walked towards Centennial Park which housed the 1996 Summer Olympics. This park was full of AstroTurf and felt like a sweet park if the weather was a bit hotter, but the cool temperatures, rough wind and sprinkling rain made it a bit uncomfortable.
However, that didn't deter the religious pop-up tents which were on every corner of the park or every corner of the street. Some pure dedication for those folks even if I didn't agree with their method of bugging random people exploring a city.
Now I'd only killed an hour of time exploring and it wasn't even lunch time yet. So I kept wandering until I stumbled upon the entrance of the Atlanta Aquarium. A quick check on tickets and price and I had an 11:30am ticket to go. Going on a Friday afternoon was probably a mistake - there had to have been no less than 1,000 kids roaming around.
Atlanta Aquarium
These were groups of like 20-30 kids a piece with some poor adult attempting to rally them together and organize them among 100 adults doing the same thing. This meant as I wandered around there was nothing but kids yelling, kids being kids and kids blocking every single little window anywhere. At the end of the day though - I was a guy alone going to an aquarium at noon on a weekday - what should have I expected if not that?
Once that was done I was a bit hungry and my room still wasn't available, so I stopped at a place known as Ted Montana's as it looked to have some nice bison options. This place was elegant for a lunch room meal, but was a great meal after a morning of flying. A perfectly cooked steak and salad with an alcoholic milkshake to celebrate taking a vacation.
Burning a few hours there and my room was finally ready - I could shower and drop off my stuff to prepare for the Friday event. One thing I quickly learned with all these restaurants is you either have security at the door or a prepared routine for an unfortunate homeless invader. I saw twice at the bar we were at - someone come and make a scene - the response from the business was to provide to-go containers of food and drink and put them on their way elsewhere. I guess that's the easiest method if you don't have security on the door.
I don't really want to harp on the misfortune of others, but there was a good deal of homeless interactions while in this city. These weren't easily ignored like in other cities as the individuals would follow you with simple asks of like "*just 1 meal, just 1 donut, just 1 train ticket*" until someone folded. It seemed like every other street just smelled of pure urine or worse - a sad sight to experience.
Friday came to an end and it was Ingress day. Discussing the inner workings of an anomaly from a specific faction is not something I can do. The other team would be quite interested in all the details of that - so instead we skip directly to the after party. This was a bar on the outer edge of downtown with excellent food options and an outdoor area to fit our large group of nerds. I had an excellent smash burger and a constant stream of gin. A quick Uber back to the hotel and Sunday was here.
Holiday Inn Express & Suites Atlanta Downtown
However, a quick rant the hotel bathroom toilet was inches from the wall. There just was no way for a regular 6ft person to use that bathroom in any normal form.
The non-competitive event on Sunday was exploring the city which always ends up being a great exploration of parks, food and people. I may not travel to random countries around the world, but every quarter I do learn a bit about some random city in the states.
The morning started early meeting for photos at 9:30am at a park. This is where I connected some dots that made me a tiny bit angry. I saw strewn about all these little styrofoam containers with remaining food all over the ground in various areas. These seemed like the same containers the homeless invaders to various restaurants were given as they were kicked out.
I hate just discussing the misfortune of others - but it felt like to me that it was so inconsiderate to be given free food to just leave it on the ground uneaten. I saw trash cans on various corners of that park. So what did our group have to do? Clean up a medium-sized mess so we could take some photos in front of a fountain. I just felt mad about it and that may not be the right emotion to feel. Clearly from the stories of some locals - it wasn't like that in the 80s or 90s.
However, clearly in 40 years a lot has changed. It could be the drug epidemic or mental health crisis or some combination of the fact a dollar is next to nothing compared to its value in the 80s. I say all of that because just because I find it interesting that a city will design and build these interesting public bathrooms that have timers on them and auto cleansing systems to solve the current visible problem. Though in software engineering - sometimes you gotta find the root cause or you are just patching bandaids on a problem that will return.
As I sat catching up on news on various bars - what a weekend to travel. OpenAI drama is through the roof and my fantasy quarterback Burrow is out for the season.
I sit here in the Atlanta airport with hundreds of thousands of people around preparing to board my direct flight into Tampa. I paid the extra $30 so I could get A14 because I forgot to checkin on Southwest - this saved me from having C16\. The weekend is over and all I have to do is fly and drive home. The post ends here, but my journey home isn't.
### Treated like Garbage
URL: https://connortumbleson.com/2023/11/13/treated-like-garbage/
Last updated: 2025-02-04T11:42:28.000Z
Photo by [John Cameron](https://unsplash.com/@john%5Fcameron?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A bit ago after an update on my Windows gaming machine - I saw something odd in my start menu - it was an ad.
[https://www.reddit.com/r/assholedesign/comments/aqsbbu/when\_did\_windows\_start\_integrating\_ads\_into\_the/](https://www.reddit.com/r/assholedesign/comments/aqsbbu/when%5Fdid%5Fwindows%5Fstart%5Fintegrating%5Fads%5Finto%5Fthe/?ref=connortumbleson.com)
There is nothing more infuriating to me when using something I paid for to have an advertisement shoved in my face. Thankfully, one quick search later and I knew how to disable it. They aren't advertisements to Microsoft they are called "Suggestions" so it confused me for a bit on the journey to remove it.
More recently Microsoft stepped this up again, this time warning on the Insider blog about changes being tested on the start menu.
[https://blogs.windows.com/windows-insider/2023/04/14/announcing-windows-11-insider-preview-build-23435/](https://blogs.windows.com/windows-insider/2023/04/14/announcing-windows-11-insider-preview-build-23435/?ref=connortumbleson.com)
This change fueled my anger even further and led me to basically thinking that Microsoft treats its users as garbage. If we look at that above image - you'll see this advertisement is actually now paired with the global caution symbol. For those not technically inclined they may believe this is a warning or something they need to do. When in fact most of these options are just shelling new products or encouraging the end user to sign into more accounts to give more data to Microsoft.
Just a few days ago I booted up the gaming computer and again something was different.
There was now a Bing/Edge search bar injected directly to my desktop over my wallpaper. This was the fastest "turn off" click in my life. It is almost comical at this point that I can't get a single update to my operating system without it shoving something down my throat that I don't want.
There are even plenty more of these annoying changes that I haven't mentioned. A few of them from recent memory include:
- Weather in task bar.
- Cortana in task bar.
- Prompting to change my default web browser.
- Prompting to use Cortana as my search engine for local files.
- Candy Crush randomly installed.
What bothers me the most though is how every upgrade somehow Microsoft "forgets" some of my settings and asks me to confirm or change. Its like I can say "No" to Edge 40 times, but one upgrade and its randomly my default again.
There is a word for this, which is "Enshittification" - basically the decay of a platform in terms of quality. I've blogged about this a lot recently:
- From the increase of [ads](https://connortumbleson.com/2021/12/06/adpocalypse/).
- To the removal of [chronological](https://connortumbleson.com/2018/05/27/the-death-of-chronological-order/) order
- With the never ending amount of [spam](https://connortumbleson.com/2020/10/19/blog-spam-sponsored-content/)
- To the [price](https://connortumbleson.com/2019/08/12/the-end-of-streaming/) going up and quality going down
- With products just aiming to hold your [attention](https://connortumbleson.com/2019/02/11/attention-control/) forever
- To the increased dependency on [instantaneous](https://connortumbleson.com/2018/08/19/instant-is-preferred/) gratification
- Finally for an addiction to [social networks](https://connortumbleson.com/2018/04/08/the-facebook-dependency/).
Or in more concrete terms:
- Windows destroying the experience on every release.
- Streaming solutions adding ads while we already pay for the content.
- Spam everywhere - dating apps, Xbox messages, text messages, letters in mail.
- Social networks removing chronological order to default to "recommendation based feeds"
- Streaming solutions going up in price as their content becomes fractured between many services.
Is it my age? Is it the products? Is it the time? I'm just getting exhausted of products changing to the disadvantage of the end user, but advantage to the shareholders.
Maybe I'm part of the problem. I like when I get quarterly dividends on the market and I'm indirectly cheering and rooting on companies who turn around and degrade the experience for the users. We encourage and push companies to push growth quarter after quarter and once you've captured all the population you've got no choice but to degrade the experience to further squeeze profits.
Maybe this is just the way the world is now. Money changes everything. I don't know how to explain it, but if you look at Twitter now. People are not tweeting like they used to - folks are tweeting to draw attention and spawn interaction. They do this because interaction = views and views = money. That same thought process can be applied to what you see occurring during Windows updates.
Microsoft wants you to use Cortana, use their web browser and search on their engine. They want this because you become the product making them money. For some unaware they follow along with whatever changes and updates - it doesn't matter if the quality has fallen. They follow along and nothing is better for Microsoft than a user who just accepts the changes. For now I'll call out the garbage and disable it.
### The Brain
URL: https://connortumbleson.com/2023/11/06/the-brain/
Last updated: 2025-02-04T11:42:28.000Z
Photo by [Milad Fakurian](https://unsplash.com/@fakurian?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few months ago I [blogged](https://connortumbleson.com/2023/02/06/air-quality/) about walking outside and having a breath of fresh air. Something about that air just smelled and felt like healthy quality air. This led me to purchasing and building out air quality tests that proved nothing was dangerous in my household. The air I breath inside is within the range of particulates per million expected within an American home.
Along those lines something else happened that I thought was a bit odd. I listened to an old favorite song called "Worldwide Choppers" by Tech N9ne ([YouTube link](https://www.youtube.com/watch?v=0GhbkrOg9gA&ref=connortumbleson.com)). When I heard this song come on - something was different and I couldn't quite place it. The song did not sound like I remembered and I felt like I could clearly understand the lyrics way more than I did in the past.
In this situation I just assumed it was something off with my Google Home in terms of the quality/speed it was playing. However, on the way to work the song still didn't sound as I remembered on a completely different medium for listening. On an off note, it amazes me that we've gotten to the point with Spotify that my current track can remember between devices, but that it resumes down to the same second I stopped listening on a different device.
Kagi search for "**music sounds different to me after a while*"
I started researching this though and it turns out I'm not alone with this random occurrence that things sound differently than you remember. It seemed there was a huge list of different reasons why music might sound differently over time if I summarize some random search results.
- Auditory Adaption
- Changes in mood
- Memory and Nostalgia
- Exposure to new music
- Sensory Acuity
- Environmental Influence
- Expectations
- Familiarity
Now there may be some truth to some of those or maybe its just some random idea that some person on the Internet had. I do know that this occurrence isn't just one song that is from my past. It can happen with old songs and currents songs - some days I listen to music and it just sounds different. This leads to me to basically the short version that the brain is such an interesting organ. Since I'm not sure why its deciding to make music sound different to me for a song that I'm positive I remembered sounding differently.
Now each brain is entirely different and probably responsible for an endless amount of senses from feeling, chemical, mental and radiation. What I find incredibly interesting with the advent of the Internet is folks dump their experiences into a public forum in hopes that anyone or someone can corroborate their experience. Since there are some weird things people do/experience and post it online and just hope that they aren't alone.
I research my sound change in hopes that someone has a reason and instead all I find is that is normal behavior. So at the end of the day - I guess that's positive instead of an alternative.
### Travel Blog: San Francisco
URL: https://connortumbleson.com/2023/10/30/travel-blog-san-francisco/
Last updated: 2025-02-04T11:42:29.000Z
Photo by [Jorge Gardner](https://unsplash.com/@gardnerjorge?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Boarding a plane and hearing the estimated travel time as 5 hours and 5 minutes for someone who doesn't travel internationally sounded terrible. Sure enough flying through the air at 30,000 feet for 5 straight hours did begin to ache the back, but once done I had landed in SFO airport.
The wedding I was attending though was in Berkeley and I landed in San Francisco so I decided to take the train. Just getting to the train was the biggest struggle for me as I had to figure out how to get to the right floor, take a tram to the BART location and then figure out the right train to get on.
I was pretty excited to drive over the water, but then I quickly realized this was a subway and that was going under the water. I've only got experience with a few train/subway trips in my existence now, but I feel like the underground subways are a bit less preferred then to the Chicago style of above ground.
Either way I made it to my intended location with luggage in hand and off to a restaurant. Still feeling the Florida time of 3 hours ahead, but arriving around 11 local I was surprised to find that many places would not be open until 11:30\. So I walked until I hit the first restaurant to be open, which was Eureka.
[Eureka](https://eurekarestaurantgroup.com/locations/berkeley?ref=connortumbleson.com) Bison Burger
The burger was messy and good and the fries crispy. It was a good first meal after flying all morning. If they had some better napkins that could absorb the grease this burger was emitting - it would have been perfect.
Once that meal was done a few other family members had arrived and we stayed at the place above. Enough time then passed and our Airbnb was ready, which I Uber\`d towards so I could offload my bags.
The rehearsal dinner was that night and I quickly learned that Uber's in Berkeley were pretty hit and miss. With only 6 purchased trips that weekend two of them had 20+ min delays before a ride was available. So a tiny bit of a late arrival and a wedding event was in progress.
This was the first time at a wedding that I felt much more connected to most chunks of it people wise. In some weddings I'm the friend of the bride/groom and don't know the family. In some weddings I'm the family and don't know the others. In this wedding I was the family and the friends, which took a bit to balance all those parties together.
When Saturday morning arrived we had a solid 6 hours to kill before the wedding would start. So we were off to look at some of the large trees of California.
[Reinhardt Regional Redwood Park](https://www.ebparks.org/parks/reinhardt-redwood?ref=connortumbleson.com)
It was a crisp cool morning with gusts of wind making me wish I had packed a jacket. This was a relaxing start to the day for the wedding party before we had to be at the venue. I wish I had taken more photos of the Blair Witch like stick creations that littered the woods.
Once we were done in the forest - we stopped to eat some lunch. This time to prevent the issues of the past (food poisoning during wedding) we stayed to eating pretty safe foods.
As we purchased a fancy Uber Black this was quite the short complicated trip to the venue. It was stop sign and hill one after another until we were in a park above the town.
This terrain map shows it best when you see how much incline occurred on the way in. Once there - it was an elegant building known as the "[Brazilian Room](https://www.ebparks.org/rentals-and-permits/event-venues/brazilian-room?ref=connortumbleson.com)" on top of East Bay park.
From this photo it looks like a random patch of grass which doesn't really give the view justice especially since none of the venue is in the photo. At this point at a venue with pretty much no cell service and a professional photographer - my phone and camera went away.
The wedding went on into the night with drinks and dancing. I went from ciders to wine to a gin & tonic while dealing with an increasing amount of back pain. Getting an Uber out of this place was a challenge - you had to use the venue Internet to request an Uber, but then the Uber couldn't confirm the pickup or properly navigate with no service.
It led to some interesting detours that were ended the instant cell service became available as the driver had instant corrections on the route to take. It reminded me a problem I heard is quite frequent here. Travelers take an Uber into the forest for a drop off, then realize they have no signal for the Uber to request home. I'm not carrying an Ingress backpack full of hot spots and mesh routers, so at times on Google Fi I found myself with no service.
Saturday night came to an end and a few hours of sleep were had as many were flying out as early as 5am. Once again the time shift here of a 10:30pm blog post release in Eastern time puts me in a position to have a fully written post by 7:30pm local time. I'm normally writing these travel posts at the end of the night Sunday, but I'm in a pickle again that the weekend won't be over when the blog post is due.
So Day 3 on Sunday may be here, but you the reader won't know what happened. For now - its a travel day and hopefully goes well. I'll probably be on a flight when this post goes live.
### Help me help you.
URL: https://connortumbleson.com/2023/10/23/help-me-help-you/
Last updated: 2025-02-04T11:42:29.000Z
Photo by [nikko macaspac](https://unsplash.com/@nikkotations?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Every so often I see an issue on GitHub that can best be explained as someone attempting to get help with doing next to zero research on their own. This happened quite recently when a Java update rolled out and broke a selection of applications that were built slightly against the zip specification.
This had a pretty specific crash if affected of some form of "invalid CEN header" and something I [blogged](https://connortumbleson.com/2023/07/31/invalid-cen-header/) about a bit ago.
When the first duplicate issue came in - I was pretty calm and broke it down.
```
This is actually caused by a recent Java update that made things quite strict. It was reported here and slated for a hotfix this weekend - #3170
Fixed in this commit: #3178
If you want to workaround it. Set these system properties for your java:
jdk.util.zip.disableZip64ExtraFieldValidation - true
```
The 2nd time I saw a duplicate question, I went with:
```
You'll want to update your helper scripts to opt-out of this increased Java ZIP validation.
#3198
It may be fixed anyway once this patch is released to various versions - openjdk/jdk#15273
```
The 3rd time within days I went with:
```
Quite a few duplicates of this issue :/
#3290 (comment)
Closing.
```
It seemed like folks didn't search the issue tracker or even look at the last few merges. At some point this starts to eat at you as it shows the individual looking for support hasn't spent any effort in attempting to resolve the issue on their own.
I'm part of this one community and this individual I feel acts a lot like myself - they are straight to the point and don't stand for anyone not meeting them halfway.
This maintainer responded in under 10 minutes from this report and made it clear that if you don't use the issue template - you aren't getting help.
At times I feel it must be a language barrier as this user came back wondering why the issue was closed. In this specific case - this was this user's first ever post on GitHub and the account was less than a day old when it was posted. Personally, I don't see how you get to the point of installing a plugin for React Native without having a GitHub account yet - just seems a bit odd.
As shown above - when I tried to submit a issue on this repository I was met with a template to fill out. It wasn't as fancy as some of the newer GitHub templates that are more form driven, but it still looked like you had to do quite a lot of deleting to ignore the template.
So yeah I feel for that maintainer.
Take React Native itself which gets 10-20 issues a day on top of all the pull requests. They've got plenty of automation in play that automatically does the following:
- Checks if the template was followed.
- Checks if a newer version is available (compared to what you put).
- Checks if a reproducer was added.
- Checks if version is out of support.
If you make a mistake - a bot adds a label and in 90-180 days that label will cause the issue to be closed unless you fix it. This has helped them take a backlog of thousands of thousands of issues down to roughly 1,500.
At the scale they are working in - they'd either have to hire a few full-time folks to manage the bug tracker or have automation and machines keep it in check.
I just think back to the era of less structure with forums and Halo modding almost 2 decades ago. Even as a 13 or 14 year old kid - I was beyond nervous of people on the forum knowing I didn't know things. What that meant is I searched, read and tried to find answers to my own problems before I resulted to posting a question.
Chances are there back then - even when I did exhaust my research and post a question - I was still insulted and told something terse. Something has just changed over the last decade or so that folks are more likely to ask a question for someone to direct them / answer them instead of digging into it themselves.
This is a tough middle point to find though, especially in the workplace. You don't want someone struggling researching for hours for something they can simply ask another co-worker. On the flip - you don't want constant questions when a bit of self-research helps build the ability to resolve problems on your own.
This applies directly to GitHub - if you've shown you are willing to help the maintainer(s) help you then you'll have greater luck in getting a resolution. Once you do that a few times - take the next step and attempt to fix the problem itself with a pull request.
### The Weaponized Process
URL: https://connortumbleson.com/2023/10/16/the-weaponized-process/
Last updated: 2025-02-04T11:42:29.000Z
Photo by [Mitchel Lensink](https://unsplash.com/@lensinkmitchel?ref=connortumbleson.com) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few months ago at a local conference I ran into some folks that work at a pretty big national technology company. One of the things we discussed was the rise of "sim swap" attacks, which basically boils down to social engineering an individual to perform a task they should not do.
If you take that specific example - at times a sim swap is the only valid path to move a phone number, which will require a good deal of personal information to validate and confirm. Attackers have gotten pretty good due to the vast amount of information leaks to gather all the information needed to perform a swap.
At that point you then run into the processes and procedures in place at each respective phone company. If you roll the clock back a lot - it was almost as easy as just rolling the dice with who answered the phone. Chances are you might get someone willing to grant your sim request as you sell a story.
Common feature on an account to prevent SIM swaps.
In more modern times - features have been released by the respective companies in order to thwart this type of attack. They've even begun delaying processes in order to give a chance in a malicious situation for the victim to respond.
*XXX: A SIM change has been requested for this line. Reply with 1 to Approve this change or 2 to Decline. If we do not hear a response from you within 10 minutes, the change will proceed as requested.*
What I find extremely interesting is that every process or support avenue begins for the right reasons, but is almost immediately tested for how it can be abused.
---
Take for example like YouTube or Twitch which launched a major immediate and direct route in order to combat copyright infringement. In theory this seemed like a good idea where companies could shut down obvious movie uploads or any other purely malicious content.
However, what happened was very quickly people realized you could destroy a person's YouTube Channel with some quick claims about infringement. To make matters worse is YouTube wouldn't mediate these claims, so if a disagreement occurred it would be between the party and victim to resolve it.
Of course that didn't take too long for bogus requests to be thrown from shell companies or individuals to demolish competitor channels. YouTube reacted and then provided some methods for a legal response to fight back a claim. However, sometimes all you need to do is start a copyright claim as that is instant - the appeal and resolution may take weeks to months and by that point - the damage is done.
---
Now if you look at Ingress, a game I've been playing for 10+ years - they've had their own share of oddities.
In the beginning if you wanted to submit a new portal (Point of Interest) you would email an address and wait days to months for someone to approve/deny it. As Ingress evolved they added the ability to submit new locations directly into the application - this helped collect all the metadata they needed instead of the manual email route.
This created such a huge influx of submissions that it became clear that Niantic itself couldn't process the entire world's submission of POIs, so they disabled submissions. This was quite sad as it seemed the growing world of Ingress would halt. Roughly a year later a program called Operation Portal Recon (OPR) launched which allowed the players themselves to judge the quality of incoming submissions.
OPR
As shown above a user would quickly grade a portal on a variety of things in order to qualify or reject a submission. Of course this didn't take long for the first form of abuse to occur. Since it was user-generated content, some folks quickly developed patterns to detect their own submissions between the two teams.
It may be a trailing comma or leading space, but each team knew that meant their team submitted it. This would lead to rejections that were valid and submissions that were not.
All for the play of getting portals into areas they shouldn't be. Whether this was a private business location or personal property - it became weaponized.
As OPR features grew the other game under Niantic (Pokemon Go) was itching to take part in this process. They wanted to change the POIs for different reasons - while Ingress was about exploring and finding difficult to reach portals, Pokemon players generally just wanted a huge amount of Wayspots everywhere.
So a few years later OPR was no more - it was shutdown and evolved into Niantic Wayfarer for a cross-game database of locations (now known as Wayspots).
Sure enough abuse was back - this time with edits causing all the in-game links and fields to drop. Was it being moved to correct an inaccuracy of a few meters or being moved to impact the game board?
The case was clear that in most situations - no one cared if the Wayspot was a few meters misplaced - they just wanted to do the damage when a point moved. Niantic took a bit, but responded again to this new form of abuse and prevented moved locations from adapting the game board.
Time and time again in Ingress every new pattern was abused and it becomes a toxic pool of thinking. You either join in the abuse in a form of revenge or take the high road and hope people just play the game.
---
Abuse doesn't always have to be malicious though - think about GitHub support who has mentioned that a large amount of support requests they get are people emailing support about an issue in a repository. It seems crazy to me that just because some people can't install/build React Native they think an avenue for solving that is emailing GitHub itself.
So all in all - malicious or not if you add a process it'll be weaponized or abused.
### Apktool v2.9.0 Released
URL: https://connortumbleson.com/2023/10/08/apktool-v2-9-0-released/
Last updated: 2025-02-04T11:42:29.000Z
Apktool v2.9.0 has been released! This release is quite large with a good deal of changes and a ton of commentary to follow. If you aren't interested and just want the changes and download - head on the bottom or the [doc site](https://apktool.org/blog/apktool-2.9.0?ref=connortumbleson.com).
From the highest level - we will dig into the follow:
- Android 14 Support
- AAPT2 as default
- Resources Modes
- SnakeYAML
- Surviving Decoding
- Reworking Attributes/Arrays
- Sponsors
**Android 14 Support**
Android 14 was unlike the previous releases for AOSP for a variety of reasons. This release introduced a new qualifier for gender, but what was odd about this qualifier is that it claimed the "*inputPad0*" that was found at byte 20 of the flags that was previously reserved/unused.
This meant that instead of increasing the size of the qualifier header - a reserved value was claimed. This becomes problematic for folks using older versions of Apktool now. As Apktool previous to 2.9.0 will skip that value - this will lead to duplicate resources and more than likely crash. This was important for another reason, because we did not see this patch applied to the original aapt build tool, only aapt2 was updated.
Additionally, a new optimization technique was created for aapt2 known as "*\--enable-compact-entries*". This is a bleeding edge optimization only for applications built with a minimum of API 34\. What this does under the hood is quite clever and deserving of its own blog.
In short we saw the introduction of COMPACT entries, which were commonly used when only strings were in play. This allowed some tricks to be used to store the index/type in the size/flags field, because you can assume the size of a string only entry set and re-purpose the size field for other information.
Finally, we saw the introduction of OFFSET16 as a flag, which allowed entries to be stored in a smaller data size than normal (int). Of course this would only work if the entry set can fit into the unsigned short size pool.
**AAPT2 as Default**
This was going to happen at some point eventually, but with Android 14 adding more and more features only to aapt2 - it became clear that Apktool defaulting to the original aapt was no longer the right call. Especially since the new qualifier (gender) is only supported in aapt2.
This exposed a flaw in the naming pattern of these flags and forced me to introduce `--use-aapt1`, and keep `--use-aapt2` as a defunct parameter. Of course tool authors who wrap Apktool are going to struggle with this one, but I accept I named this parameter wrong in the beginning. It should have been something like `--aapt-version {x}`.
**Introducing Resource Modes**
While resolving issues I noticed a pattern to the tune of basically:
- intentional malformed/unused resources
- huge amount of gaps in resource table
- confusion around dummy resources
So a new parameter called Resource Modes was added with 3 possibilities of `remove`, `dummy` or `keep`. The [documentation](https://apktool.org/docs/in-depth/resource-modes?ref=connortumbleson.com) explains the reasoning and history best with this, but this is a big step towards disassembling an application as the end user wants. We will now default to removing any unresolved resource instead of previously producing a dummy (and often invalid) resource.
**Dropping SnakeYAML**
We relied on SnakeYAML for over a decade to help us parse the YAML files, but they've had some struggles running on Android itself and some recent CVEs due to untrusted parsing. Apktool relies on an untrusted `apktool.yml` file, so sv99 set out to introduce a very small [custom class](https://github.com/iBotPeaches/Apktool/pull/3191?ref=connortumbleson.com) for handling YAML files.
It went through months of testing during the construction of Apktool 2.9.0 so I'm confident all regressions have been found. With SnakeYAML gone - I can now safely assume I won't get anymore "SnakeYAML vulnerability" emails anymore, because as that hit 10+ occurrences I was starting to get annoyed.
💡
Even when we used SnakeYAML - we had a custom class safe constructor so were not vulnerable to any untrusted code deserialization attacks.
**Surviving Decoding**
Much like I [talked about](https://connortumbleson.com/2023/07/17/upcoming-apktool-2-8-0/) during the release of 2.8.0 - I set out for this release to tackle every disassembly failure during Apktool resource parser that we had open bug reports for. We got tons of fixes for the following:
- supporting misleading chunk header sizes
- supporting entry offsets that resolve to nothing
- supporting AXML namespaces with padded extra data
- supporting AXML with duplicate end namespaces
- supporting empty resource tables
- supporting duplicate namespaces
- supporting string blocks with more entries than strings
- supporting unknown files that exceed file length limit
- supporting smaller packed resource entries
- supporting spanned strings that have spans outside length
- supporting pre-1.0 Android resources
In short this required large chunks of rewriting our AXML/ARSC parser, but the journey left me with a far better understanding of the specification than previously. You should notice far more success with disassembly than the past.
**Reworking Arrays/Attributes**
Apktool was started before AOSP sources were available and had a good, but not bulletproof resolution for determining the types of attributes and arrays. This was noticed here and there over the years and some patches were thrown on top of an unstable house. Once fresh eyes looked at some logic - it was far easier to determine types of arrays/attributes than previously.
This release via [#3326](https://github.com/iBotPeaches/Apktool/pull/3326/files?ref=connortumbleson.com) ripped out all that logic and rewrote the detection of type and led to a more stable solution. This may lead to some changes in the disassembly, but for a proper resolution than the past.
**Sponsors**
I launched [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com) to help provide another alternative for folks showing appreciation. I was quite happy to obtain a few donations in under of month from launching that platform.
- [Emerge Tools](https://www.emergetools.com/?ref=connortumbleson.com) came online to sponsor the tool.
- [Sourcetoad](https://sourcetoad.com/?ref=connortumbleson.com) (self employer) additionally joined to sponsor (as well as a few other projects).
---
**This release had 327 commits by 10 people and 1 robot**
- Connor Tumbleson (iBotPeaches) - 282 commits
- Dependabot (BOT) - 9 commits
- Fmstrat - 8 commits
- Slava Volkov - 8 commits
- sv99 - 7 commits
- ArjunaKumarMohanta - 3 commits
- Ben Curtis - 3 commits
- Igor Eisberg - 2 commits
- Dougy Lee - 2 commits
- Phone-Guru - 1 commit
- maksz42 - 1 commit
---
# Changes since 2.8.1
- \[[#3145](https://github.com/iBotPeaches/Apktool/issues/3145?ref=connortumbleson.com)\] Add manual YAML implementation to drop SnakeYAML dependency. [(Thanks sv99)](https://github.com/iBotPeaches/Apktool/issues/3145?ref=connortumbleson.com)
- \[[#3202](https://github.com/iBotPeaches/Apktool/issues/3202?ref=connortumbleson.com)\] Add Android 14 framework support.
- \[[#2836](https://github.com/iBotPeaches/Apktool/issues/2836?ref=connortumbleson.com)\] Add [Resource Modes](http://localhost:3000/docs/in-depth/resource-modes?ref=connortumbleson.com) to allow for more control over resource decoding.
- \[[#3351](https://github.com/iBotPeaches/Apktool/pull/3351?ref=connortumbleson.com)\] Add Docker image. (Thanks Fmstrat)
- \[[#3366](https://github.com/iBotPeaches/Apktool/issues/3366?ref=connortumbleson.com)\] Add support for compactly packed resources.
- \[[#3367](https://github.com/iBotPeaches/Apktool/issues/3367?ref=connortumbleson.com)\] Add support for 16bit offset entries in resource table.
- \[[#3369](https://github.com/iBotPeaches/Apktool/issues/3369?ref=connortumbleson.com)\] Add support for grammatical gender.
- \[<#3199>\] Fix regression with detection of sparse resource table.
- \[[#3298](https://github.com/iBotPeaches/Apktool/issues/3298?ref=connortumbleson.com)\] Fix poisoning of sparse detection via sparse framework.
- \[[#3205](https://github.com/iBotPeaches/Apktool/pull/3205?ref=connortumbleson.com)\] Fix over-reading the Res Config Flags if size is larger than known.
- \[[#2806](https://github.com/iBotPeaches/Apktool/issues/2806?ref=connortumbleson.com)\] Fix improperly decoding attribute and arrays.
- \[[#3346](https://github.com/iBotPeaches/Apktool/issues/3346?ref=connortumbleson.com)\] Fix corruption of resource table when aapt2 is used.
- \[[#2989](https://github.com/iBotPeaches/Apktool/issues/2989?ref=connortumbleson.com)\] Fix decoding application with larger chunk header size than used.
- \[[#1874](https://github.com/iBotPeaches/Apktool/issues/1874?ref=connortumbleson.com)\] Fix decoding application with entries offset that resolved to NO\_ENTRY (-1).
- \[[#2587](https://github.com/iBotPeaches/Apktool/issues/2587?ref=connortumbleson.com), [#2863](https://github.com/iBotPeaches/Apktool/issues/2863?ref=connortumbleson.com)\] Fix decoding application with larger axml namespace than known.
- \[[#2070](https://github.com/iBotPeaches/Apktool/issues/2070?ref=connortumbleson.com)\] Fix decoding application with misleading number of end namespace chunks.
- \[[#2701](https://github.com/iBotPeaches/Apktool/issues/2701?ref=connortumbleson.com)\] Fix decoding application with empty resource table.
- \[[#2664](https://github.com/iBotPeaches/Apktool/issues/2664?ref=connortumbleson.com)\] Fix decoding application with duplicate namespaces.
- \[[#2972](https://github.com/iBotPeaches/Apktool/issues/2972?ref=connortumbleson.com), [#2420](https://github.com/iBotPeaches/Apktool/issues/2420?ref=connortumbleson.com)\] Fix decoding application with missing namespace on system resources.
- \[[#3236](https://github.com/iBotPeaches/Apktool/issues/3236?ref=connortumbleson.com)\] Fix decoding application with string block with more string entries than strings.
- \[[#3238](https://github.com/iBotPeaches/Apktool/pull/3238?ref=connortumbleson.com)\] Fix decoding application with unknown files that exceed file name length limits.
- \[[#2824](https://github.com/iBotPeaches/Apktool/issues/2824?ref=connortumbleson.com)\] Fix decoding application with duplicate smaller res entries.
- \[[#2829](https://github.com/iBotPeaches/Apktool/issues/2829?ref=connortumbleson.com)\] Fix decoding application with styled string with span outside length of string.
- \[[#3311](https://github.com/iBotPeaches/Apktool/issues/3311?ref=connortumbleson.com)\] Fix decoding application from Android Milestone (pre 1.0) builds.
- \[[#3198](https://github.com/iBotPeaches/Apktool/issues/3198?ref=connortumbleson.com)\] Fix "disableZip64ExtraFieldValidation" patch by adding to helper scripts.
- \[[#3204](https://github.com/iBotPeaches/Apktool/issues/3204?ref=connortumbleson.com)\] Fix changing values of `platformBuildVersionCode` and `platformBuildVersionName` in `apktool.yml`.
- \[[#3282](https://github.com/iBotPeaches/Apktool/issues/3282?ref=connortumbleson.com)\] Fix ci build system to properly archive test builds post Kotlin migration.
- \[[#2973](https://github.com/iBotPeaches/Apktool/pull/2973?ref=connortumbleson.com)\] Fix Windows helper scripts to properly handle `/c`. (Thanks maksz42)
- \[[#3368](https://github.com/iBotPeaches/Apktool/issues/3368?ref=connortumbleson.com)\] Change aapt2 to be default build tool.
- \[[#3222](https://github.com/iBotPeaches/Apktool/pull/3222?ref=connortumbleson.com)\] Change build system to ignore missing javadoc blocks. (Thanks sv99)
- \[[#2129](https://github.com/iBotPeaches/Apktool/issues/2129?ref=connortumbleson.com)\] Change `-c/--copy-original` to no longer be deprecated.
- \[[#2683](https://github.com/iBotPeaches/Apktool/issues/2683?ref=connortumbleson.com), [#2104](https://github.com/iBotPeaches/Apktool/issues/2104?ref=connortumbleson.com)\] Change frequency of dummy resources to be less often after proper disassembly of resources.
- \[[#3249](https://github.com/iBotPeaches/Apktool/pull/3249?ref=connortumbleson.com)\] Change build system configuration to Kotlin DSL.
- \[[#3353](https://github.com/iBotPeaches/Apktool/pull/3353?ref=connortumbleson.com)\] Change build system to leverage Gradle version catalog.
- \[[#3258](https://github.com/iBotPeaches/Apktool/pull/3258?ref=connortumbleson.com)\] Change system to no longer generate `APKTOOL_DUMMY_*` resources.
- \[[#3310](https://github.com/iBotPeaches/Apktool/pull/3310?ref=connortumbleson.com)\] Change verbose mode to no longer print out method names.
- \[[#3171](https://github.com/iBotPeaches/Apktool/pull/3171?ref=connortumbleson.com)\] Refactor out specific manifest file decoder for empty resource table. (Thanks sv99)
- \[[#3211](https://github.com/iBotPeaches/Apktool/pull/3211?ref=connortumbleson.com)\] Refactor out duo logic with decoders during resource parser. (Thanks sv99)
- \[[#3217](https://github.com/iBotPeaches/Apktool/pull/3217?ref=connortumbleson.com)\] Refactor for specific method operations for loading full resource table. (Thanks sv99)
- \[[#3242](https://github.com/iBotPeaches/Apktool/pull/3242?ref=connortumbleson.com)\] Refactor ApkDecoder for leveraging ApkInfo for file and unknown files. (Thanks sv99)
- \[[#3243](https://github.com/iBotPeaches/Apktool/pull/3243?ref=connortumbleson.com)\] Refactor ResAttrDecoder into AXmlResourceParser. (Thanks sv99)
- \[[#3228](https://github.com/iBotPeaches/Apktool/pull/3228?ref=connortumbleson.com)\] Refactor Gradle validation job to only run if `gradle/wrapper/gradle-wrapper.jar` is modified. (Thanks ArjunaKumarMohanta)
- \[[#3275](https://github.com/iBotPeaches/Apktool/pull/3275?ref=connortumbleson.com)\] Upgrade Gradle to `8.3.0`. (Thanks ArjunaKumarMohanta)
- \[[#3327](https://github.com/iBotPeaches/Apktool/pull/3327?ref=connortumbleson.com)\] Upgrade `@actions/checkout` to `v4`.
- \[[#3240](https://github.com/iBotPeaches/Apktool/pull/3240?ref=connortumbleson.com)\] Upgrade `apache.commons/lang3` to `3.13.0`.
- \[[#3358](https://github.com/iBotPeaches/Apktool/pull/3358?ref=connortumbleson.com)\] Upgrade `apaches.common-io` to `2.14.0`.
- \[[#3213](https://github.com/iBotPeaches/Apktool/pull/3213?ref=connortumbleson.com), [#3241](https://github.com/iBotPeaches/Apktool/pull/3241?ref=connortumbleson.com), [#3285](https://github.com/iBotPeaches/Apktool/pull/3285?ref=connortumbleson.com), [#3316](https://github.com/iBotPeaches/Apktool/pull/3316?ref=connortumbleson.com), [#3359](https://github.com/iBotPeaches/Apktool/pull/3359?ref=connortumbleson.com)\] Upgrade `gradle/gradle-build-action` to `2.9.0`.
- \[[#3214](https://github.com/iBotPeaches/Apktool/pull/3214?ref=connortumbleson.com)\] Upgrade `gradle/wrapper-validation-action` to `1.1.0`.
- \[[#3235](https://github.com/iBotPeaches/Apktool/pull/3235?ref=connortumbleson.com)\] Upgrade `xmlunit:xmlunit:1.6` to `org.xmlunit:xmlunit-legacy:2.9.1`.
- \[[#3259](https://github.com/iBotPeaches/Apktool/pull/3259?ref=connortumbleson.com)\] Upgrade `com.github.johnrengelman.shadow` to `8.1.1`.
## Notes
- This release has moved to aapt2 being the default. If you'd like to return to the previous behavior, please use `--use-aapt1` during build stage.
## Download
[Download Apktool 2.9.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.9.0.jar?ref=connortumbleson.com)
- [Apktool 2.9.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.9.0.jar?ref=connortumbleson.com)
- `246e7208cfb92c73d21e4e6a8909dda1` (md5)
- `e5ecf759297b845be64a3a5145ccc372db905b15a801a22ea1c91ee03c4c7a65` (sha256)
- Rename to `apktool.jar` and follow the [Instruction Guide](https://apktool.org/docs/install?ref=connortumbleson.com) if you need help.
- [2.9.0 Doc Site Post](https://apktool.org/blog/apktool-2.9.0?ref=connortumbleson.com)
## Links
- [Project Site](https://apktool.org/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [GitHub Sponsors](https://github.com/sponsors/iBotPeaches?ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### Safety in Patterns
URL: https://connortumbleson.com/2023/10/02/safety-in-patterns/
Last updated: 2025-02-04T11:42:30.000Z
Photo by [JJ Ying](https://unsplash.com/@jjying?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few weeks ago as I arrived at the park to workout and do my morning stretches I saw a regular who seems to be there every weekend like me. They asked where I've been since I wasn't there the prior week as I was up in [West Virginia](https://connortumbleson.com/2023/08/21/travel-blog-charleston-wv/).
I explained a simple phrase of "out of town" and that was that. What I found interesting is that if someone can notice my pattern was broken - it seems you build up quite an amount of safety in that. Now I doubt any of these park goers would treat me missing from a normal workout as anything to be alarmed about, but interesting enough that they noticed.
It seems this notion of finding anomalies within a pattern is the strength of many many systems. Whether its a network defense system looking for out of the norm packets or a credit card company noticing where and what you normally buy.
Let's take a look at [nzyme v2.0](https://www.nzyme.org/?ref=connortumbleson.com) and how it operates among patterns.
nzyme monitored personal network.
You can see above that nzyme will detect differences to a trusted network by quite a lot of methods, but what I want to lock into is the "Expected Signal Track". Given a static position of your nzyme hardware - it would develop a consistent track of the signal strength of the monitored networks.
💡
nzyme v2 is currently in alpha - a network defense piece of sofware built by the founder of Graylog - Lennart Koopmann.
This of course assumes that your access points and nzyme hardware is stationary. This ends up building a waterfall chart of the signal strength as packets go across the air.
nzyme 2.0 signal waterfall
This becomes quite possibly the best protection against spoofed/fake networks in my personal opinion. When a malicious network comes online chances are it isn't on the same hardware or area as trusted devices.
This means that near instantly when an attacker launches a malicious network nzyme would notice a different pattern to signal strength and immediately alert. This method wouldn't work for a brand new stood up network to immediately flag malicious activity, but it's seeming that some of the best detection is a break to a pattern.
Take my credit card and what happened with Akamai acquiring Linode (which I'm not happy about).
Once Akamai took over billing - the name (and price) started changing. This threw off some patterns on my credit card and I had to confirm the transaction.
It seems that credit card companies probably have entire departments dedicated to anti-fraud with huge amounts of logic or AI to shift through transactions to look for oddities to a pattern.
The more I think the more things appear to be based on anomalies to patterns. Even to the extreme that some pattern watching becomes profiling - all in all some interesting things to think about.
### Travel Blog: Malibu, CA
URL: https://connortumbleson.com/2023/09/25/travel-blog-malibu-ca/
Last updated: 2025-02-04T11:42:30.000Z
Airbnb - Malibu, CA
For the first time in what might be ever I did a direct flight from Tampa to Los Angeles. This was a long grueling 5.1\~ hour flight with a 3h time shift once landed, so while my body felt like a good chunk of the day was over - only 2 hours had passed in time.
Thankfully taking a flight across the states means its a large plane that travels at high altitude, which helps cut down on the motion sickness I receive. So all in all outside of a few minutes of turbulence I felt okay on the flight. Once landed and walking out into the terminal - it was insanely packed. I couldn't believe a random 9am on a Friday had people and lines everywhere. I had to weave and walk to get myself to the ground car pickup, where my group was receiving a $93 ticket for waiting too long.
We were then off with a ticket and traveling to breakfast at a place quickly researched around the Santa Monica Pier. We landed at Shutters on the Beach which I quickly then learned how massively the price of things changed between Florida and California.
Fish n Chips @ COAST (Shutters on the Beach)
The meal was elegant with personal ketchup deposits and unopened mini jams, but I still can't really fathom how a little mimosa was $20 a glass. Thankfully I could order off the lunch menu as my body clock was at lunch time even if it was only 10am local time.
However, the food came and went and heavy breaded fish was hardly worth $29 when paired with my $20 drink. Either way though - I was here for a celebration so it was worth it to spend a little more than normal.
Once done there - we walked to the Santa Monica Pier and walked it in a large circle stopping at the bar at the end. This felt like an older pier compared to what I remember visiting in Florida. This was a wooden structure full of events, gatherings, shops, homeless and an army of people wandering around. Preparations were undergoing to setup for an Opera, so I imagine it was a bit more hectic than usual. Additionally, getting yelled at from various folks stumbling around and people dressing like strippers and asking for $20 for a photo was an experience.
Looking out towards the water at the end of the pier.
A pier is a pier though and good tourist site to visit. I enjoyed the views and we burned enough time to be able to head back to our Airbnb in Malibu. We just made a quick pit spot at another bar as our check-in wasn't allowed till 4pm. This was another expensive venture as we booked a place right on the water.
One thing I quickly learned after attempting to go on a run is this house sucks for working out. There is no walking/running allowed on the Pacific Coast Highway (PCH) and when I went down to the beach to run there instead - it was full of rocks and the tide was splashing against the seawall in some places. I'm guessing the folks here head into the hills for a trail or into town for a more structured running path.
The Airbnb booking
So maybe a bit of advertising tricks led me to believe it was going to be flatter on the beach. The pricing hike of California struck again with a 4 digit price tag to stay here - no wonder engineers in California easily make 2-3x what I make in Florida - everything here is mega expensive.
Some quick showers and cleaning up and we were off to quite possibly the most expensive and fancy dinner I've ever been to. We were seated at 1 of the 2 dining rooms for a private seasonal Omakase meal at [Shunji](https://www.exploretock.com/shunji/?ref=connortumbleson.com). This was a 2+ hour meal with over 20 courses of a single fish/dish placed in front of you. It was only us four, the chef and a staff member.
I've never been to such an exclusive and expensive meal before. There were only two eating times at 5:15pm and 7:45pm both of which required finding an unmarked building/door that was locked. Stand around outside a bit and someone comes out to confirm your information and you are brought into a tiny elegant building.
There are no substitutions, there are no changes - you will try what the Chef is making on that day of that season of that month. The fish was of insane great quality and it reminded me I should always try something once. The sea urchin may not have been one to repeat, but I finished all 20 courses. I think Omakase will be left for the ultra celebration unique events to visit again.
Once done there we jumped to a nearby bar, but were fading fast. At this point only being 8pm in CA, my body clock was at 11pm with a 4am wake up - I was feeling it. So we went home to call it a night and sleep with the windows open listening to the waves crash against the shore.
One thing I thought was interesting was how high tide basically had the waves crashing against the foundation of the home. In the case of this rental - the concrete looked undamaged and quite sturdy. However, walking down Malibu's rocky beaches many of the homes structure looked eroded to the point that rebar was visible on the concrete supports.
Burger @ Malibu Farm
A new day struck and it was the day to learn how to surf, but prior to that we needed some breakfast. A quick trip to a Malibu pier and I was amazed to see almost a hundred surfers all surfing out there. Most of them were leaving as we were arriving (8am) so the true local surfers must start the morning really early with some surfing.
We sat on top of the pier watching surfers and fending off birds as we ate once again an expensive meal. I can't keep harping on price, but it really was such a change of pace to what I'm used to.
- A charge per plastic bag at grocery store.
- A flat-fee per Uber for driver benefits (Only in CA?).
- Gasoline hitting $7/gallon.
- Commonly spending $20 per drink.
- Meals averaging $50-70 per person per meal.
I'll avoid bringing it up again, but it just blew my mind that a single weekend here would rack up more cost spending then maybe weeks of entertainment value in Florida.
It was time for another scheduled major event - learning how to surf. We got down to the beach early to explore Venice and that was another experience to see. Walking this strip of concrete and having shops everywhere with people selling things from palm readings to phone cases.
A few shops just had people with a microphone trying to convince people of some message/point and it was so much to take in. Once done exploring there we went to our check-in for a surfing lesson, which started as a orange car in a parking lot.
Kapowui Surf Lessons
I wondered how I was going to handle at this with a lingering back surgery issue and it didn't work out too well. Going from your stomach to knees to pushing up from knees into standing in a second it just not something I can do much anymore.
I can do it, but it takes me a few extra seconds to let that back warm up. I gave it a go, but after one real attempt of trying to get up and crashing into the sand/water - I knew my back wasn't going to help me on this one. So I chilled out on a board in the water in my wet suit just watching the others learn to surf.
I'm paying the price the next day for even that as my back is pretty locked up. It'll take a few days and proper posture/sleeping to get this thing back to my normal.
Once we were done surfing - we were pretty wet and dressed like beach-goers so we went into town a bit to find a bar. The recommendations we got though were absolutely jammed back - it seemed every college football game on meant that every bar was packed. We slipped into one that had an empty table, but only one wait staff for the entire bar.
It felt like we were crashing some college sports bar as tables around us were packed of students/alumni pulling up chairs and constantly looking to grab our table. Unless I'm in the drunk zone - I much prefer a more quieter atmosphere than that meal.
So we waited a solid minute to find an Uber and went back to the place to shower and clean up. However, surfing took a number on us so instead we just slipped to the bar down the road and enjoyed some drinks and deserts to end day 2.
Day 3 will be a challenge to write about - the day hasn't ended and by the time its over - it'll be passed 10:30pm (Eastern) in which I normally publish. My flight home is 10:10pm CA time - so I'm looking at a red eye overnight flight back to Tampa. Normally on travel days I'm getting home before 10:30pm Eastern so I can finish the post.
However, my blog post is scheduled to go live at 10:30pm Tampa, 7:30pm California time. At that point I'll be making my way through transportation on my way to a stressful airplane experience.
So I'll come back and retroactively edit this to drop in day 3, but for now - the expensive trip to Malibu is over.
### Bye CentOS & cPanel
URL: https://connortumbleson.com/2023/09/18/bye-centos-and-cpanel/
Last updated: 2025-02-04T11:42:31.000Z
Photo by [İsmail Enes Ayhan](https://unsplash.com/@ismailenesayhan?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Way back in February of 2016 I did a large migration and moved my large server from CentOS 6 to 7\. It was a self-inflicted disaster with all fault to myself. My sites had downtime, name-server propagation took days and many folks were upset.
I didn't really have a CentOS 6 box - I had a cPanel CentOS box which changes the system quite massively to the point that I would say its a cPanel box - not CentOS.
So once I was done with that migration I pledged to not touch it again and run CentOS 7 until it was no longer possible. That day is now nearing as June 30, 2024 CentOS 7 will become End of Life (EOL).
Now a lot has changed in the ecosystem and myself since 2016 to have a differing opinion on this. First off, I'm way better at managing Linux servers than I was in 2016\. Simply put I feel way more comfortable triaging and building out configurations than I did about a decade ago.
However, one big thing is still in the equation which is cPanel. A tool I first encountered when buying shared hosting and something I became familiar with a long time ago.
In mid 2019 though cPanel [decided](https://web.archive.org/web/20200427063618/https://blog.cpanel.com/introducing-account-based-pricing/) to redo pricing in an extreme way - they moved from server based billing to account based billing. This meant in absolute basic terms that my yearly bill of $170 went to $360\. This was a bit upsetting, but I realized they had me in a choke-hold. I couldn't migrate off a cPanel box without a good deal of effort and it was easier to eat the cost and ignore it.
Though, I'm a bit torn on the price hike there. Of course the web servers of the 2000s were different than 20 years later. A per server billing agreement was quite abused when some powerful servers in modern times could easily hold hundreds of accounts. Especially when you consider load balancing and many servers/containers in place - a rate per server in an era of containers is an odd thing to tally up.
However, I didn't see that in the moment - all I saw was a new private equity investment of Oakley Capital coming in and acquiring cPanel. With what has become common in the industry - when PE money comes in - the price goes up or the product collapses. Not to mention it was the most abrupt pricing change with zero advance notice and no honoring of older pricing plans.
[https://blog.centos.org/2020/12/future-is-centos-stream/](https://blog.centos.org/2020/12/future-is-centos-stream/?ref=connortumbleson.com)
So I realized my time on cPanel was going to come to an end. I set in my head that once CentOS 8 was released and had a few months to stabilize - I was going to rip out cPanel and swap CentOS 7 to 8 and do things manually with the help of Ansible.
That plan was quickly over when Red Hat pretty much destroyed the CentOS I was tracking. That drama itself could be its own post, but when the dust had settled CentOS had been terminated (2020).
So I was back in an odd situation as Red Hat just moved the EOL date of CentOS up by 8 years and introduced CentOS Stream as a replacement. I was a bit hesitant to get onboard with something that was free today, but maybe not tomorrow. Even if I fit under the limits to qualify as free usage - it just seemed like something that may not be free in the future. So when all associated products were costing more than the hardware itself - it was time to plan.
So my new long-term goal was to shutdown projects that I didn't want to pay for anymore and split sites to containers/servers that were without cPanel. This has been a difficult journey, but I'm down to 11 sites from 25 on the cPanel box. I wish that was discount, but cPanel's tiers are:
1. 1 - Solo
2. 5 - Admin
3. 30 - Pro
4. 100 - Premier
5. 100+ Custom
So I've always been on the Pro plan and doesn't look like I can drop any pricing until I've down to the last few accounts.
[https://cpanel.net/pricing/](https://cpanel.net/pricing/?ref=connortumbleson.com) (2023)
Of course these migrations of moving 14 sites occurred over 18 months and throughout those times we've had 2 price hikes with cPanel.
Now instead of $30 a month, I pay $39.99 a month which is basically $480 a year. This is way more than the $120 a year I used to pay. cPanel continues to push the price forward and I wish I could see some marginal improvements in the product, but my SSL continues to break for some "known issue" still being triaged after a year.
So now I have Rocky Linux, Alma Linux, Debian, Ubuntu and more to pick from for building out some remaining servers. I want to use containers more or even utilize AWS, but without a price ceiling I'm pretty nervous to leave Linode.
> Akamai Technologies Completes Acquisition of Linode to Provide Businesses with a Developer-friendly and Massively Distributed Platform to Build, Run and Secure Applications
> [https://www.akamai.com/newsroom/press-release/akamai-completes-acquisition-of-linode](https://www.akamai.com/newsroom/press-release/akamai-completes-acquisition-of-linode?ref=connortumbleson.com)
So I got pretty nervous again when Akamai acquired Linode as I knew changes would be inbound. Sure enough exactly 1 year later price updates came out to increase nearly all Linode prices. This is already not the Linode I remember.
The Linode I remember would decrease costs and increase the resources of your existing plan for $0\. They did it consistently throughout a decade of hosting. Now they are upping the prices under the clause of improved cloud experiences, but honestly nothing that directly impacts me.
It seems I either just become a ranting mess or 3 things (CentOS, Linode & cPanel) I once depended on and appreciated are changing for the worse. It'll take me a bit longer to migrate the last \~10 sites, but when I'm done hopefully I'll be set for another decade.
### C-135 Tampa Bypass Canal
URL: https://connortumbleson.com/2023/09/11/c-135-tampa-bypass-canal/
Last updated: 2025-02-04T11:42:31.000Z
Driving around Temple Terrace every once awhile I pass this huge river and never see any boats on it. This turned out to be the C-135 Tampa Bypass Canal.
It starts, as the image shows, right where I drive by on the way to a park and it always looked a bit strange. Imagine driving over a large bridge and one side of the bridge has zero water and the other is a calm large river. I drove by it this weekend and stopped to get a photo of where the actual canal starts.
So then I got curious - why does this canal exist?
Turns out that isn't difficult to find at all with an official Southwest Florida Water Management District [website](https://www.swfwmd.state.fl.us/recreation/tampa-bypass-canal?ref=connortumbleson.com) explaining it briefly.
> The Tampa Bypass Canal (TBC) is a 14-mile waterway that connects the Lower Hillsborough Wilderness Preserve with McKay Bay. The canal provides flood protection for the cities of Temple Terrace and Tampa by diverting floodwaters from the Hillsborough River. The canal is also a water supply source for the city of Tampa.
While that helps explain it - an annotated photo really helps break down how this works.
[Tampa Bypass Canal Explained - YouTube](https://www.youtube.com/watch?v=j62LwYV0KBI&ref=connortumbleson.com)
While flood areas collect water and normally kickoff the Hillsborough River in times of heavy flooding or hurricanes - a dam code-named S-155 can be closed. That'll block further water from entering the Hillsborough River.
This will further flood the detention area, but then overflow into the canal instead of the regular river. This C-135 Canal then is a straight shot all the way into the bay avoiding the populated urban towns.
However, if the water level or capacity is already in the Hillsborough River another a different canal was built called "Harney Canal".
This can be used to divert the flood water away from the lower Hillsborough River which protects it from the urban downtown area. Just a little Y-split in the water to guide the rushing water into a less congested body of water.
So of course I wondered why this was built and if it was an after-thought or preparation for an event to come.
[Hurricane Donna (1960)](https://www.swfwmd.state.fl.us/projects/tampa-bypass-canal-system?ref=connortumbleson.com)
It was Hurricane Donna of 1960 that struck Florida causing massive floods around Tampa. The area knew it needed to do something to prevent another catastrophic flood from destroying the cities. The next year legislation created the Water Management District. A quick recap of the next 50\~ years is below.
- 1964 - Headquarters opens up in Brooksville, FL
- 1964 - Starts purchasing land for canal
- 1966 - Canal construction begins
- 1975 - Canal water can be used for consumption
- 1979 - Flood mapping is complete
- 2005 - C.W. "Bill" Young Regional Reservoir built
- 2008 - Desalination Plant built
An interesting history of how we adapted from abusing too much water from the aquifer to leveraging reservoirs to finally just desalinating ocean water. This all while trying to protect against a river flood from destroying homes and businesses.
So now every time I drive by this canal I'll know its true purpose - to save Tampa's ass when the heavy rain or hurricane comes.
Looking at the start of C-135 Canal from Fletcher Ave.
Too bad this is all gated - I would have like to walk up to the structures closer to the water for a closer investigation. I [learned](https://connortumbleson.com/2018/12/10/learning-about-water-treatment/) pretty quickly you don't want to go exploring around our water supplies.
### Hurricane Idalia & Tampa
URL: https://connortumbleson.com/2023/09/04/hurricane-idalia-tampa/
Last updated: 2025-02-04T11:42:31.000Z
[GOES Images from NOAA](https://www.star.nesdis.noaa.gov/GOES/floater.php?stormid=AL102023&ref=connortumbleson.com#navLink)
Towards the end of August 2023 some hurricane track images started going around chats and news. It seemed a storm was brewing and it was on the track for Tampa.
[https://www.nhc.noaa.gov/archive/2023/IDALIA\_graphics.php](https://www.nhc.noaa.gov/archive/2023/IDALIA%5Fgraphics.php?product=3day%5Fcone%5Fwith%5Fline%5Fand%5Fwind&ref=connortumbleson.com)
This accelerated things fast in Tampa with no real certainty exactly where it would land. On that Monday (August 28) it went incredibly quick that the following occurred:
- Parks closing to become sandbag pickup locations.
- School/Church closings.
- Mandatory evacuation for zone A.
- Diesel was mistakenly released mixed into regular gasoline causing gasoline panic. \[[source](https://www.wfla.com/news/hillsborough-county/potentially-widespread-gasoline-contamination-complicates-storm-prep-for-many/?ref=connortumbleson.com)\]
- Businesses closing down and plywood going up.
I'm not sure if its pure panic or what to describe the actions of humans in the pending time before arrival of a hurricane, but its interesting to write about.
Stores quickly enact rules that you can only buy a certain amount of select items like water, bread and toilet paper. They have to work quickly though because some people are there instantly buying multiple shopping carts worth of those items.
I don't really understand those people. When I see someone with multiple carts of water - who are they buying for? It seems like such an insane amount that they must be buying for a family of 20\. Either way - I understand its not my business to care how others are preparing for a storm, but boy it is odd.
Gasoline also became another panic purchase with most of the stations around me putting the little bags over the pumps indicating the fuel is out. This time - it didn't seem as urgent as Irma as later that day more gasoline was available.
So what ended up happening? Like has happened for 100+ years - the hurricane didn't end up directly hitting Tampa. We haven't been directly hit in Tampa since the Unnamed storm of 1921.
[Coast NOAA](https://coast.noaa.gov/hurricanes/?ref=connortumbleson.com#map=6.05/26.989/-79.326&search=eyJzZWFyY2hTdHJpbmciOiJUYW1wYSwgSGlsbHNib3JvdWdoIENvdW50eSwgRmxvcmlkYSwgVVNBIiwic2VhcmNoVHlwZSI6Imdlb2NvZGVkIiwib3NtSUQiOiIxMjE2ODQ5IiwiY2F0ZWdvcmllcyI6WyJINSIsIkg0IiwiSDMiLCJIMiIsIkgxIiwiVFMiLCJURCIsIkVUIl0sInllYXJzIjpbXSwibW9udGhzIjpbXSwiZW5zbyI6W10sInByZXNzdXJlIjp7InJhbmdlIjpbMCwxMDMwXSwiaW5jbHVkZVVua25vd25QcmVzc3VyZSI6dHJ1ZX0sInNlbGVjdGVkU3Rvcm1JRCI6IjE5MjEyOTNOMTMyODAiLCJidWZmZXIiOjYwLCJidWZmZXJVbml0IjpbIk5hdXRpY2FsIE1pbGVzIl0sInNvcnRTZWxlY3Rpb24iOnsidmFsdWUiOiJ5ZWFyc19uZXdlc3QiLCJsYWJlbCI6IlllYXIgKE5ld2VzdCkifSwiYXBwbHlUb0FPSSI6dHJ1ZSwiaXNTdG9ybUxhYmVsc1Zpc2libGUiOnRydWV9)
The track above is the storm of 1921, but what ended up happening with Idalia was a track straight north into Cedar Key. It ended up curling right into the corner as shown below.
However, Tampa still got some solid storm surge. This is where it further proved that if Tampa did take a direct hit - it would not be good. Most of the evacuation zones can't take 5-10ft of surge without extreme damage.
So while this Wednesday morning was pretty calm - the amount of storm surge was rising and rising. I found that you can always count on public Snapchat videos in order to get the scope on what is going on.
So a little script I wrote to just fetch all those public videos. A few minutes of tossing out boring videos and I had a collection of hurricane related content. Its unfortunate this process kinda blew out any names/authors of this content. I guess that is why TikTok automatically watermarks video with the author and itself.
So I grabbed 3 from each region of Tampa, St. Pete and Cedar Key and grouped them together. A bit of stitching and killing of the audio track and I was left with these creations.
0:00
/
1×
0:00
/
1×
0:00
/
1×
The videos move from Tampa to Crystal River with raw muted videos of folks on the ground during the hurricane. One thing I learned with the water just barely splashing the door of homes - that driving fast through flooded roads with a lifted truck is quite possibly a terrible thing to do.
A coworker was watching a camera feed of St. Petersburg and took a before/after photo of the marina. I took those photos and converted them into a little animated image.
When we pivot to Tampa - we can see the water level rise also changed the Tampa Riverwalk into an actual river walk. Probably just not the safest thing to walk on until that water recedes.
When the dust settled for those not in an evacuation zone - there was nothing but twigs on the ground. Got lucky for where I live and we live to survive another storm.
### Hobby Projects
URL: https://connortumbleson.com/2023/08/28/hobby-projects/
Last updated: 2025-02-04T11:42:32.000Z
Photo by [Eden Constantino](https://unsplash.com/@edenconstantin0?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As I blogged [heavily](https://connortumbleson.com/2023/07/17/upcoming-apktool-2-8-0/) about a month ago I've been working on a wide variety of hobby projects again. I don't know how best to explain it, but the drive to work on these hobby projects comes in waves.
When Halo Infinite was released near 2 years ago - [Leaf](https://connortumbleson.com/2023/04/17/project-leaf/) became my real drive and focus for an open source hobby project. Since this project exploded in popularity in comparison to the predecessors I had the drive to continue working on. It gained over the last year:
- Automatic image optimization from the upstream assets.
- Optimized top 100 leaderboards for medals
- Badges for achievements
- Detection of "farmers"
However, it struggles at the moment for larger changes because two of the most requested features are no easy task.
**Dark Mode**
Unfortunately my CSS library (Bulma) does [not support this](https://github.com/jgthms/bulma/issues/2342?ref=connortumbleson.com). Since I built Leaf with near zero custom CSS - introducing something as large as dark mode is holding me off.
**Season Support in Top Ten**
Querying a database that has grown past 50 million rows and still runs on a cheap Linode instance has its challenges. It takes nearly 11 hours to regenerate the top ten stats. This means that if I introduced per season stats (5 seasons at the moment) I'm looking at roughly 2.3 days per generation.
However, the stats should update daily so we have a problem. If I add indexes to make the site much faster at generation I'm looking at an extra 20-30gb of database space. I clearly am missing something why my indexes are so large, but doing any work with a database this big has become a challenge.
---
Thankfully in the terms of Leaf I made one choice that has helped immensely in preventing this project from decaying. It still has 100% code coverage, which means I have extreme confidence in every single change to the codebase.
I [blogged](https://connortumbleson.com/2023/03/13/letting-dependabot-merge/) about this before, but the main gain I've noticed with this project is it doesn't matter how long passes between working on it. I'm confident when I sit down it'll have the latest tools and still work. When I have [un-merged](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/952?ref=connortumbleson.com) pull requests I know exactly where I can start working.
---
So when I swapped to a different private PHP project that decayed a bit - I hit some extreme challenges.
It seemed using a latest version of Composer just didn't work with this project due to some namespace issues on some dependencies. So before I could even work on the thing I wanted to - it took a bit to get the project running again.
Ecosystems don't sleep and always move forward. Sometimes at the cost of breaking tools/programs that once worked in them. This is normal behavior, but it has two different extremes.
Python 2 to 3 was a horrible upgrade path. It fractured the community between Python 2 and Python 3 and took almost a decade to finally resolve itself.
Golang on the flip side has pledged to avoid breaking changes at all costs. They have an immense amount of automated tests that attempt to compile some of the earliest programs. This might grow to become some "cruft" over time, but the model of not breaking user-land is very much appreciated.
Thankfully for the project above I was only looking at a few hours of work and I had the CI/CD pipeline working again with fresh deploys. This project is far from getting to 100% code coverage to enable some automation like Leaf, but at least it deploys now.
---
I then started working on an older Android application that is privately shared between a few folks. Peeking the commits it had been over a year since a commit had came in, so I gave it a shot to build to my device.
```
* What went wrong:
Could not compile settings file 'settings.gradle'.
> startup failed:
General error during semantic analysis: Unsupported class file major version 61
```
Of course my Java version was too new and Gradle refused to work on it. Upgrading Gradle without upgrading Gradle Tools led to a new issue, so then I had an upgrade going in progress for that.
That upgrade led to a requirement to adapt some build files, which led to a requirement to target modern SDK versions. It seems like the easier path would have been to downgrade to Java 8 or 11.
It seems the Android ecosystem decays fast and it's in your best interest to stay in line with the SDK changes and Gradle upgrades.
---
Finally I was working on another PHP project that did a partial transition between Gitlab and Github where the CD system was on Gitlab, but the CI system on Github.
This project was still using Bootstrap 4 which after the last few years of project development was pretty dated. However, instead of reaching for Tailwind I just did the upgrade to Bootstrap 5.
It went pretty well and outside of renaming a ton of classes from "left" to "start" and "right" to "end" - it looked great. I think this upgrade went pretty easy because the project was sitting at roughly 70% code coverage. This meant I had a good amount of confidence that nothing was broken after all these upgrades.
---
All in all - the drive to work on some hobby projects is back and I'm knocking out some bugs and upgrades.
### Travel Blog: Charleston, WV
URL: https://connortumbleson.com/2023/08/21/travel-blog-charleston-wv/
Last updated: 2025-02-04T11:42:32.000Z
A little over 4 months ago I traveled to [Jacksonville Florida](https://connortumbleson.com/2023/04/24/travel-blog-jacksonville/) for an Ingress anomaly and this time again I set off to Charleston in West Virginia to do it again.
What I learned really quickly is Charleston West Virginia is the rarely traveled or visited Charleston. My flight information and hotel research kept ending up in Charleston South Carolina. I'm curious if the organizers of this event (Niantic) accidentally meant the other.
Either way - the 4am Friday morning arose and this time it was off to the airport. My car situation is still odd, so it was time for an Uber. I grabbed a photo of the house will standing in darkness to begin this journey.
4am - August 18, 2023
The airport was insanely packed for 4am - the most I'd ever seen it. Turns out it was the huge crowd of Beyonce concert goers on the way home. Once I was settled and at the gate - it was one short flight to Charlotte and then another short flight into Charleston.
This was the first time for an Ingress anomaly that I was doing connections to travel. Normally I'm only driving or taking directs when it comes to these events.
It was the last flight that destroyed my body in terms of motion sickness. From the instant we boarded this tiny plane - I knew it was going to hurt. From the start of the flight and the immediate turbulence and crazy up/down behavior of the flight. My stomach and body was in immediate pain.
Felt sorry for the guy next to me as I pointed cool air onto myself and just tried to keep a solid amount of breathing going on. It was the longest 1 hour and 11 minutes on a plane ever. As I write this post here - I haven't even done that flight on the way home yet.
Hopefully I learned a lesson though. Seeing how it was very early - I had not eaten yet and flying on an empty stomach is bad. I purchased some motion sickness tablets, which I've never tried before. Hopefully when I board at 6pm on Sunday to head home - the full stomach and pills will make this first flight painless.
Landing Charleston and seeing just mountains everywhere and little town on the river was pretty cool to see. The airport being minutes from downtown and an Uber drive only 4 minutes was great to see. I was in the city and checked into my hotel before 10am on that Friday.
So I went exploring and I quickly realized how kinda empty this city was. Whether it was noon on a Friday or Friday night or Saturday night - I rarely saw cars or people. I guess a town of 48,000 people is pretty small when I compare to my hometown of \~400,000.
I visited a regular ole sports bar and it was enough just plain average food to get my first meal in me of the day. I had to eat way slower than I wanted because my body was still recovering from the most turbulent flight of my life.
Once I had some food in me and a few hours had passed. I was feeling normal and great again. I packed up my bag and re-organized some items and walked the 2km wide downtown in a large loop.
It was clear this city was mixed between highly cared for and just pure abandonment. Some streets and buildings were boarded up with shattered windows and crumbled concrete while others had immaculate lawns with high rise fences (which was probably some federal building).
During this walk too I was realizing that my chances for most of the restaurants was going to be Friday only. It seemed a good portion of the establishments downtown were closed on Saturday and Sunday.
It must be the true visitors of the downtown is the working class so when the weekend arrived my options for food dwindled.
The mornings were cool and crisp which made a little workout Saturday morning wonderful. I wasn't competing with the immense Florida humidity and instead had a run that was a bit chilly till my body warmed up.
The afternoon was hot though with not much shade to be found while wandering through the city. My body is burnt now even though I was applying sunscreen pretty often.
As Sunday came it was a slow morning to kill a hangover and pack up the belongings. I'd be in the city till 5pm, but had to be out of the hotel by 10am. So I plotted some food places to hit and went off exploring again. This time a few gins and exploring and the day was quickly over.
I took my pills and went for the airport to board a plane from the tarmac.
Unfortunately I'll be landing back in Tampa before I'll have time to finish this post, so either the pills worked or I had a stressful amount of flights back home.
EDIT: The flight home was way easier than the travel there. I attribute that to a few things - one being that the flight home was way shorter than the visit there. Cutting 30 minutes off a flight doesn't really make sense to me in terms of how it works in air travel, but I wasn't complaining.
Secondly I was traveling on a full stomach which felt so much better when the turbulence hit. So lesson learned - pop some pills and eat some food before flying.
### The dangerous corium
URL: https://connortumbleson.com/2023/08/14/the-dangerous-corium/
Last updated: 2025-02-04T11:42:32.000Z
[Churning molten pool of uranium oxide at 2000°C](https://www.youtube.com/watch?v=gMnDz66-D7w&ref=connortumbleson.com)
Every so often I stumble upon some nuclear research which seemingly more than not points to corium. A material that we generically call any melted mixture of nuclear fuel, control rods and fission by-products.
As that sounds - it isn't good and normally is only created when a reactor meltdown occurs. This material can hit some really insane temperatures depending on the materials in play. When corium is first created and in the melted liquid-like form it can reach almost 5,070 degrees Fahrenheit. Of course that temperature doesn't come near what the Large Hadron Collider can do, but that is a dangerous amount of heat.
1996 photo of Chernobyl "Elephants Foot" by Artur Korneyev
Take this famous photo above where Chernobyl's remaining sludge of radioactive mess that melted out of its containment. This material in the moment was so dangerous you'd probably die in just a few minutes of standing in range of it.
In the case of above - 10 years had passed since the incident and even then the photograph was developed with oddities from the lingering radiation.
Its tough to really imagine the pure strength and power of this corium. Imagine the heat needed for some liquid metal contents to eat through concrete falling further and further down with gravity.
Like most kids probably thought when they imagined digging a hole through the Earth towards China - it has a name "China syndrome" in this nuclear world. It was a metaphorical description of a melted nuclear core melting all the way through the Earth - clearly which couldn't happen in reality.
So how often have we accidentally produced corium?
**Three Mile Island**
- The slow partial meltdown of the core left some corium at the bottom of the reactor.
**Chernobyl**
- As explained above, a huge amount of corium dripped under the reactor to the bottom of the steam corridor.
**Fukushima Daiichi**
- Unit's 2 has a pool of corium from the meltdown it received.
- Possibly Unit 1 & 3 does as well, but this disaster is too recent for all the details.
This might explain why corium is barely understood - we only see it when man-made nuclear creations hit the absolute pinnacle of failure. Even when we do they are all completely different in terms of the chemical compositions.
Its like when people made "suicide drinks" which were just a combination of every soda on the machine. Sure every single one of these created was different, but they are all called the same.
I believe we just needed a word that meant melted nuclear reactor waste and corium was it. Such a short word that carries a huge amount of danger behind it. Corium isn't just dangerous as it melts around - it stays dangerous for centuries.
Since Fukushima incident occurred quite recently we have the power of some new technology to study and investigate this corium. Not only that, but the repair effort is extremely [documented online](https://www.tepco.co.jp/en/insidefukushimadaiichi/index-e.html?ref=connortumbleson.com).
This is what led to the video demonstration of robotic tools working to test if extraction of the corium was even possible.
So corium is a scary thing to produce or get near. The pure ionizing radiation it emits will break down any bonds in its path whether its human flesh or a collection of atoms and molecules. Only a long stint of time will slowly stabilize or degrade the corium - we just don't know exactly when or how that occurs.
Initial research was the Chernobyl accident corium would simply degrade into a powder. While that wasn't accurate the corium is cracking and weakening in every case we've seen so far.
So while animations make corium seem like a little red melting mush, we know the real power and danger it contains. Hopefully that will be the last corium accidentally produced we will ever see.
### The Disappointment Islands
URL: https://connortumbleson.com/2023/08/07/the-disappointment-islands/
Last updated: 2025-02-04T11:42:32.000Z
[Photo by ](https://goo.gl/maps/uCYL1UHCJHWXMjQaA?ref=connortumbleson.com)[Luciano Ragivaru](https://maps.google.com/maps/contrib/102304605576849068840?ref=connortumbleson.com) (2021)
A bit ago I was looking at the California coast and I kept moving in Google Maps further out into the vast ocean. I stumbled upon a little strip of water that was labeled "*Disappointment Islands*" and I thought it had to be typo. It was quite an odd name for some islands, but I continued on interested in these islands.
When you zoom out these islands don't even exist on the lower zoom levels. It didn't take long to learn that the islands I stumbled upon were part of the 100+ islands part of French Polynesia. It must be where I'm geographically located, but I feel like I learned nothing about these islands in school.
[Orange Smile Map of French Polynesia](https://www.orangesmile.com/travelguide/french-polynesia/country-maps.htm?ref=connortumbleson.com)
A few of these islands are immensely popular tourist locations and look like locations out of those fancy techno beach music videos. Places that make our Earth look so beautiful without the huge amounts of industrialization.
I'm more interested in the islands so small that require you first land on a larger island, then take a boat/flight to a smaller island.
That would be some of the 3 islands that make up the Disappointment Islands:
- Tepoto
- Napuka
- Puka-Puka
The population respectively
- Tepoto with 61 residents in 2012, with 54 in 2002.
- Napuka with 234 residents in 2017, but 257 in 2002.
- Puka-Puka with 163 residents in 2017, but 197 in 2002.
With exception of Tepoto it seems these other islands have lost roughly 30 residents a piece over \~15 years. These are tiny little communities when you think that your own neighborhood sits above 300 people.
Could it be all these islands are classified as arid? Thus not being the best place for humans to reside? I remember enough of my old classes to remember that arid means basically no water available. Paired with these islands surrounded by salt water and right on the equator probably makes a hot climate.
Now it makes sense after a bit of research of the name of these islands. Way back in 1520 when Magellan went on his expedition - he stumbled upon some of these islands. He couldn't find a water source there to replenish from, so called them *Islas Infortunadas* which translated over the years to Unfortunate Islands then Disappointment Islands.
So how does a random guy living in Tampa Florida find modern photos or information about these islands? Off to Google we go.
We can find via [Richard Konn](https://www.google.com/maps/contrib/107804951558169753807?ref=connortumbleson.com) that he traveled there in March of 2011\. Based on his photos watermarked it looks like they weren't made with a cellphone camera.
Its quite difficult to find information about this island, because most searched will give you results about Pukapuka, which is part of the Cook Islands.
Google Maps wasn't much help here presumably because the residents of these islands don't have the technology to add information for the buildings for Google to index. We must rely on the rare visitors to these islands who wish to document this journey and share it for the world to see.
Many times in this research I saw this one user who had reviews for all these islands. I was quite excited when I viewed their profile to see pins everywhere.
However, every single review or piece of information said:
> If you are reading this review, then you are bored and will need to do something like call relatives or talk to friends.
So yep I got pranked. I wonder what led this user to making reviews on these near hidden islands off the worlds to make useless comments on them. So I reported their profile and every single review that was off-topic to feel better for that user wasting my time.
So if we pop back over to NASA - we can find satellite imagery for all 3 of these islands.
[Tepoto](https://en.wikipedia.org/wiki/Tepoto%5F%28North%29?ref=connortumbleson.com), [Napuka](https://en.wikipedia.org/wiki/Napuka?ref=connortumbleson.com) and [Puka-Puka](https://en.wikipedia.org/wiki/Puka-Puka?ref=connortumbleson.com)
Such tiny little islands and I went on a journey on viewing information on each one. Once again I hit this odd behavior where every single review looked to be some joke. Reviews and images of memes or completely unrelated images uploaded to the various buildings on each island.
It takes some effort, but then you find a real person. This time I stumbled upon [Jacques Hoiore](https://www.google.com/maps/contrib/117495308394504121828/photos/@-13.2300124,-144.6552515,6z/data=!4m3!8m2!3m1!1e1?entry=ttu&ref=connortumbleson.com) with some very recent reviews! This user looks very legitimate with photos all over the islands.
[https://www.google.com/maps/contrib/117495308394504121828/photos](https://www.google.com/maps/contrib/117495308394504121828/photos/@-15.6455534,-147.5198117,6.87z/data=!4m3!8m2!3m1!1e1?entry=ttu&ref=connortumbleson.com)
This person has donated and contributed over 500 images that have been viewed over 2 million times of all these islands. I'm not sure how large the market is for people looking for images on these really isolated islands, but this user has a large collection of I presume information and images.
If I can find a blog called "[Have Pension - Will Travel](https://havepension-willtravel.com/?ref=connortumbleson.com)" documenting reviews and destinations of the Cook Islands, maybe there is a helpful market here of providing details of these islands. That user might consider a passive revenue angle of providing all that information for researchers online.
So I went on this journey just from curiosity of some isolated island and left with confusion on why people put fake reviews on locations. Thankfully, discovering a few interesting people who travel to all corners of the world while doing so.
### Invalid CEN header
URL: https://connortumbleson.com/2023/07/31/invalid-cen-header/
Last updated: 2025-02-04T11:42:33.000Z
On July 17, 2023 I released [Apktool 2.8.0](https://connortumbleson.com/2023/07/17/apktool-v2-8-0-released/) which was a very large release that unfortunately carried some regressions with it. Little did I know that on July 19 only a few days later I would be contending with a stressful bug (feature?) from OpenJDK that took the builds down for days.
---
So to start this story off - one morning I noticed wide spread build failures on the test suite between various platforms and versions of Java. When the dust settled it appeared Apktool was failing on:
- JDK 11
- JDK 17
- JDK 20
With an exception that looked like this.
```
Caused by:
java.util.zip.ZipException: Invalid CEN header (invalid zip64 extra data field size)
at java.base/java.util.zip.ZipFile$Source.zerror(ZipFile.java:1728)
at java.base/java.util.zip.ZipFile$Source.checkExtraFields(ZipFile.java:1261)
at java.base/java.util.zip.ZipFile$Source.checkAndAddEntry(ZipFile.java:1212)
at java.base/java.util.zip.ZipFile$Source.initCEN(ZipFile.java:1667)
at java.base/java.util.zip.ZipFile$Source.(ZipFile.java:1445)
at java.base/java.util.zip.ZipFile$Source.get(ZipFile.java:1407)
at java.base/java.util.zip.ZipFile$CleanableResource.(ZipFile.java:716)
at java.base/java.util.zip.ZipFile.(ZipFile.java:250)
at java.base/java.util.zip.ZipFile.(ZipFile.java:179)
at java.base/java.util.zip.ZipFile.(ZipFile.java:193)
at brut.androlib.res.Framework.installFramework(Framework.java:57)
```
It is pretty easy to look back at this with all the knowledge and identify the variable that must have changed, but I had just merged a few changes for Gradle and GitHub Actions so my first inclination was something at fault for one of those.
A bit of research turned up nothing for [gradle-build-action 2.6.1](https://github.com/gradle/gradle-build-action/releases/tag/v2.6.1?ref=connortumbleson.com) or [Gradle 8.2.1](https://github.com/gradle/gradle/releases/tag/v8.2.1?ref=connortumbleson.com) so I was off to GitHub Actions.
Image updates between July 17 - July 19
So I knew if builds worked on July 17, but failed on July 19 I went looking for container image updates between them. This only turned up changes for Ubuntu and Windows so it could not have been the flaw as Mac was failing as well.
At this point I figured a Java update must have occurred and stumbled unto this [Consolidated JDK 17 Release Notes](https://www.oracle.com/java/technologies/javase/17all-relnotes.html?ref=connortumbleson.com) page. However, I was looking at the OpenJDK page and my build scripts were pointing to the Azul Zulu distribution.
I'm not sure when it happened, but there are so many versions of Java now I struggled to understand if looking at an OpenJDK change-log was the same thing as my Zulu distribution. Turns out this just cluttered my research as I stumbled upon nearly 10 different distributions and I was considering testing them all on GitHub.
So I just re-ran some really old Apktool builds that were like 3 months old and they failed as well. So ultimately I had eliminated a few variables, but ran out of time and left for work.
[https://twitter.com/iBotPeaches/status/1681740291978526720](https://twitter.com/iBotPeaches/status/1681740291978526720?ref=connortumbleson.com)
So at some point during the day I put out a tweet pointing to my open issue and hoped the Internet would help. This was the way to go as it didn't take more than 24 hours for a [response](https://github.com/iBotPeaches/Apktool/issues/3174?ref=connortumbleson.com#issuecomment-1642697602) on that thread that pinpointed the issue.
> I was able to reproduce the issue locally. It is indeed caused by JDK 17.0.8.
> The following is mentioned [in the changelog](https://www.oracle.com/java/technologies/javase/17all-relnotes.html?ref=connortumbleson.com#JDK-8302483):
> Improved ZIP64 Extra Field Validation (JDK-8302483 (not public))
> `java.util.zip.ZipFile` has been updated to provide additional validation of ZIP64 extra fields when opening a ZIP file. This validation may be disabled by setting the system property `jdk.util.zip.disableZip64ExtraFieldValidation` to true.
So thanks to [evowizz](https://github.com/evowizz?ref=connortumbleson.com) that was the tip I needed to identify the issue and fixed our build scripts and got the [Apktool 2.8.1](https://connortumbleson.com/2023/07/22/apktool-v2-8-1-released/) out into the wild or so I thought.
It didn't take too long though and [reports](https://github.com/iBotPeaches/Apktool/issues/3198?ref=connortumbleson.com) in the [wild](https://github.com/iBotPeaches/Apktool/issues/3170?ref=connortumbleson.com) were showing that this was not resolved. That didn't make sense to me because I did exactly what the description of the above change said.
```java
System.setProperty("jdk.util.zip.disableZip64ExtraFieldValidation", "true");
```
I was pretty mad at this point because the change (JDK-8302483) that caused this was presumably a security measure that I knew nothing about, back-ported and released to various versions.
- [Java 11.0.20](https://www.oracle.com/java/technologies/javase/11-0-20-relnotes.html?ref=connortumbleson.com#R11%5F0%5F20)
- [Java 17.0.8](https://www.oracle.com/java/technologies/javase/17-0-8-relnotes.html?ref=connortumbleson.com#R17%5F0%5F8)
- [Java 20.0.2](https://www.oracle.com/java/technologies/javase/20-0-2-relnotes.html?ref=connortumbleson.com#R20%5F0%5F2)
So I went digging and found the [commit](https://github.com/openjdk/jdk/commit/fff7e1ad00be07810bf948b8a6f94e83c435fa1f?ref=connortumbleson.com) that led to this issue.
```
From fff7e1ad00be07810bf948b8a6f94e83c435fa1f Mon Sep 17 00:00:00 2001
From: Lance xxx
Date: Wed, 22 Mar 2023 14:45:15 +0000
Subject: [PATCH] 8302483: Enhance ZIP performance
Reviewed-by: ahgross, alanb, rhalade, coffeys
---
.../share/classes/java/util/zip/ZipFile.java | 131 +++++++++++++++++-
.../classes/jdk/nio/zipfs/ZipFileSystem.java | 53 ++++++-
test/jdk/java/util/zip/TestExtraTime.java | 13 +-
.../util/zip/ZipFile/CorruptedZipFiles.java | 4 +-
4 files changed, 194 insertions(+), 7 deletions(-)
```
The commit description much like other security precautions is hiding in plain sight as this is not a performance boost. It is a further validation of the Zip specification.
I was quite sad when I took my error message and searched it.
```
Invalid CEN header (invalid zip64 extra data field size)
```
I had 5 results of that exact string in this commit so I couldn't fully isolate which path of code I was failing. I was even further confused because the applications it was failing on were just test sample applications I [pulled](https://github.com/aosp-mirror/platform%5Fframeworks%5Fbase/tree/main/tests/SharedLibrary?ref=connortumbleson.com) from The Android Open Source Project. I was very confused at this point because the zip64 specification was over [20 years old](https://en.wikipedia.org/wiki/ZIP%5F%28file%5Fformat%29?ref=connortumbleson.com#Version%5Fhistory) and my sample applications didn't feel like applications with a 64-bit format nor a malformed one.
I started digging into the commit above more and got a bit sad. We can easily see we had 2 test file changes and 2 non-test file changes, but how did we test nearly 200 new lines of code in 17 line changes in the test suite?
In my quick research - it wasn't. I couldn't find additions to the test suite that asserted the logic of the new functions - `checkExtraFields` and `checkZip64ExtraFieldValues`
This bugged me because this author when peeking some history had good behavior of the last changes to the ZipFile class with commits like:
```
From f0995abe62b81cf9c96cc07caa0ac27d00c96ff1 Mon Sep 17 00:00:00 2001
From: Lance xxx
Date: Mon, 7 Mar 2022 16:10:31 +0000
Subject: [PATCH] 8280404: Unexpected exception thrown when CEN file entry
comment length is not valid
Reviewed-by: alanb
---
.../share/classes/java/util/zip/ZipFile.java | 11 +-
.../zip/ZipFile/InvalidCommentLengthTest.java | 345 ++++++++++++++++++
2 files changed, 355 insertions(+), 1 deletion(-)
create mode 100644 test/jdk/java/util/zip/ZipFile/InvalidCommentLengthTest.java
```
[https://github.com/openjdk/jdk/commit/f0995abe62b81cf9c96cc07caa0ac27d00c96ff1.patch](https://github.com/openjdk/jdk/commit/f0995abe62b81cf9c96cc07caa0ac27d00c96ff1.patch?ref=connortumbleson.com)
```
From a020b6ba8f38fe85fb26972a51e4c1068408b1c1 Mon Sep 17 00:00:00 2001
From: Lance xxx
Date: Wed, 23 Feb 2022 16:56:50 +0000
Subject: [PATCH] 8280409: JarFile::getInputStream can fail with NPE accessing
ze.getName()
Reviewed-by: mullan, alanb
---
.../share/classes/java/util/jar/JarFile.java | 33 +-
.../share/classes/java/util/zip/ZipFile.java | 47 +-
.../zip/ZipFile/GetInputStreamNPETest.java | 1055 +++++++++++++++++
3 files changed, 1103 insertions(+), 32 deletions(-)
create mode 100644 test/jdk/java/util/zip/ZipFile/GetInputStreamNPETest.java
```
[https://github.com/openjdk/jdk/commit/a020b6ba8f38fe85fb26972a51e4c1068408b1c1.patch](https://github.com/openjdk/jdk/commit/a020b6ba8f38fe85fb26972a51e4c1068408b1c1.patch?ref=connortumbleson.com)
So I was pretty confused. The last few commits to the ZipClass had an immense amount of tests in comparison to code changes. We can see above sometimes 10x the amount of test logic for a tiny amount of logic.
However, in the case I was dealing with now I was surprised to see less than 20 code change lines in the test suite for over 200 lines of core zip changes. Not to mention when the code being changed was sometimes 10+ years old it felt like something that should be tested heavily if modified.
However, I was dancing a very toxic line with those thoughts as I contribute nothing to Java and simply leverage it. So I shouldn't sway into a toxic realm where I start assigning blame - I should just help out and see if this was intended. Since I was seriously doubting that 6 of my sample applications were violating some specification.
So I googled how to report a Java bug and landed on [Oracle's site](https://bugreport.java.com/bugreport/?ref=connortumbleson.com). Though I knew I was using OpenJDK so that didn't seem like the place to go. I started wasting way too much time and it [appeared](https://wiki.openjdk.org/display/OpenJFX/Submitting+a+Bug+Report?ref=connortumbleson.com) some little nobody like me couldn't just report a bug to OpenJDK.
So then I started researching more things and apparently StackOverflow let me know that I should report a bug into Oracle's database and if they accept it - they'll [assign](https://stackoverflow.com/questions/29379425/where-to-report-issues-of-openjdk-when-youre-not-a-openjdk-developer?ref=connortumbleson.com) it into both OpenJDK and Oracles database.
Attempting to submit a bug stressed me out. There was no way I could sit down and create a code sample that replicated an entire zip header of an Android application to create a failing test case.
So while I was debating that - the wonderful guys over at JADX had encountered the same issue and investigated it much further than I did. They took a more terse approach and dropped a [comment](https://github.com/iBotPeaches/Apktool/issues/3174?ref=connortumbleson.com#issuecomment-1653200079) to me of:
> The Java developers were so "intelligent" to check this property at load-time of `java.util.zip.ZipFile` and copy it's value into a private static field:
> `private static final boolean disableZip64ExtraFieldValidation =
> GetBooleanAction.privilegedGetProperty("jdk.util.zip.disableZip64ExtraFieldValidation");`
> As the Java class loaders use ZIPFile class to load the Jar files from class path, ZipFile class is loaded long before any user created class respectively the main class is loaded. Therefore I don't see a way how a call to `System.setProperty("jdk.util.zip.disableZip64ExtraFieldValidation", "true");` will ever have any effect in a Java program. From my perspective the only way to set this property is from "outside", thus on the java command-line.
So this made sense now why my fix wasn't working. By the time Apktool's code was running - the zip class was already invoked via the class loader.
So now my only resolution was instructing all consumers of Apktool to adjust the process of how they invoke the java file or grab an updated helper script.
So now instead of `java -jar apktool.jar`, folks had to do `java -Djdk.util.zip.disableZip64ExtraFieldValidation=true -jar apktool.jar`
This must be some real urgent vulnerability for this to be not public and patched everywhere in what seems like a rushed approach. Thankfully since its a week or so later Red Hat has a bit more description of what this vulnerability was.
> OpenJDK: ZIP file parsing infinite loop (8302483) ([CVE-2023-22036](https://www.suse.com/security/cve/CVE-2023-22036.html?ref=connortumbleson.com))
Turns out we (Apktool) weren't alone in this patch causing some issues. Looking at the CVE and fix - there is no way any of the Apktool samples are malformed applications that cause infinite looping and I doubt all of the below affected projects are that as well.
- [Chromium broke and included the workaround.](https://chromium-review.googlesource.com/c/chromium/src/+/4705883?ref=connortumbleson.com)
- [JADX broke](https://github.com/skylot/jadx/issues/1962?ref=connortumbleson.com)
- [OFX4j broke](https://github.com/stoicflame/ofx4j/issues/71?ref=connortumbleson.com)
- [LifeRay broke](https://liferay.dev/blogs/-/blogs/important-jdk-11-0-20-notice?ref=connortumbleson.com)
So I was stressing out and just gave up on this - went to the OpenJDK commit log and made a comment.
[https://github.com/openjdk/jdk/commit/fff7e1ad00be07810bf948b8a6f94e83c435fa1f#r122903240](https://github.com/openjdk/jdk/commit/fff7e1ad00be07810bf948b8a6f94e83c435fa1f?ref=connortumbleson.com#r122903240)
and then a bot came in and blew out my comment with:
At this point - I gave up. I'm not trying to report a regression anymore. If Chromium was affected and corporations a lot larger than my single person - I'll let them dig into this and look for fixes in the next Java releases.
Hopefully by the time Apktool 2.8.2 comes out this will be resolved as I'm not looking forward to stacking properties onto the invocation of Java.
UPDATE (Sept 5, 2023)
It seems that we've discovered many tools of the past have been generating zip files against the specification. This increased validation has caught these mistakes, so a [new JDK pull request](https://github.com/openjdk/jdk/pull/15273?ref=connortumbleson.com) went up to adapt this validation to be a bit less strict while still keeping the purpose of the increased validation.
### 2023 Tour de France
URL: https://connortumbleson.com/2023/07/24/2023-tour-de-france/
Last updated: 2025-08-16T10:31:14.000Z
[https://www.letour.fr/en/stage-21/image-gallery](https://www.letour.fr/en/stage-21/image-gallery?ref=connortumbleson.com)
On July 23, 2023 the Tour De France ended again. This time the winner stayed the same with Jonas Vingegaard of Jumbo-Visma reinforcing that he is the best rider out there beating Tadej by almost 8 minutes.
Before the tour started though it didn't seem like too many teams had General Classification (Yellow Jersey) goals. I could only really count a few people that looked like serious contenders for the jersey.
- Jonas from Jumbo-Visma
- Tadej from UAE Team Emirates
- Pidcock from Ineos Grenadiers
- Hindley from Bora Hansgrohe
It was great to see Mark Cavendish coming back for his presumed last tour. Tied with the most stage wins everyone would be waiting on edge for the stage win to beat the record. However, each sprint he tried Jasper Philipsen got the win and the unfortunate stage 8 hit where Mark crashed out and left the tour - the record would remain tied.
The green jersey this time was earned by Jasper Philipsen with his explosive technique of sprinting, but I learned after multiple occurrences through the tour - hes a bit of a bully. Many times leaving his line or pushing riders into the wall to solidify his victory.
The white jersey will be forever with Tadej Podacar until he ages out of that category which will be the next tour. There was almost no fear of Tadej ever losing that white jersey during this year.
The Polka Dot jersey much like every tour bounced around to many hands finally landing on 20th stage to Giulio Ciccone. It was a bit refreshing to have someone intentionally targeting the jersey and winning it. What seemed to happen year after year was the GC winner winning the Polka Dot just from a few mountain stage wins.
---
[https://www.letour.fr/en/stage-1/image-gallery](https://www.letour.fr/en/stage-1/image-gallery?ref=connortumbleson.com)
Stage 1 had such an insane pace with breakaways occurring towards the end. Such a unique finish with two brothers on different teams competing and sprinting for the finish. This time Adam Yates of UAE taking the win and first yellow jersey.
[https://www.letour.fr/en/stage-3/image-gallery](https://www.letour.fr/en/stage-3/image-gallery?ref=connortumbleson.com)
Stage 3 had the sprinters going at it and there appeared to be what looked like some line breaking, which caused nearly a 20 minute delay in announcing the winner. In my personal opinion it did look like Jasper above broke his line putting another into a path with the barrier. However, after a ton of waiting - Jasper was announced the winner.
[https://www.letour.fr/en/stage-5/image-gallery](https://www.letour.fr/en/stage-5/image-gallery?ref=connortumbleson.com)
Stage 5 had some excitement with Jai Hindley taking the stage and the yellow jersey. This really shook things up with all the contenders falling into various places from 2nd to 7th.
[https://www.letour.fr/en/stage-6/image-gallery](https://www.letour.fr/en/stage-6/image-gallery?ref=connortumbleson.com)
Stage 6 had Tadej taking his 10th stage win and stealing back time on his goal to take the yellow jersey. This was the first of many battles where it seemed like the only competitors on the road were Jonas and Tadej.
[https://www.letour.fr/en/stage-7/image-gallery](https://www.letour.fr/en/stage-7/image-gallery?ref=connortumbleson.com)
Stage 7 would let the sprinters battle it out, but it was interesting to watch the dynamic of mind games between UAE and Jumbo as the gap between Tadej and Jonas continued to either stay the same or shorten. At this point Tadej was only down 25 seconds to yellow jersey Jonas.
[https://www.letour.fr/en/stage-9/image-gallery](https://www.letour.fr/en/stage-9/image-gallery?ref=connortumbleson.com)
Stage 9 had a massive summit finish so all expected a battle and one surely occurred. Tadej for the first time in days gained some time back and was only sitting 17 seconds away from the yellow. The Polka Dot riders battled it out to the top of the mountain with Michael Woods taking the stage.
[https://www.letour.fr/en/stage-12/image-gallery](https://www.letour.fr/en/stage-12/image-gallery?ref=connortumbleson.com)
Stage 12 had Cofidis winning another stage, which was quite odd as they were on such a bad luck streak for the past few years. So winning the 2nd and now 12th stage was amazing for them. The top two places in the yellow didn't move, but the remaining top ten were constantly shifting places.
[https://www.letour.fr/en/stage-14/image-gallery](https://www.letour.fr/en/stage-14/image-gallery?ref=connortumbleson.com)
Stage 14 had some tough climbs and was another journey of the breakaway getting away, but this time an interesting group of riders. At one point during the last few kilometers the group was 5 riders in the top ten. This was an intense race with Tadej/Jonas neck and neck with no time change between them.
[https://www.letour.fr/en/stage-16/image-gallery](https://www.letour.fr/en/stage-16/image-gallery?ref=connortumbleson.com)
Stage 16 was our one and only time trial and it delivered. Wout van Aert went 3rd to last and set the best time, but as Tadej was racing he was on pace to beat Wout's time by over a minute. This was insane as it looked like Tadej was going to blow the 10 second gap out of the water.
However, Jonas kicked off a few minutes later and appeared to be doing even better than Tadej on every single kilometer. It seemed originally that Tadej was going to take the yellow, but Jonas had another plan. He demolished the competition putting over a minute back onto to Tadej.
[https://www.letour.fr/en/stage-17/image-gallery](https://www.letour.fr/en/stage-17/image-gallery?ref=connortumbleson.com)
Stage 17 was basically the end of the tour for the yellow jersey competition. It was a sad sight to see for those following Tadej as he cracked on the journey to the summit while Jonas seemed to have excelled. Tadej fell behind with his shirt unzipped losing to Jonas dropping a large 5+ minutes. Jonas was moving up the mountain at insane speeds but couldn't catch the breakaway of Felix Gall who took the stage.
[https://www.letour.fr/en/stage-20/image-gallery](https://www.letour.fr/en/stage-20/image-gallery?ref=connortumbleson.com)
Stage 20 was the last tough stage before the trip into Paris. It once again had an immense battle between Tadej and Jonas and showed that Tadej felt normal again. He won the stage by just a few meters against Felix Gall and Jonas Vingegaard. He had no chance of coming back at this point, which is maybe what released the pressure and allowed him to just race.
[https://www.letour.fr/en/stage-21/image-gallery](https://www.letour.fr/en/stage-21/image-gallery?ref=connortumbleson.com)
Stage 21 was on the cobbles and the famous 8 laps around Paris. This was an insanely fast stage which started having rainfall with 2 laps to go. The Tour organization made an announcement that times would be counted on the 2nd to last lap so the sprinters could go all out on the final lap without a chance of harm to the GC riders. This meant on the final lap that the yellow jersey and teammates calmly raced together on the way to finish line.
The real exciting battle was for the sprint at the end and it was great to see. Like we saw over the last 20 stages Jasper always had a bit of drama following his victories due to various reasons. This time we saw sprinters catch on to his style and try and block him in. All these battling between sprinters let the Bora rider on the top squeeze in the victory.
---
All in all - this tour was a building year I'm guessing. There weren't many competitors to the GC and many were retiring. This next year will be the real challenge with tons of riders coming back and teams switching up.
### Apktool v2.8.1 Released
URL: https://connortumbleson.com/2023/07/22/apktool-v2-8-1-released/
Last updated: 2025-02-04T11:42:33.000Z
Apktool v2.8.1 has been released! This release has been quickly released to cover some immediate regressions from v2.8.0 as well as patching a new LTS Java feature that affected parsing malformed zip headers.
A part of me expected that refactoring \~50% of the codebase would lead to some regressions, but not the ones or quantity we had.
Turns out we had no test coverage for the exact format of the `apktool.yml` meta file. Since the test suite decodes and assembles - they were generating a `apktool.yml` on the fly. So the only way this regression was noticed if you were using older `apktool.yml` files against the newest release. We do have [tests](https://github.com/iBotPeaches/Apktool/commit/ca07a0a56cd0ce3418151c8ddc296625f7200026?ref=connortumbleson.com) now to prevent this from happening again.
Next we had wide spread build failures on JDK 11 & 17 shortly after the release of v2.8.0 which became apparent with this crash.
```
java.util.zip.ZipException: Invalid CEN header (invalid zip64 extra data field size)
```
Turns out thanks to the research by [evowizz](https://github.com/iBotPeaches/Apktool/issues/3174?ref=connortumbleson.com#issuecomment-1642697602) \- a recent Java update affected some types of applications.
> Improved ZIP64 Extra Field Validation (JDK-8302483 (not public))
> java.util.zip.ZipFile has been updated to provide additional validation of ZIP64 extra fields when opening a ZIP file. This validation may be disabled by setting the system property `jdk.util.zip.disableZip64ExtraFieldValidation` to true.
So we set some system properties to opt out of this protection.
---
**This release had 17 commits by 4 people and 1 robot**
- Connor Tumbleson (iBotPeaches) - 11 commits
- Igor Eisberg - 3 commits
- ArjunaKumarMohanta - 1 commit
- Dependabot (BOT) - 1 commit
- sv99 - 1 commit
---
# Changes since 2.8.0
- \[[#3177](https://github.com/iBotPeaches/Apktool/pull/3177?ref=connortumbleson.com)\] Add JDK 20 to test suite.
- \[[#3179](https://github.com/iBotPeaches/Apktool/pull/3179?ref=connortumbleson.com)\] Add `run` command for Gradle inline execution. (Thanks sv99)
- Fix links on usage output for new smali & apktool links.
- \[[#3165](https://github.com/iBotPeaches/Apktool/issues/3165?ref=connortumbleson.com)\] Fix Windows issue copying files that resolved to an empty filename.
- \[[#3170](https://github.com/iBotPeaches/Apktool/issues/3170?ref=connortumbleson.com), [#3174](https://github.com/iBotPeaches/Apktool/issues/3174?ref=connortumbleson.com)\] Fix Java restriction with ZIP64 extra field validation.
- \[[#3169](https://github.com/iBotPeaches/Apktool/issues/3169?ref=connortumbleson.com)\] Fix regression on `apktool.yml` property names.
- \[[#3182](https://github.com/iBotPeaches/Apktool/pull/3182?ref=connortumbleson.com)\] Fix regression on `minSdkVersion` value being blown out before setting into `apktool.yml`.
- \[[#3181](https://github.com/iBotPeaches/Apktool/issues/31810?ref=connortumbleson.com)\] Fix regression on inefficient reading of framework files during attribute parsing.
- \[[#3193](https://github.com/iBotPeaches/Apktool/pull/3193?ref=connortumbleson.com)\] Fix regression on decoding framework file with a tag. (Thanks IgorEisberg)
- \[[#3188](https://github.com/iBotPeaches/Apktool/pull/3188?ref=connortumbleson.com)\] Refactor descriptions on commands. (Thanks IgorEisberg)
- \[[#3151](https://github.com/iBotPeaches/Apktool/pull/3151?ref=connortumbleson.com)\] Upgrade `gradle/gradle-build-action` to `2.6.0`
- \[[#3141](https://github.com/iBotPeaches/Apktool/pull/3141?ref=connortumbleson.com)\] Upgrade to Gradle 8.2.1\. (Thanks ArjunaKumarMohanta)
## Notes
- Applications are becoming more and more difficult to build with aapt1, using the `--use-aapt2` flag during rebuild is a good test.
## Download
[Download Apktool 2.8.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.8.1.jar?ref=connortumbleson.com)
- [Apktool 2.8.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.8.1.jar?ref=connortumbleson.com)
- `c186ee0c87dbf197456cc010aeba99da` (md5)
- `7b4a8e1703e228d206db29644b71141687d8a111b55b039b08b02dfa443ab0f9` (sha256)
- Rename to `apktool.jar` and follow the [Instruction Guide](https://apktool.org/docs/install?ref=connortumbleson.com) if you need help.
- [2.8.1 Release Post](https://apktool.org/blog/apktool-2.8.1?ref=connortumbleson.com)
## Links
- [Project Site](https://apktool.org/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### Apktool v2.8.0 Released
URL: https://connortumbleson.com/2023/07/17/apktool-v2-8-0-released/
Last updated: 2025-02-04T11:42:34.000Z
Apktool v2.8.0 has been released! This release includes massive amounts of refactoring to the codebase to speed development on the never ending game of resource obfuscation.
Large changes you'll notice as a developer are:
- Remove `Androlib` for `ApkBuilder` and `ApkDecoder`
- Extract aapt/aapt2 into `AaptInvoker` class
- Refactored `ARSCDecoder` to support unified chunk loading
- Refactored `AXmlResourceParser` to leverage same chunk loading
- Smali is pulled from [Google](https://github.com/google/smali?ref=connortumbleson.com) now instead of [JesusFreke](https://github.com/jesusfreke/smali?ref=connortumbleson.com)
Large changes you'll notice as an end user are:
- Support for Upside Down Cake & Vanilla Ice Cream (API 34+)
- Enhance decoder for common obfuscation techniques
- Relax aapt failures that succeed in aapt2
- Fix crashing on common Meta applications
Changes you'll notice as a frequent user of the GitHub project:
- Features are tracked in [Discussions](https://github.com/iBotPeaches/Apktool/discussions/categories/ideas?ref=connortumbleson.com) now instead of the bug tracker.
- A new documentation website launched.
- [https://apktool.org](https://apktool.org/?ref=connortumbleson.com) is the new home for docs.
I'd like to thank all the contributors, but especially [sv99](https://github.com/sv99?ref=connortumbleson.com) for their effort in giving the code base a serious facelift. That effort gave me enough of a drive to spend some serious time on Apktool over the last month to finalize this release. I went into further details about this release and Apktool in general in yesterday's blog post.
---
**This release had 153 commits by 9 people and 1 robot**
- Connor Tumbleson (iBotPeaches) - 122 commits
- sv99 - 9 commits
- Slava Volkov - 8 commits
- Dependabot (BOT) - 6 commits
- ArjunaKumarMohanta - 3 commits
- AARON - 1 commit
- Crimson - 1 commit
- Igor Eisberg - 1 commit
- Marc Miltenberger - 1 commit
- jason.liao - 1 commit
---
# Changes since 2.7.0
- \[[#3041](https://github.com/iBotPeaches/Apktool/issues/3041?ref=connortumbleson.com)\] Add SDK U (API 34) Preview Support
- \[[#3115](https://github.com/iBotPeaches/Apktool/pull/3115?ref=connortumbleson.com)\] Add SDK V (API ?) Preview Support
- \[[#2976](https://github.com/iBotPeaches/Apktool/issues/2976?ref=connortumbleson.com)\] Add CI testing for Java versions 18 & 19
- \[[#2978](https://github.com/iBotPeaches/Apktool/issues/2978?ref=connortumbleson.com)\] Add support for parsing applications with config flag size > 8 (from 28).
- \[[#3070](https://github.com/iBotPeaches/Apktool/pull/3070?ref=connortumbleson.com)\] Add support for running apktool via gradle. (Thanks sv99)
- \[[#2980](https://github.com/iBotPeaches/Apktool/issues/2980?ref=connortumbleson.com)\] Add support for `0_resource_name_obfuscated`
- \[[#3113](https://github.com/iBotPeaches/Apktool/pull/3113?ref=connortumbleson.com)\] Add support for Upside Down Cake & Vanilla Ice Cream SDK Shorthand.
- Remove CI testing for Java versions: 9, 10, 12, 13, 14, 15 and 17.
- \[[#2998](https://github.com/iBotPeaches/Apktool/pull/2998?ref=connortumbleson.com)\] Fix issue parsing empty `resources.asrc`. (Thanks IgorEisberg)
- \[[#3008](https://github.com/iBotPeaches/Apktool/issues/3008?ref=connortumbleson.com)\] Fix issue with larger `apktool.yml` files.
- \[[#3030](https://github.com/iBotPeaches/Apktool/issues/3030?ref=connortumbleson.com)\] Fix issue with parsing `XML_TYPE_OVERLAY`.
- \[[#3071](https://github.com/iBotPeaches/Apktool/pull/3071?ref=connortumbleson.com)\] Fix issue with aapt/aapt2 in edge cases waiting 15 seconds for output. (Thanks sv99)
- \[[#3104](https://github.com/iBotPeaches/Apktool/issues/3104?ref=connortumbleson.com)\] Fix NPE when decoding namespace missing from string pool.
- \[[#2981](https://github.com/iBotPeaches/Apktool/issues/2981?ref=connortumbleson.com)\] Fix preference order when bogus values fill spring pool instead preferring res table.
- \[[#1927](https://github.com/iBotPeaches/Apktool/issues/1927?ref=connortumbleson.com), [#2484](https://github.com/iBotPeaches/Apktool/issues/2484?ref=connortumbleson.com)\] Fix assembly with aapt1 when duplicate bag items are detected.
- \[[#3133](https://github.com/iBotPeaches/Apktool/pull/3133?ref=connortumbleson.com)\] Fix config flag support for 64 byte header, adding `localeNumberingSystem`.
- \[[#3036](https://github.com/iBotPeaches/Apktool/issues/3036?ref=connortumbleson.com)\] Fix issue crashing out when reading entries past chunk end.
- \[[#3088](https://github.com/iBotPeaches/Apktool/pull/3088?ref=connortumbleson.com)\] Refactor `brut.androlib.err` to `brut.androlib.exceptions` for standard naming convention of Exceptions. (Thanks sv99)
- \[[#3091](https://github.com/iBotPeaches/Apktool/pull/3091?ref=connortumbleson.com)\] Refactor Build/Decode to work from common Config object. (Thanks sv99)
- \[[#3103](https://github.com/iBotPeaches/Apktool/pull/3103?ref=connortumbleson.com)\] Refactor into `ApkBuilder` and `ApkDecoder` instead of generic `Androlib`. (Thanks sv99)
- \[[#3105](https://github.com/iBotPeaches/Apktool/pull/3105?ref=connortumbleson.com)\] Refactor new class `Framework` to lessen responsibility of `AndrolibResources`. (Thanks sv99)
- \[[#3106](https://github.com/iBotPeaches/Apktool/pull/3106?ref=connortumbleson.com)\] Refactor `ApkDecoder` to split methods for `MetaInfo` towards `ResTable`. (Thanks sv99)
- \[[#3109](https://github.com/iBotPeaches/Apktool/pull/3109?ref=connortumbleson.com)\] Refactor `ApkDecoder` to introduce common methods for manifest and resource operations. (Thanks sv99)
- \[[#3114](https://github.com/iBotPeaches/Apktool/pull/3114?ref=connortumbleson.com)\] Refactor Gradle workflow into its own to cut down on unrelated CI failures.
- \[[#3116](https://github.com/iBotPeaches/Apktool/pull/3116?ref=connortumbleson.com)\] Refactor `*Decoders` to split child classes into own class files.
- \[[#3124](https://github.com/iBotPeaches/Apktool/pull/3124?ref=connortumbleson.com)\] Refactor classes to support new `ApkInvoker` class. (Thanks sv99)
- \[[#3119](https://github.com/iBotPeaches/Apktool/pull/3119?ref=connortumbleson.com)\] Upgrade `gradle/gradle-build-action` to `2.5.1`.
- \[[#3079](https://github.com/iBotPeaches/Apktool/pull/3079?ref=connortumbleson.com)\] Upgrade away from deprecated SnakeYAML constructors. (Thanks MarcMil)
- \[[#3055](https://github.com/iBotPeaches/Apktool/pull/3055?ref=connortumbleson.com)\] Upgrade codebase to use Java7 NIO library for IO. (Thanks sv99)
- \[[#3050](https://github.com/iBotPeaches/Apktool/issues/3050?ref=connortumbleson.com)\] Upgrade to smali/baksmali 3.0.3 and move to Google fork of it.
- Upgrade to Gradle 8.2 (Thanks ArjunaKumarMohanta)
- Upgrade `commons-io` to `2.13.0` from `2.11.0`
- Upgrade `guava` to `32.0.1-jre` from `31.0.1-jre`
- Upgrade `proguard_gradle` to `7.3.2` from `7.3.0`
- Upgrade `shadow` to `8.0.0` from `7.1.0`
## Notes
- Applications are becoming more and more difficult to build with aapt1, using the `--use-aapt2` flag during rebuild is a good test.
## Download
[Download Apktool 2.8.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.8.0.jar?ref=connortumbleson.com)
- [Apktool 2.8.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.8.0.jar?ref=connortumbleson.com)
- `aefd27becd2b97527c47e595bd22d8d2` (md5)
- `b331323ebf325d63e13375a6147915f9dac048f0f1f86783806f925941748dbc` (sha256)
- Rename to `apktool.jar` and follow the [Instruction Guide](https://apktool.org/docs/install?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://apktool.org/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### Upcoming Apktool 2.8.0
URL: https://connortumbleson.com/2023/07/17/upcoming-apktool-2-8-0/
Last updated: 2025-02-04T11:42:34.000Z
A few months ago I got pinged on the oddest message. I was being called out for not fixing Apktool obfuscation issues since I was allegedly being paid by a company to not fix the issue.
Knowing that was a complete lie - the real reason the bug tracker had expanded without crucial fixes was a combination of a few things.
1. My day/hobby life is no longer Android and APKs.
2. These newer obfuscation techniques have poked holes in the aged code base.
3. I had no drive/passion to work on it.
So one day I get a notification of a pull request from a user known as [sv99](https://github.com/iBotPeaches/Apktool/issues?q=is%3Apr+author%3Asv99&ref=connortumbleson.com). This is an alert letting me know that Google has decided to fork [smali](https://github.com/google/smali?ref=connortumbleson.com) (A dependency of Apktool) and bring it up to date so I should switch to that version.
The maintainer of smali (Ben Grover) must be feeling the same burnout I had, because that repository had gone over a year without activity.
So with the child dependencies of Apktool getting a facelift I started noticing more and more pull requests coming in. sv99 was on a roll doing large refactors to take this Java 1.5 code base and bring it up to date with modern design patterns. I was nervous to merge these because my memory of the code base was weak and I was unsure of the impact of some of these changes.
So unfortunately days became weeks and I slowly went through these requests, but when I was done - no more came in. I went peeking on this author's GitHub to investigate and saw a comment directed towards me that said.
> Original repository very slow receive PRs.
That was a little wake up I needed to give some love to Apktool again. If someone can spend unpaid time to help the project - the least I can do is review the request timely and/or share commit rights.
---
So off I went on a journey for some tasks.
**Cleaning the bug tracker**
The downside of any open source project in my opinion is the size of the backlog. If it isn't organized there is no chance of finding tasks to complete. What I'm finding as an annoyance is that all the features and bugs are mixed together in some pool.
So every day I have to look at over 100 issues that could be a mix of bugs and features.
preparing to convert features
I found a sweet feature of GitHub that will allow me to migrate all issues I tagged as "Feature" into a new discussion thread. I put up a warning that I was going to do this [here](https://github.com/iBotPeaches/Apktool/discussions/3135?ref=connortumbleson.com) and when I release Apktool 2.8.0 this migration will go live.
This paired with reviewing all tickets to merge/close issue will knock down my issue count to under 60 when this is done.
**Revamping the docs**
When you look at the current Apktool doc site - it just has aged a bit. It was created when we migrated away from the shutdown Google Code and was a basic template.
Apktool website pre 2.8.0
Most of this documentation just a more cleanly documented port of the old Google Code site. So I felt I needed to wake this up to entice more users to contribute documentation and notes.
I leveraged [Docusaurus](https://docusaurus.io/?ref=connortumbleson.com) which I learned from React Native and started building it out.
Work in Progress - Apktool docs
Working at the moment to find a good medium between a modern design while at the same time not robbing the visitor from the crucial information they want to see immediately when visiting the site.
The code base is much more elegant to adapt the docs in comparison to the past so once I'm done porting old information in - the ability to introduce new docs and links to community tools will be much easier.
**Fixing the attribute resolution**
I wanted to dive into the code and partially fix a long standing [bug](https://github.com/iBotPeaches/Apktool/issues/2981?ref=connortumbleson.com) with decoding the wrong attribute while parsing AXML files. As I started investigating this - it made no sense. We decode a value from a string pool and it was wrong.
I debated parsing the value from the resource map and it worked in that situation. So I was confused - it seemed obfuscation tools had found a trick that Android prefers the resource map over the string pool. So they fill the string pool with bogus/invalid values as they know exactly how Android parses the file.
```java
// Android prefers the resource map value over what the String block has.
// This can be seen quite often in obfuscated apps where values such as:
// -
// Are improperly decoded when trusting the String block.
// Leveraging the resource map allows us to get the proper value.
//
-
if (resourceMapValue != null) {
return resourceMapValue;
}
if (stringBlockValue != null) {
return stringBlockValue;
}
// In this case we have a bogus resource. If it was not found in either.
return "APKTOOL_MISSING_" + Integer.toHexString(resourceId);
```
[https://github.com/iBotPeaches/Apktool/pull/3123/files](https://github.com/iBotPeaches/Apktool/pull/3123/files?ref=connortumbleson.com)
So I adapted our parser and it fixed the issue, but I had to blow out some previous attempts at fixing the issue. It seemed it was the first time in awhile that I sat down and traced a problem to the source in order to apply the long-term intended patch.
**Refactoring the chunk parser**
As I was attempting to the fix attribute parser - I remembered how old Apktool code base had gotten. Maybe folks might not know, but Apktool started before AOSP was open source so it was built on pure research instead of viewing the specifications of the file formats.
So at times when I was comparing chunks to the spec. Apktool read an integer and shifted it into place and the spec was 2 shorts. Odd things like this make it incredibly difficult at times to line up the parser to the specification so I set off to rework that.
With this refactor I had a few goals:
- Support reading chunks in any order
- Unify the parser between AXML and ARSC
```java
private ResPackage[] readResourceTable() throws IOException, AndrolibException {
Set
pkgs = new LinkedHashSet<>();
ResTypeSpec typeSpec;
chunkLoop:
for (;;) {
nextChunk();
switch (mHeader.type) {
case ARSCHeader.RES_NULL_TYPE:
readUnknownChunk();
break;
case ARSCHeader.RES_STRING_POOL_TYPE:
readStringPoolChunk();
break;
case ARSCHeader.RES_TABLE_TYPE:
readTableChunk();
break;
// Chunk types in RES_TABLE_TYPE
case ARSCHeader.XML_TYPE_PACKAGE:
mTypeIdOffset = 0;
pkgs.add(readTablePackage());
break;
case ARSCHeader.XML_TYPE_TYPE:
readTableType();
break;
case ARSCHeader.XML_TYPE_SPEC_TYPE:
typeSpec = readTableSpecType();
addTypeSpec(typeSpec);
break;
case ARSCHeader.XML_TYPE_LIBRARY:
readLibraryType();
break;
case ARSCHeader.XML_TYPE_OVERLAY:
readOverlaySpec();
break;
case ARSCHeader.XML_TYPE_OVERLAY_POLICY:
readOverlayPolicySpec();
break;
case ARSCHeader.XML_TYPE_STAGED_ALIAS:
readStagedAliasSpec();
break;
default:
if (mHeader.type != ARSCHeader.RES_NONE_TYPE) {
LOGGER.severe(String.format("Unknown chunk type: %04x", mHeader.type));
}
break chunkLoop;
}
}
if (mPkg.getResSpecCount() > 0) {
addMissingResSpecs();
}
return pkgs.toArray(new ResPackage[0]);
}
```
So I had a nice reworked loop to just parse chunks as we encountered them. Once again it felt right - the code base inherited over a decade ago was rewritten into a pattern that I understood and aligned to the AOSP specifications.
**Revamping chat mediums**
Finally, I just couldn't link towards Gitter anymore - I just never went to it. No one ever stayed around for responses anyway, much like IRC.
So now I'm solidified on [Stack Overflow](https://stackoverflow.com/questions/tagged/apktool?ref=connortumbleson.com) or [GitHub Discussions](https://github.com/iBotPeaches/Apktool/discussions?ref=connortumbleson.com).
---
So I'm finishing up the new docs site and ensuring no major regressions and excited to launch Apktool 2.8.0 and bring in a new modern era of patches and documentation.
### Bloggers Block
URL: https://connortumbleson.com/2023/07/10/bloggers-block/
Last updated: 2025-02-04T11:42:34.000Z
Photo by [Glenn Carstens-Peters](https://unsplash.com/@glenncarstenspeters?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I blog every week and have been since my new years resolution of 2018, but the passion to have a thoughtful post every week changes.
Some posts I start months in advance and slowly piece together experiments, research or additional photos. These posts feel robust and like they've have some serious effort behind them. For example, my research on [Halo 2 map editors](https://connortumbleson.com/2021/01/11/halo-2-map-editors/) took me a solid amount of time for research and it shows with an estimated 12 minute read.
On the flip side some articles like my collection of [random stories](https://connortumbleson.com/2023/04/10/random-stories-winter-2023/) are pieced together on the last day of the week and barely pass 500 words (my bare minimum word count).
So what I wanted to review this time was my collection of drafts and remember why they are there.
---
**Ship Broken. Patch Later**
This draft was started in pure anger five years ago when Halo MCC was not playable, a $60 game that just refused to work. Back then in the moment I was hoping the game would just start working and I could finish my blog post. It took 1185 days later for an update to be released that made the game actually playable.
**Understanding the metaresources.arsc file**
Following my Apktool tag I wanted to do some research to help document a new type of ARSC file. However, as I started doing that research I realized that my little time I have for Apktool should be better spent fixing bugs than supporting new formats. So it decayed into my drafts.
**Destiny 2: The Bad & The Ugly**
This was another post built out of rage. I couldn't believe when the 2nd iteration of Destiny came out - that it imploded our gaming group and no one played it. This was such a sad sight as the first game had easily thousands of hours played between the friends. I found that since I didn't really play it anymore I didn't even have the drive to make a post to rant about it.
**The Ugly Side of Ingress**
This post was aimed to go out during the rise of Pokemon Go to capture some of the negative traffic aimed at attacking both games. I had a good outline of discussing spoofing, weaponizing of support processes and real world dangers. However as I started writing it out - it felt quite "whiny" so I let it decay.
**Downloading P.T on a PS4**
This post was a cool little guide of tricking your PlayStation to download the [demo horror game](https://en.wikipedia.org/wiki/P.T.%5F%28video%5Fgame%29?ref=connortumbleson.com) that was quite popular. The downside being that I didn't own a PlayStation, so my only confirmation that my test worked was the one time I did it on a friend's console. So I just didn't have the ability to replay some aspects for more photos/proof and it just decayed.
**Hurricane Irma for a Tampa Resident**
I wanted to blog about the odd behaviors that occurred as the expected Category 5 Irma would arrive. It ended up missing Tampa by a lot, but the complete clearing of gasoline and basic items at the grocery store led me to starting this post. However, once I realized that countries and other cities were literally destroyed - it seems quite wrong to blog about a city that was slightly inconvenienced.
**Bots are everywhere**
This was a fun post to do where I just started taking photos of all the spam/bot communication I got between social media, email and text messages. The problem was most of this stuff was highly inappropriate to publish - I didn't exactly want to publish half naked women. Not to mention I think it back-fired as I started responding to some to gather more responses and that just led to even more spam messages.
**Home Automation Exploration**
This was an attempt of documenting all the home technology I have for auto-locking, auto-lights and some clever commands that automate some common actions I would do. The problem as I got near to finishing this post is it just felt like a massive advertisement for Phillips Hue and Google. It wasn't my intent, but once I removed the things that felt like a pure advertisement not much content seemed left so it stayed in the drafts.
**Apktool: The Spare Resource Table**
This was another developer blog to dive into the sparse resources that were recently patched in Apktool. However, I felt I needed to understand it more than the tiny bit I understood in order to patch support and that understanding never arrived. Every once in awhile I would wake up this draft and work on some research and sample applications, but then I wondered why I was doing that when folks wanted bug fixes.
**Junior -> Senior -> Manager**
This post was about my work journey through the ranks, but it felt odd writing it. Even though I didn't leak any company details - it was quite easy for those in the know to understand who I was referencing or talking about in vague terms. It didn't seem like a good idea so I stopped working on it.
**World A-Changin'**
This post was a pure anger driven rant as I sat in a Waffle House and listened to some older gentlemen just rant about my generation to whomever he was sitting with for 20 minutes. So I was collecting his points and preparing a post to prove them all wrong, but boy the post felt so toxic that I stopped working on it.
**React Native: A Rough Ecosystem**
As I worked in React Native more and more - I just started getting really upset about package quality for things like cameras, GPS and queues. When I paired that with the quite horrible developer experience for updates and debugging - I started working on a real rant post. However, React Native conducted a survey and all these points went public with timelines to resolve them all. I felt my post was in bad faith at that point and just let it decay.
**Personal Service is Fading**
Another post that was driven from a rant that it seemed like retail workers were so toxic in a few circumstances and I didn't know what I did to deserve it. However, I was only like 100 words into this post and I remembered every single human that was an asshole to service workers and then I understood why they occasionally act a bit stern - so I dropped it.
**Tampa Bay Water Sources**
This was a fun technical post where I requested water usage for Tampa Bay over last 20 years and got an amazing Excel sheet of data. I visualized it into some charts, but making those interactive while working in the bounds of Ghost was a bit difficult. I wanted the data to be interactive with my commentary, but I struggled to present the data in a clean format so it sat.
**NDAs and Staying Quiet**
Every once in awhile I would read a great Hacker News post about some person who was employed at X and would break down inside knowledge about processes or technologies. However, chances are most of these stories were like 30-40 years ago. I have some cool stories and odd stories I wanted to share, but these are still in business companies and of course I would be invalidating NDAs so instead I stayed quiet. When I've basically recapped the entire post in this summary is why I stopped working on it.
**AirGradient**
I purchased some air quality monitors and set them up. I stupidly forgot to take pictures as I assembled them and half the journey with a DIY air monitor is the journey of building. So I sat it aside to take apart one model and build it again with photos, but I just haven't gotten around to that. So they sit as I work on perfecting my data collection pipeline and obtaining more photos.
---
All in all I doubt any of those posts will ever see the light of day, with the exception of the Air Gradient one.
### Hyundai Theta II Engine
URL: https://connortumbleson.com/2023/07/03/hyundai-theta-ii-engine/
Last updated: 2025-02-04T11:42:34.000Z
Photo by [Sigmund](https://unsplash.com/@sigmund?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few days ago my 2019 Hyundai Sonata abruptly stalled/seized in the middle of the road while driving. This has never happened to me while driving before and it was quite an experience. I had within seconds:
- My brakes acting extremely odd - they wouldn't really work unless hammered down.
- My power steering was gone.
- I had 4 new red icons on my dashboard illuminated.
- My gas pedal was unresponsive.
- My vehicle wouldn't move forward.
I was completely unaware how panic inducing it can be when your brakes don't work as you expect. I guess I was unaware of how much hydraulic pressure is used to make the brake pedal work with little effort. I was mashing the brake pedal and was sure I was going to ram the car in front of me. Thankfully just pumping the brakes and slamming my foot down led to me stopping.
About an hour later a tow truck showed up and my Hyundai was off to the dealership. With how backed up the dealership was they would be unable to look at my car for days.
I tossed this news to a group chat and my friends just posted a link towards a [class action lawsuit](http://hyundaithetaenginesettlement.com/faq.html?ref=connortumbleson.com) and mocked me for having a Hyundai. I did vaguely remember getting a letter in the mail about that mentioned lawsuit.
The Class Action Lawsuit.
Back when I got this letter, it seemed the points didn't really apply to me. It was for requesting reimbursements for one of the following:
- An engine failure
- Delays exceeding 60 days
- An engine fire
- Losing faith in Hyundai
So after reading those - I've only had 2 Hyundai's in my life and combined they've gotten me through 15 years so I hadn't lost hope and I hadn't noticed an issue at all. So next time I was at my service appointment I mentioned this and was told I'll get needed software patches applied during service so I ignored this.
After posting this life update to an Ingress group chat - I learned a teammate in this game happened to be previously employed as a Hyundai technician for a dealership. I messaged this individual and asked if I could jump on a call with him and he agreed.
We talked for about 20 minutes and I asked for permission without using his name or location to summarize what we discussed. He agreed, so thus this is my recap.
---
He started this call asking me if I had the dreaded P1326 code and I responded I have no idea what that is. I got a mini lesson then about the fault codes and how that referred to an alarm about potential engine knocking.
> [*Error code P1326*](https://www.way.com/blog/error-code-p1326-reasons-problems-and-diagnosis/?ref=connortumbleson.com) *occurs due to vibrations indicating excessive connecting rod bearing wear. You can easily detect them using the KSDS (Knock Sensor Detection System). Since severe engine damage and failure are possible.*
Once again I asked what any of that meant and this guy asked how much time I had and proceeded to give me \~10 years of history with him and Hyundai while working in the dealership.
I also learned that I know an embarrassing-little amount about cars under the hood, so I listened well and did some research to augment our discussion.
---
**2011**
Hyundai launches a Theta II engine which he mentioned adjusted the engine design from a multi-port fuel injector to a direct injector for squeezing further optimizations and efficiencies out of the engine. This is where he mentioned that the first flaw they noticed in cars as they came in was a massive build up of carbon in the intake valves as there was no longer fuel to clean it out.
[https://www.youtube.com/watch?v=dxbZkVyd9cc](https://youtu.be/dxbZkVyd9cc?t=379&ref=connortumbleson.com)
So one quick search and I found a [YouTube video](https://www.youtube.com/watch?v=dxbZkVyd9cc&ref=connortumbleson.com) to visually see what he was describing.
**2012 - 2014**
This individual's dealership starts noticing a pattern of engine failures in a variety of Hyundai's - they just don't know why. They dealt with many engines where the rod would displace itself and lead to catastrophic failure either shooting down through the bottom oil pan or up. This was way before any official recall or support from Hyundai, but the dealership knew something was off.
**2015**
[Recall 132 Dealer Best Practice Guide](https://static.nhtsa.gov/odi/rcl/2015/RCMN-15V568-2234.pdf?ref=connortumbleson.com)
As 2015 nearly ended he mentioned Hyundai started *Campaign 132* which was specifically for an isolated set of engines and cars. He mentioned what this required them to do was sit in the car with all windows up and hold some tablet in the vehicle.
They'd run the RPM up and idle it while this tablet was recording the audio and listening for audio of the engine potentially "knocking". This individual hated this test as it was only testing the engine at that very moment, which meant that it would rarely fail a vehicle preemptively. He remembered some cars that passed this test would come back sometimes just weeks to months later with a seized engine.
**2017**
[Recall 162 Dealer Best Practice Guide](https://static.nhtsa.gov/odi/rcl/2017/RCMN-17V226-4739.pdf?ref=connortumbleson.com)
This is when he remembered that another campaign started with Hyundai named *Campaign 162*, which added a bunch more of newer vehicles and provided a new method for recording the engine. Now this was a customized microphone that went into the engine dip stick for a more accurate recording.
However, much like you expect. This only in his experience detected vehicles that had already seized or were moments from it. Since he remembered a few circumstances where vehicles came back not more than a week later with a blown engine.
Around this time he remembered more and more occurrences of not only a seized engine, but the ejection of the rod towards the exhaust could cause the engine to catch fire. This meant the government was getting quite involved at this point and pushing Hyundai to make changes.
For him - they just kept recording audio of failed engines to get approval from Hyundai for a replacement. They'd make some money, but he mentioned it was getting pretty ugly for the dealership since occasionally during tests the rod might eject and start a fire in the shop.
He believes this is why Hyundai ended the 162 & 132 campaigns as they required a good deal of testing the engine which was causing fires in the dealership's shop.
**2018**
This is where he learned that Hyundai was under major fire. They had to either recall millions of vehicles or give a warning to consumers that their vehicle was in danger of blowing up.
[Service Campaign 953 Dealer Best Practice](https://static.nhtsa.gov/odi/tsbs/2019/MC-10167765-9999.pdf?ref=connortumbleson.com)
So Hyundai had a new campaign for them known as *Campaign 953* which was the software upgrade that introduced the Knock Sensor Detection System (KSDS). Not only that but it added basically any Hyundai vehicle with the Theta II engine to the list.
He said this was internally known as the "Limp mode" campaign and associated code. When it was thrown your vehicle would shut itself down into a limited mode so its only goal was to safely transport it back to the dealership at a low speed.
He said this was a nightmare campaign. So many vehicles came in with this code (P1326) which was the code responsible from the KSDS system. Hyundai was telling them to order new engines and just put people in loaners, but the engines were on a 6+ month backorder and they were out of loaner cars. They couldn't get answers from Hyundai on what to do with vehicles that threw the code, but had no issue.
[Service Campaign T3G & Warranty Extensions TXXC/TXXI - ENGINE BEARING INSPECTION / ENGINE REPLACEMENT- Dealer Best Practice](https://static.nhtsa.gov/odi/tsbs/2022/MC-10211665-0001.pdf?ref=connortumbleson.com)
So the dealership was stressed in the situation, despite making some solid money from all the coverage from Hyundai. Except he mentioned something happened when Hyundai requested they cancel all pending orders for new engines and instead follow this new campaign known as *Campaign T3G*.
This was a campaign to help fix/teach the dealership how to detect a false positive fault code when it came to the KSDS system. It turned out some vehicles he said had the knock detection line resting on top of the fuel injector wire. This would lead to interference which would improperly trigger the knock detector sensor.
So the staff was trained to remove the existing KSDS system and rewire in an alternative way that avoided existing wires. This was an expensive amount of labor to do and Hyundai quickly was not happy with the amount of hours they had to pay for.
So they revised the T3G again and again cutting hours paid until a new piece of hardware was invented to more accurately detect affected engines with little labor and no chance of fires in the shop. He mentioned it was a sketchy little box that was known as the: Engine Bearing Clearance Tester.
You'd connect this piece to the engine and use a special crankshaft rotator tool to test the engine. It would then measure highly accurately over many tests the rod bearing clearance to detect a flaw, but still suffered in the same regard as the last tests - it would only detect an issue if the damage had started.
**2019**
He mentioned this is where Hyundai solidified their stance that would only warranty engine replacements when it was rod bearing failure. He knew that in plenty of situations burning oil was a sign of this issue, but it wasn't covered. This led to extremely pissed consumers he said and they considered warranty fraud, because burning oil would soon become rod bearing failure which then was covered.
This was a year that made it clear to the dealership that Hyundai was getting upset with so many warranties. They continued to adjust the criteria for what would be covered and this put the dealership in a battle to fight for the consumer at times when they knew the engine damage wasn't operator error.
---
After all this interesting background - I was quite furious in this company Hyundai I've been supporting since my first car.
So now I learned I don't want to go anywhere near another Theta II engine again. I might have to sell my fixed Hyundai when I get it back and do some research for a new manufacturer.
UPDATE (2024) - My Hyundai was sold back to the dealership after seizing for the 3rd time.
### Retiring Technology
URL: https://connortumbleson.com/2023/06/26/retiring-technology/
Last updated: 2025-02-04T11:42:35.000Z
Photo by [Adnan Mistry](https://unsplash.com/de/@adnan%5Fvisuals?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few months ago my Chrome browser said - "*Chrome couldn't update to the latest version, so you're missing out on new features and security fixes.*"
There isn't actually any compatible updates remaining on the free Ubuntu plan I'm on. If I was willing to shell out some money I could keep some extended support on Ubuntu 16.04 for another few years. This post isn't about Ubuntu though or extended support - its about a personal problem of retiring technology.
I'm typing this blog on an NP8130 Sager notebook that was purchased way back in July of 2011\. Back then it was built to last with a few components that were a bit extra than the base. It rocks spec wise:
- GPU: GTX 560M
- CPU: i7-2630QM
- Memory: 12GB DDR3 SDRAM 1600MHz
- Display: 15.6" 1920x1080
It hasn't survived a decade plus without a few replacements though. I've replaced at some point the power cable and hard drive. It also will die instantly if unplugged from power despite having a battery.
Only recently has using this old machine really started being noticeable. With YouTube videos just refusing to play and anything involving OpenGL just crashing - the web experience is collapsing.
However, on the positive side. I've built and launched many projects built on this old machine. I find perfecting a project on a weaker set of hardware results in quite a lightning fast experience when deployed to more powerful hardware. I think it helps force my hand to make an experience great for a low end device as it has to work great on my own slow machine.
It's not my only laptop though - I've got a Samsung Chromebook Series 5-550, which was a Chromebook released in May of 2012\. I remember a family member getting the first Chromebook (CR-48) and talking about how good it was in quick booting and straight to web browsing.
Samsung Chromebook Series 5: 550
Turns out the Chromebook still boots well, but I don't really use it anymore. This laptop was amazing as a companion machine for Xbox gaming. Some games had 3rd party tools you could use and this was a perfect laptop to use when playing Xbox. Once I entered the world of PC gaming - this laptop lost its purpose.
So one day when I was working on Apktool - I realized that waiting a few minutes for a full build to complete was insane. I drove over to Best Buy in a moment of built up aggression against a slow machine and purchased an Acer Nitro 5\. Basically a $700\~ laptop to get me moving again on things.
I did some research on my phone while standing in the store and made sure the laptop could run Linux and set up Kali once I was home with it. I hadn't set up a new Linux computer in a few solid years and a few new options between LUKS and file systems threw me into some research to be sure I was doing the right thing.
However, as mentioned in the beginning why am I blogging on an older laptop when I have a semi-brand new one?
The Acer sits away
The other laptop is in arm's reach, but sits near the Xbox/Raspberry Pi corner. I struggle to intentionally retire hardware until it is catastrophically broken. In this situation I've attempted many times to swap hardware and swap the positions of these laptops and just reversed it a few days later.
I forget some file or configuration or some software was licensed to only the old laptop and I struggle to figure out how to re-license it on a new machine. So I'm constantly just using the old machine and only bring out the new laptop when working on a project I've migrated.
Some projects are so old they work fine on Ubuntu 16, but given Kali Linux 2023.2 and it struggles to work. I either spend the time to fix the project to work on new hardware or just take the shortcut and use the old machine. Sadly, I continue to just use this old laptop and let the newer one sit in the corner.
---
This isn't even isolated to laptops. My old desktop that was previously used for gaming is now a Plex server that sits beneath me. It has a large collection of old Halo/Xbox modding files on it as well, so I struggle to figure out how to properly retire that hardware.
It even broke one day where the graphics went all pink so I just ordered a replacement ATI Radeon HD 5770, which was the exact model of older GPU it had. So I'm willing to buy very old equipment to fix old machines, but rarely do I upgrade a machine in place.
Current Desktop
My current desktop is far from its expiration day, but it can't go to Windows 11 and who knows how it'll handle with the next generation of video games. It's already telling that my once great GTX 1080 can't handle the frames when it comes to Halo Infinite.
Though, I have to remember I'm no streamer and it doesn't matter if my equipment lags behind. I like to leverage a calculation that refers to the entertainment value of any purchase. For this situation if we estimate 8 hours of a gaming a week times 52 weeks a year times 6 years we get roughly 2,500 hours of gaming.
So if you take the cost of the machine (\~$2,220) and divide by the hours spent on it you can tell we have broken sub dollar range. For context if you spend $40 at a bar for 5 hours you got $8 an hour of socializing. I'm currently working at \~90 cents/hour of entertainment value on my computer which seems like I got my money's worth.
Though if we talk about network equipment or phones - that all goes out the window. I revamp those way before they reach the end of their life. So maybe there is no chance of understanding how I retire technology and replace it.
*EDIT: It wouldn't be believable, but the Monday after this post went live - the 10+ year old laptop wouldn't boot. Its not getting power and it appears the power brick has died.*
### The Reddit Drama
URL: https://connortumbleson.com/2023/06/19/the-reddit-drama/
Last updated: 2025-02-04T11:42:35.000Z
Photo by [Brett Jordan](https://unsplash.com/@brett%5Fjordan?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As June started an article spread like wildfire in the technical communities and it was this thread on Reddit: "[Had a call with Reddit to discuss pricing. Bad news for third-party apps, their announced pricing is close to Twitter's pricing, and Apollo would have to pay Reddit $20 million per year to keep running as-is.](https://www.reddit.com/r/apolloapp/comments/13ws4w3/had%5Fa%5Fcall%5Fwith%5Freddit%5Fto%5Fdiscuss%5Fpricing%5Fbad/?ref=connortumbleson.com)"
The title basically summarizes this issue, but we need to turn back the clock to understand what Apollo is and why this spread quickly.
In 2012 I joined Reddit and back then we can see that Reddit didn't have an official mobile application. If you remember years based on the Android version this was around the time of Ice Cream Sandwich or Jellybean. So if you were an addicted user of the site a decade ago - you found an unofficial 3rd party application.
In my personal experience, I was in Kansas at the time and had met a local company known as [OneLouder](https://pinsightmedia.com/solutions/onelouder?ref=connortumbleson.com) while interning around in high school. They had a pretty cool weather application known as 1Weather which eventually lead me to other applications by the company which was BaconReader.
[https://pinsightmedia.com/solutions/onelouder](https://pinsightmedia.com/solutions/onelouder?ref=connortumbleson.com)
So I found myself with BaconReader and a $2 donation to remove ads and this is how I browsed Reddit over the last decade. It was a sweet application as it had a minimal interface and support for multiple accounts.
As years went on - something interesting happened. Reddit actually acquired one of the 3rd party applications known as [Alien Blue](https://techcrunch.com/2014/10/15/reddit-acquires-alien-blue-the-most-popular-unofficial-reddit-app?ref=connortumbleson.com) in 2014\. This reminded me what happens anytime a business acquires a competitor - it slowly over 2 years abandoned the application and then removed it from the store launching their own official applications in 2016.
The official application from someone who tried it - just wasn't my cup of tea. This application was clearly built for metrics, conversions and ads which was a complete alternative than what the 3rd party applications were built for.
It seemed like a problem was brewing - the 3rd party applications didn't have ads and could even gate payment access to their unofficial application. I was more willing to pay $2 to a 3rd party company for a better polished application than use the official application.
However, lets be real. I am the minority, most people browsing Reddit have no idea what an API even is nor the difference between a 3rd party application and official one. If we look at BaconReader vs the official application in terms of downloads - this tells that story.
- BaconReader - 1 million+ downloads, 4.3 stars (107k reviews)
- Official - 10 million+ downloads, 3.8 stars (2.86mil reviews)
So if we bring things back to the present why is Apollo facing a $20 million yearly bill for an assumed less popular unofficial application? Apollo must be more popular than the comparison of BaconReader above, which must be why that post garnered 164,000 up-votes.
The comments here in that post really told a story, so here is some summaries:
- The same API used for 3rd party applications is used for many bots that moderate subreddits.
- Unofficial applications take accessibility more seriously than official app.
- API pricing doesn't seem reasonable and rivals Twitter's $42,000/month fee.
8 days later from that post a bombshell dropped: "[Apollo will close down on June 30th. Reddit’s recent decisions and actions have unfortunately made it impossible for Apollo to continue. Thank you so, so much for all the support over the years.](https://www.reddit.com/r/apolloapp/comments/144f6xm/apollo%5Fwill%5Fclose%5Fdown%5Fon%5Fjune%5F30th%5Freddits/?ref=connortumbleson.com)"
This post was a bit insane to read. The creator of Apollo had recorded calls, transcripts and more of these discussions with Reddit to help prove his side of the story.
This post exploded further than the last and went to 215,000 up-votes. While this was spreading Reddit intervened and scheduled an AMA (Ask Me Anything) for the next day. This in my eyes was either a chance to rollback some changes or double down.
The [AMA](https://www.reddit.com/r/reddit/comments/145bram/addressing%5Fthe%5Fcommunity%5Fabout%5Fchanges%5Fto%5Four%5Fapi/?ref=connortumbleson.com) was an absolute mess to read, which even resulted to attacking the author of Apollo who spawned all this drama.
> His “joke” is the least of our issues. His behavior and communications with us has been all over the place—saying one thing to us while saying something completely different externally; recording and leaking a private phone call—to the point where I don’t know how we could do business with him.
> [https://www.reddit.com/r/reddit/comments/145bram/addressing\_the\_community\_about\_changes\_to\_our\_api/jnk45rr/](https://www.reddit.com/r/reddit/comments/145bram/addressing%5Fthe%5Fcommunity%5Fabout%5Fchanges%5Fto%5Four%5Fapi/jnk45rr/?ref=connortumbleson.com)
It didn't take more than an hour for the accused to respond and say:
> Please feel free to give examples where I said something differently in public versus what I said to you. I give you full permission.
So boy after reading this I felt like the Reddit I enjoyed using was coming to an end. They doubled down and made little changes, but did promise to make exceptions for moderating tools and non-profit applications.
I think its clear what happened here and it has nothing to do with 3rd party applications. The AI movement is growing and all these models are being trained on publicly accessible data. Reddit is mad that all these successful highly funded ventures were built from some of their data for free.
Data though could be its own blog post. If you look at Reddit - its the community that creates content, up-votes content and moderates it. Reddit admins steps in when their rules are broken, but for the most part the community keeps Reddit content growing and moderated. Maybe at some point in the far future data is connected to the human and the human decides how it can be shared, but we are no where near that at the moment.
Companies who pulled data from Reddit to train models are faced with a new problem - pay a heavy bill or get their data from elsewhere. However, Reddit is doing that at the cost of blowing out millions who prefer an alternative approach to browsing the site.
Old Reddit
I still use the "old" version of Reddit when browsing the website. I just can't find myself ever using the new interface which is heavy on ads and recommended content.
New Reddit
Turns out I am not alone in some of this thinking and communities decide to turn their communities private on June 12, 2023 in a protest. This resulted in the following outcome from this [source](https://i.redd.it/w8tfdet8dz5b1.png?ref=connortumbleson.com):
- 622 million submissions went private.
- 7.4 billion comments went private.
- 8,830 subreddits went private.
This meant if you wanted to view any of that information from a linked article or Google search you were left with a nasty error page on that day. Probably such a temporary blip that will do no real damage, but the fallout is still happening. Quite amazing to think that humans self-organized to take down over 600 million posts of content temporarily.
Some subreddits are refusing to re-open and Reddit is getting angry coming out with posts like:
> *If a moderator team unanimously decides to stop moderating, we will invite new, active moderators to keep these spaces open and accessible to users. If there is no consensus, but at least one mod wants to keep the community going, we will respect their decisions and remove those who no longer want to moderate from the mod team.*
So what I end up seeing occurring:
- Reddit removes moderators who are taking a stand.
- New staff or other moderators are added who don't fit the vision of the original community.
- The community collapses and moves elsewhere.
Alternatively, I also see this approach.
- Reddit removes moderators who are taking a stand.
- Reddit assigns corporations and companies to the respective domains, ie Apple for [/apple](https://www.reddit.com/r/apple/comments/14al426/rapple%5Fblackout%5Fwhat%5Fhappened/?ref=connortumbleson.com).
- Corporations moderate for brand image and take away the aspect of Reddit that allowed raw thoughts about a company.
- The community collapses and moves elsewhere.
Finally, I also see this approach.
- Reddit removes moderators who are taking a stand.
- Corporations employ AI to moderate subreddits.
- AI posts and moderates which causes a loop of AI being trained by AI and original thoughts start disappearing.
- The community collapses and moves elsewhere.
---
All things change in time and things I like slowly become something I hate isn't new. Corporations want to go public or please shareholders and the things that made the company wonderful collapses. Companies continue to push for growth on growth at the expense of destroying itself and allowing a new company to sweep in.
[https://en.wikipedia.org/wiki/Digg#timeline](https://en.wikipedia.org/wiki/Digg?ref=connortumbleson.com#timeline)
Much like Digg collapsed when version 4 was released - we may look back at this at the moment Reddit started its downfall. I imagine July 1st, 2023 will be my last day on Reddit and I'm sad for that. The little communities allowed me to follow competitive Halo, Ingress, Laravel and much more.
I'll find a new home, much like I did when Digg went south.
### Superfund Sites
URL: https://connortumbleson.com/2023/06/12/superfund-sites/
Last updated: 2025-02-04T11:42:35.000Z
Photo by [Aleks Dorohovich](https://unsplash.com/@doctype?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few months ago through work I stumbled upon the term Superfund and a few days later had a pretty good understanding of the term. Taking that term back to some friends it seemed that no one else understood it. This must be a flaw of being born after 90% of this was established and not remembering hearing the term once in school.
So for those unaware Superfund is the informal term of the Comprehensive Environmental Response, Compensation and Liability Act (CERCLA). This in basic English means the Environmental Protection Agency (EPA) may identify and clean up contaminated sites - while finding and forcing the associated party to pay or clean it up themselves.
So lets turn back the clock and see why this started and some of the big reasons it began.
**1962**
- Marine Biologist Rachel Carson has concern about water and air pollution from the rise of company engineering or waste disposal.
**1970**
- Public concerns quite high with how a city deteriorated with contamination.
- Nixon signs the creation of the EPA thus creating a new agency.
- Earth Day is created.
**1976**
- Resource Conservation and Recovery Act (RCRA) is enacted to combat the midnight dumping of toxic waste.
- Toxic Substances Control Act (TSCA) allows EPA to limit the acquisition of toxic chemicals through processes.
**1976-1979**
- National coverage of fire of waste drums in New Jersey.
- State of Emergency at Niagara Falls.
- Hearings on hearings about toxic waste.
**1980**
- CERCLA enacted by Congress, which added a tax on potentially hazardous substances to fund the program.
- National Contingency Plan (NCP) begins with the procedures on how to respond to discovered hazardous sites.
**1982**
- Hazard Ranking System (HRS) is invented to help classify and evaluate the danger of a discovered hazard site.
**1983**
- Leveraging the HRS scale, EPA creates the National Priorities List (NPL) which lists and classifies sites requiring long-term cleanup supported by the Superfund.
**1984**
- Amendments to RCRA to force treatment of waste prior to disposal.
**1986**
- Right-to-know added into Superfund amendments so residents can be aware of nearby incidents.
- First site "removed" from NPL list after recovery known as Friedman Property.
- Superfund Amendments and Reauthorization Act (SARA) passed to beef up the CERCLA process for long-term remedies and involving local government more.
**1989**
- EPA adapts to "Enforcement First", which moves the priority to finding the party at fault to assign responsibility.
**1990**
- Oil Protection Act enacted forcing the cleanup cost of oil spills to be handled by the oil handling industry.
- EPA revises the scale of HRS based on SARA to more accurately access danger to a human.
**2010**
- 40th Anniversary of EPA, which has just been slightly amended or streamlined in the past 20 years.
---
So lets take a look at one of the first sites.
Valley of Drums - Brooks, Kentucky - KYD980500961
This was a big discovery - it was found that nearly 27,000 drums were buried and near 100,000 drums were just emptied and dumped into trenches in the 23-acre site. So from the 1960s to 1980s drums were disposed of here and a tough story follows to discover who is responsible.
Unlike today where property records are quite documented - the responsible party for this site was someone known as A.L Taylor who died in 1977\. However, its clear that with the site being a primary dumping location it couldn't have been a solo effort.
So clearly the snow melt and weather carried the waste around the ground and was becoming a large environmental nightmare. Alongside the discovery of the [Love Canal](https://en.wikipedia.org/wiki/Love%5FCanal?ref=connortumbleson.com) disaster it was becoming clear that this discovery was even worse. So even though in 1982 the site was proposed it took into 1996 when the site was finally removed from the Superfund site list after extensive cleanup.
So 14 years of cleanup, but even that isn't fair to say. Since they continue to find environmental issues around that area as recent as 2008\. The point of this is to say that the carelessness of waste disposal had huge implications that still haven't been fully discovered. A good recap of this specific site can be found here at the [ArcGIS story map](https://storymaps.arcgis.com/stories/a8a2e5df0f064ce69656a1f6cae5c336?ref=connortumbleson.com).
---
However, even with all this regulation there are still some disasters that are tough to fully understand or resolve.
[Stunning DDT dump site off L.A. coast much bigger than scientists expected](https://www.latimes.com/environment/story/2021-04-26/ddt-waste-barrels-off-la-coast-shock-california-scientists?ref=connortumbleson.com)
Take the DDT dump site off the L.A coast which discovered 27,000\~ barrels of assumed DDT at the bottom of the seafloor. You can read the breakdown on the EPA site and learn it scored 32.10 on the HRS score, which is small knowing it goes up to 100, but anything over 28 will go on the NPL list. It looks like a cleanup that'll never end when you consider it was broken up into units:
- Soil near property
- Storm-water pathway
- Ground water pathway
- Dense non-aqueous phase liquid cleanup
- Historic storm-water pathway
- Palos Verdes shelf
- Historic storm-water south pathway
- and more
It just looks like its incredibly easy to damage the environment and incredibly more difficult to clean up the damage. It just seems entirely malicious knowing someone approved boating out off from the coast and dumping barrel drums to the bottom of ocean. Perhaps the regulation change over the decades finding and forcing the associated party to pay for the cleanup would prevent future occurrences such as this.
Though, much like we see with recycling. The cheaper option is now to just send waste to a country with less restrictive policies. A small payment in comparison and now its their problem. A sad true reality of our world when the right path is too expensive - find an alternative. Unfortunately for our Earth any environmental damage harms the same planet we all share.
---
So then I wanted to open up a map and see how the the current state of Superfund sites looked.
[NPL List](https://epa.maps.arcgis.com/apps/webappviewer/index.html?id=33cebcdfdd1b4c3a8b51d416956c41f1&ref=connortumbleson.com) \- 6/10/2023
I could have filtered out deleted/proposed sites (the green and red), but seeing how many yellow triangles existed I figured it wasn't worth it.
This was quite the sight to see - I didn't realize how many Superfund sites existed and after reading about two of them, I was more interested and researching the one that was a few minute walk from my house.
So the NPL site near me was known as "[Normandy Park Apartments](https://cumulis.epa.gov/supercpad/cursites/csitinfo.cfm?id=0405823&msspp=med&ref=connortumbleson.com)" and scored a 49.98 on the HRS score. So I was quite surprised it scored higher than some previous sites I researched, so I began investigating.
Turns out between 1953 and 1963 this location operated a battery recycling and lead extraction plant. The process used for these operations released sulfuric acid and lead into the environment. In 1970 an apartment complex was built with 144 units on top of the affected soil. The concrete layers ended up protecting from most of the contaminated soil, but the EPA found widespread lead leaks throughout the non-constructed areas.
So major cleanup began, but it wasn't until 2018 that the last bit of impacted soil was treated and removed. The only contaminated soil that remains is covered by a building or parking lot.
So I wonder if any of the folks know that they live on top of a lead extraction facility debris and just a few layers of concrete keep them safe. A slight exaggeration there, but I found it very interesting to see and read about these sites. Especially with the amount of public details you can find.
You can even read the contaminants for each site. In the case of the [Normandy Apartments](https://cumulis.epa.gov/supercpad/SiteProfiles/index.cfm?fuseaction=second.contams&id=0405823&ref=connortumbleson.com) we see:
- Antimony - Soil/Groundwater
- Arsenic - Soil/Groundwater
- Cadmium - Groundwater
- Lead - Soil/Groundwater
So I guess when those apartments age out and require destruction the EPA will get involved again to be sure the soil hidden beneath the structures is treated and removed.
---
So I kept reading more and more and I can't tell with some of these companies the intent of their inflicted environmental damage.
- Some companies seem to react immediately in the recovery process fronting the bill as intended as if it was an accident or they just want to keep the public happy.
- Some companies are hidden through so many layers of companies no one can find the true culprit of an abandoned site and the government is left with the bill.
- Some companies actively fight the legislation claiming it impacts their business and there is no concern for citizens.
Depending how you feel on this issue - there is no end to research you can find. One odd thing I found was a company "Clean Harbor" that just does open burn pits of toxic materials. It seems there are some parts of the world that seem quite dangerous to your health to live near and its unfortunate for the citizens who can't just move away.
What I think happened for more than half of these situations is it was cheaper to dump/burn the waste than treat it and there was no enforcement to do the right thing. Over time regulation started enforcing treatment of waste, but that was too late for the 60-70 years of vaguely unregulated disposal of toxic waste. Especially too late for currently active burn pits that skirt the rules.
However, if we draw a parallel line to data leaks in the computing space. I see the same style of problem occurring. Companies can lose our private data, send some apology and give us 1 month free credit monitoring and call it a day. Much like 40 years of regulation happened to ensure companies aren't killing us with toxic waste. I see a future where companies that lose our data face some hefty fines and extensive punishment.
Looking at this through a lens of time - knowledge and technology has evolved. We used to use lead paint, lead gasoline and only decades later did regulation and knowledge end that era. So who knows if something we are doing now we learn in 40 years has led to some consistent health issue and will soon be regulated.
### The FP Movies
URL: https://connortumbleson.com/2023/06/05/the-fp-movies/
Last updated: 2025-02-04T11:42:35.000Z
Over the past week or so I watched all four currently released movies of The FP movie franchise and while I believe I've lost a good deal of brain cells - its time to recap these films. While I watched the first film with some others under the guise of "bad movie night" - I watched the remaining three alone to make this post.
---
The FP - 2011 (R) - 1h, 22min - [Trailer](https://www.youtube.com/watch?v=ulwbRqXbS90&ref=connortumbleson.com)
> In a post apocalyptic future, two rival gangs fight for control of Frazier Park by playing "Beat Beat Revelation", a deadly version of Dance, Dance, Revolution(TM).
The first film in the series sets up a universe that is tough to follow. I'll do my best:
- Characters are named quite oddly, such as JTRO, KCDC, BLT, BTRO and L Dubba E.
- The spoken language is some mix between slang and 6th grade wannabee gangsters.
- The residents of dystopian Frazier Park need alcohol to prevent scourge of drugs upon them and prefer alcohol over water.
- Gangs fight over control of the city (The FP) in order to control the "booze mines", which provide alcohol from rocks.
- If you lose a dance battle - you sometimes die.
Now that I've seen all the movies - this first film is the least green screen filmed of them all, with also a much more tamed approach to the type of language spoken in this film.
To fully understand what I mean - here is a sample of some real lines in the film word for word. Some of them I don't even feel comfortable pasting in this post as out of context can be quite difficult to explain.
"The FP" Clip
> Back your stank ass shit up off my flavor!
> You got's permission to be up all up in dis suare de la twa.
What I found interesting is it seems the main character (JTRO), who is also one of the directors, doesn't often want to use the established type of spoken language. He reverts to talking like a regular human towards many characters throughout the film.
This film follows a pretty standard movie plot, which works roughly like:
- Protagonist loses to antagonist.
- Protagonist needs help to get back on path to victory.
- Antagonist has the person/object/thing protagonist is interested in.
- Protagonist needs to train Rocky style to prepare to face antagonist again.
- Protagonist beats antagonist after training.
So as this movie ended I was quite surprised to find there was not only a sequel, but three additional movies to watch.
---
FP2: Beats of Rage - 2018 (R) - 1h, 29min - [Trailer](https://www.youtube.com/watch?v=tgdVv6MK1PA&ref=connortumbleson.com)
> Despite hanging up his boots following the events of 'The FP,' JTRO must return to the blood sport of Beat-Beat Revelation one last time. JTRO and KCDC - his mystical hype man - will quest deep into The Wastes, a land destroyed by the Beat Wars, to compete in the ancient Beat-Beat tournament, "Beats of Rage," face AK-47 - and, hopefully, save the world.
The 2nd film is the franchise moving further and further into the realm of green screens. We see the main character JTRO back in action aging as his friends from the older film compete in Beat Beat matches in the middle of the wastes. This is apparently the area outside of The FP where alcohol is harder to come by.
One of the main characters from the first film (BLT) ends up dying in the intro of movie to the new antagonist known as AK-47\. So now we have JTRO and KCDC off to wandering through the middle of nowhere to find this underground style of beat matches where this new arch nemesis resides.
This is where we learn that rain/water is known as "wet shit" and the absolute worst thing to drink to these characters. Its alcohol over anything here, which is odd especially with how dehydrated you get consuming alcohol.
We meet one of our new main characters known as CHAI-T who seems to be the newest love interest for JTRO. These two will end up together and become the main characters for the final two films. CHAI-T has stayed true to the established universe in this film and speaks in only the oddest form of words.
"FP2: Beats of Rage" Clip
> Magic is real AF out here, JTRO
> CHAI-T just went all Anzac Day on that mother-bitcher, yo!
While the language went up a notch in oddness - the story line remains about the same. Our lead character JTRO loses a fight against the enemy and proceeds to train and learn to face them again towards the end. I'm still confused watching this how some folks die (187\`d) in the film after losing a match, but others can simply retrain and face again. It must be that plot armor protecting JTRO at this point since it seems he cannot be killed.
As JTRO wanders back home after losing to AK-47 he stumbles upon a bar in the middle of no where who happens to have a hooded bartender who is his father. His father then brings him back to his childhood house out in the wastes and explains a bit of family history. Whats important to note here is:
- NITRO (JTRO Dad's) ended up having kids with CHAI-LATTE
- NITRO competed in illegal beat matches causing to get thrown in Bako (Jail)
- CHAI-LATTE was a Ninjawa (Magic Ninja Warrior)
- NITRO had 3 kids (BTRO, JTRO and ATRO)
- BTRO died in the 1st film
- ATRO is AK-47
- JTRO is a RE-NINJ (Evolved with powers?)
- CHAI-LATTE died in a beat match when forced to face NITRO
So we get another training montage and JTRO is apparently ready to roll again against his brother AK-47\. CHAI-T appears pregnant from her time with JTRO and returns to find JTRO to support him in this final battle. So this training montage must have occurred over months based on the pregnancy.
At some point in this final battle - JTRO gets electrified and its shown that he has "RE-NINJD", which must be some form of evolution. So of course with that added boost of power - he defeats the enemy.
So the 2nd film ends with JTRO and CHAI-T together with a soon to be born child.
---
FP3: Escape from Bako - 2021 (R) - 1h, 9min - [Trailer](https://www.youtube.com/watch?v=wT%5F3I0ksJ4Y&ref=connortumbleson.com)
> JTRO and Fam embark on their most dangerous mission yet: Forcing them to battle foes from the past in order to save their future from a calamity that threatens to wipe humanity off the mo' suckin' face of the Earf...4 EVZ.
The 3rd film in this series throws everything out the window that you thought you knew. It was apparent that you couldn't continue to evolve a movie series if people are just dancing on dance pads as a form of competition. The movie starts off with a huge amount of text to help you understand what you are about to witness.
> THE WET SHIT IS COMING
>
> A NEVER ENDING STORM OF SOBRIETY FROM WHICH THERE AINT NO CURE HAS SWEPT OVA THE MO' SUCKIN' EARF.
>
> ROLLIN' UP FROM THE RUINS OF BAKO, A BEAT-BEAT PRISON CITY FROM THE OLD WORLD THAT LIES BEYOND THE WASTES, DEEP AF OUT ON THE EDGE OF KNOWN EARF.
>
> IF THE WET SHIT CANNOT BE STOPPED, AND IT SWALLOWS THE FP WHOLE, ALL WHO REMAIN... WILL TURN STONE COLD SOBER.
>
> 4 EVZ...
So after reading this - it seems this film is really all about the alcohol, but yet our main characters are rarely consuming it. Probably not something you want to base your movie franchise off of if all the characters are consuming copious amounts of alcohol.
The film starts off with us learning that at least 18 years has passed since the last film and JTRO/CHAI-T's daughter has just turned 18\. All our characters in this film are much more focused and training for some unknown event. The 4 main characters (JTRO, CHAI-T, KCDC and CHAI-TRO) end up coming upon a portal in the hills/mines. When CHAI-TRO approaches this portal she somehow "beats" back in time into Bako.
So now we've mixed time travel into this and it just adds to the confusion. What further makes this a confusing movie to follow is how much the spoken language got turned up to insane levels. We are talking replacements for words and the order of words that are funny the first time and then beyond annoying by the 15th.
"FP3: Escape from Bako" Clip
> We're just going through immigraties, while they chin wag us up and down.
> Lates yo
The enemies this time appear to be recycled and somehow still alive - so we have both L Dubba E and AK-47 back with some adaptions in the 3rd film. The family is united to solve this Bako puzzle, but we learn at some point from JTRO that CHAI-TRO's twin died around birth. I wondered why they were telling us that as it seemed to make no difference, but alas the 4th movie connects that dot.
JTRO however could not beat L Dubba E in the final showdown, but it did not matter. Like we know from plot armor - he does not die and instead AK-47 flips to be good as he realizes he is ATRO and not meant for the evil side. The arrival of backup and AK-47 changing sides pushes L Dubba E off the edge and the threat is neutralized.
Or so we think. The movie ends on a cliff hanger that this reunited stronger family must work together to fight one more enemy for the fate and survival of The FP.
---
FP 4EVZ - 2023 (R) - 1h, 14min - [Trailer](https://www.youtube.com/watch?v=AgN6wM7IvI4&ref=connortumbleson.com)
> A legendary family of rhythm game warriors must battle their way deep into the future to save what remains of a booze fueled humanity from a horrific calamity that threatens to turn them all stone cold sober 4 EVZ.
The 4th film starts off with narration from JTRO who helps piece together the back story and history of this universe. I'll break it down in simple bullet points.
- Ducks ruled planet prior.
- Beat Massa X came from stars introducing Beat-Beat Revelation and a comet full of booze.
- Beat Massa X enslaved people with alcohol dependencies and killed the enemy known as the "beat wars".
- Beat Massa X introduces "rage" to recruit followers for him (the red).
- CHAI-T is the Beat Battle Queen from the Wastes
- CHAI-TRO went back in time in history to blow up the comet of booze.
- Rain is coming and will make everyone sober and frozen.
What I've also started to pick up is the cheaper a film is the more green screen that is involved. I'm not sure when that changed, but at some point I guess it became cheaper to fake scenes than make them. However, seeing this movie was filmed during COVID - I'm guessing that restriction was forced rather than intended.
The movie begins with JTRO & CHAI-T dancing in some prehistoric ruins in order to unlock a portal that somehow has a hologram of JTRO's mom. This hologram explains in another odd forms of words that a fountain of life exists that contains booze which can revive fallen beaters and can be used to revive those lost in the "wet shit".
(She also explains you cannot stop the rain)
Turns out however if you use this fountain you'll awake some enemy and also need a certain type of person with a certain type of object. So it seems in the first 15 minutes we've established a ton of back story and the plot of this film.
The spoken language this time about broke me. I didn't think I could hear the word "earf" or "youse" one more time. As the clip shows below we have some interesting phrasing of words and tons of layers of video artifacts.
"FP 4EVZ" Clip
> Aight. But shut your chex guzzler, cause I only be spittin' this shit once, okay?
> But that does not mean you should jack yourself of enjoying this mome-y-do you've earned.
As JTRO & CHAI-T return home with this knowledge - they party until a human with a red duck mask appears and takes CHAI-TRO hostage. This embarks the main characters on a quest to chase this enemy all the way to where the final showdown occurs. They'll of course have to compete some challenges on that journey which no matter what will have something to do with dancing or punching.
As this happens we learn the enemy they are chasing is actually the brother who apparently did not die when the family gave birth 18 years ago. This made zero sense to me as they made it perfectly clear he was dead and the guy looked 40 years older than JTRO anyway. It turns out that its a common pattern in this film to have new family members appear on every single film.
Right when they meet up with the enemy - he takes one bullet and shoots CHAI-T dead. This is the Beat Battle Queen so I find it a bit dumb that she takes a single bullet to the chest and dies.
Fortunately, JTRO and CHAI-TRO end up battling their own battles to awaken some space craft and obtain some booze that would revive CHAI-T and they succeed. It was hard to trust that this daughter who had zero training till 18 could fight in battle to win these engagements against established enemies, but she did.
The movie is quickly over and threats neutralized and The FP is back with alcohol flowing. That seems like the end until the end credits scene where we see JTRO has chased down the space craft that escaped at the end of the film. I don't think I have it in me to see a 5th movie, but one might occur.
---
All in all - the first movie I watched with others and it was a laughable experience despite all the flaws. It's tough to make a bad movie intentionally and replicate what you see with movies like "The Room" or [Neil Breen](https://connortumbleson.com/2018/11/05/discovering-neil-breen/).
Watching the next three films alone was tough to do. At many points during the watching I was wondering why I was doing this to myself. The 4th movie about broke me - it was clear at many points that folks were just acting in front of a static green screen. From the other side though - making four movies with a small budget is no easy task, so I've got to hand over props for that.
If you want to learn more about these films. You can find them on the free streaming services, but you can purchase them if wanted from the [official JTRO Link Tree](https://linktr.ee/JTROPresents?ref=connortumbleson.com).
Since I imagine over time a few Google searches will land on this page. Here is a glossary of terms I've picked up watching these films for this post.
**Glossary**
| Water | "wet shit" |
| ----- | ---------- |
| Dead | "dirt nap" |
| Earth | Earf |
| Booze | Quatro |
| Kids | "pups" |
### CSS Framework Evolution
URL: https://connortumbleson.com/2023/05/29/css-framework-evolution/
Last updated: 2025-02-04T11:42:36.000Z
Photo by [Robert Katzki](https://unsplash.com/@ro%5Fka?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A long time ago I wanted to build a website and I did using nothing but my own code for the interface and logic behind the scenes. This site was absolutely garbage from a design perspective and was quickly abandoned after it became obvious that any change would break 15 other things. The site had no support for any screen size except for the one it was built on, so I went on the hunt for a mobile friendly CSS framework.
text based game - 2010
A few months later I started another site and used [jQuery Mobile](https://jquerymobile.com/?ref=connortumbleson.com) to help build out the mobile design. I wanted to spend less time building the boilerplate and just working on the project itself. Unfortunately, this site did not have anything worth designing for as it was meant for mobile viewing.
It was also such a weird site that an entirely different experience was delivered for mobile vs desktop. Nowadays you'll find frameworks that are responsive friendly for all types of screen sizes.
MIUI Stats (MIUIAndroid) - 2012
Ten years ago jQuery was all the rage and this design pattern was common to see. However, the next project I started I wanted to use a different CSS framework and thus stumbled upon [Semantic UI](https://semantic-ui.com/?ref=connortumbleson.com).
[https://semantic-ui.com/](https://semantic-ui.com/?ref=connortumbleson.com)
This framework had quite a plain method to build a button, which looked like.
```html
```
So I found myself building [Panda Love](https://connortumbleson.com/2021/02/22/pandalove-clan-site/) and [LeafApp](https://connortumbleson.com/2021/03/08/project-leafapp/) and a few other private projects all in Semantic. As years went on I ran into some problems here and there with the project and it was seemingly becoming abandoned. So I started following this community fork known as "[Fomantic UI](https://fomantic-ui.com/?ref=connortumbleson.com)", but I felt there had to be a newer alternative.
[https://getbootstrap.com/docs/3.3/](https://getbootstrap.com/docs/3.3/?ref=connortumbleson.com)
However, I couldn't fight ignoring Bootstrap any longer and produced a few sites privately that leveraged it. I felt it was overused so I initially stayed away from it. A Bootstrap button also leveraged pretty much the same markup, but with the common prefix shorthand that most engineers have memorized now.
```html
```
As Bootstrap evolved I followed a few major upgrades, but found another framework that took my focus as Bootstrap 4 was released.
[https://get.foundation/index.html](https://get.foundation/index.html?ref=connortumbleson.com)
I started building a project in Foundation and that was a quickly ended journey. The framework seemed extremely professional and organized supporting tons of great features like accessibility, but the design looked so bland I felt like it wasn't a good fit. I struggled so much trying to build something that felt good to me and fought the framework so often.
The button example though rivaled others in terms of how you could get something going with near zero code. A simple class of "button" laid down the foundation for everything you needed.
```html
```
However, Foundation and I weren't meant to be. So I went hunting for a different framework and stumbled upon Bulma.
[https://bulma.io/](https://bulma.io/?ref=connortumbleson.com)
This project felt like Semantic UI, but with active development and a great set of documentation to learn from. I built [Leaf](https://connortumbleson.com/2023/04/17/project-leaf/) and [Halo Depot](https://connortumbleson.com/2021/03/15/project-halodepot/) and a few other private projects with Bulma.
The basic button HTML matched that of Foundation.
```html
```
This gave you a good chance of collisions if any other framework used the common names, but I found if I started a new project and only used Bulma and refused to include 3rd party extensions - things worked well.
As 5\~ years went by - it seemed Bulma only had a few releases and was also aging. The world had moved towards [CSS variables](https://developer.mozilla.org/en-US/docs/Web/CSS/Using%5FCSS%5Fcustom%5Fproperties?ref=connortumbleson.com) which looked like such a great enhancement to more easily leverage "dark mode".
This blog at the time of this writing uses CSS variables heavily in order for the light/dark toggle to swap the theme in one quick movement. That is my only large complaint with Bulma at the moment - that I don't have an easy way to support a dark/light theme.
So once again I went looking - this time landing on Tailwind CSS.
[https://tailwindcss.com/](https://tailwindcss.com/?ref=connortumbleson.com)
I haven't actually completed a project myself using Tailwind and I'm not exactly positive why yet. It could be the large shift to a utility based framework or that I get confused whether to use `@apply` or make custom components.
Either way - this latest framework might not be my choice in a few years like has been shown prior, but it looks exciting either way to try a new one out.
### Project: Tampa Resists
URL: https://connortumbleson.com/2023/05/22/project-tampa-resists/
Last updated: 2025-02-04T11:42:36.000Z
Tampa Resists Homepage
To continue filling the [Projects](https://connortumbleson.com/tag/projects/) tag - I must document before the test of time claims another hobby project. Unfortunately for this site - it has been coasting without updates since 2017 and full of dead and broken links.
This is Tampa Resists and was a recruiting/welcome page to attract folks to play Ingress on the Resistance team in Tampa Florida. The longer you play Ingress the more important is to communicate with your team at a local and regional scale - so you need to trust folks and connect them.
Ingress is 10 years old at this point so it isn't fair to say one specific account was used, but for the most part Google accounts were the method to authenticate against 3rd party sites.
So this site allowed you to do a few things:
- Sign up with Google
- View Tips
- View Lessons
- View Portal Hotspots (areas with many portals)
- View Regional Stats
- Automatically Invite to Slack
So if you were brand new to the game - chances are this link was floating around in chat or online.
tips and lessons
Since most newbies had an infinite amount of questions and the official Niantic source of information was bare - this was just a collection of community built lessons and tips.
This commonly answered questions of like:
- What is the point of a JARVIS Virus?
- What is a SBUL?
At this point in the game's history official documentation exists for about 90% of this content.
If you were a veteran to Ingress and just traveling to our area. Chances are you probably just wanted to know about the best areas to visit for Ingress, which would be areas with a ton of portals.
hotspots
The hot spots tab would answer that question and provide Intel links and Google map links to all the areas. However, we got frequent complaints that most preferred an interactive map to mark all the locations instead of a table.
Looking back at this list - all those locations are still valid, but the amount of portals has only increased by 1-3 times per area.
stats on stats
If you were verified and trusted you could view stats, which were nothing more than the saved network requests of the regional scoring. I've attached one below which is what the site used to iterate/combine and build some interesting stats.
It seemed like a pretty cool thing to do, but boy doing anything with network calls was so looked down upon - work on it was abandoned. It was associated with cheating and while I believed some harmless stats were harming no one - others thought it was a breach of their privacy.
```json
{
"result":{
"card":{
"cellIdToken":"88c3",
"regionName":"AM04-KILO-01",
"scoreCycleTitle":"2017.30",
"currentScore":{
"alienScore":"474013",
"resistanceScore":"926503"
}
},
"regionVertices":[
"01b33708,fb047bb8",
"019c69cf,fb047bb8",
"019b5ae4,fb198035",
"01b21e38,fb198035"
],
"regionImageUrl":"http://lh4.ggpht.com/O2BwUTw2BTRgJfafQmHPE56pjnj4mH7wCkxtpRQ5JpkmnSalZiuCx2aCfgNJNlYnMj3Jbnq_5Z9TziKHyOUC3P_dN6xtF7pIeLgm-lM",
"regionImageTopRight":"01b60e2a,fb29d06c",
"regionImageBottomLeft":"019861da,faf42b83",
"topAgents":[
{
"nickname":"EvoldicA",
"verifiedLevel":16,
"team":"RESISTANCE",
"isViewer":false
},
{
"nickname":"SakataMoonfall",
"verifiedLevel":16,
"team":"RESISTANCE",
"isViewer":false
},
{
"nickname":"hexteria",
"verifiedLevel":16,
"team":"ALIENS",
"isViewer":false
}
],
"cycleTimelineDetails":{
"baseCyclesPerDiem":5,
"baseCycleDurationMs":"18000000",
"timeLeftInCurrentBaseCycleMs":"4019",
"multipliers":[
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0,
1.0
],
"scoreHistory":[
{
"alienScore":"495803",
"resistanceScore":"307084"
},
{
"alienScore":"148234",
"resistanceScore":"190427"
},
{
"alienScore":"125628",
"resistanceScore":"270113"
},
{
"alienScore":"1462781",
"resistanceScore":"317677"
},
{
"alienScore":"118760",
"resistanceScore":"291743"
},
{
"alienScore":"114716",
"resistanceScore":"462070"
},
{
"alienScore":"115310",
"resistanceScore":"420889"
},
{
"alienScore":"103139",
"resistanceScore":"370832"
},
{
"alienScore":"352190",
"resistanceScore":"184187"
},
{
"alienScore":"111060",
"resistanceScore":"368975"
},
{
"alienScore":"109481",
"resistanceScore":"400416"
},
{
"alienScore":"167913",
"resistanceScore":"394266"
},
{
"alienScore":"203357",
"resistanceScore":"172680"
},
{
"alienScore":"523390",
"resistanceScore":"228240"
},
{
"alienScore":"503335",
"resistanceScore":"228682"
},
{
"alienScore":"153581",
"resistanceScore":"224460"
},
{
"alienScore":"145836",
"resistanceScore":"280716"
},
{
"alienScore":"145661",
"resistanceScore":"190279"
},
{
"alienScore":"158127",
"resistanceScore":"189853"
},
{
"alienScore":"165336",
"resistanceScore":"194587"
},
{
"alienScore":"225049",
"resistanceScore":"183637"
},
{
"alienScore":"196122",
"resistanceScore":"200843"
},
{
"alienScore":"194509",
"resistanceScore":"191651"
},
{
"alienScore":"194853",
"resistanceScore":"187963"
},
{
"alienScore":"526289",
"resistanceScore":"191868"
},
{
"alienScore":"164776",
"resistanceScore":"201287"
},
{
"alienScore":"157481",
"resistanceScore":"162211"
},
{
"alienScore":"109652",
"resistanceScore":"136269"
},
{
"alienScore":"142976",
"resistanceScore":"136140"
},
{
"alienScore":"131424",
"resistanceScore":"178412"
},
{
"alienScore":"156268",
"resistanceScore":"193396"
},
{
"alienScore":"144792",
"resistanceScore":"183301"
},
{
"alienScore":"4301503",
"resistanceScore":"212618"
},
{
"alienScore":"4303789",
"resistanceScore":"202049"
},
{
"alienScore":"217358",
"resistanceScore":"24177790"
}
]
}
},
"gameBasket":{
"gameEntities":[
],
"inventory":[
],
"deletedEntityGuids":[
]
}
}
```
As shown in the snippet it was all the properties given to tabulate and produce the images above. You got:
- All checkpoint scores
- The top 3 agents
- The final score
- The date of that cycle
A bunch of other fields that never ended up being used, but helped show a picture of how Niantic engineered their API.
Finally, if you were an admin you had a special little admin portal that turned the navigation bar red to help you remember.
admin panel
This page did some cool API work with Google and Slack. You could automatically invite the person to our Slack channel via a single button click. It would automatically name them after first name and agent name so the our channel had some organization to the naming of folks.
You could also invite them in one click to a Google Hangout chat, which we used more-so for the visitors. This chat was then automatically synced with a #visitor Slack channel and for a period of a few years - all of these things worked wonderfully.
Until they broke.
- As Ingress v2 (Prime) came out - the API got a boost in security, which officially ended the stat feature.
- Google+ shut down which destroyed tons of communities and links and the scopes we used to obtain profile information.
- Google Hangouts was changed into Google Chat and this broke all the APIs that were using it.
- Ingress communities migrated away from Slack/Hangouts into Telegram/Discord.
I never actually owned the domain used for this project. It was a subdomain on a popular Ingress themed domain. I forgot who paid or organized it, but they summarized it quite well the purpose of these individual subdomains.
> This domain provides subdomains for regional [Ingress](http://www.ingress.com/?ref=connortumbleson.com) Resistance groups. We do this to promote community discovery and provide a "nice looking" custom domains to communities that would prefer not to purchase their own domain.
> Generally, we try to follow [craigslist naming](http://www.craigslist.org/about/sites?ref=connortumbleson.com) for easy discovery and to avoid collisions and ambiguity.
> The individual groups are run by their local communities.
Looking back - I did this same style of site for the Fayetteville, Arkansas and Tampa, Florida communities. I learned a lot from the 1st iteration of Arkansas which led to the additional features on the 2nd try.
For now - just a little Ingress playing here and there.
### The Tampa Gulf Parks
URL: https://connortumbleson.com/2023/05/15/the-tampa-gulf-parks/
Last updated: 2025-02-04T11:42:36.000Z
[Tampa Gulf Parks](https://www.google.com/maps/d/edit?mid=1tsDFVZIwsrpY27sa-SUrG8cMnFCuuco&usp=sharing&ref=connortumbleson.com)
Much like I did in [2021](https://connortumbleson.com/2021/08/23/the-parks-of-tampa/) I want to recap some gulf facing parks and give a bit commentary about them.
---
### Fort De Soto Park
[Website (Pinellas Country)](https://pinellas.gov/parks/fort-de-soto-park/?ref=connortumbleson.com)
- 7am to sunset.
- $5 dollar per vehicle + tolls on road inland.
- Tierra Verde, Florida
This park is at the very southern point of St. Petersburg and you are basically inline with the Skyway Bridge once you've made it the park. The park is insanely long and winds in a big U shape. At various points of that U you'll find:
- 7 miles of beach
- Kayaking
- Picnic Shelters (15+)
- Fishing Pier
- Military Museum
- Dog Park
- Food
- Boat launch
- Playgrounds
This park I discovered during visits in finding some rare Ingress portals. I originally came to walk the fishing pier to the end and stumbled upon some food once that was done. At that point I saw the dog park and kayak launch and realized I had to come back.
The dog park and associated beach section is the coolest thing to dog watch. Watching all these various dogs rush into the water and run around like hyenas is a fun activity to watch.
This park ramps up in popularity as the day goes on. I arrive around 7:30am to catch some ferries and the place is quite empty at that time. However, once returning from a ferry visit to a near by island you might find every single parking spot in the popular sections full.
One downside about this park is the no alcohol rule which is strictly enforced. Staff monitor the area so the only acceptable area to consume alcohol is from your boat on the islands off the coast. At first I was really against this, but now that I see the damage and trash that alcohol allowed parks bring - it must be the reason this park continues to be pristine. Humans cannot be trusted to leave no trace when alcohol is involved.
---
**Honeymoon Island**
[Website (Florida State Park)](https://www.floridastateparks.org/honeymoonisland?ref=connortumbleson.com)
- 8am to sundown
- $4 per vehicle (solo), $8 per vehicle (up to 8 people)
- Dunedin, Florida
If you pivot away from the south and head north you'll run into a state park known as Honeymoon Island. Accessible from Dunedin after a simple drive across the causeway and you are in.
Once again Ingress was the first reason for me to visit this park and I quickly learned that most of the nature trails partially close during the nesting season for the eagles. However, not to worry you can take an alternative route that goes out towards the water/beach and loops you back inland towards the end.
This park is much like De Soto in the sense of a long stretch of beach, just a bit smaller at 4 miles of space. What makes this park stand apart is the unique slash pine trail which holds home to many sorts of ospreys and eagles. You can walk for a mile on a pure nature trail just to arrive to a little private beach of sand - something no other beach can claim.
This park emits some serious heat which I oddly don't feel at other parks. I'm guessing the large amounts of trees present slow down the breeze and lead to just the sun beating down on you. Pair with the immense mosquitoes present on the nature trails and you'll be bitten and sunburn by the time that trip is over.
---
**Picnic Island**
[Website (Tampa)](https://www.tampa.gov/parks-and-recreation/featured-parks/picnic-island-park?ref=connortumbleson.com)
- sunrise to sunset
- Free
- Tampa, FL
The only free park to make this list and located on the absolute southern part of Tampa much like the military base. Driving to this park you feel like you are in the wrong area the entire time. You are squeezed between highly industrial gated & fenced areas and the highly secure port of Tampa. At some point maneuvering between these narrow roads you end up at the entrance to the park which is notated by nothing more than a single color sign.
However this park makes up for the bland entrance with some unique attributes:
- 24 hour boat ramp
- Disc golf course
- Sand volleyball courts
- 15 shelters
- Dog beach
While other parks may be a state or regional park - this is just a regular ole Florida park that is free. I believe that really sets it up to be a locals only sort of park. The park doesn't market itself as anything more and paired with the odd location - it looks like a park for the locals.
I'm glad for it - the other parks tend to be very over populated and this park on all my visits is just right. While every shelter seems to be sold out on every visit the parking lots are always full of spots to park. The kayak launches are very close to parking and folks tend to be very talkative and friendly at this location.
---
I can visit any of these parks from my current location within an hour's drive. So depending on my mood for nature or beach paired with travel time and I've got plenty of options to pick from.
### Lost Treasure: K'NEX
URL: https://connortumbleson.com/2023/05/08/lost-treasure-knex/
Last updated: 2025-02-04T11:42:36.000Z
K'NEX Power Tower Crane Kit
A couple years ago I started a new [blog tag](https://connortumbleson.com/tag/lost-treasure/) to look into items of the past and it started with [Rokenbok](https://connortumbleson.com/2020/10/05/lost-treasure-rokenbok/) and continues with another toy: K'NEXs.
K'NEX was a toy that was an alternative to LEGOs because they worked a bit differently. A K'NEX structure as seen above was much more wire-frame in shape with rods and connectors to connect the pieces. This can be seen in stark comparison to LEGOs which was just a collection of plates and bricks.
Now of course if you look at both those toys in present day - they introduced so many different pieces that anything that was once specific to one toy is no more. So we should turn the clock back to the 1990's to look at how these toys were \~20 years ago.
> K'NEX was founded in 1992 by a Joel Glickman - a company behind K'NEX known as K'Nex Industries Inc stayed involved until selling the company to Basic Fun! in 2018.
If you purchased the above Power Tower Crane in 1998 you'd get an instruction manual included, which in the case above would be a 44 page colorful document ([pdf](https://connortumbleson.com/uploads/2023/05/power-tower-crane-1998.pdf)).
page 41 of construction manual
If you've ever built IKEA furniture you know this style of showing all the pieces is quite common, but what IKEA does is establish a shorthand notation for each piece type. So you might be struggling to find piece J4, but for K'NEX the idea is a bit more simpler. Pieces within the same family are different colors so there is no need for piece shorthand. Quite obviously IKEA will do that because you don't want furniture that is visibly built with every possible color screw and bolt - so they must establish a different method for identifying pieces.
That means once you are on a build step - you can follow the colors of the depicted diagram to lead you to that successful build step.
page 5 of construction manual
This doesn't look too bad to follow, but I vaguely remember this style of instruction being hit and miss with kids in the 90s. Some much preferred the style of LEGOs and thought this above design was difficult to follow.
Depending how you felt - one great feature of K'NEX manuals were including a subsection that showed you where the piece belonged in what you were building and what it should look like up to that step.
top of page 5 of constructional manual
You can see on the image above this one you are building step 5, 6 and 7 which combines with the full step 1-7 to build the bottom left section of the tower.
We can take a look at a manual from around that time with LEGO and we get the below guide. A much easier tiny building of the greater city, but isolated in its own building manual.
[City In Flight Manual](https://connortumbleson.com/uploads/2023/05/city-in-flight-2006.pdf)
Color plays a big role in this guide as well with a more individual step by step approach. I'd just argue that each step for K'NEX is much more involved than a single step on this LEGO guide. However, perhaps comparing the Power Tower Crane towards the City In Flight is not an equal comparison.
Either way - it was immensely fun back then building the Power Tower Crane even if my room was packed with pieces a tiny tower taking all the room.
Too bad no pictures of that achievement are left around. It'll just live on in memories and this post.
### Camera in the Attic
URL: https://connortumbleson.com/2023/05/01/camera-in-the-attic/
Last updated: 2025-02-04T11:42:37.000Z
tools prepared for the build out
A few months ago I attended a neighborhood meetup and there was one overheard discussion that really caught my ear. This individual was telling another about how they discovered they had a family of raccoons living in their attic. I was quite confused hearing this because it seemed like something you could clearly hear or protect against.
I then discovered that same conversation on Next Door and had the oddest idea. I wanted to wire up a camera in my attic for the sole purpose of monitoring something that will never happen.
So I started researching Ubiquiti cameras that could support some intense heat. While I found the operating temperatures for all of them - I went towards [Reddit](https://www.reddit.com/r/Ubiquiti/comments/loi5k9/unifi%5Fcameras%5Fin%5Fhot%5Fclimates/?ref=connortumbleson.com) to give me some real life feedback on them. It turns out the G3 Flex ($79) was the way to go - plenty of great feedback of running them in hot ambient weather.
So I measured out some CAT6 and got my fishing tools in order. I got very lucky with this fishing attempt and I got my line fished from the attic into my office in one go. It was more difficult running the line down that molded cover into the switch then going through the wall.
Office cable mess.
Now this plate needs to be redone, but that's for another time. I remember when I ran my two access points I didn't have any of the pieces left to mount an Ethernet port on this 4 port adapter. So what ended up happening was just running the wire through the wall all the way to the switch without a break.
So I did that again shoving an additional wire through one of those holes. I am thinking if I gain another cable I'll swap for one of those mesh multiple cable ports and a two port adapter for the already spliced ones.
a messy mounted 10U rack w/ switch
Once that was done - a new cable was lodged into the POE section of the switch and it was time to return to the attic.
Building an Ethernet cable in the intense heat of an attic is no joke. The pure sweat building up as I sat up there building a B cable was rough. I was very grateful when I plugged in the cable tester and watched the numbers 1 through 8 work perfectly.
making a cable and testing it.
For those wondering how I could confirm the cable was working with only seeing one side of it - I cheated. I joined a Discord call and live-streamed the other end of the lights, then one quick call to a friend to relay the numbers out loud and I could confirm this was all wired in the proper way.
So now it was time to mount this camera on the back wall of the attic so it could see all and hope that UniFi OS would detect it. The mount bracket for the G3 Flex was just two little screws that I could screw in without any drill. Since the camera weights next to nothing - this makes sense that I didn't need a fancy mounting setup.
G3 Flex shows up.
It had some day zero updates to do, but once that was done - it showed up with a nice overview of my attic.
Protect module of UniFi OS
So all of that effort and now I have a direct feed to review my attic and the enormous air condition unit that it monitors.
Attic camera online.
I'm not sure how to explain this to the next person that visits my attic. My guess that might be some air conditioning guy soon as that thing pictured above was manufactured in 1996 and bound to fail with this upcoming summer heat.
Until then I'll hope that the intense ambient heat doesn't break the camera.
### Travel Blog: Jacksonville
URL: https://connortumbleson.com/2023/04/24/travel-blog-jacksonville/
Last updated: 2025-02-04T11:42:37.000Z
Photo by [Trevor Neely](https://unsplash.com/@trevorneely?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
When the clock struck 6 in the morning on April 21, 2023 - it was time to pack the bags and prepare for a drive to Jacksonville. Since I had no flight to make and no perfect schedule to align with - this gave me a bit of time to clean up the house so I would arrive home to a clean space.
So I jumped in my car - set the directions and set off on a 3\~ hour drive for Jacksonville from Tampa. Of course though only 1 hour into my trip I saw an opportunity to detour to visit an island that contained an Ingress portal. So commonly known in the scene as a water portal.
Home to Jacksonville
Looking back - I should not have done this detour as my 3 hour drive became a 4 hour and 55 minute drive. I added 2 hours of extra driving by cutting inland to Leesburg instead of going straight north.
This drive had way more nature and interesting sights than a normal trip on a straight shot on I-75\. Once I arrived to Jacksonville I checked into my hotel and looked all the BBQ places in walking distance.
a sad bbq sandwich
This landed me with a place known as [Jenkins Quality Barbecue](https://jenkinsqualitybarbecue.com/?ref=connortumbleson.com) which website looked promising, but in actuality it was pretty bland. It was a regular hamburger bun with a mess of sauce/beef around.
I ate it and took the lemonade to go, but it was a pretty bad first meal in Jacksonville. After I had a chance to talk to some locals - they didn't even mention this place in their personal top 3 BBQ locations. So I guess I messed up in finding a place to eat BBQ.
As I walked around it was pretty crazy to have 3 bridges within walking distance of each other and each one was built incredibly differently.
John T. Alsop Jr. Bridge
On my way back to my hotel - this bridge above went up for a sail boat and that was a sight to see. An enormous bridge lifting into the air with huge slow moving steel wire is such an industrial feat of engineering. Unfortunately I was on the pedestrian bridge when this occurred so I couldn't get a good angle for a photo of the raised section.
Saturday morning I went on a run over the bridge onto the river walk and that was a run with such an interesting view. However, had an odd interaction with a homeless individual that was incredibly upset at me for running on the river walk. I thought it was isolated to me, but then he started chasing some other random people who had just walked by.
Garmin Connect map recap of 4/22/2023 run.
As I walked around downtown it blew my mind how many stores were closed in the middle of the afternoon on a Saturday. I wanted to go to Quiznos and it was closed for the entire weekend, so I walked over to Jersey Mikes and it was closed for the day. So I walked into a 7-11 and bought an ice cream and a vitamin water for my lunch.
As my event ended and Sunday came - I took a straight shot on I-75 back home. I got lucky because the construction signs said "*driver going wrong way on I-75 be cautious*" and that must have caused a terrible accident on the other direction. The north bound I-75 was stopped and blocked for what looked like miles.
Police were stationed at all the emergency turnover points blocking cars from attempting to do a U turn on the highway. This seemed like a mega terrible situation for those trapped on a closed highway. We were in the middle of no where so there wasn't even an exit for folks to leave from. When I got home Twitter didn't have anything extra about this - so not sure exactly what happened.
> Updated: Crash in Sumter County on I-75 North, beyond MM 326\. All lanes closed.
> [https://twitter.com/fl511\_i75/status/1650137351040151553](https://twitter.com/fl511%5Fi75/status/1650137351040151553?ref=connortumbleson.com)
So then I got home and another 3 day vacation weekend was over and my [travel blog tag](https://connortumbleson.com/tag/travel/) gained another post.
### Project: Leaf
URL: https://connortumbleson.com/2023/04/17/project-leaf/
Last updated: 2025-02-04T11:42:37.000Z
About a decade ago I launched my first site responsible for obtaining stats from the then-current Halo game. When Halo Infinite launched Leaf was reborn as another site with a new stack of technology.
Laravel with [Livewire](https://laravel-livewire.com/?ref=connortumbleson.com) and [Bulma](https://bulma.io/?ref=connortumbleson.com) joined together to build a quick responsive template to take a more clean minimal approach to Halo stat design. I was just getting upset with the other sites in this ecosystem that either had ads everywhere or some heavy interface.
So I found a public API service known as [HaloDotAPI](https://twitter.com/halodotapi?ref=connortumbleson.com) to save me the stress of building both a stat platform and stat obtaining platform.
Leaf Overview
If you searched your own gamertag you would land on the page above. This was a basic quick overview page that showed people information they probably wanted to see. We cached it on the backend so next loads were extremely quick with the data refresh happening behind the scenes.
Of course everything seems fast when you build it, but then when you add \~40 million games into it - things do sadly slow down a bit.
Once you land on this page you see the top medals obtained as well.
Leaf Medals, Competitive & History page
The other tabs make jumps into pure competitive, a medal breakdown and a historical reference of games played.
Once you found a game you could jump into the game detail view of that game. This page took such a different approach to medals than I've seen anywhere else before. I struggled in previous Halo games showing medals for each player in an interface that didn't explode in visual space needed.
Game Details
This time I just grouped all medals together ordered by rarity and put the count and gamertag by the user who obtained it. This got some good feedback because folks could quickly see who obtained some rare medals without clicking on each person individually.
Building in export support for everything was an odd request I got on Twitter that seemed to explode in popularity. Most folks used this to export data and visualize it in some tools. It was even abused to the point that some folks automated dashboards via the CSV export I have - crawling it way too often.
When you move into the esports scene of Halo - I wanted to see the bracket without scrolling my browser thousands of pixels to the right. Once again I was upset with the required site to use as it put my computer to a crawl. Thankfully they had an API so I got to work.
Leaf HCS Integration
This took an interesting approach to reviewing what is normally a classic double elimination bracket. You could tab through losers/winners from above and the sidebar would let you move between rounds.
At some point I wanted to be able to click a team and have their entire history throughout the tournament visible, but I never got around to it. Related to competitive play I got request to combine the stats of multiple games in order to see the best performer of a series.
So I built out the scrim feature, which was pretty neat. You simply enabled scrim mode from either the local or custom game history and just checked boxes of the games you wish to be included. It even persisted the check boxes across pagination which was a cool built in feature of Livewire.
Leaf Scrim Overview
I wanted to gain some feedback on how to use these pages since I never use it, but never got any extra requests - so it sat.
When I noticed the site was quite popular - it made sense to investigate into some cool analytics. Once I passed 10 million games it seemed possible to build a fairly accurate leaderboard of stats. It may have been missing some things that the mega popular stat sites had, but I figured the leaderboards would correct themselves as people stumbled upon them.
Leaf - Most kills w/ 0 deaths
One top ten leaderboard that was extremely popular was the most kills in a game with zero deaths. Folks would share this on Twitter when the record was beat.
Now medals were something that I really wanted to show, but I didn't have the best database design to query it. All the medal data was basically serialized into a key/value array and dumped into a single column.
Leaf Medal leaderboard
So while the leaderboard was live - it got slow over time. What once took milliseconds to render now takes seconds. The [bug report](https://github.com/iBotPeaches/LeafApp%5FInfinite/issues/559?ref=connortumbleson.com) for that has been open for a bit and I think my only resolution is to process the top 1,000 of every medal and remove the live aspect of it.
The things I haven't talked, but I want to record into history.
- 100% test coverage
- fully automated ci/cd system
- automatic XUID comparison to detect renames
- automatic image optimization and caching
- open source
- zero ads
- zero trackers
- free
This iteration of Leaf is by far the best. The biggest issues it hits now is reacting to popularity which harms its rate limit and database size. The site may not exist anymore by the time readers read this, but it was hosted at: [https://leafapp.co](https://leafapp.co/?ref=connortumbleson.com) and the repository lived at: [https://github.com/iBotPeaches/LeafApp\_Infinite](https://github.com/iBotPeaches/LeafApp%5FInfinite?ref=connortumbleson.com).
### Random Stories
URL: https://connortumbleson.com/2023/04/10/random-stories-winter-2023/
Last updated: 2025-02-04T11:42:37.000Z
Photo by [Annie Spratt](https://unsplash.com/@anniespratt?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I've got a few interesting stories, but they can't survive on their own post so this is the recap.
---
**The Truck Shopper**
As I walk out of Publix towards my car - I notice a person just push their cart across the parking lot with a large push. However, what caused me to even focus that - there was no cart station in any area where this individual pushed that cart.
So of course it reminded me of that shopping cart theory that suggests you can detect the moral compass of an individual whether they put their cart back where it belongs. This individual jumps into their truck and I notice that shopping cart they pushed across is actually slowly rolling back.
As they back up - the shopping cart gained enough speed to start really moving and sure enough just rolled into that truck as it was backing up. It didn't just hit the back either - it hit the side due to the angled parking lot and just bumped/slide further down the side of the truck scraping the entire way.
Watching this individual get out furious and then realize nobody was around was priceless. The shopping carts got their revenge this time.
---
**The Older Gentleman**
I've been running at the same park every Saturday and Sunday since August of 2022\. If you keep a pattern like that - you can easily discover others that keep a similar pattern. I recognize the people who are there every weekend and they recognize me.
Except this one person - I saw them there every Saturday at various different points, but it always ended with them sitting in a field alone with two setup chairs. Typing this out and especially seeing that chair empty for months on end - I should have connected the dots.
However, one day my run ended at 46 minutes which put me halfway around the loop. So I cut back to my car right across that field where that person sat. I said some form of good morning and why that chair was always empty.
The gentleman responded that is wife passed away and she always liked to do a crossword puzzle at the park every week. So he brings her chair and a new crossword puzzle, but joked that he can't solve them though so just leaves them empty for her to do.
I don't even remember how I responded to that, but it was probably a rushed attempt to say something nice given the situation I put myself in. Either way - a lot more respect for that random individual now.
---
**The Missing Pineapple**
One day my neighbors garage broke - the little piece that attaches the chain to the door had ripped out all 4 screws. By the looks of the situation - it was down to 1 screw when it failed.
I somehow had the right tools and nuts/bolts to re-add 4 screws and reattach it. So my neighbor the next day gave me a full pineapple as a thanks. She included a note to cut it off near the top and plant it outside.
So I made some rum pineapple smoothies and did as she instructed and planted a pineapple in my backyard removing my dead pepper plant. The next morning I went out and my pot had dirt spilled everywhere and the pineapple plant was gone.
I walked around my backyard and found it in the corner with the bottom portion of the pineapple gone. So I'm guessing the fresh pineapple yellow portion attracted some critter to rip it out and eat it. I went back to the notes my neighbor left and I messed up completely.
I was supposed to keep that portion in water inside for the first few weeks until it developed roots. So that explains why it was stolen and eaten.
---
That was it - a tiny recap of some events in past few months.
### 300,000+ Scrobbles
URL: https://connortumbleson.com/2023/04/03/300-000-scrobbles/
Last updated: 2025-02-04T11:42:37.000Z
[https://www.last.fm/user/iBotPeaches](https://www.last.fm/user/iBotPeaches?ref=connortumbleson.com)
While I don't remember why - a long time ago in 2008 I signed up for *last.fm* and linked my Spotify account to it. This would then record every song I played for the past 14\~ years. Someone at work recently mentioned last.fm and my account was still surprisingly active. With this new huge collection of analytics - I wanted to look at the past 10 years and figure out what my most played songs were in each year.
---
**2013**
- I Came to Party (*Deuce*) - 245 plays
- Let's Get it Crackln' (*Deuce*) - 188 plays
- America (*Deuce*) - 163 plays
I don't remember much about this time period anymore, but its clear I was on a real Deuce/Hollywood Undead obsession. I remember learning how the lead singer on Hollywood Undead left and started his own band named Deuce.
The lyrics and songs were way more vulgar than what Hollywood Undead ended up releasing post separation, but I enjoyed the old Hollywood Undead vibe which I instantly remembered from the Deuce album.
So I played a lot of Deuce, but if we look at today - its near never. The songs don't really appeal to me anymore, but funny enough the new Hollywood Undead does.
**2014**
- Am I A Psycho (*Tech N9ne*) - 162 plays
- Bad Moon Rising (*Mourning Ritual*) - 117 plays
- Seeya (*deadmau5*) - 114 plays
This year reminds me really leveraging random songs that Spotify recommend for me. Also that I was seriously addicted to watching the TV show - "The Following" which heavily used Bad Moon Rising in its soundtrack.
**2015**
- Usual Suspects (*Hollywood Undead*) - 67 plays
- Day of the Dead (*Hollywood Undead*) - 63 plays
- Till It's Gone (*Yelawolf*) - 58 plays
This looks like that Hollywood Undead obsession came back, but I remember that it was because a new album had dropped. Spotify continued to get smarter and reminded me that I used to listen to a lot of Hollywood Undead, so it recommended the new album to me.
So of course - I found a few songs in that album I liked and played it a ton. However, you'll notice my top song play didn't even break 100\. I attribute this to failing to graduate in 4 years like most of my peers. Since I failed two engineering classes - I had to stay an extra semester in order to graduate.
This mean my normal behavior in 2015 was different than most and it was all focus, no fun which led to a decrease of music consumption.
**2016**
- Calm Down (G-Eazy) - 189 plays
- Me, Myself & I (G-Eazy) - 182 plays
- Order More (G-Eazy) - 176 plays
I believe I stumbled upon G-Eazy on my nights to the bars towards the end of my last semester in school. The beats and songs were catchy and it filled that bit of rap I enjoy listening to. I get into this behavior of just looping an artist until I'm burnt out. So based on the top ten of 2016 - I surely just listened to G-Eazy on repeat until I was tired of it.
**2017**
- Tried to Be Nice (*Witt Lowry*) - 108 plays
- Numb (*Witt Lowry*) - 99 plays
- Silicone Kingdom (*Witt Lowry*) - 99 plays
This was an interesting year with discovering Witt Lowry who I believe was just a far more explicit sounding Eminem. Based once again on the ten this became the same idea of 2016 - play an artist till death until burnt out.
**2018**
- Not Alike (*Eminem*) - 56 plays
- Fall (*Eminem*) - 51 plays
- Kamikaze (*Eminem*) - 49 plays
A very small sampling of music listening this year and I remember why. My old Hyundai port stopped working that I used to plug my phone into my car. So my only option for music listening was the radio. However, when I did have Spotify the new Eminem album Kamikaze took over my top ten.
This album felt like old Eminem and had some good tracks in it.
**2019**
- You're Going Down (*Sick Puppies*) - 64 plays
- Undead (*Hollywood Undead*) - 62 plays
- White Rabbit (*Egypt Central*) - 57 plays
I can tell this top ten is falling into the trap of "Discover Weekly" on Spotify. From getting burnt out of listening to artists or albums non stop, this method of having Spotify give me a playlist weekly of songs it would think I would enjoy was great. It would commonly bring up old songs and new songs and I'd always find a few to add into my liked set.
**2020**
- Cruel Intentions (*Delacey*) - 97 plays
- Lonely Gun (*CYN*) - 63 plays
- Undead (*Hollywood Undead*) - 58 plays
Another year - another year of Spotify's automatic playlists given to me. I can tell I watched Suicide Squad and pulled some songs from that based on the top ten. However, nothing much to add here - I don't remember anything specific except the start of a pandemic.
**2021**
- 30 (*Badflower*) - 107 plays
- Play with Fire (*Sam Tinnesz*) - 86 plays
- Anthem for the Year 2000 (*Silverchair*) - 86 plays
Another year - same story. I just listen to what Spotify gives me and once I find a song in the weekly collection I like - I save it and then overplay it until I'm exhausted from that song.
**2022**
- Lights and Sound (*Yellowcard*) - 72 plays
- Uptown (*Drake*) - 65 plays
- You're Going Down (*Sick Puppies*) - 62 plays
This year I can tell I started using the Spotify playlist called "*Your Time Capsule*", which found all my highly played songs in past decade. So for sure a blast from the past where I just listened to tons of songs that I overplayed back in the day.
**2023**
- When I Grow Up (*NF*) - 38 plays
- HOPE (*NF*) - 36 plays
- The Search (*NF*) - 36 plays
Finally, we are still in 2023 but I've been obsessed with listening to NF. The lyrics are great and extremely easy to understand with a dedication to putting out great albums often.
---
So if we take my top ten artists of all time - we get:
- Hollywood Undead - 9,837 plays
- Linkin Park - 9,678 plays
- Eminem - 6,380 plays
- G-Eazy - 5,020 plays
- The White Panda - 3,096 plays
- NF - 2,901 plays
- Drake - 2,594 plays
- Yelawolf - 2,287 plays
- Witt Lowry - 2,142 plays
- Deuce - 2,104 plays
I don't even know how to describe that collection of artists, but I'm glad I have the analytics to do further research on this.
### Homelab Software Recap
URL: https://connortumbleson.com/2023/03/27/homelab-software-2023/
Last updated: 2025-02-04T11:42:38.000Z
Photo by [Thomas Jensen](https://unsplash.com/ja/@thomasjsn?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Roughly a year ago I redid my entire home network and could then officially call it a [homelab](https://connortumbleson.com/2022/03/07/the-homelab-part-1/). Unfortunately the insane delays in acquiring Raspberry Pi's has put quite the delay in finishing this setup. So while I continue to sit and wait on available pieces - I want to recap all the software I've come to love and run on this network.
---
#### Pi-hole
*the ad blocker.*
[pi-hole.net](https://pi-hole.net/?ref=connortumbleson.com)
Pi-hole technically started in my network long before I built out a homelab. I started running it as my DHCP server in late 2017\. This is an immediate benefit of becoming a network wide ad blocking instead of say running an ad blocker in your web browser.
Now every device on my network has to resolve DNS through my Pi-hole instance which will null route anything it deems is privacy invasive or an ad. This has become a requirement to using the Internet as without it I immediatly notice the jarring addition of advertisements injected everywhere.
Thankfully when I'm on the go I can pair some of this software listed below to have my Pi-hole server helping no matter where I'm at in the world.
---
#### OPNsense
*the brains of routing and firewall. \[[official link](https://opnsense.org/?ref=connortumbleson.com)\]*
[opnsense.org](https://opnsense.org/?ref=connortumbleson.com)
OPNsense started on my network when I purchased a [TLSense 8550U](https://teklager.se/en/products/routers/tlsense-i7-8550U?ref=connortumbleson.com) and for never using either pfSense or OPNsense before - I struggled. This is a piece of complex software that has an interesting history behind it.
You can move the clock back to 2004 and find the [m0n0wall project](https://en.wikipedia.org/wiki/M0n0wall?ref=connortumbleson.com) which was a firewall distribution on top of FreeBSD. It ended up getting forked to become pfsense which was insanely popular. However, pfsense ownership switched hands and some odd license choices were used and most found an urge to return to the roots of what made m0n0wall popular so OPNsense was forked and born.
I use it for a variety of purposes:
- Firewall rules and configuration
- Wireguard setup for remote VPN when away
- DHCP server w/ static reservations
- Prometheus stats exporting
- VLANs for securing my wireless networks
- Utilizing the insecure UPnP for easier gaming
---
#### nzyme
*the defensive wifi monitoring*
[nzyme.org](https://www.nzyme.org/?ref=connortumbleson.com)
I configured and setup nzyme after hearing a Tampa local discuss it at a meetup. It was in its infancy at the time and was such a cool piece of software to log some immense details about my network.
It can detect devices are nearby and record time/dates so you can scarily build some logs of when those devices are near your house. They may belong to the UPS driver or a neighbor as their device networks out to my equipment. I [blogged](https://connortumbleson.com/2022/04/25/setting-up-nzyme/) in detail of about how I set this up and it always becomes a great discussion point at technical meetups to show folks what your network can discern.
Version 2 of this software is in active development and its going quite fast as the author has left his [job](https://www.nzyme.org/blog/project/2023/01/22/a-new-chapter-begins.html?ref=connortumbleson.com) of founding Graylog and devoted all time to this.
---
#### Grafana
*the visualization of collected data*
[grafana.com](https://grafana.com/?ref=connortumbleson.com)
Grafana is slowly becoming my entry point to check in on all my various services and data. Once you connect a data service, which in my case is Prometheus, I can create a custom dashboard to show what I need to see at a glance. What really blows my mind with this software is how many different widget types there are.
You can create:
- Time series
- Bar char
- Stat / Text
- Gauge / Bar Gauge
- Table
- Pie Chart
- State timeline
- Heatmap
- Status history
- Histogram
- Alert list
- Candlestick
- Geomap
- Node graph
- Traces
- XY Chart
This is where the confusion sets in - since if you start submitting your own data - what do you build? I'm currently trying to build out a weather dashboard from all the various information I have while also using the panels available from Grafana. Which has become a testing ground of like using a state timeline to show the difference between rain/no-rain throughout the week.
Once the remaining Raspberry Pi's show up, which will become data collectors, I'll have the pieces finalized and can push towards finalizing my Grafana dashboards.
---
#### **Prometheus**
*the data collection entity*
[prometheus.io](https://prometheus.io/?ref=connortumbleson.com)
You can't talk about Grafana without Prometheus and I recently did in detail in an [old blog post](https://connortumbleson.com/2023/03/06/grafana-prometheus/). Prometheus is the data collection workhorse that doesn't get much fame in this setup. Its UI isn't pretty and it doesn't do anything but orchestrate my data collection targets.
You setup targets which basically publish information to a webpage then you configure Prometheus to crawl that page at a frequency that you prefer. Right now I run queries every 60s which is an insane amount of collected data. I will gain an extra 86,400 data points every day from each configured target.
This is where Prometheus shines with its specific data format which takes advantage of the fact that this data is immutable once its obtained. This allows some interesting packing tricks to group and pack older data together. You can read about this technically on [their website](https://prometheus.io/docs/prometheus/latest/storage/?ref=connortumbleson.com) if curious about the storage technique.
So both Prometheus and Grafana run on a single Pi I have in this homelab. They work well together and are slowly being built out.
---
#### UniFi OS
*the switching/poe brains*
[ui.com](https://community.ui.com/questions/Introducing-UniFi-OS/2d19729d-0c49-440e-bd58-dd70e114d1b1?ref=connortumbleson.com)
UniFi OS is technically the software that runs on my UniFi Cloud Key Gen2 Plus, which I purchased instead of self-hosting the software on one of my own Pi's. While I initially hosted the software myself - the requirements it needed clashed with the software I had originally installed and became stressful to update.
So this hardware/software pair helps orchestra all the various Ubiquiti equipment I have, which is overkill for a home network no doubt. I've currently got:
- `USW-16-PoE`
- `US-8-150W`
- `UAP-AC-Pro`
- `UAP-AC-Pro`
In human terms this is
- A 16 port switch with 8 ports capable of doing power over Ethernet (PoE)
- A 8 port switch
- A wireless access point powered via PoE (2x)
So I can jump into the UniFi panel and config and review all my ports on my switch to label/filter them. I can create wifi networks that correlate to VLANs that my OPNsense software created. This allows me to put IOT devices and frankly other devices I don't trust on their own little network.
The interface is incredibly friendly and allows me to run rolling updates so I can slowly update my fleet of equipment.
---
#### Plex
*the media center masterpiece*
[plex.tv](https://www.plex.tv/?ref=connortumbleson.com)
Plex is what Xbox Media Center would have become if it was invented 20 years later. This is an amazing media collection piece of software for all the metadata handling it does. Toss it a video file and it will automatically parse the title card, information and organize it into seasons.
Plex has also grown to help combat the absolute insanity of streaming services out there. You can search content in Plex and it offers to find that content in any of the services out there. Say I want to watch "*See no Evil*" - it tells me that I can buy it on a bunch of various services or watch it for free on Tubi.
That is a great feature on top of managing my personal media.
---
All these various pieces of software help become my homelab when paired together. So when you walk near my place or connect to my network - these are the wonderful projects making that experience possible.
### Written by a Human
URL: https://connortumbleson.com/2023/03/20/written-by-a-human/
Last updated: 2025-02-04T11:42:38.000Z
Photo by [Giannis Skarlatos](https://unsplash.com/@eikosipente?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few days ago I saw an article on Hacker News that was titled "[not by AI](https://notbyai.fyi/?ref=connortumbleson.com)". The website purpose was to just add a badge to your content if it was produced without the use of AI.
(light badge)
(dark badge)
I kept reading this website, but then it looked quite odd when it was laying down requirements for using this badge. This isn't a company as far as I know - who cares if I make the badge a different color or size. That left a sour taste in my mouth so I made this blog instead.
The AI explosion in the past few months is no joke - if you look at [OpenAI](https://openai.com/?ref=connortumbleson.com) (ChatGPT and DALL-E 2) they grew their user-base to 100 million users in about two months. That is a record ([source](https://www.reuters.com/technology/chatgpt-sets-record-fastest-growing-user-base-analyst-note-2023-02-01/?ref=connortumbleson.com)) in consumer application history which just shows how quickly AI is becoming the discussion of 2023.
In a few minutes of searching you can find AI tools for tons of categories:
- Writing code - [GitHub Copilot](https://github.com/features/copilot?ref=connortumbleson.com)
- Image generation - [Midjourney](https://www.midjourney.com/?ref=connortumbleson.com)
- Meeting note generation - [Jamie](https://www.meetjamie.ai/?ref=connortumbleson.com)
- Voice generation - [Murf](https://murf.ai/?ref=connortumbleson.com)
From the ones I selected here - you can quickly see how content to consume will get more and more difficult to discern human generated vs machine. Imagine a company or business that writes a new post/blog weekly to stay relevant on searches. I'm guessing with a simple prompt of that week's content - the entire post may be generated.
This may not be a terrible thing as these tools continue to evolve, but I'm also nervous that much like SPAM dominates the amount of emails we get - that AI generated content will dominate our media consumption.
Where I'm really nervous is the scam department. Right now scams are pretty easy to detect between:
- Obvious generic messaging
- Broken English
- Automatic detection via Gmail
However, imagine a near future where you can ask an AI generation tool to generate a custom misleading email from the point of a view of a student. Now scam authors can target people with a wide variety of generated content which in turn may be more successful than the obvious static scams that exist today.
Take this scam email I got today.
> Greetings.
>
> I am Mrs. Rula Ghani,I am contacting you based on my personal interest to develop a mutual business relationship with you in your country or your company. which I believe we could mutually benefit from, The amount involved is $22,000,000.00 USD only.
>
> Please reply urgently for more details.
>
> I only write in english but i use Google translate to translate to vietnamese so you can read and understand.
>
> Regards,
> Mrs. Rula Ghani
This is taken word for word and you can see how obvious this scam is. One quick Google search of the contents and you stumble upon a post on [StopScamFraud](https://stopscamfraud.com/?ref=connortumbleson.com), which explains this is a [Advanced-Fee Fraud attempt](https://stopscamfraud.com/viewtopic.php?f=7&t=321&ref=connortumbleson.com). So if attempts to scam are generated uniquely each time - it'll get more difficult to teach others how to avoid being scammed.
For as much as it looks painfully obvious now - think that in February 2023 the [FTC reported](https://www.ftc.gov/news-events/news/press-releases/2023/02/new-ftc-data-show-consumers-reported-losing-nearly-88-billion-scams-2022?ref=connortumbleson.com) that $8.8 billion was scammed from consumers in 2022\. This blows my mind especially since fraud affects each generation differently. It may be the tech support scams for the grandparents, but the young adults are trusting get rich quick YouTube scams.
Fraud and scams will never change, but a few categories of scams may get a nice boost from the features that AI brings monthly.
For this blog - it'll be human written till the end. There is an added little bit of therapy writing weekly and no automation or tool will replace that. I won't add a badge, but you can rest assured that I am writing every post on this blog.
### Letting Dependabot merge
URL: https://connortumbleson.com/2023/03/13/letting-dependabot-merge/
Last updated: 2025-02-04T11:42:38.000Z
About a year ago I hit 100% code coverage on an open source project known as Leaf. I [blogged](https://connortumbleson.com/2022/01/17/goodharts-law/) about this when I hit that coverage marker and after a year its worked out quite well. Adding new large features is a pain from all the requirements, but little changes here and there I've now got full confidence in whether they regress or break the site.
So one thing I wanted to experiment with is if I have 100% code coverage - why not let Dependabot just merge what it wants?
For those unaware - Dependabot without configuration will present pull requests to your project when it detects a vulnerable dependency. It keeps the change-set small and only updates the lock file and required child dependencies of the affected one.
[https://github.com/iBotPeaches/LeafApp\_Infinite/pull/506](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/506?ref=connortumbleson.com)
I wanted to explore how to configure Dependabot to not only update for vulnerable dependencies, but to properly follow semantic versioning and update any package when a new version exists.
So I created a new configuration file in my project at `.github/dependabot.yml` with the following:
```yaml
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: daily
time: "04:00"
timezone: "America/New_York"
- package-ecosystem: npm
directory: /
schedule:
interval: daily
time: "04:00"
timezone: "America/New_York"
- package-ecosystem: composer
directory: /
schedule:
interval: daily
time: "04:00"
timezone: "America/New_York"
```
I opted into three different ecosystems for updates.
- Composer - for the PHP side.
- NPM - for the Node/asset bundling side.
- GitHub Actions - for the CI/CD pipeline.
So now daily Dependabot will check if any of my packages have a compatible version update and if so - present an upgrade. After about a month I've collected a mix of feedback.
---
**It doesn't auto-rebase between ecosystems**
If we have three pull requests put up and there is one in each ecosystem, the first one will merge and the other two won't automatically rebase because their monitored lock file was not updated.
This just causes me to manually rebase and delays the pure automation of this.
---
**It works too fast against me at times.**
With it running daily - if an upgrade is pulled or a mistake, but still results in a valid pass of test suite - it'll be merged. Take a look at the title of this one bugged merge I got.
```
Build(deps): Bump laravel/horizon from 5.14.2 to 515.0 #577
```
Clearly this was not meant to be version 515, but instead 5.15\. So once that bugged tag was removed and purged - I noticed some struggles to update dependencies as it could not resolve that tag anymore. Tracked it down to a [bug](https://github.com/laravel/horizon/issues/1257?ref=connortumbleson.com) and simply manually upgraded to the proper version.
---
**Upgrades are easy**
With isolated dependency upgrades it becomes night and day difference to understand which package caused regressions or broke the build. In the past every few weeks I simply ran a upgrade of all packages and that led to stress in identify which package caused failures among them all upgraded.
Now when I have an unmerged pull request - I know a breaking change was encountered and I can triage it as such. This helps keep the project up to date and allows me to move to new major version of say PHP and Laravel without much effort.
---
**Hands off**
I wake up and chances are my project has had a few merges already. With automation occurring near daily I know when I sit down to work on a bug or feature, a simple git pull and I can get straight to work.
---
**Additional Vector**
However, I understand that giving Dependabot the ability to auto-merge code has opened a new vector. If a dependency updates maliciously I would auto take that upgrade and possibly deploy it to production later on.
I'm not worried about the actual CI/CD vector though. Secrets are only exposed from the context of a deployment and build machines are random GitHub runners.
---
So take a look at the [repository](https://github.com/iBotPeaches/LeafApp%5FInfinite?ref=connortumbleson.com) \- chances are its still 100% covered with automatic Dependabot merges enabled.
### Grafana & Prometheus
URL: https://connortumbleson.com/2023/03/06/grafana-prometheus/
Last updated: 2025-02-04T11:42:39.000Z
Pi-hole Grafana Dashboard
A few weeks ago a Raspberry Pi I ordered quite awhile back showed up. This Pi was designated to be my new data collection Pi. The programs [Prometheus](https://prometheus.io/?ref=connortumbleson.com) and [Grafana](https://grafana.com/?ref=connortumbleson.com) were new to me, but research showed these were the ones to use.
For those unaware - these programs pair quite well together. For a quick personal breakdown of features:
**Prometheus**
- Collection of metrics/data
- Robust querying of that data
- Compact storage of that data
- Alerting of that data
**Grafana**
- Visualization of collected data
- Reports of that collected data
- Insights of that collected data
- Custom dashboards of that collected data
So as you can imagine - I can collect data via Prometheus and Grafana perfectly can ingest that data to visualize it. The challenge I had was figuring out how all this worked.
When you configure Prometheus - it spawns a data collection service on the same instance it was configured on. This is a tool known as "[Node exporter](https://github.com/prometheus/node%5Fexporter?ref=connortumbleson.com)", which basically sits on a host machine and collects information and listens on a HTTP port to make that information known.
What is simple about this program is it doesn't transmit information anywhere as itself. It just puts information on a URL that another service is responsible for pulling. It doesn't store it, it doesn't do much outside of putting metrics on a page.
That page is a basic little text file with some comments to help the parser.
```
# HELP apt_autoremove_pending Apt package pending autoremove.
# TYPE apt_autoremove_pending gauge
apt_autoremove_pending 0
# HELP apt_upgrades_pending Apt package pending updates by origin.
# TYPE apt_upgrades_pending gauge
apt_upgrades_pending{arch="",origin=""} 0
# HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.
# TYPE go_gc_duration_seconds summary
go_gc_duration_seconds{quantile="0"} 9.6315e-05
go_gc_duration_seconds{quantile="0.25"} 0.000136203
go_gc_duration_seconds{quantile="0.5"} 0.000305369
go_gc_duration_seconds{quantile="0.75"} 0.000580848
go_gc_duration_seconds{quantile="1"} 0.003516581
go_gc_duration_seconds_sum 64.884547092
go_gc_duration_seconds_count 159728
// ....
```
snippet of /metrics endpoint
There is way more than just that, but you get the picture. Now that I have this endpoint showing data - I can tell Prometheus to read that file every so often and record that data. I keep most of my analytics at the 60 second refresh pull, which is very often and may prove to be more data than I want.
Prometheus - classic targets
So for now since I'm still setting this up I only have a few things logged which are listed below:
- The device itself (twice)
- The Pi that handles Pi-hole
- The TLSense 8550U running OPNSense
I have two of the same right now because I'm still learning how to best configure these collection tools and want a test subject. I have in progress the following things once I perfect the timing and how I want to configure these exporters.
- [Linode hobby instance monitors](https://github.com/DazWilkin/linode-exporter?ref=connortumbleson.com)
- [Weather station monitor](https://github.com/ianunruh/ambient-exporter?ref=connortumbleson.com)
- [Nest home air/smoke/etc monitor](https://github.com/grdl/pronestheus?ref=connortumbleson.com)
- [My other Pi's](https://github.com/prometheus/node%5Fexporter?ref=connortumbleson.com)
What I'm basically trying to do is log information about all my devices remote or local so I can build a custom dashboard for an immediate overview of everything I care about. This may be local weather with the up-time of my hobby projects in another widget. It may show my network speed from a random test it stored from the last hour. The possibilities are quite endless here once you have the data.
So once you have an exporter running and Prometheus configured to read that data stream - you now have a collection of metrics and you just need to visualize that data.
Prometheus expressions
You can query data in Prometheus to check if the metrics you want are showing up as you expect. The above pictured metric is specific to my Pi-hole so I wouldn't expect multiple hosts reporting this value. However, once I have the last minute load percentage from all my Pi's - that would be a perfect graph to have.
This is where Grafana comes in as you can select Prometheus as an incoming data source and it gains access to all of these metrics.
Data sources in Grafana
So now that Grafana has all the data available you have a few options here. You can find a dashboard that visualizes your collected data or build your own. What I prefer to do is find a dashboard even if its not compatible with the data source I'm using. This allows me to quickly learn from their example and adapt for my use-case.
Edit wiget in Grafana
Take for example the Pi-hole dashboard in the beginning of this blog. I can chose to edit a singular widget of that dashboard and learn how it works. This is very helpful for me to quickly learn how the expressions and transformers work. This editor pictured above has some great typeahead support as well. It knows every metric and possibility of formatting on that data which helps you live visualize your widget.
So now I'm entering the phase of finishing this setup. I have many more things to obtain metrics from and a few new dashboards to complete. When this is done phase 3 of my home lab will be complete.
### Pi-hole: 5 years later
URL: https://connortumbleson.com/2023/02/27/pi-hole-5-years-later/
Last updated: 2025-02-04T11:42:39.000Z
Screenshot of Pi-hole 5.18
In 2017 I installed a Pi-hole into my network and routed all my DNS traffic through it. Today is now February 26, 2023 and I've been running it ever since.
This last year was the hardest of running Pi-hole in the history of this little project. It all started when one regular upgrade went south and it refused to complete. It turned out that running Raspberry Pi OS (Stretch) was no longer supported.
```
1041 upgraded, 735 newly installed, 11 to remove and 0 not upgraded.
Need to get 1,322 MB of archives.
After this operation, 2,179 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
```
Stretch to Buster
I took a risky jump and did a in-place upgrade from Stretch to Buster to Bullseye. So now that I was up to date on my operating system I could resume my upgrades on the Pi-hole. Once done I completed the upgrades from Pi-hole 5.11 to 5.18:
- **5.12** \- [Add rate limit support and log flushing changes.](https://pi-hole.net/blog/2022/04/20/pi-hole-ftl-v5-15-web-v5-12-and-core-v5-10-released/?ref=connortumbleson.com#page-content)
- **5.13** \- [Fixes for IPv6 and UI refactor for group assignment.](https://pi-hole.net/blog/2022/07/07/pi-hole-ftl-v5-16-web-v5-13-and-core-v5-11-1-released/?ref=connortumbleson.com#page-content)
- **5.14** \- [Remove Debian Stretch support](https://pi-hole.net/blog/2022/08/29/some-upcoming-changes/?ref=connortumbleson.com#page-content), [UI refresh, 404 handler changes.](https://pi-hole.net/blog/2022/09/02/pi-hole-ftl-v5-17-web-v5-14-and-core-v5-12-released/?ref=connortumbleson.com#page-content)
- **5.15** \- [Remove Ubuntu 18 support](https://pi-hole.net/blog/2022/09/03/psa-dropping-support-for-ubuntu-18-04/?ref=connortumbleson.com) [and improve deep CNAME inspection.](https://pi-hole.net/blog/2022/09/14/pi-hole-ftl-v5-18-web-v5-15-and-core-v5-12-1-released/?ref=connortumbleson.com#page-content)
- **5.16** \- [Optimize long-term data graphs and remove heavy corn job.](https://pi-hole.net/blog/2022/10/10/pi-hole-ftl-v5-18-2-web-v5-16-and-core-v5-13-released/?ref=connortumbleson.com#page-content)
- **5.17** \- [Upgrade to latest dnsmasq and fixes for static IP usage.](https://pi-hole.net/blog/2022/11/14/pi-hole-ftl-v5-19-1-web-v5-17-and-core-v5-14-1-released/?ref=connortumbleson.com#page-content)
- **5.18** \- [Native systemd support and lighttpd upgrades.](https://pi-hole.net/blog/2022/12/21/pi-hole-ftl-v5-20-and-web-v5-18-released/?ref=connortumbleson.com#page-content)
A cool part of this upgrade was the introduction of [PADD](https://github.com/pi-hole/PADD?ref=connortumbleson.com) which was the upgraded version of the Chronometer2.
PADD
This is a pretty nifty feature compared to the previous - a great quick command to get quick insight on the status of the Pi.
During the last year I also gained a Prometheus and Grafana server in my local network. So I dug into how to push Pi-hole data into that project in order to add Pi-hole data into my dashboards. I found a simple [exporter](https://github.com/eko/pihole-exporter?ref=connortumbleson.com) and with that my Prometheus server was gathering the data.
Prometheus target for Pi-hole
So then I found a [Grafana dashboard](https://grafana.com/grafana/dashboards/10176-pi-hole-exporter/?ref=connortumbleson.com) and did a bit of configuring and had a new dashboard to contend with. The purpose here isn't really to replace the existing Pi-hole dashboard, but to use the available data to slowly build my own personal dashboard of all home data available.
Grafana dashboard
So now all my new bells and whistles were up and running - it was time to do some data exports and see how the blocked/allowed queries were handling.
So I jumped onto my internal "pi-stats" project and executed `php artisan stats:dump` and waited. With over 40 million records its showing how inefficient some of these queries are I produced.
The script took \~90 minutes, but then dumped out the following stats:
```
Total Queries: 41,676,108
First Query: 2019-06-17 00:55:35
Last Query: 2023-01-28 21:19:47
Time in days: 1321
Time taken: 90 minute(s).
```
**Top 15 Allowed**
| Domain | Count |
| ------------------------------------------ | --------- |
| e7bf16b0-65ae-2f4e-0a6a-bcbe7b543c73.local | 5,631,937 |
| 68c40e5d-4310-def5-a1c3-20640e1cd583.local | 5,305,150 |
| 1d95ffae-4388-9fbc-1646-b2b637cecb64.local | 4,898,205 |
| localhost | 3,643,663 |
| 806c4c48-1715-4220-054f-909f83563938.local | 1,342,386 |
| b.canaryis.com | 1,111,227 |
| pistats.ibotpeaches.com | 588,559 |
| api-global.netflix.com | 376,154 |
| clients4.google.com | 361,808 |
| ssl.gstatic.com | 328,905 |
| cdn-0.nflximg.com | 322,484 |
| nrdp.prod.ftl.netflix.com | 319,364 |
| play.google.com | 312,519 |
| www.google.com | 280,645 |
| ichnaea.netflix.com | 279,543 |
**Top 15 Blocked**
| Domain | Count |
| ------------------------------------------ | ------- |
| 806c4c48-1715-4220-054f-909f83563938.local | 803,900 |
| e7bf16b0-65ae-2f4e-0a6a-bcbe7b543c73.local | 638,460 |
| 1d95ffae-4388-9fbc-1646-b2b637cecb64.local | 432,008 |
| ssl.google-analytics.com | 379,597 |
| 68c40e5d-4310-def5-a1c3-20640e1cd583.local | 247,892 |
| app-measurement.com | 246,464 |
| watson.telemetry.microsoft.com | 217,743 |
| googleads.g.doubleclick.net | 87,587 |
| settings-win.data.microsoft.com | 71,150 |
| www.googleadservices.com | 62,735 |
| mobile.pipe.aria.microsoft.com | 47,406 |
| sb.scorecardresearch.com | 47,058 |
| sessions.bugsnag.com | 44,110 |
| reports.crashlytics.com | 39,801 |
| secure-dcr.imrworldwide.com | 36,591 |
---
So lets take a look at the top few on both sides. The random UUID domains are still here and might take years to be bounced out of the top 15\. If you remember these were from the multicast behavior added in [Big Sur](https://connortumbleson.com/2021/04/26/pihole-3years-later/), which caused tons of requests to be made to any `.local` domain. Why they wouldn't stop if the other device(s) didn't respond properly after the first 100,000 requests - I don't know.
I renamed the devices to end in `.pihole` and that has halted Mac from reaching out to them nonstop. However, even 2 years since that fix - those requests are still leading both the blocked and unblocked. My network does look extremely different than prior with the introduction of a switch and a firewall. I [blogged](https://connortumbleson.com/2022/03/21/the/) about this new setup prior, which may explain some of the new differences in my top 15 blocked and allowed domains.
The top blocked domains still fit into categories of:
- analytics
- bug tracking / analytics
- ads
- dumb Mac multicast spamming
The top allowed domains are:
- Canary security system
- Pi Stats (this internal stat project)
- Netflix
- Google Play
- dumb Mac multicast spamming
So I think in order to have a sane dataset - I should purge all these multicast domains from the history. It might save me 15\~ million records and make this research a bit more interesting.
Pi-hole continues to evolve and be a great addition to my local network. I'll pass another donation and see them again in another year with another yearly blog post.
### 3 months of mail
URL: https://connortumbleson.com/2023/02/20/3-months-of-mail/
Last updated: 2025-02-04T11:42:39.000Z
3 months of mail
As I mentioned in a [blog](https://connortumbleson.com/2022/11/07/the-research-begins/) awhile back I collected all my physically delivered mail from the time of November 15, 2022 to February 15, 2023\. This is 3 months or exactly 92 days of collecting mail. For further context - I live alone and would be the only one expected to receive mail at this address.
I've initially grouped them into 4 piles of:
- (top left) - Mail I never wanted or requested.
- (top right) - Mail I didn't want, but from a Company I did business with.
- (bottom left) - A hand written personal letter to me.
- (bottom right) - Mail that was beneficial to obtain that I probably legally was required to receive.
So lets break down each category further and dig into the pure amount of physical delivered weight of mail I obtained.
---
**Mail I never wanted or requested** (101)
This category is just the huge collection of these full page coupon pages printed on newspaper like material. The companies for these range between all the local grocery and drug stores around Tampa as well as some odd companies I cannot place locally.
Piles of coupon mail.
So I broke this pile into further piles of:
- Save (50\~)
- Save a lot (20\~)
- Bravo (10\~)
- Winn Dixie (10\~)
- Fast food (5\~)
- Other (5\~)
I spent a few minutes researching and found a way to unsubscribe from Save via address entry [here](https://save.com/mailing/delivery-options?ref=connortumbleson.com).
> Per your request, your address was removed from the Save delivery list effective today. Advertising programs are prepared several weeks in advance, so please allow up to six weeks for delivery of the Save package to stop. Please be aware that occasional delivery errors could result in delivery of Save packages intended for other households.
After wasting another 30 minutes trying to remove my address from the rest - I gave up. This pile of 101 items could be counted even higher if I counted the individual loose pages inside each folded set.
If I get 101 of these in 92 days - this must be a hugely heavy source of mail for folks around.
**Mail I didn't want, but did business with the company** (22)
This category bothers me the most, because I did spend time or money with these businesses, but I never knowingly agreed to wanting mail delivered. We have the following:
- 9 letters from One Blood
- 5 letters from Hello Fresh
- 3 letters from my dealership
- 2 letters from my loan company
- a single letter from TurboTax
- a single letter from Publix
For 3 months of collecting - One Blood sends way too many pieces of mail. Not only that, but they call way too often. I can peek my call logs and see:
- Feb 6, 2023 - 11:39am
- Jan 20, 2023 - 2:52pm
- Nov 14, 2022 - 4:18pm
- Oct 31, 2022 - 2:25pm
- Oct 15, 2022 - 2:28pm
- Oct 1, 2022 - 5:18pm
3 months of OneBlood mail
OneBlood has upset me more just learning they are the leading count to phone and letter spam in this category. It must be because I'm the universal donor (O-), but either way I'll probably be done with donating blood with them after collecting all this information.
I used Hello Fresh for a few months and they won't stop sending misleading coupon letters. The letters claim extreme savings that don't really come into play unless you stay subscribed for another 3-4 months. Sorry Hello Fresh - our time is over and no amount of letters to me will change that. Just save that money and work on having consistent quality and deliveries.
My dealership has some pretty scummy behavior in their mail. Letters that claim so many things that aren't accurate in order to get you there in person. Lets be real that anytime anything says "*up to*" - this means most people fall way below that value. You can barely see the "*up to*" on this fake check pictured above - the font is so incredibly tiny.
My dealership should stop spending money on letter spam and make the service center a pleasant experience. Since as it stands - getting service on your car is a maddening experience.
**Mail between human and human** (1)
This category had only one piece of mail for the entire test. This was a single hand written Christmas card from a family friend.
**Mail that was from company and beneficial to obtain** (12)
This category is mail that I obtained that I think was beneficial to receive, even if I didn't agree that it needed to be sent in a letter. This was:
- 6 letters about benefits from insurance
- 3 letters about my loan on house
- a letter about house tax
- a letter about my stocks at \_\_\_ company
- a letter about my 401k
This category might have been quite small, but I believe switching insurance companies at work during this time frame led to easily 7 of these letters in mail. The others fall into a category of something that you just get every year for compliance or taxes.
---
All in all - this doesn't seem like that large of a quantity of mail when I sum the quantity at 136\. However, its tough to count the coupon pages that are full of pages within. If I could count each page that was contained – this count could easily exceed 200.
### Personal Weather Station
URL: https://connortumbleson.com/2023/02/13/personal-weather-station/
Last updated: 2025-02-04T11:42:39.000Z
Mounted Ambient Weather WS-2902
I've been building out my home network to support the logging and visualization of more data and while that build out is underway - the weather station has arrived. This is the first of many new projects to log some data into Prometheus and visualize it with Grafana.
I ordered the Ambient Weather WS-2902 and mounted it outside where I once had a bird house. While its now balanced and even - the mounting job sure has its list of imperfections:
- The post is smaller than the mount bracket, so it overlaps.
- The grey color does not match with the white post.
- The old screws from the birds nest snapped in half and I left them.
- It looks odd.
All those issues aside - the process to set this up was not difficult. The device created its own wireless network that I had to connect to and once I configured my own network within it - it restarted and was connected.
Panel for configuration on WS-2902
Once connected to the Internet - I could head to `ambientweather.net` and set my device to build my own extremely local weather dashboard.
A few button clicks and the dashboard was up with a widget for:
- Temperature (Dew Point / Feels Like)
- Wind Speed & Direction
- Rain rate
- Pressure
- Humidity
- UV Index
- Solar Radiation
- Battery value
Widgets for my weather station
This was pretty nifty to see and even cooler once I realized these were stats gathered 10 steps from where I'm writing this blog. So now when its raining at the office and I'm wondering whats going on at home - this will keep track of the rain amount at my exact place.
I've also now started to truly understand what happens when the sun comes up and goes down. How much truly settles down when the light disappears. Temperature and wind are two of the stats that become so interesting to correlate with the time of night.
Wind - Temple Terrace - February 11, 2023
Now one day is hardly enough to draw a conclusion, but it does help bring meaning to the phrase - *the dead of night.* For February 11, this was 4:05am when the temperature was the lowest (62f) and wind at 0 mph. When I checked this page the next day it had grown with further analytics.
I'm guessing after a year I'll have quite a pile of data to draw conclusions with. Just two days of data and its already comparing to yesterday and proving ranges of the collected values.
Two days of temperature data
---
What I'm trying to figure out now is the best method to ingest this collected data into Prometheus. With a quick Google search I can find two different exporters that work using the Ambient Weather API.
- [https://github.com/dantswain/ambient\_wx\_exporter](https://github.com/dantswain/ambient%5Fwx%5Fexporter?ref=connortumbleson.com)
- [https://github.com/ianunruh/ambient-exporter](https://github.com/ianunruh/ambient-exporter?ref=connortumbleson.com)
Since I'm not 100% familiar with Prometheus and exporters yet - I still need to investigate why I can't just keep this local and use the built in data stream to emit to some endpoint that Prometheus can consume.
Customized section of weather panel
All of this investigation will have to wait until the Prometheus software is set up on a new Pi. Until then, I'll just keep looking at weather stats localized to my address.
### Air Quality
URL: https://connortumbleson.com/2023/02/06/air-quality/
Last updated: 2025-02-04T11:42:40.000Z
Photo by [Timothy Eberly](https://unsplash.com/@timothyeberly?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
One morning in Florida it was a bit cool when I opened up the garage to head to work - and it smelled wonderful. There was something about the fresh air of outside and the slight coolness it had that just caught my nose.
So instead I checked my mail for a bit more time outside and took in that before jumping into my car.
So the next day it was a morning run type of day and again the air just smelled great compared to what I remember. That was until I ran by some apartments near my place that had the distinct smell of weed - which kinda threw me off guard as it was 6:15am and I didn't expect that smell so early.
I get onto the trail after running out of my neighborhood and someone is smoking a cigarette while walking their dog. This time knowing I had this blog idea in my head - it bothered me. I'm pushing a 7 minute mile pace at this point and a cloud of cigarette smoke on the trail doesn't vibe well.
On the flip side - smoking it right outside an apartment door just blows into all apartments from my experience so maybe this person was doing a respectful thing. Or perhaps just being a non-smoker that any cigarette smoke just tilts me.
The weekend arrived and this time I drove to a different park for a work out and what do I smell this time? These 4 wheeler loud park vehicles that are driving around the same loop I'm running. The watch had me doing 46 minutes, so I was looking at 5 laps around the park. I think 2 or 3 times per loop I got a huge whiff of just pure exhaust from these various vehicles doing maintenance tasks.
That is way better than running on the sidewalk next to the road in terms of air quality, but all of a sudden I'm temporarily obsessed with the idea of clean air.
---
So now I'm entering the nerd phase of logging some data. I started researching "*open source air monitoring*", because I'm not going to buy another enterprise piece of monitoring technology that locks out features and changes terms (cough Canary).
This was some tough research in a way because all my results fell into the following buckets:
- Extremely technical and DIY and out of my league.
- Extremely old and outdated and lacks any of the connectivity features I want.
- Extremely expensive or commercial.
- Unavailable to be used safely outside.
Random weather station I was looking at.
At some point I was seriously considering picking up a [personal weather station](https://www.wunderground.com/pws/buying-guide?ref=connortumbleson.com) as that seemed to check all the boxes, except it was missing detailed air quality which was the entire reason I was doing this research unless I bought a plethora of attachments. However, this does seem pretty interesting to purchase as a few hundred bucks and I can have my personal weather feed. I just want to be sure I can push this data into my slowly growing personal dashboard of home data.
However, I kept focused and pushed that weather idea to my backlog and stumbled upon [AirGradient](https://www.airgradient.com/open-airgradient/kits/?ref=connortumbleson.com) which had a snippet of information that aligned with what I was trying to do.
> With our expertise in air quality monitoring, we want to provide an open platform for building air quality monitors and enable citizens and organizations around the world to measure the air quality, share the data and have a positive impact on the environment and health.
I started and looking at their products and it was quite interesting. Such a range of basic to advance products with the ability to make them yourself or buy a pre-built iteration.
[https://www.airgradient.com/open-airgradient/kits/](https://www.airgradient.com/open-airgradient/kits/?ref=connortumbleson.com)
This looked like a combination of sensors to produce some great air quality stats, but looked to be isolated to some indoor devices. However, it looked like an outdoor model was on the horizon.
[https://www.airgradient.com/open-airgradient/outdoor/](https://www.airgradient.com/open-airgradient/outdoor/?ref=connortumbleson.com)
So this is my new journey. I've ordered an indoor and pre-ordered an outdoor model. My goal to ingest this data into a local database and visualize it. I want to start making correlations on days I feel the indoor/outdoor air smells great and what the real facts report.
I have the ability with this model to re-flash the Arduino with my own URLs for data collection and configuration. This is because near everything regarding this project are published on [GitHub](https://github.com/airgradienthq/arduino/blob/master/examples/DIY%5FPRO%5FV3%5F7/DIY%5FPRO%5FV3%5F7.ino?ref=connortumbleson.com). The only thing I'm nervous about is there appears to be some issue with consistent reboots, however the [community](https://forum.airgradient.com/t/airgradient-rebooting-itself/603?ref=connortumbleson.com) is on the case due to the open platform. They've identified a [regression](https://forum.airgradient.com/t/airgradient-rebooting-itself/603/44?ref=connortumbleson.com#workaround-as-of-jan-28-2023-1) in the Arduino core version on the esp8266 and recommend a downgrade to v3.0.2.
So now I'm not too worried. It looks like a great group of nerds can collectively solve problems and work on the open platform together.
However, I don't have the hardware yet and will wait for my final judgement after a few weeks of running this for real. I might even purchase some personal weather station to add to this data collection.
### Layoffs on Layoffs
URL: https://connortumbleson.com/2023/01/30/layoffs-on-layoffs/
Last updated: 2025-02-04T11:42:40.000Z
Photo by [James Yarema](https://unsplash.com/@jamesyarema?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On January 20, 2023 I saw a new thread on the top of Hacker News named: "*Google to reduce workforce by 12k"*. This linked directly to a post from Sundar Pichai about letting go of 12,000 employees.
If we look at Google's size though, 12,000 employees is barely 6% of the workforce so while 12,000 sounds like a very large number its all relative to the company size. So lets look at other companies who've done layoffs in past few months.
- Google - 12,000 - 6% (*January 20, 2023*)
- Microsoft - 10,000 - 5% (*January 18, 2023*)
- Salesforce - 8,000 - 10% (*January 4, 2023*)
- DoorDash - 1,250 - 6% (*November 30, 2022*)
- Kraken - 1,100 - 30% (*November 30, 2022*)
- Carvana - 1,500 - 8% (*November 18, 2022*)
- Amazon - 10,000 - 3% (*November 16, 2022*)
- Meta - 11,000 - 13% (*November 9, 2022*)
Probably a lot more in there - you could check out [layoffs.fyi](https://layoffs.fyi/?ref=connortumbleson.com) to get the full story, but I'm more interested in the reasons behind all these layoffs.
You could take the obvious answer that our planet isn't doing too well in the economics department. Perhaps this is the result of wars and viruses or some mixture of corporate greed, but more than likely this is over my head of comprehension.
What I do what to go through is my perception though from a few angles.
---
### Everyone else is doing it.
In this angle I believe we have a few companies laying off folks from the pure implosion of Crypto and how many companies were affected by that. However, once you have a sizable chunk of companies laying folks off and getting praised for how they handle it - its time for others to join in without being the bad guy.
### Some companies are heavy on personnel
My guess is that some companies just have too many people. I say this because I've been at a few meetups where verified employees of various companies have just admitted to basically doing nothing. They take advantage of this and just burn through hobby projects. It seems like a pretty cool gig to get paid to do nothing and work on what you want.
Now that isn't fair to say all folks laid off are doing nothing and worthy of a layoff. In most cases I'm guessing businesses forecast how many employees needed in the future to handle new business or growth, but guess wrong and you are over populated with not enough funds to handle it and have to trim.
### Shareholders
What I've noticed in my very basic example - when my savings interest rate is low - the market is doing great. When my savings interest rate is high - the market is going bad.
Stretch this example to companies and I believe it applies. We saw companies as an attractive investments to push returns. This helped spawn and breed this impossible feat for a company to continue to have extreme profits each year.
Which I think at some point turns against the company - take what we see with any social media platform. A feature that changes is the loss of chronological order for some AI intended iteration of what you should see to push retention. I blogged about [this](https://connortumbleson.com/2018/05/27/the-death-of-chronological-order/) before because I was so upset when I could no longer sort YouTube in order of most recent.
New default for recommended tweets.
We just saw it again with Twitter a few days ago putting a new default "For you" tab in my face to control the ordering of my feed. I'm convinced these features come out when money needs to be made.
---
All in all we are probably past 200,000 employees let go and I'm not sure if this is just the beginning or near the end. It does help establish which companies take the responsibility and provide good severance package and which ones do not.
### Dangling Domain Abuse
URL: https://connortumbleson.com/2023/01/23/dangling-domain-abuse/
Last updated: 2025-02-04T11:42:40.000Z
Damage of a foreign sitemap with 500k entries.
On January 15, 2023 I deleted an old Linode as I helped migrate an old website I hosted to a new provider and webmaster. This went as seamless as possible with zero downtime - I asked all WordPress contributors to hold on writing - did an rsync of all contents and one quick export/import of database and I was done.
The short TTL I had on the domain led folks to the new host extremely quickly and for those contributors who didn't respect TTL - I had a draft blog in the old site titled - "*This is old - do not write here.*". I kept the old site up for about a week for stragglers then deleted the Linode as mentioned on January 15.
Five days later on January 20, 2023 I obtained an alert that a new owner was verified in the Google Search Console. I was pretty busy at work on that Friday, so I only started piecing together this mistake on the weekend.
So this is the story.
---
**The Linode Deletion**
Logs in Linode of actions.
So maybe not exactly a week as mentioned, but on January 10th I turned that Linode off and on January 15, 2023 I deleted it. This action immediately freed that IP address (`96.126.126.141`) and unaware to me started the cascade of mistakes.
There must be a bot/spider/site/tool responsible for finding recently released IP addresses as this behavior occurred within days. So unbeknownst to me at the time I was now broadcasting an A record to an IP I no longer controlled.
```
➜ ~ dig fevgames.connortumbleson.com
; <<>> DiG 9.10.3-P4-Ubuntu <<>> fevgames.connortumbleson.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15495
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;fevgames.connortumbleson.com. IN A
;; ANSWER SECTION:
fevgames.connortumbleson.com. 14145 IN A 96.126.126.141
;; Query time: 9 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Sun Jan 22 07:19:47 EST 2023
;; MSG SIZE rcvd: 73
```
"fevgames.connortumbleson.com" -> "96.126.126.141"
This was obviously the vector and a big reminder to always take it seriously when you are releasing an IP back into the global space that you previously used.
---
**The Verification**
So at this point with a valid subdomain pointed to an IP I don't control - somehow this attacker obtained access to the IP that I recently released in a short period of time. There must be some scanning service that watches when IP addresses move around. [BishopFox](https://bishopfox.com/blog/fishing-the-aws-ip-pool-for-dangling-domains?ref=connortumbleson.com) has a tool for this, so there must be a few more of these tools available for attackers to use.
Some seem to work isolated to AWS spinning up IPs as fast as they can - scanning and releasing when done. Something like that seems like something AWS would like to prevent, but I digress. Perhaps Linode has the same sort of mechanism for iterating through IPs in the pool.
So this attacker now uploads the [basic HTML verification](https://support.google.com/webmasters/answer/9008080?hl=en&ref=connortumbleson.com#html%5Fverification) file to some hosting in order to have Google verify ownership of that "*fevgames.connortumbleson.com*" website and that works. The attacker is now a verified owner of my sub-domain.
---
**The Missed Alarm**
The giveaway email.
So while at work on 11am on a Friday - I'm busy with some meetings prior to lunch and spot an email about a new owner for "*fevgames.connortumbleson.com*".
Since I had just recently migrated the real website, I just improperly assumed that the testing domain was migrated/re-owned by the new owners. I failed to open and fully read the email to see the clearly bogus email attached to it.
Clearly I wasn't thinking if I thought it was all right for our testing site to be index/added to Google Search Console. I guess you lose track of things when you are passing it along to a new person.
---
**The Luck of the Draw**
With the weekend here now (January 21, 2023) I got another email about my Google Search Console performance suffering because I did not put an image placeholder on my recent blog ([Callous Tampa](https://connortumbleson.com/2023/01/16/callous/)) that utilized a video.
So with a bit more free time I jumped onto the console and reviewed that warning to fix it. When I went to re-process that warning I noticed something strange on the results where I saw 500,000+ pages that were declined from indexing.
Indexing results on Google Search Console
I know I blog weekly, but surely not 500,000 pages worth. So I clicked in and saw something alarming. It was pages on pages of clear redirect/ad spam links that simply responded to all these popular search terms.
Discovered - currently not indexed on Google Search Console
So now I pieced it together with the email I got the day prior about a new owner on the domain. I went back and saw the email was `dmcareportmail@gmail.com` which is a clever naming trick to hopefully cause site owners to ignore the addition of the owner.
In my case - a mix of a busy work day and bad assumption led to ignoring the initial sign.
---
**The Attacker Removal**
So right out of the gate - I realized that the testing domain for the recently migrated FevGames was no longer needed. I deleted those relevant DNS records and did some cleanup on that `connortumbleson.com` zone.
I figure that would break the HTML page verification, but I needed to work quicker and explicitly remove this person.
Thankfully the email had two options.
- The first being "Manage Users" in [Google Search Console](https://search.google.com/search-console/users?ref=connortumbleson.com) which was useless to me because it showed no one, but me.
- The second being the legacy "[Google Webmaster Central](https://www.google.com/webmasters/verification/home?ref=connortumbleson.com)" which had the malicious user and how they verified, but was incredibly difficult to visit.
Google Webmaster Central showing malicious added owner.
So from that page I could remove the malicious user and identify how they verified - then I went onward to cleaning up the mess.
---
**The Cleanup**
Asking Google to removal all of these domains.
So I went back to Google Search Console and requested Google to remove all these malicious links. This didn't take too long to submit, but I'm not sure how long it takes to enact itself.
I sadly still see results on Google when I explicitly look for that subdomain. Granted, it hasn't even been 24 hours so we will give this a few more days to reset itself.
Back on the DNS front - I double checked I had no more references to the no longer owned IP.
---
So all in all - I learned first hand to always be careful when releasing IP addresses and hopefully didn't damage my blog too much with that mistake.
I'll monitor every day for a bit and make sure everything is returning back to normal on the Google Search Console front.
### Callous Tampa
URL: https://connortumbleson.com/2023/01/16/callous/
Last updated: 2025-02-04T11:42:40.000Z
Photo by [Artem Maltsev](https://unsplash.com/@art%5Fmaltsev?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On the way to work one morning I experienced what has occurred more often recently of a car interaction where I just thought - "*what an ass*". This time the event was just an individual in a right hand turn only lane that decided they wanted to go straight after already being in the intersection. Of course I had an option here of refusing to give up space and leading to some sort of accident or slowing down and laying down the horn as the car squeezed in.
I honked and let the car in, because who knows - they could be in an emergency and missed a turn. Not more than 5 minutes later as I hit my last stop sign before work - another car did something so seemingly comparable to nothing, but it upset me.
0:00
/
1×
Tampa, FL - Stop Sign
Probably caught in the motions of a stop sign as I just started going on my turn, but a car clearly went out of turn. This was no where near a close accident or even a merit to honk, but it just messed with my mind.
Was the driver wanting to stay with the other car? Did they miss me sitting there? Does the world resolve around them? Am I misunderstanding the etiquette of a 3 way stop?
Who knows - at the end of day I was delayed near nothing and made it work without an accident.
---
I started thinking though - this behavior in a vehicle has easily been changing over the past few years and its not like I remember when I moved here in early 2016\. Take an example of a simple zipper merge to promote merging traffic - it seems somewhat recently that a behavior has emerged to the tone of "get eaten or eat".
Which basically means cars will either go the extreme of blocking cars from merging in or alternatively cars merging in will floor it to the end of the lane and force themselves in.
I just don't understand the callous behavior of what seems to be more and more people and why its changing. It wasn't too long ago that leaving my apartment complex during rush hour had no shortage of drivers that would allow me into the rush.
Now it doesn't matter if I have a green light - cars will continue to run their red for multiple seconds taking the few legal seconds I have to cross the intersection. Perhaps this is an evolution of drivers understanding how the lights work here in Florida. When the light turns red its at least 2-3 seconds before any light turns green.
This must be a preventive technique to allow those idiots who continue to run blatant red lights to not endanger others. However, folks have caught on that you can run yellows into reds for a few solid seconds before any chance of collision occurs.
Perhaps this recent awareness for callous drivers is more insight into how I'm perceiving situations now - perhaps it was always like this and I'm more on edge now.
---
I [blogged](https://connortumbleson.com/2022/07/04/entitlement-and-compassion/) about this before when driving to the park and [again](https://connortumbleson.com/2022/04/04/anarchy/) when the power took out street lights. I just want to know why folks are losing the ability to calmly interact with others.
- Was it lock-down and COVID?
- Is there a cause/effect that we won't understand for another 20 years? (*Think leaded gasoline and aggression - [reference](https://www.forbes.com/sites/alexknapp/2013/01/03/how-lead-caused-americas-violent-crime-epidemic/?sh=8cec39d12c48&ref=connortumbleson.com)*)
- Are people just more on edge?
- Economy strain?
- More people moving to Tampa?
I'm not quite sure, but it takes a toll on everyone. You either end up being walked over or becoming the asshole that people complain about.
### Evolution of Food Taste
URL: https://connortumbleson.com/2023/01/09/evolution-of-food-taste/
Last updated: 2025-02-04T11:42:41.000Z
Avocados/Limes from my trees.
Shortly after moving into a home I had the largest yield of avocados and limes to which I made an endless amount of guacamole and avocado toast. I say Florida avocado out and about and people shiver - they want the Hass. I don't blame them, when I was at the grocery store - I never picked Florida avocados because I was used to growing up eating Hass. However, once a tree was in my yard - I gave it a chance and realized they were no different.
This post isn't about a bunch of avocados though - it's about how food taste changes. If we move the clock back 20 years our trips for food out n about resulted in probably a trip to:
- Some Kansas local BBQ joint.
- Longhorn Steakhouse.
- A sandwich shop.
- Arby's / Culvers / Sonic.
- Pizza Hut.
Now I look back at that list and think a few things:
- Food tastes changes as you age.
- Kansas vs Florida offers different food.
- Fast food is dated.
- Some food isn't worth it anymore.
When I took the 3 hour long drive from Kansas to Arkansas for school every so often a decade ago - there was a gas station and food option in the middle of nowhere. That place was Arby's and it wasn't a bad option for food when you had no other options.
Though if I look at the past 10 years - I don't think I've ever visited an Arby's nor even know where one is. I tried to visit a Sonic once after coming home late at night without dinner. However, sitting at a kiosk I heard a voice that said "*drive through only*" and that line was insanely long - so I gave up.
So the tried and true what I'm calling legacy fast food is out in my book. I think the only exception I continue to make is McDonald's breakfast. That is a simple quick trip when on the way to an early morning kayak/island trip - a bit more food and energy than a yogurt and still cheap.
---
Jersey Mikes, Mariana Sub, Mr. Goodcents & Which Wich-
However, lets move to sandwiches. I used to love visiting Quiznos, Mr. Goodcents and Which Wich. Now we see:
- Mr. Goodcents - Midwest only.
- Quiznos - All closed near me.
- Which Wich - became garbage.
I used to love the configuration and customization of Which Wich sandwiches, but one time I went in and everything was different. I could pick my same sandwich, but from a list of allowable removals and additions. I was confused, because how can I make my perfect jalapeno Italian iteration. I kept looking for a different sandwich bag to notate and none existed.
The staff said I could just write what I wanted on the back, but yeah sure I can remember what to write down when there was no longer 30 items with checkboxes to pick from. I haven't been back since then - which sucks since I really did enjoy that place before it changed.
So I'm happy to have a consistent experience when going to Jersey Mikes or Mariana's subs. The first being a huge chain that prides itself on consistency and the 2nd being a shop that literally only sells a single sandwich made a single way.
---
Hello Fresh
So if the idea of sandwich shops or fast food is collapsing under preference - it was time to make some new creations at home. So I signed up for Hello Fresh and did a few solid months of producing their creations. What I quickly figured out is every recipe boiled down to:
- Chop a ton of things.
- Use a ton of bowls/pans/utensils.
- Heat/bake/grill something.
- Dump some sauce onto the creation that you mixed from tiny plastic bags.
- Figure out how to properly dispose of an infinite amount of ice packs and plastic.
So at some point - I cancelled, but it allowed me to pick up some good recipe techniques and how to make iterations of popular dishes. Now I have no problem cooking up some rice, tossing in some vegetables and protein and I have a good dish going.
With the power of a cast iron pan and green egg - you can also cook quite a lot of things. Throw in a few chicken thighs and add some lemon/olives/garlic and you have a nice dish.
So all in all - I'm cooking more at home and more than just some pasta and salad. However, what happens now when I'm out n about?
---
Right now I'm spoiled with a cafe being next door to my work. This place has a different special daily and ranges from breakfast to lunch with a wide menu. Since I go near daily I've become the test subject for new creations. I even have a menu item named after me for the classic buffalo chicken wrap.
[Cracked Pepper Cafe](https://www.thecrackedpeppercafe.com/menu?ref=connortumbleson.com) Creations
So now I have a consistent source of a wide variety of flavors and tastes. I might enjoy a roast beef sandwich one day, but then a Greek salad the next. All with only taking 15 steps outside my office. I'll continue to try new creations here to expand my palate.
I might miss that Wendy's Baconator every once in awhile, but my evolved food taste I'm happy with.
### A Year of Blogging (2022)
URL: https://connortumbleson.com/2023/01/01/a-year-of-blogging-2022/
Last updated: 2025-02-04T11:42:41.000Z
Photo by [Moritz Knöringer](https://unsplash.com/@mokngr?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As 2018 ended, I had successfully blogged every week for the [entire year](https://connortumbleson.com/2018/12/30/a-year-of-blogging/). This was a new years resolution that I've somehow kept for now four years and counting.
So lets recap my favorite posts from 2022.
---
[Open Source & Money](https://connortumbleson.com/2022/01/24/open-source-money/)
This post I wrote after I saw people complaining online that this random company was donating $500 to open source and that was too little. I thought it was extremely odd to see people unaware of what open source donations and offerings even are. So I took some values from my own projects and wrote up a post.
---
[2022 - Era of the CVE](https://connortumbleson.com/2022/02/14/2022-era-of-the-cve/)
This post was from a bit of annoyances over the years - from getting alerts from services for having a regular expression vulnerable project. Yeah sure - that seems severe when the only thing capable of abusing that is code that needs to be code reviewed and then built. On top of Apktool getting a debatable security flaw reported that netted the discoverer $170 - which was more than half of any money I'd made supporting Apktool at the time.
---
[The disappointment of Halo Infinite](https://connortumbleson.com/2022/03/14/halo-infinite-disappointing-review/)
A new Halo game came out and I really wanted to like it, but it kept disappointing me time and time again. Whether it was bugs, broken playlists or another battle pass cash grab - it was maddening. It seems like this is a new toxicity that is affecting all new video games. Ever since Fortnite made stacks on a new game model - every other game tried to copy.
---
[A Look into Laravel Livewire](https://connortumbleson.com/2022/05/02/a-look-into-laravel-livewire/)
However, even though I quickly lost interest in the new Halo I did build a new stat site for the game. Much like every major Halo game I attempt to make a site using a new type of framework/language. I really enjoyed Laravel Livewire and thus wrote this post documenting my journey for this project.
---
[July 2015 Lake Ozark Flood](https://connortumbleson.com/2022/05/16/july-2015-lake-ozark-flood/)
As I went through older photos I found it very interesting that I had documented some events in history that were large enough to have Wikipedia pages. This might be an ice storm or flood - so I started adding posts to the History tag. So I enjoyed researching and pulling old photos of the Lake of the Ozark flood.
---
[The Penny Hoarder](https://connortumbleson.com/2022/09/05/the-penny-hoarder-on-quora/)
After a tip from a friend - I started researching what I believed to be scam. It all started when I started getting solar salesman at my door shilling a product that was not in my favor. When I found this Penny Hoarder site - it just screamed of scams. I couldn't believe how many people actually used this site. It seemed sad how many people might spend 45 minutes of their time to win 11 cents unaware they probably earned the company behind it a dollar.
---
[Door to Door - Lumino Solar](https://connortumbleson.com/2022/08/29/door-to-door-solar-n-more/)
As hinted at above - I did begin extracting some audio and screenshots from the various solar folks to visit my house. I used these interactions to research the claims they put forward to see if they were valid or not. These were fun posts to write as it just helped further cement my belief that solar panels at this point and house in my life is not worth it.
---
[Someone is pretending to be me.](https://connortumbleson.com/2022/09/19/someone-is-pretending-to-be-me/)
Finally, a weird encounter in my life where someone was impersonating me in order to gain employment at a company. This investigation and blog ended up going quite viral going to the top of Hacker News and netting roughly 100,000 unique views in one day. Turns out as days became weeks after this release - this is a large common trend occurring in the employment space. I hope to finish the follow up research for this soon.
---
2023 is arriving and I'll still be here blogging weekly. Thanks for reading and here is to another year.
### I'm Sick
URL: https://connortumbleson.com/2022/12/26/im-sick/
Last updated: 2025-02-04T11:42:41.000Z
Photo by [Mufid Majnun](https://unsplash.com/@mufidpwt?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Not in a demented weird way - I'm literally sick health wise. I don't think I've been sick since the pandemic started in any major capacity, so it was about time I caught something.
Last week on Friday was our company holiday party so the first time I was around \~50 more people than normal. This might have been the contributor to what infected me. The weekend came and I felt great - I worked out on both days and didn't think anything was odd.
Until Sunday night writing the last blog about the World Cup - I started feeling an itch in the back of my throat and I knew that wasn't normal. I figured it was nothing and went to sleep for the working Monday.
Sure enough Monday was not good. I felt a sore throat and had a tiny cough - enough of a reason to stay home from work. So I did but the throat was getting worse - so this time I put in an Instacart order for some healing options.
So while I was barely sick on Monday, Monday night was horrible. I think I totaled 2 hours in total sleep just coughing non-stop. Tuesday just pushed the symptoms further, but I was surprised to have my 2nd covid test negative. I just figured like most in this era - that if I'm getting sick its probably covid.
When Wednesday hit and I was no where near better - I figured it was time to schedule a visit with primary care so I could still possibly attend Christmas activities with the family at end of the week. That appointment wouldn't be till Thursday and this was another painful day of symptoms and little sleep.
When I decided to just start my day at 3am on Thursday - it was because I couldn't sleep and I needed a shower/meal to let my throat recover. It was becoming apparent that I would not be joining Christmas this year. At least I was lucky enough to find an appointment for care on short notice. This reminded me of flash backs of trying to schedule an appointment for my back pain and getting appointment slots weeks out.
However, the doctor didn't know what was wrong with me in specific. Short of proving once again that it wasn't covid and a negative strep test - he believed it was something viral and prescribed me:
- Prednisone
- Lidocain
Which was a bit funny after I had just [blogged](https://connortumbleson.com/2022/12/12/medicine-advertising/) about the advertisement of prescription medicine. I found myself being that dumb patient that was using WebMD while waiting for the doctor to be available. I was left in an interesting dilemma - happy that I was getting prescribed something, but upset I was just getting classified as having "something viral". It seems that each doctor is always beyond busy bouncing between people all day - so quick to just try a few things and pass you along for some pills.
Why hasn't our civilization gotten to Elysium levels of healing yet?
When Friday hit I believe I traded the worse sore throat ever for the worse cough ever. I could not say 3 words without going into a cough. I could not eat without coughing. I could not stay still without coughing. All that coughing ended up leading to pressure on my face and led to some nose bleeds.
A week of negative covid tests.
So boy this is a sickness I've never had before. Saturday came and for the first time my sore throat was pretty mild. I wasn't scared to drink a liquid or swallow my food. It was bearable and instead I just traded that symptom for a never ending nose full of mucus.
Netflix held me a great deal of Saturday and I went back to eating regular food like a frozen pizza. Still getting into coughing rampages here and there, but I could at least hold a conversation without going into extreme coughing spurts.
I've surely destroyed all the progress I was making with workouts and long distance running, as I'm about to hit 7 days without a workout. Either way Sunday is here as I write this post and I'm still not quite healthy. I could downgrade my sore throat to very mild and I just feel like a regular cold of congestion now.
Who knows what I had - hopefully in a few more days I'll be back to 100%.
### 2022 World Cup
URL: https://connortumbleson.com/2022/12/19/2022-world-cup/
Last updated: 2025-02-04T11:42:42.000Z
Photo by [Fauzan Saari](https://unsplash.com/@fznsr%5F?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Today the world cup will end - it hasn't ended yet as I write this post, but it will in about 3 hours. So this post is the recap.
If we look at teams that didn't even qualify - the list is large as normal, but I was surprised to see Italy not qualify again. This was a team we watched win in 2006 to then fall apart in 2010 & 2014 to failing to qualify in 2018 & 2022.
Those in America were excited as we actually qualified this time instead of the embarrassment of not qualifying in 2018.
So if we look at each pool - there were some major upsets that we didn't expect in terms of teams NOT moving onward to playoffs. We saw the following teams not leave their pool:
- Germany (1/1/1)
- Belgium (1/1/1)
- Uruguay (1/1/1)
So it shows that tying and losing a game seriously hurts the chances of moving on. Instead we saw the following teams move on from pool play that we didn't expect:
- South Korea (1/1/1)
- Morocco (2/1/0)
- Japan (2/1/0)
Immediately lots of focused moved to the African team of Morocco for knocking out Belgium to gain entry to the best of 16.
Once the best of 16 arrived - we saw the wins align more closely to teams we expected to be in the final 8\. However, we saw Morocco upset Spain which proved this African group was here to say. Sadly, we saw The United States get eliminated by the Netherlands.
This left us with 8 teams:
- Netherlands
- Argentina
- Croatia
- Brazil
- England
- France
- Morocco
- Portugal
The quarter-finals again were ripe with excellent matches with two of those games going into penalty kicks. When the dust settled we saw:
- Argentina beat out Netherlands in PKs.
- Croatia beat out Brazil and Neymar in PKs.
- France take down England 2-1.
- Morocco upset Porugal and Ronaldo 1-0.
So the semi-finals having an African nation was an amazing feat. However, we saw Morocco was no match for France during the semis and Argentina embarrassed Croatia in 3-0 fashion.
So the finals were set - Argentina vs France in the 2022 World Cup finals. This was the most exciting match I've seen in awhile. The major events looked roughly like:
- GOAL - Messi (PK) - 23rd minute.
- GOAL - Di Maria - 36th minute.
- 2x SUB France - 41st minute.
- Half Time
- GOAL - Mbappe - 80th minute.
- GOAL - Mbappe - 81st minute.
- Extra Time
So we were going into extra time at 2-2 after what seemed like a game that would end 2-0 Argentina. We then saw these events play out:
- GOAL - Messi (PK) - 109th minute.
- GOAL - Mbappe (PK) - 118th minute.
- Penalty Shoot-out
The shoot out went back n forth with both Messi and Mbappe kicking first. This was probably a change after some of the best kickers never got a chance to shoot in shoot outs earlier in this tournament.
Argentina continued to score on each attempt, but we saw France miss both their 2nd and 3rd penalty kick. This would end up costing them the game as the 4th penalty taker for Argentina (Montiel) scored.
This would end the game 3-3 tied, with a 4-2 advantage in penalties for Argentina.
Lionel Messi would solidify his greatness winning the largest challenge in the game. Leading to the GOAT (Greatest Of All Time) status being spoken.
It was probably the greatest soccer match I've ever watched. It went back n forth and down to the final whistle.
### Medicine Advertising
URL: https://connortumbleson.com/2022/12/12/medicine-advertising/
Last updated: 2025-02-04T11:42:42.000Z
Photo by [Christine Sandu](https://unsplash.com/@lenscapewithme?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A couple of weeks ago at a bar with some friends watching a sports game - someone mentions that is incredibly annoying to see a prescription medicine advertisement every single time commercials start.
This started a little discussion where someone else notated that only the United States and New Zealand allowed such a thing and for what I presume is the clear reason of money.
So I learned a bit from this back and forth conversation and waited till I got home to research this claim myself.
---
In a quick Google search I found a [peer-reviewed paper](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3278148/?ref=connortumbleson.com) that substantiated this claim, so at this point I could not figure out how I felt about this and this is why.
Some part of me believes if you visit a doctor - that doctor is getting paid to stay up to date and know their field. That includes knowing medications and all varieties that may be able to resolve what ever ailment is bringing me towards them.
This is the same way I believe that engineering folks have to continue to research/learn new technologies so that when questions come in from technical clients we can explain why we continue to use x/y/z for something.
If a client comes to us in technology and says - "*Look, I found this cool new compiler to make things faster called Turbo LVLQR that I think you should use."*
I've got a few options as an engineer, but they come down to either:
- Explaining why that is not a good option because x/y/z.
- Taking the option the client said, because the client is always right.
So when we bring this back to medicine. Lets say I go to my doctor because my blood values are all out of wack.
I see some commercial that says "*standardize your blood values, ask your doctor about dimeekiofiltrate 3.0".* The doctor looks at me and says I don't need that, but I'm convinced from the beautiful commercials that my life would be better if I was on that medicine.
The doctor realizes they are fighting a losing battle and writing a prescription is easy. It might even make them money at the end of the day - so I get a prescription and I'm on my way.
Yeah an exaggerated tale, but it seems like that happened in some form after learning about some "pill mills" via [The Pharmacist documentary](https://www.netflix.com/title/81002576?ref=connortumbleson.com) (Netflix).
So I look at the situation and think - do we really need prescription medicine commercials?
It seems to me the companies paying for these commercials get success from more people taking these medications and getting pays outs from insurance. So yeah it makes sense to advertise as much as you can about new medication to increase profit. However, what about the part of population that is easily swayed or in a poor mental state?
If you watch a commercial about a beautiful beach over and over again with bright colors and realize its advertising an anti-depressant. Maybe you do need that pill as your life is feeling pretty bare and colorless.
This could be a negative thing to start as an anti-depressant may have some side effects that need countering with another pill. Soon you find yourself knee deep in a variety of uppers and downers to balance some chemicals and I think at that point you are just a human funding a company via a chain of pills.
However, this opinion can be dangerous to have since you set up the belief that the doctor holds all the knowledge and knows the correct path each time. I sure hope they do, but every time we hear a story about an individual who knew something was wrong with their body, but doctors insisted on no treatment is one too many.
So lets say we remove all advertising of prescription medication. I'm guessing the usage of those meds will naturally go down and with that goes the profit. Does that mean pharmaceutical companies will no longer fund research for new medications because it won't be profitable? I'm guessing so because as it stands now the United States fosters medical innovation via the huge amount of profit available. If you take that away - the innovation will slow.
> Today, Americans have faster access to more medicines than anywhere else in the world and doctors and patients work together to decide which medicine is right for them.
> [https://phrma.org/policy-issues/Access](https://phrma.org/policy-issues/Access?ref=connortumbleson.com)
So perhaps we just haven't found the happy medium yet. Since I don't believe Insulin costs rising 600% over the past few decades is anything other than greed.
### React Native Packages Woes
URL: https://connortumbleson.com/2022/12/05/react-native-packages-woes/
Last updated: 2025-02-04T11:42:42.000Z
As I hinted at in my previous [post](https://connortumbleson.com/2022/11/28/open-source-saying-no/) \- I've been working in React Native more in more in both work and hobby over the past few years. What I've been finding as more increasingly stressful is how often an issue lies in a package instead of my code in the React Native ecosystem in comparison to say like the Laravel ecosystem.
This could be entirely my fault, but I want to run through some situations I encountered to try and understand why this happens.
If we start with GPS - I learned that Geolocation was leaving the core of React Native and instead urged to find a package for this functionality elsewhere.
> Additionally, in response to community feedback about new App Store policy, Geolocation has been extracted.
> [Announcing React Native 0.60](https://reactnative.dev/blog/2019/07/03/version-60?ref=connortumbleson.com#lean-core-removals)
So I wanted to find an alternative plugin and landed on what was recommended.
[https://reactnative.dev/docs/0.63/geolocation](https://reactnative.dev/docs/0.63/geolocation?ref=connortumbleson.com)
The package linked was having reports of \~90,000 downloads a month. So I was quite confident that this package would be a good replacement for what I needed due to the popularity in comparison to the others. It didn't have many reported issues and looked quite active. Not to mention if the global React Native community was converging on a community solution this would lead to a more stable solution.
A few weeks later I'm investigating the strangest issue that folks could not obtain GPS coordinates while in airplane mode. Since GPS is more of a receiver than a literal outbound request - it should work in airplane mode.
Long story short - it was a bug in the [library](https://github.com/Agontuk/react-native-geolocation-service/issues/216?ref=connortumbleson.com#issuecomment-767150732). I was happy that it was getting resolved, but my issues did not end there. I could get a location at coordinate x and a few hours later after walking around an island get the same exact coordinate when another location was requested.
I figured that was a logic issue I created, but after a few months of recurring issues I could not resolve anything and it felt every upgrade to the GPS package was a dice roll if something unrelated would break. So I started digging into this package more so than my original investigation and some discoveries were made.
- It has 230 commits total.
- 188 commits from one author.
- 20 commits from a robot.
- 20 commits total from every other contributor combined.
This package is effectively a one man show that is probably used by hundreds of hundreds of businesses and people alike. I figured a package with such large usage would just be a bit more stable. Am I at fault for this in both a business and hobby aspect?
- For business - should we fund all packages we depend on that are crucial to an application's success?
- For hobby - should I try and contribute more than just issue reports and attempt to fix actual issues.
In this case - I took a different option and just switched packages to a paid [alternative](https://github.com/transistorsoft/react-native-background-geolocation?ref=connortumbleson.com). I did this because I figured GPS from a constantly updating OS on Android/iOS was best left to a company who specialized it.
---
In another case I'm starting with an existing application that we inherit and I'm trying to triage why this application is not yet using Hermes. Hermes was 2 years old at this point - so I was a bit surprised to see it still using the older JSC runtime. I end up tracking it down to an dependency the application used.
[react-native-queue](https://github.com/billmalarky/react-native-queue?ref=connortumbleson.com) uses [realm](https://github.com/realm/realm-js?ref=connortumbleson.com) which did not support Hermes till [v11](https://github.com/realm/realm-js/issues/2455?ref=connortumbleson.com). So I believe this is a simple fix, but it appears react-native-queue is abandoned without a commit since 2018.
With some more research - this project only has 5 source files in total. So after ranting previously about how small projects should be more stable - I'm surprised to find this abandoned project has 30 issues and 15 pending pull requests with only 5 source files!
In the defense of this project, most "issues" are people begging for support instead of a true bug. So this time because this library has no native components and quite small I think leaving this package shouldn't be needed. So I [engage](https://github.com/billmalarky/react-native-queue/issues/62?ref=connortumbleson.com#issuecomment-928035687) with some discussion internally and with the community and we (work) end up forking it.
So we had 3-4 years of tech debt to fix.
- We added some GitHub Actions for CI.
- Upgraded to Realm 11
- Fixed some documentation and type issues.
- Linted entire codebase.
So in the case of this project - we forked and patched and kept using it.
---
Lastly, I want to bring up a package [react-native-fs](https://github.com/itinance/react-native-fs?ref=connortumbleson.com), which is 1 of 3 popular packages for file system operations I could find.
The linked package has not only file system operations, but a complete upload/download support. Which makes me believe the feature set has become so large that it explains the open \~500 bugs on the project.
[https://github.com/itinance/react-native-fs/issues/542](https://github.com/itinance/react-native-fs/issues/542?ref=connortumbleson.com)
However, I pick an issue and see a PR merged years ago for a section of code I'm investigating and its still left open. Now I understand more and more why people use robotic accounts for closing/merging tickets after PR merges. It doesn't seem that a clean bug tracker is a pillar for this maintainer.
So I'm back to investigating a reported issue where every once in awhile our copy file line just duplicates the last copied file. So I find the above pull request as the last pull request to change the block of code where I believe the issue is occurring.
```java
private class CopyFileTask extends AsyncTask < String, Void, Exception > {
protected Exception doInBackground(String...paths) {
try {
String filepath = paths[0];
String destPath = paths[1];
InputStream in = getInputStream(filepath);
OutputStream out = getOutputStream(destPath, false);
byte[] buffer = new byte[1024];
int length;
while ((length = in .read(buffer)) > 0) {
out.write(buffer, 0, length);
Thread.yield();
}
in.close();
out.close();
return null;
} catch (Exception ex) {
return ex;
}
}
}
```
[https://github.com/itinance/react-native-fs/pull/597](https://github.com/itinance/react-native-fs/pull/597?ref=connortumbleson.com)
My Android development is weak, but I understand the authors intent with merging something to move an expensive operation to another thread.
However, I start wondering why we are yielding during background thread processing. It seems like without extreme care with scoped/thread-safe variables that we could cause our threads to trade priority and mix and match variables.
So I remove with that line with a patch and it ended up solving our issue immediately. So I upstream that [patch](https://github.com/itinance/react-native-fs/pull/1150?ref=connortumbleson.com) in form of a pull request and move on.
The pull request reminds me of some mistakes I made in Apktool in the beginning. Someone gives you a pull request and looks confident in a solution in an area you might not be. Soon you have code you didn't write and don't understand why its written in a certain way. This may have been the situation that led to this bug.
---
I do start wondering though if there is a better way for file-system operations. Like say we just take the most popular native implementations of file operations ([square/okio](https://github.com/square/okio?ref=connortumbleson.com) \- Android, ? - iOS) and write a wrapper for React Native. Would that be more stable than a highly basic and tested library for a few basic file operations? I'm not positive, but its worth the thinking.
Maybe this is just the fault of the React Native ecosystem. Think about it - a native library for React Native will have a complex iOS/Android build system, linking code from JavaScript to native and some various iterations of new/old architecture and Hermes/JSC.
With all that effort - how often do you see testing for Android, iOS and JavaScript within a library?
I know I rarely see it - since the effort to do real native testing isn't easy. Maybe the burden moves to React Native itself. Could they enable and produce an easier method for libraries to produce automated tests at the end-to-end level?
Perhaps its the development experience for libraries or a lack of knowledge on my part. You can open Android Studio and Xcode and still are left with a library that cannot find the React imports. Yes they will be there when your application is built, but boy it would be helpful to have this properly working during library development for the IDE support.
React imports not working while developing library.
Perhaps its the debugging experience. How painful is it to attempt debugging native code and/or JS code at the same time? I know I can debug JS pretty easily, but even that is a bit of a challenge with all the async threads jumping in and out of a bridge to native.
Perhaps its a bit of all those things combined that results in React Native packages that are a bit less stable and maintained than I'd prefer.
I'll keep doing my little part of putting up pull requests and forking abandoned repositories when required.
### Open Source & Saying "No"
URL: https://connortumbleson.com/2022/11/28/open-source-saying-no/
Last updated: 2025-02-04T11:42:42.000Z
Photo by [Roman Synkevych 🇺🇦](https://unsplash.com/@synkevych?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few weeks ago I was digging into a pretty complex issue that was only affecting less than 1% of users in the field with an application. With a constant mix of emotions working with React Native I appreciate how I can normally go all the way to the source during an investigation.
So I stumble upon a library known as [react-native-fs](https://github.com/itinance/react-native-fs?ref=connortumbleson.com) and I learn what I need to, but also find some interesting discoveries.
- It has \~500 open issues.
- It has \~60 open pull requests.
- It has a built in HTTP library for downloading files.
- It has a library built in for uploading files.
So while I'm trying to just research a tiny charset issue with a created file - I learned the feature set of this project is quite large. So in a situation like this I believe the author inherits a good deal of tech debt of things to maintain.
So I get a bit selfish and wonder if the library was specific to just the filesystem and ignored all those extra features - could I anticipate a more stable solution?
From an Open Source maintainer myself I think its extremely important to say "no" to requests/features that bloat your library too much. What I've seen occur many times played out is something like this:
- Talented contributor Z delivers feature X to project Y.
- Project Y accepts it.
- Feature X has an issue in latest release.
- Project Y didn't start that feature so asks contributor Z for some help.
- Contributor Z is not around and the fix is taken in by the project.
So a project shouldn't think about the short term benefit of a new feature, but understand the long term implication of supporting such feature.
I may have accepted a feature to re-add support for 32 bit binaries in Apktool, but I struggled for hours to figure out how to re-add that support when the upstream AOSP project released a new major version of Android.
I did however say "No" to adding Apktool support for the actual Android platform. Since I feared that support of keeping that feature added would be extremely difficult.
---
So moving back to the filesystem research I started with. I began exploring for a package that might be scoped to just filesystem operations and nothing else.
I found the reversal with [rn-fetch-blob](https://github.com/joltup/rn-fetch-blob?ref=connortumbleson.com) an interesting project that started because React Native struggled with properly uploading Blob (binary) contents.
The package exploded with popularity and sure enough added a filesystem implementation to it. So much like we saw with the other filesystem package:
- Forked and continued under a new owner.
- \~450 open issues.
- \~50 open pull requests.
[https://github.com/joltup/rn-fetch-blob](https://github.com/joltup/rn-fetch-blob?ref=connortumbleson.com)
So I get selfish again. I'd really wish this library was split between file access and network module. It seems in my research that the smaller a library's feature set is - the more stable it is.
This is probably the [Unix philosophy](https://en.wikipedia.org/wiki/Unix%5Fphilosophy?ref=connortumbleson.com) at the end of day and I think I'm pretty aligned with it now. I just want libraries to stay true to a small feature set and do it well.
I'm exhausted from seeing a library abandoned because it expanded too much in features.
I'm exhaused from seeing a library buggy because it expanded too much in features.
I'm exhaused from internal debates rewriting a package and assuming that responsibility to have a smaller isolated feature set.
All in all I'm being much more careful when researching dependencies and libraries before bringing them in.
### Apktool v2.7.0 Released
URL: https://connortumbleson.com/2022/11/24/apktool-v2-7-0-released/
Last updated: 2025-02-04T11:42:43.000Z
Apktool v2.7.0 has been released! This release includes a small feature as well as packing in many improvements to handle the continued cat n mouse game with obfuscation at the resource level.
Large changes you'll notice as improvements are:
- Support for API 33
- Enhanced support for AndResGuard / Proguard resource tricks
- Ability to generate a network security config via `--net-sec-conf`
- Correct compression handling with remapped resources.
- Enhanced support for applications with multiple styles res types.
This release was originally labeled as 2.6.2, but as the release was being built it was clear this was not a patch release and instead more fit following semantic guidelines a feature release.
The release went a bit longer than intended, but we introduced a few regressions during the building which delayed stabilizing the release. Our test suite has been adjusted to more easily catch this prior to merge. Our test suite also now runs on JDK8 through JDK17 on Windows, Mac and Linux for a full set of cross platform automated tests.
As what has become common - the community has stepped in massively to deliver great fixes and improvements to the tool. I can't thank them enough.
So welcome to Apktool 2.7.0
---
**This release had 118 commits by 15 people**
- Connor Tumbleson (iBotPeaches) - 97
- erev0s - 4
- Igor Eisberg - 4
- Dominic Lemire - 2
- Build-0-Matic - 1
- Danealau - 1
- Goooler - 1
- Jonathan Schoeller - 1
- Kirlif - 1
- Miepee - 1
- Sven Marquardt - 1
- Tvildo - 1
- Victor de Pedraza Ajenjo - 1
- auermich93 - 1
- surendrajat - 1
---
# Changes since 2.6.1
- \[[#2845](https://github.com/iBotPeaches/Apktool/pull/2845?ref=connortumbleson.com)\] - Add SDK T (API 33) support.
- \[[#2776](https://github.com/iBotPeaches/Apktool/issues/2776?ref=connortumbleson.com)\] - Add SDK S v2 (API 32) support.
- \[[#2787](https://github.com/iBotPeaches/Apktool/pull/2787?ref=connortumbleson.com)\] - Update internal aapt/aapt2.
- \[[#2809](https://github.com/iBotPeaches/Apktool/issues/2809?ref=connortumbleson.com), [#2714](https://github.com/iBotPeaches/Apktool/issues/2714?ref=connortumbleson.com)\] - Add support for newest `ResourcesTypes.h` specs (policy, overlay and staged alias).
- \[[#1622](https://github.com/iBotPeaches/Apktool/issues/1622?ref=connortumbleson.com)\] - Add ability to generate generic network security config (`-n` / `--net-sec-conf`).
- \[[#2843](https://github.com/iBotPeaches/Apktool/issues/2843?ref=connortumbleson.com)\] - Add helpful message during built apk message to identify location of apk.
- \[[#2918](https://github.com/iBotPeaches/Apktool/issues/2918?ref=connortumbleson.com), [#2662](https://github.com/iBotPeaches/Apktool/issues/2662?ref=connortumbleson.com)\] - Add bleeding edge smali package (2.5.2-dirty) via jitpack.
- \[[#2952](https://github.com/iBotPeaches/Apktool/pull/2952?ref=connortumbleson.com)\] - Add build support for JDK 17.
- \[[#2473](https://github.com/iBotPeaches/Apktool/issues/2473?ref=connortumbleson.com)\] - Fix resource unclosed during unknown file handling. (Thanks auermich93)
- \[[#2815](https://github.com/iBotPeaches/Apktool/issues/2815?ref=connortumbleson.com)\] - Fix style strings regression between aapt1/aapt2 builds. (Thanks IgorEisberg)
- \[[#2778](https://github.com/iBotPeaches/Apktool/issues/2778?ref=connortumbleson.com)\] - Fix support for `uses-native-library` in Manifest.
- \[[#2789](https://github.com/iBotPeaches/Apktool/issues/2789?ref=connortumbleson.com)\] - Fix support for `usesPermissionFlags` in Manifest.
- \[[#2855](https://github.com/iBotPeaches/Apktool/issues/2855?ref=connortumbleson.com)\] - Fix windows helper script to allow spaces in path name.
- \[[#1719](https://github.com/iBotPeaches/Apktool/issues/1719?ref=connortumbleson.com)\] - Fix decoding application if using multiple style res types. (Thanks tvildo)
- \[[#2615](https://github.com/iBotPeaches/Apktool/issues/2615?ref=connortumbleson.com)\] - Fix handling with malformed namespaces. (Thanks ljysdfz & MyAnoneNeko)
- \[[#2887](https://github.com/iBotPeaches/Apktool/pull/2887?ref=connortumbleson.com)\] - Fix handling of sparse flags during resource parsing. (Thanks iamr0s)
- \[[#2878](https://github.com/iBotPeaches/Apktool/issues/2878?ref=connortumbleson.com)\] - Fix crash when parsing a manifest numeric that resolves as null.
- \[[#2900](https://github.com/iBotPeaches/Apktool/issues/2900?ref=connortumbleson.com)\] - Fix crash when parsing HTML string with empty tag leading to invalid entry. (Thanks MaSven)
- \[[#2805](https://github.com/iBotPeaches/Apktool/issues/2805?ref=connortumbleson.com)\] - Fix crash when wrongly decoding overlay policies. (Thanks gramound)
- \[[#2945](https://github.com/iBotPeaches/Apktool/issues/2945?ref=connortumbleson.com)\] - Fix regression when decoding overlay policies.
- \[[#2924](https://github.com/iBotPeaches/Apktool/pull/2924?ref=connortumbleson.com)\] - Fix respecting of `$XDG_DATA_HOME` on Linux for framework files location. (Thanks Miepee)
- \[[#2925](https://github.com/iBotPeaches/Apktool/pull/2925?ref=connortumbleson.com)\] - Fix storing of obfuscated resource files for properly applying proper compression on build. (Thanks Kirlif)
- \[[#2908](https://github.com/iBotPeaches/Apktool/issues/2908?ref=connortumbleson.com)\] - Fix issue parsing an obfuscated resource with a improperly referenced parent resource.
- \[[#2927](https://github.com/iBotPeaches/Apktool/pull/2927?ref=connortumbleson.com)\] - Fix `--only-main-classes` winning over `--no-src`. (Thanks Surendrajat)
- \[[#2933](https://github.com/iBotPeaches/Apktool/issues/2933?ref=connortumbleson.com)\] - Fix disassembly of files mixed between `r`, `R` and `res` folders.
- \[[#2940](https://github.com/iBotPeaches/Apktool/pull/2940?ref=connortumbleson.com)\] - Fix handling of `(name removed)` resources. (Thanks Danealau)
- \[[#2943](https://github.com/iBotPeaches/Apktool/pull/2944?ref=connortumbleson.com)\] - Fix disassembly of raw resources for AndResGuard.
- \[[#2911](https://github.com/iBotPeaches/Apktool/issues/2911?ref=connortumbleson.com)\] - Fix attribute referencing to self package while using AndResGuard.
- \[[#2771](https://github.com/iBotPeaches/Apktool/issues/2771?ref=connortumbleson.com)\] - Revert automatic workaround for using private resources.
- Upgrade CI Workflow to leverage latest actions. (Thanks Goooler)
- Upgrade `org.apache.commons:commons-text` to `1.10.0` (from `1.9`)
- Upgrade `org.yaml:snakeyaml` to `1.32` (from `1.29`)
## Notes
- Applications are becoming more and more difficult to build with aapt1, using the `--use-aapt2` flag during rebuild is a good test.
## Download
[Download Apktool 2.7.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.7.0.jar?ref=connortumbleson.com)
- [Apktool 2.7.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.7.0.jar?ref=connortumbleson.com)
- `ec5b561de3c55ddc2e2223c504b2726b` (md5)
- `c11b5eb518d9ac2ab18e959cbe087499079072b04d567cdcae5ceb447f9a7e7d` (sha256)
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### The United States of Wall Street
URL: https://connortumbleson.com/2022/11/21/the-united-states-of-wall-street/
Last updated: 2025-02-04T11:42:43.000Z
Photo by [Aditya Vyas](https://unsplash.com/@aditya1702?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On the day this blog goes live the World Cup 2022 will have started with the first match. There is no other way to state that Qatar hosting this once every 4 year event is pure corruption.
If we look at just soccer itself - the country has never qualified for a World Cup ever.
So what led to it winning the project bid? Corruption way up at FIFA presumably due to Qatar's insane wealth and GDP making its way to the pocket of those responsible for the voting.
So lets just make a bullet point list of all the things that make Qatar not a good place for a World Cup.
- Its roughly the size of Connecticut.
- It is insanely hot, so the World Cup was rescheduled to be during winter months.
- Human rights violations and deaths from building stadiums.
- It sucks to be a women there - you can't be alone and have to dress a certain way.
- Alcohol was banned at the stadiums after suggesting it would be allowed.
- Despite the heat - knees and shoulders must be covered.
So this is just sad - I'm not sure how many people took bribes or profited for this, but it seems the world is clearly moving in a direction where wealth talks a lot.
I wouldn't want to be a fan traveling to this World Cup - one little mistake and you might never return home.
---
Next we have FTX, which somehow if you haven't heard will be labeled as one of the largest financial scandals of all time.
Somehow lost 16 billion of funds via poor trades, fraud, mistakes and more.
There is no real way I can explain this mess of fraud, but plenty of others have done already.
This Patrick Boyle video above has a good explanation of this collapse in a very dry humor video.
So I just can't figure out what I'm more upset about.
- That millions of people were dumb enough to trust FTX with their own funds with return percents that just seem too good to be true.
- That hundreds of firms and investors were dumb enough to invest funds in this corporation without a basic financial look at their books.
Maybe this drive to fraud others of funds is a natural instinct to some. It happened with Madoff and Enron without fancy cryptocurrency, so the unregulated sector of crypto must attract those with a drive to be nefarious.
Its an odd thing when you look at crypto as a whole. Many love it for how unregulated it is and how volatile it is - this leads if played right to major wins. However, when funds are lost the first thing people demand is regulation and restoration of funds.
You can't have it both ways so these users find themselves in an odd position. They want the insane returns of a ponzi scheme in a get rich quick scheme, with all the regulation when it goes wrong.
The crypto ecosystem is going to have some major shakeups in the next few months as this collapse ripples through the exchanges.
---
[https://www.congress.gov/bill/117th-congress/senate-bill/623](https://www.congress.gov/bill/117th-congress/senate-bill/623?ref=connortumbleson.com)
If we look at America and time-zones we can see an attempt to end Daylight Savings, which has been [stuck](https://www.congress.gov/bill/117th-congress/senate-bill/623?ref=connortumbleson.com) in the House since 3/16/2022\. I'm not well versed enough in how our government works with bills, but I do know that it blew my mind how many corporations are obsessed with time change.
- Entertainment companies want it darker earlier as folks tend to watch TV if it gets darker earlier.
- Golf wants it brighter longer so more tee times can be used.
It seems all these subset of points all have money at the core. It blows my mind we can't have a legitimate discussion about the impacts of accidents/safety and more with time changes. Instead of having millions of lobbying pumped in to stick to a certain timezone for revenue gains.
---
I can type all of this though and realize I'm just as affected. I like money - it keeps my lifestyle and roof over my head. So while I haven't been dumb enough to fall for a clear crypto scam, I'm not walking around working for free.
I'm not sure if the world has always been this obsessed with revenue, but I'm sure getting tired of what looks like clear fraud & corruption happening over and over again.
### Door to Door - Better Earth
URL: https://connortumbleson.com/2022/11/14/door-to-door-better-earth/
Last updated: 2025-02-04T11:42:44.000Z
As I sat writing a different blog - my door got a knock. Which was odd on a Saturday, especially since the last time someone knocked instead of using the doorbell was [Lumino Solar](https://connortumbleson.com/2022/08/29/door-to-door-solar-n-more/). To my unfortunate luck - another solar company was going door to door and this time it was [Better Earth](https://www.betterearth.solar/?ref=connortumbleson.com).
This time another recollection of the event.
---
This time two different individuals were at my door arriving via two little scooters. Since it was just a knock at the door - my gut said this was a solicitation before I even opened it.
A part of me wants to just gain a bit more rudeness and close the door and walk away, but I continue to listen to the speech given by these folks to blog about it.
We will jump right into it with a claim from these individuals about the true purpose behind my new digital meter.
Digital meter allows me to accept solar energy?
0:00
/0:28
1×
I'm not sure why each solar solicitation loves to explain a different reason of what the digital/SMART meter I have does. It must be a technique to trick an individual to thinking they have technology that enables them to more easily obtain solar panels.
Now sure, let's be real here. You aren't getting solar panels with an analog system as you need to be able to send/receive power information in real time. What I think is odd is how this individual makes a claim that this is what enabled me to accept solar energy from the many solar farms around Tampa.
We can head straight to the [TECO website](https://www.tampaelectric.com/company/ourpowersystem/aboutyourmeter/smart-meter-updgrade-faq/?ref=connortumbleson.com) and read the features of the digital meter to debunk that.
> **What is a smart meter? How is it different?**
> Your meter, also referred to as a smart meter or "Advanced Metering Infrastructure" meter sends data to Tampa Electric through a secure wireless network and eliminates the need for us to manually read your meter each month. Smart meters provide enhanced services such as the ability to start or transfer service remotely, respond to outages more quickly and provide you with daily usage information so you can be more efficient.
So I called it out this time and explained you need a [bi-directional meter](https://www.tampaelectric.com/company/solar-energy/connectingyoursolar/?ref=connortumbleson.com) for solar and validation from the electric company itself.
---
Now much like the last solar visitor - these guys try and reinforce the idea that I will pay $0 down for solar and no longer pay TECO and instead pay them a low monthly rate for the solar panels that I own. This is true to a degree - they don't want to scare away customers with a down payment. You'll pay $0 down and then have a large loan to pay like normal.
So I want to go dig into Better Earth's support to see if I can find anything concrete.
[FAQ Broken](http://support.betterearth.solar/?ref=connortumbleson.com)
Too bad their FAQ page doesn't work and most, if not all, the other tabs just redirect to a "Contact Us" page. What does work on the site is just education about solar and how Better Earth is helping to save the Earth. So while I want to learn about the nitty gritty details of power estimations, loans, etc - that information is not available. My guess being the "report" they want to generate for me will contain all of that.
---
Finally, I heard something different with this company that they claim to pay your electric bill for as long as their panels are installed, but not yet working. To avoid you having a situation where you are paying both an electric bill and a solar loan bill.
No double bill paying.
0:00
/0:30
1×
This seemed like a nice idea as it forces the company (Better Earth) to ensure your panels are validated, installed and working. However, what I was told at my door doesn't really line up with reviews on [BBB](https://www.bbb.org/us/ca/santa-ana/profile/solar-energy-contractors/better-earth-solar-1126-1000077532/customer-reviews?ref=connortumbleson.com).
> I signed a contract in May and panels were installed on June 20th. To this day (Sept. 18th) the service has not been been turned on and I have been **paying the electric bill** through the hottest months of the year. I have **paid the company 90% of the cost for the panels** and still have not heard back
> Cant rate the actual service because even though the panels are in and the money **has been paid** we still have no solar power. We signed a contract in May and the panels were finally installed in early August we were told we may not have use of them until November!!! Meanwhile we are **paying giant utility bills** for air conditioning during a heat wave.
So it seems if you can find reviews that shows customers with a paid/paying panels that are still paying a electric bill, then that is not true.
---
Looking back at this I just naturally don't trust any business that relies on door to door sales. They tried to convince me that I would be the model home with discounts and all I had to do was agree to a free report.
Unfortunately, they hit all my red flags.
- Showing up on a weekend unannounced.
- Not dressed in any business labeled attire.
- No businesses cards/materials.
- Knocking the door instead of ringing it.
So ultimately I wasted seven minutes at my door releasing air condition to the world for the known answer of saying "no". However, I got to have some fun.
Do you work for TECO?
0:00
/0:08
1×
I made up that I helped build the digital meter so I could interject what they actually do so I could immediately call that bluff.
I guess I might start blogging about each visitor to my door.
### The Research Begins
URL: https://connortumbleson.com/2022/11/07/the-research-begins/
Last updated: 2025-02-04T11:42:44.000Z
Photo by [RephiLe water](https://unsplash.com/@revolution%5Fin%5Ffiltration?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
In just under two months 2022 will be over and while I'll continue to blog weekly - I am going to attempt some interesting research for blog content as the new year hits. So here are some experiment/observations I have planned.
---
**Mail Spam**
I am noticing that nearly all of mail I get physically delivered I did not request, want or need. I want to collect all my mail for a month, classify it and organize it in order to figure out just how much junk I get. As part of that I want to identify all the types of mail and figure out if I was somehow responsible indirectly for obtaining it.
Now while collecting evidence for this future blog - I realized that mail this close to voting day will probably skew my stats. So I'll collect mail for the entire month of October, November and December and use that for a post.
**Angry Drivers**
With no real facts to back this up - I feel my drive to work post 2020 is way more toxic and dangerous than prior. The real change I'm noticing is how many people run a red light by a mile. This is a problem that is continually exacerbated by the never ending circle of light runners.
Take a left hand turn that you can do if safely able to cross a few lanes of traffic, but traffic normally doesn't allow that until the turn is explicitly green. So as the north/south drivers get a yellow light and red - they will run it, so then the drivers waiting for the left turn even though they have a red will also run it. At this point the east/west drivers have had a green like for 3 seconds, but they can't move because everyone is still running red lights. So what do they do? They run the red light continuing the pattern.
I will record my miles driven for a few weeks and collect easy stats I can remember and record after the drive. I'll augment the post with a few dash-cam clips if I can create a good optimized method to encode the videos. Since each minute of my dash-cam presently is 300mb\~ of video.
**Running Safety**
I bought a new running watch and new running shoes with the goal to change up my workout plan to exactly what the watch instructed me to do. This has led me to new areas to run and I've noticed a few chosen routes give me a good chance of being hit by a car.
Some because the sidewalk doesn't exist at some points, some because cars are oblivious to runners and a few because the built infrastructure does not consider the sidewalk visibility up to an intersection.
I want to take a look at some routes, investigate the sidewalk and identity areas where I think Temple Terrace could do better to promote a safer running environment - with proof photos and videos.
---
Some of these have already begun information gathering, so 2023 will hold what I hope ends up being great posts.
### Hellraiser
URL: https://connortumbleson.com/2022/10/31/hellraiser-movies/
Last updated: 2025-02-04T11:42:44.000Z
Photo by [engin akyurt](https://unsplash.com/@enginakyurt?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Early this month in October 2022 I noticed a trailer for a new movie known as Hellraiser showing up in Hulu.
As the title image card shows above this classic look of pins on the face reminded me of the original Hellraiser (1987) movie that I barely remembered. So after watching this remake I realized I needed to re-watch the original. Little did I know that there were 9 more films following the original. So for the past few weeks I watched every single Hellraiser movie and this is my recap.
---
**Hellraiser (1987)**
[IMDB - Hellraiser](https://www.imdb.com/title/tt0093177/?ref=connortumbleson.com)
The original movie had an interesting plot that I think was pretty unheard of for a movie in the 80s, but were known to some via the related books. We saw director Clive Barker invent these characters known as Cenobites that are prison guards of Hell. They inflict massive amounts of damage, pain and more to those unlucky enough to unlock a box known as the Lament Configuration.
So the film starts with an individual drawn to pleasure via pain purchasing a box said to open a realm to great pleasure. This of course is via the arrival of Cenobites to capture that soul and trap it in endless pain. This movie sets up the possibility that blood spilling on the same spot where the soul was captured leads to that individual being revived as skin and bones in the real world.
The revived clump of bones and blood must kill and collect blood working their way up to stealing the skin of another individual. So this movie continues the dynamic between the Cenobites working with a human to figure out how someone has escaped Hell.
Towards the end of the movie - its clear many people are dead or trapped in Hell and the Cenobites are still in full swing. This makes it clear there must be another movie coming and sure enough one year later there was.
**Hellbound: Hellraiser II (1988)**
[IMDB - Hellbound: Hellraiser II](https://www.imdb.com/title/tt0095294?ref=connortumbleson.com)
This film starts with another individual obsessed with the Lament Configuration who accidentally ends up freeing a woman killed in the first movie from Hell. This movie takes us further into the ecosystem of Cenobites as there appears to be some power dynamic between the god of Hell - The Leviathan and the Cenobites.
The world is depicted as an endless labyrinth and we see how a Cenobite is made. It appears some captured souls instead of being given an endless life of torment are instead mutilated beyond belief and converted into a Cenobite. The main character we've been following between the movies ends up surviving a trip to Hell and escapes just barely after witnessing the Cenobites killed via a Leviathan's created Cenobite.
Which is the first time I lost track of what was going on. Since if the Leviathan produced the other Cenobites, then why does a recently produced Cenobite have more power and urge to eliminate the others?
All in all though, a good follow up film to further the story line from the first. With the original Cenobites dead though - the next movie would begin a deviation from the story thus far.
**Hellraiser III: Hell on Earth (1992)**
[IMDB - Hellraiser III: Hell on Earth](https://www.imdb.com/title/tt0104409?ref=connortumbleson.com)
The 3rd movie I was glad to see feature Doug Bradley (The lead Cenobite) again, but the story I couldn't follow. Apparently when he (Pinhead) was killed in the 2nd movie, a fragment of the Cenobite was burned into a statue. That statue could revive him back onto Earth after he drained a few bodies of blood.
After alive on Earth, he slaughtered hundreds at a dance club and began creating Cenobites from all the characters we recognized as important to the main character. This was just odd as the Cenobites in the first film were absolutely straight to code when it came to whose soul was taken. It was strictly related to whomever opened the box.
So for the lead Cenobite to return to Earth and murder a ton of people didn't really make sense to me. His grudge was with The Leviathan in Hell, so why kill a bunch of humans on Earth?
It just kinda bugged me and it looked the only thing in this movie that could be called Hellraiser was the lead Cenobite and everything else was just an attempt at a crash grab.
**Hellraiser: Bloodline (1996)**
[IMDB - Hellraiser: Bloodline](https://www.imdb.com/title/tt0116514/?ref=connortumbleson.com)
This movie was an attempt like most films to go back and time and try and establish some history of characters via a prequel and a far off sequel. It does help in some regards as we see Pinhead was left to reign hell after one character (Angelique) leaves Hell for Earth in 1796\. This helps establish why Hell transitioned to a more structured pain/pleasure approach under new leadership.
We get to see the history of making of the Lament Configuration and how this blood line of family have been building traps/boxes for Cenobites for hundreds of years.
Though it all just felt odd as we were learning about the past from the far future in the 2100's when some futuristic space ship is building a weapon which apparently only a bloodline human can do to destroy the Cenobites. It just made no sense to me what made this specific family so special and how they could build something that suddenly gained the power to transcend worlds.
They do end up killing Pinhead - so we know in 2127 all the Cenobites will be killed by a device built solely for that purpose. So after watching this film I was hoping the next film would be more about Cenobites and what happened during this 200 year period that Pinhead reigned over Hell.
**Hellraiser: Inferno (2000)**
[IMDB - Hellraiser: Inferno](https://www.imdb.com/title/tt0229440/?ref=connortumbleson.com)
The 5th movie didn't deserve Hellraiser in the title in my brutally honest review. The plot was just basically about a scumbag person that was slowly watching his friends get killed by an assailant. Towards the very end of the movie we learn this was just physiological torture from Pinhead and the movie is over.
I couldn't find anything redeeming about this film since it felt like it changed Pinhead to be more attracted to physiological torture than physical and only had a few lines in the entire film. I guess though after the 4th film it does make sense that perhaps Pinhead is still adjusting his technique for ruling Hell.
Since it was the first Hellraiser film to go directly to video - it made sense that perhaps the quality of these films had begun to decrease.
**Hellraiser: Hellseeker (2002)**
[IMDB - Hellraiser: Hellseeker](https://www.imdb.com/title/tt0274546?ref=connortumbleson.com)
The 6th movie was going to be different for sure, because I saw the main character from the first two films reprising her role in the 6th film. The plot however was just a bit odd. We learn Kristy was being cheated on and her husband was planning to kill her. So we learn after she was forced to open the Lament Configuration she struck a deal with Pinhead to deliver five souls in exchange for hers.
So now we learn via a mix of events that her husband is trapped in Hell reliving a nightmare as we learn how all five souls were obtained. Much like the last movie - we only see Pinhead via a few flashbacks and a tiny portion at the end of the film. Once again another disappointing film - it seems like a cheap plot for a regular horror film, but carries the Hellraiser title for no real reason.
**Hellraiser: Deader (2005)**
[IMDB - Hellraiser: Deader](https://www.imdb.com/title/tt0337636/?ref=connortumbleson.com)
The 7th movie tries to tie back to the 4th film with another family member from the toy maker (who made the box). This time this person believes if they kill a person after they open the Lament Configuration, but before the Cenobites arrive to take the soul they can build up an army to gain access to Hell.
So once again just an odd plot change. Since the Cenobites have not shown delay or ignoring souls without a trade for every other film. This was a new pattern starting that showed we'd really only see Cenobites for an extended period of time at the very end of the film.
So it was another film that seemed to change the rules established by the previous films and didn't have much of a redeeming factor.
**Hellraiser: Hellworld (2005)**
[IMDB - Hellraiser: Hellworld](https://www.imdb.com/title/tt0354623?ref=connortumbleson.com)
The 8th movie attempted to add some technology into the mix, but it was so poorly executed I'm not sure what the point was. Apparently there was a game that if beaten invited you to a Hellworld party. With characters that we had to force ourselves to believe were actually nerds invested in a demonic series of games. However, we learn near nothing about the back story and only know their friend commits suicide from getting too invested in this game prior to the party.
These nerds show up the party for beating Hellworld with hundreds of others. This plot felt more like SAW than a Hellraiser film as we learn the party host is actually the father of the dead child and intending to inflict pain on the friends for causing the death of his son. So am I really expected to believe that best friends don't know their dead friend's father?
Turns out the kids were drugged and buried alive and hallucinated about getting killed via the characters (Cenobites) from the game while at the party. So we are watching the party from the point of view of the hallucinations of those buried alive. So once again at the very end of the film Pinhead arrive to claim the soul of the party host who summons the Cenobites.
At this point I was really only watching the films for Doug Bradley (Pinhead) as he carried the films.
**Hellraiser: Revelations (2011)**
[IMDB - Hellraiser: Revelations](https://www.imdb.com/title/tt1716747/?ref=connortumbleson.com)
The 9th film I did not know what to expect as I saw that Doug Bradley would no longer play Pinhead. Additionally learned before watching that this film was made in two weeks solely to prevent losing the rights to the series. So boy what a horrible movie this was.
It starts off near immediately with two punk kids and no story line who end up disappearing. Years later the families reunite to mourn the lost of kids who then discover the video of the adventure when they went missing has been documented. Of course the Lament Configuration is in the belongings alongside the video and it is opened and one of the kids returns. This very much reflects the story line of the 1st and 2nd film, but this time represents a character we know nothing about.
Much like the first film we discover the kid is actually wearing the skin of another child and the Cenobites arrive to collect souls as the box is opened. This time it turns out everyone is cheating on everyone and people are killed and souls taken and the movie is over.
I wanted to like the new Pinhead, but I felt like he just made a bunch of facial expressions and did not contribute to the vibe of Pinhead I expected. This movie was not great and I got mad for watching it.
**Hellraiser: Judgement (2018)**
[IMDB - Hellraiser: Judgement](https://www.imdb.com/title/tt5476182/?ref=connortumbleson.com)
At this point I was at the last movie before the reboot and all my hope was lost, but I pushed on. This movie progressed some unexplored areas of the Cenobites and introduced some new characters which was welcome.
It appeared we learned some adaptions of harvesting souls using some truly gruesome and demonic characters. What really separated this film is instead having us follow a main character who we learn is actually the serial killer they are hunting. So evil finds evil and Pinhead vs the main character goes down. This time though an angel intervenes in all white.
There is some biblical dialog here about good doesn't exist without evil and to allow the serial killer to remain on the planet. The killer interprets this as a blessing from God, but gets quickly corrected to only a temporary blessing to instill fear in sinners for the example they will make out of him in time.
People die again and this time Pinhead kills an angel and this upsets God. God expels Pinhead from Hell and he becomes a mortal on Earth and the movie is over. So at this point if we know Pinhead dies in 2127, but is no longer the ruler of Hell somewhere in 2000's then we either have a plot hole or he is reinstated between those dates.
**Hellraiser (2022)**
[IMDB - Hellraiser](https://www.imdb.com/title/tt0887261/?ref=connortumbleson.com)
So now we were caught up for the real remake. A restart of the 1987 film and I enjoyed it. The new Cenobites reminded me of the first film with a great desire to go according to the code.
The Lament Configuration box now had to adapt between each sacrifice before making the final shape which would call upon The Leviathan for a selection of riches for whomever holds it. However, knowing the Cenobites the best option refers to becoming a Cenobite and living an eternity of ruling and torment.
The story progresses with twists and turns and this time we get to see the Cenobites very often with dialog. This was such a great change of pace from the previous films where we really only saw dialog from the Cenobites at the end of the film.
This time we had steady interactions with Pinhead and a less visually dark movie than the previous. The plot had some tiny issues here and there, but otherwise was a good reboot to the series.
---
So I could have gone on in life without seeing probably five of those films, but I'm glad I watched the entire series for this post.
### Mortgage Life Insurance
URL: https://connortumbleson.com/2022/10/24/mortgage-life-insurance/
Last updated: 2025-02-04T11:42:45.000Z
Collection of Mortgage Insurance letters
After obtaining my first mortgage the amount of sketchy insurance letters I got in the mail were unreal. I only have 10 in front of me of the ones I collected, but it easily had to be at least 50.
All of these letters have the same type of structure, but not a single duplicated phone number or P.O box.
The letters start with some form of:
- *Our records indicate that you have not taken advantage of...*
- *You are invited to participate in a low cost...*
- *You are entitled to participate in our low cost...*
Which then proceed to list the exact amount of your mortgage, which is easily obtainable from public record and attempt to convince you that you need Mortgage Protection Life Insurance.
If we take a single one of the letters - the exact text is:
> You are entitled to participate in our low cost Mortgage Protection Life Insurance program, which can protect your $xxx,xxx loan in case of an unexpected tragedy. Without this plan your family would still have to make your monthly mortgage payments.
> See Below - plan can include choice of Life and/or Disability income benefits.
> Connor Tumbleson, your benefits can include:
>
> **Death Benefit**
> Pays off your $xxx,xxx loan in the event of your death from accidental or natural causes.
>
> **Disability**
> Pays your Mortgage Loan payments if you become sick or injured and cannot work.
>
> **Unemployment**
> Make your premiums in case of job loss\* (available in most states)
>
> **Money Back Option**
> Return your premiums if the benefits are not used by the end of the mortgage term
>
> Knowing your family will have the funds to help them from losing their home.
>
> Consultations can be held over the phone or through video. No in-person appointment is required.
Scattered throughout the letter in tiny text is:
- *Not affiliated with or sponsored by XXX Loans.*
- *Solicitation not authorized by and loan information not provided by XXX Loans*
- *Specific Mortgage information gathered from public record.*
- *Benefits and carriers will vary and subject to underwriting approval.*
So you can tell from this letter that this is not official, but an attempt to get me (the homeowner) to sign up for some insurance.
Lets take a look at what they don't tell you when it comes to the actuality of Mortgage Life Insurance.
- They explicitly list "natural causes" as an allowed death benefit - which could entirely be a possibility, but most insurance policies don't actually list natural causes as a valid death benefit.
- They list "disability" under the clause that if you cannot work - this can pay your mortgage. This in actuality has to proven to an extreme that you cannot work to enact this benefit.
This goes on and on in terms of exaggerated benefits without telling the true story. So I wanted to dig into the companies behind this, which is not made easy.
I'd imagine for a normal business exchange to have a reachable business number or website. So out of the ten letters in front of me here is the break down of contact information:
- 0/10 - Website Links
- 2/10 - Phone Numbers
- 10/10 - Return this form with enclosed paid envelope.
"Business Reply Mail" collection
So this will be tough, we only have 2 phone numbers and a mess of P.O boxes to research. For Googlers, the numbers/addresses below
- (833) 954-0664
- (833) 905-2777
- PO Box 95347, Palatine IL 60095
- PO Box 268841, Oklahoma City OK 73126
- PO Box 100080, Kennesaw GA 30156
- PO Box 6373, Asheville NC 28816 (2x)
- PO Box 154329, Irving TX 75015
- PO Box 1748, Kennesaw GA 30156 (2x)
- PO Box 7744, Seminole FL 33775
- 1635 W 135th St, Gardena CA 90249
So we got lucky here and have an address and a few duplicates so lets do some research and see if we can find any companies behind this.
[https://twitter.com/lippard/status/1404603601691971584](https://twitter.com/lippard/status/1404603601691971584?ref=connortumbleson.com)
A quick Google search and it appears someone named Jim Lippard has done the research for one of these addresses already and discovered Lead Pros LLC behind it.
The [Better Business Bureau](https://www.bbb.org/us/ca/los-angeles/profile/information-bureaus/lead-pros-1216-13162911/customer-reviews?ref=connortumbleson.com) has dropped a big F on this business and the comment section mimics my experience.
> Monsters who prey on old people. Everything's marked final notice and it's just insurance scam. (Holly W)
> Mortgage insurance scam. I get more mail from them than from every other spammer combined. (Autumn S)
You can just pop these addresses into Google one at a time and end up on another BBB page.
- PO Box 95347 - 1 star (15 reviews), F rating on [BBB](https://www.bbb.org/us/il/palatine/profile/insurance-companies/mortgage-protection-plan-0654-88377313?ref=connortumbleson.com) (Mortgage Protection Plan).
- PO Box 268841 - 1.17 stars (48 reviews), A+ rating on [BBB](https://www.bbb.org/us/ok/oklahoma-city/profile/insurance-companies/globe-life-and-accident-insurance-company-0875-90715683/customer-reviews?ref=connortumbleson.com) (Globe Life and Accident Insurance Company).
- PO Box 100080 - ? (Direct Mail Processing LLC, [Ref #1](https://boisetech.org/2020/03/18/official-documents-fraud-records-division-dmpoptout-com-direct-mail-processing-llc/?ref=connortumbleson.com))
- PO Box 6373 - 1 star (13 reviews), F rating on [BBB](https://www.bbb.org/us/ca/los-angeles/profile/information-bureaus/lead-pros-1216-13162911/customer-reviews?ref=connortumbleson.com) (Lead Pros LLC)
- PO Box 154329 - ?
- PO Box 1748 - 1.14 stars (22 reviews), B rating on [BBB](https://www.bbb.org/us/ga/marietta/profile/direct-mail-advertising/distribution-processing-center-llc-0443-27755692?ref=connortumbleson.com). (Distribution Processing Center, LLC)
- PO Box 7744 - 1.11 stars (35 reviews), not rated on [BBB](https://www.bbb.org/us/ca/arcadia/profile/mortgage-broker/mortgage-protection-services-1216-1022976?ref=connortumbleson.com). (Mortgage Protection Services)
So I don't need to spend any more time researching this. The intent is clear:
- Crawl public record looking for new mortgages.
- Attempt to convince the homeowners with red letters, bolded text and short timeline.
- Hide business information behind direct mailers so homeowner has to reach out via mail.
- Business passes you on to less than preferred insurance policy that will net them monetary gains on each premium paid.
So I thought because I had 10 return letters in front of me to contact USPS and see if they can reverse this reply letter to the real business behind it. I wanted to double check the above research and see if I could find a common company behind this all. I figured this would work because I saw the requirements for being able to send BRM mail.
> You must have a valid Business Reply Mail permit before you can mail. You may apply for a permit at any time by filling out *PS Form 3615, Mailing Permit Application and Customer Profile*.
> **Note:** [PS Form 3615](http://about.usps.com/forms/ps3615.pdf?ref=connortumbleson.com) is a simple form requiring you to know the company name, address where the mail will be returned, contact person, and telephone number.
However, after getting passed from party to party at USPS on the phone - no one would entertain my request or even know what I was talking about. I debated just walking to my local USPS for further research, but I also realized I was walking a line that was more meant for an investigative researcher.
Unrelated, businesses will pay for "*Business Reply Mail*" and they pay only when the letter is sent back. So 10 return mails packed with empty note cards may have just been deposited into a mail box. The least I can do is cost the businesses money behind this for sending upwards of 50 letters to my house.
### Top 5 Tampa Pizza
URL: https://connortumbleson.com/2022/10/17/top-5-tampa-pizza/
Last updated: 2025-02-04T11:42:45.000Z
Photo by [Ivan Torres](https://unsplash.com/@iavnt?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
At times I just want to inject my opinion of personal favorite pizza places around Tampa. I've done this for sandwiches twice in [2019](https://connortumbleson.com/2019/08/05/sandwich-shop-reviews-2019/) and [2022](https://connortumbleson.com/2022/07/18/sandwich-shop-reviews-2022/) as well as fast food in [2020](https://connortumbleson.com/2020/08/17/fast-food-reviews-2020/). This time just a look at my top 5 favorite pizza shops in Tampa.
---
**Forest Hill Brick Oven Pizza**
[https://www.foresthillbrickovenpizza.com](https://www.foresthillbrickovenpizza.com/?ref=connortumbleson.com)
In 5th place is the Forest Hill Brick Oven Pizza conveniently located not far from where I work. I discovered this place through Uber Eats, but when I saw the delivery distance under 2 miles I had to find the brick and mortar location.
The pizza reminds me of a classic local location where you can find all the expected types of pizza, but with a real fresh taste at a great price. So if I find myself in a situation where I'm craving a chain pizza, I'll enjoy a far better experience going with Forest Hill Brick Oven.
They even have breakfast sandwiches now which aren't bad at all. I just kept them at five, because I don't think I can find anything unique that establishes them as a key differentiator in the industry. You could say the ultra fresh ingredients are key, but I've come to expect that with the places I like.
---
**Napoli Pizza**
[https://www.napolipizzaoftampa.com](https://www.napolipizzaoftampa.com/?ref=connortumbleson.com)
In 4th place is Napoli's Pizza which is also conveniently located not by my work, but my home. They appear to be using the same software as Forest Hill's based on the look/feel of the website. Slice must be a key player in the smaller pizza business game.
Napoli's is a tiny little place with the same father/son on each time I visit. There is nothing flashy about the menu or location, but there appears to be a solid amount of pride when making the food. Which I really appreciate these days, as it becoming too often you visit some place and it appears the staff wants no part in the creation of your order. Granted that may be a larger discussion of how we treat our service workers, but just having a place that never seems toxic and makes a great product is a breath of fresh air.
Buffalo Chicken Pizza
---
**Blaze Pizza**
[https://www.blazepizza.com](https://www.blazepizza.com/?ref=connortumbleson.com)
Blaze is top three for having the most unique coolest pizza place I've been in awhile. It targets the vegan population, but is built like a Chipotle for pizza. So many toppings, options and more for a tiny little 10" pizza that you can customize to your heart's content.
So while my first visit was a very generic pepperoni my next visit was a spicy red sauce with chicken and garlic. After that point I just continue to mix and match different sauces and toppings to create either a horrific combination of flavors or something amazing.
Custom pizza at Blaze
Now looking at this above pizza - it doesn't look that good visually, but boy I did love this pizza. It was spicy red sauce, chicken, jalapenos and red peppers with a buffalo sauce drizzle.
The taste of a stone oven is even better when compared to some of the more industrial metal oven setups.
---
**New York New York**
[https://nynypizzeria.com](https://nynypizzeria.com/?ref=connortumbleson.com)
New York New York lands at number two for just consistently being exactly what I want to eat. It may be a buffalo chicken pizza or a regular pepperoni pizza - it delivers.
The locations are nearby whether I'm drinking, at home or work. I can count on every location to deliver what I'm expecting consistency wise - this is sadly not true with other chain establishments as you roll the dice on the experience each time. You buy pizza by the slice, which I don't think any other place offers on the list.
The wings are great, the Greek salad is even better. You can find a classic pizza joint that fills all voids for a regular pizza/wing/salad meal.
---
**Anthony's**
[https://acfp.com/](https://acfp.com/?ref=connortumbleson.com)
Anthony's Coal Fired Pizza is my top pizza in Tampa for just the excellent quality and flavor they produce. Coal fired pizza with that warm blackened crust on the bottom just destroys any pizza cooked in metal. Now I know that Blaze also employs this same technique to a degree, but Anthony's has been doing this for 20 years.
The price reflects this quality by being more than the competition, but delivers beyond all. I've got two favorites here and both are unique - either the eggplant pizza or the salad pizza.
The salad pizza isn't exactly a menu item you'll find on Uber Eats, but its described in person as a regular cheese pizza with a salad on top. Not sure why I tried this once, but its amazing. Something about the flavor of a oil based salad mixed with the pizza brings out some amazing flavors.
The picture above doesn't really give it justice, because this is our interpretation of ordering a salad and pizza individually and combining them.
---
I don't eat pizza as much as I did, but chances are I'm eating from one of these places if I am.
### Cheating on the rise.
URL: https://connortumbleson.com/2022/10/10/cheating-on-the-rise/
Last updated: 2025-02-04T11:42:46.000Z
Photo by [Jon Tyson](https://unsplash.com/@jontyson?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few days ago I saw a news article pass my feed that was about some cheating occurring at the Lake Erie Walleye Trail Tournament. I couldn't really understand how you could cheat at fishing - I assumed fish were pre-purchased and just pre-attached to fishing lines, so I clicked on the link.
[Jason Fischer via CNN](https://www.cnn.com/2022/10/04/sport/ohio-fishing-tournament-cheating-winner?ref=connortumbleson.com)
This cheating felt dirty as it looked pretty damaging to the fish. What happened is some individuals shoved lead weights and fish fillets down the throat of a fish to increase its weight from 4 to 8lbs. Of course tournament organizers being knowledgeable individuals of the fish world quickly realized there was no way a fish that size could be that weight and cut the fish open exposing the above.
I thought that was really odd that cheating had gone as far as fishing, then I saw another article about cheating in chess. I was so out of the loop but then saw a 72 page [document](https://www.chess.com/blog/CHESScom/hans-niemann-report?ref=connortumbleson.com) about Hans Niemann cheating. I kept reading and this looked like a serial cheater from the past being accused of cheating again.
With basically zero competitive knowledge in chess - I have no idea what is going on here, but strangely more attached to claims of cheating than watching an actual match. Seems embarrassing to admit, but perhaps because I've never been one for the competition side of chess to understand the full story here.
I continue to read and come up with a ton of possibilities:
- Hans after many confirmed instances of cheating has cheated again.
- Magnus loses legitimately to Hans and has to reach for a cheating claim.
This rabbit hole never ends and all this research about cheating has messed up my Google predictions and now I start seeing results about cheating in the Miss USA pageant. So at this point I have to read on - the winner is accused of being shown favoritism by the corporations that normally provide benefits after winning the pageant - not before.
I don't care enough about Miss USA to honestly read more into that - since at the end of day I'm not sure how you judge the competition without some form of bias. Maybe I'm blissfully unaware of a perfect point scale used to determine a winner, but either way - cheating allegations spread to another competition.
So at this point I'm just curious what the last week looks like in any relation to cheating:
- Poker game accused of cheating from stealing chips while off broadcast.
- Competitive Irish dancing cheating scandal.
- Cheating on the bar exam and admitting it on Reddit.
I haven't even talked about video games which affects me the most. Its ridiculous how much effort people go towards in order to cheat. They may see through walls and have auto-aim in shooter based games, but all that cheating effort goes useless when the account is banned.
Is the purpose just to disrupt games for fun? What changed in our culture to just embed cheating in near everything?
I'm not quite sure, but it could be folks locked in at home for the better part of a year during a global pandemic. Things were online at that time and who knows how many tests were proctored while a student could simply look at some notes located off screen from the computer.
Or maybe its the drive to never lose and to win at whatever it takes. If the world's best athletes have access to training injections that allow the body to excel further and train better is that cheating? Or does it only become cheating when a certain line in the sand has been crossed.
Lets say I pop some Ibuprofen before a race to loosen up some muscles - that might be perfectly valid. However, if I test positive for Clenbuterol I'll probably be disqualified for using a performance enhancing drug. So what do corporations do once a drug has been classified? They research and make a newer iteration that is not banned and less detectable - until it is banned.
This is a race that never ends. Video game developers realized they couldn't really detect cheating efficiently because they don't own the machine that their code runs on. So if you can't trust the host - then you can't trust any inputs. This led to engineers building kernel level anti-cheat drivers which puts code even further to the heart of your machine.
So while anti cheat detection is enhanced so is the cheater and while drugs are banned yearly - many new ones are invented. This drive to cheat for some reason is seemingly increasing and I still don't know why.
### NGINX, Ghost Blog and top of Hacker News
URL: https://connortumbleson.com/2022/10/03/nginx-ghost-blog-and-top-of-hacker-news/
Last updated: 2025-02-04T11:42:46.000Z
Tuesday September 27, 2022 - [Hacker News](https://news.ycombinator.com/front?day=2022-09-27&ref=connortumbleson.com)
On September 27, 2022 I'm sitting at the office helping prepare for the arrival of Hurricane Ian and I stumble upon a thread on Hacker News with people discussing impersonation of others. I think "*maybe they will like my blog I wrote last week*", so I try and share my link and instead after submitting am met with a self-imposed error screen.
I'm in Hacker News time out, so I go to lunch.
While eating I get an email that my blog is offline. I tried to view the blog on my phone and it indeed was not responding, so my lunch ended early and I jumped onto my computer.
SSH worked, but very slowly and I saw the load on the server being 7.86 on a single Linode Nanode so something was eating up resources. It appeared node and Ghost was consuming so many resources that things were timing out.
I couldn't understand why it was climbing so much, so I tailed my NGINX access logs and saw a huge amount of hits coming to my "[Someone is pretending to be me](https://connortumbleson.com/2022/09/19/someone-is-pretending-to-be-me/)" post. At this point I connected the dots - I jumped to Hacker News and my post was sitting at #1 already and I had just posted it like 30 minutes ago. I figured my submission was blocked so didn't think that as a possibility.
So I made a quick rash decision to upgrade my Linode to gain another CPU core. This incurred about 8 minutes of intentional downtime of the service, but gave me some time to breath.
I messaged a co-worker and asked how I could survive what seemed to be a viral load of hits without incurring more downtime in a short amount of time. He mentioned NGINX Cache would be my solution.
So a quick Google and I stumbled upon this [blog](https://stanislas.blog/2019/08/ghost-nginx-cache/?ref=connortumbleson.com), which gave me a good base to start from and adapt.
```nginx
proxy_cache_path /tmp/nginx_ghost levels=1:2 keys_zone=ghostcache:16m max_size=32m inactive=24h;
...
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_pass http://127.0.0.1:2369;
proxy_ignore_headers Set-Cookie Cache-Control;
proxy_hide_header Set-Cookie;
add_header X-Cache-Status $upstream_cache_status;
proxy_cache ghostcache;
proxy_cache_valid 1d;
proxy_cache_valid 404 1h;
proxy_cache_revalidate on;
proxy_buffering on;
proxy_cache_background_update on;
proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
}
location ~ ^/(ghost/|p/|members/) {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://127.0.0.1:2369;
}
location ^~ /assets/ {
root /var/www/connor/blog/content/themes/nurui-github;
}
location ^~ /content/images/ {
root /var/www/connor/blog/content/images;
}
location ^~ /content/images/(!size) {
root /var/www/connor/blog;
}
```
A pretty cool set of changes that setup the goal to:
- Introduce a 1 day cache for blog posts to skip the origin servers after cached.
- Allow a stale cache (expired) to be returned while a new one is generated in background.
- Skip the cache for any admin/preview/member functionality.
- Skip Ghost for any direct file asset from my theme or uploads.
- Allow ghost to be used if the auto-generating image resize is in play.
Tested it out and set it live somewhere around noon. The results were insanely quick - the server load over the past minute had dropped to under 1.
I could load the blog on my phone and desktop insanely fast than before. A bit sad I hadn't ever looked into these optimizations before, but my blog previous record of unique hits in a day was \~3,000\. I was already passed that within two hours so this was a good change to make.
So now I could relax a bit and add a comment to the post as the server was handling well. However, I was running up against a meeting at work at 1 so while I did just want to see the impact of this post live - I had other events to attend.
For someone that doesn't get a huge amount of social presence coming back to an influx of notifications was a change of pace.
- A bunch of emails from a variety of people.
- Tweets, Retweets and more.
- LinkedIn reshares and private messages.
This just really taught me how many people visit the same sites as I do. A couple friends messaged saying "*Did you know you are on the top of HN???*", but I guess they forgot my username is iBotPeaches.
What was most interesting in all these communications is how helpful people want to be to investigate something. I had folks continuing the research I started and suggesting additional paths to take - for a subset I had:
- Someone in Madison volunteering to go to the business I called out in person at the registered Madison address to ask questions live.
- Someone suggesting I create a fake LinkedIn account and attempt to be recruited by the suspected business.
- Someone suggesting I remove all my information from online if I don't want this to happen.
- Someone suggesting I go to the FBI and report identity fraud.
- Someone telling me my blog design sucks and shouldn't use JavaScript.
It was quite the whirlwind of activity all at once, but I was just happy the server was still healthy.
I then got a message from a friend that he saw my blog on the top of a subreddit he visits. So I learned you can just search Reddit with "*site:connortumbleson.com*" and isolate your search to link submitted by this blog.
What I found interesting with this is how information appears to travel from Hacker News to Reddit relatively quickly. I posted my own blog on Hacker News and everything posted to Reddit occurred from others within hours of the submit.
So now I understood why a huge amount of hits were coming in to the website at once. I checked the comments again and I saw Andrew at the top of the comment thread and I was happy for him. He was the reason I had that blog at all and it appeared he was getting a positive outcome from the crowd of Hacker News, so I sent him an email and went back to work.
Towards the end of the day still surprised my post was still at the top place my mind was changing to how much traffic is a "hug" of traffic from the socials.
So I configured [GoAccess](https://goaccess.io/?ref=connortumbleson.com) against my NGINX logs and let it run.
GoAccess - connortumbleson.com
So it looked like a normal day has barely 1,000 unique views and 10,000 hits. The day the post went to the top of Hacker News registered 102,514 unique readers with 3,664,639 hits.
This is a 11,006% percent increase in traffic so I was pretty happy that folks were stumbling upon my blog. Since it was my 2018 resolution to blog weekly and since January 2018 I have not missed a week.
Sure some posts are pretty short and bad, but others are the culmination of a few weeks or days of research. So in the end I'm happy I learned how to further optimize my blog and glad a few folks enjoyed the read.
### The Perfect Salad
URL: https://connortumbleson.com/2022/09/26/the-perfect-salad/
Last updated: 2025-02-04T11:42:46.000Z
1905 Salad - Colombia Cafe
A few weeks ago I got to enjoy the 1905 salad menu item at the Colombia Cafe on the Tampa Riverwalk. This salad continues to amaze me because I don't think I can name a single other place that the salad is worth the trip.
So what makes this specific salad so great? I believe an excellent combination of crisp iceberg lettuce with a famous almost 100+ year old garlic based dressing. I'm already a huge fan of either romaine or iceberg and either of these lettuces have a great crunch to give the meal some texture.
In terms of this salad vs others - the other ingredients are mixed in with the dressing and tossed together. This is much preferred to me for a decline in presentation instead of organizing tomatoes on top. When a salad is plated for design you take a hit in the flavor department.
Finally for this above salad - the ham/cheese/tomatoes/shrimp are sliced in small enough chunks that they naturally mix in with the rest of the salad. This is a benefit as the alternative may have such large chunks of the topping that your salad is now eating some lettuce, then that thing instead of together.
Seafood Cobb
Take this Seafood Cobb I ordered at a Tampa restaurant now shutdown. This lettuce is hurting - just pure romaine with no detected dressing. A huge amount of seafood mixed with the classic bacon/eggs/cheese. I think this salad looks like it needs some work. The real benefit I see to the Cobb iteration is a quick transition of bold colors. For example when you move from a red tomato to a yellow egg to a pink ham to a white cheese. This salad is thrown together with a weak vinaigrette and no plating so it looks like a blob of ingredients with a lonely lettuce on the bottom.
So if we pivot again, maybe the lettuce is the issue. We need a more mixed green that collapses with pressure and liquid to help bring out the flavor in the paired ingredients.
Tocobaga Tuna
This salad made an attempt at plating with identified locations for the tomatoes and tuna, but then we can see the red peppers primarily tossed in the middle. So with this lettuce we find its not the main purpose of this meal - the tuna is meant to grabbed with a bit of lettuce on each bite. This combination of flavors enhances the taste of the tuna, but you'll probably run out of tuna before lettuce. So then you are left with a tough question - can the lettuce stand alone?
Perhaps the vinaigrette stands alone, but you might find the secreted liquid from the tomatoes overpowers the splash of dressing on this meal. You'll notice this difference in the first salad, because the tomatoes are cut to lose the inner part that is more liquid based than solid.
So what if you could have a protein with your salad, but not sacrifice the taste of the salad when left alone?
Steak & Chili Lime Corn Salad
So you could make the above salad, the arugula will stand alone mixed in with dressing and corn. However, we made the same mistake with the tomatoes leaking too much affecting the dressing. So while the steak runs out and the lettuce remains - it may only be great if you like the flavor of tomatoes mixed in.
So at this point we may realize the effort for letting lettuce stand alone is not worth it. So the logical explanation is to cut it out - so we could make a salad with barely any lettuce. This is a pretty common move with the bowl type of meal.
Ahi Tuna Bowl
So at this point we now have the flavors we enjoy, but with none of the lettuce remaining when the protein is done. The toppings are the salad with the lettuce becoming an unimportant patron to this party. We see competing dressings here though with a premixed crema and a side container of Chile dressing. Could the bowl have been elevated with the dressings mixed in? Or does the bowl with lack of lettuce base mean the dressing has to be mixed ad-hoc?
Perhaps its unfair to compare bowls with salads.
---
So now I might have a better idea with the perfect salad.
- A lettuce like romaine or iceberg to give the salad crunch and a base.
- A vinaigrette that is tossed with all ingredients for full coverage as well as a solid dressing that simply elevates the flavor instead of over powering it. I believe lemon juice and Worcestershire sauce is the key here.
- Toppings that are cut and cubed for a easily mixable size. We also want to make sure we prepare the additions so they don't overpower. Whether we are hollowing a tomato or vertical slicing a cheese.
- A protein that doesn't over power or become the focus of the meal. So this might mean tiny shrimp or steak chunks. You might be able to get away with some chicken here as well.
- A plating that results in no effort to eat. We shouldn't have to mix dressings, fight the toppings or cut the protein before a bite occurs.
With all of that together - The 1905 Salad from Columbia Cafe might check all of those boxes easily. So it seems only fair to go back to try another.
1905 Salad from [Columbia Cafe](https://tampabayhistorycenter.org/columbia-restaurant/?ref=connortumbleson.com)
As good as I remembered and still holds up to all my points - I think I've found the perfect salad.
### Someone is pretending to be me.
URL: https://connortumbleson.com/2022/09/19/someone-is-pretending-to-be-me/
Last updated: 2025-02-04T11:42:47.000Z
On September 14, 2022 I got an email from someone that reeked eerily of a scam, but it turned out to be quite real. The full text is below.
> *Hi Connor,*
> *A few days ago, this person named Maris \[redacted\] found me on GitHub and reached out and asked me to be his senior software engineer where my priorities will be communicating with clients. I thought it was a tiny bit strange since I'm a college junior having a hard time to land a SWE intern offer. But I took it, I knew what I was capable of.*
>
> *Ah, this is what he was doing: He finds contracting positions, pretends to be a real developer with experience matching that position, and *wants me to interview as that real developer*. In this case, he found a Laravel/React contracting position, researched and decided to become you. Furthermore, he sets up a fake email similar to yours (as attached in the document) for communicating with the client.*
>
> *I doubt this happens very often since he pretends to be different developers most suited for the job. But, perhaps you should let \[redacted\] know what's going on (the client).*
>
> *Take care, Andrew*
So I was about to toss this in the trash, but it had a word document attached. Thankfully I'm not sitting on a Windows machine and can just preview the document via Google without a fear of infecting myself.
So I previewed the document and it was scary. It was a document intended for someone to have a cheat sheet for an interview on how to act as me.
- It included a subset of my personal information.
- It included my education history.
- It included my employment history.
- It included my certifications.
- It included a fake cover letter.
- It included a fake email/address that was "near" mine.
- It included information about the company interviewing for.
[ Connor Tumbleson Interview Prep Redacted PDF given to the "fake" Connor Tumbleson ConnorClientCheatsheet.pdf 120 KB download-circle ](https://connortumbleson.com/content/files/2022/09/ConnorClientCheatsheet-1.pdf "Download")
The more I read this document - the more creepy it felt. Someone went to the effort to extract tons of true information from my available sources and build a fake profile of me.
- They created an email that just tossed a `2` at the end of my legitimate one.
- They picked an address of a house that is for sale in Tampa.
So I emailed the guy back that sent this to ask for more information. The exchange went like:
> **Me:** This behavior seems odd - you are reached out by a party and asked to fake your identity for a job, which in this random case was me?
> **Them:** Yup, and they asked me to fake it because they aren't that fluent in English. Doing a voice call interview with a client will certainly expose them.
So I had all information to join this interview that the fake Connor Tumbleson would have joined. So I did.
---
The Zoom Interview
I joined the Zoom call early and the client thankfully admitted me quickly. I explained as quick as possible that while I was the real Connor - I was not applying for this job.
I tried to explain how the individual who was hired to impersonate me had a great set of morals and forwarded this all to me. I was asking for all the information this employer had on the fake me when the story got even weirder.
Another Connor Tumbleson joined the call and was stuck in the meeting room. The gentleman of this company was frankly amazing and allowed me to change my name, turn off my video and tweak my avatar and stay on the call.
So the interviewer admitted entry to a new person who then spoke with an accent I could not place. The interviewer kicked off the interview and asked this individual to explain a bit about himself.
This imposter for the next 2 minutes proceeded to read the same document, that I was leaked, saying things word for word as well as saying his name was Connor Tumbleson. This was a different person hired to impersonate me than who reached out to me. My guess the original person declined and this just got passed to a different person.
I could not stand this anymore listening to someone legitimately claim they were me while using my photo, name and hard earned achievements. So I turned on my camera, renamed myself back and asked the individual what the hell they were doing.
The fake Connor Tumbleson immediately left the Zoom call.
So I spoke a few more minutes with this interviewer thanking him for going along with it. I then learned this was a interviewee discovered through Upwork - so I asked for all the proof and continued my investigation.
---
Fake Upwork of Me
The company who my impersonator applied at reached out and provided all the images above as well as reporting this account to Upwork.
So with this discovery - I found the fake Upwork of myself. This was creepy as it included some jobs I worked and some that were made up. It was like my actual resume with some made up boosted traits. It did have my real Laravel certification so my guess is someone just exported a data-set of me from LinkedIn.
So it seemed like I was starting to understand the picture now.
- A person/company sets up fake Upwork profiles of real people.
- They apply to jobs in hopes to get an interview using that fake profile.
- They find suspecting victims on GitHub who are willing to go along with this.
- That person uses the identity of someone else to land the job.
I'm not sure how this actually pans out if it works. Can you really refuse to use video for the entire contract of the job? How do you get paid if you need to submit tax documents? Do you pretend to be me forever?
So it was time to investigate further. Who or what was behind this profile?
---
However, before I did that. I wanted to childishly email the address of the person impersonating me.
Email from me to fake Connor.
The response I got I'm not sure how to react - an apology for assuming my identity which is absolutely insane. You could just make up profiles and use AI generated images, but using my real photo and information and GitHub is far beyond "sorry".
This next part of this post is all in part thanks to the individual who passed on the details to me and it only gets crazier. I got written approval from Andrew (The Individual) to show his name/photo unredacted. He blogs at [unfooling.com](https://unfooling.com/?ref=connortumbleson.com) and may have a post up about this as well.
If you put on the shoes of Andrew. You would have been reached out to by a person using a fake profile, name and email. They would be looking for a business partner with a very generic document in hopes to attract you to join after a bit of small talk.
> Hope you're doing well.
> I just came across your GitHub profile. Looks like you've got a lot of experience in software development. So, I just wanted to reach out to you and see if you're available for a part-time role
>
> I'm currently looking for a senior software engineer who can work with me as a business partner and it will be fantastic if we can work together.
>
> A bit about me... I have a remote development team and we mostly work with clients from North America.
>
> We provide web and mobile app development services. Most of our team members are not native English speakers and we often face communication problems.
>
> So, we need a native English speaker with software development experience to help us with client communications. The rate is between $60 and $80/hr depending on your experience.
>
> The main responsibility will be taking job interviews on our behalf and talking to our potential clients.
> Please shoot me a message if you're interested in further discussion.
This individual was interested and that led to a document being sent along after considering to accept this position.
[ Looking for a Business Partner Document given to potential hires. Looking for a business partner.pdf 39 KB download-circle ](https://connortumbleson.com/content/files/2022/09/Looking-for-a-business-partner.pdf "Download")
This document spells out some weird behavior between the lines and lacks any official business domain, email or logo. Especially paired with a generic Google email address and a phone number that resolves to the Embassy in Panama does not seem right.
So Andrew like most potential hires has some valid questions before jumping into this opportunity.
A potential "fake" Connor talking to the presumed leader.
I'm redacting the sites provided for the sole reason that I can't confirm if they were actually developed by this company and don't want to loop them into something incorrectly.
Reached out to one client who PND claimed they built.
1/3 of the companies responded and claimed PND did not build their website nor had they ever heard of them. So I believe this is a never ending web of lies.
What we do learn from this email is the website of the company itself - PND Design. So we take a look at their website and it doesn't appear to look that great.
pnddesign (d0t) com
So I continue to go back in history on [Archive Machine](https://web.archive.org/web/20201202084124/https://pnddesign.com/) until I find a change to the site design.
December 2020 of pnddesign (d0t) com
This gives me an older company name of "PND Developing" which finally gets me some results on the web. It seems because the website says Madison, Wisconsin and so does the LinkedIn page and the domain matches - we found the right page.
[https://www.linkedin.com/company/pnd-developing/about/](https://www.linkedin.com/company/pnd-developing/about/?ref=connortumbleson.com)
So recapping - we have a business in Wisconsin, a phone number in Panama with a generic Gmail. However, we do have a profile associated with this company and that led on quite the discovery mission.
We can find [Plamen Dimitrov](https://www.linkedin.com/in/pndimitrov/?ref=connortumbleson.com) who appears associated with PND Design on LinkedIn and the name of this individual looks pretty close initial wise with PND. This entire thing could be lies on lies - so maybe even that can't be trusted. However with the initials in the Slack channel being PND we might as well investigate. This individual has a website associated with himself and this leads me to see an eerily relation between the sites.
0:00
/
1×
Same "No Right Click" on all the sites.
This individual is associated with a personal site and a company site that uses the services of two other sites that all act with similar features and broken designs. It looks like the security enhancements of web browsers in the past few years have not been patched on these websites.
So we now have the following sites associated with this and I can say with pretty good gut certainty these are built/hosted/controlled by the same party.
- [pnddesign (d0t) com](https://pnddesign.com/?ref=connortumbleson.com)
- [visibledev (d0t) net](https://visibledev.net/?ref=connortumbleson.com)
- [itechfixes (d0t) com](https://itechfixes.com/?ref=connortumbleson.com)
- [seocrunches (d0t) com](https://seocrunches.com/?ref=connortumbleson.com)
You can reverse those sites to find a couple hundred of domains on that IP, then cross-check the list against matching Google Analytics IDs and find almost 50 domains.
I clicked on one of the domains and it actually loaded - which was a surprise after the four sites above not really doing too well.
The "Anti Right Click" is back again.
It seems I've found the pattern of installing WordPress with an odd set of plugins. I'm not sure what the obsession with no right clicking is. So now we can continue to find more websites built by this company.
- `pdrecipes (d0t) com`
- `pndstore (d0t) com`
- `acupunctureherbalmd (d0t) com`
- `francelavindesign (d0t) com`
- `maacupuncture (d0t) com`
- `onsitepromassage (d0t) com`
- `recipeswise (d0t) com`
- `studiozmadison (d0t) com`
- `thesmoothierecipes (d0t) com`
- `tryveganrecipes (d0t) com`
- `acupressureschool (d0t) com`
- `acupunctureschoolusa (d0t) com`
- `freshmartmadison (d0t) com`
(44 more....)
---
If we jump back to my situation with this - we can look back at the individual Andrew stuck in the middle of this who still had some doubts with this job. He proceeds to ask another question.
> Last question: What's the rationale of me pretending to be one of your developers?
Getting a response from "Maris" of:
> Hi Andrew, we're not a grownup company. So we still get jobs from various job board websites as individuals. Actually, we managed to sign up on several platforms. That's why you should talk to the client as an individual. Hope this answers your question.
This is a valid question with a non answer. No where in this response do I see why you have to pretend to be another developer in order to do your job. There are plenty of businesses that have a project manager in the states that simply act as the communication layer between an offshore development team and that could have been an acceptable business model.
My guess is this becomes the difference of hiring a person instead of a company. Perhaps the contract jobs on Upwork are easier to obtain with one singular person masquerading as an entity than an entire company applying to handle some contract job.
So Andrew decides to go forward with this and obtains an invite to a Slack channel where we immediately see how crazy this story gets.
PND = "Maris" ?
We can see PND is talking and showing an example of what Andrew might have to do. The link was active at the time of my research and this interview occurred on February 28, 2022.
The initial reach out to this individual came from Maris. So this is crazy - PND creates emails impersonating engineers then uses those emails to attract more folks to join their company. I do wonder why Andrew didn't immediately bounce at multiple points during this, especially when you realize the person you were recruited by gave you a fake name.
So am I expected to believe this company is using my name and fake email to attract more individuals? I attempted to get this email account removed, but then I realized that was a useless endeavor - no way Google would get involved in the drama of deciding what is impersonation or not.
[https://support.google.com/mail/answer/56256](https://support.google.com/mail/answer/56256?ref=connortumbleson.com)
So if we look at timestamps - Andrew joined the Slack channel around 9am on September 14, 2022\. Around lunch the assumed leader known as "PND" begins to ask this individual if he is willing to take the interview as fake me that same day. This is the same interview I ended up joining for real alongside an impostor.
It appears this job ended for Andrew. While he thought he was being brought on to develop - he was just going to be an English speaking individual to assume identities & roles of others.
This is a direct lie from what we saw in the initial email from PND. It was explained that you would "assume the role of **our** developers". The important word is here "our" - I am not a developer with this company, yet my profile was being used.
A fake Connor did end up joining the interview, albeit late, who was not the individual pictured above. So my guess between 1:23pm and 5pm PND got to work to find an alternative person to assume my identity which was probably someone in that Slack team.
Unfortunately for us the individual who joined the Zoom interview impersonating me left immediately when confronted about lying, so nothing else could be learned from this.
---
Individuals in this Slack team.
So we can see the 35 members in this Slack, but I don't feel comfortable posting that list. I have no idea who is real or fake and who may be working for this company unaware of what is actually happening.
So I sent an email to two of them after I found them on LinkedIn to further help investigate this. One immediately responded unaware of this behavior occurring and left the group.
I do know there is an extreme amount of care from the assumed leader "PND" to not expose themselves who has not once used a real set of information or documents when talking to Andrew.
All parties are given only the information to complete their part of this scheme. I say this because you don't even know the company you are interviewing with - PND only gives you the name of the interviewer. Thankfully the Zoom link in the fake Connor Tumbleson interview leaked the company involved.
This helps piece together those odd interviews some coworkers described to me when the interviewee has no idea what the purpose of the meeting is or company. I'm starting to piece together a huge scheme that probably occurs in way more places than this Slack.
It appears Maris was in Notion instead of Google Docs and I can not find the client associated with that interview. I only have a generic interviewer name to go from. So if you hired a Maris in February 2022 - you may want to double check who you actually hired.
My guess since "PND" holds the fake Gmail addresses - they may orchestrate everything between Upwork, fake person and the client while the hired hand just attends meetings to be a voice.
So at least two people had their identity assumed in hopes to obtain a job in my brief research. At this point I did the following:
- I emailed the individual who provided these photos/research asking for permission to post this with name.
- I emailed all three businesses this company claimed they built to obtain more information.
- I emailed two users from the Slack who I guessed may be in a similar situation after finding on LinkedIn.
- I emailed the real Maris to loop them into this situation.
- I emailed the fake Connor Tumbleson.
- I reported the fake Upwork of me.
- I called the assumed owner of PND Design and left a voicemail after no one picked up.
---
Who knows how many jobs out there were obtained from an individual impersonating someone else. It seems scary still to think that someone is using my name, profile and achievements to convince companies to hire a fake iteration of me. For that sole reason - I will not give up on my research.
---
Updates
- September 14, 2022 - Draft written.
- September 15, 2022 - Upwork removes the impersonator of me.
- September 15, 2022 - Fake Connor Tumbleson responds.
- September 16, 2022 - Person from Slack team I emailed responds and announces "*leaving the slack*".
### Adult Life
URL: https://connortumbleson.com/2022/09/12/adult-life/
Last updated: 2025-02-04T11:42:47.000Z
Photo by [Bethany Legg](https://unsplash.com/@bkotynski?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few weeks ago I donated blood - honestly the first time I've done it since college and the process has gotten more scientific and process based since the last time I donated a decade ago.
The benefit with this donation outside of a towel and $20 was a little health check up from the blood given. Of course because I'm writing this blog post - that health check came back poorly with a recommendation to visit a doctor.
Extremely low iron, high cholesterol and high blood pressure was the outcome of that health check. At first thought I don't care, because I am breaking personal bests post surgery nearly weekly running and my diet is way above average in terms of nutritional value. So I just didn't really want to believe a negative health outcome and chalked it up to an outlier.
However, knowing I hadn't visited a doctor since my surgery in 2019 - I was coming up on 4 years without visiting one. Turns out when you wait that long - you are treated as a new patient, so I had a new appointment to get some blood work done.
Scheduling this must have been a fluke as I scheduled a Monday morning visit on Saturday night - this is unheard of in my experience. When I was intentionally trying to visit a doctor in 2019 - every time I wanted an appointment was finding an appointment weeks away.
Tampa MyChart (me)
So long story short - all my blood work came back with no issue. Everything was in perfectly acceptable ranges and there was no need to worry. My guess giving blood in the middle of a workday probably threw off some of my normal values.
So I was happy doing the absolute bare minimum of adult errands needed, however I realized everything I've been doing lately is reactive of a situation instead of proactive.
Old & New Driveway
- I get a citation on my door for an algae driveway - that gives me a timeline and a forced action to do something.
- I pop out a filling in my mouth leading some immediate pain and then I have an immediately scheduled dentist appointment.
- My skylight begins leaking and I have a roofer scheduled leading to a fix.
- My fence is falling over and after replacing a few posts - I have to give up and hire someone to repair/replace this.
When you type it all out - it looks embarrassing. People all deal with things and some in much worse situations than this. Like to think I am complaining about an algae driveway notice when some may be more fighting to decide how they will afford a meal.
So I look back in this situation and think I should not be handling events re-actively. I have plenty of time and flexibility at work in order to proactively take care of errands before they become a forced task.
So perhaps I've found a new 2023 resolution - I'll try and stay on top of things with some proactive actions.
### The Penny Hoarder
URL: https://connortumbleson.com/2022/09/05/the-penny-hoarder-on-quora/
Last updated: 2025-02-04T11:42:47.000Z
Photo by [Annie Spratt](https://unsplash.com/@anniespratt?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few days ago a friend tipped to me to a service knowing that I enjoy digging into these services to find the "catch" with them all.
It all started with a basic Quora search titled - "*How do you afford to live in Florida?".* A [response on that question](https://www.quora.com/How-do-you-afford-to-live-in-Florida/answer/Kyle-Taylor-155?ref=connortumbleson.com) I saw had 5.4 million views which I thought was pretty crazy. To save you the click - these were the 5 ideas the person put forward to afford living in Florida.
- Get paid to play Bingo.
- Let this company pay your credit card bill this month.
- Let this app pay you up to $83 when you win solitaire games.
- Get paid $225 just for going down a rabbit hole on your phone.
- Cancel your car insurance.
Before we jump into all these options and start debunking some claims - I seriously doubt any of these items are a legitimate method to afford living in Florida, so lets start the investigation.
---
**Get paid to play Bingo**
If we look at the Quora post again we will see a link to Bingo Cash as the application name, but if we look at the link attached we see something like:
```
https://t.thepennyhoarder.com/aff_ad?campaign_id=285&aff_id=114&aff_sub3=afford-florida&source=afford-florida-quora
```
Now this isn't out of the norm if it was a pure tracking link for analytics. However, this is a landing page to gate the location of the Bingo Cash App.
Cell phone number to get application?
Why not just link to the respective store links? This is obvious - The Penny Hoarder wants your information and to do anything once it has it.
> By clicking on “Get the app,” you agree to our [**Terms of Use**](https://www.thepennyhoarder.com/terms-of-use/?ref=connortumbleson.com) & [**Privacy Policy**](https://www.thepennyhoarder.com/privacy/?ref=connortumbleson.com) and to **receive recurring text messages**. You are also authorizing The Penny Hoarder to deliver marketing messages to you using an automatic telephone dialing system.
Perhaps you don't care about marketing spam, but then you read the [Terms of Use](https://www.thepennyhoarder.com/terms-of-use/?ref=connortumbleson.com) and see this snippet.
> You agree to provide us true, correct, current and complete information at the time of registration, and to also update this information so that it remains true, current and complete. Any sign-in and registration information you provide to us or we receive from a third party (for e.g., Facebook, Amazon, Google, etc.) **is our information to use as we see fit.**
So that isn't great - unless you expect to be targeted with an insane amount of advertisements directed to you before even having the game!
So if we take a look at the game on the store. The permissions are a tad bit scary - why does Bingo need your precise location?
[Bingo Cash App - iOS App Store](https://apps.apple.com/us/app/bingo-cash/id1522266397?ref=connortumbleson.com)
Getting the Android version of this game is also a challenge. Which is odd because I figure if the application got onto the iOS App Store that it should be no challenge to get it on Android.
Android simply redirects to [https://bingocash.com](https://bingocash.com/?ref=connortumbleson.com), which hopes that you are on a Samsung device (Like most the population is) to utilize the Samsung store. Am I reaching here to say the Google Play Store did not allow this application?
So lets just ignore all of this and pretend we installed the application and actually read the [Terms of Service](https://www.papayagaming.com/termsofuse?ref=connortumbleson.com).
- If you give them no money - you are a "Non-Cash User" and basically can never win anything.
- If you give them money you become a "Cash User" and have a **chance** at winning small amounts of money.
However - with every action you make and do or even don't do - you will get spammed with ads. You will have to watch 100 advertisement videos for some amount of money. However, if you want that deposited you may have to pay up to $10 for the transfer depending on your location and method.
> If you make a credit card deposit, we may submit an authorization request to the issuing bank of at least ten U.S. Dollars ($10.00) to your credit limit, even if the actual amount charged may be lower.
You also have to keep playing once you sign up or risk a monthly fee.
> If your account is inactive (i.e. you have not entered at least one (1) competition or tournament) for six (6) consecutive months or more, we reserve the right to charge a maintenance fee of $2.00 per month (the “Monthly Maintenance Fee”).
So in short:
- You get your information harvested from you.
- Paying to get a chance at winning is expected.
- You might have to wait up to 90 days for a payout.
- Every moment you use the application you are earning money for the company.
It does hurt that I think a site like The Penny Hoarder could thrive with great content of saving funds, but instead just shills obvious scam applications and tries to convince people otherwise.
---
**Let this company pay your credit card bill this month.**
This pattern isn't new and in short is just consolidating bills to one company and then having a new single loan to pay off. In this case Fiona would be used to pair you with a lender.
Since Penny Hoarder is branded on this page - it appears there must be some benefit for facilitating users through this flow. The disclosure really spells this out for you.
> For example, on a $10,000 loan with a **5% origination fee**, you will incur a $500 origination fee and receive $9,500 upon successful issuance of your loan. Rate, terms and fees will be based on your individual credit history and underwritten by the lender and not by Even Financial, Inc. / Fiona ("Even”, “Even Financial”, ”Fiona”, “we”, “us”, “our”)
So the service itself is not really free, and the loan you get is less because of it since you went through an aggregator. Not to mention the misleading "credit score" warning. This will for sure affect your credit score once you land on a lender as they will do a hard pull, but they hide that information under the little "i" hover icon.
So sure - you get a loan and pay off some credit cards. Now you have a new payment to make and the credit card bills keep coming. If you really want to consolidate your bills - do some research for a local company. Though if we are being honest - if you are failing to pay a ton of credit cards - my guess is your credit score isn't the best and you'll have to find some less than preferred options.
---
**Let this app pay you up to $83 when you win solitaire games.**
This is another application built by the same company: [Papaya Gaming](https://www.papayagaming.com/?ref=connortumbleson.com) who built Bingo Cash, so not sure there is a point to investigate this type of application again.
0:00
/
1×
[https://www.youtube.com/watch?v=jLZ0UbWAeNE](https://www.youtube.com/watch?v=jLZ0UbWAeNE&ref=connortumbleson.com)
This application just turns it up a level of annoyance from the last.
- Puzzle pieces are required to unlock the items, which means you will get all the pieces except a few rare ones to entice you to continue playing to win something big.
- Going from background to foreground causes an ad.
- Moving between menus sometimes causes an ad.
- Doing something randomly causes an ad.
What honestly pisses me off more than anything is how Kyle (Penny Hoarder Staff) on Quora can say:
> You might be thinking: There’s got to be a catch. This is definitely one of those spammy apps, right?
> Wrong. There really isn’t a catch. And, in fact, there aren’t even any annoying ads.
Sorry Kyle - I don't believe you. Unless you are doing some weird word magic here where the ads aren't annoying thus there aren't any.
So many ads and you are supposed to make your living in Florida easier by spending all your time in energy in this? Is this a joke?
---
**Get paid $225 just for going down a rabbit hole on your phone.**
At this point - we know the deal. An intermediate page to a service that can probably make you a tiny bit of money for a good deal of work.
This is InboxDollars which reminds me of Swagbucks, which I guess makes sense since 1 minute of research shows the parent company owns all of these!
> Prodege, LLC (together with any affiliates, the “Company”) owns and operates a number of different websites, mobile apps, and interactive services, including without limitation Swagbucks, MyPoints, InboxDollars, Upromise, ShopAtHome, CouponCause, Swagbucks Live, MyGiftCardsPlus, ySense, Tada, Shoply, Prodege.com, ProdegeMR.com, and others (collectively, the “Prodege Sites”).
InboxDollars [recommends](https://help.inboxdollars.com/hc/en-us/articles/360044247732-Popup-Blockers?ref=connortumbleson.com) you disable your pop-up blocker for usage, which in plaintext means: *disable your ad blocker so we can give you ads*.
These type of sites are everywhere and I just flat out recommend you don't use them. Sure lets say you can make a dollar for 30 minutes of pure labor answering surveys and watching videos. You make a tiny bit of money, but the company behind it makes way more and your privacy and information is harvested.
If you really want a solution for surveys - just use the Google Opinion Rewards. You won't suffer through an endless supply of ads and videos and instead just answer some questions every now and then with immediate credit for in-app purchases.
---
**Cancel your car insurance.**
This is a misleading title of an answer as the real answer is just swapping companies for your car insurance. They pick another aggregator to compare much like the personal loans, but this time for car insurance.
In the case of this company (EverQuote) you are just signing up for an immense amount of advertising at the benefit of getting an endless amount of quotes sent your way.
> **We will share information with our business partners and other third parties*.*** These partners may send you information about products and services by telephone, text, fax, mail or email. If you use our website or app we will share your information, including name, address, email, telephone number, and date of birth, which you provided to us or that we obtained from third-party sources, with insurance companies or other third parties that may provide it to insurance companies.
So as the [terms](https://www.everquote.com/privacy-policy/?ref=connortumbleson.com) state - your information collected will be shared. So once again - its clear. For every second you spend with any of the options presented in this Quora thread will be information harvested or shoved in your face.
---
So then I look back at this post for Florida and find this exact answer given to other state questions by the same user!
- New Jersey
- North Carolina
- Texas
- Illinois
- New York
- California
So I'm sorry - no wonder I never click on Quora links. This service reminds me of the end of Yahoo Answers - just a pure SEO abused spam house of answers where contributors are enticed to ask questions, shill products and rake in the money.
This is a complete opposite to StackOverflow where answers are voted up/down by the community. So if an answer is clearly not constructive - it will be downvoted out of view. When you look at Quora though - you might have companies throwing money their way to place an answer on the top of a very popuar post.
So if I look back at The Penny Hoarder - who can blame them. They can get millions of views by harvesting the power of posting less than reptutable answers on Quora. So then I head to their site and its a mixed bag of thoughts for me. Some articles looks like legimately good advice while others look like a pure "spammy" product advertisement, so then I wonder...
This reminds me of the movie Wolf of Wall Street. A technique shown in the movie to convice investors with blue chip stocks in order to build trust and once the company had trusted investors to manage funds - they unloaded some less stable penny stocks to rake in huge profits.
So a bunch of good articles for Penny Hoarder I may read, then I might stumble upon a few shill articles advertising some of the applications we looked at in this post. Your bound to run into one since theres at least 51 posts for [Bingo](https://www.thepennyhoarder.com/search/?q=bingo&ref=connortumbleson.com). It must be why they were acquired for $102 million - its a lucarative business.
> Sykes’ digital marketing subsidiary, Clearlink, is set to acquire the publication’s parent company, Taylor Media Corp. for $102.5 million through a stock purchase “for an all-cash purchase consideration,”
> [https://www.tampabay.com/news/breaking-news/2020/12/21/the-penny-hoarder-acquired-by-sykes-enterprises-in-1025-million-deal/](https://www.tampabay.com/news/breaking-news/2020/12/21/the-penny-hoarder-acquired-by-sykes-enterprises-in-1025-million-deal/?ref=connortumbleson.com)
---
In closing - I'm not a fan of The Penny Hoarder or Quora. Both are taking advantage of people not versed enough to see through the smoke.
### Door to Door - Lumino Solar
URL: https://connortumbleson.com/2022/08/29/door-to-door-solar-n-more/
Last updated: 2025-02-04T11:42:48.000Z
As I sit and enjoy dinner on a Friday night - I'm unaware my door is about to get a knock with an increasingly common technique - that I must blog about it.
So August 26, 2022 - I hear a knock and then an alert from my phone that means it spotted a person. This wasn't a doorbell and I should have ignored it, but the alert on my phone spotted a younger looking person with a backpack. I figured it was a neighbor or something so went to answer it.
This is the recollection of the events as my doorbell recorded it all.
---
Immediately the person mentioned they were working with TECO (My electric company) assigned to this street to announce a new Solar plan backed by government policy. At this point I already wanted to close the door and be done - since I'm not getting solar panels.
However, this guy was persistent and talked for at least 2 minutes of explaining everything solar to me. What I found as common points repeated frequently were:
- Your home will gain equity.
- You can get started for $0.
With the goal to get me to agree to a "free" assessment of the possibility to get solar panels installed on my home. So lets rip apart everything he said and get to bottom of this.
---
[https://www.tampaelectric.com/company/solar-energy/](https://www.tampaelectric.com/company/solar-energy/?ref=connortumbleson.com)
**Claim: This is a new program offered by TECO**
This is not true. TECO offers a portion of their website to explain everything solar and not a single option is an option to get panels installed with TECO's support. The closest they have is a list of contractors in good standing.
> View a [list of solar contractors](https://www.myfloridalicense.com/wl11.asp?mode=1&SID=&brd=&typ&ref=connortumbleson.com) in good standing with the state of Florida. In the license information form, select Construction Industry (License Category) and Certified Solar Contractor (License Type).
> [https://www.tampaelectric.com/company/solar-energy/connectingyoursolar/relatedlinks/](https://www.tampaelectric.com/company/solar-energy/connectingyoursolar/relatedlinks/?ref=connortumbleson.com)
So I wanted to check that list and I could not find "Lumino" anywhere on it.
---
**Claim: Your home will gain equity.**
This is only partially true if funding is in your favor. Let's take the vision that Lumino wants you to have then talk about what happens normally.
The Perfect Vision
- Spend no money on install, increase home by 6%.
- Swap electric bill for solar bill (Repay for panels)
- As electricity bill goes up further, solar stays constant for loan payment.
- Pay it off over the next 10-25 years.
The Actual Vision
- Spend no money on install, increase home by 6%.
- Have an electric bill alongside solar bill until solar "goes live"
- Have a final inspection with TECO, which depending on the quality of the install may fail repeatedly.
- Continue paying for solar and electric bills until inspection done month after month.
- Have a new $75,000\~ loan on top of your home on a 20 year payment plan.
- Struggle to sell place without clearing the lien on the panels or covering the loan.
- Prevented from removing panels without paying for removal on top of clearing bill on the panels.
> Never was I told that a UCC/lien was going to be placed on my home so when I went to sell it the buyers title company informs me I have to pay $75,954 to this solar loan company before I can close on my house You could have knocked me over with a feather So I reached out to the salesman who said well just get the buyer to take over the loan I told him the buyer was an investor and had no desire or intentions of taking over a $75,000 loan. So then he says, just take them with you. Well that's great BUT I still have to pay $75,954 to remove the UCC then another $12,000 to remove the panels then the cost to transport them and then pay to have them reinstalled on a new house!
> [https://www.solarreviews.com/installers/atlantic-key-energy-reviews](https://www.solarreviews.com/installers/atlantic-key-energy-reviews?ref=connortumbleson.com)
So what I believe is the goal here is to install panels as quick as possible (Maybe as soon as 10 days after you accept). Knowing they (The solar company) will get payments as soon as the panels are installed. They don't care if the inspections are delayed - they are getting money. They don't care about anything but recouping costs for the panels.
---
**Claim: This is our old company name (AKE).**
This is true.
So I asked the guy for a business card and he said he only had one. So I mentioned I would just Google the company name I spotted on the paper of "*AKE Solar*". He mentioned that was the old company name and I should scan this QR code to get the new company which took me to the image above. From that I could obtain the new company name of "Lumino".
So I found a [businesswire](https://www.businesswire.com/news/home/20210609005762/en/New-Solar-Company-Lumio-Co-founded-by-Greg-Butterfield-and-Jonathan-Gibbs-Announces-Formal-Convergence-of-Five-Leading-U.S.-Regional-Firms?ref=connortumbleson.com) article.
> Lumio is the result of combining five leading regional U.S. residential solar providers:
> *[Atlantic Key Energy](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fatlantickeyenergy.com%2F&esheet=52442833&newsitemid=20210609005762&lan=en-US&anchor=Atlantic+Key+Energy&index=2&md5=dfac8f396061309a8530f2b574152f9b&ref=connortumbleson.com),*
> *[DECA](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fgetzenithsolar.com%2F&esheet=52442833&newsitemid=20210609005762&lan=en-US&anchor=DECA&index=3&md5=89414d1c52799e2ae20a9b8d9e069c31&ref=connortumbleson.com)*
> *[LIFT Energy](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fliftenergysolar.com%2F&esheet=52442833&newsitemid=20210609005762&lan=en-US&anchor=LIFT+Energy&index=4&md5=d42ed2f3785ef3a7dbb627b97096d1d9&ref=connortumbleson.com),*
> *[Our World Energy](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.ourworldenergy.com%2F&esheet=52442833&newsitemid=20210609005762&lan=en-US&anchor=Our+World+Energy&index=5&md5=ad1943596031f594b3520bbc8b6a764d&ref=connortumbleson.com), and*
> *[Smart Energy Today](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.smartenergytoday.net%2F&esheet=52442833&newsitemid=20210609005762&lan=en-US&anchor=Smart+Energy+Today&index=6&md5=f91525a725661345b0740150b6502bc9&ref=connortumbleson.com).*
> Each company leads their respective markets in customer satisfaction and time-to-install. In a period in which the solar industry’s average install time is 60-90 days, Lumio’s average install time – with high customer satisfaction – is less than 30 days. In some cases, it is less than 10 days.
What bothers me is this article claims each company leads their respective market, but I can't see how that can be true based on what I find online.
[(AKE) C rating on BBB (revoked)](https://www.bbb.org/us/fl/winter-park/profile/solar-energy-contractors/atlantic-key-energy-llc-0733-90648730?ref=connortumbleson.com)
- *On 04/21/2022 this company's accreditation in BBB was revoked by BBB's Board of Directors due to engaging in activities reflecting poorly on the BBB or its members and failure to be responsive by addressing disputes forwarded by BBB quickly and in good faith.*
- two years in business.
[(DECA) C- rating on BBB](https://www.bbb.org/us/tx/arlington/profile/solar-screens/deca-living-0825-1000199806/complaints?ref=connortumbleson.com)
- This business is NOT BBB accredited.
- one year in business.
[(Lift Energy) C- rating on BBB](https://www.bbb.org/us/ca/bakersfield/profile/general-contractor/lift-energy-construction-inc-1066-850025772/complaints?ref=connortumbleson.com)
- This business is NOT BBB accredited.
- unknown time in business.
[(Our World Energy) A+ rating on BBB](https://www.bbb.org/us/az/phoenix/profile/solar-energy-products/our-world-energy-1126-1000055984?ref=connortumbleson.com)
- This business was accredited since 9/25/2018.
- 6 years in business.
[(Smart Energy Today) A+ rating on BBB](https://www.bbb.org/us/wa/olympia/profile/solar-energy-contractors/smart-energy-today-inc%C2%AE-1296-22714840?ref=connortumbleson.com)
- This business was accredited since 8/2/2012.
- 15 years in business.
So while a few of the companies look reputable - a few do not. The company that used to service my area based on the materials shown to me was Atlantic Key Energy (AKE).
---
**Claim: We are #1 installer in Tampa and #3 installer in USA.**
Lumino is #1 installer in Florida (?)
0:00
/0:18
1×
I can't prove this, so leaning to false.
I researched every iteration of "*top/best solar companies in Tampa/USA*" and looked at least 20 sites and not one even listed Lumino.
---
**Claim: The new SMART meter is a 2 way power send/receive.**
SMART meter sends power (???)
0:00
/0:27
1×
This is false. The SMART meter just allows [TECO to read your values](https://www.tampaelectric.com/company/ourpowersystem/aboutyourmeter/smart-meter-updgrade-faq/?ref=connortumbleson.com) by having them transmitted to them instead of an employee reading the meter on the house.
What is true here is you need a SMART meter if you want to use solar. That is so TECO can have control to remotely read/configure your power if you get solar. This is not what was described though in person as the way to send power back to the company is a variety of new [interconnection pieces](https://www.tampaelectric.com/company/solar-energy/connectingyoursolar/netmeteringapplication/?ref=connortumbleson.com) that must be verified.
---
**Claim: This is at $0 cost to you and cheap due to government policy.**
Solar will be $0 to you to install.
0:00
/0:23
1×
This is false and just misleading advertisement. Sure it's $0 for install, much like you can get a phone for free - but then you have monthly payments which was explained to me in the audio above. The goal for this company is to put solar panels on the roof as soon as possible. That means you are locked in for payments, including a possible lien on the panels.
However, what is the government vague policy that was mentioned? I believe the [Solar Tax Credit](https://www.energy.gov/eere/solar/homeowners-guide-federal-tax-credit-solar-photovoltaics?ref=connortumbleson.com) which expires in 2023\. In 2019 it was 30%, which since the cost of these loans might range from 50k to 90k may help decreasing your taxable amount. What I believe was being attempted to confuse me was saying the price would be 20-30% cheaper than normal.
That just simply isn't true - while it may be possible to get a rebate of a couple thousand and get some credit on my taxes. You are still left with a large loan over 15-25 years. These companies use this loan to their advantage, because the alternative of leasing solar panels is not allowed to reap the benefits of these tax credits. I found some reviews in BBB that boosts my claim that the tax discussion is meant to confuse you to think you are getting a better deal. However, the website makes it abundantly clear this is a credit. My guess is on paper its correct for compliance, but the sales technique voice to voice may not say it exactly right.
> Their representative claimed that I would receive $18,000 tax rebate from federal government when I file my tax return for this year. There is no tax rebate for solar panels; only a tax credit.
> [https://www.bbb.org/us/tx/arlington/profile/solar-screens/deca-living-0825-1000199806/complaints](https://www.bbb.org/us/tx/arlington/profile/solar-screens/deca-living-0825-1000199806/complaints?ref=connortumbleson.com)
> There is something wrong with our solar panels and no one can tell us why. We have $70k worth of solar panels on our roof and we only received 94kwh for a $12.82 credit on our \*\*\*\* electric
> [https://www.bbb.org/us/ut/lehi/profile/solar-energy-contractors/lumio-1166-90028215/customer-reviews](https://www.bbb.org/us/ut/lehi/profile/solar-energy-contractors/lumio-1166-90028215/customer-reviews?ref=connortumbleson.com)
---
It's clear I believe this company just wants to put panels on as many homes as possible. They will get money from the instant the panels are installed and can win if the sun is up or down - they get money either way.
I don't think anyone should trust any company that comes to you to entice you. There may be an exception to that rule like girl scout cookies, but otherwise you are best to find a local supported contractor that your local power company supports.
I will not be using Lumino and I'm happy I got an idea for a blog post after a random employee to my door.
### Spotty Frontier - Aug 2022
URL: https://connortumbleson.com/2022/08/21/spotty-frontier-aug-2022/
Last updated: 2025-02-04T11:42:48.000Z
On Thursday August 18, 2022 I got to the office and noticed something a bit odd after noticing some weirdness at home. Sites like AWS Console and Atlassian were either not loading or taking a solid minute. Other sites however worked perfectly fine - so I chalked it up to temporary problems.
However, around 3pm and I was still noticing this, so I polled our office and surprisingly almost everyone aligned with these issues - except for the folks not on Frontier - they were fine. So at this point I guessed it was Frontier, but now we had a workaround. The benefit of having two service providers at the office - we just swapped and all our problems went away.
Friday came and went and the original Frontier network was still shaky. Now it's the weekend where I sit here typing this blog. I use Frontier at home and my connection is experiencing roughly an average 20% packet loss when using a video game debugging feature.
So I started with a live chat with Frontier - just in case this was a known issue.
> I currently ran a test on the line. I did not see any physical issue that may be affecting your service at this moment.
>
> I'm seeing that you have Fiber Optic services so I need to transfer you to the appropriate department, ok?
However, this agent than transferred me because he could not handle the type of service I had.
> Thank you for being patient, Connor. Upon carefully checking on my end, I can't see any reported outages on your area.
The newer agent could not help me either, but I don't blame them - I figure this is a larger issue or they are simply not equipped with the right info to answer me.
So I started an investigation.
---
[https://downdetector.com/status/frontier/](https://downdetector.com/status/frontier/?ref=connortumbleson.com)
I started with Down Detector and it confirmed my assumption since both work and home were affected. Something was going on with Frontier isolated to the Florida area.
Fortnite packet loss ranging from 11% to 30%.
However, I started thinking maybe I want to blame Frontier when the issue might be elsewhere. I started looking at the sites I was experiencing issues with and 60% were confirmed hosting on AWS. To the best of my ability with [researching](https://aws.amazon.com/solutions/case-studies/EPICGames/?ref=connortumbleson.com) Fortnite - it appears it was also hosted onAWS as well.
So I figured I should check the outages mailing list - it normally has some good technical discussions when a wider scale issue is occurring.
[https://puck.nether.net/pipermail/outages/2022-August/thread.html](https://puck.nether.net/pipermail/outages/2022-August/thread.html?ref=connortumbleson.com)
Unfortunately, outside of some discussions about AWS US-West-2 nothing concrete, so I was getting worried that this was more localized to my zip code.
So it was time to check Twitter as it normally has an no shortage of people complaining.
[https://twitter.com/jayntampa/status/1560236283032641536](https://twitter.com/jayntampa/status/1560236283032641536?ref=connortumbleson.com)
Thankfully this user had the right idea and just pinged them on Twitter and the response told me way more than my two service support requests. This user said they were in Tampa (*Guess what - so am I*) and Frontier said:
> As discussed via direct message, the outage is still ongoing and there's no ETR posted yet due to a fiber cut. Rest assured that this will be taken care of for appropriate resolution. ^Jay
I was hoping since this message was on Thursday and this was days later that it would have been resolved, but it had not.
So I kept reading Frontier's responses and saw:
> Hi, Becky. We're sorry to hear that you're having issues with the service. The outage is due to possible fiber/cable issue. Our techs are still investigating and working to get this resolved as soon as possible.
> [https://twitter.com/AskFrontier/status/1560335925967732736](https://twitter.com/AskFrontier/status/1560335925967732736?ref=connortumbleson.com)
> I'm sorry for the service disruption, Ellejanae. There's an outage in FL due to a fiber cut and techs have located fiber cut that is due to new bore site for cell tower. Repair is still in progress and there is no ETR yet. You may send us a DM to check for updates. -Rezza
> [https://twitter.com/AskFrontier/status/1560261113392295936](https://twitter.com/AskFrontier/status/1560261113392295936?ref=connortumbleson.com)
> No ETR posted, but our crews found the damaged cable and they're working on moving a fiber reel. We are pumping a manhole to confirm any empty conduit we can use. They will need to pump the second manhole shortly. - Shimi
> [https://twitter.com/AskFrontier/status/1560311450203066368](https://twitter.com/AskFrontier/status/1560311450203066368?ref=connortumbleson.com)
> Hello, Cinzia. Upon checking, the ETR would be around midnight ET 8/19 but this is still subject to change. -JD
> [https://twitter.com/AskFrontier/status/1560465829216526336](https://twitter.com/AskFrontier/status/1560465829216526336?ref=connortumbleson.com)
> As per the latest updates, the area-wide outage appears to have already been restored. For us to check if there are still known or isolated issues that could impact your service, kindly send us a DM for us to gather the necessary information. -Ly
> [https://twitter.com/AskFrontier/status/1560307222856417281](https://twitter.com/AskFrontier/status/1560307222856417281?ref=connortumbleson.com)
So this is amazing and confusing at the same time - I get information that a new cell tower bore severed a fiber line causing issues and its bit difficult to resolve due to things I don't understand.
Why does the Twitter support staff have more information than my direct support chat on the website? I did my support request on August 20 and all these tweets were posted on the 18th or 19th - so Frontier support should have been able to confirm an issue in my area due to a fiber cut.
However, even so it seems there are a variety of answers given on Twitter as Ly might say the issue is resolved at noon, while JD confirms an outage that won't be resolved till the next day. It seems its just a mess to get info from the official source on Twitter or directly via the support/call option. It does bother me though that an issue that is seemingly affecting an entire state has no confirmation outside of private support requests or Twitter replies.
In the slew of Twitter replies I find a user linking to [DSLReports](https://www.dslreports.com/forum/r33477796-Frontier-has-been-slow-all-day-packet-loss-connection-quality?ref=connortumbleson.com), which I honestly forgot existed and there was a forum post!
[https://www.dslreports.com/forum/r33477796-Frontier-has-been-slow-all-day-packet-loss-connection-quality](https://www.dslreports.com/forum/r33477796-Frontier-has-been-slow-all-day-packet-loss-connection-quality?ref=connortumbleson.com)
This was a good forum thread that linked to the same evidence I discovered on Twitter. So I slipped a reply in with some of the information below I discovered.
So at this point I wanted to look into the BGP announcements as those can be quite heavy if a line is cut as new routes for peering are announced.
Cloudflare [recently launched](https://blog.cloudflare.com/asn-on-radar/?ref=connortumbleson.com) a very public service for BGP information on any ASN, so it was time to look up Frontier (*AS5650 Frontier Communications of America, Inc.*)
[https://radar.cloudflare.com/asn/5650?date\_filter=last\_7\_days](https://radar.cloudflare.com/asn/5650?date%5Ffilter=last%5F7%5Fdays&ref=connortumbleson.com)
So this is interesting - we see a huge change from the norm with 134,000\~ announcements on August 17\. I don't think that is a normal amount which might suggest a misconfiguration or a huge amount of network changes after a fiber cut.
However, a day later we get 127,000\~ announcements which would suggest the issue was resolved and correcting itself. Though, we see a huge amount of announcements right afterwards which does not look normal given the trend of the past 7 days.
So my Internet is still not working right during the weekend, but the trend line of Frontier has stabilized. Is there an unfixed fiber cut affecting my issues or is there a misconfiguration in the wonderful world of BGP? I know I can't get a straight answer from Frontier to tell.
Until then - I'll join the upset customers and [tweet](https://twitter.com/iBotPeaches/status/1561082889051283457?ref=connortumbleson.com) Frontier and see what happens.
---
EDIT - August 22, 2022
I woke up today expecting a good ole Monday morning to have resolved my issues, but alas - it has not.
I jumped into another 1/1 chat with Frontier and they once again for the 4th time told me there is no issue.
> I have checked that there's no active outage in your area. We need to check your battery back up unit which powers your ONT. This is usually located near the power outlet. Please try to reboot it by unplugging the power cord for 3 minutes. -JD
After that I provided a huge amount of links to the staff of other users on Twitter/forums experiencing issues. They responded with:
> The reported outage has been restored already. Since you're still having issues with service, we need to do some real time tests in order to isolate where the problem is originating. -JD
So I know this issue only affects portions of the Internet, so I did roughly 10 pings to ESPN and my own blog.
```
--- espn.com ping statistics ---
12 packets transmitted, 11 received, 8% packet loss, time 11016ms
rtt min/avg/max/mdev = 8.332/8.990/10.425/0.687 ms
```
8% packet loss to ESPN
```
--- connortumbleson.com ping statistics ---
11 packets transmitted, 11 received, 0% packet loss, time 10017ms
rtt min/avg/max/mdev = 20.586/21.112/22.652/0.636 ms
```
0% packet loss to my blog
Unfortunately passing these details to entry level support staff is wielding no results.
---
EDIT2 - August 22, 2022
I got home from work and tried my ping tests - 0% packet loss! I played a game of Fortnite and 0% packet loss! I believe this issue is resolved, but boy what a mess of information and delays to get here.
---
Timeline
- August 17, 2022 - 5pm - 134,000\~ BGP Announcements from ASN5650.
- August 18, 2022 - 6am - Notice issues at home.
- August 18, 2022 - 8am - Notice issues at work.
- August 18, 2022 - 1:03pm - [Frontier mentions draining manhole](https://twitter.com/AskFrontier/status/1560311450203066368?ref=connortumbleson.com) (Twitter).
- August 18, 2022 - 2:49pm - [Frontier mentions fiber cut](https://twitter.com/AskFrontier/status/1560335925967732736?ref=connortumbleson.com) (Twitter).
- August 18, 2022 - 3pm - Swap work to other ISP - issues go away.
- August 18, 2022 - 9 to 5pm - Huge amount of BGP Announcements.
- August 19, 2022 - Midnight - [Frontier ETA](https://twitter.com/AskFrontier/status/1560465829216526336?ref=connortumbleson.com) passes with no fix (Twitter).
- August 19, 2022 - All Day - Issue Persists
- August 20, 2022 - All Day - Issue Persists
- August 21, 2022 - All Day - Issue Persists
- August 22, 2022 - 6am - Issue Persists
- August 22, 2022 - 5pm - Issue Resolved
### The Big 30
URL: https://connortumbleson.com/2022/08/15/the-big-30/
Last updated: 2025-02-04T11:42:48.000Z
*I don't know who did this ^*
When I looked at the calendar a few weeks back - odds were in my favor. The day this post goes out on August 14 (Sunday) happens to be my birthday and the 30th one.
So yeah I'm now 30 and I think for one - I didn't die on the way to 30\. When you look in your own little bubble of folks you know that wasn't always expected. From memory I remember losing a classmate or friend to:
- Suicide (2x)
- Car Accident
- Sickness
Some classmates I remember are still alive, but sure aren't living the life they intended with prison & rehab taking the time.
---
Health wise I seem to be doing okay - only 2 surgeries to my name after 30 years. Weight fluctuates depending on how serious I take working out - as its way too easy to fall into a trap of work/sleep/repeat. I did have a blood panel a few days ago and not a single value out of normal range - so pretty happy with that.
I did end up cancelling Hello Fresh though as I got unhappy with the consistency of the service. While it did help have a more consistent diet, I couldn't deal with the up and down quality that was delivered. It didn't make sense to me how every delivery could have a different quality set of coolant materials, paper and organization. It was like they slowly decreased the quality of the box from initial signup to see how much they could make while at the same time increasing the cost.
---
On the front of spam, bots and scams I feel like the digital and physical world is even more packed with things to confuse you. Nearly every week I get a letter trying to scam me into free solar panels or a new mortgage at the costs of signing over my home to someone else. Daily I get an influx of spam emails or texts that increase in chances of just having a half naked woman.
For someone who grew up during the rise of this - it is easily detectable, but boy its annoying. Even swiping on a dating app has a chance of landing on a bot with the predictable messages ending in asking for a credit card to verify age.
Much like the Internet was much more insecure a decade ago - the phone system was built on a promise to act good, but in theory folks aren't. Maybe in the next 30 years the FCC will enforce some changes to crack down the pure abuse of the spammers that annoy me daily.
---
When you pivot to looking at the work life - I think I'm a minority. I've been in the same job since I graduated college about 7 years ago. I've heard or seen from many LinkedIn posts that most folks have jumped a few jobs in that time. Which at times after I read a few popular posts from [r/antiwork](https://www.reddit.com/r/antiwork/?ref=connortumbleson.com) on Reddit seems perfectly normal to swap jobs.
I started as a junior software engineer and now I'm the director of engineering as our company grew from 11 to 64\. I continue to be amazed by the level of quality we produce, then when I see competitors and realize how embarrassing their quality is - I get scared about the infrastructure that crucial systems run on.
---
So all in all - I made it. A cheesy blog post to mark the time and the personal opinions or rants will resume next week.
### 2022 Tour de France
URL: https://connortumbleson.com/2022/08/08/2022-tour-de-france/
Last updated: 2025-02-04T11:42:49.000Z
On July 24, 2022 the Tour de France ended again. This time the winner switching hands to Jonas Vingegaard of Jumbo-Visma instead of the previous winner Tadej Pogacar.
A lot of Twitter/Reddit folks were considering this tour the real challenge that Tadej would face. As the 2020 delayed COVID Tour had the contender Primoz Roglic unable to hold the yellow jersey losing it in the final time trial. We saw in 2021 when Primoz was injured - Jonas stepped up as the team general classification (GC) leader and almost won - holding 2nd place by only 5 minutes.
So the 2022 tour was going to start with some fire - Jonas, Tadej, Roglic and Geraint all looking like competitors to take home the win.
- Tadej - 1st in 2021
- Jonas - 2nd in 2021
- Roglic - 2nd in 2020
- Geriant - 2nd in 2019
This tour was also going to be another chance for Peter Sagan to recover and compete in the green jersey. However, we saw a completely different picture when it came to the points. Wout van Aert scored 480 points and destroyed that competition never losing the jersey. Names I was expecting to compete for that jersey sadly disappointed - never seeing Sagan or other sprinters get close to Wout.
[https://www.letour.fr/en/stage-2/image-gallery](https://www.letour.fr/en/stage-2/image-gallery?ref=connortumbleson.com)
Stage 2 was in Denmark and featured a huge bridge, which was the first time I remember seeing a large bridge in recent memory. It also had a pretty huge crash with 1.9 miles to go, which invoked a special 3km rule. This allowed riders to have the time of the group they crashed with instead of losing crucial time for crashing at the high paced speed at the end of the race.
[https://www.letour.fr/en/stage-5/image-gallery](https://www.letour.fr/en/stage-5/image-gallery?ref=connortumbleson.com)
Stage 5 was such a unique stage with cobbles returning to the race - such a dusty and complex chunk of the race. Tons of crashes occurred, Roglic even crashed and dislocated his shoulder, but instead just popped it back into place and jumped back on the bike.
[https://www.letour.fr/en/stage-7/image-gallery](https://www.letour.fr/en/stage-7/image-gallery?ref=connortumbleson.com)
Stage 7 ended on gravel at an insane 24% incline and led to the most intense ending of a stage between the 1st and 2nd place rider that I can remember. It was a stage that proved that Tadej was still here to hold the jersey.
[https://www.letour.fr/en/stage-11/image-gallery](https://www.letour.fr/en/stage-11/image-gallery?ref=connortumbleson.com)
Stage 11 was intense with a calculated attack against the yellow jersey (Tadej) by Jumbo-Visma who continued to attack and isolate Tadej until he had no teammates remaining. This was the first stage we saw Tadej as only human who dropped 3 minutes to Jonas who then took the yellow jersey.
Stage 12 through 16 all saw Jonas continue to hold strong and answer any challenge given by the white jersey (Tadej). Tadej continued to be down by 2:22 stage after stage unable to catch up. Was losing 4 teammates on his team of UAE leading to this challenge? - probably didn't help, but Jumbo Visma lost 3 themselves.
[https://www.letour.fr/en/stage-17/image-gallery](https://www.letour.fr/en/stage-17/image-gallery?ref=connortumbleson.com)
Stage 17 was the first stage we saw Tadej barely out pace Jonas gaining 4 seconds due to the time bonus for winning the stage. This was showing promise with only a few stages left.
[https://www.letour.fr/en/stage-18/image-gallery](https://www.letour.fr/en/stage-18/image-gallery?ref=connortumbleson.com)
Stage 18 however crushed that belief when Jonas buried Tadej by another minute, with an extreme stage showing that it was man vs man with a few kilometers to go. With such an interesting show of sportsmanship when we saw Tadej crash and Jonas slow down until they got back together. I think Jonas knew that he could crush him in the final few kilometers and didn't want to win due to a rider crashing out.
[https://www.letour.fr/en/stage-20/image-gallery](https://www.letour.fr/en/stage-20/image-gallery?ref=connortumbleson.com)
Stage 20 was another time trial and we saw Jonas further his lead by roughly 10 seconds in the general classification. Which solidified the placings as:
- 1st - Jonas
- 2nd - Tadej (+2' 43)
- 3rd - Geriant (+7' 22)
Wout finally got a time trial stage win after very closely losing it in stage 1\. It looked like ever so briefly that the yellow jersey was going to win the time trial with a few minutes to go, but he slowed down and started smiling. So the teammate (Wout) above came out to greet the yellow jersey at the finish line.
[https://www.letour.fr/en/stage-21/image-gallery](https://www.letour.fr/en/stage-21/image-gallery?ref=connortumbleson.com)
Stage 21 had a few funny events where the day started with yellow, green and white jerseys jumping out in an immediate sprint in the beginning. This is normally a stage that starts with 50km of slow pacing group movement, so this little fun the jersey's were having was a great show. Towards the very end with a few kilometers to go we saw the white jersey attack! Tadej was 3+ minutes down at this point so no possible way to catch up, but it kept the crowd on their toes.
The tour ended and a new yellow jersey was crowned: Jonas Vingegaard.
---
A very interesting tour this year and the competition continues to elevate. I think we will see teams build around Jonas and Tadej for the years to come for true contenders to battle it out.
### Travel Blog: DC
URL: https://connortumbleson.com/2022/08/01/travel-blog-dc/
Last updated: 2025-02-04T11:42:49.000Z
My 2nd travel after COVID-19 restrictions have been relaxed a bit and this time visiting a friend in DC. After my last travel nightmare with a different airline, I went back to Southwest for a slightly more expensive, but consistent airline experience. Which did not disappoint as my flight departed and arrived on-time with no issues.
This time a late morning flight around 9:45 to land in DC roughly at 11:30 prior to lunch. Visiting a friend this time was different because he didn't know we were coming, but don't worry we ran some logistics by his wife to be sure everyone was available. So my arrival and another friend's aligned almost perfectly to both be available around noon.
So the plan went into action - we took a taxi to the friend's apartment and waited outside in the locked entry for the friend to arrive. Sure enough he arrived carrying some alcohol for the weekend and spotted us. Thankfully that plan did not backfire and the 3 of us then went up to his apartment.
I could see from the roof of his apartment a pretty large train intersection of lines. With very little activity on the lines themselves - I only remember seeing 2 of the lines have moving trains on them.
We then went out to explore some food and learn a bit of history of the area's more well known parks and buildings. We stumbled upon an area known as "The Wharf" which had tons of food establishments plopped right on the water.
Fish n Chips - Kirwan's on the water
While I hoped the meal above would have been something to remember - I won't. The staff consistently just forgot about us for refilling waters or even bringing the check and the food had nothing special about it. I was expecting some of these places on the water to put a twist on the common seafood meals, but they did not. Perhaps living in Florida and getting an increasing amount of perfect seafood has tainted my viewpoint of alternatives.
However, the experience and area was great and we rented bicycles to travel around. I wish we abandoned the scooters in Tampa and had more bike stations as those were on nearly every other corner and made traveling longer distances a breeze.
July 20, 2022 - Activity
As you can tell from above we biked around Capitol Hill and went all the way to the river and back. I could feel the burn in my legs on a sub 400 meter climb, but yet I watch the Tour de France where they climb 4km - absolutely insane to put into perspective.
As the night hit we jumped between bar after bar making our way to a jumbo pizza slice joint on the road before calling it a night for gaming and sleep.
As Sunday approached it was the day to travel home, but prior to that we jumped onto a bike to head to brunch. This time I got the chance to catch a picture of the one of the many bike racks scattered around the city.
Just scanning a QR code with a valid mobile application and the bike is yours. Likewise just locking it back up is all it takes for the transaction to take place. Most of mine being between $1 and $3 for the trips.
We stopped at brunch at a place that increased in popularity as the minutes ticked by. What started as us being the only folks quickly grew to 10+ tables full of folks. I ended the trip with a Nashville hot chicken sandwich. Which was pretty solid with the combination of flavors with sauce, coleslaw and perfectly cooked chicken.
I headed back to airport a few hours ahead of my flight while writing this blog prior to the adventure being over. The post is set to go live at 10:30pm local time, but I'm only landing around 10\. With travel and more - I might be getting home around then - so if all goes well I'll be getting an alert this blog went out as I get home from the travel. If not, I might have to update this post on what nightmare occurred on the way home.
### Twitter Argument and 10k Ninjas in Halo Infinite
URL: https://connortumbleson.com/2022/07/25/twitter-argument-and-10k-ninjas-in-halo-infinite/
Last updated: 2025-02-04T11:42:49.000Z
[Original Tweet](https://twitter.com/Forcifyy/status/1549936951922491392?ref=connortumbleson.com), [Quoted Tweet](https://twitter.com/halodotapi/status/1550554978665783300?ref=connortumbleson.com)
This post starts with a Tweet that I stumbled upon. I spotted the tweet posted in a Discord channel I was in and the unraveled image was the one above.
I was curious because I built the website shown in the interface. That was the [Halo Infinite Ninja Leaderboard](https://leafapp.co/leaderboards/medal/3085856613?ref=connortumbleson.com) on Leaf.
I then looked at the comments and was instantly deflated. One comment reading:
> No, and I can only imagine stat boosters such as yourself are the sole reason why 343 won't let 3rd parties use their API.
> [https://twitter.com/FRiCTiON\_just/status/1550084873699876873](https://twitter.com/FRiCTiON%5Fjust/status/1550084873699876873?ref=connortumbleson.com)
So yeah I don't think you get anything for hitting 10k medals in a game, so his first 2 characters are right. However, then he immediately suggests that a stat booster is the reason 343 won't let people use their API.
Boy that is a lot to unpack.
First off, [HaloDotAPI](https://autocode.com/halo/api/infinite?ref=connortumbleson.com) is the service Leaf uses (the stat site above) and that API works by talking to the same exact internal APIs that the game uses.
When 343 built Halo 5 - they produced a [public API](https://developer.haloapi.com/?ref=connortumbleson.com) that also acted as the internal API for some selection of calls. This was documented, rate-limited and given to any who asked. The API was full of properties marked "internal" so it was believed that 343 used the same stat endpoints that they handed out to the community.
When Halo Infinite launched - there was no public facing API. So engineers went peeking around the network of the game to find the internal calls it made. These calls are less friendly for clients/users outside the game, but have the same amount of information needed.
So if we loop this back to the Twitter argument - a user visiting a website that utilizes HaloDotAPI which talks to the internal game API has nothing to do why 343 won't support this API project.
343 probably cannot fund this 3rd party service because the data is obtained and researched via some "gray" methods. The APIs are internal and could change on a whim with a new patch release. So if 343 funded a project that was built on reverse engineering an internal API and they funded it - I think the precedence set would be odd.
They would be funding a company for reversing an API and building on top of it. I think the expected thing they can do is what they are doing: They are **not** shutting the internal API access down for unofficial clients.
I have more respect for the complications that arise when wanting to partner with an organization and help run a "chunk" of their business after now hitting 7 years building software professionally. I can see all the compliance, legal and devops nightmares that arise when these conversations begin happening.
---
So I decided to respond to the tweet and go to work.
> playing game for medal(s) somehow affects api usage? I've had enough internet for today and I just woke up.
> [https://twitter.com/iBotPeaches/status/1550095734611001345](https://twitter.com/iBotPeaches/status/1550095734611001345?ref=connortumbleson.com)
Of course I made a mistake even responding to someone on the Internet. When I came home from work and saw I had 15 notifications. A ton more tweets came in:
> You think 10k ninja's in 425 hours played is a legitimate stat? Yes, you should get the eye boogers off & realize the boost.
> Watch out for ninja warrior here. 425 hours total and only 23 in ranked. 10k ninjas sounds like you ninjad a bunch of 343 bots.
> 10,000 and 9,999 of them were against “343 Meowlnir”
So it seems folks believe this user is boosting and/or playing against bots. Thankfully as the engineer who built the stat site used in the original tweet. I can invalidate two of the responses above with 1 simple phrase.
Leaf does **not** track stats from Bot Playlists in leaderboards or service records. This means if you head into "Bot Bootcamp" where you play dumb bots - those stats do **not** count towards any leaderboard on Leaf.
Not to mention, this is a default supported feature by the API itself.
[HaloDotAPI (Autocode)](https://autocode.com/halo/api/infinite/?ref=connortumbleson.com#stats-players-service-record-multiplayer-matchmade-all)
> Bot Bootcamp stats are omitted by default but could be fetched separately using the right "playlist\_id".
So now we have two more claims to investigate:
- The user does not play Ranked.
- The user "boosts" medals.
If we look at the first one - someone is upset that the user does not play Ranked playlists. My guess is this is an easy answer. As of this post the only Ranked playlist is 4v4.
So if you want to play the game 4v4 while attempting to maximize a specific medal - you would be probably not contributing to a win in a team game. However, you can drop into "Social" (not ranked) and play in Lone Wolves - a playlist designed to be a Free For All (FFA) and specifically focus a medal.
So I think we should design a query since we have all this data and see the hour breakdown of every playlist played for this user.
So a quick query for this user.
```sql
SELECT
playlists.name,
SUM(
games.duration_seconds / 60 / 60
) AS duration_in_hours
FROM
games
JOIN playlists ON playlists.id = games.playlist_id
WHERE
games.id IN(
SELECT
game_id
FROM
game_players
WHERE
game_players.player_id = 43667
)
GROUP BY
games.playlist_id
ORDER BY
duration_in_hours
DESC
```
We are just grabbing this user history and ordering by most played in hours.
| Playlist | Hours |
| -------------------------- | ------------ |
| FFA Slayer | 132.01666658 |
| Rumble Pit | 131.49111112 |
| Team Slayer | 110.68166670 |
| Quick Play | 57.79861112 |
| Ranked Arena | 26.83194448 |
| Big Team Battle | 13.45888888 |
| Fiesta | 11.41666667 |
| Entrenched | 3.20444445 |
| King of the Hill | 3.13027779 |
| Fracture: Tenrai - Fiesta | 2.30500001 |
| Tactical Slayer | 1.81444442 |
| Team Snipers | 1.77111111 |
| Ranked Arena | 1.60083334 |
| Land Grab | 0.95500000 |
| Bot Bootcamp | 0.67111111 |
| Cyber Showdown - Attrition | 0.37888889 |
| Tactical Slayer | 0.17805555 |
So as I thought - best playlist to obtain Ninja's is a FFA playlist and that accounts for the top two playlists for nearly 263 hours played.
So sure - the user does not play ranked. The last point now is the user is a "booster", which the name suggests boosts a specific stat normally against partner(s) supporting the effort or bots instead of naturally obtaining the medal against random players.
We know its not bots, but could this user be playing against the same person as they trade Ninja's? Well not in FFA, as the max party size is one.
So I think I should query all games this user has done, cross reference to the players in that match and find the results. I am expecting due to Halo Infinite crash from extremely powerful to hurting to survive that we might expect some heavy duplicates, but we are making sure they are no outliers.
| Gamertag | Cccurrences |
| --------------- | ----------- |
| Forcagious | 3546 |
| LoveMeSomeCake | 289 |
| CoppertheViking | 162 |
| Maneyax | 141 |
| Kaemn | 108 |
| A Smelly Jar | 104 |
| NoGuish | 85 |
| EmperorWilbur | 55 |
| Ston3dNinjaZ | 55 |
| IQ Ninja pro | 54 |
So we can see we pulled 3,546 games and "LoveMeSomeCake" was in 289 of them or roughly 8% of matches and since I was curious most of those matches were Team Slayer.
So now I think should check which playlists all these medals were obtained.
| Ninjas | Playlist | |
| ------ | -------------------------- | |
| 2323 | FFA Slayer | |
| 525 | Rumble Pit | |
| 462 | Team Slayer | |
| 83 | Quick Play | |
| 21 | Fiesta | |
| 19 | Fracture: Tenrai - Fiesta | |
| 5 | Ranked Arena | |
| 2 | Big Team Battle | |
| 1 | Cyber Showdown - Attrition | |
So with nearly 3000 medals obtained in FFA type playlists which restrict the playlist to 1 player in the party - we know this user cannot be boosting with a player.
So I look back at this post and wonder why I just did all this research to prove some comments wrong on the Internet.
### Sandwich Shop Reviews 2022
URL: https://connortumbleson.com/2022/07/18/sandwich-shop-reviews-2022/
Last updated: 2025-02-04T11:42:49.000Z
Photo by [Mae Mu](https://unsplash.com/@picoftasty?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few years ago I wrote a [blog post](https://connortumbleson.com/2019/08/05/sandwich-shop-reviews-2019/) about my opinion of sandwich shops, but I did something weird - I judged places by how I remembered them even if I hadn't visited them in years. Turns out after another 3 years of not visiting those places - it doesn't seem fair to grade them.
So this time a refresh of my favorite sandwich shops in Tampa - this time the rules decrease to just one - I must have eaten at each place more than once.
---
**Lenny's**
I stumbled upon Lenny's about a year ago and it reminded me of Quiznos and an older Kansas place known as Planet Sub. You can get a cold or hot Italian sandwich and its wrapped in tin foil and handed off. That tin foil technique reminds me of Planet Sub and for some reason just elevates the flavor of a sandwich.
It falls a bit lower in my top five because of consistency. At the end of the day it is a chain and whomever is working at times can lead to a dice roll experience. So at times I go and I think the food is excellent and prepared well - other times it seems the staff doesn't want to work and I get something that I'll eat, but pushes me away.
However, I still go back because even if the staff messes up the sandwich - the quality is there with the bread and meat.
---
**Panera**
Panera continues to change and evolve and why I continue to visit. They are the only company on this list that I feel every visit I go I see a new sandwich on the menu. Which is funny given an option at any other place - I would get the same thing. So what is it about Panera that leads me to trying every new sandwich?
I think its because the Italian sandwich I get is normally dry and not my favorite, but it does taste good. So I tend to try like the avocado melt, then I figure if I'm trying different sandwiches I might as well try the new spicy chicken.
This pattern never ends and I keep trying the new creations at Panera and most of them do not disappoint.
---
**Sulfur** **Springs Sandwich Shop**
Sulfur Springs Sandwich Shop
This sandwich place I debated putting on this at all because the location has been closed Since Feburary 2022 under new owners and renovation. So knowing how many times I've been let down by change - I'm predicting the new owners to not produce the same quality I loved.
If we ignore that aspect - this sandwich place was like if you had the power of unlimited sandwich aspects in your home kitchen, but instead produced by professionals. Every sandwich has an insane great quality from the first to last bite, but it does take a solid amount of time to get a sandwich. Nothing I can truly count them off for, but if a place is always busy and takes a bit to obtain - it doesn't often work into my schedule.
---
**Publix Subs**
[https://www.publix.com/pd/publix-veggie-sub/BMO-DSB-100018](https://www.publix.com/pd/publix-veggie-sub/BMO-DSB-100018?ref=connortumbleson.com)
This is a grocery store that has a sub area and it rivals most established sandwich shops. So many unique possibilities of flavors that aren't normally available in other places. You can get garlic pickles on your sandwich or regular - you can get some unique Boar's Head gourmet mayo on top. This is a sub station that benefits being located in a grocery store to offer a ton of possibilities.
The bread is always fresh daily and tastes great whether ordering white or wheat and the veggie or buffalo chicken sandwich are both excellent. I think why I continue coming back is the closeness to a regular shopping trip and the friendly staff present. I don't think I've had a single sour person working the sandwich station - always a pleasant staff member.
When you compare that to the chains or other stores - most times I stop supporting a place is the actions of a single staff member that turns me off to that establishment.
---
**Jersey Mikes**
Jersey Mikes won #1 when I did this blog post in 2019 and nothing has changed with this business. Staff is still very nice and actually asks you how your day is going - which is odd when looking at how often that is in done in other restaurants. They still coat the mayo on the bread to protect it from the liquid of oil/vinegar seeping in and that random act does produce a great sandwich.
The cherry pepper relish is unique to this chain and it continues to elevate any sandwich with great flavor. I can't place it, but the shredded lettuce in comparison to other restaurants just tastes more unique. So I can go in and get an Italian sandwich "Mike's way" + cherry pepper relish and mayo and I have an excellent sandwich.
They also have the most excellent perfectly cooked just right cookies and as pictured above they even had a special iteration with pure Hersey's Kisses.
---
All in all - sandwich shops are my jam. I don't think I've gone to a burger fast food establishment in years. Sandwiches are in.
### Local News is Dead
URL: https://connortumbleson.com/2022/07/11/local-news-is-dead/
Last updated: 2025-02-04T11:42:50.000Z
Photo by [AbsolutVision](https://unsplash.com/@freegraphictoday?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
If I turn back the clock further and further to being a younger kid - there is one thing I remember is newspapers. Whether it was the dog ripping it to shreds or just picking it up and carrying it home after the morning dog trip.
The next memory is moving into my first apartment in college and I'll never forget someone coming to my door and asking if I would want to buy a newspaper subscription. When they said it was nearly $10/month I was like "*ehh no*" - I didn't want to spend what little money I had on news.
After that I've never been in a situation where I bought a newspaper again. What I have instead as news is a constant stream of alerts, tweets and Reddit at an insane pace. This means I can choose to get updates about the current situation in Ukraine up to minute by minute, but I struggle to know when my local city has anything local that will affect me.
My "Nextdoor" page.
Take Nextdoor, which I believe is trying to take over the local news market, but boy what an annoying experience. These official local news entries take forever to load and outnumber actual human messages by a ton as they post heat warnings 3 times a day. Granted, the human messages I do see are just embarrassing.
It seems that people on Nextdoor commonly just:
- Forget how to spell
- Forget how to act
- Forget how to use technology
There is one user I'm looking at right now that has posted "813" as comments on 3 posts. That is our area code so what is the intent? Then someone else posts in all caps - "IN NEED OF STORAGE TUBS/BINS WITH LIDS" that just attracts a bunch of laughing emojis presumably because of the all caps.
The problem is Nextdoor seems like a good idea to marry local neighbor chatter with local news, but instead just creates such an annoying experience - I tend not to visit.
---
If we look now at global news - that has massively changed in comparison to the past as we can get near real time alerts of anything in the world. A storage facility blows up in Beirut and I know about it in extreme detail within minutes, but yet I have no idea why miles of roads are closed right outside my door (turned out testing new natural gas lines).
Perhaps this is because we as of a community are addicted to blood, death and gossip which is trumped at a global level than local. Lets follow as a planet when Natalee Holloway goes missing in Aruba, but turn off the amber alerts for abductions in our city as its inconvenient.
It seems the answer is simple - just pivot to local news. Though who knows if your local news station is just owned by a central organization and fed scripts.
You can see above that you may think local news is in-fact local, but chances are some scripts are from the central organization. So that begs a real question of who decides what your own local news coverage looks like.
I can tell local news changed, because I remember how different it was in Kansas in my childhood. Some local news report were about high school state events to discuss winners or to interview the winners of a science fair. It had more positive stories than constant [doom n gloom](https://connortumbleson.com/2021/08/30/doom-gloom-and-music/) that it feels like now.
Though, lets look at local news itself as a whole. Chances are even if I had easy access to it at this age and point in time - would I watch it? Probably not as something important enough for me to know would make it to me in some other method.
My guess this is because the world has less time for news, which I think is directly related to how little wages have kept up with products over the last 60 years. I [blogged about](https://connortumbleson.com/2022/01/03/then-and-now/) this in detail about how many burgers you could buy off the dollar menu in 1963 vs 2020.
So if we have near instant access to global news in a divided country with near useless local news. What do we have? Perhaps a constant biased source of news or propaganda over non-television based media, which can eat up any person at a mental level. So until then I'll continue to somewhat ignore news until it pops up on feeds that I watch.
### Entitlement and Compassion
URL: https://connortumbleson.com/2022/07/04/entitlement-and-compassion/
Last updated: 2025-02-04T11:42:50.000Z
Photo by [John Cameron](https://unsplash.com/@john%5Fcameron?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This morning around 7:50am I left for the park for a run. A short drive and a left hand turn and that's all it takes and I'm at the park. I get into the left lane and see the lane for the park is quite backed up into the road.
Odd drawing of my left hand turn. I am the blue rectangle.
So I tried to draw what I saw as I sat in my car as the blue rectangle above. Knowing it was a minute or two away from the gate opening (red line above) - I saw the light turn green and did not move. I figured the cars behind me were going to the park as well and all would be fine.
I was wrong - at first a honk I ignored, then a just non-stop hounding of the horn behind me. I figured they were not looking at the blocked entrance of the park and would realize it. Before I could further react a car ripped out into the lane besides me - floored it in front of me, tossed a finger and whipped a U turn around me.
So now I understood the driver was attempting a U turn and not left turn which explains the honking. So then I was thinking what an ass, but then I started thinking that I could have easily passed this light and done a U turn myself to get into the other direction's right hand lane as a line had developed.
However, none of that entered my mind in the blast of a horn and heart rate elevated situation for the sub 30 seconds it occurred in.
---
So I start to think if people are losing compassion and just growing full of entitlement since these situations are happening more commonly than I remember.
Is it location based? I did used to live in the Midwest and folks just felt nicer in that regard, but then I move to the "Southern Hospitality" region and at times don't feel it.
[Fallen Shopping Carts (2019)](https://connortumbleson.com/2019/04/22/fallen-shopping-carts/)
Take for example returning your shopping cart after shopping. There is a theory about this called the "Shopping Cart Theory" which suggests you can detect the moral character of someone simply from what they do with their cart. If you fail to return the cart to the designed spot - you aren't getting arrested. It seems baring an emergency you should return your cart as it is objectively without fault the right thing to do.
So each time I see someone not return their cart I feel I know their character immediately.
---
Another thing that continues to blow my mind is trash pickup. We have a raccoon problem here and if you leave trash out without a lid chances are its getting knocked over and perhaps dug through. Which I kinda doubt a raccoon can do, so must be another animal around.
So when I see a trash pile exceeding the space of a can as I drive home, then as I drive to work the next morning and see it knocked over and trash everywhere. I think - what an ass that person is. They know why the city requests you to put lids on the cans.
So what did the city do? They thought ahead - they bought new trash cans for every citizen in the city through a botched roll-out. This new trashcan is huge and is easily larger than my old and has an attached swinging lid. Its extremely heavy in the realm of trash cans and I think the city built the fixes into the can itself.
New (left) and old (right) of my trash cans.
Animals cannot flip this heavy trashcan. The lid is attached so citizens have no argument for not putting a lid on it and the label says not to overfill it and instead request another trashcan.
I feel like this should have resolved our issues of animals messing up trash, but still some folks refuse to follow rules.
- They pack trash next to, on top, alongside the huge 60-75 gallon bins.
- They don't close the lids that are attached to the cans.
- They use the old trashcans alongside new.
Which I cannot follow - its in the best interest of other neighbors and citizens to not break these rules so trash stays in the trash. However, they don't and we deal with pure trash that blows around and has to be cleaned up.
So I need to shout out this older gentleman that I do not know. Every single day between 7 and 8am he is walking the neighborhood road with a bag and trash picker and picks up trash every single day - he cleans others mistakes who do not deserve it.
---
Finally, I just feel more of the population doesn't realize how they act in public. From watching someone stand in the middle of a sandwich shop looking at the menu and then talking to me when I step up to the counter to order like I'm cutting.
Perhaps its all just Florida - who knows.
### Rebuilt Games
URL: https://connortumbleson.com/2022/06/27/rebuilt-games/
Last updated: 2025-02-04T11:42:50.000Z
[Similar Open Source Projects](https://github.com/OpenRCT2/OpenRCT2?ref=connortumbleson.com#similar-projects)
In the start of the new millennium video games were in a much different state than they are now. Most of the games I played back then simply do not exist in the same style today and from memory I played the following:
- Roller Coaster Tycoon
- Sim Ant
- Sim Tower
- Red Alert 2
- Age of Empires
Every once in awhile I have an urge to play one of these older games and I find quite a selection to pick from of these games. It seems classic games will be reborn from one or many of the following.
**Ports**
Age of Empires 2: Age of Kings
Lets take Age of Empires 2: Age of Kings - a game released in 1999 that was extremely addicting for real time competition of civilizations. This was in contrast to the growing popular game known as Civilization, which instead worked in turn-based strategy.
The game continued over time with a few more in the series, but the game moved further away from the real basic design to a more highly 3d driven approach. These newer games didn't jive extremely well with the tight knit community that developed around the original. So about 15 years later - an HD version of the original game was released known as Age of Empires 2: HD Edition.
Age of Empires 2: HD Edition
This was sold as "re-imagined" with a selling point of supporting new higher quality assets, supports for Steam as well as multiple monitors. What happened in actuality was a pretty buggy game that continually broke synchronization in multiplayer as well as just crashing to the desktop.
This isn't to say the 1999 year old alternative didn't have its fair share of issues, but the modding community really helped keep that version running. So while this port didn't change the game to an extreme that lost it roots - it wasn't perfect for what the community wanted and easily was looked at as a rushed, poor and lazy port.
Age of Empires 2: Definite Edition
Another 6 years passed and the original game was re-mastered and ported again! This time we got Age of Empires 2: Definite Edition, which was developed by a different group of companies but still published under Xbox. This was the port that people wanted. It took some common complaints about the game that were simply dated with age and tweaked them. Features that were a welcome addition were added, as well making sure the game had the settings that folks wanted to play with the vast combination of video display settings.
So it seemed with the right amount of work - you could port a 20 year old game to newer systems with only slight tweaks to the base and make a successful game.
---
**Re-implementation**
[OpenRCT2](https://github.com/OpenRCT2/OpenRCT2?ref=connortumbleson.com)
What we notice at times where a port is never made or heavily delayed sometimes the community steps in to hold the mantle. For this we can look at Roller Coaster Tycoon, which has the popular [OpenRCT2 project](https://github.com/OpenRCT2?ref=connortumbleson.com) that re-implements the game in the open source space.
This is a legal and fair re-implementation as the open source copy refuses to run unless it can be pointed to a valid original install to re-use some assets and scenarios. However, this is just a requirement for large popular open source re-implementation projects as failure to do so can easily result in a DMCA and the project is dead.
OpenRCT2 started around 2014, but what is interesting is a port of the classic game did end up being released officially in 2016 on mobile and 2017 for desktop. So you then have an interesting split of users - those who return to the official port of the game or those who prefer the community driven approach of an open source iteration of the game.
Regardless, we have to look back at the classic game that was written by Chris Sawyer solo writing the game in x86 assembly. Rarely in this day and age do you find a game written at such a low level language without a full development shop.
A lot of Sawyer's games have attracted the attention of re-implementation:
- Locomotion - [OpenLoco](https://github.com/OpenLoco/OpenLoco?ref=connortumbleson.com)
- Transport Tycoon - [OpenTTD](https://github.com/OpenTTD/OpenTTD?ref=connortumbleson.com)
- Roller Coaster Tycoon 2 - [OpenRCT2](https://github.com/OpenRCT2/OpenRCT2?ref=connortumbleson.com)
[OpenRA](https://www.openra.net/?ref=connortumbleson.com)
As well as a few games that I also played during that era:
- Age of Empires 2 - [OpenAge](https://github.com/SFTtech/openage?ref=connortumbleson.com)
- Red Alert - [OpenRA](https://github.com/OpenRA/OpenRA?ref=connortumbleson.com)
These re-implementations range from better than the official version to a less than preferred buggy experience.
---
**Emulation**
Finally, we have the emulation route which just emulates the original environment in order to run the classic original game. There are a bunch of websites that can even preform this emulation all via a web browser.
Take Sim Ant, which we can use DOS Box in order to run directly in Chrome.
Sim Ant - DOS Box
This takes you back to the literal exact game you played 20+ years ago. However, you will quickly realize why games evolved. While great to play for an hour - the game has been dated with the time and it needs the re-implementation or a remaster in order to make the game re-playable.
This continues with games like Sim Tower where you can emulate Windows 3.1 and jump right back into the experience as you remember it.
Sim Tower - Emulation
Another game that is a bit jarring to use movement wise, but you might remember it being much better than it actually feels.
---
So overall it seems no matter how dated a game gets - it become emulated, re-built or even re-mastered officially.
### Basic Laravel Optimization
URL: https://connortumbleson.com/2022/06/20/basic-laravel-optimization/
Last updated: 2025-02-04T11:42:51.000Z
Photo by [Mathew Schwartz](https://unsplash.com/@cadop?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Recently when Halo Infinite came out, a hobby site of mine grew from roughly a 1mb database to 5.5gb in half a year, additionally moving from nearly 10 records to 20 million.
The hardware has not changed for this project and continues to be on the same [$40 Linode instance](https://www.linode.com/lp/refer/?r=e92c46a37fb8d23182a473696f336b261ff2ec78&ref=connortumbleson.com) (*affiliate link for $100 credit*) and has shown a few growing pains. I wanted to revisit all the optimization techniques Laravel, PHP and MariaDB offers in order to see if we can squeeze more performance out of this site.
---
**PHP - Composer - Optimized Autoloader**
```bash
composer install --optimize-autoloader --no-dev
```
- This will install production dependencies with an optimized autoloader.
In development mode composer has no issues crawling the filesystem to resolve PSR0/4 namespaces which incurs a performance cost. Once in production its expected that new classes are not being added to system. So the optimization can produce generated class maps rules that even get inserted into opcache. This means class loading is insanely fast.
Since I use Deployer I [double-checked](https://github.com/deployphp/deployer/blob/master/recipe/deploy/vendors.php?ref=connortumbleson.com#L6) my deployment process is correctly doing this.
---
**Laravel - Artisan Optimize**
When you deploy Laravel you want to pre-generate files that incur a cost to generate. This ranges from configuration files to view files. Once done, these files have been combined and located in one area so the file scanning IO no longer needs to occur.
```bash
php artisan optimize
# Configuration cache cleared successfully.
# Configuration cached successfully.
# Route cache cleared successfully.
# Routes cached successfully.
# Files cached successfully.
```
If you leverage Blade files you may also add another command in order to build all Blade files. This moves the generation from on-demand to ahead of time which makes the end user experience much quicker.
```bash
php artisan view:cache
# Compiled views cleared successfully.
# Blade templates cached successfully.
```
---
**Laravel - Production Assets**
I've sadly seen a few folks just deploying their Laravel projects with precompiled development assets. If you leverage Laravel Mix you want to toggle into production mode.
```bash
yarn run prod
# ┌──────────────────────────────────────────┬───────────┐
# │ File │ Size │
# ├──────────────────────────────────────────┼───────────┤
# │ /js/app.js │ 113 KiB │
# │ /js/app.js.LICENSE.txt │ 561 bytes │
# │ css/app.css │ 108 KiB │
# │…400.ttf?b823fc0dbb5a5f0c21bbcc2a268f92aa │ 178 KiB │
# │…0.woff2?ebb7a127d2d8ee6f183274b7557718ab │ 103 KiB │
# │…900.ttf?e615bbcb258550973c165dfc0d871c96 │ 379 KiB │
# │…0.woff2?59edf72a325ac2048d6077f64773674f │ 151 KiB │
# └──────────────────────────────────────────┴───────────┘
```
You can see `app.js` was built to 113 killobytes when development mode is nearly 700 killobytes. I additionally leverage [PurgeCSS](https://github.com/spatie/laravel-mix-purgecss?ref=connortumbleson.com) in order to purge unused selectors. This takes a bit of configuration because of the dynamic nature of some of my selectors.
Its worth it in development to occasionally run your local install with a set of production built assets. As you might notice things act differently in "production" mode.
---
**PHP - Opcache**
*Before we jump into this one, PHP7.4 support for preloading opcache looks extreme powerful. Laravel does not support it natively and I'd like to stay away from [plugins](https://github.com/Laragear/Preload?ref=connortumbleson.com) that work quite close to the core.*
First you need to determine if you have the native (PHP 5.5+) cache module installed.
```bash
root@zanzibar [~]# php -m | grep 'cache'
Zend OPcache
Zend OPcache
```
If you have it enabled, then just double check a few properties.
- `opcache.enable` \- `On`, so its actually enabled.
- `opcache.enable_cli` \- `On`, so its enabled for CLI.
- `opcache.memory_consumption` \- `128`, I prefer 128mb for how much memory to allocate to this. Keep this to powers of 2.
- `opcache.interned_strings_buffer` \- `8`, I prefer 8mb, a small size knowning my application design of strings. Also keep this to powers of 2.
- `opcache.max_accelerated_files` \- `4000`, This is an odd property that works off primes, so while I put `4000` the real value will become `` `7963` ``.
- `opcache.validate_timestamps` \- `Off`, This disables automatic detection of changed files to refresh cache. So it must be done manually.
- `opcache.save_comments` \- `On`, because oddily some libraries depend on the comments, which may be annotations, etc)
The import value to note here is `validate_timestamps` which can seriously affect your application getting updated code unless your deployment process can handle either cleaning the cache or reloading the php process.
My deployment tool handles this via a [php-fpm](https://deployer.org/docs/7.x/contrib/php-fpm?ref=connortumbleson.com) recipe. So anytime a deploy goes out - fpm is reloaded and changed files are loaded.
---
**Laravel = N+1 Problem**
So when building Laravel applications, I enjoy using the [debugbar](https://github.com/barryvdh/laravel-debugbar?ref=connortumbleson.com) extension to make it easier to digest performance issues.
If we take a look at this homepage, we have an obvious problem here. We are grabbing 5 players, then pulling a relation one by one off each of those players. Without Laravel, the optimization here would be to properly join the tables and select the needed data.
Here, I can just `->with(['serviceRecord'])` and I'm good to go. Now that page results in a singular query finding all the related data for that set of players.
While the queries were not expensive - this is a cheap way to optimize a system. Additionally, we can slip a line into our App Service Provider in order to detect these kind of mistakes from occuring in the future.
```php
// app/Providers/AppServiceProvider.php
public function boot(): void
{
Model::preventLazyLoading(! app()->isProduction());
}
```
---
**MariaDB - Query Cache**
Your database is always under constant requests on a popular website, so tuning and optimizing a database is not something we can cover in a small snippet in a blog. A [query cache](https://mariadb.com/kb/en/query-cache/?ref=connortumbleson.com) though is an incredibly powerful feature that can cache SELECT queries and return a cached value for the exact query.
MariaDB takes the complex effort of determing when to refresh the cache, so for the most part - you can simply enable this and reap the benefits.
While your mileage may very depending on setup. You can enable query cache on MariaDB with just a few configuration tweaks.
- `have_query_cache` \- `Yes` \- To enable it.
- `query_cache_size` \- `8mb` \- For an 8mb cache pool.
- `query_cache_type` \- `1` \- For a mode that caches all possible queries.
Now you can query the database for some status and see how its handling.
```mysql
MariaDB [(none)]> SHOW STATUS LIKE 'Qcache%';
+-------------------------+---------+
| Variable_name | Value |
+-------------------------+---------+
| Qcache_free_blocks | 385 |
| Qcache_free_memory | 1662336 |
| Qcache_hits | 420933 |
| Qcache_inserts | 280391 |
| Qcache_lowmem_prunes | 147248 |
| Qcache_not_cached | 15511 |
| Qcache_queries_in_cache | 641 |
| Qcache_total_blocks | 2288 |
+-------------------------+---------+
```
So we are looking at 420,933 hits and 15,511 misses. It looks like a solid positive return for a simple change. Obviously if your application deals with money, finance or something instead of Halo stats - you might want to learn more about the downsides of caching.
---
So with just a few hours of work you can improve the performance of any site. We haven't even discussed many things like:
- HTTP/2.
- `EXPLAIN` queries and tuning them.
- PHP-FPM tuning.
- Image optimization.
- Cookie-less asset domain.
We've scratched the surface enough though for the basics.
### Travel Blog: Michigan
URL: https://connortumbleson.com/2022/06/13/travel-blog-michigan/
Last updated: 2025-02-04T11:42:51.000Z
Lake Michigan shore walking around in rain.
My first travel since the COVID-19 restrictions had been relaxed. This time entering an airport and seeing a mix of masks and non among the crowd. Additionally, seeing all businesses open in the airport was a change from my [beginning COVID](https://connortumbleson.com/2020/09/21/travel-chicago-covid-19/) timeline flight in which non-food establishments were just closed.
Flying to Michigan from Tampa was a challenge to find a direct flight from my preferred airlines out of TPA. Only finding a direct from PIE (St. Pete / Clearwater) to GRR (Grand Rapids) via Allegiant.
I've never flown Allegiant before and it appears to fit the the budget airline experience, but I'm honestly at a lost how its cheaper in the scheme of things. You have to pay for a carry-on bag, you have to pay for a checked bag, you have to pay for seat picking, you have to pay for food/drinks. You are also forced to pay for a "carrier usage fee" which makes no sense.
So if we look at my base air fee with Allegiant it was $147.12 total, then all the additions I had left me at $338\. A complete random Southwest flight from TPA to MDW to GRR at the lowest plan is $332\. I see no benefit of Allegiant unless you are flying alone with no luggage.
Boarding via tarmac at PIE Airport.
This also was the first time I was boarding a large 747 via the tarmac. It was quite eerie walking under a wing to board the back of the plane via steep stairs. This also proved how dumb humans are with people seeing the shorter lane on the back of plane and going towards it even if they were sitting in row 12\. This paired with the older folks who needed the ramp boarding in the front of plane, but sitting in the back half led to a collision in the middle of plane of folks trying to cross.
This took forever to board as a 5:15pm departure for Allegiant actually meant a 5:43pm departure. Paired with waiting 30+ minutes for our bags in GRR led to quite the delay at the airport. A journey that expected us arriving around 9pm turned into arriving to the house around 10:20pm.
Random shots of rented house on Lake Michigan shore.
It was a bit chilly compared to Florida folks and the first day was nothing but rain and clouds. Plans were getting destroyed as some events didn't seem worth it during a constant mist of cold rain.
I took advantage of this rainy day and started exploring the shore line. It was clear the expensive purchase is building a bridge down the ravine/shore to the water as you could see premium stairs or some just falling apart.
Walking around Lake Michigan.
It was a good, but interesting trip.
- Went fishing and lake was rough and cold.
- Drove 1.5 hours north to visit Big Sable in cold rainy weather.
- Some party members got sick, changing plans even further than rain.
- Selected "hit" restaurants were just ordinary sports bars.
- Power went out one morning for a solid 3 hours.
- Internet was hit and miss at house, but neighbor bragged about having fiber as an attraction to their rented guests.
It wasn't till the departure that this story grows. All the folks on this vacation were leaving at different times and I was first to leave on Thursday. Dropped off at the airport 5 hours early so family could golf - I sat and waited for my flight and boarded.
Something was odd this time as just like the departure to GRR, we were just sitting on the tarmac waiting forever for people to board. I knew something was off when the door never shut and nothing was happening.
The captain came on the mic and said due to bad weather in Florida, the flight was delayed 1 hour and they were debating de-boarding us from the plane. In 10 minutes they checked in again and said waiting on traffic control to find an alternative route as the 1 hour delay was now 3.
We got no update for the next 30 minutes just sitting on a hot plane at the gate - then an Allegiant employee that looked like a guy I recognized from the ticket counter got on the plane and on the microphone and said the worse thing possible.
"*This flight is cancelled, we will work to reroute you.*"
At 6:36pm the email arrived to make it official.
> We regret to inform you that your upcoming Allegiant flight 1072 originally scheduled to depart Gerald R. Ford International Airport (GRR) to St. Pete-Clearwater International Airport (PIE) on Thursday, June 9, 2022 at 5:15 PM has been canceled.
So now I was in a pickle. Dropped off at airport 2 hours away from the rented house and it was late. I saw the lines at both the ticket counter and gate absolutely insane with hundreds of people.
I jumped on my phone and saw the same Allegiant flight but tomorrow (Friday) and started going through the booking on my phone. I pulled out my credit card and filled in information and booked it. Unfortunately, it failed as the flight was full by the time I submitted.
I blame myself messaging folks in anger vs just trying to re-book a flight as soon as possible.
I then shifted to +2 days (Saturday) for another GRR to PIE flight and it was also booked. It seemed every Allegiant flight was just full. It was my turn in line and the staff confirmed, the earliest flight they had available was 16th which was +7 days from the current (June 9th).
That was not going to work, so I went straight to Google Flights and just looked for flights for that day (7pm on Thursday) and there was no flights left to Tampa for that day. The closet thing was a $500 one-way flight to Atlanta on Delta, which I could then easily jump from Atlanta to Florida in the next morning.
That seemed like too much money to spend, so I just started looking at the next day (Friday) to get home on any airliner. I was lucky to be in a position to have the funds to just buy another flight while most the crowd on this Allegiant flight looked unfortunately bound to the available Allegiant offerings which would expand their trip by 7 days!
I always book non-stop because I get dizzy on flights and the less flights make me feel better. There was no direct flight for at least a week so I knew I had to find at least two flights.
I found a Delta from GRR to DTW to TPA. This was going to work, except my car was at PIE. So this is what happened.
- Thursday - June 9 - 5:15pm - Original Allegiant Flight departure.
- Thursday - June 9 - 6:36pm - Allegiant Flight cancelled.
- Thursday - June 9 - 7:00pm - Allegiant flights full till June 16.
- Thursday - June 9 - 7:08pm - Delta flight booked one way - $337
- Thursday - June 9 - 7:14pm - Hotel booked - $184.85
- Thursday - June 9 - 7:32pm - Uber to Hotel - $24.28
- Thursday - June 9 - 8:15pm - Uber Eats - $22.60
- Friday - June 10 - 5:05am - Uber to Airport - $13.77
- Friday - June 10 - 6:15am - Flight to DTW (from GRR)
- Friday - June 10 - 7:43am - Breakfast in DTW - $13.44
- Friday - June 10 - 10:19am - Flight to TPA (from DTW)
- Friday - June 10 - 1:02pm - Uber to PIE (from TPA) - $39.89
So all in all an extra \~$650, but I should get a refund from Allegiant in 7-10 business days of ONLY the airfare charge of $157, so basically an extra $500 and 1 day in Michigan in order to get home.
I can't imagine the alternative of staying another 7 days in a city I don't call home. I overheard one couple just say - "*lets just go home and change our plans*". I wish we all had that option, but I'm guessing most were not local. Allegiant was refusing to cover hotels because weather meant they were not at fault, thus did not have to cover.
I was extremely stressed in the moment tired, exhausted and having to quickly find a hotel, flight and food among a rush of a few hundred people doing the same.
However, I don't understand how other full flights from the same airport just traveled to Florida that night when only the Allegiant flight was cancelled. That sounds fishy to me.
Either way, I made it home +1 day than intended and I guess that's always a fear when traveling. I'm not sure I got to really experience Michigan due to constant rain, but I sure got a dose of stress of travel.
### OPNsense, WireGuard & Pi-hole
URL: https://connortumbleson.com/2022/06/06/opnsense-wireguard-pihole/
Last updated: 2025-02-04T11:42:51.000Z
OPNsense - WireGuard - List Configurations
A few months ago I finished a mini home-lab build out to support some new cool technology in my network. After a few more weeks - its all been perfected and I want to walk through supporting a few things:
- A VPN you can use anywhere that supports WireGuard to connect back home.
- Pi-hole to route all traffic over the network or VPN.
- All wired up and configured properly through OPNsense.
Now I started following this official OPNsense tutorial on setting up [WireGuard](https://docs.opnsense.org/manual/how-tos/wireguard-client.html?ref=connortumbleson.com) and it worked fairly well, but knowing my setup had a few differences left me to figure it out myself. Now from someone moving from purely ISP consumer based software - this was a bit to learn.
I had some strange issues that like only the first device setup in my WireGuard worked, or when I enabled Wireguard all my non-VPN devices lost Internet. I was quickly learning the true advanced settings for configuring interfaces and routing traffic properly.
OPNsense Interfaces: Assignments
At first I created an interface for WireGuard, this just made things easier for a few reasons:
- Automatic outbound NAT rule creation
- Automatic alias generation for the tunnel
- A good clean separation of rules
So now I just needed to edit that interface to disable the configuration of IPs on it knowing that configuration would occur as Wireguard tunneled to my existing LAN.
Next I needed to open something up on the firewall itself to allow inbound connections to WireGuard server itself.
OPNsense Firewall Rules WAN: Edit
This rule is pretty easy to understand just basically says:
- Inbound connections (IPv4 or IPv6) is allowed under UDP to port 51820
- The source being anything to arrive at the "WAN address"
So now we've basically setup the routing to allow a foreign connection (provided it authorizes) to connect to our WireGuard interface. At this point, we need to create another Firewall rule that determines what can be visited.
For me, I want my VPN remotely to be able to connect to anything local as well as anything on the public Internet. This is so my browsing both at home and afar can benefit from the Pi-hole.
OPNsense Firewall Rules WG: Edit
Likewise for this rule - it is pretty easy to follow. We want:
- Any connection into WG (WireGuard) to be allowed anywhere (any)
- For IPv4 or IPv6
So now after these configurations we are ready to setup WireGuard itself. Which you can do from "Services -> VPN -> WireGuard" . This is a powerhouse of configurations allowing multiple VPNs as well as peers. You'll want to make a new connection with the following values:
- Listen Port: 51820 (*default*)
- Tunnel Address: 10.6.0.1/24 (*personal preferred range*)
- Disable Routes: true (*as it will conflict with our Pi-hole*)
The rest you may leave blank as they will be generated automatically. If you are transferring from an existing WireGuard setup - you will want to use those values instead of making new ones so existing clients aren't affected.
OPNsense: Peer Edit
One minor annoyance here is the selection of peers. You must select which peers can use that VPN connection, but they don't show up on the list until you create the peer. So a common workflow is to create a peer, head back to the local configuration and edit it to include that new device. An easily missable step that will cause some stress if missed.
Creating a new client (endpoint) is not difficult with the only real important field to note being "*Allowed IPs*". This is where you can make an option to make a real generic larger range, but then risk having to rotate it if you need to remove a device.
WireGuard Mac - Tunneling to Home
I prefer making a unique endpoint for each device and locking it to one specific IP address to inbound on. This does add a tiny bit of extra configuration steps, but then I have a good idea of how each selected client connects - think laptop, phone and work laptop.
You'll also notice from the above screenshot I manually test each device where it should grab its DNS from, which is Pi-hole. I was hoping that connecting through WireGuard and WireGuard connecting automatically within my LAN would automatically do that, but I had to explicitly spell it out.
Pi-hole Dashboard
So now my Pi-hole has traffic from my existing network (at home) and while I'm out an about. You can see my current local IP of 10.6.0.2 is tunneling lots of DNS traffic into Pi-hole.
So now I have a great setup of Pi-hole when not at home connecting through WireGuard that is setup on my OPNsense firewall.
### Hello Ghost v5
URL: https://connortumbleson.com/2022/05/30/hello-ghost-v5/
Last updated: 2025-02-04T11:42:51.000Z
A surprise a few days ago when I learned a new major version of Ghost had been released. I tend to always stay up to date with Ghost and this post and release is no exception.
Like any major Ghost version - breaking changes and major features are released. I'll recap the big points with a personal touch.
**Cards on Cards**
A card in this regard is the ability while writing a blog to call out to a number of sweet features - this may be embedding a 3rd party service, video, audio or some cool feature for quotes, headers, etc. This might be just expected in WordPress, but its cool to have a bunch more of these supported. These technically came out prior to v5, but now I have a chance to mention them.
**Membership Expansion**
The movement of Ghost is strong in the area of subscriptions, newsletters, memberships and tons of analytics surrounding it. Unfortunately for me - I don't use any of these paid features. Either way, I'm happy the dashboard automatically scopes itself to the features you have enabled now. Since you can see the difference between the v4 dashboard that was plagued with a $0 line forever vs the v5 dashboard that realizes I don't have paid features enabled.
v4 (left) / v5 (right)
**Speed Boost**
This release made some great improvements in the speed department and I'm always a fan of that. However, the speed increase also hinted at locking down the allowed database versions to MySQL8 in a future release. While I'm excited for the speed - I'm not excited for locking to MySQL8\. I figured I could continue to use MariaDB (as its a drop-in replacement), but Ghost is finding [bugs](https://github.com/TryGhost/Ghost/issues/14634?ref=connortumbleson.com) in the upstream knex project that is preventing that. So today I'm happy, but soon I'll probably have to figure out a migration strategy to migrate after from Maria.
**Theme Settings**
Themes can now register custom settings to display and configure within the admin panel. This makes the experience of configuring a theme easier when installing custom ones. This feature is probably for the best, but since my theme deploys via GitHub Actions and modified by myself - I find this introduces an extra layer of work as I cannot figure out how to default a setting to a value.
---
I was very lucky to have a quick theme author who updated [Nurui](https://themeforest.net/item/nurui-multipurpose-ghost-blog-theme/22243886?ref=connortumbleson.com) in under a day! So I just opened up Meld (diff tool) and up-streamed the changes into my private copy of the theme. This didn't take long and this blog was updated with Ghost v5 and a new compatible version of the Nurui theme.
Ghost grows massively with each major release, but the last few releases are focusing an area I don't directly benefit from. My blog is free and always will be, so all of the premium support options are a toggle I always keep off. At first I was upset about this, but then I remember I pay Ghost $0 dollars and this doesn't hurt me.
I was upset with a dashboard that was ugly in v4 for me, but now its different. I was upset about the forced CDN for the members feature, but now I can remove it. I was upset with MariaDB support breaking, but then I fixed it. This seems to be a common pattern, so I believe to prevent this going forward I'm just going to delay any upgrade to Ghost by a few solid weeks or months. I'm just exhausted from being the guinea pigs and having to fix or request a feature change that does normally get resolved a bit later.
For now, welcome to Ghost v5.
### Most of my site requests are bots
URL: https://connortumbleson.com/2022/05/23/most-of-my-site-requests-are-bots/
Last updated: 2025-02-04T11:42:52.000Z
Photo by [Alessio Ferretti](https://unsplash.com/@ilferrets?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few months ago when Halo Infinite launched - I built a new site that I've blogged about a few times related to the [disappointment of the game](https://connortumbleson.com/2022/03/14/halo-infinite-disappointing-review/) and how I wired up the [CI/CD process](https://connortumbleson.com/2022/02/21/deploying-laravel-w-github-actions/). One thing I was quite happy about with this site was the sheer popularity in comparison to previous iterations of this site.
If we look at the Halo 5 iteration of this site - I was tracking probably below 10 unique hits a day. However, I still worked on it and enjoyed building it even if no one was visiting it. The new iteration of this site though was far more popular than the previous - just looking at May 16th data I see 2,600\~ unique hits that equal 52,000\~ requests.
So while I was investigating some growth concerns - there was a few things I was tracking.
- Failed jobs database table at 3GB (what is failing so often)
- Jobs queue growing to large levels
- Images loading slow from upstream service
- Blocking "bad" bots
I easily tracked down the failed job issue, added additional queue runners for the queue and ended up wiring up an automatic image optimizer and downloader from the upstream service.
All that was left was blocking "bad" bots and I had no idea the large amount of requests these bots do.
[https://goaccess.io](https://goaccess.io/?ref=connortumbleson.com) tool
Lets look at May 16th, 2022 and look at the top 5 User Agents.
- 18,004 hits - SemrushBot (Bot)
- 5,413 hits - AhrefsBot (Bot)
- 4,832 hits - Mobile iPhone (User)
- 4,020 hits - MJ12Bot (Bot)
- 3,343 hits - Firefox (User)
So right of the gate - why does Semrush have so many hits? What could it possibly be doing that is beneficial?
[https://www.semrush.com/bot/](https://www.semrush.com/bot/?ref=connortumbleson.com)
Their website has a large list of things of why this service is needed and what it does. Every single item on this list looks to be related to a true marketing push and research one might need on a site. However, Leaf (*leafapp.co*) is a free site I make in my hobby time and I don't really need any of that.
Especially when this service just hammers my site non-stop. That led to an easy site block, so now my `robots.txt` looks a bit different.
```
User-agent: SemrushBot
Disallow: /
User-agent: MJ12bot
Disallow: /
User-agent: AhrefsBot
Disallow: /
```
So then I got curious and started looking at some of my failed hobby projects that I still host for some reason. All these bots love hammering sites that are dead! I don't get it - the cost and money to spider the website must be pretty cheap for hammering hits to websites I haven't even visited in months.
So this just led me on a hypothetical thinking pattern - folks are complaining that Twitter is all bots. I'm complaining that a good portion of my site is all spider hits. I'm just starting to wonder if a majority of web traffic is not real.
This seems plausible when Cloudflare produces blogs with graphs that help enforce this theory at a larger scale.
[https://blog.cloudflare.com/introducing-bot-analytics/](https://blog.cloudflare.com/introducing-bot-analytics/?ref=connortumbleson.com)
So bot or not - Leaf continues to be built and a few more bad bots are added to the `robots.txt`.
### July 2015 Lake Ozark Flood
URL: https://connortumbleson.com/2022/05/16/july-2015-lake-ozark-flood/
Last updated: 2025-02-04T11:42:52.000Z
[Lake of the Ozarks, from the air, Flood 2015](https://www.youtube.com/watch?v=WpUKFzRZCB8&ref=connortumbleson.com) \- Big Planet Media
On July 2nd, 2015 I drove out to Camdenton Missouri to visit the Lake of the Ozarks for July 4th. Having visiting the area many times before I tended to refer to the water as low or high based if the rocks on the seawall were visible or not. Arriving this time was the largest I'd ever seen the lake and we had already passed the point of damaging.
The attached part of the dock (the not floating part) was submerged underwater which had shorted out and killed all the power to the lifts and lights on both the swimming dock and boat dock. The raised water level over the seawall was also damaging all the soil that was not meant to be submerged causing erosion in parts of it.
Back then I thought this was insane - the water level was so high that even driving through town you could see homes that the water was touching the foundation. Our place was lucky in that we still had easily 3-5 feet in elevation left to go prior to the house.
So I did some research 7 years later. Turns out the lake prefers to stay at the dam at around 658 feet, but it could be found at 655 feet at different points in the season. So that 3 foot difference probably explains the "low" and the "high" points I remember being at.
What was lodged that day was 662 feet, a staggering 5 feet jump in the normal maximum of the lake and what I soon learned was 2 ft higher than the absolute max.
my panorama photo - July 2, 2015
I started trying to figure out why this happened when there was a dam to regulate the water level. It turns out after finding this [wonderful PDF by Ameren](https://connortumbleson.com/uploads/2022/05/lake-flood-guide-curve.pdf), I learned a good bit of history about the dam.
When the Bagnell Dam was built in 1929 - its primary purpose was electrical power generation and it could fluctuate between 630 feet and 660 feet. It started as a motto of "water in" and "water out", but this had such terrible downstream damage if the incoming water was more than the downstream could handle.
This is what led to the creation of the upstream Truman Dam, whose primary purpose was flood control instead of power generation. I'm guessing here, but I guess that is why Truman Lake is so beautiful and different - they must restrict dock building so they have the ability to swing the water level way more.
Bagnell wanted to do that and actually had the ability to do so, but it was quickly realized with the tourism that changing lake levels at extreme levels would damage all the constructed ecosystem around the lake. So tons of meetings were had that basically regulated the Bagnell Dam to stay between 645 ft as the absolute low and 660 ft as the absolute high. With a 15 feet range - contractors, regulation and buildings could work to build safe construction, but in actuality the common range ended up being 653 to 658 feet.
So I wondered how this random July 2015 matched up to the highest levels over time.
Figure #6 from [Lake Flood Guide](https://connortumbleson.com/uploads/2022/05/lake-flood-guide-curve.pdf)
What is interesting is most of the highest levels were between 1940 and 1945 - which correlates directly to World War II. As high water levels provided the maximum power generated from the generators.
If you ignore those you can see 2015 was a crazy year with both July and December having top 10 water levels. December peeked at 663 feet, an entire feet higher than July 2015\. Reading online about this has a variety of explanations.
- Global Warming.
- More industrialized cities removing flood pains.
- Natural ebb and flow of planet.
- Fault of x/y/z company.
So what exactly happened in July 2015? In short - a ton of rainfall and not just at once. The Truman and Bagnell Dam cannot make sweeping changes based on hunches of weather - this is because any change can either damage upstream or downstream. Take the estimated in July 2015 which was 1 - 3 inches of rain, but what actually happened was 9 inches.
Now you can get into immense amount of science here with understanding flood pools, stored water and balancing communication between dams. However, when rainfall continues to fall at huge amounts more than expected - bad things happen. Something had to suffer and there were many options.
- Truman holding back more water would flood additional areas.
- Truman releasing more water would add additional flooding to Bagnell.
- Bagnell holding back more water would flood docks and homes.
- Bagnell releasing too much water would flood downstream.
So we look back at July 2015 when the lake hit 662.55 feet, which is 2.5\~ feet above the absolute maximum regulated. Now not having any background in this - I'm unsure if a 1 foot rise at the dam equals a 1 foot rise everywhere, but I do know this water level was the most dangerous I've ever seen it.
Photos at our dock/area - July 2, 2015
So if I turn back the clock to July 2015 - in that instant of this insane flood. I decide to go to the dam to investigate.
It seemed some roads were closed and I could not find the best way to get closer, so I just parked at the viewing center and took a photo.
Bagnell Viewing Area - July 3rd, 2015
It was insanely loud and it was the first time I'd seen all the flood gates open. I wish I had taken more photos and or even recorded some drone photography, because I'm finding more often than not that photographing the past is worth it.
I had no idea it ended up flooding worse in December of 2015, but the place we visited was in the process of being sold - so the journey often to the Ozarks was over.
### The Unknown Future
URL: https://connortumbleson.com/2022/05/09/the-unknown-future/
Last updated: 2025-02-04T11:42:52.000Z
Photo by [Christian Lue](https://unsplash.com/@christianlue?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A bit ago when I broke the cable that gave me Android Auto, I was listening to the radio and heard a story about lead poisoning decades ago causing an increase of aggression and thus crime.
So I started researching the only thing that I remembered at the time with lead in it, which was leaded gasoline and nothing I found surprised me anymore.
"[window, living room picture window - 99 - replacement - lead paint warning sign - IMG\_3111 - (20110627)](https://www.flickr.com/photos/31355686@N00/6322411439?ref=connortumbleson.com)" by [Claire CJS](https://www.flickr.com/photos/31355686@N00?ref=connortumbleson.com) is marked with [CC BY-NC-SA 2.0](https://creativecommons.org/licenses/by-nc-sa/2.0/?ref=openverse).
For starters I found [an article](https://www.bbc.com/news/business-40593353?ref=connortumbleson.com) (*bbc.com*) that basically summarized that we knew lead was toxic for humans long before it was finally outlawed. I mean lead white paint in the 1600's were killing people and yet we still used it to push performance in engines nearly 300 years later.
My guess is these big companies started realizing that they had 2 options:
- Invest in some new option, like perhaps Ethyl additions to gasoline, with the benefit of a global farming union able to distill it from simply grain at a slightly higher cost.
- Invest in tetra-ethyl lead and build a large refinery to refine this deadly additive at cheaper prices, but invest heavily in studies to give false impressions that lead is okay to delay regulations that prevent the use of it.
So the petrol companies of the world did decide to refine tetra-ethyl lead even while workers at the "loony gas building" died of lead poisoning [quite frequently](https://www.wired.com/2013/01/looney-gas-and-lead-poisoning-a-short-sad-history/?ref=connortumbleson.com) (*wired.com*). So this led the states to an investigation - probably 10-20 folks have died at this point simply refining TEL (tetra-ethyl lead) and the use of TEL needed to be stopped.
A few states banned the use of it, which lead to a huge national research and task force to determine the public safety of TEL. Like predicted the research proved "*no danger*" as long as workers were well protected during production. This was a crucial mistake that our country made with only short term profits in mind and not worrying about the future. We probably did another 50 years of TEL before it was officially [banned](https://www.greencarreports.com/news/1133434%5Fwhy-did-the-world-use-leaded-gas-and-why-did-it-take-so-long-to-phase-out?ref=connortumbleson.com) (*greencarreports.com*) from being a gasoline additive.
In that 50 years though lead had permeated itself due to a growing population of cars and even had been put into paint on the walls! A simple blow of dust on the road while walking could hold a dangerous amount of lead on it. So we affected millions of Americans that would go on to die of [lead-induced issues](https://www.who.int/news-room/fact-sheets/detail/lead-poisoning-and-health?ref=connortumbleson.com) (*who.int*).
That is not the part that really bugs me though - do you know why the companies really stopped using TEL? Regulation came in to mandate catalytic converters as they reduced the emissions a vehicle emitted. Though, it became painfully obvious that TEL just eroded and destroyed catalytic converters. So now you have a mandated technology that is not working with a toxic technology and this is what forced companies to change - regulation.
I found a word exists for this called "[The Environment Kuznets Curve](https://www.sciencedirect.com/topics/earth-and-planetary-sciences/environmental-kuznets-curve?ref=connortumbleson.com)" which suggests that a company starts with little profit and cuts corners to get to market in a variety of unsafe ways. Once funding comes in and an elevation to economic growth then only does the environmental improvements come.
This bugs me because it took TEL nearly 80 years to get off the market when it was clear it was toxic from the beginning. So now I sit here and think about all the changes to life we have now:
- A phone near us 24 hours a day
- Bluetooth everywhere
- WiFi everywhere
- 3G / 4G / 5G everywhere
- An aging water infrastructure
- A healthcare system that wants you on medication for $$$
Is it possible there is an unfunded study and someone warning of a future to come? Or as we've seen in the past will companies simply battle with alternative research delaying in the inevitable to line the pockets with future funds.
I don't know what the future holds, but I think its clear we are moving from a world of solving problems to a world of lining share holder pockets at the risk of damaging ourselves and the planet.
### A Look into Laravel Livewire
URL: https://connortumbleson.com/2022/05/02/a-look-into-laravel-livewire/
Last updated: 2025-04-02T11:14:52.000Z
Photo by [Steve Johnson](https://unsplash.com/@steve%5Fj?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As Halo Infinite was released I knew I had to build another stat site for the game. Like most Halo stat site adventures - I had to do a different stack for the rebuild. In my memory, I had so far done:
- Halo Reach - Invision Power Board
- Halo 4 - CodeIgniter
- Halo 5 - Laravel w/ Blade
- Halo Infinite - Laravel w/ Livewire
So I started building Leaf with [Livewire](https://laravel-livewire.com/?ref=connortumbleson.com) and it was a pleasant experience that I'm still using as of this post. So I wanted to dive into all the features/functionality I used to show how I went from nothing to something extremely fast.
So the first secret with my 4th iteration of Leaf was to no longer hook the internal game's API myself. While a fun research experiment, building code to keep a constant valid session alongside a growing list of roadblocks of clearance levels and tokens was painful. When you do that - you have less time to devote to the purpose of your project which is stats. So I used [HaloDotAPI](https://autocode.com/halo/?ref=connortumbleson.com) which did just that and exposed a more friendly API for consumers.
Second, I picked a frontend framework that required no JavaScript. I did this solely out of caution that a Livewire like product might not play nice with a frontend solution that also tries to control the same aspects that Livewire would, so I settled on [Bulma](https://bulma.io/?ref=connortumbleson.com).
Finally, I pushed myself to have 100% code coverage with a good set of linters and a fully [open source project](https://github.com/iBotPeaches/LeafApp%5FInfinite?ref=connortumbleson.com) from code to pipelines for deploying and releasing.
So now that everything was ready - I dove into Livewire. I started building a simple "Add Gamertag" input box.
Livewire Validation
This had a small Blade file that was very familiar to anyone writing Blade.
```html
```
You can see in here that it looks like a normal Blade file with a few different things.
- The `form` tag has `wire.submit.prevent`, which instructs Livewire to basically prevent form submission on submit and instead execute `submit` on the corresponding PHP class.
- The `input` has `wire:model="gamertag"` which binds the value entered into the `public $gamertag` value on the PHP class.
- The `` tag has `wire:loading` so it only appears while an in flight network request is ongoing.
So then we can look at the corresponding PHP class.
```php
class AddGamerForm extends Component
{
public $gamertag;
protected array $rules = [
'gamertag' => [
'required',
'min:1',
'max:32'
]
];
public function submit(): ?Redirector
{
$this->validate();
$player = Player::fromGamertag($this->gamertag);
if ($player->exists) {
return $this->redirectPlayer($player);
}
$this->validate([
'gamertag' => [
new ValidInfiniteAccount()
]
]);
$player = Player::fromGamertag($this->gamertag);
return $this->redirectPlayer($player);
}
public function render(): View
{
return view('livewire.add-gamer-form');
}
private function redirectPlayer(Player $player): Redirector
{
return redirect()->route('player', [$player]);
}
}
```
You can see above the following in this PHP class.
- We leverage the "[rules](https://laravel-livewire.com/docs/2.x/input-validation?ref=connortumbleson.com)" functionality of Livewire to validate input.
- If it validates, we first check if we know this gamertag otherwise falling back to looking them up.
- We instruct Livewire which file to render.
I then have a fully interactive search box with validation and more without writing a single line of JavaScript.
Now I wanted to start figuring out how to paginate without full page refreshes. Livewire once again had a [section dedicated](https://laravel-livewire.com/docs/2.x/pagination?ref=connortumbleson.com) to pagination which made this as easy as plain Laravel.
Livewire Pagination
Moving between pages felt slick and fast and it seemed like I could even excel it further with cursor based pagination, but the URL with cursor based pagination didn't look as friendly as say `/page/17` of game history.
This made the component PHP wise for Livewire very small and easy to understand.
```php
class GameHistoryTable extends Component
{
use WithPagination;
public Player $player;
public function paginationView(): string
{
return 'pagination::bulma';
}
public function render(): View
{
return view('livewire.game-history-table', [
'games' => $this->player
->games()
->with(['playlist', 'map', 'category'])
->orderByDesc('occurred_at')
->paginate(16)
]);
}
}
```
All I needed to add was a trait - `WithPagination` and optionally I added a `paginationView` function so I could overload which pagination interface was drawn. I needed to do this to build a Bulma compatible pagination since it wasn't a supported default in Laravel.
So now I had a pretty slick working site, but refreshing data was the next challenge. I wanted visitors to immediately be able to view information quickly with the power of server side rendering. However, I also wanted to immediately trigger a background update of stats and immediately refresh the screen once that updated information arrived.
Livewire "Refresh"
So I built a page setup that is full of Livewire components. It we look at the above animation and associated Blade template - it looks roughly like:
```html
```
It uses `wire:init` which is another cool Livewire feature called [Defer Loading](https://laravel-livewire.com/docs/2.x/defer-loading?ref=connortumbleson.com), so you can call a PHP function after the frontend portion of the component has completed loading.
So once the page loads, I emit an request to run `processUpdate` on the PHP class. This is a simple function that toggles a class variable on the `render` function. This is what Livewire uses to render the component initially and every time it updates.
However, I hit an issue that the component that was detecting updated stats was not the component that was drawing the stats.
Thankfully, Livewire has an "emit" function that allows us to pass messages between components and Livewire even offers a special "$refresh" event that instructs that component to refresh itself.
```php
$this->emitTo(GameHistoryTable::class, '$refresh');
```
We just ask the component to update itself once we know we've updated the underlying data source.
So now the site was working quite well and I was off to get 100% test coverage. So I can test Livewire in both isolation and as a unit.
Take this first example as a more integration level test.
```php
// Tests/Feature/Jobs/GamePageTest.php
public function testLoadingGamePageWithUnpulledGame(): void
{
// Arrange
$game = Game::factory()->createOne([
'was_pulled' => false
]);
// Act
$response = $this->get('/game/' . $game->uuid);
// Assert
$response->assertStatus(Response::HTTP_OK);
$response->assertSeeLivewire('game-page');
$response->assertSeeLivewire('update-game-panel');
}
```
At this point I'm just rendering the page to be sure nothing is crashing. The existence of these Livewire components is good enough that the page itself is rendering.
Now I can take those components individually and test them in isolation. Take the Overview page which is the animated image shown above.
```php
public function testValidResponses(array $attributes): void
{
// Arrange
$player = Player::factory()
->has(ServiceRecord::factory()->state($attributes))
->createOne();
// Act & Assert
Livewire::test(OverviewPage::class, [
'player' => $player
])
->assertViewHas('serviceRecord')
->assertSee('Quick Peek')
->assertSee('Overall')
->assertSee('Types of Kills')
->assertSee('Other')
// ...
->assertSee($serviceRecord->kd);
}
```
We can now test that component and all the data it renders out just like we would in Blade testing. This is powerful because my integration tests don't have to worry about the internal workings of each Livewire component and instead each component can be tested in isolation with a variety of inputs to account for all code paths. This ease when coming to testing for both Laravel and Livewire just makes the developer experience great when working with it.
Now [Leaf](https://github.com/iBotPeaches/LeafApp%5FInfinite?ref=connortumbleson.com) is approaching 1000 commits and still has 100% coverage with Laravel Livewire. If I start a new project and the purpose merits it - I'll probably use Livewire again.
### Setting up Nzyme
URL: https://connortumbleson.com/2022/04/25/setting-up-nzyme/
Last updated: 2025-05-09T14:32:13.000Z
[nzyme home](https://www.nzyme.org/?ref=connortumbleson.com)
A couple months ago I was at a talk when I learned about a piece of software that is common in home labs. I listened to a [talk](https://t.co/FCDsLU2LZS?ref=connortumbleson.com) by Vodkanaut and he demoed Nzyme and it looked quite interesting, so I spent some time setting up the project as well.
The project in short is a forensic piece of software for WiFi networks. It can log frames and compare to signatures and patterns to provide a constant source of updates of the state of your wireless network. It was built by [Lennart Koopmann](https://github.com/lennartkoopmann/nzyme?ref=connortumbleson.com) who was the name behind Graylog2.
The documentation on the project website [guides you through](https://www.nzyme.org/docs/installation-configuration/install-raspberry-pi-os?ref=connortumbleson.com) the installation and you can follow that without an issue. So I decided to buy a new Raspberry Pi 4 and a [Panda Wireless PAU09 N600](https://amzn.to/3Oq8NIW?ref=connortumbleson.com) \- this is [one of the devices](https://www.nzyme.org/docs/installation-configuration/requirements?ref=connortumbleson.com#required-one-or-more-wifi-adapters-that-support-monitor-mode-on-your-operating-system) that is recommended as being able to support monitor mode and working with the project.
One thing I encountered that I highly recommend doing is setting up [predictable interface names](https://www.nzyme.org/docs/installation-configuration/predictable-interfaces?ref=connortumbleson.com). As described, this moves things like `wlan0` to something consistent for that device like `wlp1s0u1u2`. This helps so you can ensure you are talking to the right adapter that supports monitor mode vs the inline wireless that is common on most Pi's.
```
wlan0 IEEE 802.11 ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=31 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
wlp1s0u1u2 IEEE 802.11 Mode:Monitor Frequency:2.484 GHz Tx-Power=20 dBm
Retry short long limit:2 RTS thr:off Fragment thr:off
Power Management:off
```
As the documentation suggests, you may run into some problems having `libpcap` automatically configure monitor mode like I did. This means I manually configured my device to keep it in monitor mode, then told nzyme to not worry about it.
```json
802_11_monitors: [
{
# The 802.11/WiFi adapter name. (from `ifconfig` or `ip link`)
device: wlp1s0u1u2
# WiFi interface and 802.11 channels to use. Nzyme will cycle your network adapters through these channels.
# Consider local legal requirements and regulations.
# See also: https://en.wikipedia.org/wiki/List_of_WLAN_channels
channels: [1,2,3,4,5,6,7,8,9,10,11,12,13,14,36,38,40,42,44,46,48,50,52,54,56,58,60,62,64,100,102,104]
# There is no way for nzyme to configure your wifi interface directly. We are using direct operating system commands to
# configure the adapter. Examples for Linux are in the documentation.
channel_hop_command: "sudo /sbin/iwconfig {interface} channel {channel}"
# Channel hop interval in seconds. Leave at default if you don't know what this is.
channel_hop_interval: 1
# Time this monitor can remain without recording any frames until it is marked as failing. Under certain conditions,
# it can be normal to not record any frames for an extended period of time. If you receive warnings and alerts for
# failed probes when there were simply no frames to record, increase this value. Default: 60
max_idle_time_seconds: 60
# Skip the automatic monitor mode configuration of this interface. Only enable this if for some reason libpcap can't
# properly configure this interface into monitor mode. In that case, you can try to set it manually instead.
skip_enable_monitor: true
}
]
```
`/etc/nzyme/nzyme.conf`
So knowing that the automatic configuration of `libpcap` wasn't quite working, I leveraged a network config file at the system level and then set `skip_enable_monitor` above to `true`.
```shell
root@raspberrypi:/home/pi# cat /etc/network/interfaces.d/wlp1s0u1u2
auto wlp1s0u1u2
iface wlp1s0u1u2 inet manual
wireless-mode monitor
```
These changes paired together got my external adapter in monitor mode, surviving reboots and booting up with nzyme successfully.
So now it was time to setup a nightly email to send me a report of my network.
Weekly nzyme Tactical Summary
So I get a cool email that shows me:
- Alert count
- Health check
- Status of all networks seen in past 24 hours
- Any new networks
- Any new alert/tracker detected
Now nzyme even shines when you decide to monitor a network, so I monitor my home network (`xb0x`).
/network/show page in nzyme
This is probably more paranoia than anything, but I can really see into my network to see if anyone else is attempting to deauth me and/or replicate my network with a spoofed one.
On top of specifically monitoring a network - I can globally listen to a growing list of signatures that recognize unique devices. This would basically be devices built by HAK5 or a [Pwnagotchi](https://connortumbleson.com/2022/02/07/the-pwnagotchi/).
So I turned on my Pwnagotchi and waited a few moments until it popped up as an active alert (`PWNAGOTCHI_ADVERTISEMENT`) in nzyme.
nzyme - pwnagotchi alarm
So now I have a cool little peace of mind if anyone is trying some clever network attacks near my home network.
The project is [open source](https://github.com/lennartkoopmann/nzyme?ref=connortumbleson.com) and looks to be growing with a new major UI refresh designed as "2.0.0". The current version I'm running is 1.2.2 so I'm excited to see what a refreshed interface looks like.
### Cults on Cults
URL: https://connortumbleson.com/2022/04/18/cults-on-cults/
Last updated: 2025-02-04T11:42:53.000Z
Photo by [ALEXANDRE LALLEMAND](https://unsplash.com/@alexandrelallemand?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
In the early 1950s Jim Jones started a new religious organization that really aimed to connect bits of Christianity with communist and socialist ideologies. Only a couple thousand of folks ever joined this movement, but probably are aware what happened roughly 30 years later in Guyana. I blogged about [the Peoples Temple](https://connortumbleson.com/2020/02/10/the-peoples-temple/) prior as I find it extremely interesting and sad.
For those unaware, Jim Jones claiming of a vision of cities destroyed via nuclear war - the only option was to relocate to a safe area of Brazil. However, as he scouted in Brazil burning funds - it was clear the organization back home was crippling without his presence.
He ended up returning home to restore the organization and it moved into California growing and eerily exhibiting cult-like behavior. Deflectors would be tracked and huge amounts of money would be raised and left to the leaders. So among this huge spiritual and political movement in the states - Jim Jones decided to move the cult into Jonestown, Guyana.
The Jonestown Institute, [jonestown.sdsu.edu](http://jonestown.sdsu.edu/?ref=connortumbleson.com)
Roughly 900 members lived in the cheap land with him, but the claims of abuse started rising. This led to a congressman going to visit and investigate. It turned out to be true and many members wanted to deflect and leave with him. Sadly as they left with the congressman - the cult tracked them down and gunned them all down at the airport.
They were gunned down on November 18, 1978 which was the day that Jim Jones advised the entire congregation to drink a fruity drink laced with cyanide. This was perhaps the largest loss of American life intentionally at 918 people until the sad hijackings of 9/11.
---
Another group that reminds me of the cult label is the 3HO movement which was the Happy, Healthy, Holy Organization. It was pieces of Hinduism with Sikh which led to folks practicing an insane amount of Kundalini yoga - while dressing in turbans and all white clothes.
The leader was Yogi Bhajan and while no mass suicide occurred - it was quickly learned after his death via [an extensive report](https://connortumbleson.com/uploads/2022/04/olive-branch-investigation.pdf) that the movement was corrupt for financial and sexual reasons. Yogi would attract followers and arrange marriages - taking the kids from those marriages and deport them to India for brainwashing. As they aged and returned to the states - instead of school they would be promoted to staff alongside Yogi Bhajan which would of course lead to rape.
[The Dark Empire of Yogi Bhajan - VICE](https://www.youtube.com/watch?v=nfr5jKauwtE&ref=connortumbleson.com)
The financial front was ripe with abuse. Imagine a follower that started a new Ashram (teach yoga and live together with followers). Yogi convinced folks to put these expansions under the organization to help with taxes, but it more-so just helped keep the financial control under him.
---
Another group that I think earns the cult name is the Branch Davidians that most remember as the siege of Waco in 1993\. An interesting group that really split (or rather continued) the Seventh-day Adventist to the extreme.
David Koresh, who was actually born as Mr. Howell moved into the compound a some 15\~ years prior to running it. He engaged in an affair with a 60 year old lady while in his 20s. Once she died some of the power of the group was then split between Koresh and the existing leader Roden. Those leaders fought and we saw the first take that Koresh had a dark side - his group raided the compound with a large amount of weapons to find proof of Roden's illegal doing.
Once Roden murdered a follower for being convinced he was a true messiah he was judged insane and removed from the property. Mr. Howell then renamed to David Koresh to show his ties to King David and run the group as well as property.
Of course like our pattern of cults. Koresh was part of many sexual assaults with his belief that he needed to raise 24 children to elders to prepare for the Second Coming (the return of Jesus). These claims then paired with the fact that group was hoarding a huge amount of illegal weapons is what led to the eventual standoff with ATF.
By Federal Bureau of investigation - Branch Davidian investigator shared FBI photos
So on February 28, 1993 when a search warrant was attempted to be executed. A standoff occurred and it went terribly - 51 days went by basically ending with a huge fire on the compound killing 86 total. Once the dust settled and investigators moved in, the cache of weapons was insane. Hundreds of illegal high powered weapons were discovered - these were collected as the group referred to themselves as "students of the [Seven Seals](https://en.wikipedia.org/wiki/Seven%5Fseals?ref=connortumbleson.com)" and needed to prepare defensively for the Apocalypse.
---
Another cult group that rose up during the rush of religious movements in the 60s and 70s was Heaven's Gate. This group is quite interesting as they believed their human shells were nothing but holding them back from ascending into heaven to evolve into basically aliens.
[https://www.heavensgate.com](https://www.heavensgate.com/?ref=connortumbleson.com)
This was started by Bonnie Nettles alongside Marshall Applewhite who took his childhood of religion and his experience in the military to dig into prophecies. Once Nettles died there was no rejecting opinion from the views of Applewhite.
So the group started growing including the creation of media that was used for recruiting purposes. Shortly after the group focused onto the approach of the [Comet Hale-Bopp](https://en.wikipedia.org/wiki/Comet%5FHale%E2%80%93Bopp?ref=connortumbleson.com) and this is where odd things began.
The group fully expected the Comet to bring a spaceship. This ship would be a vessel for their spirits to take them on a journey to another planet. The only way to get onto the vessel was to communicate suicide on this world.
This mass suicide was eerie. Videos were recorded for farewell statements and one by one followers would take a concoction and suffocate themselves with a bag. As they died the remaining followers would clean up the body and place it face down on a bed.
0:00
/
1×
You can also watch the final video that Applewhite recorded explaining the reason behind the upcoming suicide. Odd to watch and listen knowing what happened shortly after.
---
The final cult I want to cover is UNICULT which is such an interesting modern cult. Started by a young millennial named Nicole after she was rescued from a suicide attempt via her dad. This large event woke her up mentally and she now believes she is a star seed on this planet.
She founded a cult in which other similarly aged members were attracted to it and this is where the cult is massively different than others. UNICULT allows followers to pluck teachings they agree with and ignore the others. So if you don't believe in aliens that is okay - you can just follow the light/darkness teaching.
All in all, this group seems like its harming no one at present. They attract a group of people that want to work with others to remove barriers in their own life and I see nothing wrong with that. You can join for only $11 like 3,147 others - though as the leader and followers age will this obviously younger cult survive the test of time?
---
In closing, my mind is continually blown with the [rise and fall of cults](https://connortumbleson.com/2020/02/03/fear-is-a-currency/) and how some have some terrible impact yet survive and how others convince hundreds to kill themselves. The only thing that would blow my mind further is if one of the teachings is true and we happen to be sharing a planet with a 900ft lizard.
### Infection of Greed
URL: https://connortumbleson.com/2022/04/11/infection-of-greed/
Last updated: 2025-02-04T11:42:54.000Z
Photo by [Gabriel Meinert](https://unsplash.com/@gabriel%5Fmeinert?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few months ago a new Halo game dropped that I'd been waiting on for a solid few years. Since if you started playing Halo on the original Xbox each time a new Halo game is released means a chance to play an amazing series.
However, a few weeks in it was [clear this game](https://connortumbleson.com/2022/03/14/halo-infinite-disappointing-review/) was rushed despite delayed and filled with changes that was meant to fill the pocket vs keep the consumer happy. I wish this was an isolated incident, but it happens over and over again. So lets turn back the clock and look at a bunch of situations over the years.
---
I'm guessing way back in the early automobile era there hit a point where folks that wanted a car - owned a car. How can a car company make money if they build excellent products that take decades to break?
I don't think you can say the original Model A from Ford was amazing, but products were initially built to last and be great. Now chances are if you purchase something a meeting of folks probably sat and debated one of the following:
- **Durability** \- If we build something that is cheaper, we make more money and it breaks after a few years and we can sell more. We just have to balance it properly so our product isn't too breakable.
- **Anti-Repair** \- If we build something great and locked down, tinkers cannot fix it if it breaks. They'll be forced to buy a new one.
- **Non-removable batteries -** If the battery cannot be replaced and it slowly loses power over time. At some point the product needs an official repair or a replacement.
- **Intentional Replacement -** A yearly game? A yearly edition of a school book? A new design on top of the same product? Anything between a fashion cycle or school schedule to force the hand of buying another.
- **Technology Replacement** \- Maybe intentional or an ecosystem movement. We expect to replace serial ports, but switching between Lighting, Thunderbolt and USB could be used to require purchases of adapters and sell more.
- **Relying on Patches** \- Lets sell something broken and patch it based on the highest priority discovered issues. This will allow us to make money sooner and work on a new paid version.
- **Intentional Breaking** \- Lets intentionally slow down our software on older devices to persuade folks to upgrade to the newest and greatest.
- **Intentional Lock-down** \- If the fridge doesn't have Internet, lets prevent changing the settings. This keeps our user base enticed to give us analytics since they will setup the connection to tweak settings.
- **Legal -** Lets use a product that we know is cheaper and causes an environmental hazard. At some point the government will block these products and we will have a safer newer product released at that time.
- **Advertisers -** Lets sell as much data as we can collect from our users to 3rd parties. We can make a ton of money paired with the information we collect as part of our business.
A fun exercise to imagine all the ways things are diminished to make more money.
---
Though, I don't think you can fully say greed is bad - its just understandable that our culture thrives on money and the more you make the more your morals go out the window. We've seen this with Chrome extensions that authors break at some [price point](https://connortumbleson.com/2022/01/24/open-source-money/) for greed.
I'm just getting upset with software, products and services that are continually letting me down. I want to believe this is all corporate greed, but maybe things are getting more difficult and consumers less patient. I have to remember that 100 years ago electricity wasn't even in half of US homes.
50 years ago the Internet was hardly invented yet. 20 years ago 3G cell service didn't exist. Perhaps the original video game of Donkey Kong on 1 console and 4MB of RAM was a bit more simpler than developing against thousands of PCs and gigabytes of space.
Though I always like to remember Boeing - a company that took the United States into the skies. Amazing reliability engineers and staff that probably contributed to 30,000+ jobs. At one point though a merge occurred with another company. The cultures clashed and the corporate profit driven suits continued to win. We all know how that story ends with [737 Max crashes](https://en.wikipedia.org/wiki/Boeing%5F737%5FMAX%5Fgroundings?ref=connortumbleson.com).
I just like to think about Boeing a lot. Do you ever have enough profits that you don't need to grow a certain percent each year? Probably not as investors demand those profit increases to turn a buck. Though, now we see a company that lost so much trust with the crashes of the 737 Max.
It took a new CEO and Boeing was turning it around with a new [777X](https://en.wikipedia.org/wiki/Boeing%5F777X?ref=connortumbleson.com). Until that plane had an incident during testing and it was delayed for 2 more years.
I'm still in the belief that greed leads to all these issues.
### Anarchy
URL: https://connortumbleson.com/2022/04/04/anarchy/
Last updated: 2025-02-04T11:42:54.000Z
One morning driving to work I noticed a few stoplights were no longer working. I still don't exactly understand how they work under the hood, because some lights along this journey were between blinking yellow, blinking red or completely off.
I imagine that mess is a mix between loss of power and loss of communication falling into some protection mode to prevent collisions.
What I immediately noticed is that without a higher authority (the light) to enforce something a random collection of citizens have no ability to work together. The light pictured above was a pure nightmare to be at. I witnessed so many events:
- Folks beyond nervous to enter intersection upsetting everyone behind them.
- Folks not caring the light was busted, seeing the yellow light and just rolling through hoping for the best.
- Folks entering intersection, getting blocked and then further blocking intersections.
- Folks realizing they can just drive however they want to make it through the intersection blocking everything and anyone so they can pass.
- Folks always deferring to another driver - thus never getting space to go.
So when I see a police officer directing traffic at a similar situation - I fully understand why this happens now.
I can't imagine a situation where the power just goes out city wide for days. It has happened before during hurricanes, but there is a fraction of the people in the city that should normally be there so it isn't comparable. I don't think folks could function without the critical infrastructure that keeps a city moving especially in the transportation department.
Lets take another critical industry: water.
[https://www.nytimes.com/2021/02/08/us/oldsmar-florida-water-supply-hack.html](https://www.nytimes.com/2021/02/08/us/oldsmar-florida-water-supply-hack.html?ref=connortumbleson.com)
This got to national news, because hacking had moved into the critical systems that millions depend on to drink clean water.
I wish I could dig into the actual hack, but like most stories that involve the government all the details were hidden. I do want to talk about what happened during this event as I lived not more than 4 minutes from this water plant.
Grocery stores were drained of all types of water within the day. I'm not quite sure why everyone panicked to the point to do that, when it was being made clear that numerous safety systems caught any change prior to it being a danger.
However, it proved that in situations where fear sets in folks may act irrationally. I can almost guess the person filling their car with 10 racks of water was the same person who bought hundreds of toilet paper during the initial COVID "stay at home" order.
---
So if we get back to anarchy - from each little event we have I lose further faith in our society to be able to go on without the infrastructure that keeps folks moving along.
We could even look at traffic where a simple accident can lead to a 20 minute delay, since folks can't seem to work together to form a zipper merge. By chance every other car has to floor it all the way up to the accident and force their way into traffic at the cost of blocking traffic for everyone else.
So maybe movies have it right - in a world where our infrastructure is attacked folks would probably either bunker or rush stores for supplies. Without a working credit card network things would move to "cash is king" or theft.
Traffic would have an huge amount of accidents which I imagine the police force would be at a minimum to support due to their own families to support in this imagined world.
Here is to hoping our world doesn't turn to that.
### Pi-hole: 4 years later
URL: https://connortumbleson.com/2022/03/28/pi-hole-4-years-later/
Last updated: 2025-02-04T11:42:54.000Z
Pi-hole "Chronometer" feature - `pihole -c`
In 2017 I installed a Pi-hole into my network and routed all my internet traffic through it. Today is now March 27, 2022 and I've been running it ever since.
My [last post](https://connortumbleson.com/2021/07/12/pivpn-pihole/) about this went into detail about the PiVPN integration I did to support VPN access via Wireguard. That has since been removed and added into my OPNsense firewall directly. I then additionally followed this [wonderful tutorial](https://pi-hole.net/blog/2021/09/30/pi-hole-and-opnsense/?ref=connortumbleson.com) to use my existing Pi-hole setup with OPNsense.
The long-term data solution I built is still going strong with all extracted data being removed from the Pi-hole to keep it lean. This is of course less of a concern now, because the HDD on the Raspberry Pi was upgraded from 6GB to 28GB usable space.
The Pi-hole software has also jumped with releases from 5.5 to 5.11, so we have a few versions to recap.
- **5.6** \- [Upgraded dnsmasq, show DNSSEC queries and bug fixes](https://pi-hole.net/blog/2021/09/11/pi-hole-ftl-v5-9-web-v5-6-and-core-v5-4-released/?ref=connortumbleson.com)
- **5.7** \- [Correctly proxy iCloud Private Relay and upgrade fixes.](https://pi-hole.net/blog/2021/09/11/pi-hole-ftl-v5-9-web-v5-6-and-core-v5-4-released/?ref=connortumbleson.com)
- **5.8** \- [Fix FTL issues with CNAME inspection and rate limiting.](https://pi-hole.net/blog/2021/10/23/pi-hole-ftl-v5-11-web-v5-8-and-core-v5-6-released/?ref=connortumbleson.com)
- **5.9** \- [Upgrade dnsmasq and Gravity DB handling improvements.](https://pi-hole.net/blog/2021/12/22/pi-hole-ftl-v5-12-web-v5-9-and-core-v5-7-released/?ref=connortumbleson.com#page-content)
- **5.10** \- [Cleanup UI appearance for menus and update sqlite.](https://pi-hole.net/blog/2022/01/05/pi-hole-ftl-v5-13-web-v5-10-and-core-v5-8-released/?ref=connortumbleson.com#page-content)
- **5.11** \- [Enable history for SQLite, optimize web with animations.](https://pi-hole.net/blog/2022/02/12/pi-hole-ftl-v5-14-web-v5-11-and-core-v5-9-released/?ref=connortumbleson.com#page-content)
We saw these release notes give a more automatic dump of changes from the variety of repositories that produce Pi-hole. This makes it slightly more difficult to find the key points of each release, but helped find each contributor and change that made up a release.
v5.11 Pi-hole Dashboard
The dashboard has gotten a face-lift in a few areas and eagle-eyed users would notice my amount of clients has gone up by about 7 and the percent blocked is now roughly 8% instead of 3%. I think this is an extremely interesting that the amount of traffic I send now is 5% heavier in terms of blocked requests than last year.
So lets dig into the top 15 blocked and allowed requests to see what led to that. This time looking at 40,997,056 requests over the last 1,002 days of long-term data collection.
**Top 15 Blocked**
| Domain | Count |
| ------------------------------------------ | ------- |
| 806c4c48-1715-4220-054f-909f83563938.local | 803,900 |
| e7bf16b0-65ae-2f4e-0a6a-bcbe7b543c73.local | 638,460 |
| 1d95ffae-4388-9fbc-1646-b2b637cecb64.local | 432,008 |
| ssl.google-analytics.com | 376,072 |
| 68c40e5d-4310-def5-a1c3-20640e1cd583.local | 247,892 |
| app-measurement.com | 240,059 |
| watson.telemetry.microsoft.com | 217,743 |
| googleads.g.doubleclick.net | 86,068 |
| settings-win.data.microsoft.com | 71,150 |
| www.googleadservices.com | 62,394 |
| mobile.pipe.aria.microsoft.com | 47,379 |
| sb.scorecardresearch.com | 46,057 |
| sessions.bugsnag.com | 43,222 |
| reports.crashlytics.com | 39,801 |
| secure-dcr.imrworldwide.com | 36,533 |
**Top 15 Allowed**
| Domain | Count |
| ------------------------------------------ | --------- |
| e7bf16b0-65ae-2f4e-0a6a-bcbe7b543c73.local | 5,631,937 |
| 68c40e5d-4310-def5-a1c3-20640e1cd583.local | 5,305,150 |
| 1d95ffae-4388-9fbc-1646-b2b637cecb64.local | 4,898,205 |
| localhost | 3,518,671 |
| 806c4c48-1715-4220-054f-909f83563938.local | 1,342,386 |
| b.canaryis.com | 1,110,838 |
| pistats.ibotpeaches.com | 588,559 |
| api-global.netflix.com | 376,112 |
| clients4.google.com | 350,257 |
| cdn-0.nflximg.com | 322,484 |
| nrdp.prod.ftl.netflix.com | 318,632 |
| ssl.gstatic.com | 318,514 |
| play.google.com | 307,227 |
| ichnaea.netflix.com | 278,804 |
| www.google.com | 271,109 |
Right out of the gate you can see the snafu of `.local` domain multicast spamming that plagued nearly 17 million requests since the release of [Big Sur](https://connortumbleson.com/2021/04/26/pihole-3years-later/). I've since turned my local TLD to `pihole` so each device gets named like such and works around that issue that was caused by using `.local`.
This is easily more seen if I screenshot the last few requests through the system.
So you can see the devices using the new `.pihole` TLD, as well as switching to DNS servers that use DNSSEC. I haven't perfected this process yet, but I'm just now starting the switch to slowly move to secured only DNS requests.
If you look at the blocked requests above, it looks roughly like I expect:
- Google Analytics
- Microsoft Telemetry
- Google Ads
- Nielsen Tracking
- Application Session/Error Tracking
Though, I do notice a new domain climbing extremely fast to the top 15\. It has lodged 31,000 blocked calls and only started 3 months ago. That is roughly 10k blocked calls a month and is `us-tracking.nextdoor.com`. Which matches exactly to when I installed the Nextdoor application.
I'm glad I have a Pi-hole, because I'm going to dig into what that endpoint is sending for a future blog. I am noticing my upstream data collection is about 2 weeks behind so might have to dig into a way to let that catch up.
Either way, another year running Pi-hole and no complaints. Pass on a donation to the [Pi-hole](https://pi-hole.net/?ref=connortumbleson.com) team if you appreciate what they are doing.
### The Homelab - Part 2
URL: https://connortumbleson.com/2022/03/21/the-homelab-part2/
Last updated: 2025-03-01T22:08:58.000Z
Photo by [Lars Kienle](https://unsplash.com/@larskienle?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As we ended [Part 1](https://connortumbleson.com/2022/03/07/the-homelab-part-1/) of the home lab, I knew what I wanted to do but the equipment had not arrived.
When the firewall arrived (TLSense), I loaded the equipment into the rack and it looked like this:
Pictured above is:
- A [Pi-hole](https://pi-hole.net/?ref=connortumbleson.com) (Raspberry Pi 3B)
- [Nzyme](https://www.nzyme.org/?ref=connortumbleson.com) (Raspberry Pi 4 - 4GB)
- [TLSense 8550U](https://teklager.se/en/products/routers/tlsense-i7-8550U?ref=connortumbleson.com) (OPNSense)
- Google Wifi (Mesh)
- TP-Link 5 Port
- A week fan system
- 1U Power
Immediately some issues were discovered or rather learned by myself.
- The firewall treats each port as a different interface, if you set it into bridge mode to basically treat each non-WAN port as a LAN port - then you run out of interfaces to setup Wireguard.
- So I needed a switch to basically only leverage WAN/LAN on the firewall, so I used my existing 5 port switch for that
- Google Wifi wants to be the DHCP server so if you force it into bridge mode - you lose the "mesh" feature.
- Providing power to 2 PI's had two power adapters strewn around
So I took a break and decided to rotate out the consumer grade hardware (Google Wifi) for some Ubiquiti access points.
This would require running more cable through the attic from my office in order to drop the Ethernet line needed for each point. The next problem was powering those access points which required a PoE cable. None of my switches or technology could do PoE and I did not want to have PoE injectors required.
So some more equipment arrived.
Unfortunately, it appears I rushed this and quickly learned a few things.
- Raspberry Pi's cannot do PoE without an extra part ([A PoE hat](https://www.canakit.com/raspberry-pi-poe-hat.html?ref=connortumbleson.com))
- Unifi technology requires a "console" for configuring
I ended up installing the Ubiquiti console onto the newer Raspberry Pi and it didn't work due to Debian Bullseye and MongoDB. So I installed it on my older Pi which ran my DNS and it slowed that system down to quite a halt.
So I did some slower research this time and purchased a CloudKey and a few PoE hats for the Pis. While discussing all these mistakes I was also donated an old 8 port Ubiquiti switch that was rotated out of a business for a higher port device.
So now things were starting to take shape. The Google Wifi was all cleanly packed back up and being sold on Craigslist. The 2 Ubiquiti access points were placed around the house and wired up via the PoE ports on the switch.
The CloudKey was loaded onto the rack and powered via PoE from the switch.
Outside of the organization and wires being incredibly ugly - stuff was at least working. Since the PoE hats have not arrived, I'm still withholding the final cleanup of hiding all wires into wire molds and remaking cables to be perfect length.
It was amazing to see the topology feature of Unifi that automatically loaded up my network.
It was really cool to see devices come back online as my Internet setup grew. Yes, I have a lot of technology that is connected. It seems the Hue lights paired with the smart appliances and few Nest items add to a large amount of wireless devices.
So now I only have a few remaining items:
- Convert Pi's to PoE
- Get Internet to my "Xbox hacking station"
- Wire-mold the wires strewn around my office
- Organize the cage
At least all the technology is working now so we can take a look at some dashboards.
Nzyme, Pi-hole, OPNSense & Unifi Overview
I'll be back with a Part 3 when everything is cleaned up and I'm more proud to show off my basic cage setup. For now, we will have some unorganized wires while we wait on the final delivery.
### The disappointment of Halo Infinite
URL: https://connortumbleson.com/2022/03/14/halo-infinite-disappointing-review/
Last updated: 2025-02-04T11:42:55.000Z
Photo by [Erik Mclean](https://unsplash.com/@introspectivedsgn?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On November 15, 2021 on the 20th anniversary of Xbox - Halo Infinite Open Beta dropped. It launched with multiplayer and it was free!
On December 8, 2021 it officially lost the "Open Beta" tag and campaign launched for $60 price tag so I want to dig into the experience and review from a Halo player that has played ever single major Halo since the beginning.
---
**Maps**
On release day, Halo Infinite launched with 10 maps which is pretty close to the base limit that most Halo games launched with. However, lets talk about that 3 of them were specifically for Big Team Battle.
One of the other maps then (Launch Site) was not in competitive so that left us with 6 maps. However, a few weeks into the game one map from that pool was removed entirely from competitive (Behemoth) for being absolutely hated. Spawns were disgusting in it, so it took between 3-4 sets of team kills before pulling a flag in objective was feasible. So now we are at 5 maps for competitive play - which becomes quite boring.
So I find with my luck that a few days of playing between work and writing this blog, I play on only 3/5 of the 4v4 maps and only 1/3 of the 12v12 maps. This is of course luck of the draw, but just leads to aggravation - I don't want to play the same map especially not 3 times in a row.
---
**Free to Play**
This model has become quite popular over the years where anyone can obtain the game for free. In app purchases exist for cosmetic items of all sorts - in Halo this becomes like colors, AI sounds, emblems, armor, etc.
These items can be obtained one of two ways presently:
- Unlocking them via the Battle Pass
- Buying them
For most games this is a classic behavior that you don't have to buy anything and can simply play to unlock items. For Halo Infinite on release that was NOT the case. Folks were beyond upset that you could play hours of the game winning and receive zero XP. This is because XP was isolated to only a pool of limited challenges which could require you to be in a specific playlist.
So then imagine once you finally unlock a new level and you get a reward and chances are you get a "*challenge swap*". A literal reward that allows you to swap your challenge to something else in case you don't want to play the random rolled challenges given.
I'm not honestly sure how this left the 343 office without being forced by some executive on the promise of more financial engagement, so lets look how quickly changes were made to please an upset user base.
- ([+2 days](https://twitter.com/HaloSupport/status/1461369370303598598?ref=connortumbleson.com)) 343 adds +50XP per game, boosts last 1 hour vs 30min
- ([+15 days](https://twitter.com/HaloSupport/status/1465753149151481858?ref=connortumbleson.com)) 343 changes XP, 1st game +300XP, 2-3rd game +100XP, then 3-6th match +100XP, then +50XP for all others
- ([+29 days](https://twitter.com/HaloSupport/status/1470816613599305735?ref=connortumbleson.com)) 343 removes odd challenges and introduces easier challenges.
I just can't figure out how anyone thought playing the game and winning and doing amazing resulted in 0XP on release day. What happened to the older Halo's of progression? How is this better? I'm just constantly at a loss of understanding.
---
**Crashes & Regressions**
Imagine this - you are playing the game and it just crashes out. You lose experience and you upset the experience for every other teammate. You have a thousand dollar video card and top of the line computer - what is the reason?
You suffer with hundreds of others disabling random features, uninstalling higher quality resource packs, turning off Steam features. Just to hopefully stop the crashing.
Just when you finally slow the crashes disabling every possible feature in your computer - your teammate just crashes and the experience sucks.
[https://leafapp.co/player/iBot/matches](https://leafapp.co/player/iBot/matches?ref=connortumbleson.com)
Since I do build Leaf in my free time I can just export my game history filtering by "left" games. I know since I've never willingly left a game, all my games that show as "left" are crashes.
So I've played 1,208 matches of Halo so far and I've crashed out of 13 games. That seems pretty good since I took the steps to attempt to resolve this as much as possible. However, the February update that came out regressed something and I now crash more often now which is part of the reason I play this game less and less now.
So with my 1,208 matches lets check how many of those games were:
- I crashed: 19 games - 1.57%
- Other left/crashed: 339 games - 28%
- No one left/crashed: 850 games - 70%
That is simply insane - almost 30% of my games had a missing player due to leaving or crash. That in a 4v4 is a literal game winner or loser depending on which side you fall of the missing player(s).
So why don't I try the new larger "Big Team Battle" that pits 12 vs 12 Halo players against each other. Too bad early December something manifested in the game that was never apparent during the early November playing.
You would launch into BTB and one of the few would happen:
- You would lag out immediately
- The games would start 1v3, 4v2, 1v5 in a playlist meant for 12v12
- The games would never start (waiting 5+ minutes loading)
343 with the holiday and 2022 nearing [basically said](https://forums.halowaypoint.com/t/big-team-battle-update/474781?ref=connortumbleson.com) (summarized) "*we have no idea whats causing this, we added some logging and will be back in 2022*"
I couldn't believe it. The large break from work I get every year and my 2nd favorite game mode is busted.
So on January 19, 2022 (which is a month later) an update comes out to fix BTB and guess what? It fails at it.
[https://twitter.com/ske7ch/status/1483882268892352512](https://twitter.com/ske7ch/status/1483882268892352512?ref=connortumbleson.com)
Have video games gotten too complicated and companies too large to produce a AAA game and expect it to be stable on release?
I keep vaguely remembering this [Bloomberg article](https://www.bloomberg.com/news/articles/2021-12-08/how-microsoft-s-halo-infinite-went-from-disaster-to-triumph?ref=connortumbleson.com) and thus quote:
> The staffing at 343 was also unstable, partially because of its heavy reliance on contract workers, who made up almost half the staff by some estimates. Microsoft restricts contractors from staying in their jobs for more than 18 months, which meant steady attrition at 343.
This seems tough for the video game industry. Since chances are that some of those contractors have become subject matter experts of a certain part of a game engine or feature.
Another month passes and the early February patch finally resolves BTB for me. At least it didn't take a [few years](https://connortumbleson.com/2018/09/02/halo-mcc-redux/) like Halo MCC to fix. However, this is the same release that led to an increase of crashing for me so the hope was further lost.
---
**Priorities**
What bugs me the most is every release I'm hoping to see changes for one the following:
- Fixing the crashes
- More ranked playlists (Slayer, Objective, HCS, Doubles, FFA)
- Correcting the imbalanced ranked games
- Releasing all game modes that are presently in game, but hidden (VIP, Assault, Infection, Attrition, KoTH)
- Releasing Forge
- Releasing Co-Op
- Halo Waypoint Stats
However, this is what we actually get:
- A new limited event with a new gamemode that will go away
- Adding playlists that should have been there on day 1
- Events with new armor/colors - purely visual
While we've heard news on the Co-Op front - it was bad news as it was delayed. Don't worry though, the brand new cosmetic "core" that will require you to re-earn armor and paint for a different spartan will be releasing on time.
I don't blame them that you work on the things that make you money, but at the end of the day. If you are bleeding population - why not fix the things people are complaining about?
[https://steamdb.info/app/1240440/graphs/](https://steamdb.info/app/1240440/graphs/?ref=connortumbleson.com)
This graph is just flat out sad. I want to like this game. I want to play this game. The weapons feel great and when it works - it works well. It just rarely works.
For comparison, we can look at Apex Legends which I see a lot of Halo professionals also play.
[https://steamdb.info/app/1172470/graphs/](https://steamdb.info/app/1172470/graphs/?ref=connortumbleson.com)
Apex has a reverse graph that is actually swinging up with players compared to the bleeding Halo Infinite.
Which person out there said - "*You know what, I want more cosmetic changes before anything else?*"
I know I sure didn't.
---
**Ranked Balance**
So if we ignore the actual issues that prevent me from playing the game. I decide to play in the morning before work.
[https://leafapp.co/game/ec7e18dd-62bf-4e38-b263-4f01acbef426](https://leafapp.co/game/ec7e18dd-62bf-4e38-b263-4f01acbef426?ref=connortumbleson.com)
I actually win! Which is odd, because lets look at this game:
- The estimated MMR was \~100 difference
- Why is there a Gold 6 on enemy team?
So we beat a team we were supposed to beat while they have a person that is almost 600 points beneath me. That is insane. At least in Overwatch they prevent folks that far apart from playing together.
It feels the game knows what I should be ranked (MMR) and no matter how I play - it wants me to be where it thinks I should be. When I finally climb out of that hell - I can lose hours of progress for 1 loss which just breaks me. We recently got a [developer post](https://www.halowaypoint.com/news/closer-look-halo-infinites-ranked-experience?ref=connortumbleson.com) that dug into these details a few days ago, because of tons of community complaints about this.
I read it and I don't feel better, because it just tried to explain the reasoning why things are the way they are. I honestly don't care if the system is working as intended for x,y,z if most people think its garbage.
[https://leafapp.co/game/1b96baed-6635-4d8f-9774-40b7248b5204](https://leafapp.co/game/1b96baed-6635-4d8f-9774-40b7248b5204?ref=connortumbleson.com)
Though, lets talk about this game above.
- Objective play does not help your stats, according to 343 itself, only kills/deaths so I should not play the objective and instead lose and do well in killing to help myself.
- Why is a Gold 6 in this lobby. You have to climb all the way through Platinum to reach Diamond. Why Gold?
- Why did my teammate who ended up placing Diamond 1 go 8 and 24 and still place in Diamond.
It's just depressing beyond belief.
So lets pivot away from me for a bit and grab a professional player Snipedown. Who I remember from the early Halo days.
[https://leafapp.co/player/Snipedown4965/matches](https://leafapp.co/player/Snipedown4965/matches?ref=connortumbleson.com)
This is a professional player playing solo that happened to lose or crash every game he played in a multi-hour gaming session yesterday.
He plays at a positive level with an insane accuracy in every game yet loses. So lets take a look at the last lost that caused him to go offline.
[https://leafapp.co/game/07da0865-bbf9-4c7b-bab1-de3dc731d5c6](https://leafapp.co/game/07da0865-bbf9-4c7b-bab1-de3dc731d5c6?ref=connortumbleson.com)
This game looks depressing. The MMR is near aligned, but not a single teammate of Snipedown could go positive holding a sub 1 KD ratio. Not to mention one teammate played so poorly at 7 kills and 23 deaths.
Don't worry though, Snipedown won't lose any CSR for this loss since he did great.
Why do these games keep happening? If they happen for me and they happen for a pro, then I can estimate its happen for all.
Most readers will tell me to just stop playing and I should really do so, but imagine a game you've been playing for 20 years. Every single Halo that is released - you have to give it a shot.
So for my final ranking example. I decide to play BTB and did amazing with 51 kills. This isn't odd in BTB because the game gives me players that are still learning how to move. It isn't fair - I'm not even sweating in BTB and easily drop 40 kills a game.
[https://leafapp.co/game/3428bff1-67e1-4074-9e2a-1a9e0160ebb1](https://leafapp.co/game/3428bff1-67e1-4074-9e2a-1a9e0160ebb1?ref=connortumbleson.com)
So I play a bunch of Social games (no ranks) and do pretty well. I'm affecting my perceived skill even though I'm not playing comparable players.
So then what happens is when I decide to go back into Ranked, the game thinks I'm better than I am.
[https://leafapp.co/game/0b4ff72c-b8a8-4f0a-9795-ecaf4305e231](https://leafapp.co/game/0b4ff72c-b8a8-4f0a-9795-ecaf4305e231?ref=connortumbleson.com)
I had [Lethul](https://halo-esports.fandom.com/wiki/LethuL?ref=connortumbleson.com) on my team who is a professional player on Sentinels, the team that won nearly every Halo 5 event and got rated the #2 best player of all time.
Why am I matched with this professional? Did the game think I was good after I beat noobs in social over and over?
Thankfully having the 2nd best player of all time on your team leads you to a victory. All of his teammates (ie me) went negative, but we still won.
This doesn't seem right no matter how I look at it. I'm happy we won, but this match-up should have never happened.
---
**Closing**
Season 2 is approaching under the motto of a "live service" Halo game, but instead I'm just hoping for a fixed game.
I can't understand how older Halo's can launch on release day with features that this game still does not have released.
I'm not in game development so I'm properly just not understanding the real reasons behind everything. What I can assure readers though from Steam graphs and personal experiences is - this game just sucks right now and I hope that changes.
### The Homelab - Part 1
URL: https://connortumbleson.com/2022/03/07/the-homelab-part-1/
Last updated: 2025-03-01T22:09:20.000Z
Photo by [Jordan Harrison](https://unsplash.com/@jordanharrison?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
So one thing I've noticed from other professionals in this technology space is they have quite the home network setup. I've looked at my setup and realized its embarrassing for the field I work in.
So I ordered some gear and redoing my network. So let me start with my current setup.
- Frontier ONT (1gig)
- Frontier Router
- Raspberry Pi 3B ([Pi-hole](https://connortumbleson.com/tag/pi-hole/) \+ [PiVPN](https://connortumbleson.com/2021/07/12/pivpn-pihole/))
- Two 5 port switches ([Amazon](https://amzn.to/3KoPeOz?ref=connortumbleson.com))
The switches just help keep things hard-wired that should be, so my living room as well as office can maintain strong connections.
This wasn't an easy task as I ended up breaking my ceiling while maneuvering through the attic for an Ethernet drop. This can be found if curious in [Part 1](https://connortumbleson.com/2020/12/21/running-cat6-and-failing/) and [Part 2](https://connortumbleson.com/2020/12/28/running-cat6-part-2/) journey.
Miro diagram of Network (Feb 22, 2022)
So the diagram above helps show my current setup, including all devices that use WiFi or some form of Hue connectivity. This has a few issues I've noticed over time:
**I still use my Frontier Router**
- Since my ONT spits out Ethernet, I don't need to use my ISP Router
- This will be upgraded with Google Wifi Mesh, with the access points just being connected to drops across the house
**A Raspberry Pi 3B running VPN and DNS is a lot**
- This is minor, but I do notice odd issues when remote with a phone/computer to my VPN.
- Perhaps this is because a little Pi running some heavy network traffic as well isn't the best
**One router sucks in corners of house**
- If I sit on my couch on other side of house I might drop my connection a few times and fall down to LTE
---
So the plan is to rework my home setup and I'm changing all major parts. With these planned improvments:
**Introducing a cage**
[10U Cage @ Amazon](https://amzn.to/3sJrM8D?ref=connortumbleson.com) hung in my office.
- Keeping all my equipment and soon more spread among my office is too messy.
- I have things all sprung around and I believe a tiny 10U case will be perfect
- The case pictured above has been obtained and mounted against an exterior stone wall, with a bit of wall damage.
**Introducing a firewall**
[TLSense 8550U](https://teklager.se/en/products/routers/tlsense-i7-8550U?ref=connortumbleson.com)
- Networking without messing with it often is tough. Consumer equipment doesn't matchup with like opnsense, pfsense and the other enterprise offerings
- So I can properly learn network configuration at a scale with 10-20 devices, will obtain a device that can run Opnsense.
**Meshing it up**
- Using an ISP provided router for WiFi when I could have a mesh network is just something I should have done years ago
- I'll probably stick with Google for sake of having Nest, Cameras, Protect and WiFi together.
- This'll mean my connection is stronger in all corners of the house, allowing future wireless purchases of cameras to work more flawlessly.
---
So this time another pass through the Miro board to design what I intend to build.
Miro diagram of proposed network (Feb 22, 2022)
So while the above graphic looks larger - I just went overkill and started mapping all technology in every room. The big changes being:
- Adding a firewall (OPNSense)
- Adding Nzyme (WiFi Monitoring)
- Introducing a 10U Cage
- Introducing a Pi shelf to organize Pi's
- Removing my Frontier Router for new mesh setup
So its too early to dig into anything else, only a fraction of the equipment is here and I need to clean up the office in preparation for this upgrade.
So check back when [part 2](https://connortumbleson.com/2022/03/21/the-homelab-part2/) will dive into the final product with everything configured.
### Disinformation is Free
URL: https://connortumbleson.com/2022/02/28/disinformation-is-free/
Last updated: 2025-02-04T11:42:56.000Z
Photo by [Michal Matlon](https://unsplash.com/@michalmatlon?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Checking Twitter lately has been all about Ukraine and Russia and for good reason due to an ongoing invasion. I noticed a tweet that caught my eye as someone in the technology field.
[https://twitter.com/vxunderground/status/1496878462690340865](https://twitter.com/vxunderground/status/1496878462690340865?ref=connortumbleson.com)
This tweet garnered a good deal of traffic with about \~1,500 retweets and 6,000 likes so a lot of folks appreciated it. This tweet without explicitly saying it was interpreted by the masses that some entity "hacked" Russia's military and took down their website and returned a joke HTTP status code of 418 that stands for "*I'm a Teapot*".
[https://twitter.com/vxunderground/status/1496887677530030084](https://twitter.com/vxunderground/status/1496887677530030084?ref=connortumbleson.com)
40 minutes later the tweet author sent an updated tweet that draws a further conclusion that this 418 is only returned in select geographic areas in the world. So basically we now understand that this filter (with a joke return code) is simply blocking access to Russian Military websites to the non-Russian world.
Though, the initial basically disinformation tweet got 1,576 retweets versus the correction at 233\. The ripple of this is unreal and sadly most don't seek to understand the truth behind something and instead just trust the first thing that was spread.
With a bit of [research](https://news.ycombinator.com/item?id=29594249&ref=connortumbleson.com) though you can discover this happened in December of 2021 nearly 70 days ago! So yes, Russia is blocking access to its military site to non-Russia IPs, but it happened in December of 2021\. So we can dismiss all these crazy claims that a worldwide "hack" took place recently.
I will have to shout-out a clearly obvious troll.
---
All of this together got me wondering again about a common experience where a link is given to some news site and I hit a paywall.
Lets say there is a worldwide topic going on with something, like happens nearly monthly.
If the article that speaks the truth from on the ground research is behind a paywall - where do folks get knowledge? They find free news which is available everywhere, but what quality is the free news?
I don't think Wall Street Journal can really make every article free, because its been proven the era of advertising and harvesting information from readers is more and more difficult in 2022\. This closes a loophole of money making and one of the remaining options to remain positive is to charge for your content.
Though, how do we combat obviously false information that spreads the Internet when information we hope is truthful from reputable sources is commonly left to those who can afford it.
This is a tough question, but I don't think censoring everything is the answer. Since who decides what is true or not? Not to mention the mantra of the United Sates is free speech. I just find it incredibly frustrating that you continue to find false information that spreads faster and further than the alternative, hopefully truthful, paid news sources.
---
This also reminded me of a conversation I had a bit ago. While watching a news report about the [Missouri governor](https://www.nytimes.com/2021/10/15/us/missouri-st-louis-post-teachers-hack.html?ref=connortumbleson.com) claiming viewing the HTML of a website was hacking - a friend wanted to ask me what I thought about that.
Clearly I knew that viewing HTML cannot be claimed as hacking in any regard, but what I found scary about that is I knew enough about that specific topic to debate the claim. However, given a topic I'm not versed in that I hear in the news - who knows if I'm being lead astray?
I either have to cross check everything I hear in the news - which takes time and energy or I have to find a news source that I can trust. The complete opposite of that is just ignoring all news which then sadly positions me into a person that has no insights into current affairs.
There is no easy way to solve any of this, so instead I'll just blog about it.
### Apktool v2.6.1 Released
URL: https://connortumbleson.com/2022/02/26/apktool-v2-6-1-released/
Last updated: 2025-02-04T11:42:56.000Z
Apktool v2.6.1 has been released! This is a bug fix release including a low severity security issue.
The security issue I don't think is a true vector for most Apktool users. However, I cannot sit on a patched security issue ethically without a release. It was assigned a CVE, but then revoked after a long discussion that you can probably now read on [huntr](https://huntr.dev/bounties/d2246081-21fc-4e68-9e04-5bb4095d3624/?ref=connortumbleson.com).
This did lead to some confusion that I apologize for in which a [commit](https://github.com/iBotPeaches/Apktool/commit/4065717b450f557f385495c6cd80bd0da10dba10?ref=connortumbleson.com) did enter the repository under a now wrong CVE. While I was discussing a change in the severity rating, I did not expect the CVE to be removed entirely.
Not too much has occurred in the preparation for v3.0.0, but the decided feature list, including many breaking changes has been decided for 3.0.0.
- Removing aapt1
- CLI library replaced (attempting to keep as many parameters unchanged)
- Linter added for Java style
- Mapping filenames for unsupported characters or operating systems
- Optional disabling of dummy resource generation
- Support for only Android Manifest disassembling (no rebuild)
Depending on how long this might take we may have a few more releases in the 2.6.x series while 3.x is under development.
So welcome to Apktool 2.6.1
---
**This release had 23 commits by 4 people**
- Connor Tumbleson (iBotPeaches) - 20
- Al Sutton - 1
- Goooler - 1
- Yaroslav - 1
As mentioned a smaller release cycle for a security issue.
---
# Changes since 2.6.0
- \[[#2686](https://github.com/iBotPeaches/Apktool/issues/2686?ref=connortumbleson.com)\] Add `apktool-cli` to Maven publishing.
- \[[#2687](https://github.com/iBotPeaches/Apktool/issues/2687?ref=connortumbleson.com)\] Add support for signature scheme v4.
- \[[#2713](https://github.com/iBotPeaches/Apktool/pull/2713/files?ref=connortumbleson.com)\] Add `commons-lang` project to remove deprecated methods from `commons-io`. (Thanks alsutton)
- \[[#2739](https://github.com/iBotPeaches/Apktool/issues/2739?ref=connortumbleson.com)\] Fix temporary files not automatically being removed.
- \[[#2637](https://github.com/iBotPeaches/Apktool/issues/2637?ref=connortumbleson.com)\] Support automatic workaround for private resources.
- Upgrade to `commons-cli 1.5.0` (Thanks Goooler)
- Upgrade to `guava 31.0.1` (Thanks Goooler)
- Upgrade to `jengelman.shadow 7.1.0` (Thanks Goooler)
- Fix `licenseFormat[Test/Main]` to properly inject variables into license preamble.
- Fix untrusted classes from being loaded during YAML parsing.
## Notes
- Applications are becoming more and more difficult to build with aapt1, using the `--use-aapt2` flag during rebuild is a good test.
## Download
- [Apktool 2.6.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.6.1.jar?ref=connortumbleson.com)
- md5 `361f0c97e34aa93c7c1d8aa3e4828f69`
- sha256 `bc2b9a87ac5a86905b6ca343c21a0db3bc37bdd51154bc9cdf65523d95895d34`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### Deploying Laravel with GitHub Actions
URL: https://connortumbleson.com/2022/02/21/deploying-laravel-w-github-actions/
Last updated: 2025-02-04T11:42:56.000Z
After my 9th or 10th hobby Laravel project, I've noticed that there is a mix up of available easy steps for automating the deployment process. This is a mini guide to make this easier.
I enjoy a simple process that allows a project to deploy with the ease of use of a simple tag push. This method might not be applicable to every specific situation, but for mine pushing a tag is a perfect method to kick off a release.
So to start - lets pretend we have just pushed a tag doing something like:
```bash
git tag -a v1.0.0 -m "initial release" -s
git push origin v1.0.0
```
This snippet basically creates a signed commit called `v1.0.0` and pushes it. With a simple GitHub Action that reacts to this tag push, we will have a small file like.
```yaml
on:
push:
branches-ignore:
- '**'
tags:
- v*
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Deploy
uses: deployphp/action@v1
with:
private-key: ${{ secrets.DEPLOY_SECRET_KEY }}
dep: deploy -vvv
```
[LeafApp\_Infinite/blob/master/.github/workflows/release.yml](https://github.com/iBotPeaches/LeafApp%5FInfinite/blob/master/.github/workflows/release.yml?ref=connortumbleson.com)
If we follow that snippet about from top to bottom we see:
- An initial `on` rule that specifies us to ignore any branch name and only react to any tag pushed that starts with the lowercase letter `v`
- Next up we have `jobs`, which only has one called `deploy`
- We run on the latest Ubuntu, which is a safe bet when deploying PHP
- We checkout the repository `actions/checkout@v2` so we have the project available.
- We use a GitHub Action from [Deployer itself](https://github.com/deployphp/action?ref=connortumbleson.com) to kick off the deployment
- We specific verbose `-vvv` on the command to make debugging easier.
So you'll immediately see that `private-key` is a required variable. So this is our first stop point. You'll want to imagine how this software is getting deployed to a server. This will hopefully be a non-root user for proper security measures.
If this part seems unfamiliar, I recommend reading up on ssh-keygen as you'll be creating a keypair `ssh-keygen -t rsa -C 'deployer@{domain}`. You'll then want to allow that new keypair to connect to the server itself. This can be broken down to basically adding the public key into the `authorized_keys` file on the server and user.
```bash
leafapp@leafapp.co [~/.ssh]# ls | grep 'id_rsa'
id_rsa
id_rsa.pub
leafapp@leafapp.co [~/.ssh]# cat authorized_keys | grep 'leafapp'
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt/uCEjylZwPCl4MYcJcm4Ypq3BVo/TDiV9ktE0mE9WZCVHjaVYOI96WWjtBfdg9cZei7HLJpDiaJz7ADOpxZYOOL1kZpXeUbX8wQKK96Zy0+kjPaSYRq1qDfbKxNMKYF9KDQ0eL9wKJnBaDpiTHhK8+ME397q4D2Xw0B1DCWVR4xXgI+IEWEtUp97yS/P1w1QkzW8rOm/YQkXGW+fb3LF2bgCPRVjsHL3N7h0hBPexiNjZqQGI0Bi2kfhSK60TKkqzGpVAp4U1h6iTsdGd2OrXVa+mxofSUu3h32Rd77RmW9Jn0ToMAOfkTDxPuRJ9/UoszJI7EepoannlCdXJyVV leafapp@leafapp.co
```
So this snippet above basically shows that the corresponding private key to that public key is allowed to SSH onto this server without a password becoming the `leafapp` user.
Now take that private key and store it securely into GitHub Action secrets. Note that depending on your setup - this should probably use the [Deployments feature](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment?ref=connortumbleson.com) of GitHub Actions for hardening the infrastructure.
Now when the deployment starts - Deployer needs to know what to do and this is where the `deploy.php` or `deploy.yaml` comes into play.
A quick note - I would recommend using the php version of the configuration file. The YAML file has had issues that are not apparent in the PHP one.
There is a wonderful site for Laravel for a starting point by [Lorislevia here](https://github.com/lorisleiva/laravel-deployer?ref=connortumbleson.com) to grab as a starting point.
```php
set('remote_user', 'leafapp')
->set('port', 22774)
->set('hostname', 'leafapp.co')
->set('deploy_path', '/home/leafapp/deploy');
task('deploy', [
'deploy:prepare',
'deploy:vendors',
'artisan:storage:link',
'artisan:view:cache',
'artisan:config:cache',
'artisan:migrate',
'yarn:install',
'yarn:run:prod',
'deploy:publish',
'php-fpm:reload',
'artisan:queue:restart',
]);
task('yarn:run:prod', function () {
cd('{{release_or_current_path}}');
run('yarn run prod');
});
after('deploy:failed', 'deploy:unlock');
```
Lets break down this file like the last.
- We start off with a namespace and importing the files we need. These can be found in either the [recipes](https://deployer.org/docs/7.x/recipe/common?ref=connortumbleson.com) or [contribs](https://deployer.org/docs/7.x/contrib/npm?ref=connortumbleson.com) section of Deployer to perfect your build.
- Next up we set some variables to override some sections of the project. You'll need `application` and `repository`, but I include an additional one to help me properly restart PHP FPM.
- After this we want the host setup, which can be quite powerful between environments or multiple servers. For the case of this project, we have 1 server and one environment. You setup the configuration for that server, which should align with the private/public key you created earlier.
- Now we setup the tasks to do during `deploy`. The defaults might be sane here, but we have to do some additional checks with yarn and queues so we duplicate the list to properly order the events.
- We then create a new custom task for building yarn assets. This is required because as of this blog post - Deployer only has helpful rules for NPM.
- Finally, we unlock our deployment after it fails so we can retry again. Since a failed deployment blocking all deploys is a choice you have to make regarding your project.
Now when we push a tag, GitHub Actions starts the process which kicks off Deployer. Deployer runs through this configuration file and deploys it.
It setups a common folder setup of:
- `current`
- `releases`
- `shared`
So as Deployer runs it creates a new release in `releases` and once that is finalized. A quick symlink is changed so `current` points to the newly deployed release. The shared folder is for everything shared between a release. Think your log files, environment file, etc.
So yes, the very first time you deploy you'll have an empty `.env` file in the shared folder. It'll be up to you to set that file up to properly represent the configurations needed on that environment.
So in under 1 minute after pushing your tag - the automation will do the rest and deploy your new version of software ready for visitors to use.
### 2022 - Era of the CVE
URL: https://connortumbleson.com/2022/02/14/2022-era-of-the-cve/
Last updated: 2025-02-04T11:42:56.000Z
Photo by [Clint Patterson](https://unsplash.com/@cbpsc1?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
About a decade ago, hearing the word CVE (**C*ommon *V*ulnerabilities and *E*xposure*) was associated with big name issues in software. This was like Heartbleed & Shellshock. However, what changed year after year was the ease of use to request a CVE for any type of software in the toolchain. This of course to make more software secure and encourage folks to patch such issues.
[CVE Details](https://www.cvedetails.com/browse-by-date.php?ref=connortumbleson.com) is a good site that I want to start with that breaks down how many CVEs it logs year after year.
| Year | Count |
| ---- | ------ |
| 2015 | 6,504 |
| 2016 | 6,454 |
| 2017 | 14,714 |
| 2018 | 16,557 |
| 2019 | 17,344 |
| 2020 | 18,325 |
| 2021 | 20,142 |
This is quite interesting to me that upwards of 20,000 vulnerabilities of insecure software are documented and released in 2021\. This number is obviously way higher for everything that isn't documented, but I fear this volume is going to work against the population.
Lets start with an example of installing React Native on February 13, 2022 and see what happens after we get to the last step of `npm install`.
```bash
➜ npm install
changed 4 packages, and audited 947 packages in 9s
79 packages are looking for funding
run `npm fund` for details
14 moderate severity vulnerabilities
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
```
This is so scary! I have a brand new project that has 14 moderate severity vulnerabilities. So lets just take a look at the first one.
[https://nvd.nist.gov/vuln/detail/CVE-2021-3807](https://nvd.nist.gov/vuln/detail/CVE-2021-3807?ref=connortumbleson.com)
This is another perfect example of the dependency hell in the Node world that some dependency 5 generations deep has an issue.
Though what is the issue? We are talking about an inefficient regular expression - this in short means that intentionally malicious input can cause the regular expression to process for near forever exhausting resources and crashing a machine.
This seems so dangerous if you accept untrusted user input and lint it, but lets look at our situation. This package is a "dev" dependency which means its only used during development or building. By the time our test React Native application is installed on a device - ESLint is gone - thus the vulnerability.
So how was this issue discovered? Was it abused or what?
[huntr.dev](https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/?ref=connortumbleson.com)
This was discovered by a researcher and then fixed by the same researcher by building an intentionally malicious expression to test before and after the resolution.
I'm all for building a PoC for vulnerabilities so complex systems have an easy way to know if vulnerable, but lets sadly talk about what I believe actually happened here in the full picture.
This service (Huntr) is a newer website to basically fund finding and fixing vulnerabilities in open source software. It automatically contacts maintainers and attempts much like other services to help get issues fixed.
It sounds great and also includes funding to help entice the researcher and maintainer to resolve the issue.
> We are a UK based startup backed by VCs such as [Seedcamp](https://seedcamp.com/?ref=connortumbleson.com).
> [https://huntr.dev/faq/](https://huntr.dev/faq/?ref=connortumbleson.com)
It however leads to bounty farming and this is what generally happens:
- A type of vulnerability is discovered (ReDOS)
- That vulnerability has an easy PoC (Proof of Concept)
- That vulnerable snippet is scanned across GitHub to find vulnerable repos.
- Those vulnerable repos are submitted to Huntr.
- Huntr reaches out to repo for privacy to disclose and resolve.
- However, researcher can also be the fixer to claim 2 bounties (report & fix)
[https://huntr.dev/users/yetingli/](https://huntr.dev/users/yetingli/?ref=connortumbleson.com)
In the example above, the user responsible for discovering and fixing this issue has found this same type of issue in plenty of other repositories.
Is this wrong? Well this is where we get into debatable territory. I will never deny that fixing security issues is a wrong thing, but how its done in this example bothers me.
Lets look at some timestamps. On September 9, 2021 the Huntr disclosure was created - we can't tell if any contact occurred, but we know the date it was created. That date also aligns to the same day that the researcher submitted a public fix to the repo.
This is the wide open public GitHub. Where is responsible disclosure? Why did Huntr not enforce a secure method of disclosing?
Though, lets talk about the vulnerability itself and how its treated. It got a 7.5 HIGH rating, which is quite severe in the scale of things. So for a non-technical person being told they have a HIGH known not patched vulnerability is a tough conversation to have.
[https://nvd.nist.gov/vuln/detail/CVE-2021-3807](https://nvd.nist.gov/vuln/detail/CVE-2021-3807?ref=connortumbleson.com)
Now I have to understand that not everyone using this package is using it for the same reason I am, so perhaps this severity is earned given a different situation.
Though from my perspective of this vulnerability - its rating is absurd and so is the exploit. Not a single use of this package I use is for user input and if someone has physical access to my development machine to properly exploit this flow - they won't! They will do far worse things.
Though, whether this is my client, my hobby project, my work or my boss. This HIGH rated vulnerability will be forever plaguing the repository and be included on reports, exports and compliance until patched even if I don't agree.
So lets pivot to why I think this occurs, because guess what - Apktool has a currently unreleased un-patched vulnerability through Huntr as well.
---
[https://huntr.dev/bounties/d2246081-21fc-4e68-9e04-5bb4095d3624/](https://huntr.dev/bounties/d2246081-21fc-4e68-9e04-5bb4095d3624/?ref=connortumbleson.com)
Above is what I see as the maintainer of Apktool, I got a suspicious email from a service I believe to be a scam and that led to me to this screenshot above once I joined.
A researcher (who is the top 3 of Huntr) had found a vulnerability in Apktool and was rewarded $170 for the effort. Which given the explanation I'm about to give is way too much especially since Apktool has only netted $244 profit in 10+ years. So I find it especially odd that someone can make nearly 70% of what I made in a decade for a simple search on GitHub.
Let me explain. This vulnerability is a natural extension in [SnakeYAML](https://mvnrepository.com/artifact/org.yaml/snakeyaml?ref=connortumbleson.com) of parsing user input YAML, which could lead to executing code. This was patched with a simple [SafeConstructor](https://bitbucket.org/snakeyaml/snakeyaml/src/master/src/main/java/org/yaml/snakeyaml/constructor/SafeConstructor.java?ref=connortumbleson.com) which basically built out each supported scalar datatype so a malicious YAML file would not be executed.
The researcher suggests that I just fix 1 line of code [here](https://github.com/iBotPeaches/Apktool/blob/e25c3636ffaafa7768651c4e40659867742f4bb1/brut.apktool/apktool-lib/src/main/java/brut/androlib/meta/MetaInfo.java?ref=connortumbleson.com#L50) and all my problems will go away. The issue is we already use a custom constructor in Apktool to handle character sets easier in an attempt to thwart resource obfuscation, so I have to adapt it more carefully to patch this issue.
However, it won't work cleanly. I'm not well versed in YAML parsing, because we actually do resolve to a configuration class, which is now rejected. So now I spend a few hours looking into how to explicitly allow some classes, but reject the rest. I quickly realize the little time I have for Apktool is not worth spending time on this.
Though lets look back at the reported vulnerability. The vector here is first you must disassemble an application with Apktool using `apktool d`. Once disassembled, Apktool generates a `apktool.yml` file to store configurations. It writes that file itself from configurations passed in during disassembly and looks like this.
```yaml
!!brut.androlib.meta.MetaInfo
apkFileName: Dialer.apk
compressionType: false
doNotCompress:
- classes.dex
- resources.arsc
- png
- webp
isFrameworkApk: false
packageInfo:
forcedPackageId: '127'
renameManifestPackage: null
sdkInfo:
minSdkVersion: '30'
targetSdkVersion: '29'
sharedLibrary: false
sparseResources: false
unknownFiles:
usesFramework:
ids:
- 1
tag: null
version: 2.6.1-ddc4bb-SNAPSHOT
versionInfo:
versionCode: '2900000'
versionName: '23.0'
```
This helps Apktool know what to do during the build process. Apktool makes it and reads it. So this vulnerability is then modifying the above file to be malicious and Apktool will execute it between that process.
Lets talk about how that is supposed to happen. If you are disassembling an APK on your own machine. The vector here would require read/write access to your own machine in order to modify the `apktool.yml`. These files are NOT shared around - they are built on runtime of the decode operation.
So you can see the vector for abusing this is so difficult. If you had file-system access to a victim's computer - why would you wait for them to build a malicious apk? You'd obviously do much more damage if that is the access you had.
So no, I don't agree with the money paid to the researcher nor the severity given to it. Even after discussing with the researcher - I could only drop this vulnerability from 7.0 to 6.7 (MEDIUM). Which is still a bounty vulnerability worth $170.
Why can't that money go towards fixing real bugs? Issues that plague the use of the tool and not a wrongly classified security issue that will now hang above Apktool until resolved.
You can tell I'm not happy about this and this is why.
One simple GitHub search and I found 44,496 results. The first one looks to be a test file so I don't care. The 2nd one is a text file so I don't care. Lets look at the third.
This appears to some file responsible for loading configurations and looks vulnerable to this same issue.
[https://github.com/deathbeam/yae/blob/master/core/platforms/ios/IOSLauncher.java#L22](https://github.com/deathbeam/yae/blob/master/core/platforms/ios/IOSLauncher.java?ref=connortumbleson.com#L22)
So do I just go down this list of 44k results and look for vulnerable uses of SnakeYAML? Seems like if I can get $170 for a confirmed issue and can work quickly - I can make some serious money just reporting every single repository I find that does this incorrect and could probably average 6-10 an hour.
I did not join Huntr (As an Apktool maintainer) and this security issue did NOT follow my requested guideline for security issues. So if that is true for me, I guess it doesn't matter if this "YAE" program, in the above screenshot, does either - I should be able to win a bounty by reporting this.
You see whats happening? I'm now pretending to chase bounties for a leaderboard/money and don't actually care about secure software anymore. In this example I just found - who would maliciously modify a configuration file that the program makes itself?
No one. They wouldn't.
If they had the access required to do that vulnerability - they would do a world of different things. I don't have to say that though, I can just report a security issue and let the platform (Huntr) determine the severity itself.
---
So to try and close this thought process and blog post. We are getting hit hard with CVEs and the problem is they are coming in batches fast and often. Even if the severity is miscalculated and difficulty of executing even more.
This will lead to engineers ignoring these vulnerabilities when the entire purpose of this evolution of platforms was to encourage users to patch them. Since when a brand new project installed says it has over 10 not patched vulnerabilities - the system is broken.
### The Pwnagotchi
URL: https://connortumbleson.com/2022/02/07/the-pwnagotchi/
Last updated: 2025-02-04T11:42:57.000Z
*For those believing this is a tutorial, please head to a more proper [tutorial location](https://pwnagotchi.ai/installation/?ref=connortumbleson.com). This is just a story of building something cool.*
A few weeks ago a group I belong to announced a new event in which we'd build a "*pwnagotchi*" which was the first time I'd ever heard of that word. I quickly learned after a few Google searches the coolest little project that would automate parts of exploiting WPA networks.
So I was off to buy a [few things](https://pwnagotchi.ai/installation/?ref=connortumbleson.com#required-hardware), which basically broke down to:
- Raspberry Pi Zero W
- [PiSuger Powerpack L](https://amzn.to/3GwEPOa?ref=connortumbleson.com)
- [Waveshare 2.3in e-paper HAT](https://amzn.to/3ru0vXd?ref=connortumbleson.com)
Turns out trying to buy a Raspberry Pi Zero on Amazon was a bit tough and out of stock nearly everywhere. So I went to CanaKit and ordered a kit with a few extra things I didn't need.
I now had everything I needed prior to the event. However, that random Thursday during work a coworker left at lunch feeling a bit sick and since COVID won't go away - turns out they tested positive a few hours after leaving the office.
So while I felt fine - I did not attend the event and attempted to build mine on my own.
Enter the first mistake - where I could not attach my e-ink display to the Pi because I had no pins to connect with. Turns out I should have purchased the pre-soldered GPIO headers, but I did not.
So I ordered a pack of GPIO pins in the smallest quantity of 20\. At this point I was days away from the next meetup and my device was still not built. So I missed another week waiting on the delivery of the pin headers.
When it all arrived - I had to remember how to solder since the last time I did that was probably 10 years ago during original Xbox.
So I set up a quick station with my old equipment and hoped with a bit of solder and paste I could do a good job at soldering 20 pins to a board.
I started with a bit of tape since I did not have a board to anchor this Pi to something stable. Since I do remember that attempting to solder holding an iron, solder and board at once becomes incredibly difficult.
Folks will probably rate this soldering job poor, but this was a slow painful process to effectively not bridge points.
So I was excited that the hard part was done - the only thing I had left to do was to attach the display to that pin header and screw the battery onto the back.
Outside of triple checking everything this step was quite easy and then I had an uncased final product.
Outside of it looking like a bomb - I was ready to insert the sdcard and hope it worked. So I plugged it in and immediately a green light showed up! So I was happy I didn't fry the Raspberry Pi itself.
It looked quite bleak for about 6 minutes as nothing happened, but I just let it sit. Eventually, the display flashed and now I had a visual indication on the display that stuff was occurring!
All these values seem unlikely because the device did not have power until about 6 minutes prior to that picture so I'm unsure why all those values showed up by default.
However, it worked! I could connect to it via SSH and configure it to my liking. A tiny educational project that refreshed my dated knowledge of soldering and learning a bit more about WiFi network security.
### Keeping a project alive
URL: https://connortumbleson.com/2022/01/31/keeping-a-project-alive/
Last updated: 2025-02-04T11:42:57.000Z
Photo by [Kelly Sikkema](https://unsplash.com/@kellysikkema?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Every year I tend to start a few hobby project(s) - I'm not sure exactly why, but I always find a reason to build stuff. In the past few years I've built a few things:
- Ghosty (Private - Automation for publishing this Nurui theme)
- [HaloDepot](https://connortumbleson.com/2021/03/15/project-halodepot/) (Halo `.map` modding depot)
- Biney (Private - PHP Binary Reader/Writer)
- PikminTeardowns (Private - Repo for diffing binary Pikmin apps)
- PiStats (Private - Exports Pihole stats for long term storage)
- Leaf (Halo Infinite Stat Site)
This doesn't even count all the projects that I continue to maintain each year, but I want to talk through some difficulties I encounter and methods I found to prevent project burnout.
Lets start with HaloDepot with some examples. The idea was to build a site that I could just upload a modded patch file and it would automatically extract all the metadata. Like most projects - I spent the initial project work on:
- Repo organization
- Linting / Testing - CI
- Domain
- Automated Deployments - CD
This gets easier and easier since I've done it almost 50 times now, but lets take an example for an individual new to the scene. If you spend the entire time on your project just attempting to get it automatically deploying you may run into some time constraints and burn out.
For me, deploying a variety of PHP applications to a shared cPanel server with different PHP versions kept introducing new issues. Though, even if you are struggling or making slow progress - you are learning something. If your goal is to not learn CI/CD however, then working on the reason you started a project might be a better worth of time. I believe once a project starts to take shape, then the drive and process to do automation becomes easier.
Thankfully, now in 2022 this CI/CD automation with GitHub Actions has become pretty easy. You can see in my [77 line build file](https://github.com/iBotPeaches/HaloDepot/blob/master/.github/workflows/laravel.yml?ref=connortumbleson.com) I have CI/CD and plenty of features for HaloDepot with little effort.
---
What ended up killing HaloDepot though? Lets talk about what happens when you bite off too much to chew. If you work in an agile sense you probably remember to take vertical slices of improvement in tiny chunks. This is unlike the waterfall style of things that intend to work on the feature/project as a whole for a long time to perfect and then finally release.
So lets go back to HaloDepot - I decide to support a new patch format that supports 5 different Halo games. I spend time to add filtering & sorting interfaces for tons of new Halo games. I started collecting patches to be ready to seed the completed product.
When I finally started development on the new patch type, I was wiring it up and kept running into issues. This patch format had many different versions so I kept having to perfect my parser to not crash. This would seem like an easy enough task to accomplish, but I could not figure out why my 32bit signed reads were coming up incorrect.
Turns out I found someone else with the [same issue](https://github.com/mdurrant/php-binary-reader/issues/10?ref=connortumbleson.com). I wanted to fix this package, so I ended up forking it - but it was untouched since 2017 and this was 2020\. The CI process was broken and it did not support PHP8 so I became addicted to bringing that project to the future. It was [pretty fun](https://github.com/iBotPeaches/php-binary-reader/issues/1?ref=connortumbleson.com) to keep a project at 100% code coverage and bring it to the present time with the latest and greatest language features.
Though, I realized after doing all of that - I never fixed the bug which was the entire reason I forked the project. I suffered trying to fix that because my knowledge of pack/unpack and low level bit shifting was rusty. So I tossed that project and built Biney to learn more about this process.
So now I was working on a new package to parse binary files in PHP for HaloDepot while redoing the API from my previously used package. I never completed this and HaloDepot never supported more than 1 patch type. This is because the large task kept ballooning and thus led to a lack of drive to complete it.
The proper alternative to this would have been to launch the patch in a partially supported mode only supporting a few versions and then iterate on each release.
---
If we pivot again to a recent project [Leaf](https://leafapp.co/?ref=connortumbleson.com) \- I had a vision to add an entire new service to do a complex set of actions.
- API against a Tournament Provider (FaceIt)
- Pull brackets and players/teams (FaceIt)
- Automatically match players to Xbox Live accounts (Autocode)
- Pull the game history from those Xbox Live accounts (343)
- Find the online match between Team A and Team B (Logic)
- Include those stats from the automatic games. (Logic)
So like any new thing I was excited and worked on pretty heavily for a few weeks. I found my drive shrinking to work on it since the pull request was \~60 commits, 50 files changed and \~2,000 lines changed without even being complete.
[Leaf - ANZ HCS Open Series (Nov 20)](https://leafapp.co/hcs/1514b83f-7f65-4270-89ad-7e55cfca08c4/winners/2?ref=connortumbleson.com)
Things I expected to take zero time took too much time and I decided to release it early. I added some under construction messages, hide some features that were busted and released it.
Within the next few days I had a bunch more releases out to fix issues discovered on the live site. I believe its easier to work on a project when you release early and iterate with feedback. Otherwise it falls victim to burnout from spending forever on a feature that will never see the light.
### Open Source & Money
URL: https://connortumbleson.com/2022/01/24/open-source-money/
Last updated: 2025-02-04T11:42:57.000Z
Photo by [XPS](https://unsplash.com/@xps?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A solid few years ago I finished a talk at a conference and afterwards someone recognized my username as the maintainer behind [Apktool](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com). It was an odd conversion in a way because the individual just spoke about how they used it for x,y,z and thought it was great. They then hinted at the millions of downloads suggesting that I must have tons of money due to the popularity of it.
Quick news flash - I do not have a pile of money from Apktool and have only obtained $380 (*$280 if you subtract the $100 I gave to the other maintainer*) in 12 years.
We will get back to that, but something happened over the weekend that re-sparked all these thoughts. An open source project for Windows known as "[ImageGlass](https://imageglass.org/?ref=connortumbleson.com)" was caught injecting malware into the project during a [commit](https://github.com/d2phap/ImageGlass/commit/97c716cf1ad23535b7b6840ba189270e440e742e?ref=connortumbleson.com). This showed up on [Hacker News](https://news.ycombinator.com/item?id=30037417&ref=connortumbleson.com) and of course led to an infinite amount of debate.
This was an interesting form of open source going rogue, because the maintainer undid their mistake and gave us plenty of dialog, which is not the norm given the recent situation that occurred with [thegreatsuspender](https://github.com/greatsuspender/thegreatsuspender/issues/1175?ref=connortumbleson.com). So lets look at some dialog in an recent issue report for ImageGlass.
> *Yakabuff: I love how you added literal malware to a supposed "lightweight image viewer". How can anyone trust you after this lmao maybe you add a crypto miner next time?*
> [issue 1252 - d2phap/ImageClass](https://github.com/d2phap/ImageGlass/issues/1252?ref=connortumbleson.com#issuecomment-1019011308)
Which was responded in short by the maintainer with this snippet:
> Yakabuff what should I do now? I became international criminal after 1 night, and all people from nowhere can come and judge me. Before this integration, I made an announcement to poll people's reaction on ImageGlass discord server for the first release of IG Moon. There were very little comments, I guessed people were fine with the changes, it's been there for 2 weeks. When it came to the official release, I expected there would be more comments, but in fact, people have been insulting me more.
> ....
> [issue 1252 - d2phap/ImageClass](https://github.com/d2phap/ImageGlass/issues/1252?ref=connortumbleson.com#issuecomment-1019027168)
This is such interesting dialog to me. The maintainer acknowledges that the greater Internet descending onto his project to interject opinions might not have a place in a project they don't use.
Though, his response of claiming his user base was "fine with the changes" I think is a reach. Most folks have no idea their Internet connection is being harvested for an exit node and I would guess would certainly not agree if given a chance to understand the true purpose.
I disagree 100% with what this maintainer did and it would fully affect my trust towards this individual near forever. So lets run through other possibilities with real world examples that could have been injected into the ImageGlass situation.
---
**Sell the project to another person** (one time $$$ gain)
[https://github.com/greatsuspender/thegreatsuspender/issues/1175](https://github.com/greatsuspender/thegreatsuspender/issues/1175?ref=connortumbleson.com)
For this, lets turn back the clock to a Chrome extension that I even used known as TheGreatSuspender. I used the extension for free and never once visited the GitHub of the project itself. Call me a poor user of the open source space or probably acting like most and just installing an extension and being done with it.
One random day years later - that extension had an alert from Google that it was malware and automatically removed. I was scared beyond belief thinking all my stuff was stolen so spent an entire weekend rotating every single key, password, and authentication I had. Since this extension was built to suspend any tab, it naturally had an extreme amount of permissions.
So then I went into investigation mode. Turns out on June 19, 2020 the maintainer of the project wanted out after 8 years and hell I don't blame him. Just take a read on my [2017 blog post](https://connortumbleson.com/2017/05/01/the-human-behind-the-keyboard/) about the battering you take maintaining a semi-large open source project. He names the new GitHub account to takeover, which happens to be a brand new (at the time) GitHub account named after the project itself. So effectively an unknown user.
On November 3, 2020 a user [opens an issue](https://github.com/greatsuspender/thegreatsuspender/issues/1263?ref=connortumbleson.com) noticing that a new published update of the software has no corresponding code on GitHub. This is odd for an open source project, since a binary release without corresponding code is very suspicious.
Sleuths investigate, reverse engineering and discover ad fraud is at the center of the recent updates. The unknown new entity tries to cover face, by adding options to toggle this behavior into the repository. However, the pull requests and issue reports are ignored. Its clear this new owner was not maintaining this repository, but instead monetizing the repository.
Money I believe sways all opinions, because any project that sees some success in popularity will receive emails from odd places. I remember Apktool getting an email for a simple ask - add one JS script to my documentation site and I would make roughly $1000-1200/month.
The extension was not going to be shared ahead of time, but my guess is something to override links/searches/something malicious. I think open source maintainers have a slightly higher responsibility to protect the end users of their software to pick the ethical path even if its not the money making path.
---
**Sell the compiled project, remain open source** ($$$ for ease)
[https://community.ardour.org/download](https://community.ardour.org/download?ref=connortumbleson.com)
This is an unique method that helps more non-web based software. Imagine a piece of software that is a bit complex to build on your own, but you can easily obtain a pre-built binary for a small fee.
Developers or even technical folks alike could manually build this software or just pay a small fee to have it pre-built. I remember this with a piece of software for a Halo stat tracking program way back in Halo 2\. Some C# application that was $2 to have pre-built or suffer through a combination of ZIP files released on a forum to build on your own.
Halo nerds did not like payment at all though as a few smarter engineers just shared the binaries in other areas negating the entire purpose of paying for a download.
---
**Attempt Sponsorware** ($$$ to produce)
[https://twitter.com/enunomaduro/status/1263074923314130944](https://twitter.com/enunomaduro/status/1263074923314130944?ref=connortumbleson.com)
In this situation, we see a few packages of recent times promise to go open source but only after a certain amount of sponsors are added. This usually leads to a collection of folks buying into a cool looking extension for the benefit of it eventually going open source.
We saw this again with [Caleb Porzio](https://calebporzio.com/i-just-hit-dollar-100000yr-on-github-sponsors-heres-how-i-did-it?ref=connortumbleson.com), who left his job to support his own packages in the open source space. He followed this idea and it turned out to work quite well growing his salary by $11,000 for a specific package in just a few days in one example.
Though, we now have the benefit of looking back at how this has panned out. Both Nuno & Caleb both requested 75 sponsors prior to open sourcing Pest & Sushi.
- 75 required (Nuno), January 23, 2022 current: 47 sponsors
- 75 required (Caleb), January 23, 2022 current: 973 sponsors
This difference is insane to me, so lets dig into it.
Nuno
- PEST *(3,890 stars)*
- PHP Insights *(4,470 stars)*
- Laravel Zero *(2,849 stars)*
- Collision *(4,001 stars)*
- Larastan *(3,625 stars)*
Caleb
- Livewire *(14,327 stars)*
- AlpineJS *(19,651 stars)*
- Better PHPUnit *(175 stars)*
- Sushi *(1,387 stars)*
So while Nuno's current sponsor count in January 2022 is 47 sponsors - that is under his requested sponsor amount to open source PEST. We can see that Caleb has instead exploded with almost 1,000 sponsors on GitHub.
We can see though that a single project that Caleb created (AlpineJS) has more stars than every single project Nuno has listed in his sponsor page combined.
I think when I look at this above, I see one example that may cause this difference. Nearly every single package Nuno creates benefits the developer directly, with enhancements to tests, console and insights that engineers read. If you look at Caleb's packages some of them have clear features that end up being front and center on a website.
Could this be the difference that no one seems to be talking about? If a business builds a site with AlpineJS - they've bought into supporting it and have to stay with it. If a business attempts PHP Insights and doesn't like it - they can just turn it off unlike ripping out a feature like a chosen JavaScript library. Perhaps the monetary gain is related to where your product is in the ecosystem of technology - the closer to the end user's eye - the more money you might earn.
---
**Find a Sponsor** (steady $$$)
[https://github.com/iBotPeaches/Apktool](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
Finding a true sponsor overlaps a bunch of the categories we currently have listed. Since a sponsor at times may request features, fixes and constant updates for the stream of funding.
If the company sponsoring you is the company you work at - you may get to re-purpose your work priorities to slip in some open source work at times with no real guide to the specifics. COVID-19 may mess this up with companies pulling funding to stay afloat, but it is a great way to have sustained funding to keep working on a project.
It just has to be clear what the sponsorship entails. Larger companies sponsoring software might have clear requirements what it means, so its always important to realize what you (as a maintainer) might be agreeing to for another sponsor.
Laravel does this in a cool way that sponsors depending on the price have a larger presence on the Laravel website in a marketing way. Since Company A pays Laravel monthly as a sponsor and Laravel in return pushes folks to Company A if they need X,Y,Z done with the software.
---
**Paid Support** (ad hoc $$$)
[https://vuetifyjs.com/en/introduction/enterprise/](https://vuetifyjs.com/en/introduction/enterprise/?ref=connortumbleson.com)
Another interesting method of raising money is just asking for people to pay for support. This is a tough tough thing to do unless you are confident you can solve problems that come your way.
Let me give you an example - way back in 2016 when I was dealing with way too little time and still a solid amount of support requests. I sent this static message to all support requests that were privately messaged to me.
> Due to overwhelming Apktool related personal emails I get, direct one on one support costs $50 an hour to triage and investigate problems. Such a large open source project ran by myself simply has no time for personal emails anymore. If you'd like to continue, I'll send an invoice and we can get you squared away. Otherwise you may try the many sources of XDA, searching the bug tracker, Google Groups and Stackoverflow.
In the 50 to 100 of these I sent only 1 person ever took me up on the offer and I'll tell you how it went.
- I messed up the timezone difference and missed initial meeting.
- Met again and problem was difficult, but identified as a known bug.
- Person was upset that I could not resolve issue and instead told them "*known issue, unknown resolution*"
- Person re-called their $50 via PayPal.
- PayPal sided with them and I lost the $50
I thought it was clear in my messaging that I can't fix all problems, but I at least can triage and identify what is going on. This is a problem I think that is kinda unique to a reverse-engineering tool. Since I don't think its too often that someone supporting a piece of PHP software has an issue that is a low level bug in PHP and they cannot resolve it timely.
So lets look back at Vuetify and Tidelift which offer a way to keep the project up to date as well as providing support. I think this is a solid path
- recurring support for enterprises to know the software isn't going anywhere
- one-off support for that person who just wants some help
The project can stay open source and the funding for support can drive the project to keep been maintained.
---
**Ask for Donations** (manual $$$)
Apktool Finances (private)
The last category, that I think all folks just do no matter what, is an optional donation path for enjoying the software. I've had donations open for Apktool for now a decade and currently sitting at a positive $244 gain, which is roughly $20 a year in support for the project. The costs to me have been near zero until I obtained `apktool.org` to own the `org.apktool` maven namespace.
I'm trying to show that optional donations don't really work in my personal experience. Though, the perception of what people think is entirely different. Lets take a [random Hacker News](https://news.ycombinator.com/item?id=22325625&ref=connortumbleson.com) post where a user is asking how to split up an approved $1,000 donation to open source.
A few extracted comments:
> If you were to donate $1000 to "open source", not much would actually get anywhere useful IMO.
> I think of it this way, no matter what you give, it's a great start.
> In terms of impact, paying for $1000 worth of consulting on an open source project that you use is probably where it's at. "I really want bug #1234 fixed." Pay someone $1000 and it's fixed. (For a bug that takes a day or so to fix, that is.)
A very interesting discussion as legal in a company is the hardest reason donations don't occur according to this thread. Companies can more easily apply for a support contract than do a donation.
This category is one that I've struggled with in the past - I've been guilty in the early programming days of building "All In One" software which effectively just bundles other software together. I got donations, but my software was a weekend project that just launched other software.
In a different example, folks built GUIs for Apktool (cli tool) on various platforms and asked quite heavily for donations. This did bother me, because for a project to push for donations more-so than the project they were wrapping was tough.
This got exasperated further in my brain when I realized that a few popular sites/projects and more simply just wrapped my tool and built a better solution with it. This still happens in large scales with things like [Redis](https://redis.com/blog/redis-labs-modules-license-changes/?ref=connortumbleson.com) and [Elasticsearch](https://www.elastic.co/pricing/faq/licensing?ref=connortumbleson.com) when license changes occur to force the companies that benefit from these open tools to share the profits or code changes. Though, I don't see this often (if ever) when the project is still led by maintainers. In both examples above - this only occurred after a company sponsor came in to run the show.
At one point though when a salary started coming in and I bought software vs stealing it. I realized that I didn't upstream my donations to [smali](https://github.com/JesusFreke/smali?ref=connortumbleson.com) (a project that Apktool uses) or any of the dependencies that Apktool uses from [Guava](https://github.com/google/guava?ref=connortumbleson.com), [JUnit](https://junit.org/junit5/?ref=connortumbleson.com) and much more. So this just tweaked something in my brain that is not my place to care or worry about what project asks for donations or who builds projects solely based on another tool.
---
All I've learned digging up these links and thoughts is that money & open source is such an evolving and difficult thing to perfect. For now, I'll keep my donations open and my open source projects slowly growing.
### Goodhart's Law
URL: https://connortumbleson.com/2022/01/17/goodharts-law/
Last updated: 2025-02-04T11:42:58.000Z
Photo by [Artur Matosyan](https://unsplash.com/@artmatters?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Charles Goodhart back in 1975 said:
*When a measure becomes a target, it ceases to be a good measure.*
So I want to talk about a journey I had where I enforced 100% code coverage on an open source project and started to hate it. So lets roll the clock back a good few months.
I built through work an [open source GitHub Action](https://github.com/marketplace/actions/sourcetoad-phpunit-code-coverage?ref=connortumbleson.com) that can be used to collect coverage percent from a Clover export and use that to enforce a specific minimum amount of code coverage. So when I started a new hobby project, I set it up without much configuration like so.
```yaml
- name: Execute tests (Unit and Feature tests) via PHPUnit
run: php artisan test --parallel -p2 --coverage-clover=output.xml
- name: Code Coverage Check
uses: sourcetoad/phpunit-coverage-action@v1
with:
clover_report_path: output.xml
min_coverage_percent: 50
fail_build_on_under: false
```
This above example will take the output of the `artisan test` command via the `--coverage-clover` calculate the percentage.
So most build outputs in the first few days of this project looked like:
Which was cool that everything worked out, but a \~30% coverage was not very good, especially for such a small project.
I knew I wasn't testing this new [Laravel Livewire system](https://laravel-livewire.com/?ref=connortumbleson.com) I was using, so I set off through 2 semi-large pull requests ([#1](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/54/files?ref=connortumbleson.com) and [#2](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/56?ref=connortumbleson.com)) to add some automated testing.
I was blown away that after just testing my major components, my new code coverage was 81%. So I knew I had to reach for even further.
Prior to that though, I wanted to ensure that no regressions dropped my percent so I changed the above GitHub Action to enforce coverage at 80% or higher and [committed it](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/57/files?ref=connortumbleson.com).
This time with all components tested, I needed better insight into what was not covered. So it was time to leverage my IDE (PHPStorm) as well as look into an HTML report.
I wrote up a quick [Composer command](https://getcomposer.org/doc/03-cli.md?ref=connortumbleson.com).
```
"coverage": [
"@php -dxdebug.mode=coverage ./vendor/bin/phpunit --coverage-html=output"
]
```
so now I was one command - `composer coverage` away from running my test suite with coverage and built report.
HTML Report via PHPUnit
So the HTML report was great and helped me continually push further towards 100%. The interface and report clearly defined which functions and even lines were untouched by tests.
This is where I learned I had to strip out everything from Laravel that I did not use, because that was negatively affecting my code coverage. Additionally, it made clear to me that my console commands had 0 coverage. So this led to the [introduction of assertions](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/60?ref=connortumbleson.com) for console commands and another [pull request later](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/59/files?ref=connortumbleson.com) and I was inching into the 90% realm of coverage.
Once at 90%+ I realized this was getting difficult to push further. Code had to be refactored to be testable and some functions that had safety nets of `return null;` had to be tested even if the possibility of null was near impossible.
It became tough, because imagine a function that throws an exception on error. If you try and return a value from a function, that function contract may be array or null, so you naturally have to support both. Hoever, you know chances of a null return without an exception are near impossible, so this leads to very odd test code to be sure all paths are covered.
Though, it also forced myself to write slightly better code. For example, lets take that above example and see how it looks today.
```php
public function match(string $matchUuid): ?Game
{
$response = $this->pendingRequest->get('stats/matches/retrieve', [
'id' => $matchUuid
])->throw();
$data = $response->json();
return Game::fromHaloDotApi((array)Arr::get($data, 'data', []));
}
```
This block of code does the following:
- APIs out to a service, intentionally throwing an exception if any non-20x is returned (Guzzle)
- Attempts to parse the response into JSON (Http Facade)
- Hydrates the response into models, but ensuring an array is passed into the hydration (Eloquent)
- Finally, returning `null` if the hydration could work.
This is easy to test, because:
- An exception bubbles out, thus tests sad path
- A null path is simply mocking a null return on a 200
- A happy path is mocking the real 200 payload.
So after a few changes like that, I was now [around 95%](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/61?ref=connortumbleson.com) with a pull request.
The move from 95% code coverage to 100% coverage, a meer 5% took longer than building the project from nothing to initial deployment and this is no joke.
Enums became a stress point with every possible enumeration needing testing, so I became quite fimiliar with [Laravel sequences](https://laravel.com/docs/8.x/database-testing?ref=connortumbleson.com#sequences), so I could simply have generated models in test bounce between a variety of possibilties. Paired together with an amount of iterations equal to the sequences and all possible enums were ran.
Though, I sat at 98% and struggled with the remaining changes which required micro changes to how logic was returned. Pairing fighting against a 100% goal while having linters (PHPStan) also battling my syntax was tough.
Though, I finally did it. [One pull request](https://github.com/iBotPeaches/LeafApp%5FInfinite/pull/63/files?ref=connortumbleson.com) went up setting the coverage to 100%. I quickly learned that Faker randomness can lead to sub 100% coverage so patches kept coming.
---
Now the project was enforced at 100% and I wanted to work on features. What used to be a fun creation and quick iteration, was now stopped abruptly into every single bit of experimental code was tested.
I can see this argument for mission critical systems or even enterprise, but a little hobby project was draining my energy. Though, I continued to push on with the enforcement for the sake of this eventual blog and being able to proudly say I have an open source Laravel project at 100% code coverage.
So take a look. Chances are we are still at 100% coverage - [https://github.com/iBotPeaches/LeafApp\_Infinite](https://github.com/iBotPeaches/LeafApp%5FInfinite?ref=connortumbleson.com).
### Poems
URL: https://connortumbleson.com/2022/01/10/poems/
Last updated: 2025-02-04T11:42:58.000Z
Photo by [Thought Catalog](https://unsplash.com/@thoughtcatalog?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Around 15 years ago I had a school assignment to produce poems in many different formats. I recently stumbled upon those poems I wrote and now posting them here to be digitized. I read them and realize to most, I look like a deranged child and to others just another random kid.
So enjoy. Misspellings, bad grammar and all - a direct port.
---
**~~Sonnet~~ Ballard**
*There once was a goat named Bill*
*He live in the town of Dill*
*He usually took trips to the Hill*
*The goat takes sips of Thrill*
*He takes people to the sawmill*
*Its there, he met Jill*
*They both went to Kansas, where there are no hills*
*They met a prophet named Jim*
*Who told them they were to kill*
*Even though they were at a grill*
*The grill was cold so there was no chance for fish*
*The fish tastes like cherry pits*
*And those pits were dread*
*So the goat left dill*
*And returned to the island of Phil*
*Once again get reunited with Nill*
---
**Free Verse**
*McDonalds, McDonalds how I hate thou place*
*I once met my wife there on a date*
*The service was pitiful, but thats the price I pay*
*Over serer was nice though his name was Nate*
*It was raining and pouring that bad day*
*It still remember my wife say*
*"This place stinks" lets go see another spot*
*My wife kept talking so I said, "Okay"*
*Cause the year is 2037, were taken by bots*
*It all comes down to how you talk*
*Some fast, some slow or who shows the most*
*This poem is dumb, but it ryhmes*
---
**Clerihew**
*Peter Pan*
*Flies across the land*
*To find his girl named Hannah*
*So they can find the Savannah*
---
**Limerick**
*Sometimes you think you know someone*
*Till they pull a gun*
*Then you're on a hike*
*Until they find you and fight*
*The fight is over when one is done*
---
**Preposition Poem**
*Through the land I find a sandman*
*Among him is his band*
*Beyond that is a plan*
*During the plan, it will take the land*
*Below sandman is his enemy Spiderman*
*Between the suits is Peter, kissing Mary Jane*
*Amid both of them sits a man*
*Beneath the man is a bomb*
---
**Acrostic**
**S*uper Cool*
**O*dd in a good way*
**C*ontinually Talks*
**C*onstantly gains friends*
**E*vades the Tomatoes*
**R*eally Enjoys Soccer*
**C*onnor is his name*
**T*umbles, and fall when he walks*
---
**Ballad**
*Technology is soon too good for us*
*It slowly gains more info than Gus*
*As we evolve we improve their world*
*Till were fighting a full wage war*
*We think were imrpoving our daily life*
*When all were doing is killing our bikes*
*It's too soon so pick a side or wait till they decide*
*These machines are pulling our life aside*
*Even Google was become too much*
*Its because Technology is grasphing the Clutch*
*We need to take a stand with everything we got*
*Otherwise we will be left in the dust*
*It's all too easy, they will learn soon enough*
*That were the ones that need to rest*
---
Looking back at this shows a few things:
- I was obsessed with death and weapons, I blame reading a book called "*[Give a Boy a Gun](https://amzn.to/3zE2lHi?ref=connortumbleson.com)*" that I found in the school library and read.
- I enjoyed Spiderman and that kicked off my appreciation for the MCU universe
- I had a good grasp already that technology had a negative side
### Then and Now
URL: https://connortumbleson.com/2022/01/03/then-and-now/
Last updated: 2025-02-04T11:42:58.000Z
Photo by [Avel Chuklanov](https://unsplash.com/@chuklanov?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
In today's online world its a tad bit difficult to read a comment thread without the word "*boomer*" being thrown around as an insult. This is a classic slang term to refer to the Baby Boomer generation of folks that might be out of touch with some current thing.
I want to research salaries, wages, tuition and home prices and see if there is any merit to the constant debates online.
### Tuition
Lets start with tuition and dig into the cost over time, we will use the NCES (National Center for Education Statistics) for these analytics. We can find a [table](https://nces.ed.gov/programs/digest/d20/tables/dt20%5F330.10.asp?ref=connortumbleson.com) that plots tuition + room/board from 1963 to 2020 which is a great range for us to work from.
If we look in 1963 a 4 year college average with included room & board + fees will cost you $1,286 or roughly $321.5/yearly to attend. If we want to take this same value in 2020 we have to decide between public or private schools - so lets do both.
An average private 4 year college average in 2020 with included room & board + fees will cost you $45,932 or roughly $11,483/yearly to attend. A public 4 year college however will cost you $21,035 or roughly $5,258/yearly to attend.
This looks quite alarming with the rise of cost, but before we go crazy. Lets take the 1963 value and apply inflation to it which changes that value to $4,348 for 4 years. Which kinda aligns with the present time of public university offset by about a thousand dollars. Sot lets show a graph to picture these 3 different values over time to see what we notice.
This just helps show that costs are going up quite heavily. A bit unbelievable even accounting for inflation that folks attended college for sub $2,000 total in 1963, though how did the education compare? I think we should apply an average wage over this same time frame and see if we can see any odd differences.
We will do two forms of comparison here, a purely federal minimum wage investigation as well as just a regular average of households income to better reflect a family wage set.
### Salaries & Wages
Starting with a [federal minimum wage](https://www.dol.gov/agencies/whd/minimum-wage/history/chart?ref=connortumbleson.com) lets plot an assumed 40 hours a week for 52 weeks a year salary.
We know that way back in 1963, minimum wage was $1.25/hour - now in 2020 that is $7.25/hour which respectively comes out to $2,600/yearly (1963) or $15,080/yearly (2020). It seems minimum wage doesn't move often and when it does normally a few other rises follow quickly.
I think looking at McDonald's and seeing the price of a burger between 1963 and 2020 would be a cool comparison - we can see how many burgers you can purchase with an hour of work.
- 1963 - $0.15 for a single hamburger \[[source](https://www.sidmartinbio.org/how-much-was-a-mcdonalds-hamburger-in-1963/?ref=connortumbleson.com)\]
- 2020 - $1.59 for a single hamburger \[[source](https://www.fastfoodprice.com/menu/mcdonalds-prices/?ref=connortumbleson.com)\]
So now lets do the math assuming nothing else but the price of the burger:
- 1963 - $1.25 (1 hour of work) / $0.15 = 8 burgers + 5c change
- 2020 - $7.25 (1 hour work) / $1.59 = 4 burgers + 89c change
So effectively an hour of minimum wage work in 1963 vs 2020 will net you half the regular hamburgers it did in 1963\. Is this an indication that food prices should be lower or that minimum wage did not follow the rise of pricing? We haven't even opened up the debate about much the staff should be paid.
So lets pivot away from minimum wage and find some analytics from the U.S Census Bureau for income of households. I think this comparison between minimum wage and food would be interesting to play out except over household income vs tuition for 1 child.
The [survey results](https://www.census.gov/data/tables/time-series/demo/income-poverty/historical-income-people.html?ref=connortumbleson.com) were grouped into 6 groups - fifths from lowest to highest, then a special top 5 percent group. So if we looked at 2020 mean income for all households we get:
- Lowest Fifth - $14,589
- Second Fifth - $39,479
- Middle Fifth - $67,846
- Fourth Fifth - $109,732
- Highest Fifth - $253,484
- Top 5% - $446,030
So yes, the lowest mean fifth looks a little like what minimum wage would obtain. So now, lets plot this since 1967 and see if we see these fifths change over time. Afterwards, we will add in the cost of tuition to see the correlation.
I'm no statistician, but I do enjoy tabulating some analytics into some cool charts. This one above shows that unforunately the lowest fifth even accounting for \~50 years of changes - still only makes minimum wage. Though we can see a larger separation from each fifth as time goes on especially in the realm of the 5% and highest fifth.
So now, we know from above of tuition pay ranging from 4 year public & private universities. So lets drop our scale from $0 - $50k and add in those 3 tuition calculations.
So the lighter lines are from the previous image, this time the scale on the vertical axis caps out at $50,000\. So we can see some interesting points here:
- You could attend public university at minimum wage until \~2003
- Around 2007 not even the second fifth of income could afford any university
- The top 5% skew results
It just seems a bit odd to me that college tuition is rising at quite an insane pace. Students graduate with a ton of debt to work off with salaries that obtain half the McDonald's burgers they got in 1963.
So I think finally a good graph to do would be to find the average home sold from 1963 to 2020\.
The graph above shows just that, with the following important dates to note:
- 1963 - $18,050 (Starting)
- 1987 - $104,700 (100k)
- 2000 - $167,550 (Y2K)
- 2004 - $218,150 (200k)
- 2016 - $305,125 (300k)
- \*Q3 2021 - $404,700 (400k)
This graph when also applied with a trend line produces some interesting results that in order for the line to be properly applied to the data set the starting point has to be negative. I don't think they were giving away homes in the 1960s, so here we are with home prices rising pretty heavily over the trend in the past few years.
Not to mention think about how many years it takes to go up another 100k.
- $0 - $100k roughly 24 years
- $100k - $200k - roughly 17 years
- $200k - $300k - roughly 12 years
- $300k - $400k - roughly 5 years
If this trend continues are we expected to see the average home cost to be half a million dollars in 2025? I think we should apply our average income per household to this chart to see how things align over time.
This graph I think shows that home prices in the early few years were quite close, it still would take minimum wage a solid amount of years, but it wasn't insurmountable. I'm sure you've heard the phrase - "*The rich get richer*", which does seem to have some merit from this graph.
Lets take the 6 years above (1963, 1987, 2000, 2004, 2016 and 2021) and calculate the minimum wage, middle fifth and top 5 percent vs the average home cost. We will have to toss out 1963 for 1967 and 2021 for 2020 to work with our datasets.
| Year | Home Cost | Minimum Wage | Middle Fifth | Top 5 Percent |
| ---- | --------- | ------------ | ------------ | ------------- |
| 1967 | $22,750 | $2,912 | $7,077 | $28,110 |
| 1987 | $104,700 | $6,968 | $26,055 | $118,000 |
| 2000 | $167,550 | $10,712 | $42,233 | $252,400 |
| 2004 | $215,650 | $10,712 | $44,411 | $263,896 |
| 2016 | $305,125 | $15,080 | $59,149 | $375,088 |
| 2020 | $336,950 | $15,080 | $67,846 | $446,030 |
Right out of the gate you can see the top 5 percent average of income in the states can still afford on a yearly basis the entire cost of a home. Probably not truly accurate with everything else that needs to be purchased on a year to year basis, but from the pure facts of the numbers - it is possible.
I think we should repeat this table above, but this time inserting the percentage of income that make up the home purchase over time. Adding in a percent change as we move on.
| Year | Home Cost | Minimum Wage | Middle Fifth | Top 5 Percent |
| ---- | --------- | -------------- | --------------- | ----------------- |
| 1967 | $22,750 | 12.8% | 31.11% | 123.56% |
| 1987 | $104,700 | 6.67% (-6.13%) | 24.89% (-6.22%) | 112.72% (-10.84%) |
| 2000 | $167,550 | 6.39% (-0.28%) | 25.21% (+0.32%) | 150.64% (+37.94%) |
| 2004 | $215,650 | 4.97% (-1.42%) | 20.59% (-4.62%) | 122.37% (-28.27%) |
| 2016 | $305,125 | 4.94% (-0.03%) | 19.39% (-1.2%) | 122.93% (+0.56%) |
| 2020 | $336,950 | 4.48% (-0.46%) | 20.14% (+0.75%) | 132.37% (+9.44%) |
So this shows how much income of a yearly wage will go towards the above average home cost for a select bunch of years. Minimum wage falls further and further with the income only accounting for under 5% of a house. The top 5 percent never had an issue and sway between being 110% to 150% over what is required for the average.
The housing market though looks too difficult to draw anymore conclusions from our data set. Even the middle fifth ranges from being under the trend to above it and the housing market has had a few large issues over these times as well as the economy.
I'll iterate again - I'm no statistician and not here to argue mean vs median and inspect every dot of the graphs. I wanted to run some basic analytics on wage, salaries, homes and school and that is above.
### Understanding Matrix Resurrections
URL: https://connortumbleson.com/2021/12/27/understanding-matrix-resurrections/
Last updated: 2025-02-04T11:42:58.000Z
One [random day 4 years ago](https://connortumbleson.com/2018/01/28/understanding-the-matrix-triology/) I decided to write my interpretation of the previous 3 Matrix films and now a 4th has arrived. So lets dive into this and try and make sense of the reboot. Let me remind again though - interpreting a film may never have a correct answer. This is just mine.
**The Matrix Resurrections (2021)**
We start this film in an eerily close way to how the original movie (*The Matrix*) began. This is down to the exact spoken word between the 1st and 4th film even at times overlaying the original film. However, instead of us recognizing the usual Trinity and actress behind her we are left with someone who the audience does not recognize and additionally we are watching this from the perspective of new characters watching this encounter from within The Matrix.
This new character Bugs helps teach us that we are watching a simulation of the Matrix within the Matrix. This might be a shout out to all the fan theories of the previous films of just that explanation.
The agents are breathing down on Bugs though and we find one agent in particular that is referred to and speaks like Mr. Smith, but is stumbling embodiment of Morpheus. A quick encounter and red pill vs blue pill with this program and it is freed and now sentient losing the behavior of the agent inside.
We loop back to what is perceived as the real world, but obviously the Matrix with Neo back as Mr. Anderson. He is watching his sandbox ("modal") and noticing the breach that Bugs caused and nervous what is happening.
We learn that Mr. Anderson is a top game designer building a trilogy of games that are a mimic to the first three films. We are many layers deep in trying to understand of what is going on - Neo is in the Matrix, but building a game of the Matrix within the Matrix. He sees a therapist who prescribes a blue pill in which Neo abruptly stops taking during this film.
His boss is another walking mimic of Mr. Smith and at times also repeats exact phrases from the earlier films. Like we've become accustomed to at the 20 minute mark to always being reminded of the nostalgia of the earlier films.
Morpheus (The machine iteration) is working with Bugs to extract Neo from the Matrix, but once again agents are intervening. We get to witness another extraction routine that had some slight differences from the original films, but then eventually at the 50 minute mark - Neo awakes in the real world again.
We are left at this point in time lost beyond belief. Neo was killed alongside Trinity in the 3rd film and now the physical real world bodies of both are back alive. As Neo awakes he looks in front of his battery pod and spots Trinity's pod. Both of these pods are elevated and positioned in a way that suggests these batteries are far more important than the rest. Which does poke a plot hole on why one of those bodies can be awakened with no other legitimate machine enemy reacting in time.
Neo struggles to return to the real world immediately and instead has to take part in various Matrix simulations with Morpheus to help realize that his current life was a lie. When this is done we learn that Zion no longer exists and our followed ship (*The* *Mnemosyne)* is heading back to the newest human refuge - Io.
We meet Niobe who has aged 60 years and reminds us of what happened since Neo's war with Mr. Smith in Matrix 3\. Turns out that famous battle in Matrix 3 had some side effects that awoken or introduced sentience in some machines. It was clear the war of Zion vs machines would never end - so Io took a different approach with humans and some machines working together.
We know from an explanation that wars broke out between the machines after the 3rd movie because the source of power was diminishing. This led to a new machine power rising known "*The Analyst*" with "*The Architect*" falling out of the picture as told from Niobe via The Oracle. We learn the human Morpheus after the 3rd movie was elected to the council and then passed of old age.
So now we have Neo in the real world wanting to go back into the Matrix to unplug Trinity and reunite the pair again. Basically a role switch from the 1st movie where Trinity was unplugged rescuing Neo and now Neo is rescuing Trinity.
Near instantly after jumping back into the Matrix we find that Mr. Smith has stumbled upon the group with additional exiled machines. The machines strangely want the Matrix back to the previous iterations, because at that time exiled machines were not purged. So the success of the older programs like Mr. Smith and The Merovingian just want to return to an older era by killing Neo.
A fight breaks out, but now Neo is beginning to realize that his powers have no limits in this Matrix world. He ends up defeating Mr. Smith again with an extreme use of power and they are off to rescue Trinity/Tiffany.
Unfortunately as Neo encounters Trinity we finally learn the therapist or Analyst is the one pulling all the strings. This is where many dots are connected from the previous films. The Analyst exposes a new feature known as "bullet-time" so the machines can control the timing of the Matrix slowing the humans jacked in.
This begins the monologue and boy we learn a lot. The Analyst was present when Neo died at the end of the 3rd movie or as they refer to him as The Anomaly. They realized Neo generates such immense amount of energy inside The Matrix that when Neo was gone - power was less than intended. The Analyst then convinced the "suits" or machine overlords to resurrect Neo and Trinity
Through a slow expensive process of rebuilding tissue and matter. Neo and Trinity were born again the real world to be immediately jacked back into the Matrix. However, it was learned that if they were split up there was no benefit of energy - just two additional batteries in the cog. United though and the simulation or Matrix would collapse - so the Analyst found a happy middle. A simulation where both Neo and Trinity would see each other, but due to some tricks and stimulation never really connect the dots together.
Neo suffered from a machine manipulation that made his personal perception of his image different than how every other machine saw him. At times though characters and even machines could recognize the true behavior under a false skin and realized Neo was himself all along.
The monologue continues explaining the previous iterations of the Matrix worked on facts and stats which is not how the human brain works. The Analyst moved to an approach that mixed desire with fear and human subjects never attempted to leave their pod, because they feared what they couldn't have and desired to keep the same old life moving.
Neo escapes back to the real world and the ship he accompanies is marshaled back to Io for violating orders. While discussing with Niobe a familiar machine from the 3rd movie returns. Sati, the tiny girl from the train station has now grown up and offering information and help. Shes a machine after all, so maybe she controls how she wants to look in The Matrix because she sure as hell doesn't look 60 years older.
Sati's father is the architect behind the resurrection pods that Neo and Trinity were enslaved in. Sati now holds the secrets to this resurrection chamber, a knowledge she obtained, but a death price her father paid for sharing it. This knowledge was not known to Niobe so this kicks off a game plan explained while the plan is being executed during the explanation. This reminds me of the 2nd movie while the key maker is explaining what needs to be done - as its done.
The plan to rescue Trinity is on, but this time this isn't a classic red pill and rescue. This is a live unplug of Trinity when the time is right. This isn't exactly clear how this works, especially since the first few movies established that unplugging a brain while trapped in the Matrix is suicide. However, we now have machines following our characters with the ability to jack into the Matrix at a moment's notice so perhaps this is what allows the bending of rules.
Neo, back in the Matrix, visits the coffee shop to meet with Trinity. However, The Analyst and a bunch of agents are already present. This helps enforce that this iteration of this Matrix is more focused about the individual livelihood of Neo and Trinity than a shared space to enslave all humans.
Trinity arrives, which surprises me, since what enslaved human enters a coffee shop with 98 police officers shoulder to shoulder to obtain a coffee. It's clear she already understands or at least dreams that this life is not her own. It sounds like Tiffany (Trinity) may not believe this new life, but it only takes a few moments until it clicks in her head. She says the famous - "*My name is Trinity*", which is a flip of "*My name is Neo*" from the previous films.
Trinity's dream is now being lived in the Matrix - Neo and Trinity are united, but the Analyst intervenes and freezes time. It seems quite bleak until Mr. Smith returns to resume time after a short battle with The Analyst. Mr. Smith's loyalty is still confusing, but at times both Neo and Mr. Smith will have a common enemy of The Analyst.
With The Analyst temporarily subdued from Mr. Smith, our two main character escape the scene to attempt to leave The Matrix. Neo is showing an increase amount of world breaking power to bend energy as Trinity races through the streets.
The real world preforms a hot swap on Trinity's brain to unplug her from connection in the resurrection pod to the mobile machine station using Bugs to trick the machines. This apparently unlocks her connection to truly understand the fake world in which she is imprisoned and creates an odd temporary effect (shown above) in The Matrix. Trinity shares the same gift of Neo to manipulate the Matrix, but the Analyst returns for a brief moment to activate "Swarm" - which turns all imprisoned minds against the threat as Neo/Trinity continue to escape.
While the Analyst also sent thousands of Sentinels to kill the resurrection bodies in the real world - they are too late. A bit unbelievable given the time, energy and effort to resurrect those bodies and yet no sentinels were guarding the actual resurrection chamber.
Neo and Trinity race and escape until they find themselves on top of a roof. Trinity shows an extreme change of power and can levitate & fly. She stops their suicide jump and while not shown in picture gets them safely ejected from The Matrix.
The music begins to play and it seems this movie was setting up another possible sequel. Trinity and Neo are back in the real world, but both make visits to The Matrix with the ability to fly and manipulate energy. They make one last visit to the Analyst for a few words.
They question the Analyst why he hasn't been purged and we learn the Analyst still understands enough about humans, Neo and Trinity to be kept alive by the machines. The movie ends with Trinity and Neo promising to make some changes to the Matrix to help the enslaved minds as they fly around together.
### Building a CTF
URL: https://connortumbleson.com/2021/12/20/building-a-ctf/
Last updated: 2025-02-04T11:42:59.000Z
["CTF Suit"](https://www.flickr.com/photos/38451115@N04/5492301645?ref=connortumbleson.com) by [pasukaru76](https://www.flickr.com/photos/38451115@N04?ref=connortumbleson.com) is licensed under [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/?ref=openverse&atype=rich)
On December 3, 2021 I hosted a CTF (Capture the Flag) for my workplace (Sourcetoad). For those unaware, you aren't running outside to find a real life flag in this iteration. This is a contest where competitors have a list of challenges to individually compete in - these all revolve around solving some challenge to obtain a "flag" (In this case, a string of characters).
### Finding a platform
So right out of the gate you'll need to find a platform to run this contest. If you are enormous company - chances are you might already have an internal tool or [open sourced iteration](https://github.com/We5ter/Awesome-Platforms/blob/master/CTF-Platforms.md?ref=connortumbleson.com) of a platform.
For me, I found two services that appeared to offer custom built CTFs, which was [CTFd](https://ctfd.io/enterprise/?ref=connortumbleson.com) & [Hack The Box](https://www.hackthebox.com/business/business-ctf?ref=connortumbleson.com). The pricing page for CTFd had plans from $50, $100 and $300 and I could not find any pricing on Hack The Box without asking for a quote.
[CTFd Pricing Page](https://ctfd.io/pricing/?ref=connortumbleson.com) (12/19/2021)
So at that point, I decided to go forward with the Basic plan ($50/month) of CTFd. I'd honestly only ever competed in 1 CTF prior and I was already building my own, so figured I would start small.
### Building a theme
Now that I had a platform, I wanted to make sure I kept a theme among the CTF. Much like you take the effort during a presentation deck or matching decor at a wedding - I think a unified theme during a CTF helps draw it all together.
Knowing that a bad website intentional design took place at work once, this seemed like a little effort pattern to continue. So I just looked for intentional bad CSS frameworks and stumbled upon Geo for Bootstrap, a 2.3 iteration of Bootstrap mocking Geocities of the past.
[Geo for Bootstrap](https://code.divshot.com/geo-bootstrap/?ref=connortumbleson.com)
While this theme was a perfect vision of a bad site, I wanted to tone it down a bit so it was easier to read text/information. However, prior to doing that I wanted to extract the framework into one small compiled file with inline images so I could attach it to each challenge easily.
Just in case a competitor got obsessed with this compiled file, I left a note in the credit of the file.
```css
/*!
* Bootstrap v2.3.1
*
* Copyright 2012 Twitter, Inc
* Licensed under the Apache License v2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Designed and built with all the love in the world @twitter by @mdo and @fat.
* There is nothing in this file that is part of the CTF. It was simply added to speed the design of the template.
*/
```
So no competitors would get lost in trying to dig through this file for some hidden secret. Looking back, a few folks did bring up these comments for any uninvolved files and appreciated the hint to save time digging into them.
So now I had a theme easily attachable to questions which built a page that looked like roughly (Question 1) like:
### Building the challenges
Now this part is not going to be easy, the more help you recruit to build these - the less folks that can honestly take part in the CTF (since they helped built it). Now this doesn't really apply again at huge companies, because a large company might just designate Team A to build the CTF and all other teams to take part.
My company was 50 people though and probably only \~35 engineers, so I wanted to build all the challenges so every other person could take part without knowing anything ahead of time.
Challenges normally fit under categories and that is highly specific to each organization and company. We specialize in web & mobile software so I took focus to all types of web challenges:
- OWASP Top Ten
- Basic Cryptography
- Basic Stenography
- Laravel Vulnerabilities
- PHP Vulnerabilities
- Scripting Exercises
The [OWASP Top Ten](https://owasp.org/www-project-top-ten/?ref=connortumbleson.com) were going to be the main focus point, but designing intentionally insecure challenges that leveraged all of those got a bit difficult. This is where designing a simple question to hide text in an image exif data could pad an additional question.
Finding an older CVE for either Laravel or PHP helped for many challenges. For example:
- [Expecty Bindy](https://github.com/iBotPeaches/ctf-2021/tree/master/solutions/30-expecty-bindy?ref=connortumbleson.com) (Question 30) - [CVE-2021-21263](https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x?ref=connortumbleson.com)
- [Poison](https://github.com/iBotPeaches/ctf-2021/tree/master/solutions/32-poison?ref=connortumbleson.com) (Question 32) - [CVE-2006-7243](https://nvd.nist.gov/vuln/detail/CVE-2006-7243?ref=connortumbleson.com)
- [Mass Effect](https://github.com/iBotPeaches/ctf-2021/tree/master/solutions/27-mass-effect?ref=connortumbleson.com) (Question 27) - [CVE-2020-24940](https://nvd.nist.gov/vuln/detail/CVE-2020-24940?ref=connortumbleson.com)
- [Ignite](https://github.com/iBotPeaches/ctf-2021/tree/master/solutions/25-ignite?ref=connortumbleson.com) (Question 25) - [CVE-2021-3129](https://nvd.nist.gov/vuln/detail/CVE-2021-3129?ref=connortumbleson.com)
[https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x](https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x?ref=connortumbleson.com)
These were a great dive to really fully understand vulnerabilities reported. For example, lets take `CVE-2021-21263`. This was not too long ago so I attempted to exploit this for a challenge and it refused to work. The note as shown above just shows the Laravel versions affected, but I continued to dig into this until it made sense.
Turns out this was being tracked in [PHP bug 72368](https://bugs.php.net/bug.php?id=72368&ref=connortumbleson.com), which was a bug to explain that if the amount of variables does not equal the amount of tokens passed then an exception should have been raised.
PHP member (mbeccati) left a comment and said:
> Moving to `pdo_mysql` as both `pdo_sqlite` and `pdo_pgsql` raise an exception, as expected. I haven't tested the other drivers, but I will attach a patch that adds a PDO Common test for the issue.
So this explains why my test CTF challenge using SQLite did not work as well as PostgreSQL. This also explains why using using MySQL on PHP8 was also not vulnerable, instead giving me:
```
SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens
```
So I learned a lot and I honestly wish these details were included in the original CVE, but were not. This issue was really only for MySQL drivers at PHP74 or lower and that was not listed.
Moving back to the general set of challenges, one thing that is continually difficult is identifying a difficulty for a challenge. This takes a good amount of thinking how your competitors will attempt these challenges - what helped here for me is finishing the CTF weeks prior to the date so I could have two friends run it through to check the difficulties described.
Additionally, knowing my work uses a form of the modified Fibonacci sequence for estimating work - I tried to stay true to those estimates when creating challenges.
### Scoring the challenges
This is one part I would easily change if hosting another CTF. You can have so many different types of scoring and I was attracted to the [Dynamic challenge](https://blog.ctfd.io/challenge-design-improvements-in-ctfd-v1-0-5/?ref=connortumbleson.com) point scaling that CTFd offered. It sounded clever because the question points decrease as more people solve it. Though in theory, end users don't like it and losing 1 or 2 points even as that decay affects others is not appreciated well.
This is what my challenge breakdown looked like after everyone went through. Since I used a 30 solve max until 5-20% of the question points were gone - most questions did not decay at all. However, some questions that were originally 100 points had fallen all the way to 80\. This is just all about finding the best configuration for your setup.
If I was building a CTF for the entire world to take part, then yes this point system sounds perfect for it. However, an internal company event was not the right call for this.
### Hosting the event
If you are using a service - you have to trust the service will work and focus your effort elsewhere. I used this time to have the scoreboard live and refreshing every 5 minutes as well as just listening to the chatter of folks solving challenges.
You might have to intervene - like one of my questions that intended folks to use a specific online steganography site had somehow a similar, but different image uploaded to it that conflicted with mine. So all folks that attempted the challenge were getting an error when they shouldn't. So I [remade challenge 6](https://github.com/iBotPeaches/ctf-2021/commit/795d86e2df95d6bd4c4459cefd925ed05e18bff7?ref=connortumbleson.com) on the fly during the event.
You might have to adjust a hint live or toss out some vague tips n tricks to keep folks engaged. As the event nears the end, keep folks up to date on first solves of complex challenges and make sure to present some sort of analytics at the end.
I made sure to draw focus to many stats
- Most solved challenge(s)
- Least solved challenge(s)
- Most 1st solves
- Top 10 scores
This helps give props to the competitors that placed in various fields and helps see which challenges were easy or hard.
### The aftermath
At this point - your event is over. You can either keep it running for a few weeks to let folks take part outside of a work sanctioned event or just end it. Whatever you decide - I believe its crucial to provide solutions for all challenges to let the confusion that plagued competitors be resolved.
These can be simple markdown docs collected in a [folder](https://github.com/iBotPeaches/ctf-2021/tree/master/solutions?ref=connortumbleson.com). After all of that is done - you've successfully created, organized, built and solved a CTF.
### My Halo Journey
URL: https://connortumbleson.com/2021/12/13/my-halo-journey/
Last updated: 2025-02-04T11:42:59.000Z
["Halo 3 Teaser"](https://www.flickr.com/photos/42137365@N00/316683461?ref=connortumbleson.com)by [ehavir](https://www.flickr.com/photos/42137365@N00?ref=connortumbleson.com) is licensed under [CC BY-NC-ND 2.0](https://creativecommons.org/licenses/by-nc-nd/2.0/?ref=ccsearch&atype=rich)
Halo Infinite came out with campaign a few days ago and this was the 8th major Halo game I've played. Some video games come out yearly, but Halo does not and the first Halo came out way back in 2001\. So lets turn back the clock and and go through each Halo with a bit of personal commentary.
### Halo: Combat Evolved (2001)
Image from [Halo: Combat's Evolved Best (& Worst) Maps](https://screenrant.com/halo-1-best-maps-worst-ce-xbox-multiplayer/?ref=connortumbleson.com)
The original Halo that started it all, famously rumored to be originally intended for Windows/Mac until the Microsoft purchase of Bungie (Company behind Halo) leading to a launch title for the original Xbox.
I didn't actually get to experience Halo until running into a family friend who had both an Xbox and the game. Our family did not have an Xbox and it took way too much convincing and chores to even get our first console of that generation - the Gamecube. I think the industry looks back at the Gamecube as a failure and I would agree when I first got to an experience an Xbox with Halo.
The controller with two sticks to navigate took some skills to master, but the game felt so fluid in comparison to like 007: Nightfire on Gamecube. You felt more in control of your character and competing against friends led to thousand hours of fun. Though, Halo CE lacked one thing that the future Halo's would pioneer and that was networking.
---
### Halo 2 (2004)
Image from [Halo 2's Original Ending](https://screenrant.com/halo-2-original-ending/?ref=connortumbleson.com)
Halo 2 for me is probably lodged as the best video game of all time. This game released improving on every aspect of the previous Halo, launching an insane amount of features.
Lets talk first about how this game launched with matchmaking which folks today just assume every game will have. The ability to simply party up with friends and enter Xbox Live and be matched with an enemy team was insane. The past of this was either networking with LAN events or tricking games together with dedicated servers to bridge a LAN environment. Not only did Bungie add matchmaking, but friends/clans and complex online stats existed.
The legacy "bungie.net"
Looking at game's launched today, some games don't even offer a way to have insights into stats from played games. Bungie did this 20 years ago when hosting websites was probably a bit more complex at a big scale.
The game had an insane campaign that pushed Master Chief (Spartan 117) further into media and culture worldwide. This game led folks to camping out at Best Buy days in advance - what other game started this culture?
Halo 2 is also what started showing how easy it was to cheat in these games as well as modify an Xbox. This led to my journey of [modding each Xbox](https://connortumbleson.com/2020/04/27/3-generations-of-halo-modding/) as well as converting one Xbox into a [media center](https://connortumbleson.com/2018/01/21/my-original-media-center/).
The game is what brought global attention to competitive gaming with MLG (Major League Gaming) showing that a career can be made playing video games. The nerd students were talking about [Walshy](https://twitter.com/walshy?ref=connortumbleson.com) and [Orge2](https://twitter.com/TomRyanOGRE2?ref=connortumbleson.com) so even the names of pros were known.
With the revolutionary online multiplayer I could not stop playing this game. Unfortunately as mentioned above I dug into the unethical cheating aspect of this game and many accounts were banned. For a good part of this journey though, I did compete legitimately and enjoyed every moment of playing like 1 flag CTF on Headlong.
As rumors became real - the Xbox 360 was launching and a new Halo title was coming with it.
---
### Halo 3 (2007)
[From Halo 3 CGI "Starry Night" (Superbowl)](https://www.youtube.com/watch?v=GKDkKKt9Y7I&ref=connortumbleson.com)
A new Xbox was here (Xbox 360) and Halo 3 was firing on all cylinders in the marketing department. Seeing the above commercial during the Superbowl just sent shivers down my spine of another Halo game coming.
This campaign was insanely good, we learned so much about the lore and it ended on such a cliff hanger, with the Chief presumed dead to the masses floating out in space in cryosleep.
The multiplayer launched with maps like The Pit and Guardian with remade maps like Blackout (Lockout) and Last Resort (Zanzibar) from the previous game. The game felt crisp and a new ranking system was introduced with real military ranks alongside a number between 1-50\. This is where the phrase, "*I'm a General in Halo 3*" came to be.
I played 4,179 games on my account, power leveled a few friend's accounts to Level 50 and just never got bored of this game. It had an insane amount of customization with the introduction of Forge (map editor) and Theater (watch games) which took machinima to a new level.
The competitive scene grew even larger and Halo 3 had the team names that all Halo folks had memorized - Final Boss, Str8 Rippin and Carbon.
After a trilogy of games - many wondered if the reign of Halo was over and it did seem that way until another game launched.
---
### Halo 3: ODST (2009)
ODST launched including Halo 3 multiplayer, so this game might not be able to be qualified as a full game. However, the Firefight mode of playing against harder and harder enemies was revolutionary again.
This was the first game so far to not focus on Master Chief, instead learning about the lives of the troopers that dropped in. The campaign and gun battle was nothing like Halo 3, but was niche and unique enough to really play well. Firefight was played for hundreds of hours attempting to beat levels like the addiction of playing 50 waves of Horde in Gears of War.
Though many were waiting for the next big Halo and Halo 3: ODST was all they needed to hold them off for the next big release.
---
### Halo Reach (2010)
Halo Reach would be Bungie's last Halo game as after this game they decide to split from Microsoft leaving the IP of Halo behind to go create the Destiny franchise.
*As an aside, Destiny 1 ended up taking 2,000+ hours of my life, so I followed Bungie at first before returning to my roots in Halo.*
Reach was showing another side of the Halo ecosystem with a team without the Chief. This was an odd campaign for me, because before you even start the story you know the outcome of this poor team. We follow Noble Team as they attempt to evacuate Cortana from the falling planet of Reach and we know since Halo 1, 2 and 3 occurred that Cortana is saved and Reach falls.
So I just found it a quite bit odd to play a campaign when the story is already known.
The multiplayer here is where my first distaste for the Halo franchise began. Halo Reach introduced bloom, which in short is your shot landing anywhere in the bubble around your aim. The faster you shoot - the larger that bubble becomes. So even if the reticle itself was directly where you intended - the shot might land elsewhere.
This was infuriating beyond belief, even if at times it worked in your favor. It rewarded slow shooting to keep the bubble small, but even then every gun battle was luck based instead of skill. I never really understood why this was added and I don't think the pros did either. Since Halo Reach was removed from the MLG Pro Circuit after only 1 season of a full circuit.
As many begged though, a patch came out. Now bloom was configurable and removed in some playlists, it was a mix of starting weapons depending on the playlist and it just seemed like the game didn't play well. Additionally, taking over a year to fix an issue that caused so many to quit didn't sit well with me.
I gave up playing Halo Reach at Colonel Grade 3 because it seemed to me that Bungie was more focused on their new journey (Destiny) and it was time for 343 (The new company behind Halo) to prepare the next iteration.
*Before 343 Industries released the next major Halo though, they did release an anniversary refresh of the first Halo on the 10 year anniversary. This added such an unique campaign experience that a single button click would pivot you between the original graphics and the new. Since the MP aspect was built from the Reach engine, I figure its not worth discussing this refresh.*
---
### Halo 4 (2012)
Halo was back and this time Master Chief was the focus! 343 Industries had announced that a new trilogy of games code-named Reclaimer had begun. The connection between Chief and Cortana was insane and the story went into parts of the Halo universe that I was completely unaware of.
This was such an immersing Halo with cut-scenes looking as real as movies as they dove into the spartan program and how children were exploited to create soldiers. The Forerunners were front and center with the Didact. This was a ruthless bad boss that at multiple points in the campaign just killed people instantly. This reminds me how a killer would truly act, because any film/game that has delays surrounding a death so something can intervene isn't being truthful.
This campaign also started adding a sad tale to the Chief and Cortana story, because she was reaching the end of her AI time deteriorating her code known as rampancy. At the end of this campaign we see her pretty much sacrifice herself to save the day.
Unfortunately, this campaign was short and multiplayer introduced load-outs, sprinting and ordinance drops. It just honestly felt like a Call of Duty game to me, because why would Halo which had never had load-out spawns ever introduce them? You could spawn with a different variety of guns and that is not Halo.
The REQ packs and magnetism on weapons also just didn't feel like Halo. I could have like 20 different versions of a Battle Rifle and those different versions were more than just visual. So it was just maddening that a friend could spawn with a more powerful weapon than me from either spending more money or having better luck.
So I stayed in basically one playlist that was consistent with gun battles, but I knew that while I enjoyed this game - it didn't hold me anywhere near Halo 2 or Halo 3 did. It seems it was just a rough patch for the Halo series, because even the Pro Circuit for Halo 4 did not excel. There was only 1 official MLG event for the game, so once again alignment between the casual and the pro of the state of competitive play.
Now Bungie left 343 Industries with Halo Reach which was not well perceived and 343 had to grow into the shoes of holding the mantle of Halo. Unfortunately attempting to compete with Call of Duty and the inching of monetization into the game was not classified as a success to me. However, there were two releases on the horizon to attempt resolution of this issue.
---
### Halo: The Master Chief Collection (2014)
With Halo 1 getting a 10 year refresh, folks were definitely hearing rumors of a new Halo on the 10 year anniversary of Halo 2\. This was my anticipated jam - a Halo that included all the other Halo's combined & remastered iteration of Halo 2\. I could now hopefully play my favorite Halo 2 and 3 on the Xbox One.
My hope was crushed and it seriously affected my love for the series. I had never bought a game before that just didn't work. Games never started in matchmaking and if they did - the leader could just boot people. Partying up with friends was near impossible, requiring all to be on the dashboard with game closed then joining together slowly.
I blogged [about](https://connortumbleson.com/2018/09/02/halo-mcc-redux/) this in detail, because if we look at the original date of Halo MCC at 2014 - the game effectively did not work until August 27, 2018\. So remember as we go through this remaining timeline that 2018 restored my trust in 343, but I purchased a game that simply did not work as advertised for 4 years and sulked.
However, in certain settings of custom lobbies patches did come out to resolve game-play so pro play could occur on Halo 2 Anniversary. So yes, we did get to experience about a year competitive lifespan of H2A which was a good trip down memory lane to watch. Even if the game frequently crashed or had issues during the competition. Though, it kinda hurt because H2A did not play at all like Halo 2 to me.
I can't claim that Halo 2 this many years later plays as a great game, because you can play it on MCC now and it doesn't feel that great compared to normal shooters. Though, playing Halo 3 on MCC was very fun - it was just the mixture of seasons, DLC and more on a broken game that pushed me to games like Overwatch and Borderlands instead of playing Halo. That was until the next major non-anniversary Halo was launching.
---
### Halo 5: Guardians (2015)
A new Halo was out on a new console (Xbox One) and it waged Spartan Locke against the Chief in the classic portray of the leader going rogue, but going rogue for the right reasons. We had to watch the remaining bits of Cortana fall rogue, Spartans compete to only join together against the true enemy. The lore was so invested in the Forerunners and these huge structures known as Guardians.
Cortana who was once just an AI in the head of Chief, becomes a flawed enemy attempting to cleanse the world via forced allegiance to the Guardian she controls. We are left ending this campaign with corrupted Cortana controlling Guardians across the galaxy as the chief sits on the UNSC Infinity.
On the Multiplayer side, we got the most configurable custom game/forge mode ever. I can't even remember how many hundreds of hours were spent playing custom Halo 5 games like Duck hunt, Toilet bowl, Sumo and more. It was the first Halo game for me that I spent more time in the social and custom games instead of grinding ranked for a competitive score.
I could probably make excuses why I didn't play ranked as much, but the game was too tough to play for me. Sprint was added and while the weapons felt clean, the maps meant that you could basically be anywhere in seconds. I just remember the stress of attempting to hold high ground, but there were like 9 different routes I could be ambushed. I think back to like Halo 3 "The Pit" and I can remember sitting on sniper tower and knowing exactly what few angles could attack me.
Aiming with stabilizing, clambering and ADS (Aim Down Sights) mixed together with sprinting just changed the game. Halo was meant to be played with map control and controlling weapons, but it turned into another just run and gun game.
Pro play finally had a place for Halo 5 and the first million dollar tournament was in the game. Tournaments continued with new names entering the scene as players moved industries due to the decline of Halo competitive play since the release of Reach.
I was also at a different place in life when Halo 5 came out - I was trying to graduate college and get a job. Moving here and there really meant that there wasn't that much time like the past to just play Halo. So every time I returned and got destroyed - I realized you really had to play Halo often to stay good at it.
I enjoyed building stat sites though as Halo 5 launched with an amazing API. I built [Leaf](https://connortumbleson.com/2021/03/08/project-leafapp/) for the competitive insight into leaderboards as well as [PandaLove](https://connortumbleson.com/2021/02/22/pandalove-clan-site/) to track personal clan games and stats.
Years went on and the scene faded and Halo 5 competitive play ended with a few pop-up tournaments to return to the then patched Halo MCC (2018). It seemed like 343 Industries focus was now back at fixing MCC and we might not get another major Halo.
That was until an [E3 demo](https://www.youtube.com/watch?v=Fmdb-KmlzD8&ref=connortumbleson.com) in 2018 advertising the new [Slipspace Engine](https://www.halopedia.org/Slipspace%5FEngine?ref=connortumbleson.com), but as everyone now knows - COVID was near and the next Halo would not be released until 2021.
---
### Halo Infinite (2021)
Was it COVID? Was it a new game engine? Was it the fixing of MCC? The final game of the Reclaimer trilogy was released 6 years after the release of Halo 5.
The game launched directly to PC and Xbox boosting a 120FPS on consoles and was free-to-play for multiplayer. Cross-play was native allowing Xbox and PC gamers to play together with no issues - a feature that became popularized by Fortnite.
After the loot box drama of Halo 4 and 5, Infinite did away with loot boxes instead opting for a complex chain of seasonal unlocks for customization. However, already a few weeks in this appears to be greedily designed. Many unlocks are simply rewards to "challenge swap", which swaps a challenge to alternative one. You are forced to use these because you cannot pick a specific type of playlist - leading to challenges incredibly difficult to obtain. This pushing most to believe that you are supposed to spend more money to unlock more things.
You can grind and play for 150 games and unlock the color blue that looks identical to the color blue given to you at start. You may unlock a visor, but its only for a specific armor. You can't mix and match to create a personal spartan, so you are left grinding a game for next to 0 XP to unlock 1/12 of a specific spartan design.
*EDIT: The has been changed to 50 XP per game*
*EDIT2: This is now daily XP for just playing*.
The game launched with a new training mode with bots and weapon training, but announced that Forge would not be ready till Season 3 (ETA 6 months). Campaign co-op mode is additionally not ready at launch and won't be till Season 2 (ETA 3 months).
Halo Waypoint [announced](https://www.halowaypoint.com/news/welcome-to-vnext?ref=connortumbleson.com) it would release a "vNext" a newly designed iteration site to see all your stats!
Though, it launched and the famous tab called "Stats" shown on the release blog post was no where to be found. So the entire current purpose of Halo Waypoint for Infinite is for customization, looking at your Battle Pass and buying credits for monetization.
This just bugs me. The game took years on years to build with the longest Halo release cycle ever. The game lacks features that many other Halo's launched on day 1\. The game added features that I spent sub hour on and will never return. It has no official stats outside of the game. The game launched with 1 ranked playlist just called "Arena". A Halo game after 20 years that didn't launch with Team Slayer just blows my mind.
Though, I'm incredibly conflicted. The game plays in combat very well and feels like old Halo to me. I love the gun battles and the classic game modes are back with a slight twist. The work 343 Industries did with pro players to adapt the sandbox was the right move. Though, I fear there is an internal struggle with upper management to become Fortnite rich affecting the other purposes of the game.
I've had to see Bonnie Ross apologize once for the horrible launch of Halo MCC and watch previous Halo's get abandoned from pro play. I don't want to see another Halo game fail.
Perhaps I'm being too harsh. Halo 2 had one console to support. Halo Infinite supports PC and a variety of different Xboxes. Perhaps games are getting way too complex and this is leading to features being cut and more. However, when I see a flawless feature involving monetization my thought changes back to greedy management.
Halo Infinite is still brand new only officially released under a week ago so I'll give it time. Especially since my childhood was Halo I deserve to get this game a chance.
### Adpocalypse
URL: https://connortumbleson.com/2021/12/06/adpocalypse/
Last updated: 2025-02-04T11:42:59.000Z
Photo by [Dennis Maliepaard](https://unsplash.com/@dmaliepaard?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This year is 2021 and advertisements are everywhere. Not only are they everywhere, but even services that cost money have even resumed putting ads in our face.
Is this greed? Is this the other side if selling data is prohibited? I'm not sure, but even my [Pi-hole](https://connortumbleson.com/tag/pi-hole/) even struggles to block advertisements these days. Ads are no longer 3rd party domains jacked into a website, but instead directly built into the product itself.
So lets start with Twitter, which has crippled 3rd party applications to force all users onto the official Twitter website and app. This application has so many flaws from intentionally breaking [chronological order](https://connortumbleson.com/2018/05/27/the-death-of-chronological-order/) to shoving full screen ads in my face.
Sorry, your browser doesn't support embedded videos.
Like look at the above video and see that in 18 seconds I saw 3 ads that took up probably roughly 80-90% of the vertical space on my phone. Scrolling my Twitter feed is more about shoving as many ads down my throat as possible. To make matters even worse, I see them advertising a 2.99/month "Twitter Blue" feature that doesn't even remove ads!
> **Is Twitter Blue ad-free?**
> No. Currently, ads continue to fund our ability to innovate as we grow this new part of our business.
> [https://help.twitter.com/en/using-twitter/twitter-blue#tbadfree](https://help.twitter.com/en/using-twitter/twitter-blue?ref=connortumbleson.com#tbadfree)
Call me crazy, but I thought the entire purpose of Twitter Blue when it was rumored was to remove ads. Instead it just adds these features:
- Undo Tweet (Just delay tweet before posting)
- Top Articles (Just a query)
- Reader (Just an "amp-like" of a page)
- Bookmarks (Organization)
It also says "Introduction" price, which leads me to believe it will only go up. Just blown away by a paid feature that doesn't accomplish what I believe it would. That tells me that a company makes more money shoving ads in our face than allowing folks to pay to opt-out.
That is what truly scares me, if $2.99/month from a user is not enough to break even on ads then each consumer given ads presumably makes more for the company than $2.99/month. That helps reinforce the notion that if the product is free, then you are the product.
---
[Nvidia Shield Ad](https://9to5google.com/2021/04/23/shield-tv-homescreen-ads-android-tv-discover/?ref=connortumbleson.com) (9to5google)
What started to bother me is this pattern of paying for something and still getting ads. Now I understand that if you pay $200 for a piece of tech in today's world - that only gets you so far until updates and continued work probably deems another payment.
It just feels wrong that a rotating ad takes up 30% of my screen without a choice about it. I paid $200 for an Nvidia Shield and it was a few months later and ads were in my face. So I get more upset when the service instead is a monthly payment (Xbox Live) and still results in advertisements.
Now, the good news with Xbox Live advertisements is my Pi-hole detects these are ads and thus blocks them. So my Xbox looks quite calmer than your regular gold user.
However, like clock work I boot up the Xbox and get a prompt to join Game Pass that takes up entire screen. The main screen without navigating has an advertisement on the bottom right. This just makes me sad - if you pay for the service monthly on top of paying for the games, DLC and more why can't ads just disappear?
If you live a life with Pi-hole, then you rarely see ads. What makes this is interesting is when you lose Pi-hole for a bit and stumble upon a news site. Its a jarring experience to not experience ads and then figure out that most of the world browses the web with hundreds of advertisements in the face. I don't know how they do it.
I sure can't stand looking at advertisements, but that appears to be the future.
### How did Pikmin Bloom delay Android Notifications?
URL: https://connortumbleson.com/2021/11/29/how-did-pikmin-bloom-delay-android-notifications/
Last updated: 2025-02-04T11:43:00.000Z
Cover Art from [https://pikminbloom.com](https://pikminbloom.com/en/?ref=connortumbleson.com)
On November 1, 2021 the public version of Pikmin Bloom went into the world. As of today, we know there are over 2 million users, but what struck me as completely odd is my phone notifications simply breaking after installing this application.
I thought I was going crazy, how could an application break/delay my entire phone from a specific application? It almost seems like I was going crazy or had a virus and then I saw social media:
- [https://community.pikminbloom.com/discussion/31/sms-sending-and-receiving-is-still-being-delayed-until-app-is-forced-stopped-or-uninstalled](https://community.pikminbloom.com/discussion/31/sms-sending-and-receiving-is-still-being-delayed-until-app-is-forced-stopped-or-uninstalled?ref=connortumbleson.com)
- [https://www.reddit.com/r/PikminBloom/comments/qiqubb/psa\_pikmin\_bloom\_delays\_your\_sms\_and\_messages/](https://www.reddit.com/r/PikminBloom/comments/qiqubb/psa%5Fpikmin%5Fbloom%5Fdelays%5Fyour%5Fsms%5Fand%5Fmessages/?ref=connortumbleson.com)
- [https://www.androidpolice.com/notifications-feeling-sluggish-this-popular-android-game-may-be-to-blame/](https://www.androidpolice.com/notifications-feeling-sluggish-this-popular-android-game-may-be-to-blame/?ref=connortumbleson.com)
Sure enough, this was a real deal only affecting Android. So I tossed the application, because I want my phone working over some Pikmin game.
A week and some days later (November 13, 2021) the [change log for v34](https://community.pikminbloom.com/discussion/289/release-information-v34-only-android-today?ref=connortumbleson.com) came out and included in the change log was:
> (Android) We are investigating the issue where the OS’s notifications get delayed.
This was the second time I saw official notice that an investigation had begun. The first being a pretty fast turnaround on November 2 of the wide spread reported issue in a forum post, but I figured that was generic customer service just "looking into it".
This morning (November 15, 2021) I saw a new release published (v34.1) with only 1 change in the change log.
> (Android) Made improvements to the OS notification delay issue. The issue may still persist for some devices and users, we are continuing to investigate.
> [https://community.pikminbloom.com/discussion/308/release-information-v34-1-only-android-today](https://community.pikminbloom.com/discussion/308/release-information-v34-1-only-android-today?ref=connortumbleson.com)
This shows to me with a patch release and only one change that Niantic is taking this seriously, but I'm still lost how an application even coded badly could affect all my applications (especially text driven ones) on sending or even receiving them.
So I thought, I used to do application teardowns for these applications until legal got in the way so I believe a new application with a small focus towards a bug and not leaking assets or security enhancements is good to go!
So lets diff this.
Pikmin Bloom (Android) 34.0 vs 34.1
We can see right out of the gate there are not many changes, so we can easily manually review this.
```bash
➜ git:(master) ✗ git commit -a
[master 58173c9a] [34.1] APK Dump
14 files changed, 351 insertions(+), 273 deletions(-)
```
If we look back at the files changed list, we can toss the following files for only having a build number / version change:
- `AndroidManifest.xml`
- `apktool.yml`
- `strings.xml`
- `BuildConfig.smali` (x2)
This leads only two classes that received changes:
- `nianticproject/ichigo/activity/ActivityRecognitionManager`
- `nianticproject/ichigo/location/LocationManager`
So now I'm more confused how activity/location managers end up delaying my notifications, so lets take a look. I saw the `LocationManager` class have a new constant added
```smali
.field private static final FASTEST_CONTINUOUS_LOCATION_UPDATE_INTERVAL_SEC:I = 0x5
```
If you are unfamiliar with hex (*base 16*), hex 5 is still decimal 5\. This joined the already existing constant of:
```smali
.field private static final CONTINUOUS_LOCATION_UPDATE_INTERVAL_SEC:I = 0x12c
```
Which is `0x12c` or 300 decimal, which probably corresponds to a 5 minute loop. The rest of this class has what looks to be additional debug information with newly added strings like:
- `const-string v0, "LocationManager requestUpdate"`
- `const-string v1, "LocationManager startOrStopContinuousUpdate start:%b"`
- `const-string v1, "LocationManager stop continuous update"`
- `const-string p1, "LocationManager start continuous update"`
Which will help track the events as they occur. The next changes we saw were in the `LocationCallbackReceiver`, which introduced a new `count` class variable.
```smali
.field private static count:I
const-string v1, "LocationManager LocationCallbackreceiver onReceive %d"
```
This is additionally logged and used to presumably know if the callback is called too many times.
Now if we pivot to the `ActivityRecognitionManager`, we can see the logic for "*stopping activity updates*" had some changes on when it was fired. So it will clean updates prior to starting them as well as cleaning up when ending them.
I know from enough Niantic apps that these applications barely survive in the background. Mixed with the aspect that Pikmin Bloom can optionally live in the background with connection with [Google Fit](https://niantic.helpshift.com/a/pikmin-bloom/?p=all&s=troubleshooting&f=my-steps-aren-t-being-counted-correctly-android&ref=connortumbleson.com) might lead to some interesting state issues.
When we start thinking that most applications run through Google with push notifications, it might make sense that an application that hooks directly into Google for the health/activity/fit portion may overlap some of that logic. So if the activity/location managers aren't cleaned up properly or checking too often (now locked to the fastest of 5/sec per update) it may lead to so many events getting pushed that other events are delayed.
Except hold up! While writing this post another Android only release (34.2) came out!
So lets do this again.
---
The official change log for 34.2 says:
> Thank you for playing Pikmin Bloom!
> \- further improvements to the OS notification delay issue
Pikmin Bloom (Android) 34.1 vs 34.2
```bash
➜ git:(master) ✗ git commit -a
[master e524c7dd] [34.2] APK Dump
9 files changed, 191 insertions(+), 143 deletions(-)
```
Once again the diff has many files touched with a new hash/version as part of the release. So the only file that had meaningful changes for this discussion is one file:
- `nianticproject/ichigo/location/LocationManager.smali`
This file received many changes since the last release (34.1) and we see the addition of two new properties in this build.
```smali
.field private static final GEOFENCE_LOITERING_DELAY_SEC:I = 0x1e
.field private static final GEOFENCE_NOTIFICATION_RESPONSIVENESS_SEC:I = 0x1e
```
These properties take aim at setting up delays and response time for geo-fences. They are both set to hex `0x1e` or 30 decimal. Lets talk about a game mechanic real quick that is different than say like Ingress or Pokemon Go where you directly interact with locations.
In Pikmin Bloom you can run into a flower that requires upwards of a certain number of flowers planted within its range. Is the game using geo-fences around these locations?
Looking at some pseudo code to see what changes were made. Some logic occurs now against the API (Google Protobuf) looking for a specific flag to determine two different values that are then set to the `setNotificationResponsiveness` and `setLoiteringDelay` below.
```java
((com.google.android.gms.location.Geofence$Builder) builder ).setNotificationResponsiveness(notificationResponsiveness);
((com.google.android.gms.location.Geofence$Builder) builder ).setLoiteringDelay(loiteringDelay);
```
This is a Google package, so we can easily find the [developer docs](https://developers.google.com/android/reference/com/google/android/gms/location/Geofence.Builder?ref=connortumbleson.com) for these methods. We learn the following:
[setLoiteringDelay](https://developers.google.com/android/reference/com/google/android/gms/location/Geofence.Builder?ref=connortumbleson.com#setLoiteringDelay%28int%29) *(int loiteringDelayMs)*
> Sets the delay between `GEOFENCE_TRANSITION_ENTER` and `GEOFENCE_TRANSITION_DWELLING` in milliseconds. For example, if loitering delay is set to 300000 ms (i.e. 5 minutes) the geofence service will send a `[Geofence.GEOFENCE_TRANSITION_DWELL](https://developers.google.com/android/reference/com/google/android/gms/location/Geofence?ref=connortumbleson.com#GEOFENCE%5FTRANSITION%5FDWELL)` alert roughly 5 minutes after user enters a geofence if the user stays inside the geofence during this period of time. If the user exits from the geofence in this amount of time, `[Geofence.GEOFENCE_TRANSITION_DWELL](https://developers.google.com/android/reference/com/google/android/gms/location/Geofence?ref=connortumbleson.com#GEOFENCE%5FTRANSITION%5FDWELL)` alert won't be sent.
[setNotificationResponsiveness](https://developers.google.com/android/reference/com/google/android/gms/location/Geofence.Builder?ref=connortumbleson.com#public-geofence.builder-setnotificationresponsiveness-int-notificationresponsivenessms) *(int notificationResponsivenessMs)*
> Sets the best-effort notification responsiveness of the geofence. Defaults to 0\. Setting a big responsiveness value, for example 5 minutes, can save power significantly. However, setting a very small responsiveness value, for example 5 seconds, doesn't necessarily mean you will get notified right after the user enters or exits a geofence: internally, the geofence might adjust the responsiveness value to save power when needed.
So now we understand the units at play here (milliseconds) so lets look back at this logic. Depending on the path taken - you'll either get 2 or 4 seconds back from the service. This is immediately converted into milliseconds and passed onward to the two above functions.
```java
com.nianticproject.ichigo.time.TimeUtils.secondsToMillis(millis);
```
---
With that, we looked at two patches releases specially for Android and made some assumptions and proved some logic changes occurred for:
- Location update frequency capped at 1 per 5 seconds at fastest.
- Location update frequency locked at 1 per 5 minutes at slowest.
- Location callback added count detection to toss out already processed events.
- Location Manager class added extra debug logging.
- GeofenceBuilder leveraged loitering delay parameter (2 or 4 sec).
- GeofenceBuilder leveraged notification responsiveness parameter (2 or 4 sec).
### Mike Flanagan, Eli Roth & Wes Craven
URL: https://connortumbleson.com/2021/11/22/mike-flanagan-eli-roth-wes-craven/
Last updated: 2025-02-04T11:43:00.000Z
Photo by [Stefano Pollio](https://unsplash.com/@stefanopollio?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
For the longest time I've watched movies based on the genre or previews. You'd think after watching films for so long that I'd take an interest in knowing the directors behind such films, but alas I never spent too much time on it.
I would know Michael Bay from Transformers series and Alfred Hitchcock from a film class of having such a unique method of producing suspenseful films. However, there are many more directors than that and I want to focus on three in this blog.
First being Wes Craven.
---
Pulse (2006), Written by Wes Craven / Ray Wright, Directed by Jim Sonzero
My first remembered scary movie was [Pulse](https://en.wikipedia.org/wiki/Pulse%5F%282006%5Ffilm%29?ref=connortumbleson.com), a 2006 film about when technology is discovered that is not friendly. It turns out it was written by Wes Craven, who really adapted it from the 2001 Japanese film [Kairo](https://en.wikipedia.org/wiki/Pulse%5F%282001%5Ffilm%29?ref=connortumbleson.com). At the time I watched this, I had no idea Wes was involved.
Over the few years, I found myself watching:
- The Last House on the Left
- The Hills Have Eyes
- A Nightmare on Elm Street
- The Hills Have Eyes II
- Scream
- The Ring
Now all of those except "The Ring" have Wes Craven involved. The pattern you see when you look at those is clearly slasher films. These films loved knives and hints of humor throughout each film. These might not be the type of films that most are interested in, but a slasher film is always on my list to watch.
---
Cabin Fever (2002), Directed/Written by Eli Roth-
At one point, I watched [Cabin Fever](https://en.wikipedia.org/wiki/Cabin%5FFever%5F%282002%5Ffilm%29?ref=connortumbleson.com) and this film was just odd. It was less slasher and more just disgusting scenes of a flesh eating disease that made you squirm. All in all though, an interesting film that ended up causing many sequels.
From here, I stumbled upon:
- Hostel
- Hostel: Part II
- The Green Inferno
- Knock Knock
- Hemlock Grove
This might have been the first time I recognized seeing the phrase "From Eli Roth" in some of the trailers/movie cover art. It was a short name that kinda just stayed in my memory. Not to mention the buzz that was around Hostel. Common conversations when horror came up, usually went like, "*but have you seen Hostel?*". A film that is basically about capturing and torturing people in a gruesome way, so probably not a category that all are interested in.
These days, if you really search you can find movies that are levels above Hostel. Think about [Martyrs (2008)](https://en.wikipedia.org/wiki/Martyrs%5F%282008%5Ffilm%29?ref=connortumbleson.com) or [Salo (1975)](https://en.wikipedia.org/wiki/Sal%C3%B2,%5For%5Fthe%5F120%5FDays%5Fof%5FSodom?ref=connortumbleson.com) which either film will mark your brain with images that'll be tough to forget. I'd include the cover art, but if anyone is behind you they might wonder what you are looking at. Though, this isn't a post about disturbing films, but the lesser strength horror films.
What I liked about Eli Roth films was always the envisioned viewpoint from the attackers in each film. In Hostel you learn the killers are part of some elite hunting club where enormous amounts of money are exchanged for the safe passage to kill/torture humans. The Green Inferno is about the dated rituals of some native tribe killing activist group captured by them.
---
Oculus & Hush Directed/Written by Mike Flanagan
With Netflix now, my source of horror films adapts nearly every week. Two films I watched were called [Oculus (2013)](https://en.wikipedia.org/wiki/Oculus%5F%28film%29?ref=connortumbleson.com) & [Hush (2016)](https://en.wikipedia.org/wiki/Hush%5F%282016%5Ffilm%29?ref=connortumbleson.com). I didn't know it at the time, but I was stumbling upon a director that made films that had some truly unique ideas.
With a cool Netflix feature, this was the first time I picked films from the director and not by the genre. Granted, the genre's are related here. I then set off to watch [Gerald's Game](https://en.wikipedia.org/wiki/Gerald%27s%5FGame%5F%28film%29?ref=connortumbleson.com) & [The Haunting of Hill House](https://en.wikipedia.org/wiki/The%5FHaunting%5Fof%5FHill%5FHouse%5F%28TV%5Fseries%29?ref=connortumbleson.com) / [Bly Manor](https://en.wikipedia.org/wiki/The%5FHaunting%5Fof%5FBly%5FManor?ref=connortumbleson.com).
I started to notice a pattern in these films that I recognized the actors/actresses a lot more. It might be a common thing for directors to use recurring collaborators, but I didn't really consider that. I also learned that the main character in some of the films was actually his wife - so that was another interesting find I had no idea about.
Midnight Mass, Written/Directed by Mike Flanagan
So now I've finished watching another Flanagan series, this time called [Midnight Mass](https://en.wikipedia.org/wiki/Midnight%5FMass%5F%28miniseries%29?ref=connortumbleson.com). Another miniseries on Netflix that was such a unique piece of art. I know critiques didn't appreciate the long monologues at time, but I very much appreciated the change of pace in the series.
Of all the films I've seen from Mike Flanagan, I'm continually surprised that there isn't a rush of jump scares or cheap tricks to up the ante of horror. There is actual character development that makes you understand the path these characters are on, which may even get gruesome, but helps tie each script together.
I remember during Gerald's Game, I was convinced this bone walker was a figment of her imagination, much like the movie led to believe. Turns out the person was real within the film, which completely caught me off guard. Just like when I realized what Father Paul was actually doing in Midnight Mass.
---
So now I will take looking at the filmography of each director I turn out enjoying, so I can find more series/films to watch. No more randomly watching 30 second previews of films on Netflix. I can now have a bit more research before I devote a few hours to some media.
### Running
URL: https://connortumbleson.com/2021/11/15/running/
Last updated: 2025-02-04T11:43:00.000Z
Wilderness Park Mountain Bike Trail - Thonotosassa, Florida
At one peak point in my life in the early high school years, I was doing two a days for track/long-distance. An early 6am start for a few mile run to another afternoon run around 3pm when school was over.
I was probably in the best shape of my life during those times. My mile time was around 4:40\~ on an good day with track events either raising the bar higher (or actually lower with the time) or collapsing with an awful time. I've blogged about this twice in an attempt to understand [why times continue to get better](https://connortumbleson.com/2016/07/01/bigger-faster-and-stronger/) and how [becoming the best](https://connortumbleson.com/2016/06/18/becoming-the-best/) is not easy.
This post is about neither of that stuff, but the types of runs you might go on and why. So lets go through some runs.
---
### The Hybrid
May 4, 2011 - 6.11 miles at 7:22min/mi pace
So this run is a classic after school training run for long distance. This run I classify as a hybrid run for both trail and sidewalk running. The goal for this run was to safely get to Tomahawk trail by crossing as little streets as possible. You can do this pattern really anywhere - you can leave your home and catch up with the nearest trail or leave with a group after a warm up at school. The only thing to notice is watching etiquette moving from sidewalk to trail as you don't want to cover the entire sidewalk nor trail when running with a group.
### The Track
March 2, 2011 - 1.6 miles at 5:14min/mi pace
The track run is a classic one that is highly dependent on having legitimate access to one. For a high school track that you belong at as a student - no issue. As a grown adult running on a high school track during the summer, its a dice roll whether someone asks you to leave. You could join a gym, but the indoor tracks are so much shorter and full of people that lack the etiquette to realize that folks are running laps.
The track run is a break from streets and trails, but can become easily boring if done too much. A track run is not meant to bust out miles on miles of running, because you can easily do that on any other type of run. The purpose of a track run is commonly to train for distance. Back in the prime day - a coach built that pattern of run/walk for specific distances. This is also a chance if you want to make sure your spikes are fitting well prior to a real event.
### The Wilderness
Rocky Creek Trails (Hillsborough County, FL)
A wilderness run is basically a trail run without paved payment. These runs are not about keeping an extreme pace, but instead being nimble with the constantly changing ground and blind curves. You have a good chance of catching a tree root across the trail and falling if you aren't constantly focused. I think this is a great run every so often, because you know how a pavement run can turn into some sort of zoned out run and this run prevents that from occurring.
### The Park
Lake Lettuce Leaf Park (Temple Terrace, FL)
A park run is an experience no matter the time of day and I prefer as early as the park opens. You can drive in, slowly warm up and if you build a pattern you'll run into the same folks doing the exact same thing on a schedule. Depending on the park you may get to experience the wilderness with the presence of a paved trail.
The experience aspect is all time driven - if you come in the afternoon you run the risk of kids everywhere and it isn't the nicest thing either to be attempting a fast pace run knowing kids arrive at the park at the afternoon. At this park above, you can also witness folks entering kayaks into the water and nearly every other visit you'll get to witness someone flip.
### The Sidewalk
At times the best run is to just leave your house and run on the nearest sidewalk and meander your way back home. This run is probably the most dangerous, since even with walk sign on folks will constantly blow through a right on red light almost hitting walkers. This type of run is common when you want a few breaks on your run - since you'll encounter streets to cross and have to wait.
It probably is very common in highly urban places, since I'm not sure if there beautiful parks or trails to visit.
---
To end this - I always run with no music and zero phone. Probably a bit dangerous if you applied that to everyone with what goes on in this world, but my main reason is I do not want distractions.
A music-less run with no notifications is just about the run at that point. Listening to your breathing and sounds around - each step just about the pain and experience of staying healthy.
Its 2:09pm writing this and I'm at 6128 steps and 3.9 miles traveled - stay healthy.
### Malware and NPM packages
URL: https://connortumbleson.com/2021/11/08/malware-and-npm-packages/
Last updated: 2025-02-04T11:43:01.000Z
November 4, 2021 was an interesting day for the Node ecosystem. Two packages ([rc](https://github.com/dominictarr/rc/issues/131?ref=connortumbleson.com) & [coa](https://github.com/veged/coa/issues/99?ref=connortumbleson.com)) found themselves with malicious updates published.
Both packages published updates on NPM, but the corresponding GitHub repo for those packages saw no changes. Normally, a new packaged release without the corresponding source code just smells like an issue and this was no different.
---
[](https://github.com/dominictarr/rc/issues/131?ref=connortumbleson.com)[RC](https://github.com/dominictarr/rc?ref=connortumbleson.com)
*The non-configurable configuration loader for lazy people.*
[GHSA-g2q5-5433-rhrf](https://github.com/advisories/GHSA-g2q5-5433-rhrf?ref=connortumbleson.com)
- Last "safe" release - 1.2.8 (May 26, 2018)
- Malicious Updates (1.2.9, 1.3.9, 2.3.9)
- [GHSA-g2q5-5433-rhrf](https://github.com/advisories/GHSA-g2q5-5433-rhrf?ref=connortumbleson.com) (Advisory)
- First noticed November 4, 2021 - 3:27pm EDT ([Issue 131](https://github.com/dominictarr/rc/issues/131?ref=connortumbleson.com))
- 1,780 packages use this dependency
- 4,727,300 repositories on GitHub use this
---
[COA](https://github.com/veged/coa?ref=connortumbleson.com)
*Yet another parser for command line options.*
[GHSA-73qr-pfmq-6rp8](https://github.com/advisories/GHSA-73qr-pfmq-6rp8?ref=connortumbleson.com)
- Last "safe" release - 2.0.2 (December 10, 2018)
- Malicious Updates (2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3)
- [GHSA-73qr-pfmq-6rp8](https://github.com/advisories/GHSA-73qr-pfmq-6rp8?ref=connortumbleson.com) (Advisory)
- First noticed November 4, 2021 - 9:31am EDT ([Issue 99](https://github.com/veged/coa/issues/99?ref=connortumbleson.com))
- 206 packages use this repository
- 4,872,966 repositories on GitHub use this
---
### Dependency Tree
The first thing to question and notice is how does a package like COA have 5 million installs. The package itself looks near abandoned and that is not an indication of a popular package when the source repository has hints of abandonment.
It doesn't take long to find a few very popular packages that have/had COA as a dependency.
- [svg/svgo](https://github.com/svg/svgo?ref=connortumbleson.com) \- 16.9k stars
- [ckeditor/ckeditor5](https://github.com/ckeditor/ckeditor5?ref=connortumbleson.com) \- 5.2k stars
> Painful `coa` was replaced with well maintained `commander`.
> [Release notes from version 2 of svgo](https://github.com/svg/svgo/releases/tag/v2.0.0?ref=connortumbleson.com)
I did some digging and svgo actually dropped it in v2, but that brings up an interesting point. If you move to a new major version of a package - that requires work and changes, but then you become immune to this specific issue.
However, on the flip side the actual updating of packages led from a safe to vulnerable update. So this is a tough pickle to solve. If you never update dependencies you are susceptible to known issues of vulnerable packages. If you do upgrade package you risk pulling in a malicious package that used to be otherwise secure.
### NPM/Yarn/GitHub Responsibility
So there are indeed a lot of interesting discussions here that could neutralize this problem, but implementation and talking about each one is incredibly different.
**Make install scripts opt-in \[[rfc](https://github.com/npm/rfcs/pull/488?ref=connortumbleson.com)\]**
This idea is simple, the scripts that can run on events (`preinstall`, `install`, `postinstall`, `prepublish`, `preprepare`, `prepare`, `postprepare`) become opt-in as a default instead of opt-out.
I don't think this method will get traction in theory, because as I look at even one package I worked on. We use the `install` event to build our source code at install time vs relying on a implicitly trusted compiled source. Yes, this is quite slower but it gives me satisfaction that folks obtain the same exact code on GitHub and compile it themselves.
If this RFC went forward - that workflow would no longer work without some sort of new flag to explicitly enable that event. However, perhaps a more heuristic driven approach here might work. If a dependency has a lockfile, then you can probably safely run those scripts vs say a project's own `package.json` update procedure.
**Audit packages prior to publish.**
This idea cost some serious amount of work hours. Imagine prior to any package being published on NPM that some human or machine had to scan it prior to publishing for approval. This could be also easily programmable from automated behavior:
- New automatic event - flagged
- New IP publishing - flagged
- New version published without source control changing - flagged
I publish packages on Maven via Sonatype (Nexus) and this has a cool automated report to make sure I'm not publishing dependencies that are vulnerable.
Sonatype Lift report for Apktool v2.6.0
Now I'm not sure how Sonatype handles day zero kind of things. If someone updates a dependency tree then immediately pushes an update on the morning of November 4 - what system can catch that?
We know the truly manual approach that Firefox employs is sometimes very painful. Publishing extensions and waiting weeks for an approval for a bug fix can really destroy the extension. Though, can you take shortcuts with security?
**Dependabot to the rescue (almost)**
So GitHub and by proxy now NPM have this cool feature to automatically push package update commits to projects to upgrade to non-vulnerable packages. However, in this circumstance the update was vulnerable!
> We are still processing this advisory. You may have affected repositories that are not yet on this list. Check back soon for more.
GitHub itself I don't think has yet to support this with Dependabot - I don't know exactly so I [asked them](https://github.com/dependabot/dependabot-core/issues/4379?ref=connortumbleson.com). The purpose of Dependabot is to update packages and I'm sure so many checks and balances exist so it doesn't accidentally downgrade things. However, in this circumstance if GitHub detected a malicious package version of like COA 2.0.3 - could they do a PR to undo that update back to 2.0.2?
That feature would give peace of mind if a project accidentally pulled a vulnerable version.
**NPM/Yarn Upgrade enhancements**
I do really wish I could do `yarn upgrade --min-days 14`. This would basically find the up to date dependencies published at least 14 days ago. I want to update packages and really have to in the React Native community. I just don't want to accidentally roll the dice with pulling in packages published 6 minutes ago unless intentional.
Not updating dependencies in the React Native community means not supporting iOS 15 and Android 12 or not being able to build on an M1 Mac. You can't ignore package updates there, we just have to make the method easier to safely take updates.
---
In closing, these issues will continue to happen and I believe the attractive nature of the Node ecosystem will push more issues into the light.
[https://npm.anvaka.com/#/view/2d/react-native](https://npm.anvaka.com/?ref=connortumbleson.com#/view/2d/react-native)
Since for example, take React Native - if we just install it right now we will take in 564 packages. So this is maybe why working in security is stressful.
### Project: iBotModz & Logos
URL: https://connortumbleson.com/2021/11/01/ibotmodz-logos/
Last updated: 2025-02-04T11:43:01.000Z
"The Vista" iBotModz Logo.
Way back in 2006, I created a forum. It was hosted on Forumer and I used a free `co.nr` domain in order to not force folks to use `ibotmodz.3.forumer.com` and instead `ibotmodz.co.nr`. One thing that continually intrigued me was creating a logo for the website.
In January of 2006, the site launched with the below logo that merged an appreciation for Pikmin and Halo/Xbox together.
A laughable logo today, but a good laugh to look back at time. This logo saw a change when Halo 3 became more a focal point and it was time to re-brand ever so slightly.
Font changes that made no sense, more Pikmin tossed together in a warthog and cutouts of Spartan's just thrown into the background. This logo was used until it was time for iBotModz to expand. It was leaving the forum host behind for a VPS and an installation of [e107](https://e107.org/?ref=connortumbleson.com) attempting to produce a site more than just a forum. This move was also changing the tagline from "*Modding 1 Xbox at a time*" to "*now, just more.*"
So it was time to put up a vote for which logo would reign supreme.
Taking a look at these logos with their transparent properties now on this blog a decade plus later just shows how poorly made these were. These logos were horrible, they destroyed everything that felt underground in a pale attempt to up the professionalism.
The community was upset and did not like any of them. They wanted the Pikmin back and as well as the old site. So it was back to the drawing board with a far less tall image that could fit well in the site's theme.
These logos all attempted to use some form of the template, so the common black background would work for the theme. These logos also got attacked beyond belief and for good reason. The text/font for nearly every single one was just horrendous. The cry for help to include the Pikmin went overboard. Some poor render cutouts and attempting to blend a Pikmin in a design that just didn't feel as good as the original.
So this time, instead of building a logo based on the theme. It was time to try many different themes to refresh the site look and feel.
So now we had nothing interesting in terms of Pikmin or Halo, but a text driven approach that blended with each theme in question. At this point, the site needed focus in areas other than a logo so I had a change of thinking. As I became obsessed with renders and graying them in a specific color, I wanted to make a logo that showed off games I enjoyed.
The logo above is what I launched the site with. The community wasn't too angered with this one, because it just "worked" on whatever theme we were running. This appeared to be the logo that the community would allow till our next iteration.
So now it time to present random options throughout the forums of some attempts at a new logo design.
The cutout nature of the previous lead to a new iteration that focused purely on Halo, but not any good feedback came this way. So this logo was also tossed aside.
The next logo is what happens when you spend too long thinking that all the effects you can do in GIMP make a good image. This was also trying to hone in on that Web 2.0 feel with rounded corners. All in all, this was mocked and laughed at and abandoned.
So it was time to get back to roots. Halo.
This was another attempt at rounded corners on one side, but flush to the boundaries on the left. This would sit on the top left corner of the website and was a good creative attempt to show off a new design. However, once again the community hated it claiming the text was not blended at all and it was missing a Pikmin.
So it was time to throw out everything attempted and head back to the roots. The old logo was returned, cleaned up and swapped for the new slogan.
Folks loved it. They still wanted to critique the text, but the Pikmin and Spartan's were back so it naturally was loved. We had gone full circle after a few years and returned back to the logo that was the home of the original 2006 site with a new tagline.
Days became months and months became years and the site had slowly died off. Modding had moved to other mediums and hundreds of niche forums were falling aside. Real time chat groups reigned supreme, the era of forums were over.
So one last forum software upgrade was done, a new theme installed with the learned knowledge and a generic boring logo installed.
iBotModz then went to sleep and never changed logo's again.
### Helping Open Source
URL: https://connortumbleson.com/2021/10/25/helping-oss-as-an-engineer/
Last updated: 2025-02-04T11:43:01.000Z
Photo by [Sai Kiran Anagani](https://unsplash.com/@%5Fimkiran?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Whether you know it or not - a huge chunk of technology runs from code bases that are developed in the complete open space. What I find fascinating is the dependency tree that results in more and more complex software - a business may depend on some piece of software that 1 individual has been supporting for a decade without a dime. XKCD has an [excellent comic](https://xkcd.com/2347/?ref=connortumbleson.com) for this exact situation which helps drive home the point.
So lets break this into 3 buckets and dive in:
- Companies helping Open Source projects
- Individuals who interact and work with Open Source projects
- Individuals who support or maintain an Open Source project
---
**Companies helping Open Source**
Lets start with Mozilla - a company that spawned from the open source and free software of popular programs like Firefox and Thunderbird. As they grew they realized it made sense to give back to the community they started from. They started a [repository](https://github.com/mozilla/MOSS-Directory?ref=connortumbleson.com) and started to give money to fund projects to resolve issues from tools they either use or feel as a company to monetarily support.
[Sentry](https://blog.sentry.io/2021/10/21/we-just-gave-154-999-dollars-and-89-cents-to-open-source-maintainers/?ref=connortumbleson.com) is a company in a similar boat that leverages a ton of open source software like every other company so they gave back as well. They had some cool napkin math where they estimated that each engineer gains approximately $2,000 of value from open source labor. So they simply donated $2000 times number of employees or $150,000.
I think this is something that should be normalized and just expected as part of companies worldwide. I understand it isn't easy though - giving money from a company to a collection of open source projects isn't the easiest. Sure, you could use GitHub sponsors, but then you are sponsoring a person instead of a project. If you sponsor a project - how can you assure the money will be used in good faith for the success of the project?
I just think that the entire success and purpose of some companies are built off the success of open source offerings. It should either be encouraged or allowed for either engineer support on open source projects or monetary contributions.
---
**Individuals who interact with Open Source**
Now I joke about GitHub a lot that there is no bug tracker, but only a support ticket system and that is no joke. If you interact with GitHub you'll either lead to the stress of the maintainers or not. I find that in its your best interest to follow whatever requirements exist when submitting a pull request or issue. Lets take an example.
An update to Fastlane was done, including all the plugins in order to add support for the changing App Store Connect. Running the build failed due to something I couldn't quite pinpoint.
```
[10:52:13]: error: true: IO error for operation on true: No such file or directory (os error 2)
```
[getsentry/sentry-cli - issue 1002](https://github.com/getsentry/sentry-cli/issues/1002?ref=connortumbleson.com)
It failed on a Sentry step, so presumably that was at fault. Before doing anything, I filed an issue report where I thought the issue was. Doing so because if a maintainer immediately can understand the details and save time, energy and money its worth it. At that point - it was time to dig into myself. I could not revert Fastlane, because the build was broken and required the new version.
However, I could revert the only plugin (`sentry-fastlane-plugin`) update from v1.8.3 back to v1.8.1\. This resolved the issue so I could have stopped there, but did not.
Diffing the [versions](https://github.com/getsentry/sentry-fastlane-plugin/compare/1.8.1...1.8.3?ref=connortumbleson.com) with a simple GitHub URL feature, I dug through a language I'm not entirely familiar with and noticed this just wraps the `sentry-cli` tool. One [line](https://github.com/getsentry/sentry-fastlane-plugin/compare/1.8.1...1.8.3?ref=connortumbleson.com#diff-4d96d9194f37c38c64f4246603cfd5341f06d1066c70ec14a55069f4b2d16cdeR27) in particular looked interesting as a parameter was updated to include a value, when it did not require one. I understood the issue, found the regression and put up a [pull request](https://github.com/getsentry/sentry-fastlane-plugin/pull/92?ref=connortumbleson.com) to resolve. The fix was merged and the next release (v1.8.4) had the problem resolved. I closed my original issue and the entire ordeal was over.
This sounds like a lot, but probably amounted to less than an hour. So now future folks searching the web might land on the issue or the pull request and have their solution. I'd say this is the way that engineers should solve problems - documenting the issue, attempting to resolve said issue and following all requested criteria for the repository in question.
What you often see is the complete opposite. You'll see bug reports that are clearly support requests with the entire issue template destroyed. You'll see folks just spewing pure anger and refusing to help a project that is free. You'll see people that seem personally insulted from a maintainer asking someone to check x,y,z. It all leads to my next and final section about the point of view of an open source maintainer.
---
**Individuals who maintain Open Source**
Maintaining an open source project changes you - there is no doubt about it. I wrote about [this](https://connortumbleson.com/2017/05/01/the-human-behind-the-keyboard/) in 2017 in a lot of detail. I do notice every so often that there are folks that I think are still really piecing together how to effectively run an open source project and others that should take a step back entirely. A few folks are just toxic in and out - I remember one maintainer from my early Minecraft programming days. Wrote some good stuff, but was never a fun interaction with this individual.
I've witnessed another individual and project basically pull the same thing that reminded me of the release of Python 3\. I don't think anyone could argue that Python 3 wasn't better, but the breaking changes and upgrade path was pretty less than desired - the ecosystem was basically split between the versions. So in this different occurrence - A package I depended on would not support PHP8 on the existing version, instead pushing folks to an Alpha build of their next major release.
It would be unfair for me to say the package could have simply supported 8 on the existing - I don't know. I do know however, pushing folks to a new major version with no upgrade information, no documentation and still to this day (almost a year later) is still is not out of beta. I tried to help the project, I tried to submit fixes and reports, but it was a stressful situation. Things were closed because they weren't understood. Beta 24 may have included a fix I included, then Beta 26 broke it again.
I kept trying, but every project upgraded to PHP8 that used this dependency ran into new issues. I ended up abandoning the project for an alternative, I don't think this package handled a new language version correctly.
---
All in all, open source software is everywhere. I think companies and engineers themselves should put themselves in positions to help these projects. Not all circumstances will be easy, but the more of us that support any project will be for the good.
### The Hidden Dependency
URL: https://connortumbleson.com/2021/10/18/the-hidden-dependency/
Last updated: 2025-02-04T11:43:01.000Z
Photo by [Luca Bravo](https://unsplash.com/@lucabravo?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few weeks ago I was having just a regular PHP random discussion at a meetup about great PHP packages. I had mentioned [Intervention](http://image.intervention.io/?ref=connortumbleson.com) is my absolutely favorite package for manipulating images in PHP.
I started really manipulating images via PHP around Halo 2 which was so long ago at this point. I was writing some seriously bad low level image manipulation code.
Unfortunately that code has been lost in time, but the one I wrote a few games later for Halo Reach still exists. I even [blogged](https://connortumbleson.com/2021/03/01/project-reachstats/) about this historical project.
```php
$template = imagecreatefrompng(DOC_IPS_ROOT_PATH ."reach/templates/pack5-aqua.png");
$size = getimagesize(DOC_IPS_ROOT_PATH . "reach/templates/pack5-aqua.png");
imagecopy($template,$watermark,imagesx($template) - ($water_w) - 11 , imagesy($template) - ($water_h + 3), 0, 0, imagesx($watermark), imagesy($watermark));
imagestring($template, $this->fonts[0], 160, 40, $this->lang->words['inactive_1'], $black);
imagestring($template, $this->fonts[0], 160, 62, $this->lang->words['inactive_2'], $black);
```
[ReachStats](https://github.com/iBotPeaches/ReachStats/blob/master/ReachStats/upload/admin/applications%5Faddon/other/reachstat/sources/classImageMaking.php?ref=connortumbleson.com)
A small snippet is above and this was complex to maintain or even remember how it worked. So below is how simple Intervention made everything.
```php
Image::make('public/foo.jpg')
->resize(320, 240)
->insert('public/watermark.png')
->save('public/bar.jpg');
```
[Intervention docs](http://image.intervention.io/?ref=connortumbleson.com)
So if we flash back to the discussion a friend was having with me - they said they didn't trust Intervention because it was abandoned and old. This struck a cord with me and led to this blog post. Which the intent is not to create some large post to debate a random discussion into the ground, but to research the hell out of some image manipulation libraries and learn some stuff.
---
So off to [packagist](https://packagist.org/?query=image&ref=connortumbleson.com) to search for just "image" and start pulling packages and ignoring some that look unrelated.
- [intervention/image](https://packagist.org/packages/intervention/image?ref=connortumbleson.com) \- 56 million downloads
- [nette/utils](https://packagist.org/packages/nette/utils?ref=connortumbleson.com) \- 37 million downloads
- [imagine/imagine](https://packagist.org/packages/imagine/imagine?ref=connortumbleson.com) \- 29 million downloads
- [league/glide](https://packagist.org/packages/league/glide?ref=connortumbleson.com) \- 12 million downloads
- [spatie/image](https://packagist.org/packages/spatie/image?ref=connortumbleson.com) \- 9 million downloads
All other top packages seem unrelated to manipulating images and more uploading, optimizing, organizing, etc.
So for those 5 packages up there I want to dig into what dependencies they use to see if they indeed support their own low level logic or use a different package for manipulating images.
```bash
➜ composer show --tree spatie/image
spatie/image 2.1.0 Manipulate images with an expressive API
├──ext-exif *
├──ext-json *
├──ext-mbstring *
├──league/glide ^2.0
│ ├──intervention/image ^2.4
....
```
Right out of the gate, I saw something that was interesting. I was not aware that `spatie/image` used `league/glide` which actually used `intervention/image`. So that means 3 of the packages up there all basically use Intervention at the lowest level.
```bash
➜ composer show --tree imagine/imagine
imagine/imagine 1.2.4 Image processing for PHP 5.3
└──php >=5.3.2
```
```
➜ composer show --tree nette/utils
nette/utils v3.2.5 🛠 Nette Utils: lightweight utilities for string & array manipulation, image handling, safe JSON encoding/decoding, validation, slug or strong password generating etc.
└──php >=7.2 <8.2
```
Both `imagine/imagine` and `nette/utils` appear to have their own low level code so there might only be 3 popular PHP packages that manipulate images.
You can see this with many popular frameworks and tools that chances are they depend on [Symfony](https://symfony.com/projects?ref=connortumbleson.com). Symfony runs behind the scenes for Drupal, Joomla, Magento, Laravel, Yii and many more.
This reminds me how so many things depend on [OpenSSL](https://www.openssl.org/?ref=connortumbleson.com), which only after some vulnerabilities did that project get the monetary and focus it needed.
I feel Laravel's ecosystem handles this very well. They depend on quite a few projects and every time a new PHP version arrives they start a [pull request](https://github.com/laravel/framework/pull/33388?ref=connortumbleson.com). They identify all the issues on packages they use and they don't complain and demand fixes from those packages - they contribute!
[\[6.x\] Full PHP 8.0 Support #33388](https://github.com/laravel/framework/pull/33388?ref=connortumbleson.com)
PHP8 was a big jump for the sole reason that most packages that have version constraints did not consider 8 (and for good reason). So this meant the staff and contributors to Laravel spread out to all packages that Laravel depend on and got support working on many other packages.
At times when packages get [archived](https://marmelab.com/blog/2020/10/21/sunsetting-faker.html?ref=connortumbleson.com) (FakerPHP) this lead to a few folks from the Laravel organization joining other notable names in the industry to fork that package and keep it moving on - [https://github.com/FakerPHP/Faker/](https://github.com/FakerPHP/Faker/?ref=connortumbleson.com).
I do appreciate that behavior from Laravel to keep the ecosystem healthy, which I don't think can be said to be true about everything. I see this healthy behavior as well from TryGhost in the NodeJS ecosystem so I know its in the best interest of all large projects to also support everything upstream. If only every contributor of anything open source also felt that way.
### Insights without Tracking
URL: https://connortumbleson.com/2021/10/11/insights-without-tracking/
Last updated: 2025-02-04T11:43:02.000Z
Photo by [Mitchell Luo](https://unsplash.com/@mitchel3uo?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Around 2 years ago on this blog I [removed Google Analytics](https://connortumbleson.com/2019/12/16/blogging-to-the-future/), then a year later I [removed Disqus](https://connortumbleson.com/2020/11/16/moving-disqus-to-remark42/). I am fighting to protect the privacy of all readers because the era of data is here.
Now I've got a few more things to perfect to score great on privacy scanners, but something happened that upset me. When I upgraded to [Ghost v4](https://connortumbleson.com/2021/03/22/hello-ghost-v4/) \- there was a new 3rd party thing added that I can not control.
Hidden on my page is this new snippet.
```html
```
- This is a 3rd party load to [Unpkg](https://unpkg.com/?ref=connortumbleson.com) (CDN) to support a new "Portal" feature from Ghost.
- It cannot contain [SRI hash](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource%5FIntegrity?ref=connortumbleson.com), because the version is not locked.
- It has the ability to update to any version that meets the constraint as needed.
- I now fail a category I once passed.
Now, [Ghost v4.4.0](https://forum.ghost.org/t/ghost-4-4-0-you-can-now-disable-membership-feature-and-portal/22487?ref=connortumbleson.com) came out and gave the ability to remove this script at the cost of removing the entire feature. So now it's a tough choice - I have to toss my email subscriber benefit away or keep the CDN. For now, I'm keeping the CDN.
So then I got curious, even though I trashed Google years ago. Can I still have some insights to what visitors are finding?
---
Sure enough, the [Google Search Console](https://search.google.com/search-console?ref=connortumbleson.com) has some insights. Out of the gate we can see impressions on Google and how many clicks got funneled from that.
7/9/21 - 10/8/21 - connortumbleson.com
Now of course I'm curious about this rise around September 10 which I know from memory is when the [Matrix 4 trailer](https://www.youtube.com/watch?v=9ix7TUGVYIo&ref=connortumbleson.com) dropped.
So then I got curious which posts bring the most hits to my blog. So let me link those below with a little snippet of why I wrote that post.
**[Understanding The Matrix Trilogy](https://connortumbleson.com/2018/01/28/understanding-the-matrix-triology/) (January 28, 2018)**
This post I wrote pretty early in my blogging journey as I really wanted to document my own interpretation of understanding the first 3 films of The Matrix. My guess with such a good placement on Google results (#5) that many hits will continue to come to my blog for this one.
---
**[Welcome Gift](https://connortumbleson.com/2021/01/18/welcome-gift-scam/) (January 17, 2021)**
For this post I had moved homes and just gotten bombarded with all these same little postcards (as shown above). They screamed like an attempt to scam me like most physical mail in today's world so I did some digging on the company and wrote up a post. I'm constantly getting hits from folks from Google who only searched the phone number. Hopefully could help out some who might have accidentally fallen for this.
---
**[Pi-hole: 19 months later](https://connortumbleson.com/2019/07/01/pi-hole/) (June 30, 2019)**
This blog is a slow continuation that I tend to do every year of logging all network requests my network does. This post was a great deep dive into the top blocked and allowed requests. A lot of search results are all looking for one domain in particular, which I attributed to Neilsen and plenty of applications under ESPN's belt. In my specific case it was the [fantasy football application](https://play.google.com/store/apps/details?id=com.espn.fantasy.lm.football&hl=en%5FUS&gl=US&ref=connortumbleson.com) for Android.
---
**[Original Xbox Mod Chips](https://connortumbleson.com/2021/06/21/original-xbox-mod-chips/) (June 20, 2021)**
This post I'm honestly surprised for it to be in the top 5\. This post I wrote after discovering some of my older original Xbox modchips. This was in preparation for a great talk I did ([slides](https://connortumbleson.com/slides/2021-08-12-NeonTempleXboxHaloHacking.pdf)) about modding consoles. I'm not sure why so many people are looking up original Xbox stuff, but they are landing on that page to learn some history of some real old hardware.
---
**[Stumbling into a MLM (It Works!) on Accident](https://connortumbleson.com/2018/02/11/stumbling-into-a-mlm-on-accident/) (February 11, 2018)**
I'm glad to see this post still trending, because anytime I stumble upon a Multi-Level-Marketing scheme - I'm hooked. In this circumstance I happen to be downtown and hoping to enjoy a calm day, but instead I run into an army of folks attending a conference for this company. I do some digging and find all the signs that promote an inner circle of folks making money off the intense effort of others from public data. Probably one of my only posts that has had a few comments over the years.
---
If we look at 5 to 10 - they all seem to be related to [Cicada 3301](https://connortumbleson.com/tag/cicada-3301/) and [Apktool](https://connortumbleson.com/tag/apktool/). So to end this, I need to make this site's initial experience better (according to Google).
### Servers Dying (Sept 30, 2021)
URL: https://connortumbleson.com/2021/10/04/a-server-dying-ssl/
Last updated: 2025-02-04T11:43:02.000Z
Photo by [Markus Winkler](https://unsplash.com/@markuswinkler?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On September 30, 2021 the LetsEncrypt [root certificate](https://crt.sh/?id=8395&ref=connortumbleson.com) named DST Root CA X3 expired (or rather not to be used after that date). This meant that any certificate signed from that chain was no longer trusted.
Root certificates are quite an interesting thing. They are SSL certificates signed by no one, but you implicitly trust them since your software and the company behind that software trusts it. This isn't something taken lightly as many processes and regulations exist to the companies that hold this burden.
It even continually evolves with more guidelines every few years with a current twist that root certificates will only be valid for a max of 25 years. Most certificates were started in 1999/2000 so we are entering the decade of a ton of certificates expiring.
This shouldn't be a problem in most cases. If you have an up to date machine and hardware - updates received even years prior would have prepared you for a root certificate expiration. You can even peek these yourself on Windows with the Certificate Manager.
*"certmgr.exe"*
Shown above is the now expired LetsEncrypt DST Root CA X3 certificate. Thankfully, it doesn't take long for me to find the not expired newer LetsEncrypt root certificate.
"ISRG Root X1"
So my machine should be in wonderful shape since any certificate signed in the last 18 months probably used the newer ISRG Root X1 instead of the old. There are entire blogs about this that go into cross signing and how new Certificate Authorities (CA) enter the game. I'd visit [Scott Helme's blog](https://scotthelme.co.uk/cross-signing-alternate-trust-paths-how-they-work/?ref=connortumbleson.com) if you want to dive further into that aspect of the certificate ecosystem.
Though what if your device is really old and doesn't get auto updates anymore. This may be a really old version of Java or an old Blackberry or Android device. You won't have an update to bring new root certificates into play and websites/services that are secured with newer certificates would be no longer accessible. The list of affected devices/things for LetsEncrypt is entirely [documented](https://letsencrypt.org/docs/certificate-compatibility/?ref=connortumbleson.com) if curious.
Though this blog post is about why some of my servers had a serious issue.
---
On September 30, 2021 alarms starting going off some hobby sites I run that APIs to other services for information were failing. Jumping onto the server I tested my own site and got:
```bash
[ec2-user@ip-xxx-xx-xx-xxx ~]$ curl -I https://connortumbleson.com
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
```
This scared me because I thought my certificate expired, but it was a reversal. The machine root certificate used for this verification was expired and thus rejecting all services that used a related LetsEncrypt certificate.
I was beyond confused. I was running Amazon Linux 2, which is basically marketed as the #1 AMI to base your server off of when using EC2.
AMI2 #1 during EC2 Launch
I have auto updates enabled to keep things up to date. I saw these blogs/announcements of LetsEncrypt changes coming, but I made a mistake and figured I was immune to the problem. If you run the latest and greatest AWS stuff and keep things up to date, I improperly thought I was covered.
I was trying to figure out what was wrong. I dug into the location of my certificates `/usr/share/pki/ca-trust-source` and found both the old (DST Root X3) and new (ISRG Root X1) certificate in play.
```
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
44:af:b0:80:d6:a3:27:ba:89:30:39:86:2e:f8:40:6b
Signature Algorithm: sha1WithRSAEncryption
Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3
Validity
Not Before: Sep 30 21:12:19 2000 GMT
Not After : Sep 30 14:01:15 2021 GMT
Subject: O=Digital Signature Trust Co., CN=DST Root CA X3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
```
Snippet of the DST Root CA X3
```
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
82:10:cf:b0:d2:40:e3:59:44:63:e0:bb:63:82:8b:00
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1
Validity
Not Before: Jun 4 11:04:38 2015 GMT
Not After : Jun 4 11:04:38 2035 GMT
Subject: C=US, O=Internet Security Research Group, CN=ISRG Root X1
```
Snippet of the ISRG Root X1
I kept researching things, because I assumed root certificates expired all the time so why didn't the new one win in priority over the expired one?
I didn't learn that answer until after my "emergency" fix. In the moment, I manually edited out the old expired certificate from my `ca.bundle.crt` file and regenerated everything.
This was great because everything was working amazingly and it was off to research what went wrong. I quickly learned that this situation should not have been an issue (an expired and not expired cert) in the trust store.
However, it took until OpenSSL 1.1.0 to resolve that. Guess what AMI2 runs by default.
```
[root@ip-xxx-xx-xx-xxx ec2-user]# openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017
```
This is probably because Amazon Linux 2 (and 1) follow closely to the Red Hat 6/7 system. They take stability and security over everything no matter what. So while the version they run seems quite old (1.0.2), they back port tons of security related fixes to that build.
> Since your system has ISRG Root X1 in its trust store, OpenSSL *should* simply ignore the cross-signed version of it (signed by DST Root CA X3) that shows up in certificate chains. However, OpenSSL 1.0.2 doesn't properly ignore the cross-signature. Instead it throws an error! That behavior is fixed in OpenSSL 1.1.0.
> [jsha @ LetsEncrypt](https://community.letsencrypt.org/t/amazon-amis-failing-to-connect-to-backends-modifying-ca-bundle/161559/16?ref=connortumbleson.com)
So if OpenSSL 1.1.0 only fixes a bug, then it was never included. Despite that bug [wrecking havoc](https://news.yahoo.com/internet-goes-down-millions-tech-021400230.html?ref=connortumbleson.com) for millions on September 30, 2021.
Now I found a few things from Amazon, they [released a package](https://forums.aws.amazon.com/ann.jspa?annID=7562&ref=connortumbleson.com) called `openssl11` that adds the v1.1.0 version, but it does not link behind the scenes to software.
> The update in the package repository does not replace the default OpenSSL (openssl 1.0.2k) in Amazon Linux 2, and currently no other package in the repositories, such as httpd, nginx, links with openssl11.
> [https://forums.aws.amazon.com/ann.jspa?annID=7562](https://forums.aws.amazon.com/ann.jspa?annID=7562&ref=connortumbleson.com)
So I must not understand enough about the linking of software since I'm not sure who would install this if I have to relink all my software to that version. Since I don't think installing OpenSSL1.1.1 through that source will magically fix my nginx/php/curl issues.
Am I wrong to think that the most marketed Amazon option for EC2 should just work? It took Amazon roughly 9 hours to release a package update to `ca-certificates` to remove the expired cert. This meant that the OpenSSL bug fix between 1.0 and 1.1 was no longer needed as only relevant certificate remaining in the trust store was no longer expired.
Did they have to wait until after everything broke? It seems like if you are removing a certificate 1 day prior to the expiration seems fine by me. However, I can see some folks not agreeing with that.
I can see many many certificates expiring in the 2020-2030 slot and I'm not ready for another dose of stress on a weekday.
---
TLDR; My Amazon Linux servers broke connectivity on September 30, 2021 and I either had to wait for an Amazon update to `ca-certificates` or surgically remove an expired certificate from my trust store.
### Inside the Mind: Computers
URL: https://connortumbleson.com/2021/09/27/inside-the-mind-computers/
Last updated: 2025-02-04T11:43:02.000Z
Photo by [Natasha Connell](https://unsplash.com/@natcon773?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
After a small talk at a conference I did, this father and son joined me in the front of the room and asked me how I got involved in what I was speaking about. I tried to explain it was just passion and lots of hours in front of a screen. I also reinforced at passion being involved - I did this stuff because I was interested in it and enjoyed it.
Weeks later, I booted up an old hard drive and found a trove of things that led to this blog. It will be a ton of mini stories regarding childhood and technology, where I was mainly in way over my head. What I learned looking back at all of this stuff is I wasn't nervous to just try things and really push myself to build something no matter how bad it was.
---
**The VB/C# Era**
Halo 3 Fileshare Spider
Since I started really diving into things after modding an original Xbox, the common language for all those tools was either VB or C#. Sure some folks used other languages, but a majority of languages were in the Microsoft family.
I had no idea what I was doing trying to learn one of these languages, but it wasn't the syntax that was bothering me. It was breaking problems down to a collection of smaller solvable problem. Shown above is a Halo 3 Fileshare spider, which had perplexed my mind on how to build initially.
If we do a thought exercise - it isn't too bad. Just load the corresponding URL of the fileshare on the web for an Xbox Live agent. Scan the page extracting each saved game and look for something in our scan list. Continue onward to the next gamertag until you exhaust your list.
Private versions of this program just crawled the friend lists of each gamertag it loaded, so the system slowly grew the possibilities of gamertags to scan. However, this was highly inefficient for many reasons:
- Each user had their own search (nothing shared)
- Anytime search results changed - you had to start again
- You couldn't start it in the middle
- It was slow
This was basically an attempt to build a web scraper, indexer and search engine at once. A horrible attempt, but the amount of times this knowledge or experience comes back up decades later blows my mind.
---
**Web Security & Development**
At some point I started disliking Windows applications because they were isolated to a machine. I wanted something available to web and I started learning how those worked. I started with forums beginning with IPB, then moving to phpBB3 and e107 then heading back to the paid offering of IPB.
I remember signing up at most sketch looking websites that promised free hosting since I quickly learned that hosting my own stuff from my own computer was not a good idea with a machine that turned off nightly.
My first journey was with Forumer, a site that allowed me to host my own Invision Power Board for free. This site exploded with popularity and I had nearly 50k posts and 8000 members, this attracted those who wanted to take that. I was hacked and DDoSed constantly and Forumer ended up suspending my site due to the damage it was causing to others on the platform.
ibotmodz.3.forumer.com (2007)
I was young in middle school with no real digital money to support paying for hosting. So I stumbled around to more "free VPS" services that injected ads into your content and generally just sucked.
This was a good learning experience because I was jumping hosting services so often I learned how important a real domain was. When the site left forumer, I lost the most popular `ibotmodz.3.forumer.com` domain. The next site was another subdomain and getting people to follow to the new sites was difficult.
I learned about DNS and the world of buying domains. PayPal became my friend and as long as I kept shoveling snow and fixing computers of random folks in the neighborhood I could keep up the funds to fund this lifestyle.
After another free site shut down so I went to HostMonster and paid real money for a monthly account and they suspended me near instantly for hosting "warez". I stumbled upon a home called XenServ. My first real experience with a new fresh domain `ibotmodz.net` and a new more personable host.
Suspended for going over my bandwidth limits (2010)
These folks and the staff were next to amazing, explaining everything and really helping me learn stuff. However, I turned into an ass for these guys. I was emailing 3-5 times a day on a hosting plan that was $3/month. Any single thing slow/wrong I was emailing. I was constantly under attack by the folks I surrounded myself with and even hacked. Folks did not want iBotModz to exist - it was built from the theft of content and was excelling beyond belief.
Another DDoS to iBotModz
Nothing good lasts forever and I abused all the help I got. Things escalated to me that they didn't care about my site and all the support/stress I caused is not worth the money.
Emails were bouncing and my site was effectively offline with no recourse to obtain backups or the content. I was begging in IRC channels to release my content and I would go on my way and leave. This is where I learned the hard way about actually owning your own content with alternative backups and more. In what I assume was just a "*feeling bad*" nature one of the staff members got me backups and I never spoke to Chris/David again at XenServ.
This story could go on and on for the next hosts as I jumped between a friend hosting account to *SliceHost* to then *The Planet* to then *Linode*. I've been with Linode ever since (10+ years).
This experience of jumping hosts allowed me to learn so many things about spinning up environments, Linux and everything in between to get a site back online many times.
---
**Script Kiddie Era**
Since my adventures with hosting led to a consistent suspension for either warez, DDoS or abuse - I started learning how it all worked. I remember finally executing my first SQL Injection to a competitor site and truncating all their database tables. It was beyond unethical and terrible to do, but being on the other end of it warps your perception for so long of what is good and breeds revenge.
[iBot XR (2.3)](https://connortumbleson.com/2020/01/20/ddos-revisited/)
I've [blogged](https://connortumbleson.com/2020/01/20/ddos-revisited/) about this era of DDoS booting prior, but I moved into that as well spreading malware in hopes to grow my bot army larger and larger. It blew my mind how easy putting up a torrent of an upcoming movie with an `.exe` as a binary would get downloaded.
This helped me learn how to pack binaries to evade detection and learning the constant cat n mouse game of signature detection when making tools. While my background began unethically - I still believe to this day that you cannot learn to effectively secure systems until you spend time actually attacking them.
---
So in closing, when someone asks me how I got involved in this stuff. Just never stop doing things and make sure you have a passion to want to learn this field.
### GitHub Actions Wishlist
URL: https://connortumbleson.com/2021/09/20/github-actions-wishlist/
Last updated: 2025-02-04T11:43:03.000Z
Photo by [Roman Synkevych](https://unsplash.com/@synkevych?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
GitHub Actions when it launched saved me from an honestly dated Jenkins experience and Travis CI crippling its service to favor towards the enterprise community.
I moved all my hobby projects and work projects from PHP testing, Laravel deployments, Apktool building, AWS CodeDeploy, JavaScript linting and much more.
After a solid amount of time, I've got a good deal of random features I really wish would make it into Actions.
---
**Secrets per branch**
GitHub (secrets vs environment secrets)
There is an immediate problem you run into when working in private projects and also moving your deployments to the system. It may be AWS keys or some secret, but any repository secret is ripe for abuse.
It just takes 1 person adapting the workflow on their own branch and they can have access to that secret to do whatever they want. GitHub in the past year has produced something to resolve this called [Environments](https://docs.github.com/en/actions/reference/environments?ref=connortumbleson.com), which is only available to GitHub Enterprise or public repositories.
The short version of Environment Secrets is you define the branches allowed to access that secret. So imagine you create a key used to deploy to production, you can only expose that secret to `production`. Assuming proper merge restrictions are set up - there is no way that secret could be exposed to anything but code running on `production`.
The downside - it took upgrading to Enterprise from Pro to get this feature. [GitLab](https://docs.gitlab.com/ee/ci/variables/?ref=connortumbleson.com#protect-a-cicd-variable) had this since I remember using GitLab CI.
---
**Rerunning a single job**
GitLab rerunning a specific job.
At some point you'll have a complicated job. It may run various versions of PHP to lint/test in some complex matrix. If you get a random internal error - your build fails and thus deployment is skipped. However, you can't re-run the single failed step (Like GitLab can). So you have to restart the entire build and as far as I can tell - you incur the charges of all the minutes used again. Even if the original failure was an issue from the GitHub side.
---
**Specifying specific OS versions**
When you run a GitHub Action build - you basically select Linux, Mac or Windows including a specific major version if using their runners. This example will be on Ubuntu 20.04 so when I run a build - I see the following:
```
Virtual Environment
Environment: ubuntu-20.04
Version: 20210913.1
```
This corresponds to a specific [version](https://github.com/actions/virtual-environments/releases/tag/ubuntu20%2F20210913.1?ref=connortumbleson.com) that is released on a pattern by GitHub. They keep things up to date, update the underlying images and much more. One thing I have noticed and never ever once experienced on GitLab was regressions.
The comparison isn't fair though. A GitLab CI file can be built in many ways and I've used the Docker runner for all my uses. So locking an image like in GitLab has the same possibility for the php docker image tag of 7.4 to update and include a new minor change that is unaccounted for.
However, the motto with GitHub Actions is to not use Docker for each step as the minutes really add up. Its more beneficial to use the host machine and run/install what is needed.
Now what has happened 3 times is a minor version update of the OS that is not configurable by me has updated and broken our builds. I'm not [alone](https://github.com/actions/virtual-environments/issues/4086?ref=connortumbleson.com) and this happens semi often and is resolved quite quickly, but still itches my brain. I'm not sure if the solution is supporting minor versions or having more automated checks, but our builds failing randomly and how crucial they are to work becomes a major problem.
---
**YAML Features**
GitHub is YAML, much like [GitLab](https://docs.gitlab.com/ee/ci/yaml/?ref=connortumbleson.com#yaml-specific-features) and one thing I've noticed is GitHub does not support any of the cool features like templates, anchors and aliases when it comes to writing workflows.
The matrix feature can help a bit, but after building some real complete workflows. I guarantee you'll want some of the interesting YAML features. Now I have to deal with a lot of duplicated logic across many workflows and any enhancement takes way longer to port to every location vs updating a few templates.
---
**The Text Oddities**
I don't know if folks have noticed, but if the build is running on a long running step and you load that workflow. Chances are the text of that specific step will not load till its complete. If you watch the build from the beginning - no issue.
This happens nearly every time for me, so it must be some bug with how text renders in GitHub Actions when you open a build while its on a step. So if you have a build running on a long deployment step and open it up to check progress. Chances are it will refuse to show anything and you have to debate waiting endlessly with no output or cancel it.
---
**Cross Workflow Dependencies**
GitHub Workflow
As workflows become more complex you'll have a natural extinct to split them up. Since it would be pretty cool to have a separate workflow for linting, testing and deployment.
However, you cannot do that as you can only depend on jobs within your own workflow. As builds get more complex - you might be looking at 1000 line+ files. While you could wire up talking to the actual GitHub API and attempt to replicate the behavior of same workflow in multiple files the pure overhead for that would tempt most away.
Additionally, if cross workflow depending worked you could easily put different code owner protections in place for the deployment process while letting others tweak/adapt the linting/testing process.
---
**Overall Status**
One thing I quickly encountered is wanting to build a Slack notification on complete of the build - including the pass/fail/cancelled status. At first I thought I could use `$GITHUB_STATUS` to include the status of the entire build, but it does not work as I expect.
Imagine a workflow where you have the deployments at the end (if applicable) since as you know - you can't have split workflows. So if this is a build that is not going to be deployed and you put your Slack call at the end - it never completes.
If you include all the previous jobs as requirements so it doesn't fire immediately - it won't fire since a previous step was not completed. If you adapt the call to allow any output, then how do you determine if it was pass/fail? I haven't found a way since `$GITHUB_STATUS` is misleading.
It seems a generic property of "This is the build status up to this point of any workflow that ran" would be pretty swell. The skipped jobs are natural all the time so they should not be counted.
---
In closing, GitHub Actions is swell and it can't be expected that it will have all features that Jenkins has had for a decade. It'll get there, but until then I'll have a wishlist.
### Travel Blog: Tampa, FL
URL: https://connortumbleson.com/2021/09/13/travel-blog-tampa-fl/
Last updated: 2025-02-04T11:43:04.000Z
Photo by [Kody Cheyne](https://unsplash.com/@kodycheyne?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The most travel in a short amount of time, but instead of flying to Kansas City or driving to Key West. I stayed right where I live when instead a few other friends flew down for the 3 day weekend.
The airport on a regular Friday morning to pick up the friends was a bit more packed than I remember during this long running pandemic. It looked like a regular pre-pandemic day just with masks everywhere. One flight was slightly delayed, but short term parking for under an hour is free. So I could pick up both friends and leave without paying a dime in parking at the garage.
We left straight for a staple in the Tampa area - the Colombia Cafe, but not the original brick and mortar location. Instead, we went towards the location on the water in an outdoor setting.
[1905 Salad - Colombia Cafe](https://www.columbiarestaurant.com/Menus-By-Location/Locations/Tampa-Bay-History-Center?ref=connortumbleson.com)
This place makes a salad that I have not been able to replicate the dressing for. It's quite the perfect blend of cheese, tomatoes, shrimp, olives, lettuce and dressing. With that salad, our table got a freshly made (table side) Mojito pitcher. The first Florida vacation meal for the friends visiting and I believe some of the best food in Tampa.
After that, it was still early around lunch time so it was off to the grocery store since buying food for the weekend did not work out with my timing up to that day. We bought tons of stuff to prepare for the wing challenge and other meals for a few days.
Cosmic Brownie Vodka Shot + Mega Mega Stuffed Oreo
This was the first time I had met up these friends for an extended period of time since probably high school. So a few shout outs to some goofy food and drink options we did back then. If you've never bought mega stuff Oreos and merged two of those together to make a mega mega stuff Oreo - you are missing out.
The wing challenge if you aren't familiar is eating increasingly hotter wings working your way up to the 2 million Scoville hot sauce. This was made popular by the hit YouTube series - [Hot Ones](https://en.wikipedia.org/wiki/Hot%5FOnes?ref=connortumbleson.com). This season of sauces (Season 15) had one in particular that seriously knocked me down.
Wing Challenge - Labor Day 2021
While a snafu in shipment gave us Da' Bomb Evolution - we were expecting Da' Bomb - Beyond Insanity. I've known from other challenges that Da Bomb seriously hurts with that chemical heat burn. However, [Hotter than El - Love Burns](https://heatonist.com/collections/hot-ones-season-15/products/hotter-than-el-love-burns?variant=39281760338018&ref=connortumbleson.com) prior destroyed me.
Mixing a wing together in a bowl of pure hot sauce and proceeding to bite and rip the chicken apart with your mouth and eat the entire wing is just asking for danger. My nose was running, eyes watering, drinking milk, drinking alcohol, drinking water, running water over my mouth, spitting constantly. This was a pure pain level in my mouth that only time would heal. So I give major credit to those on the show that can remain composed with a single water and milk while being interviewed.
After that sauce the heat went up by scale, but nothing came close to the pain I felt after that Hotter than El sauce. However, all of us pushed through with wings cooked on a [Green Egg](https://biggreenegg.com/?ref=connortumbleson.com) and completed the challenge.
---
The next days lead to experiencing some of the nature of Florida, heading to Ft. De Soto and even Egmont Key. I quickly learned that everyone else on a 3 day Labor Day weekend was thinking the same thing. Egmont Key, which on my normal trips is quite empty, had a boat anchored every 10 feet. Even the ferries that visit were having to maneuver around each other to make room as every location it appeared was sending folks to the island.
Gopher Tortoise - Egmont Key
While walking back to the ferry and catching some rest at a picnic table a little tortoise joined us for some food. An easy picture opportunity without messing with the guy.
The trip to this island is what increasingly bothers me each time. I just have to remember that not everyone is from Florida and have seen dolphins and manatee. The price for this island per person has gone up $10 since I moved here, so you now pay $30 per adult to visit. A 10 am departure used to get us to the island around 10:15, but now the slow speed and discussion about spotting dolphins eats so much time. Likewise, the return is so slow and not even a straight shot to the land. For myself personally, if I wanted to pay money to boat around looking for dolphins - I would. I paid to see the island and spend as much time on it as possible not eat 30-45 minutes of the time on the boat.
As we reset after a long day in the sun - it was time to experience more of the food that Florida offered. From [Ulele](https://www.ulele.com/?ref=connortumbleson.com) in Waterworks to [Half Moon Seafood](https://www.halfmoonseafood.com/?ref=connortumbleson.com) in Temple Terrace and finally [The Sail](https://www.tampa.gov/tcc/the-sail?ref=connortumbleson.com) on the Tampa Riverwalk. All great places to visit if visiting down here in Tampa. Sadly no pictures taken at these places since it appeared I was living in the moment and forgetting to document it.
---
With that a reverse travel blog out of the way.
### Leaving your Mark
URL: https://connortumbleson.com/2021/09/06/leaving-your-mark/
Last updated: 2025-02-04T11:43:04.000Z
Photo by [Mantas Hesthaven](https://unsplash.com/@mantashesthaven?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I got an interesting email a year or so ago about an individual who wanted to say thanks. This individual reminded me of a website I ran a decade+ ago during the boom of online forum communities. This site specialized in discussions around the original Xbox and Halo 2 - like the plenty of forums also in that field around that time.
My forum had a very small active community - we may have had 25,000 registered members, but only a handful checked in daily. Though, it was a community at the end of the day. Folks knew each other and communicated with each other.
This individual explained about how his life wasn't in the best place a decade ago and my site was his little escape zone to learn and chat. He explained it was the first time he felt like he belonged somewhere and how glad he was that the site existed. He wanted to pass along a thanks as he just had graduated from school and attributed a lot of his positive memories to my community.
This meant a lot as silly as it sounds. Something organized and watched over by myself helped someone's life in a positive way.
---
You don't even have to look far and you can find this same pattern in everything. I remember a site called Casual Collective (now dead) that was a mini forum and community for all these flash games.
ArchiveMachine - "old.casualcollective.com"
Folks were friendly and messages flew the instant your status went online. Its a shame that site monetary model could not compete with just moving everything to Facebook games, but it was a fun time while it lasted.
I could list another example with random IRC chats on Freenode, which once again has fallen in time (*I wouldn't support Freenode anymore and instead use [Libera.Chat](https://libera.chat/?ref=connortumbleson.com)*). These chats and communities had folks from all walks of life. The more you stayed and took part - the more you learned about everyone.
The specific point I'm trying to draw here is you don't know the personal background or history of everyone at all times. Yet a few positive comments or including folks might change the life of someone unknowingly. This of course can happen in the opposite direction for just pure toxicity which is sadly easy enough to witness.
Some communities were so intent on the power and knowledge they had they forgot what being a newbie felt like. They drove them away with toxic behavior and mocked their questions or inability to connect the dots. There is a tough line to walk though between spoon feeding information to someone or giving them a hint to the path forward.
[Stack Overflow](https://stackoverflow.blog/2018/04/26/stack-overflow-isnt-very-welcoming-its-time-for-that-to-change/?ref=connortumbleson.com) had this to the extreme. Folks would post questions and instantly members would respond - "*what have you tried?*". It became a toxic culture that unless you proved you went to hell and back folks would gate-keep the answer to simple questions. It got so bad that Stack had to release [entire company blog](https://stackoverflow.blog/2018/04/26/stack-overflow-isnt-very-welcoming-its-time-for-that-to-change/?ref=connortumbleson.com) about culture changing and blocking specific phrases.
[Group by sum mongodb \[duplicate\]](https://stackoverflow.com/questions/17909694/group-by-sum-mongodb?ref=connortumbleson.com)
I used StackOverflow occasionally and I put forth the effort to show a challenge I encountered with what I expected and what I tried. Within a few hours an individual responded with the why and the answer. A perfect exchange of sharing knowledge from one to another. Not a single part of this answer was insulting my knowledge or degrading the style of my query/code.
Where are the communities that bled toxicity? Do they even exist even more?
No one is going to remember the asshole that told you to pound sand when asking for help. It takes a bit to remember that everyone was learning at one point. One supportful encounter in life or online may positively affect someone forever.
### Apktool v2.6.0 Released
URL: https://connortumbleson.com/2021/09/02/apktool-v2-6-0-released/
Last updated: 2025-02-04T11:43:04.000Z
Apktool v2.6.0 has been released! This is a long overdue release that fixes many issues and packs a few new features/behavior in.
The last release was way back in December of 2020 so the promise of making quicker releases didn't really hold up. Building aapt/aapt2 binaries has gotten increasingly complex over each and every release. Building a pure AOSP build of build tools got a bit more difficult.
So lets talk about this release.
---
We've started publishing to [Maven](https://search.maven.org/artifact/org.apktool/apktool-lib?ref=connortumbleson.com) now on each release build. This has opened up some glaring issues in the Apktool code base:
- Declared exceptions never thrown
- Missing docblocks
- Code smell issues leading to warnings
- A not very sane API to use in library form
The good news is most of these are resolvable and a good chunk of them were slipped into 2.6.0\.
Goooler stepped in and upgraded the entire ecosystem of Apktool. Whether from direct dependencies to the CI/CD process to the build process itself. The project should be a bit easier to work in now for those wanting to contribute.
Binaries were updated again for aapt1/aapt2 and enhancements were made to our CI process to ensure that static unbroken binaries will also be produced. This should result in less cryptic errors when an aapt build was invalid.
The war on obfuscation never ends and this release is no exception. Much work was put into string handling learning from the bundletool project that had to a similar and much better approach of parsing strings.
The release as always fixes a good deal of issues between disassembling and building and should lead to a more stable experience.
The change log is below, but before is a snippet of news about the next releases. Apktool is an interesting pickle with the [announcement of APKs](https://android-developers.googleblog.com/2021/06/the-future-of-android-app-bundles-is.html?ref=connortumbleson.com) effectively not being produced during the application development stage. Bundles will be built and Google will produce the APK for the specific language and resource set per phone. This puts Apktool in an interesting position on many topics.
I've started a public discussion about [Apktool 3](https://github.com/iBotPeaches/Apktool/discussions/2641?ref=connortumbleson.com) and while nothing is set in stone yet - this is my goal.
- Apktool 2.6.1 - A few months away - fixes and non-breaking changes
- Apktool 3.0.0 - 6-10 months away - Removes aapt1 entirely, replaces internal system for configurations for disassembling, breaks API for a more sane library usages
All opinions are welcome, but with that - **Apktool 2.6.0**.
---
**This release had 195 commits by 11 people**
- Connor Tumbleson (iBotPeaches) - 149
- Goooler - 22
- Igor Eisberg (IgorEisberg) - 10
- Comnir (Nir) - 5
- pashamcr - 2
- wangyilei - 2
- MrIkso - 1
- Andrea Pappacoda - 1
- Cody Lund (codylund) - 1
- Matteo Baccan (matteobaccan) - 1
- itaybia - 1
One thing to note is this release of development was the first release to heavily use rebase/squash merging. This has the side affect of affecting commit counts, but either way - thank you to the contributors for this release.
---
# Changes since 2.5.0
- \[[#2580](https://github.com/iBotPeaches/Apktool/issues/2580?ref=connortumbleson.com)\] Android 12 Support
- \[[#2529](https://github.com/iBotPeaches/Apktool/issues/2529?ref=connortumbleson.com)\] Published to [Maven Central](https://search.maven.org/artifact/org.apktool/apktool-lib?ref=connortumbleson.com)
- \[[7691c](https://github.com/iBotPeaches/platform%5Fframeworks%5Fbase/commit/63f688ebacc6a92ddf298ef6a88edc996017691c?ref=connortumbleson.com)\] Update internal aapt/aapt2 binaries.
- Upgrade baksmali/smali to [v2.5.2](https://github.com/JesusFreke/smali/commit/cbd41d36ccde221ccc4ec2aa0c15ca2fa4491a62?ref=connortumbleson.com)
- Upgrade to `gradle 7.2` (Thanks Goooler)
- Upgrade to `snakeyaml 1.29` (Thanks Goooler)
- Upgrade to `guava 30.1.1-jre` (Thanks Goooler)
- Upgrade to `junit 4.13.2` (Thanks Goooler)
- Upgrade to `commons-lang 3.12.0` (Thanks Goooler)
- Upgrade to `commons-io 2.11.0` (Thanks Goooler)
- Upgrade to `proguard 7.1.1` (Thanks Goooler)
- Upgrade to `license.hierynomus 0.16.1` (Thanks Goooler)
- Upgrade to `jengelman.shadow 7.0.0` (Thanks Goooler)
- Upgrade to `actions/setup-java@v2` (Thanks Goooler)
- Added `.gitattributes` (Thanks Goooler)
- Added support for SDK in Development (Tiramisu, API 32?)
- Added automatic execution of aapt/aapt2 binaries during CI process to find broken builds.
- Added automatic `ldd/otool -L` execution during CI process to identify non-static “fat” aapt/aapt2 builds.
- Added test execution on Java 15/16 (Now 8-16) during CI process.
- Upgrade aapt2 with patches for `attr-private` and remove reserved pkgIds. (Thanks MrIkso)
- Upgrade aapt1 with patches for a static binary on Mac arch.
- \[[#2604](https://github.com/iBotPeaches/Apktool/pull/2604?ref=connortumbleson.com)\] Add lazy init for ResTable for optimizations. (Thanks IgorEisberg)
- \[[#2605](https://github.com/iBotPeaches/Apktool/pull/2605?ref=connortumbleson.com)\] Add automatic disassemble/assemble JAR files without specifying api level. (Thanks IgorEisberg)
- \[[#2201](https://github.com/iBotPeaches/Apktool/issues/2201?ref=connortumbleson.com)\] Changed zipslip exceptions to skip file instead of exit on failure.
- \[[#2229](https://github.com/iBotPeaches/Apktool/issues/2229?ref=connortumbleson.com)\] Changed dummy resource names to `APKTOOL_DUPLICATE_{Type}_{RESID}` to prevent starting with numeric
- \[[#2635](https://github.com/iBotPeaches/Apktool/pull/2635?ref=connortumbleson.com)\] Changed all Apache License links to `https`. (Thanks Goooler)
- \[[#2632](https://github.com/iBotPeaches/Apktool/issues/2632?ref=connortumbleson.com)\] Changed `getHTML()` processor to leverage BundleTool code for handling complex string values. (Thanks itaybia)
- \[[#2099](https://github.com/iBotPeaches/Apktool/issues/2099?ref=connortumbleson.com)\] Fix decoding issue requiring specific order of chunks (library/table). (Thanks LoyieKing)
- \[[#2299](https://github.com/iBotPeaches/Apktool/issues/2299?ref=connortumbleson.com)\] Fix decoding issues with code points over > 0x10000\. (Thanks Comnir)
- \[[#2546](https://github.com/iBotPeaches/Apktool/issues/2546?ref=connortumbleson.com)\] Fix decoding issues with surrogate pair emojis. (Thanks Comnir)
- \[[#2455](https://github.com/iBotPeaches/Apktool/issues/2455?ref=connortumbleson.com)\] Fix NPE when decoding to a custom non-empty root directory.
- \[[#2499](https://github.com/iBotPeaches/Apktool/issues/2499?ref=connortumbleson.com)\] Fix Android 11 dex NPE due to hidden api restriction flags. (Thanks JesusFreke)
- \[[#2603](https://github.com/iBotPeaches/Apktool/issues/2603?ref=connortumbleson.com)\] Fix dummy resources being built as type resources vs item resources.
- \[[#2611](https://github.com/iBotPeaches/Apktool/issues/2611?ref=connortumbleson.com)\] Fix numeric string meta-data losing context of data type. (Thanks codylund)
- \[[#2554](https://github.com/iBotPeaches/Apktool/pull/2554?ref=connortumbleson.com)\] Reduce code smell failures. (Thanks matteobaccan)
- \[[#2604](https://github.com/iBotPeaches/Apktool/pull/2604?ref=connortumbleson.com)\] Reduce code smells & correct improper opcode use for baksmali. (Thanks IgorEisberg)
- \[[#2636](https://github.com/iBotPeaches/Apktool/pull/2636?ref=connortumbleson.com)\] Reduce code smells for unused logic, unneeded casting and newer Java language features. (Thanks Goooler)
- \[[#2604](https://github.com/iBotPeaches/Apktool/pull/2604?ref=connortumbleson.com)\] Remove unused `targetSdkVersion` for source disassemble as value was not populated yet. (Thanks IgorEisberg)
- \[[#2633](https://github.com/iBotPeaches/Apktool/pull/2633?ref=connortumbleson.com)\] Remove duplicate workflows for 1 unified GitHub Action workflow. (Thanks Goooler)
## Notes
- Applications are becoming more and more difficult to build with aapt1, using the `--use-aapt2` flag during rebuild is a good test.
## Download
- [Apktool 2.6.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.6.0.jar?ref=connortumbleson.com)
- md5 `4161cdad59718f81740d0727c9683819`
- sha256 `f750a3cd2c1f942f27f5f7fd5d17eada3bdaff0a6643f49db847e842579fdda5`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### Doom, Gloom and Music
URL: https://connortumbleson.com/2021/08/30/doom-gloom-and-music/
Last updated: 2025-02-04T11:43:04.000Z
Photo by [JOSHUA COLEMAN](https://unsplash.com/@joshstyle?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Watching Netflix, I stumbled upon a song that clicked in my brain as such an interesting lyric set and beat. Since my phone (Pixel 4) is creepy beyond belief - it had lodged the song into my "Now Playing" history.
This song was [Silverchair - Anthem for the Year 2000](https://en.wikipedia.org/wiki/Anthem%5Ffor%5Fthe%5FYear%5F2000?ref=connortumbleson.com).
You can give it a listen if you want - I think the intent is overly sarcastic, but to drive home the point that the youth lives should not be heavily influenced by the older politicians.
> We are the youth
> And we are knocking on death's door
>
> Maybe we don't wanna live in a world
> Where our innocence is so short
>
> [lyrics - Anthem For The Year 2000](https://www.azlyrics.com/lyrics/silverchair/anthemfortheyear2000.html?ref=connortumbleson.com)
So what happened up to the year 2000 to create this song and many others like it?
[Geek Squad reflecting on 20th anniversary of Y2K](https://corporate.bestbuy.com/geek-squad-agents-reflect-on-20th-anniversary-of-y2k/?ref=connortumbleson.com)
Was it the upcoming year that all technology when the clocked clicked over would stop working? Perhaps, it was the more serious ramifications of the image of two students gunning down classmates in the Columbine school shooting.
Y2K led engineers down a path of preparing for the future - clear that technology was not going away.
Columbine scared millions into losing trust in visiting a school. The police introduced new deployment tactics to immediately involve them in an active crime-scene instead of waiting for a specialized task force. The other deranged individuals used this event to give them confidence to push copycat school shootings forward.
We can look back to music, which consistently was used as an outlet for current events. From memory, [P.O.D - Youth of the Nation](https://en.wikipedia.org/wiki/Youth%5Fof%5Fthe%5FNation?ref=connortumbleson.com) rings a bell the most.
An interesting music video if you'd like to watch it - the idea in these lyrics is two stories in parallel. The first is about a teenage girl skating to school only to be gunned down and killed by another student. The 2nd half of the song is a guy attempting to fit in with the popular group and ultimately failing and leading to suicide from firearm.
P.O.D created this song because they were stopped in traffic on the way to record from a different school shooting ([Santana High School](https://en.wikipedia.org/wiki/Santana%5FHigh%5FSchool?ref=connortumbleson.com))
> But who knew that this day wasn't like the rest
> Instead of taking a test
> I took two to the chest
> ...
> Who's to blame for the lives that tragedies claim?
> No matter what you say
> It don't take away the pain
> ...
> That I feel inside, I'm tired of all the lies
> Don't nobody know why
> It's the blind leading the blind
>
> [lyrics - Youth of the Nation](https://www.azlyrics.com/lyrics/pod/youthofthenation.html?ref=connortumbleson.com)
We can continue this thought exercise again with a few more global events that occurred up to the year 2000.
What about Waco? A religious sect of individuals known as Branch Davidians, that led to a siege and burning of the compound leading to \~80 deaths including that of many many children. Was the memory of mass suicides from the past of [Heaven's Gate](https://en.wikipedia.org/wiki/Heaven%27s%5FGate%5F%28religious%5Fgroup%29?ref=connortumbleson.com) or [the Peoples Temple](https://connortumbleson.com/2020/02/10/the-peoples-temple/) all building up to the year 2000?
Or was it perhaps nature? [Hurricane Andrew](https://en.wikipedia.org/wiki/Hurricane%5FAndrew?ref=connortumbleson.com) struck in 1992 and blew a hole in how prepared America was for more dangerous storms. Building codes changed, FEMA went under fire for being so slow and it was just the beginning. Every few years another hit - Irma, Maria, Sandy, Katrina, Harvey and more.
Or finally, was it the huge uptick of the [opioid crisis](https://time.com/5778759/the-pharmacist-netflix/?ref=connortumbleson.com)? OxyContin rose to insane popularity and Purdue Pharma might have led to the drug abuse of millions simply chasing a payday for the company.
We can look to music again for a song related to the events - System of a Down released an album in 2001 called [Toxicity](https://en.wikipedia.org/wiki/Toxicity%5F%28album%29?ref=connortumbleson.com). On it was a song after the same name.
This song between the lyrics hints massively at the drug problem of the time.
> Eating seeds as a pastime activity
> The toxicity of our city, our city
> ...
> Somewhere between the sacred silence and sleep
> Disorder, disorder, disorder
> ...
> You, what do you own the world?
> How do you own disorder?
>
> [lyrics - Toxicity](https://www.azlyrics.com/lyrics/systemofadown/toxicity.html?ref=connortumbleson.com)
As the lyrics suggests above, "*eating seeds*" was about popping ADD pills. Schools anywhere are obviously obsessed with the medication. Students play it off as the "study pills" and bargain them off students who have them legitimately. While others go to a doctor with the intent of asking to be put on a prescription for the medication.
The line about "*scared silence and sleep*" is probably hinting at the fact that some of the population lives on with medication that suspends them between reality of death and sleep.
You can find references in nearly every song so it was a trip back in time to look at the songs of the 2000s and now connect the dots to what it meant.
### The Parks of Tampa
URL: https://connortumbleson.com/2021/08/23/the-parks-of-tampa/
Last updated: 2025-02-04T11:43:05.000Z
For this post I wanted to take a look at some parks around Tampa that I frequently visit and provide some commentary about them as well as location/website/pricing for each one.
---
### Lake Rogers
[Website (Hillsborough County)](https://www.hillsboroughcounty.org/en/locations/lake-rogers-conservation-park?ref=connortumbleson.com)
- 7am - 6pm
- $2 per vehicle (*honor code since no attendant*)
- Odessa, FL
So this park was the first park I encountered after moving to Tampa. It was about 5 minutes from my apartment when I first moved here. This parking lot was normally quite damaged with a swampy muddy tiny lot - with an envelope and sign to pay $2\. You were expected to take one of the envelopes, take the car decal out and put in $2 and deposit it. There were occasions I skipped it, but if I had the change/cash on me - I did pay.
Over the years that payment machine evolved to some digital, but still manual equipment to pay either digitally or physically and get a receipt printed out to place on your dashboard. The trail starts at the parking lot and has tons of different paths:
- Straight to water
- Straight to Equestrian trail
- Start the inner loop
- Start the outer loop
The inner loop (closet to the pond) on most occasions I went had plenty of locations flooded. So for a run in the morning - it wasn't the best loop to take unless you wanted some mosquito laden water to splash around. I actually [blogged](https://connortumbleson.com/2016/03/03/ingress-a-morning-hike/) about this years and years ago from an Ingress point of view with tons of photos of the flooding if curious.
The trail has no boardwalk, just the pure ground of the Earth. Cleaned up and brushed off every morning to locate and remove any large branches that have fallen. A good place to run, walk and kayak with a partial amount of the trail in shade cover on a hot day.
---
### Brooker Creek Preserve
["Brooker Creek Preserve Tarpon Springs"](https://www.flickr.com/photos/73114641@N00/49046635197?ref=connortumbleson.com) by [RobandSheila](https://www.flickr.com/photos/73114641@N00?ref=connortumbleson.com) is licensed under [CC BY-NC-SA 2.0](https://creativecommons.org/licenses/by-nc-sa/2.0/?ref=ccsearch&atype=rich)
- 7am to 1 hr till sunset
- Free
- Tarpon Springs, FL
- [Website](http://www.brookercreekpreserve.org/?ref=connortumbleson.com)
Brooker Creek has probably the best entrance of non-beach parks. You'll enter a near 1/2 mile journey at a slow pace through the preserve coming up to the large parking lot and entrance.
This park starts off on a boardwalk if you stay near the nature center and other buildings, but then drops off into some brushed Earth. The deeper you go on this trail it opens up at various points to various alternate trails. You may stumble upon the black water cutoff portion which will take you on a large loop through a barely touched trail that may be flooded.
I'd highly recommend bug spray for this park since standing water is everywhere. I've not gotten to experience the various buildings and tours that exist here, but I each time I come there is either a camp, group of kids or some bird watching group here.
---
### Lettuce Lake Park
[Website (Hillsborough County)](https://www.hillsboroughcounty.org/locations/lettuce-lake-conservation-park?ref=connortumbleson.com)
- 8am to Sunset
- $2 per vehicle
- Tampa, FL
This park is paved throughout the main trail with little offshoots for boardwalk trails and some through the trees nature trails. The distance for a single loop on the pavement is roughly 1.2 miles so its quite nice for a running loop and quite calm and peaceful in the mornings.
The trail intersects the park road in one location and my luck of getting into accidents or close calls between cars and runners is not the best. I've been hit by a car (\~10mph) at this park while running. This is the only park this has ever happened so not sure what the deal is.
While this park is more built up in infrastructure than some of the other parks I normally visit. I tend to spot snakes crossing the trail at this park way more than any other. You can also people watch those renting kayaks and see how good folks are staying upright while entering the river.
The entrance isn't hard to miss by a main road and parking is everywhere by each major portion of the park. The playground, kayak, boardwalk, trail, nature center and sport courts all have a distinct parking. Lucky for most the parking is under trees for a nice cool parking before the day heats up into the 90s.
---
### Upper Tampa Bay Park
[Website (Hillsborough County)](https://www.hillsboroughcounty.org/en/locations/upper-tampa-bay-park?ref=connortumbleson.com)
- 8am to 6pm
- $2 per vehicle
- Tampa, FL
Upper Tampa Bay Park is not easiest park to traverse unless you like crossing parking lots consistently. This park has many different locations throughout to take one of the many nature trails. Unlike other parks in which the trails all connect - these do not. So you either have options to move your car in between trails or walk \~5min around the parking lot to the next entrance.
The big focus around this park is water entry. There seems to be a huge abundance of canoes and kayaks available for renting. This park is all about boardwalks and swamp/marsh water viewing. I wouldn't recommend this park for exercise unless you stay off the boardwalk sections and near the hot sand area.
---
Next time, I'll try and do a deep dive into some gulf parks like Boyd Hill, Ft De Soto, Honeymoon Island and Caladesi.
### Travel Blog: Florida Keys
URL: https://connortumbleson.com/2021/08/16/travel-blog-florida-keys/
Last updated: 2025-02-04T11:43:05.000Z
Photo by [Florida-Guidebook.com](https://unsplash.com/@hayden%5Fdunsel?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A strange situation to have back to back travel blogs, but you can't predict funerals and a trip to the keys was in the books for the birthday. This time no flights needed, just a drive on an early Saturday morning to Key Largo, Florida.
The drive consisted of a few unique portions - the regular highway drive from Tampa to Naples, then the Alligator Alley portion to cross the state and finally the single lane Highway 1 to connect Miami to the keys. It was a longer drive than usually clocking in around 5 hours and 30 minutes. The last time I remember doing this drive phone signal would drop in random locations, but this time the entire drive to the destination kept LTE signal.
House overlooking the ocean
There is also something strangely odd heading to the keys when a potential hurricane Fred is approaching. However, as Saturday hit it was becoming clear that this storm would not even hit category 1 and might perhaps just spin into the gulf and die out. The locals were staying, but a good deal of cars and traffic were leaving the keys - not heading in. The wind was quite strong and it did rain off/on the entire time, but otherwise just another regular time in the keys.
Since it was my birthday over this weekend - I decided to go to a tiki bar after lunch with some of the family for drinks. We weren't allowed to sit on the beach portion because of "danger" (pending hurricane) even though the water looked like glass. A few ciders turned to hard liquor turned into meeting some randoms at the bar for more drinks. It had been since the start of the pandemic since I really sat down at a bar and consumed a ton of alcohol. A few birthday shots and drinks from the bartender and locals and for sure I was over my limit.
Marker 88 - Key Lime Pie
Outside of the alcohol though, nearly every single place claims they have the best key lime pie or makes it from scratch. There were stores that specialized in pies nearly every 10 minutes on the road. Probably like the cuban sandwich is to Tampa, the key lime pie is to the keys.
We did head north on the keys into Key Largo towards the end of the trip to visit Ocean Reef, which can't really be explained. Its a place of yachts and more, but you can do a day visit without staying in the expensive homes there. Its the slow season there during the summer - so nearly everything was under construction.
1 Pound Spicy Peel n Eat (Raw Bar) / Mahi Mahi Blackened Sandwich (Palm Court)
However, it was a great time to still enjoy the unique restraunts that serve dishes that are perfect for the atmosphere and area. Peeling shrimp while sitting on a channel watching boats go by is quite the casual dining experience.
Ocean Reef is also known for cats everywhere. They are cared for by the ORCAT organization that traps, neuters and takes care of the cats to keep the population in check. We stumbled upon one friendly individual walking around the stores.
Random cat in Fishing Village
The beach was under construction with half it closed for improvements. The beach bar was packed as usual with an interesting small twist - I ran into another person with the taco cat meme collared shirt. I had mine packed in romper form, but a quick change in the bathroom and I was matching. From the instant I walked out of the bathroom running into a staff member to leaving the beach - every single person had something to say.
This blog goes out on Sunday as usual, but my long drive begins early tomorrow (Monday). No more travel after this for awhile, so the non-travel blogs will resume.
### Travel Blog: Kansas City (2)
URL: https://connortumbleson.com/2021/08/09/travel-blog-kansas-city-2/
Last updated: 2025-02-04T11:43:05.000Z
Photo by [Daniel Thomas](https://unsplash.com/@dtbosse?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
My 2nd travel via plane since vaccinated and this time off to the homeland of Kansas City, Kansas for a funeral. It's the summer months so just trading humid heat for dry heat of the Midwest.
This trip was short with a early morning Saturday landing with an equally early Monday morning departure. To make things easier with the odd hours, I drove my car to the airport for parking & rented a car in Kansas since I remember the airport being an hour away from anywhere I'm headed.
The airport in Tampa was absolutely packed beyond belief for a 5:55am departure. The trains that connect the airport to the terminals were densely packed like sardines. I was thinking its known that no one is on the returning trains during those early 4-6am trips - they don't need to leave the exit doors open for 20 seconds before opening the entrance side - there is no one leaving!
That might be a simple quality of life improvement that works in reverse as well, since no one is heading to the terminals when flights are landing at midnight.
With the line for security as busy as spring break during a global pandemic - I was happy that a few changes occurred. Every single scanner was open and it was the new enhanced ones that just required throwing your bag into a box. Nothing to take out and nothing to change - I even got to walk through the security scanner with shoes and a watch on.
The flight was not packed and I only had a mother/baby in the aisle seat in my row. This was the calmest child I've ever had the experience of flying next to - this child slept the entire flight and made zero noise. When the flight landed a handful of folks also told the mother this.
### Kansas
Landing in Kansas I quickly remembered how dated this airport was. I had to meander myself off the plane through a busy gate just to get outside. To sit on a median and wait 10 minutes for the rental car shuttle to show up - then the shuttle had to start/stop at every single stop for 2 terminals swapping folks at each one.
Annoying, but I got my car rented and went off to my old high school for a memorial service. The school had changed massively in the decade since I had been gone - fences were everywhere. Was this a security enhancement in the era of school shootings or just how safety has evolved?
The fields at old high school - Aug 7, 2021
When the service was over I went to one of the old sandwich places I used to work to try out Mr. Goodcents.
Mr. Goodcent - Original on Wheat
I noticed almost immediately that the onions used were red onions and not what I remember from the past. The old sandwich used thinly cut white onions and now they have changed. Outside of that, the bread was as fresh as I remember with the meats being sliced in front of you for each sandwich.
A good sandwich to remember what I used to eat weekly back in the day.
---
My flight this time is Monday morning at a crisp 6:50am with an airport 40 minutes away and a rental car to return. It will be a hectic morning, but this blog post will be going out before that occurs. Hopefully, I'll wake up in time, return the car and make it to the flight to arrive safely home in Florida. I'll then debate heading to the office late or taking the day off.
I'm not sure when or where my next flight will be, but hopefully the era of COVID-19 will be over by that point.
### Gen Z is Screwed
URL: https://connortumbleson.com/2021/08/02/gen-z-is-screwed/
Last updated: 2025-02-04T11:43:06.000Z
This post all started with a simple quote I heard that went something like - "*If Facebook was popular when I was in school, it would have made my life hell.*"
It rang a bell in my head, because I still remember when rumors were moving about the newest coolest social media site that was for college students only. This would quickly allow high school students and then evolve to allow anyone of a certain age and that was Facebook. There was social media before that with Xanga and MySpace, but neither of those really boomed and took off like Facebook. I attribute this to the age of mobile phones becoming smart around the time of Facebook.
So let me set the stage for why I believe this upcoming Generation Z is going to have some challenges to overcome. I believe this has to do with 3 things - social media, current events & technology. So lets start with the problem.
The CDC put out a report a few years ago titled - *[State Suicide Rates Among Adolescents and Young Adults Aged 10–24: United States, 2000–2018](https://connortumbleson.com/uploads/2021/07/nvsr-69-11-508.pdf).*
What is interesting in this report to me is the following breakdown of suicide among kids aged 10 to 24.
- 2007 Suicide Average Rate (per 100k) - **6.8%**
- 2018 Suicide Average Rate (per 100k) - **10.7%**
That is roughly a 57.4% increase in suicides and that is just the average. When you look at each state percent increase individually - it swings quite massively in the average percent change.
Curtin SC. State suicide rates among adolescents and young adults aged 10–24: United States, 2000–2018\. National Vital Statistics Reports; vol 69 no 11\. Hyattsville, MD: National Center for Health Statistics. 2020.
I now live in Florida which is surprisingly low in the percent change, but I grew up in Kansas/Missouri which holds 60% or above in the increase in suicide rates among kids.
I was in a position like million others to be going through school while personal technology and social media was just taking off, while the next generation is going through school from a completely different point. So let's jump into my 3 categories, which blend massively together and talk through this.
## Social Media
There are folks in this world that their entire life is focused on matters like these, so I can't pretend to know more than those. I however, can give personal experiences and notice the differences between then and now.
Social media becomes more powerful when access to it becomes easier. This naturally happened with the growth of technology and putting smart phones in the pockets of all. In my age, I remember when the first kid got an iPhone. It was news among everyone, because that device was insane with features.
Though if you take the clock back 1-2 years in my era. Only a handful of students had phones - the rest were forced to use the community phone located at the front of the school if a simple call wanted to go out. In today's world, I live by a high school and drive by an elementary school on the way to work. The obvious fact is that every high school student has a phone with some form of headphones on the walk to school. What is the scary part is watching the elementary school students walk to school with phones in hand that are larger than their arm.
So lets talk about a event. At one point in middle school, yes middle school. Rumors were flying around that this one girl had naked photos that leaked. They were being passed like wildfire through text messages. Long story short, the girl switched schools. I don't know how those photos leaked, but that absolutely ruined that girl's life to the point she had to move schools.
As I got older and phones got stronger and in more pockets. Services literally launched that fueled this behavior. "{school} Crushes" on Twitter was an account that you could direct message a secret and it would publicly post it anonymously. The maintainer of that account obviously new the true owner, but kept those secrets reserved for those in the know. What that service actually became was anonymous bullying for any to take part in.
In college that service evolved to Snapchat and got even crazier. Instead of images and text it was videos and images. It devolved at times to the point that folks were filming themselves having sex. Who knows if both parties in those videos agreed to that or even knew, but it was just unbelievable. These videos went to hundreds near instantly on Snapchat and could be backed up forever. Those accounts got shut down as fast as they were made and like most things - spread like wildfire. Imagine being the girl that soiled her clothes drunk and was filmed from multiple angles and then shared to a Snapchat account that hundreds saved and mocked.
I fortunately grew up in a time in the early school years that when mistakes were made, the memories of them faded in the memory of the witnesses.
## Current Events
In the event side of things. Does anyone remember the 2009 financial crisis? How many homes changed massively because of that? I can give you one example I remember - homes that became financially unstable started pushing that pressure onto the kids. With the idea that better grades would lead to better schools via scholarships which would lead to better salaries. What happens when you push a kid to the end forcing an extreme amount of studying to keep up with the demands?
I know for one kid I knew, the instant college started and the restrictions of being in the parents home was gone - she was committed to rehab in under a year taking up some hard drugs. You could take the approach that kids needed to be kids, exploring neighborhoods and making mistakes to learn from - not spending every waking moment perfecting homework.
## Technology
Finally though, technology is adapting both in hardware and software at immense degrees that some of the younger generation can't handle. So let me bring up a little graphic I made.
Millennials were taught in school that you can't trust Wikipedia since anyone can edit it. They were also taught to not use their real name online since predators could stalk you. Yet the current generation has a Discord account with their real name in the profile to play Minecraft before 10 years old.
Prior to Millennials earlier generations are having to learn a technology that literally didn't exist in their era. How many Generation Z's have fallen for a spam email, fake pop-up or robotic account on social media? It simply doesn't happen, because this technology is ingrained in them unlike the previous.
Take Instagram, a pure dopamine rush for kids, particularly women who can scroll for hours seeing fake reality photo after photo. The longer you stay on the site - the more money you make the company - I [blogged](https://connortumbleson.com/2020/11/02/the-good-times/) about this before. Kids grow up with these high beauty standards on each photo even though most are touched up. I'd estimate that girls make themselves miserable browsing social media and boys make other's miserable. This recipe for disaster for the young generation causes a warped perception of real life which leads down an anxiety ridden path.
The final segment I think could be summarized with just anxiety. Everyone and myself included just look at their phones. If you lock eyes with someone the natural reaction is to look away. Kids wake up checking how many likes they got or what new scandalous rumors were started. I don't think kids need that stuff until high school. I survived just texting friends and using AIM when home, the closest thing to Facebook was comparing buddy profiles attached to your AIM profile to see who had the most views.
Now who knows what the CDC will say in another few years. We've had a pandemic which changed so many things that will be difficult to understand until years of stats can be collected.
### 2002 Kansas Ice Storm
URL: https://connortumbleson.com/2021/07/26/2002-kansas-ice-storm/
Last updated: 2025-02-04T11:43:06.000Z
January 31, 2002 - 8:15am - Leawood, KS
This story will be about the largest winter storm I ever lived, which after writing this post appears to even have an entry in Wikipedia as the [2002 Central Plains ice storm](https://en.wikipedia.org/wiki/2002%5FCentral%5FPlains%5Fice%5Fstorm?ref=connortumbleson.com). I didn't have a cell phone back then, nor do I think any phones of that era had the proper quality for photos.
Based on exif data, I can see I was using an Olympus D-510 camera, a 2 megapixel camera with a max resolution of 1600 x 1200 pixels. Did I own this camera? Did I borrow my parents? - I have no idea and cannot remember. I'm just happy these photos stand up a bit almost 20 years later.
So lets look back at this event with the benefit of seeing the full story. NOAA reported a 4.021 on the RSI scale, which fits into the "Significant" scale. The full scale being:
| Category | RSI Value | Description |
| -------- | --------- | ----------- |
| 1 | 1-3 | Noteable |
| 2 | 3-6 | Significant |
| 3 | 6-10 | Major |
| 4 | 10-18 | Crippling |
| 5 | 18+ | Extreme |
So it apparently wasn't that bad, but when you realize that:
- 650,000 were left without power
- 1 death
- $111 million in damage
- Kansas, Missouri & Oklahoma affected
- 3 inches of ice
All of that together sounds quite intense, but many other locations have registered a CAT5 winter storm just in the time I've been alive. However, as I research those the story is the same - snow on snow on snow. They may have 18 inches of snow in a CAT5 storm, but it seems like ice is so much more devastating than snow.
In Kansas in 2002 we saw trees collapsing, roofs collapsing and power lines crippling under the immense weight of ice.
January 31, 2002 - 8:15am
This first picture shows how lucky our family got with such a large branch collapsing and crashing to the ground. It may have scraped the windows and roof as it collapsed, but there was no broken glass. Other families weren't as lucky with branches falling to break roof or windows leading to a chilly night.
January 31, 2002 - 7:49am
From above you can tell this is not a roof full of snow, but a roof full of a few inches of frozen water. We know from science that roughly one-inch of ice weights around five pounds per square foot, so knowing we got 3 inches of ice was roughly 15 pounds of weight per square foot. Roofs can support more than that, so guess nothing was truly in danger unless the roof was already weakened.
Shrubs and Pines - 7:51am (January 31, 2002)
Now looking at every little plant, tree, shrub and bush was quite possibly the most interesting part of the ice storm. It was obviously a snow day on that Thursday so stepping around on each grass blade as it cracked to get a closer inspection of the frozen landscape.
Yard Damage - January 31, 2002
From the photos above you can tell that trees that been around for probably 70+ years could not remain unscathed from this storm. While some strong trees only lost a handful of branches others collapsed in half breaking somewhere in the middle. Lucky for us, those trees circled the property and thus could fall safely into the yard with only damage being to the split rail fence.
Even the older stronger pine trees in the corner were no match. The crackling and damage continued throughout the morning as the stress was too much to hold.
The Pine Corner - 7:44am (January 31, 2002)
Driving around was not the safest, but a Ford Excursion had some extra tricks to make the pass out of the driveway. Basketball wasn't going to happen, which was strange since days before the storm it was easily 60 out.
As you walked around outside it was like the Earth stood still that day - with not much noise from humans. What you did hear was the creepy sound of trees buckling and crackling as they collapsed under weight. As those trees went down they more than likely took power lines with them, which lead to many folks then enduring a many week process without power.
January 31, 2002 - 7:37am
Finally, as my photos run out. A picture as I attempted to shovel the driveway of the ice. A difficult task as you had to get under the ice first and shovel away the strength of ice bonded together.
January 31, 2002 - 7:41am
Now these photos are uploaded and no longer stuck on an old hard drive. Perhaps a few folks will stumble upon a Google search looking for memories of this storm.
### Xbox Hacks: The A20
URL: https://connortumbleson.com/2021/07/19/the-xbox-and-a20-line/
Last updated: 2025-07-17T11:47:38.000Z
In November of this year (2021) we will hit 20 years since the release of the original Xbox. This console was full of vulnerabilities (or misconfiguration) from the software to the hardware and with such a low price point two decades ago for a computer - it was highly popular. For this post we are going to go into a lot of details regarding one mistake Microsoft made which was the A20.
*All the discoveries and research belongs to The Xbox Linux Project and Michael Steil. Research was obtained between personal memory of the era, a* [*talk*](https://www.youtube.com/watch?v=9NqLljaHc80&ref=connortumbleson.com) *and* [*a paper*](https://connortumbleson.com/uploads/2021/07/17mistakes-xbox.pdf) *from Steil who was known in the scene as mist.*
---
Intel 8088 (1978) - [Credit - CPUShack](https://www.cpushack.com/chippics/Intel/808x/8088/IntelD8088-2-1978.html?ref=connortumbleson.com)
So lets start with some history with some real old CPUs starting with the Intel 8088, which thanks to the [CPUShack](https://www.cpushack.com/life-cycle-of-cpu.html?ref=connortumbleson.com) reminds us it started production in 1978 and lasted till 1998\. This CPU had 20 physical address lines labeled A0 through A19 and each line represents a simple binary (0/1) so you can store 220 bytes or 1 MB of information.
A rough drawing of address lines to RAM (A0-A19) on an Intel 8088
However, the 4 registers (code segment - CS, data segment - DS, stack segment - SS and extra segment - ES) only had 16 bits. So some form of translation needed to occur to map 16 bit registers to physical address space of 20 bits. This is where the small calculation came to be: `segment (shifted 4 bits) + offset = address`.
Internal Address -> Physical Address
So I wrote up a quick example to show how addresses translate into a physical address. Since we are shifting 4 bits, we can easily do 24 (2\*2\*2\*2) and get 16 decimal or 0x10 hex to multiply the address by.
The thing about this notation is you can represent physical addresses with so many possible internal address + offset pairs. So knowing the early Intel 8088 only had 1MB what would happen if you asked for the memory at segment - `0xF800`, with offset `0x8000`. I'll save the long math and just say you'll get the physical address at `0x00100000` which is over the limit of a 20 bit address. The last real value would be at location `0x000FFFFF`, so the older generation CPUs just dropped any bit above the 20th.
So taking `0x00100000` would require a 21st bit, which doesn't exist on the Intel 8088 thus it gets dropped which ends up changing the location to `0x00000000`. This is known commonly as a "wraparound" because the location wraps back around to the beginning (or end) depending on how you are reading the memory.
[Images from CPUShack - Intel 8028x](https://www.cpushack.com/chippics/Intel/8028x/?ref=connortumbleson.com)
So the story gets interesting when you look at the history as a whole. For example, take the [Intel 80286](https://www.cpushack.com/chippics/Intel/8028x/IntelC80286-6.html?ref=connortumbleson.com) which still rocked a 16 bit processor, but had 16 MB instead of 1 MB memory. This meant it had 24 address lines instead of 20, which wouldn't mean much except for when IBM started building the [PC/AT](https://en.wikipedia.org/wiki/IBM%5FPersonal%5FComputer/AT?ref=connortumbleson.com) (1984). The machine had additional memory, but broke compatibility with previous solutions that depended on the implicit "wraparound" that occurred when requesting memory outside the limitation of the address lines.
If you had trouble visualizing that, the image above should show the 20 address lines on the 8088, as well as laying the additional 4 address lines that the 80286 had above. So you can see it was not possible to represent a 21 digit binary number with only 20 lines.
So IBM probably panicked at this point - they can't swap microprocessors at this point, so they tweaked the motherboard by placing a gate on the A20 address line. So depending on signal given to the gate it could be thrown to 0, thus effectively mimicking the behavior of the older Intel 8088 if warranted. This could effectively swap the system between legacy behavior or the new.
I've attempted to build an over simplified drawing to depict this, since the image above incorrectly assumes the gate exists at the CPU level, when in 1984 it did not.
Another rough drawing of the IBM PC/AT
So I think you can see where this is going now. This feature which IBM started eventually moved into the CPU and started being included in a few of the later CPUs including the Pentium series.
The lucky original Xbox was packing a 32 bit 733 MHz Intel Pentium III processor, which indeed had this A20# Gate. So knowing the Xbox boots up (after some initialization) at `0xFFFFFFF0`, if we ground the A20 line - the Xbox will instead boot at `0xFFEFFFF0`. So once again another quick and dirty drawing to explain how this will affect the process.
A partial memory map of the original Xbox
So you can see a normal Xbox boots into the secure state of the ROM. This is the portion that sets up enough critical information to verify and run the 2nd boot-loader (2BL) which then proceeds to also verify and prepare the kernel. However, grounding the A20 line proceeds to boot the Xbox directly into flash.
This is not good for Microsoft from a security perspective. The system can now boot from flash with whatever was cleverly placed there. An added bonus that booting with the A20 line grounded keeps the secret ROM still on. So a small application written and placed into flash can be used to simply dump the secret ROM.
Listening to the talk by [Michael Steil](https://www.youtube.com/watch?v=9NqLljaHc80&ref=connortumbleson.com), he hinted that the Xbox Linux team kept this knowledge close to heart, but easily would have communicated it to the Xbox team had Microsoft wanted to communicate with the group.
With the 20 year anniversary nearing for the original Xbox - a few more deep dives into the past to come.
### PiVPN + Pi-hole
URL: https://connortumbleson.com/2021/07/12/pivpn-pihole/
Last updated: 2025-02-04T11:43:06.000Z
PiVPN CLI Tool
Last month I wanted to upgrade my Pi-hole suite of tools in order to gain the benefit of its features while I'm out and about. So I went googling and stumbled upon the [official guide](https://docs.pi-hole.net/guides/vpn/openvpn/overview/?ref=connortumbleson.com) for setting up OpenVPN. The thing is though, while looking at those docs I saw an entry on the sidebar for Wireguard.
Wireguard was the biggest news when it got [merged](https://github.com/torvalds/linux/commit/bd2463ac7d7ec51d432f23bf0e893fb371a908cd?ref=connortumbleson.com) for the upcoming [Linux Kernel 5.6](https://itsfoss.com/linux-kernel-5-6/?ref=connortumbleson.com) release. No longer would you need to build a kernel module to use this extension - it would be available in the Linux kernel itself. This was around the start of the pandemic and I knew it would take a bit of time for systems to react to this new feature, but sure enough Pi-hole community plugins did.
[wireguard.com](https://www.wireguard.com/?ref=connortumbleson.com)
For those unaware, Wireguard is basically a modern VPN tunnel. Gone are the days of modifying 20+ files and configuring something that is decades old. Wireguard is configured pretty much like doing SSH key pairs. You generate a key pair on the Wireguard server and it generates the config needed for your client device.
Depending on the client (phone or desktop) there may be a simple tool to import it, otherwise a simple few commands will get you up and running. I've set up my phone that had an [official application](https://play.google.com/store/apps/details?id=com.wireguard.android&hl=en%5FUS&gl=US&ref=connortumbleson.com) which was also [open source](https://git.zx2c4.com/wireguard-android/?ref=connortumbleson.com) as well as setting up my hobby laptop.
So now when I grab my laptop and head to a nerd meetup or conference. I'm set with a good encrypted connection back to my house as well as gaining the benefits of my Pi-hole which handles the blocking of anything privacy invasive. A few more dedicated individuals will claim my ISP is evil and I need a real VPN in a different country, but for my use case - this is perfect.
---
[pivpn.io](https://www.pivpn.io/?ref=connortumbleson.com)
So this entire installation was made easier by a helper script known as [PiVPN](https://www.pivpn.io/?ref=connortumbleson.com). The security professionals will say never to install software this way, but don't worry - I reviewed the script and painfully read the large bash script and it looked safe. You may do the same thing before installation if you want.
It automated the configuration of needed tools and setting up proper networking to support a VPN. It additionally built its own structure of config files so I may add one as easy as `pivpn add`.
```bash
root@raspberrypi:/home/pi# pivpn add
Enter a Name for the Client: blogpost
::: Client Keys generated
::: Client config generated
::: Updated server config
::: Updated hosts file for Pi-hole
::: WireGuard reloaded
======================================================================
::: Done! blogpost.conf successfully created!
::: blogpost.conf was copied to /home/pi/configs for easy transfer.
::: Please use this profile only on one device and create additional
::: profiles for other devices. You can also use pivpn -qr
::: to generate a QR Code you can scan with the mobile app.
======================================================================
```
So now I can take that QR code to easily setup a device.
`pivpn -qr`
Don't worry about trying to jump onto my network with that configuration. I have removed that test client, but just wanted to show the ease of use of generating a new one. For those that remember older VPN software - it was not that easy and this wrapper (pivpn) makes it even easier.
For the classic issue of dealing with a semi dynamic IP - I can't place why or when, but a few times a year my IP with Frontier changes. Paying for a static IP is a bit more money and it doesn't take too long to update a DNS record on my server. I should dig into automating that, but it happens rare enough that I can fix with not much effort.
So now I have my own VPN (`wireguard.connortumbleson.com`) setup running off a Raspberry Pi hanging from a cable in my office. A few tools that when put together which makes a home office and remote home office even better.
### The Tour de France
URL: https://connortumbleson.com/2021/07/05/the-tour-de-france/
Last updated: 2025-02-04T11:43:07.000Z
[Press Kit 2021](https://storage-aso.lequipe.fr/ASO/cycling%5Ftdf/dossier-de-presse-tour-de-france-2021.pdf?ref=connortumbleson.com)
A couple days ago on June 26 the Tour kicked off. Nearly a month long race ending on July 18\. There will be 21 days of activities with 2 rest days, 2 time trial days and every other day is a grueling multiple hour bike ride between cities.
We can peek the route and see the longest day is Day 7 (July 2) which just occurred which took the riders from Veirzon to Le Creusot over 249.1km. For those in the states, that is roughly 155 miles. If you tried to bike 155 miles and were an average biker - you could probably go 17mph for the distance on flat surfaces. If you do the simple math there you are looking at a 9 hour journey. The professionals in this race though on flat surfaces are averaging a \~28mph pace.
These riders in the Tour though, don't just do 1 race. They do 21 days straight (with 2 rest days). The pure endurance and training to complete such a task blows my mind. Try biking for 10 miles - my guess it will take around an hour to do and your legs will be hurting. This post isn't about a random individual journey biking, but the riders of the Tour de France.
---
So I wanted to see how much random co-workers and friends knew about the Tour. Asking them about it - I got the following summarized responses:
- *I saw the crash video, that lady is dumb*
- *Is that the thing that Lance Armstrong did drugs on?*
- *No what is that*
Maybe others regional area and age group will have different results, but it appears that the Tour de France is not that important to the folks I encounter day to day. I can't say I'm addicted to it spending every waking moment watching the long broadcasts, but I'm at least watching the recap daily videos and following the leaders and watching it live on the weekends.
So I want to take a bit to recap some names of the sport and some major events of the sport.
---
**Lance Armstrong**
["Lance Armstrong cornering"](https://www.flickr.com/photos/41894171397@N01/2494643?ref=connortumbleson.com) by [eugene](https://www.flickr.com/photos/41894171397@N01?ref=connortumbleson.com) is licensed under [ CC BY-NC-SA 2.0](https://creativecommons.org/licenses/by-nc-sa/2.0/?ref=ccsearch&atype=rich)
We can't talk about the Tour without Lance. The story arc amazing from falling from cancer to becoming a top tier competitor in the world's greatest race. Winning year after year until it all came crashing down with truthful allegations of doping.
With so many leaders in that era also falling to doping - its tough to tell who was a legit winner and who was not. Someone who finished in 105th place may have not doped - no one can tell until the testing procedures are so up to date and can occur in real time to detect all.
**Floyd Landis**
["Floyd Landis"](https://www.flickr.com/photos/18652236@N00/24923701?ref=connortumbleson.com) by [bryan88](https://www.flickr.com/photos/18652236@N00?ref=connortumbleson.com) is licensed under [ CC BY-ND 2.0](https://creativecommons.org/licenses/by-nd/2.0/?ref=ccsearch&atype=rich)
After Lance won 7 Tour's, he decided to take a break so the American public needed a new American to follow and that was Floyd Landis. After a rough stage 16 - it appeared all was over for Landis falling so far behind, but something happened in Stage 17 that seemed impossible. Landis took off with 120km to go and proceeded to win the stage putting serious time on all others.
After winning the Tour after a great time trial, something was off. Riders don't normally have a horrendous stage and turn around 5000% percent to win the next. Sure enough, a few days later after the Tour had ended. Doping was confirmed and Landis was stripped of the win.
**George Hincapie**
["George Hincapie"](https://www.flickr.com/photos/11418908@N07/3296897458?ref=connortumbleson.com) by [puliarf](https://www.flickr.com/photos/11418908@N07?ref=connortumbleson.com) is licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=ccsearch&atype=rich)
Hincapie was probably the most trusted and powerful teammate next to Lance. For each and every year Lance won a Tour, Hincapie was there on his side helping obtain the victory. When rumors were flying about doping, Hincapie's website was one of the first to update with an admission of using banned substances. My guess is with the looming release of charges and victories being stripped - Hincapie wanted to come clean.
**Alberto Contador**
["Alberto Contador"](https://www.flickr.com/photos/60764770@N08/5583502892?ref=connortumbleson.com) by [joménager](https://www.flickr.com/photos/60764770@N08?ref=connortumbleson.com) is licensed under [CC BY-NC-ND 2.0](https://creativecommons.org/licenses/by-nc-nd/2.0/?ref=ccsearch&atype=rich)
Some of the most exciting rivalries to watch was between Lance and Alberto on the same team. The [2009 tour](https://en.wikipedia.org/wiki/List%5Fof%5Fteams%5Fand%5Fcyclists%5Fin%5Fthe%5F2009%5FTour%5Fde%5FFrance?ref=connortumbleson.com) had both on team Astana, which lead to an interesting back n forth as both were contending for first place. This race was the return of the king (Lance) as well as huge competition between the Schleck brothers as well as Wiggins.
However, no one talks about Contador much about the wins until what happened in 2010 when another victory was claimed, but stripped away due to doping. Hurting credibility of previous victories.
**Chris Froome**
["Chris Froome (Great Britain)"](https://www.flickr.com/photos/59755673@N04/7694909656?ref=connortumbleson.com) by [Sum\_of\_Marc](https://www.flickr.com/photos/59755673@N04?ref=connortumbleson.com) is licensed under [CC BY-NC-ND 2.0](https://creativecommons.org/licenses/by-nc-nd/2.0/?ref=ccsearch&atype=rich)
After the era of previous riders - it was time for Froome to assert dominance and bring home some victories. He was the partner to Wiggins and helped him win the 2012 Tour, but then afterwards he brought home the 2013, 2015, 2016 and 2017 Tours. The success was beginning to rival the then annulled Armstrong.
However, a blip came up on his radar when he was accused of abusing the allowed dosage of asthma medication. It took roughly a year, but since Froome actually had asthma and was prescribed the medication the International Cycling Union closed the investigation.
His success at winning the Tour de France did not continue though with the 2018 Tour instead going to Geriant Thomas by under 2 minutes and 30 seconds. The 2019 Tour would have had some great competition, but Froome had a dangerous crash weeks prior [when he crashed](https://www.bbc.com/sport/cycling/48612884?ref=connortumbleson.com) into a wall at 54km/h breaking his femur, elbow and ribs.
**Bradley Wiggins**
["Bradley Wiggins"](https://www.flickr.com/photos/22541812@N03/7697452952?ref=connortumbleson.com) by [Mostly Dans](https://www.flickr.com/photos/22541812@N03?ref=connortumbleson.com) is licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=ccsearch&atype=rich)
Before the reign of Chrome Froome had begun, there was another United Kingdom rider to contend with. It was Bradley Wiggins who took home the 2012 Tour de France. His time trials was pretty insane and he was an excellent rider to watch. Like most in this sport - looming news about doping came to be when it was being discussed whether the use of substances that were normally banned being used under the clause of TUE (Therapeutic Use Exception).
It took a few years, but the finalized report mentioned the use of the substances were not to treat any medical need, but to improve Wiggins and others for the upcoming Tour. It seems rules weren't broken, but Wiggins and others seemed to exploit loopholes in the rules and didn't seem exactly ethical.
**Peter Sagan**
["Peter Sagan"](https://www.flickr.com/photos/35950308@N04/4632742691?ref=connortumbleson.com) by [Dave Strom](https://www.flickr.com/photos/35950308@N04?ref=connortumbleson.com) is licensed under [CC BY-NC-ND 2.0](https://creativecommons.org/licenses/by-nc-nd/2.0/?ref=ccsearch&atype=rich)
Finally, I want to talk about Peter Sagan who competes heavily in the sprinting category (green jersey) in each tour. This has been dominated by Sagan in the previous decade with other victories going to names like Mark Cavendish.
Of course 2020 hit and the cycling of everyone took a turn. Expected races and winners changed so now we are entering and competing in the 2021 Tour and Sagan is back. Hasn't placed so well yet holding 9th place in the points classification, but this race isn't even halfway done so time will tell.
---
With that, a deep dive into some major folks and people that I remember. One thing that interests me is someone decided to graph the average speed of winners of all Tours over time.
[Tweichhart](https://commons.wikimedia.org/w/index.php?title=User:Tweichhart&action=edit&redlink=1&ref=connortumbleson.com) \- [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0?ref=connortumbleson.com)
This is such an interesting graph to me for the ebb and flow of speed increase except after the era of doping. It was so bad that even the tournament organizers decided to not reallocate all 7 wins from Lance.
The races now appear to start and end without the leaders being caught from doping. Though a part of me wonders how any human body can go through 21 days of grueling rides - maybe that is what separates us from them.
### Halo 2 Mod Photography
URL: https://connortumbleson.com/2021/06/28/halo-2-mod-photography/
Last updated: 2025-02-04T11:43:08.000Z
Havok - Darkshallfall - Halo 2 Coagulation
I found myself after unpacking a modded original Xbox that I wanted to replay some old Halo 2\. Except, I quickly realized that the graphics are not what I remembered.
Though, I vaguely remembered incredibly high definition screenshots of Halo 2 that could not be from one in game screenshot. So it was time to load up some old tools and fumble around with auto stitching software to produce some good quality shots.
I don't think there is any point making this a tutorial of a game so old, but I can list the tools/things needed.
- Yelo Game Trainer
- Halo 2
- Xored Trainer Launcher
- Modded Xbox
- Hugin (Or another stitch software)
The magic for this does start at [Yelo](https://halomods.info/viewtopic.php?f=92&t=46369&ref=connortumbleson.com) though.
> Yel-o (yell-oh) noun. blam engine hack project for all halo games of all platforms. syn. 1337
It has the ability to enter dev camera and free fly around the map. This allows via the features of Yelo to automatically take a bunch of screenshots via the following:
- horizontal shot
- video (10fps)
- 360 degree shot
These then take a bunch of photos which you can stitch together after extracting them from your Xbox. So for the rest of this post, I want to do an example 360 shot and panoramic shot of some [Halo 2 Phantom Mappack](https://connortumbleson.com/2016/05/06/phantom-mappack-project/) mods.
---
So I started with iGeo's Miami Headlong mod. It has some cool graphic replacements and felt like a good test run for a 360 shot. Booting my Xbox into UnleashX to boot Xored to configure Phantom Mappack to boot with Yelo was the first step. Once in game, I enabled dev camera (*back button + dpad right*) and flew to a location that felt good to take a 360.
Hitting white button + dpad right triggered an automatic shot as the screen automatically rotated. After it was complete, I dropped my Y coordinate a bit and did it again, then again. I found myself with 360 images (120 per set) and decided to attempt to merge all 360 images together.
Captured images
However, after leaving my computer for 48 hours on this step:
```
Written output to C:\Users\conno\AppData\Local\Temp\ha7AB4.tmp
Statistically cleaning of control points...
```
I realized that perhaps automatically stitching 360 images would take too long. If it wasn't done in 48 hours - I had no idea how long it might take. So I restarted the process with only 120 images (one rotation). This was also a mistake as 2 hours of research into photography is not enough knowledge to stitch together a 360 view.
So instead, I grabbed a few mods and just did a partial panoramic with 40-60 shots per one.
The\_Churchyard (DoorM4ne)
Playing an iteration of Sanctuary with such heavy fog was very difficult to get any good shot going. Any angle either interfered with the native map geometry or became flushed out with greys due to the fog. Either way, I'm happy with this angle which shows the eerie nature of this mod.
Wake\_Island (Ace Mods)
Wake Island was a mod that I couldn't pinpoint the original map visually, only after patching the map did I realized Waterworks was the base map. This one I attempted to go out further and capture 60 images vs 20 and it didn't turn out too well. It led to issues that I could not figure out, but I'll attach it below so you can spot them. So I went ahead and took the original 20 images and made the image above this paragraph which depicts the map quite well.
Wake Island - "bugged" panoramic
Next up, I finally got a 60 set image looking good. Ascension was the perfect map to fly out and get a good angle to perform this.
The Frostbitten (DarkShallFall)
When you look at the image though it looks like I just gray-scaled the existing map, when technically the mod introduced the cold snowy theme. This is unforunately lost and only an addicted Halo 2 player could notice the difference between a gray-scaled Ascension and The Frostbitten above.
Sunset Scorture (DrXThirst)
I could not stop without playing a Lockout mod as one of my favorite maps. This mod took the classic blue hue theme of Lockout and tweaked to orange. With a few tweaks here and there like introducing an S4\. (The codename for the new level above Sniper Tower)
You can notice slight distortion of the map, but that to be expected when you are attempting a 2d photo of a 3d environment.
Finally, I wanted to return to Miami (The mod I gave up doing a 360 on) for a basic 60 photo panoramic. These one again failed as the distortions of the environment made it look quite ugly. However, after nearly 500 images of that map - I refuse to play it anymore for screenshots.
So I booted up the related mod California and took 40 photos and called it a day. It isn't perfect, but Headlong is a difficult map to capture.
California (iGeo)
To understand what makes the image above, I'll attach 6 of the images that made up this shot to show what is joined together to build the image above.
With that, a good glimpse into the past of modding Halo 2 and taking photos of the mods.
### Original Xbox Mod Chips
URL: https://connortumbleson.com/2021/06/21/original-xbox-mod-chips/
Last updated: 2026-04-07T13:30:58.000Z
I was going through some old boxes I grabbed from the parent's house and I stumbled upon one of my Xecuter 3CE mod chips for the original Xbox. This mod chip was quite advanced and I'd argue personally the best in the market ever for the original Xbox. So I wanted to dig up some old memories and research to put together a post about the mod chips of the era.
Pictured above is a poorly staged collection of random Xecuter parts I have. So I did some research and learned that the Xecuter 3CE was a fourth generation mod chip. So I was curious what the other generations meant and represented.
Xbox Scene has since shut down, so it was off to the [Wayback Machine](https://archive.org/web/) to dig up some old web pages. Turns out that helped for additional details, but the Wikipedia [article](https://en.wikipedia.org/wiki/Xbox%5F%28console%29%5Fmodchips?ref=connortumbleson.com) helped with some quick breakdown of the generations.
---
**1st gen mod chips**
- These worked off snooping on the HyperTansport bus, which could be used to remove region restrictions from games and DVDs.
- Complicated to install, requiring about 29 solder points
- Only worked on the initial Xbox hardware (v1.0)
**2nd gen mod chips**
- Not much of an enhancement from 1st gen, but cut in half the amount of solder points
- Gained the ability to prevent the console restarting when the game tray was ejected
- Still only worked on the v1.0 hardware
**3rd gen mod chips**
- First generation to allow upgrading the hard drive size
- Allow installation of mod chip on top of board, thus requiring only 1 wire to solder
- First generation to include "kill-switch" so online play could occur without a ban
- Some models could not be updated, so stuck with hardware v1.1 or less
- Other models that could update could support v1.3, v1.4 and v1.5
**4th gen mod chips**
- Final generation to support v1.6 hardware
- Additional memory banks to support multiple BIOS flashes
---
So lets do this again, but record the chips that belong in each category.
**1st gen mod chips**
Enigmah & Xtender
- Enigmah
- Xtender
- XIOS & Devilmod
- RegionFree
There chips were difficult to install for any novice with an insanely large amount of solder connections required. For a novice attempting to install \~30 different solders - chances are quite high of damaging the board and breaking the console.
We can't talk about Gen 1 though without mentioning NEO-X which would have been the first mod chip for the original Xbox, but the news and promise to remove region locks from games attracted Microsoft. Rumor says legal notices went out and NEO-X was never produced.
**2nd gen mod chips**
MessiahX & Pandora1 Diagram
- MessiahX
- TitanX
- Pandora1
These chips spammed the market with websites that had nearly 3000 different comma delimited words. My guess is the early 2000 SEO market was quite different than it is today. These chips cost less money than the previous generation, but were less prone to messing up during installation due to a much easier install process.
Around this time two large things happened in the community, that I believe led to the big boom of chips that were to come.
1st, Bunnie ([Andrew Haung](https://web.archive.org/web/20170702172142/http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html)) produced reports and a detailed website about the hardware of the console. I have a feeling the folks and companies behind mod chips probably didn't need this too much, but either way. This was very early into the release of the Xbox and was good enough dump of information that Microsoft even got [involved](https://web.archive.org/web/20170702172142/http://www.xenatera.com/bunnie/proj/anatak/xboxedited.mp3) to remove some of the published materials.
2nd, a bounty went up for two tasks valued at $100,000 a piece. The challenges were booting Linux and producing a system exploit without hardware involved (softmod). The person behind this turned out to be [Michael Robertson](https://en.wikipedia.org/wiki/Michael%5FRobertson%5F%28businessman%29?ref=connortumbleson.com), who was behind sites like mp3 and lindows.
**3rd gen mod chips**
Xecuter 1.x & Pandora2 & Matrix
- Xecuter 1.x
- Xtrmod 1.3
- SmartBox Pro
- Pandora2
- Matrix
- Cyclone
Now around this time of these 3rd generation chips being dropped. A bunch of things happened that are worth noting. First off, the Xbox-Linux team got Linux booting and won $100,000 dollars. [Xbins](https://www.xbins.org/?ref=connortumbleson.com), the home brew release FTP, was released to help support all the software being built.
The first public game save exploit emerges (007: Agent Under Fire) and earns the remaining $100,000 bounty for a software only exploit. The technical breakdown occurs for this hack, which starts many many more:
- [007: Agent Under Fire technical breakdown](https://web.archive.org/web/20031003093240/http://xbox-linux.sourceforge.net:80/docs/007analysis.html)
- [Unsigned Font Exploit technical breakdown](http://web.archive.org/web/20170712215034/https://new.xbins.org/nfo.php?file=xboxnfo233.nfo)
- [Bert & Ernie Font Exploit breakdown](https://web.archive.org/web/20031010081635/http://phoenix.maxconsole.com:80/docs/berternie.php)
This lead to the famous 3 game save exploits being developed which were used for years and years to come.
- 007: Agent Under Fire
- MechAssault
- Splinter Cell
- (later on) Tony Hawk's Pro Skater 4
**4th gen mod chips**
Xecuter 3 & Xenium & SmartXX
- Xecuter 3 / 3CE
- Xenium
- SmartXX
- X-Chip
- X-Lite
- X-Changer
- SpiderGX
These 4th generation chips had quite the feature set and became very easy to install. Normally just laying on top of the LPC ports and soldering 0 to a few wires. Most of these chips also had an extra price point if you wanted a truly solder-less install. I still have the reminder on my finger decades later from a soldering accident, so maybe I should have used the solder-less.
[Xecuter 3 - Final Install](https://team-xecuter.com/x3/tutorials/x3pin1015.htm?ref=connortumbleson.com)
Around this era the final set of hardware was released. Xbox's could now come in between v1.0 and v1.6b, which isolated your preferred mod chip to one that could support all versions. All 4th generation mod chips easily supported all types of hardware.
The legality of each mod chip in this generation was also a point of discussion. Some software was based on the XDK and others on pure Linux. It was quite the legal gray area to include "hacked" portions of the Xbox onto software that was sold. This led to some chips being sold with a bare minimal legal OS and being told to "*look in the usual places*" for the real software. This became the phrase to refer to Xbins.
If you wanted to obtain one of these. There was no Amazon yet, so you needed to either visit the popular Divineo or Modchip/ModchipStore to purchase a chip. However, not all chips were listed on these sites and that meant if you wanted to buy like a SpiderGX - then good luck. I have no idea where those were sold, but it sure wasn't any popular site that I remember.
Once again, I have to draw attention back to the Xecuter series. They had a powerful public documented website for all iterations of chips. High quality images, a large support forum and tutorials/downloads readily available.
[Justice.gov - Indictment](https://www.justice.gov/opa/press-release/file/1324026/download?ref=connortumbleson.com)
Team Xecuter continued to live on to more and more consoles. They made a crucial mistake though. When devices for the Nintendo Switch that were clearly used for piracy went up for sale, they may have been marketed for running personal designed games, but the Xecuter website told a different story. You had to purchase a license to enable piracy on this software. That was it, the FBI got [involved](https://www.justice.gov/opa/pr/two-members-notorious-videogame-piracy-group-team-xecuter-custody?ref=connortumbleson.com) and a few were arrested and Team Xecuter website went offline.
So if we bring this back to the Xbox. Sure, the Xecuter 3 and nearly every other mod chip enabled piracy by running games you didn't own. However, with communities built around Linux, XBMC and Halo hacking - my personal experience with this hardware was piracy was never the intent. I had 20-30 different versions of Halo 2 on my Xbox.
While I dabbled in the emulation of other older handhelds - I was playing games I owned in the past, so didn't feel bad playing them again in an emulated setting.
If you try and find mod chips for the original Xbox in 2021 - you won't find much.
### The Absence of Truth
URL: https://connortumbleson.com/2021/06/14/the-absence-of-truth/
Last updated: 2025-02-04T11:43:08.000Z
Photo by [Pawel Czerwinski](https://unsplash.com/@pawel%5Fczerwinski?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
With the lock down and pandemic, I had a bit more time at home to watch Netflix and the [True Crime](https://www.netflix.com/browse/genre/108820?ref=connortumbleson.com) genre holds a good deal of interest to me. So I watched:
- **Don't F\*\*k with Cats: Hunting an Internet Killer**
- Making a Murderer
- I Am a Killer
- Jeffrey Epstein: Filthy Rich
- **Evil Genius: Most Diabolical Bank Heist**
- The Ripper
- The Disappearance of Madeleine McCann
- Nail Bomber: Manhunt
- The Pharmacist
- Murder Among the Mormons
- Unabomber: Manhunt
- Deadly Games: Manhunt
- **American Murder: The Family Next Door**
- Extremely Wicked, Shockingly Evil and Vile
- The Sons of Sam: A Descent into Darkness
- Crime Scene: The Vanishing at the Cecil Hotel
Writing the list out shows I watch too much Netflix, but this is also over the course of nearly two years so probably not too bad. Either way, I bolded the shows that really felt different watching with their real life non-cinematic portions to it. While all shows were based on true events - only some had true crime footage and interviews attached with it.
So off to the web I went to dig into more of these pretty disturbing true stories and stumbled upon the [JCS - Criminal Psychology YouTube Channel](https://www.youtube.com/channel/UCYwVxWpjeKFWwu8TML-Te9A?ref=connortumbleson.com). I recognized from the channel a few names from Casey Anthony (*National news*) to Chris Watts (*Netflix: American Murder*) so I was off to watch a few.
Watching the 3 part Chris Watts series was pretty much all the captured audio/video from the investigation with a commentary over the top. The additional commentary was pretty eye opening in comparison to watching the Netflix version of Chris Watts.
For example, we know from the trial that Chris Watts killed his wife, unborn child and two daughters. Not only that, but drove the bodies to a work site and dumped the children into large oil vats and dug a shallow grave for his wife. The motive? There was another girl and Chris hoped to just trash his current life and move on. This stuff is just pure evil and difficult to speak or even fathom about.
[The Case of Chris Watts - pt. 1](https://www.youtube.com/watch?v=Xfg861hO-Ag&ref=connortumbleson.com)
So back to this YouTube channel, which helps add another dimension of thinking to these clips. The police (who are at the house of Chris Watts) call to say to say his wife is missing. Chris, who at this point, has already disposed of the bodies tells the officer he will be home shortly. Once arriving, he says nothing but opens the garage and checks the car of Shanann Watts (the deceased wife).
The narrator of this video explains that this is not like regular human behavior.
- The wife's name is never called out
- Permission was not granted to the officer to enter the home while Chris was not there.
- Chris checks the car first and rummages through it, when its clear nobody is inside.
- Chris takes 1min \~30 seconds to go from garage to letting officer in front door.
This is just seems off. If your pregnant wife is missing and you aren't giving permission to officers to look for her while you are away and show no sign of panic - there is something afoot.
---
Though what happens if the truth isn't absent? That might be as scary as hiding the truth of some heinous crime.
[Jerrod Murray Murder Confession Tape](https://www.youtube.com/watch?v=67KcYmWipAs&ref=connortumbleson.com) (Screenshot above from "[pretending to be crazy](https://www.youtube.com/watch?v=Mwt35SEeR9w&ref=connortumbleson.com)")
Meet Jerrod Murray who paid a roommate (*Generro Sanchez*) to drive him to Walmart, but the trip went differently when Murray shot and killed the driver. He was captured a few hours later with a poor attempt to cover the body on the side of the road. The confession and interrogation was short (in comparison to others) and not a single lie was detected by the investigator.
Jerrod has been named the "Yes Sir" killer for his emotionless tone of saying, "Yes Sir" quickly and efficiently to each and every question as well as not trying to evade any question asked. While the 2 hour video is linked above, the quick 1 minute video from a news station can capture this in a creepier essence.
While being transferred (*probably due to being not-guilty due to insanity*) a reporter grabs a quick 30 seconds to rattle off questions to Jerrod who responds swiftly and without a single ounce of emotion. There is no missing truth here, but the pure blunt truth from the mouth of the sentenced is just as creepy.
---
This leads us to the last individual I want to talk about in this post, which is Nikolas Cruz, who was the shooter responsible for the Parkland Florida school shooting at Stoneman Douglas High School.
[What pretending to be crazy looks like](https://www.youtube.com/watch?v=Mwt35SEeR9w&ref=connortumbleson.com)
This guy was born in 1998 and committed one of the worse school shootings of all time. I can't begin to understand and the whole situation surrounding this individual is more frustrating.
From the instant he is captured attempting to blend in with fleeing students he starts claiming a demon and voices in his head are at fault. Born from a drug heavy women [with 28 arrests](https://www.miamiherald.com/news/local/community/broward/article216909390.html?ref=connortumbleson.com) and immediately adopted into a loving family might have led to some messed up mental health, but to gun down children?
This interrogation is just horrific to watch. Knowing this individual killed 17, but continues to fabricate a complex lie is just sad. Knowing even so years later that a few of the students who survived the shooting ended up taking their own life. Cruz continues to spew lie after lie in the face of the end of his free life. You can tell the reason "why" is something all investigators are striving to piece together, as Cruz refuses to budge even as his made up story full of holes falls apart.
---
While the sad fact remains these stories exist in more individuals and events and continue to grow with every year. Understanding more of how these individuals act in the face of a heinous act I'll never understand, which is perhaps why I keep watching more and more of them. You can understand a bug in code even if it takes 40 hours, but understanding the human mind of another - good luck.
### Cleaner Code
URL: https://connortumbleson.com/2021/06/07/cleaner-code/
Last updated: 2025-02-04T11:43:09.000Z
Photo by [Blake Connally](https://unsplash.com/@blakeconnally?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Getting back into the world with vaccines and re-openings, I've had a chance to sit down with some folks in the same industry and just chat. Exchanging stories about engineering, hiring and finding folks to grow a team and wanted to blog about those thoughts.
### Code
Year after year my perception of clean code evolves and changes, but one thing that I've come to appreciate is consistency. For example, the pure arguments about code styling is beyond annoying. Thankfully some languages these days even have syntax formatting baked into the tool itself.
I've learned that automation and enforcement is the friend here. New employees can't argue with a red x on their change request if a robot is telling you it does not validate as proper formatting.
Though, moving on from formatting to the framework's themselves. I once spent time in a Laravel project that followed next to zero of the Laravel conventions. I can only guess that the previous employer to this project expected Laravel and the team delivered without knowing it.
It should be in the best interest of any development team to follow the conventions and opinions of a framework so churn in a team does not affect the things that don't matter. Time in a code base should be spent on what really matters - the true secret sauce that makes the project exist. When you are doing custom work against the norm for things that are just given by a tool or framework - the barrier to entry for new folks just rises and that slows you down.
### Environments
With every line of code written an environment needs to exist to run it. For some their life is Java, which has its own fair share of complexities running as compared to PHP. Either way though, if you heavily work in a language and don't understand how it runs outside of a development environment - that is something to pick up.
For the majority of folks I'd bet that environment is not Windows. Become comfortable on the terminal - learn the hundreds of little tools that excel at 1 thing a piece. So the next time there is an issue on a server with a project you helped develop you feel confident with understanding the stack to diagnose the issue.
I remember asking someone to grep a log file to look for a certain phrase and left with a stumbling stare. It isn't hard to learn if you give it a chance.
### Personality
If you write code with the intention to make it so complex that only you understand it - that's a problem. I think the perfect code is something that is understandable and solves the problem that a new employee walking in on day 1 can also understand.
On that same path - if an issue occurs and you are first to point fingers vs lending a hand - that's a problem. Coworkers should be working together to solve issues and create software - not fighting against each other.
### Team
As you look for someone to join your workplace, I think a cultural fit among a team is just as important, if not more, than technical skills. Technologies can be taught, but generally at the age of finding employment behavior is a long slow process to correct. So if you are near the point of picking up a new hire - take them to lunch. Watch how they interact with the staff, that is the greatest tell tale sign of how someone treats other people.
You don't want someone that emits toxicity or treats others badly. You'll notice pretty quickly how that affects the productivity and turnover of a team with one of these folks.
---
With that, just some thoughts about the workplace.
### Egmont Key State Park
URL: https://connortumbleson.com/2021/05/31/egmont-key-state-park/
Last updated: 2025-02-04T11:43:09.000Z
Home to gopher tortoises, turtles and much more is the cool beautiful place of Egmont Key. Reachable via ferry from either De Soto Park in St. Petersburg, FL or Anna Maria island in Sarasota.
Visiting this island from De Soto has changed over the years with the price steadily rising from $20 -> $25 -> $30 for an adult ticket + tip. Add in the $5 park fee to park and the 2-3 tolls on the way in and you are looking at a \~$45 adult price tag. Throw in a few visitors or family members and you've got yourself an expensive visit to a very secluded island.
However, regardless of that. This island has everything.
- Calm beach with smooth sand
- Fishing
- Snorkeling
- Historic Forts
- Bird Sanctuary (*do not disturb!*)
- Homes (*for the pilots*)
- Lighthouse
- Picnic Tables (*in the shade!*)
- Historic Trail (*around island*)
- Turtles/Tortoises
One of the more interesting thing is the tortoises that roam around.
Tortoises of Egmont (Pixel 4)
These guys are the calm elderly that roam around looking for green to munch on. Keep your distance, but with a patient stance you can grab some cool photos. They live in these little holes scattered around which are normally marked with caution tape so the visitors know not to intervene.
I was curious how the animals would do when [Hurricane Irma](https://en.wikipedia.org/wiki/Hurricane%5FIrma?ref=connortumbleson.com) was approaching Egmont Key, so I tried to get out as soon as possible once the hurricane had passed.
Hurricane Irma (2017) damage to Egmont Key
It was interesting to see that the storm had basically carved a solid \~7 feet out of the side of the island. I could stand being 6ft 4" and not be able to see over the top of the carve out. I was curious what this meant for the island with a good deal of the beach now missing.
It took almost a year, but I saw in March of 2018 a huge effort underway with heavy machinery on the island. It appeared the bay was being dredged (presumably to help with larger ships) and huge amounts of sand/dirt was being dumped on Egmont Key.
March 2018 - The Dredging
Once this was done, the beach was back and it looked quite larger than it was before. A huge chunk of land ready for the armies of boats to anchor and enjoy the beach. Alcohol isn't allowed on this island, but you can get away with drinking on your boat or around it anchored off the island.
If the historic nature of the island is more your fancy. You can find forts, historic trails and even the remains of hundred year old buildings. Information signs are spewed across the island that give a little glimpse into the building of the past as well as a bunch of information about it.
Information Signs on Egmont
Finally, the forts themselves are a sight to see and explore. Most of them can be explored from within or even on top.
I've been to this island 19 times and spent far too much visiting. If you are in Tampa with time to spare - take the [ferry](https://www.hubbardsmarina.com/egmont-key-ferry-cruise/?ref=connortumbleson.com). It is worth the trip.
### The Florida Drivers You'll Encounter
URL: https://connortumbleson.com/2021/05/24/the-florida-drivers-youll-encounter/
Last updated: 2025-02-04T11:43:09.000Z
Photo by [Drew Coffman](https://unsplash.com/@drewcoffman?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Welcome to Florida where you have folks from all over the world visiting for vacation, intoxicated kids for spring break and the elderly living to their last day. We have every type of driver here.
## The Racer
This driver you'll usually encounter in pairs on roads and highways. You'll notice the racer(s) approaching when a set of cars that passed you minutes ago are slowing down drastically inline with another car. Sure enough, once they meet back up they rev their engines and off to race to the next finish line.
Incredibly annoying and dangerous as they race between cars and the smell of burning rubber is in the air when they are around.
## The Death Wish
This driver must not want to live on this planet anymore. You'll see them swerving traffic like the end of the world is near. They haven't heard of turn signals or speed limits and you'll only recognize them in the split instant they speed by. You'll make a double take and by that point and they are already splitting cars in front of you.
## The Distracted
You'll look over at an intersection and this person is currently 6 chapters deep into a Reddit thread on their phone. It doesn't matter the light is green - they are more focused on a little 6" display then moving onward to their destination. You'll give them a little honk and they will speed up like the tail is on fire to make up for it.
## The Elderly
This person has had a car for longer than you've been alive, but they've lost their touch. They are probably putting 55mph in the far left lane on a 70mph highway. Mixed with the young and the old you realize you might be on the set of Death Race with how often these folks are/cause an accident. You wish for everyone's safety that these folks get re-certified to drive in person every few years, but that won't happen anytime soon.
## The Spring Breakers
These folks just landed in Destin and its spring break. They probably have a rental or drove a car down here themselves. They are don't know how Florida roads are and they are rushing to the beaches to party. You'll recognize this car in the city as the windows are down, music is blasting and there's far too many young kids in the vehicle.
They are recklessly driving and its a weekday and you just want to get home from work without getting stuck behind or in an accident.
## The Confused
These folks aren't from here and they haven't learned about Google Maps yet. You'll notice as they slow down for each possible turn without a turn signal debating to turn right or not. Even worse for some they'll be slowing down in a lane to swerve across traffic to make a turn.
You also might encounter them in the inner city going down a one way street the wrong direction. These poor souls are in over their heads and should use Uber or Google Maps next time.
## The Nerd
This driver will notice the light turn red from 1,000 meters out and let off the gas. They will coast to the light at slower and slower speeds forcing every driver to go around them or additionally conserve gasoline. You'll recognize this driver in slow traffic on the highway because they have more space between the car in front of them than any other car. Too bad that space to coast won't last as 4 cars squeeze in the stop and go traffic.
## The Worker
This individual lives here and is just heading to work. They know the roads inside and out and don't want anything else but to reach their destination. The other personas drive them insane and they won't be slow to reach for the horn or racing around a car. You'll recognize this car when they jump in the opposite lane for a couple hundred feet since they recognize it becomes the turn lane at the upcoming light.
---
With that, a fun little post about all the types of drivers I encounter daily.
### Isolation Day 427
URL: https://connortumbleson.com/2021/05/17/isolation-day/
Last updated: 2025-02-04T11:43:10.000Z
Photo by [Zoltan Tasi](https://unsplash.com/@zoltantasi?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is now my 10th and probably final post about COVID-19 and the 8th series in isolation ([Day 7](https://connortumbleson.com/2020/03/23/isolation-day-7/), [Day 21](https://connortumbleson.com/2020/04/06/isolation-day-21/), [Day 35](https://connortumbleson.com/2020/04/20/isolation-day-35/), [Day 49](https://connortumbleson.com/2020/05/04/isolation-day-49/), [Day 63](https://connortumbleson.com/2020/05/18/isolation-day-63/), [Day 77](https://connortumbleson.com/2020/06/01/isolation-day-77/), [Day 119](https://connortumbleson.com/2020/07/13/isolation-day-119/)). A good deal of events both locally and worldwide have occurred since Day 119 so lets get into it.
---
**Vaccines**
It took roughly 14 months from the [first blog](https://connortumbleson.com/2020/01/27/lets-talk-epidemics/) about COVID-19 and on December 14, 2020 the first vaccine was given to the public. As months went on various brands became available:
- Pfizer-BioNTech (2 shots, 21 days apart)
- Moderna (2 shots, 28 days apart)
- Johnson & Johnson Janssen (1 shot)
- Sputnik V (2 shots, 21 days apart)
- AstraZeneca (2 shots, 28 days apart)
I took my chance with the J&J vaccine and outside of a 10 hour stint of feeling sick, I'm now vaccinated. What is strange is I've gotten a few comments about why did I take the vaccine brand that isn't as effective as the others. I found a cool short video that basically does a better job explaining that comparing vaccines is not fair unless they were all tested in the same way.
---
**The "Flu" vs COVID-19**
I've heard my fair share of "*This is just the flu*" from far too many people which I can't comprehend how people get to that conclusion. I'll start with the CDC graphic that depicts the estimated deaths/cases of the Flu every year for the past 10.
[Disease Burden of Influenza (Figure 2)](https://www.cdc.gov/flu/about/burden/index.html?ref=connortumbleson.com)
Let's range all these values from lowest to highest for what is visible above:
- Illnesses - 9.3 million to 45 million
- Hospitalizations - 140,000 to 810,000
- Deaths - 12,000 to 61,000
So lets head to the [CDC website](https://covid.cdc.gov/covid-data-tracker/?ref=connortumbleson.com#cases%5Ftotaldeaths) for the count of deaths from COVID-19 and see what we are dealing with.
[https://covid.cdc.gov/covid-data-tracker/#cases\_totaldeaths](https://covid.cdc.gov/covid-data-tracker/?ref=connortumbleson.com#cases%5Ftotaldeaths')
It obviously isn't fair to take these numbers since they are longer than a year time span, but lets talk through this. A common claim I see on Twitter is that the Flu kills this many yearly.
I just looked at the Flu deaths and the largest year was 61,000\. So lets round that up to even 100,000 dead yearly from the Flu and subtract it from the COVID-19 death count.
- 582,263 - 100,000 = 482,263
Even if the hospitals accidentally classified every single Flu death as COVID-19 we still have an extra 482,263 remaining. Now I know what you are thinking, that timeline is from December 2019 to May 2021\. Well, the first USA death from COVID-19 was in [February 2020](https://www.cidrap.umn.edu/news-perspective/2020/04/coroner-first-us-covid-19-death-occurred-early-february?ref=connortumbleson.com) and we are in May so an extra 3 months from a perfect year. So to make up for it - lets subtract another 100,000 deaths from the COVID-19 count.
- 482,263 - 100,000 = 382,262 deaths.
I don't think anyone can argue with that death number with how much padding and subtraction we did. Even with all the subtractions the value is massively higher than even the largest influenza death comparison in past decade.
---
**No Mask. No Service**
My growing washable mask collection
What has been a required change is nearly every single business had a sign at one point requiring the wearing of a mask for entrance. I've seen far too many folks claim once again that inflicts against their human rights, but I thought a private business can do what it wants. The same way they can remove patrons for not wearing shoes or a shirt so not sure why so many are up in arms.
What really got me to laugh was is this individual yelling that masks make humans weak and we shouldn't wear them as our health will be in danger for consuming our own exhale and weaken our lungs. People wear shoes though to protect their feet so this argument always gets a quick chuckle.
---
**The workplace re-opened partially**
My desk spaced out like the rest
With the vaccine available to nearly all the discussions on how to return to the office have begun. A strange discussion when the world has changed on how comfortable people feel being closely near others.
It reminds me that I don't really have a strong preference either way at this point. If you want to be vaccinated and old enough - you can. So in my perspective now if you get sick from COVID-19 and you are not vaccinated and die - it would be unfortunate, but avoidable. Now that the [CDC said](https://www.cdc.gov/coronavirus/2019-ncov/vaccines/fully-vaccinated.html?ref=connortumbleson.com) you can lose the mask if you are fully vaccinated - the world is moving on.
My social skills have taken a hit after spending 427 days basically alone working and spending weekends in a house. I ran into a neighborhood gathering and it was laughable that I forgot how to keep a conversation with someone random if it wasn't a Zoom call.
Though back to our office re-opening. The key to everything is going to be communication as described to us. Some may lie and say they are vaccinated and not. Some may not feel comfortable in a meeting room anymore. Some may prefer masks for months to come. Some may forever prefer to work at home. It'll take basic human behavior and respect the wishes and communication of all co-workers to ease back into this.
---
**Peppers**
My canned peppers
Another pandemic hobby I took up was planting various peppers, growing them, eating them and canning them. There is something about putting in all the effort into making something from nothing - eating it and burning your mouth off with the fresh heat of a pepper.
With that, I'll end the [isolation series](https://connortumbleson.com/tag/coronavirus/) as tomorrow - its back to the office.
### Lets talk Aliens
URL: https://connortumbleson.com/2021/05/10/lets-talk-aliens/
Last updated: 2025-02-04T11:43:10.000Z
Photo by [Brian McMahon](https://unsplash.com/@mcmre?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The past few weeks have been interesting with the claim of UFOs being spotted in random locations by many. Fueled by the Department of Defense putting out a [memo](https://media.defense.gov/2021/May/04/2002633947/-1/-1/1/D2021-DEV0SN-0116.000%5FREDACTED.PDF?ref=connortumbleson.com) looking into the UFO program at the Pentagon led to a lot of misleading claims online.
Most, if not all, the recent UFO sightings have been the same - they were just the batches of 60 Starlink satellites orbiting our planet. I think people forget, but it seems like near weekly we get another launch of 60 new SpaceX Starlink satellites. They've launched 26 batches so far and another is going on May 9, 2021.
What is interesting about these launches is they are not launched into an orbital height that they will operate at. They are launched quite lower, I believe because orbiting a launch vehicle into the same orbit as hundreds to thousands of other satellites doesn't seem quite smart.
[Starlink Deployment - May 4, 2021](https://www.youtube.com/watch?v=xpl%5FJnG7rcg&t=4753s&ref=connortumbleson.com)
So we can see above a stack of satellites being released into a low orbit. They will slowly space themselves out and open up these solar panels to collect sunlight. These solar panels will of course reflect light and be in such a low orbit for folks to spot on the surface of Earth with nothing special.
As those satellites continue to space out they will begin to use boosters to slowly rise up to an operating orbit. Once in the operating orbit, those panels rotate so the chance of spotting them in the night sky becomes quite slim.
However, SpaceX is launching Starlink batches nearly 1-3 times a month so there could be anywhere from 60 to \~180 orbiting at a low orbit able to be spotted.
---
[Indif](https://commons.wikimedia.org/wiki/File:Consommations%5F%C3%A9nerg%C3%A9tiques%5Fdes%5Ftrois%5Ftypes%5Fde%5Fl%27%C3%A9chelle%5Fde%5FKardashev.svg?ref=connortumbleson.com), [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0?ref=connortumbleson.com), via Wikimedia Commons
With all this cheaper and easier space flight - are we alone? I think a cool scale to figure that out is the [Kardashev Scale](https://en.wikipedia.org/wiki/Kardashev%5Fscale?ref=connortumbleson.com). The scale is a measurement system to grade civilization's technological abilities to harness the energy around it.
It has 3 (maybe 5 depending on who you ask) types.
**Type I - Planetary**
- A planet that can use and store all the energy on its planet.
**Type II - Stellar**
- A planet/civilization that can use/store/control energy in its entire planetary system.
- *This would be our solar system of planets in the terms of Earth.*
**Type III - Galactic**
- A civilization that can control energy in its entire galaxy.
- *This would be our civilization controlling all the energy in the Milky Way.*
When you take a look at this, you realize Earth hasn't even completed Type I as we cannot use/store all the energy on our planet. We barely understand our deep oceans and still have confusing terms like dark & anti matter.
If some other colonized galaxy with alive entities exist - would they resemble our technological revolution? It gets difficult to imagine a species eons beyond ours because what seems like nature could be indistinguishable from a species that can control everything in a galaxy. This would of course be highly unlikely, but just thinking about this stuff can mess with your mind.
---
Lets play some scenarios through with aliens and see what makes sense.
**They are already here!**
- This seems unlikely - we are in an era of leaks, hacks, whistle blowers and more. If we had aliens on Earth - it would be more public.
**They exist, but die before communication with Earth**
- Perhaps species emerge but never reach the technological innovation of our species to communicate.
- Or they do and wipe themselves out from something (war, resource depletion, etc).
**They exist, but ignore us**
- Perhaps something does exist, but realizes our civilization is so weak in pale to others that we are ignored.
**Nothing exists and we are alone**
- Perhaps our civilization is it. A sad reality if true.
**Our civilization is a lie. "[The Matrix](https://connortumbleson.com/2018/01/28/understanding-the-matrix-triology/)"**
- Perhaps nothing is real and we are simply entities in another civilization simulation.
---
This stuff borders a line that some make fun of you for thinking about, but on the flip side is so interesting to ponder. With that, humans are going to the Moon again shortly and Mars is on the eyes of Elon to put humans on. I'm excited for our future of space flight and what that means for life outside Earth.
### Credit Scores
URL: https://connortumbleson.com/2021/05/03/credit-scores/
Last updated: 2025-02-04T11:43:10.000Z
Photo by [Diego González](https://unsplash.com/@diegoelbueno?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
At some point in your life - you realize you need to have a good credit score. A simple number that represents how well you pay people back and how much creditors should trust you.
They use a few different things to determine this, which boils down to:
- Amount of applications for credit
- Length of credit
- Remaining balances
- History of payment
A somewhat public, but complex formula then spits out a number between roughly 300 and 850 with 850 being as high as you can go.
3 companies have taken this responsibility to manage tracking American's credit and they are - Equifax, Experian and TransUnion.
You'll probably recognize Equifax as the company that failed to update a 3rd party dependency in a timely manner. This resulted in around 150 million American records being compromised including full names, social security numbers, birth dates and addresses.
I'm sure when I signed up for my first credit card one of the 44 pages of terms included that all my purchases would be shared with credit agencies. Much like my car loan and house mortgage.
So lets start with the stuff that bothers me about credit scores.
---
[RentPlus](https://www.rentplus.com/?ref=connortumbleson.com)
I got this email while I was living in an apartment for a service that would submit my monthly rent information to credit bureaus with the clause for a new monthly fee.
I'm sorry, but what? My rent was forced to be either a check or automatic bank draft which doesn't seem like a credit. This is just money being debited from myself so it doesn't even seem like it belongs. However, the newest FICO9 / VantageScore 3.0 score metric is now including rent payments if they are provided so what do I know. \[[source](https://www.investopedia.com/new-credit-building-app-perch-reports-rent-payments-5105403?ref=connortumbleson.com)\]
Not to mention, the benefit of RentPlus is they only report "on-time" payments. So this looks like you pay a company to shove under the rug anytime you have a late payment. This seems like it destroys the purpose of a credit score to me - just pay a company and they will back date your payments (only submitting the good) to the agencies. It also scratches my head since its expensive to be poor.
---
I froze all 3 of my credit reports after the looming stress of the Equifax leak. So I've decided to sign back into all these accounts and check in on them and boy this was a stressful experience.
Lets start with [Experian](https://www.experian.com/?ref=connortumbleson.com), I sign into my account and immediately redirected to this screen.
Experian "upgrade" screen after signing in
This is just a slap in the face. The buttons are confusing colors, there is a misleading $0.00 shown, but in fact its $25/month. I just want to check my freeze, which led to another deceptive tactic.
Experian - Credit Lock page
I stumbled trying to find a "freeze" section, but it was hiding under a CreditLock feature. It seems Experian just wants to take as much money from me as possible. They are showing this misleading "CreditLock" in front of my face, but hiding in tiny text that my legally free and required security freeze is still in place.
I'm happy my freeze remains but absolutely disgusted by all the deceptive techniques at play here. Someone older or less versed in reading through these techniques might find themselves thinking they need to pay monthly to protect their credit.
So off to [TransUnion](https://www.transunion.com/?ref=connortumbleson.com) I go to check my freeze.
TransUnion Freeze Page
Finally a respectable company. An easy login flow with a clean interface and as clear as day navigation menu for where I need to go. My report is frozen and nothing was shoved in my face. If I go exploring I can find a similar paid option for more features, but it was presented in a calm manner.
Lets go check the final one - [Equifax](https://www.equifax.com/personal/?ref=connortumbleson.com), which I'll place between the two above in terms of the experience.
Equifax Account Page
The good news with Equifax is my account overview page shows the status of my freeze. Why they choose to tell me about my temporary unfreeze from almost a year ago - I don't know.
The UI isn't as heavy as Experian in shoving paid products in my face, but it doesn't take long as every location outside of your account screen is trying to get you to sign up for some monthly plan.
This just bugs me. These companies hold insane amounts of information of each and every person and countless times in history - they've lost that information. Yet the solution to this problem for all of these companies is to pay them to monitor your information?
This doesn't make sense. I don't want any of these companies to hold any of my information, yet without them I can't buy a house or car unless I'm sitting on large amounts of cash. They are a necessary pain in this world and their deceptive tactics and inability to keep my information secure upsets me.
---
Next up, lets rant about how the information gets in here. For large companies like any Chase, Discover, American Express - they submit information to credit agencies because they exist in symbiotic relation where both companies need each other to survive.
Other smaller companies simply don't or leverage a paid service like I talked about above. So it seems weird to me that information about me that controls my life isn't actually submitted by me. This could be for the obvious reason that abuse may occur.
Mint.com alert
So imagine my surprise when I get an alert that a new employer showed up on my report. I was nervous beyond belief - I did not get a new job and this company name was eerily similar to my actual job.
Long story short after a painful process of submitting forms online and verifying information (despite having an account) I had to prove I worked at `Sourcetoad` and not `SOURCE FOOD`. This is because this information is used to build [Knowledge Based Authentication (KBA)](https://connortumbleson.com/2018/08/13/the-slow-death-of-passwords/) so I can be validated as myself without an account.
These are the classic questions you get like - *which of these streets did you live at?*
So I either run the risk of having incorrect information in my profile or having to do the stressful process of correcting information in a credit report. This is all because the cars salesman who sold me my car failed to transcribe my hand-written form of required questions.
The car industry hasn't evolved to a more digital tablet information gathering, but this is an expensive transaction and this is my credit at stake here. Would it hurt to verify information or double check it before sending it onward to credit reports?
As you can tell - I didn't have the best car experience. After being told that the many credit hits would just count as 1 hard hit - I still have 3 hard hits in my report. Deceptive lies everywhere and an industry that can't step sending letters to entice me to sell my car not even a year later.
---
Finally, credit scores evolve with the changing times that work sometimes for or against you but some industries refuse to change.
The mortgage industry is a great example that mainly use FICO 2/4/5 which are specific scores built for the mortgage industry. Those scores won't look at a rent payment that is 3x your proposed mortgage for 5 years, but they'll make sure they take the credit bureau with the lowest score instead of averaging them all.
I don't like any of this. I paid everything off debit for years until it started biting me for not having a credit history. Now I need to keep credit cards and pay them off, because its the American way.
### Pi-hole: 3 years later
URL: https://connortumbleson.com/2021/04/26/pihole-3years-later/
Last updated: 2025-02-04T11:43:11.000Z
Pi-hole "Chronometer" feature - `pihole -c`
In 2017 I installed a Pi-hole into my network on a Raspberry Pi and routed all my internet traffic through it. Today is now April 16, 2021 and I've been running it the entire time.
I've now moved and now have gigabit Internet as well as learned that an older Raspberry Pi cannot handle long-term data storage for results. This has unforunately corrupted most of my long-term data. For context - I had roughly 30 million records around 2.2gb on a Raspberry Pi.
For a new long-term data solution I've designed an extraction mechanism that APIs out logged queries to a server to collect them. This basically works in three parts:
- Bash script that queries local sqlite file to extract 500 chunk size queries, as well as including clients to properly identify them
- Bash script remembers its place by using the sqlite database id on a successful response from server
- Server collects information in a pretty optimized relational database
- Server has a help command - `php artisan stats:dump` that helps write this post
So now I can set my Pi-hole to purge data older than a month. Data is constantly extracted so I'm losing no long term data and when the file grows to a few gigabytes - I pull it locally to a powerful machine and vacuum it. This frees the space from the deleted rows and buys me another 10-14 months. Hopefully this will be moot when I upgrade my Raspberry Pi to a 32gb storage device.
Though this blog isn't about that project - this is about Pi-hole which is now on version 5.5! This is quite the jump from my last blog about Pi-hole at 4.3, so lets recap those releases:
- [**5.0** \- Major Release - Per Client Blocking, Groups, Deep CNAME, Local DNS records and more](https://pi-hole.net/2020/05/10/pi-hole-v5-0-is-here/?ref=connortumbleson.com)
- [**5.1** \- Dark Mode, Conditional Forwarding, Debug System](https://pi-hole.net/2020/07/15/pi-hole-5-1-released/?ref=connortumbleson.com#page-content)
- [**5.2** \- New RegEx Engine, ECS Support, Identify clients via MAC](https://pi-hole.net/2020/11/28/pi-hole-core-web-v5-2-and-ftl-v5-3-released/?ref=connortumbleson.com#page-content)
- [**5.3** \- Fixes on Fixes, Continued detailed query type expansion (SVCB/HTTPS)](https://pi-hole.net/2021/01/15/pi-hole-core-v5-2-3-web-v5-3-and-ftl-v5-4-released/?ref=connortumbleson.com#page-content)
- [**5.4** \- Security and Reliability](https://pi-hole.net/2021/02/16/pi-hole-ftl-v5-7-and-web-v5-4-released/?ref=connortumbleson.com)
- [**5.5** \- AdList Management, New Dark Theme, Automated Blocking Mode](https://pi-hole.net/2021/04/14/pi-hole-ftl-v5-8-web-v5-5-and-core-v5-3-released/?ref=connortumbleson.com#page-content)
Screenshot from my Pi-hole on 4/16/2021
From the dashboard above you can see quite a few UI elements have changed and my daily network behavior with this remote work makes it quite obvious when I sleep.
So let's just jump into the analytics and see what is going on. Right out of the gate, it appears the database is now 2.9gb holding 670 days of records so I have quite a lot of records. Lets start with the top 15 blocked and allowed domains.
**Top 15 Blocked**
| Domain | Count |
| ------------------------------------------ | ------- |
| 806c4c48-1715-4220-054f-909f83563938.local | 803,900 |
| e7bf16b0-65ae-2f4e-0a6a-bcbe7b543c73.local | 638,461 |
| 1d95ffae-4388-9fbc-1646-b2b637cecb64.local | 432,009 |
| ssl.google-analytics.com | 323,265 |
| 68c40e5d-4310-def5-a1c3-20640e1cd583.local | 247,893 |
| watson.telemetry.microsoft.com | 189,136 |
| app-measurement.com | 129,760 |
| settings-win.data.microsoft.com | 71,150 |
| googleads.g.doubleclick.net | 71,007 |
| www.googleadservices.com | 44,161 |
| mobile.pipe.aria.microsoft.com | 41,748 |
| reports.crashlytics.com | 39,792 |
| v10.events.data.microsoft.com | 31,839 |
| vortex.data.microsoft.com | 31,554 |
| sb.scorecardresearch.com | 28,467 |
**Top 15 Allowed**
| Domain | Count |
| ------------------------------------------ | --------- |
| e7bf16b0-65ae-2f4e-0a6a-bcbe7b543c73.local | 5,631,936 |
| 68c40e5d-4310-def5-a1c3-20640e1cd583.local | 5,305,149 |
| 1d95ffae-4388-9fbc-1646-b2b637cecb64.local | 4,898,204 |
| localhost | 1,659,895 |
| 806c4c48-1715-4220-054f-909f83563938.local | 1,342,386 |
| b.canaryis.com | 680,590 |
| clients4.google.com | 221,816 |
| ssl.gstatic.com | 204,572 |
| play.google.com | 202,694 |
| cdn-0.nflximg.com | 181,530 |
| api-global.netflix.com | 148,800 |
| wpad.local | 133,864 |
| api-0.core.keybaseapi.com | 129,141 |
| nrdp.prod.ftl.netflix.com | 128,650 |
| pistats.ibotpeaches.com | 127,896 |
The first question is obviously what is the point of all these uuid like domains with a `.local` TLD. I only resolved this issue after I noticed the huge amount of domain resolutions that were out of the norm.
Turns out my work laptop loves using Multicast DNS to identify devices on the network. For some reason any device that announces itself with a `.local` domain it actively reaches out for establishing communication. What truly upsets me is these domains combined make up roughly **17 million requests**. My database only has 30 million.
Why wouldn't Apple just stop reaching out to a host if it recognized it hasn't responded in a known way in the last 10 requests or 100 requests or even million requests? Turns out bitching about it won't solve the problem - the fix is simple.
Set your "Pi-hole domain name" to something instead of local
Just head to the settings and click DHCP - you'll want to change the domain name (pictured above) off of the default local. A reboot of the network on any affected MAC device as well as the Pi-hole and those requests go quiet.
So I took a quick trip to RawGraphs and tried to visualize my network requests using a beeswarm plot to see the overhead all these Multicast requests did.
[RawGraphs 2.0](https://app.rawgraphs.io/?ref=connortumbleson.com)
Those graphs show the huge influx of requests starting with November of 2020 which was the release of [Big Sur](https://en.wikipedia.org/wiki/MacOS%5FBig%5FSur?ref=connortumbleson.com) in the MacOS world. I should have noticed earlier, but this Pi-hole isn't logged or monitored like a production web-server - I only noticed when my disc space warning went off.
Though what about those other blocked requests? Most are obvious being either Microsoft or Google services, but what is the last one - `scorecardresearch.com` ?
A quick Google search says once again another analytic tracker - heavily used on websites, TV apps and more.
Taking a look at the allowed requests is nothing out of the norm
- Google maps - Ingress, Nest and more
- Canary - Security system
- Netflix - Pandemic times - lots of Netflix
- Keybase - Encrypted communication
- wpad.local - Talked about in last [Pi-hole blog](https://connortumbleson.com/2019/07/01/pi-hole/) \- tis okay.
- PiStats - The project that collects long-term data for me
So then to end this post I wanted to take a look at my top 5 devices and their query counts:
- Macbook Pro - 19,229,727 requests
- Xbox One - 3,809,801 requests
- Router - 828,274 requests
- Raspberry Pi - 778,291 requests
- Sony Smart TV - 763,334 requests
So I can have another chance to say its insane that my Macbook and its busted behavior for Multicast DNS spams more requests than all my other devices combined!
I'm now debating purging these 17 million spam requests from my system so I can have less overhead when running analytics. We will see on the next Pi-hole blog what I decide to do. Till then, pass on a donation to the [Pi-hole](https://pi-hole.net/?ref=connortumbleson.com) team if you appreciate what they are doing.
### Piney Point - Tampa
URL: https://connortumbleson.com/2021/04/19/piney-point-tampa/
Last updated: 2025-02-04T11:43:11.000Z
Let's start with a little story about Piney Point, Florida. Way back in 1857 a company started known as Borden. It was a company that specialized in condensed milk, but over time Borden started exploring the production of ink, fertilizer and plastics.
So now in 1966 a phosphate plant opens up in Piney Point Florida to help with fertilizer production. It's job is simple - produce phosphorus to be used in fertilizer. This location is not far from Tampa Bay water and probably under a few minutes drive to hit the shore. It doesn't take long (4 years) until fishers in the area notice fish showing up dead and its discovered that Borden Chemical new phosphate plant is just dumping wastewater into the harbor.
---
Though what is the wastewater of a phosphate plant? Let's take a step back and learn what happens at a phosphate plant, but first a lesson in phosphate.
[By James St. John - Peloidal phosphorite (4.6 cm across) from the Phosphoria Formation (Roadian Stage to Wordian Stage, lower Guadalupian Series, mid-Permian) at the Simplot Mine, southern Bingham County, southeastern Idaho, USA., CC BY 2.0, ](https://commons.wikimedia.org/w/index.php?curid=34891294&ref=connortumbleson.com)
Enter phosphate rock - a sedimentary rock that may be between 4% to 20% of phosphorus. A few tricks in the enrichment industry might be able to pull this up to 30%, but for the sake of this blog just understanding phosphate rock is naturally occuring is enough.
Nearly everything in the atmosphere needs phosphorus. So we start this cycle with the weathering of rocks, which breaks them down into little bitty chunks which when paired with rain starts leaking phosphorus into the soil.
- Plants via roots ingests phosphorus from weathered natural rocks
- Plant eating creatures eat plants which now contain phosphorus
- Animal eating creatures eat creatures which contain phosphorus
- Decomposers like mushrooms, worms or mold eat the dead remains which contain phosphorus
- Decomposers release phosphorus as a waste back into soil
This is a natural occurring cycle, but farmers looking to maximize yield on crops may interject into the process with directly applying fertilizer (which contains phosphorus) right to the plants. This might be perfectly fine, but the ecosystem is getting more phosphorus than it can handle.
So a rainstorm comes along and carries all that extra phosphorus towards waterways. Water + phosphorus = algae. Enough algae can block rays of sun from reaching the water - this starves the remaining plants of vital sun and leads to oxygen starvation. This ends up killing the fish. So like most things in life – too much of something is a problem.
This cycle could be recapped in video form if you wish.
---
So now that we understand phosphorus. How does a chemical plant take absurd amounts of phosphate rock and produce phosphoric acid?
You basically need sulfuric acid first - which requires a ton of sulfur, water, oxygen and heat. This sulfuric acid then can be mixed with the phosphate to extract phosphoric acid. This reaction isn't without by-products though - you'll get:
- phosphogypsum (gypsum) - a low radioactive useless calcium sulfate
- wastewater (high in metals) - unsafe for deposit to water bodies
This wastewater can be reused, but you'll generate more than you can re-use so it will pile up. Sometimes this wastewater is simply dumped on top of lined gypsum stacks to evaporate. Otherwise large retention ponds are produced to hold this liquid - this is with the understanding that these byproducts aren't safe for the environment.
The gypsum stacks are somewhat radioactive due to the naturally occurring uranium and thorium. The EPA for this reason banned the applications of re-using this by-product for anything. So it sits in mounds sometimes holding another dangerous material, until the same organization (EPA) [decided](https://www.epa.gov/newsreleases/epa-approves-use-phosphogypsum-road-construction?ref=connortumbleson.com) to allow it road construction.
Did the late 1900s not yet understand the required safety of phosphate plants? Since the 1966 plant was just dumping the wastewater right into the bay. This led to some issues which ultimately led to [Borden](https://en.wikipedia.org/wiki/Borden%5FChemical?ref=connortumbleson.com) giving up the plant to a company specializing in phosphate - [AMAX Phosphate](https://en.wikipedia.org/wiki/Cyprus%5FAmax%5FMinerals?ref=connortumbleson.com).
It must have been an expensive problem to solve, so AMAX gave up the plant and sold it to FCS Energy. This didn't take long either until FCS Energy got absorbed into Consolidated Minerals. Once again you know the tale - this was sold to Royster Phosphates and this is where our story gets interesting.
Royster happened to be the company in charge in 1989 when a storage tank leaked 23,000 gallons of sulfate then a few years later in 1991 had sulfur leaks creating acid clouds that killed 3\. \[[source](https://thebradentontimes.com/piney-point-a-retrospective-p6328-158.htm?ref=connortumbleson.com)\]
The FBI gets involved for some reason and the plant changes hands again to Mulberry Corporation in 1993\. It must be an expensive gig as Mulberry shuts it down in 1999\. You may think the story ends here, but unlike [nuclear energy](https://connortumbleson.com/tag/nuclear/) that requires strict shutdown plans - the plant was just abandoned in 2001\. This happened inline with Mulberry filing for bankruptcy unable to pay for the upkeep of these dangerous by-products.
The EPA (Federal) stepped in for a bit, but then they appointed Florida's Environment Protection agency to oversee it. In 2004 a hurricane caused some damage leading to 70 million gallons of that wastewater to leak.
The current owner (HRK Holdings) bought it in 2006 under the clause to maintain the gypsum and wastewater. Just like clockwork another large leak (170 million gallons) happened a few years later in 2011\. This just lead to HRK Holdings filing for bankruptcy.
> History about Piney Point companies was pulled from [Minerals Yearbook 1988](https://www.google.com/books/edition/Minerals%5FYearbook/5AMWqLF4AScC?q=&gbpv=1&ref=connortumbleson.com#f=false)
I'm not happy with HRK though, they sold some of the storage of the reservoirs to take the dredging from a Port Manatee expansion. \[[source](https://www.bradenton.com/news/business/article34550916.html?ref=connortumbleson.com)\] A dated aging storage of wastewater should not have been a home for dredged material storage and probably led to the leak in 2011.
So now the property sat with rainwater growing the reservoirs until March of 2021 when leaks were detected in the containment walls of a stack of gypsum and wastewater.
It seems this plant has never been properly fixed or managed in over 50 years. There are entire [news articles](https://www.tampabay.com/news/environment/2021/04/06/piney-point-from-1966-present-on-the-edge-of-disaster/?ref=connortumbleson.com) that dive into this history of accidents. What started as a plant with no regard for environment protections just simply passed the buck from company to company to pick up the mess. A sad truth with many things in our world, like the recent [news story](https://www.latimes.com/projects/la-coast-ddt-dumping-ground/?ref=connortumbleson.com) of 767 tons of DDT barrels dumped into the ocean.
There is a good 18 minute video that explains this industry which explores another company in a similar situation in the past - Mosaic.
So now we sit in the present time with the state authorizing 400 million gallons of wastewater to be dumped into the bay. I'm no environmental scientist. I have no idea what this will do in the short term or long term, but now I'm getting curious why we have these crazy "red-tides" or algae blooms. Is it the natural ebb and flow of the world or is something pushing the world's hand?
### The Cicada 3301 Mystery (Puzzle 1 - 2nd Chance Solve)
URL: https://connortumbleson.com/2021/04/12/the-cicada-3301-mystery-puzzle-1-extra/
Last updated: 2025-02-04T11:43:11.000Z
Photo by [Chandler Cruttenden](https://unsplash.com/@chanphoto?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This blog is an extension to [Puzzle 1](https://connortumbleson.com/2019/09/30/the-cicada-3301-mystery/), so spoilers are ahead. Please head back and read [Puzzle 1](https://connortumbleson.com/2019/09/30/the-cicada-3301-mystery/) for this to make any sense.
---
845145127.com - January 10, 2012
To refresh the memory. This used to be the homepage of [http://845145127.com](http://845145127.com/?ref=connortumbleson.com) including the locations of the very end of puzzle 1.
At one point that page updated and it looked like the puzzle was over. The page was blank and viewing the source left an uninteresting snippet.
```html
845145127
```
[GitHub Source - iBotPeaches/cicada\_3301](https://github.com/iBotPeaches/cicada%5F3301/blob/master/onions/845145127.com/post2/index.html?ref=connortumbleson.com)
Though just blogging about this you can tell something is up. There is far too much white space in this. So we can open up `vim` and let `:set list` add some visibility to these hidden characters.
vim - `:set list`
So yeah it appears we have a mix of tabs and spaces. So it was time to convert this into a sane format. Using a mix of bash and vim we can get this blob into binary.
```
vim whitepage.txt
:set list
:set listchars=tab:0x,space:1
```
Now with the visible 0,1 and x. We can use a quick bash replacement to drop those "x" (Which are just the extended placeholders of a tab).
```
echo "${STRING//x}"
```
Which meant we now had a full binary file of the decoded message.
```
00101101001011010010110100101101001011010100001001000101010001110100100101001110001000000101000001000111010100000010000001010011010010010100011101001110010001010100010000100000010011010100010101010011010100110100000101000111010001010010110100101101001011010010110100101101
01001000011000010111001101101000001110100010000001010011010010000100000100110001
...
```
[full file](https://connortumbleson.com/uploads/2021/01/845145127-binary.txt)
So a simple binary to ASCII and we get:
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
162667212858
414974253863
598852142735
876873892385
935691396441
316744223127
427566844663
644169769482
889296759263
963846244281
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJPDRkvAAoJEBgfAeV6NQkPVuMP/3ZyAgwsko/B2T9Ew1yqAKVy
K9//wIWCRvMyZ4k79ApqvOJAlezgHTsAM8XG/I71bAG+2wMOXNJfTj/SFONEEbS5
BOp9UP7LHn1j3NKoESrDzsKd+u3oHoNnhs628aLrc8uDqbn/6DNUnObu5Tn3unu0
zZ3NjSs/A5QQX8O56RsK81eSJ2fifbr4NYfHBeUTeVe17nsr48WQI7qc9UVWlPsM
91FWsvhX+WohX8DyFWJmtz0lLvmh3jN+oE8WFPTVbcVCM+eiDt0TqkUNlmq/fxbd
X2Sbs8zMxDXNQWrw58TcSC6oLfXSXZnjh8uTMwrQ0tNdRXHDndgPiurXz62XjVjf
4AhSXBoXF9CHTOyGGEqvfNvFMKyz968iMZDXDNBrM8pkxx1xBHhAnoEznVpeMhII
+IfBTnV8x9lSNgFhmham5eEZlWvqRidqes8EAriqGA6uZokCq7X1IeMHo52ACWmP
2bJsCV5wZDc52c3JnwKe+cAcbsA4OWCNEH29lAsgFw5079BP8lkpY3AH2+8kqs0X
QvqsaMuUq5ZHEaZMgdD0VKYlRrKdhOiDjtJVxoXk1b7YBOV8dZZBXJbEIbTvaof4
yhgUObovx/VFGmsenp+j3nBCxgEO22SgNW3B3pN0yuIMCqccWEZ1nME/QOwLa85n
HOmElIXvK13Q9m545RtP
=Q1Fy
-----END PGP SIGNATURE-----
```
This verifies correctly with 3301 key, but strangely doesn't include the sign off of "3301" which every other message had. Was this a mistake?
Looking at these numbers you should be able to spot that these numbers were the image URLs for the beginning of puzzle 1\. For example, the first number was where the QR code went for the location in Sydney.
- [http://845145127.com/162667212858.jpg](http://845145127.com/162667212858.jpg?ref=connortumbleson.com) \- Sydney
Though what did they mean when all listed together. If you grouped them by the poem they led to. You would get the groupings of:
*Agrippa*
> A poem of fading death, named for a king
> Meant to be read only once and vanish
> Alas, it could not remain unseen.
[source](http://agrippa.english.ucsb.edu/images/book/medium-images/pages/agrippa-62-63.htm?ref=connortumbleson.com) \- agrippa.english.ucsb.edu
- `644169769482`
- `876873892385`
- `935691396441`
- `963846244281`
---
*Encyclopaedia Britannica*
> In twenty-nine volumes, knowledge was once contained.
> How many lines of the code remained when the Mabinogion paused?
> Go that far in from the beginning and find my first name.
[source](https://www.britannica.com/topic/Encyclopaedia-Britannica-English-language-reference-work?ref=connortumbleson.com) \- Britannica.com
- `162667212858`
- `316744223127`
- `414974253863`
- `427566844663`
- `598852142735`
- `889296759263`
---
With the domains thus far involving numbers. It was learned (via irc) that adding the largest number from both groups resulted in `1853143003544` and a new TLD of `.tk` was used so `http://1853143003544.tk` was the location to head.
This domain didn't have much but a TXT record that said - "*Go to my largest part*". So parts of numbers probably point to the numbers (factors) that make up that number. If you wanted to dump the factorization of the number in the URL you'd get
`1,853,143,003,544` \= `2` \* `2` \* `2` \* `7` \* `33,091,839,349`
So if you tried to visit that domain (`http://33091839349.tk` ) you'd get an image.
`http://33091839349.tk`
Of course after downloading this image and running "outguess" over it. You'd get:
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Miss round 1?
Care for a second chance?
http://i.imgur.com/hkdgl.png
1:22
3:33
3:40
6:19
4:7
4:8
4:7
9:23
12:12
4:16
16:7
11:16
1:7
5:14
3:35
2:2
4:26
1:12
3:11
3:28
4:23
18:18
Good luck.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJPDTiqAAoJEBgfAeV6NQkPytAP/1UQeylwYBjQWuzr8pbERN04
wlZVCG5SjGanqfQKxSa5Z8YOVR9LRlT6sHBKgfOEDztj+6RM2SvX7Y2Mw9mA4g90
7bizXi8IkP5K3tMvNxcA6uEy0rSchJt4D93zzjPvS7lm6jGO1gJQXrwMUd4fACs1
hxZ3Cxva0MIS+r8MxRJbU/mKbDvnEr6fwUaB6m1vFgYW6wTM4qS2ES04ic+mlkbR
0/eRPnFIBb06XjQpijDAGiisgVORaUUrUJGX+Wnp61CVobBmKwUdw3n0AxbKRC3/
Nja0HYvXexWDiRgxE2YjZyq0Pk4TnZoXxTnyS6NKZ1i1Qxysu4xUfuLO3L6zrnQP
TT4EsqDxzMAKQuJS6qo/pLsdCqyXO1Jr4wIlaG5AGYKMjt9k61Y12WLiqhpLTgzd
AtUTejZzThXqbhmm4wPCVk+Vsik8PLs/Ts6DooB3Ki3AtRtldmeCXdo+mid3Og+A
IKw9+KtB2JDd4a6DbsNbRDIt1pZmyPA3xmmksc8ogx/CEPATPwL7JaN5UwVNSZKM
6MiJ1+b39Kx9ckQ8vSuYa5cALDiUwZPddopl29zbVmKciW+sDGfSiSroXw7khNJs
dzmJ4hR2R7Bbv23Ngxt/M/J5/udOd0AaeDKMxfLNnaLqm8FiaWqnL5TwkzMFnad7
RKpOZq9TkllIE6NBB4wc
=mGcB
-----END PGP SIGNATURE-----
```
It was weird that the decoded image message also linked another image.
[https://i.imgur.com/hkdgl.png](https://i.imgur.com/hkdgl.png?ref=connortumbleson.com)
This 2nd image was a PNG so our chance of running outguess over it wouldn't work. Looking at this image though looked like a fiery right and sun sky on the left. Presumably relating to heaven and hell so off to Google search we went.
["heaven and hell painting"](https://www.google.com/search?q=heaven+and+hell+painting&tbm=isch&ved=2ahUKEwiI%5Fo7516XuAhWfeDABHb1XDY8Q2-cCegQIABAA&oq=heaven+and+hell+painting&gs%5Flcp=CgNpbWcQAzICCAAyAggAMgIIADICCAAyAggAMgIIADIGCAAQBRAeMgYIABAFEB4yBggAEAUQHjIGCAAQBRAeUOErWIYzYOAzaABwAHgAgAFEiAGdBJIBATmYAQCgAQGqAQtnd3Mtd2l6LWltZ8ABAQ&sclient=img&ei=ZZoFYMi3EJ%5FxwbkPva-1-Ag&bih=942&biw=1920&ref=connortumbleson.com)
Now the 2nd image looked like the same type of design, but the pattern didn't match. So it was time to do some research on William Blake's The Marriage of Heaven and Hell book.
Strangely an interesting book with only 9 copies made, but I assume if you are making a custom drawn book in 1789 you don't have a copier for mass production. Thankfully a [website](http://www.gailgastfield.com/mhh/mhh.html?ref=connortumbleson.com) existed to view the pages and an extracted copy of the text.
[source](http://www.gailgastfield.com/mhh/mhh4.jpg?ref=connortumbleson.com) \- gailgastfield.com/mhh/mhh.html
It was plate 4 (The Voice of the Devil) that ended up matching the above image. So now it was time to attempt the book code. Our book code only included 2 numbers, so guessing that is correlates to line number and letter we attempt to decode this.
This turns out to be a minor struggle as nothing appears to be coming out as sane text, but the text adaption online doesn't seem to match the lines from the blurry image. If we take the effort to [restructure the text](https://connortumbleson.com/uploads/2021/04/voice%5Fof%5Fdevil.txt) to match the text - our decoding begins to work.
- `1-22` \- `c`
- `3-33` \- `g`
- `3-40` \- `i`
- `6-19` \- `n`
- `4-7` \- `i`
- `4-8` \- `z`
- `4-7` \- `i`
- `9-23` \- `g`
- `12-12` \- `l`
- `4-16` \- `y`
- `16-7` \- `a`
- `11-16` \- `o`
- `1-7` \- `b`
- `5-14` \- `y`
- `3-35` \- `p`
- `2-2` \- `h`
- `4-26` \- `.`
- `1-12` \- `o`
- `3-11` \- `n`
- `3:28` \- `i`
- `4:23` \- `o`
- `18-18` \- `n`
That spelled out another onion - `cginiziglyaobyph.onion` which prompted for an email. At this point in the story we can look towards individuals who leaked these details online - the test of time leaves the random verified signed messages, but its assumed the participants who registered in time got an iteration of the message below.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This message will only be displayed once.
Here is a message that has been encrypted with RSA (the Crypt::RSA Perl module available in CPAN) :
- -----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE-----
Version: 1.99
Scheme: Crypt::RSA::ES::OAEP
eJwBzQAy/zEwADE4OABDeXBoZXJ0ZXh0Ca4y//uzl/HvFoP9Klf53nEFH0T4c+ui5de8+vqGOnZc
9DlrsWQe+xxVaPaYgKAD9Wn9VWQ6A5o254r5pa4hkDIY5RRmVfqOm88HJpGdbGGTckyEwJapCLDT
tHzZWAZ0FIVj6fH2whErHoVmZ82zQJ64OLtzr1gYk+2kIZuqtLclV9RDhs6j7meTaod2BDrF26tY
d33awv0txxrgXRhd/FDFVtKb0K84cQs2xtO/9A0yLs5GEK2xpG2yM4AeWWft
=I1r6Wtzf/29vTggAK+ELEA==
- -----END COMPRESSED RSA ENCRYPTED MESSAGE-----
Here is the public key used to encrypt it. Note that it has a low bit modulus and is therefore breakable:
$VAR1 = bless( {
'e' => 65537,
'n' => '7880891639791153779530258464649693928733411681581577103690292822333198036864739065916344030512697162068582555837',
'Version' => '1.99',
'Identity' => ''
}, 'Crypt::RSA::Key::Public' );
The encrypted message is a number. Break the decryption key, then come back to this same URL and enter the
decrypted message to continue. Each person who has come this far has received a unique message encrypted
with a unique key. You are not to collaborate. Sharing your message or key will result in not receiving
the next step.
There is a second chance to get your own RSA message and key. Follow the "Numbers dot TK" hint to find it.
There are many fake messages out there. Only messages signed with public key ID 7A35090F are valid.
Good luck.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJPEi5eAAoJEBgfAeV6NQkPuiMP/27jZQ7t27p8cg8R8//Cj4Sf
RWVF09jFYtAZ9S38atQy2bFlkBYRejQu49iZa2mGp2ITa2zfsbI3NviOeY3XJXRy
9zxzNIF6IkPm6dCwRARTsXGYz4/9I6AgyLT6OyT1ltzys+c2kccGJ+2XXo9VNpA5
D8EoWRWAaiIJhF9ezLK/j2ImaDJnQ/y2PnjVm+QE4ywivp6arSoAbxwOga6TIef4
uwjw9PKMkHR+9nJOvKSkG9S9FKxMhSo9r0jr7AVLmls8Q30t2fJ6wDNI+ygWBljo
JIvu+Av6ACmhktO6XMW3xNe2TG3W7WnhrmERm+DgzOWkfCRa2lAd42CPiwTgVI5x
1tIPowTpW0HvZlqT2/wxKmSEs994MJkPzHI+82GkXxv3FbWms/ztdBuMcv7+sUbT
IS2549fOw51S2zLvZ1RoSaKIQGZd9ycGMOPQs8etxgOWtK34tOdZlntpDQHyTDqj
NX+0/Aer7pFmtVE92iYBLlDIHH9xZnNkN6ZZSC+oXl9SP6ivs535qyYDTuM/IfFc
6zNlhuVOqosIbRp51EhWLG0vhOtNDMUTaPaQk7t5dnm6SmYjLcv5xc6qyo/3Xu2F
vCvmA0zgTaYbtWD6NI+ejTjGhZ8Pk+WeVxSyJ0Io9Q5S90/hxdAegtAVGUnLhxYa
vbacP/zEyYKHfIdkNn9R
=LMdX
-----END PGP SIGNATURE-----
```
[https://pastebin.com/4YaQ0TvJ](https://pastebin.com/4YaQ0TvJ?ref=connortumbleson.com)
This message is strange, because its almost like Cicada doesn't want you to share it, but at the same time gives you a hint there is another chance to get your own specific copy. You would only see that though if someone shared a copy or told you about it.
This is one of the only discovered snippets online that properly verifies as a Cicada signature from this stage in this puzzle (that I could find). An interesting point as well as a few years later Cicada begins [Puzzle 3](https://connortumbleson.com/2021/02/15/the-cicada-3301-mystery-puzzle-3-part1/) with a similar breaking of a small private key.
This key (112 digits) is thankfully a bit smaller than Puzzle 3 (130 digits), so lets break it. We will use the power of a decade later of technologies and boot up [rsacrack](https://github.com/b4den/rsacrack?ref=connortumbleson.com) docker container that wraps [cado-nfs](http://cado-nfs.gforge.inria.fr/?ref=connortumbleson.com) on my own hardware.
```
ibotpeaches@foundation# time docker run -it b4den/rsacrack 7880891639791153779530258464649693928733411681581577103690292822333198036864739065916344030512697162068582555837
[*] pubkey.e: 65537
[*] pubkey.n: 7880891639791153779530258464649693928733411681581577103690292822333198036864739065916344030512697162068582555837
[*] Key looks like 372 bits
[*] Using cadonfs to compute primes
[*] results are: [u'98007492061325958997349177934627388613835953553459586261', u'80411114232571782218163489375797613948878398942588985417', 65537L]
[*] Key extraction done.
-----BEGIN RSA PRIVATE KEY-----
MIHsAgEAAi8NG6bqKiUXBAidW7CmF+WTr6owpY+MprGwQrOWuRVHb0ko2zdWiiXkZH1Kv31gvQID
AQABAi8F4v06/GJby7vyr1LNxL2dba6I2lF1YQP3C1P+Jz85VYigO/4Am+s2SkB+4BkDAQIYA/8+
91K7m8jMN43hdcKwWiVe54kqoyTVAhgDR4f9CRgCSsFj8Vvilwjw0LfevXiIYEkCGAPbGvIekjHj
y6NiHDcBY+HDuGDQG2gI0wIYALzWdGz/0rb/ydL/oNbpR8aRo4MjE4uHAhgDx+oNUAE2EddY+lDq
EqRxF5D0juT2Kwg=
-----END RSA PRIVATE KEY-----
real 94m12.942s
user 0m0.214s
sys 0m0.115s
```
94 minutes later we've got ourselves a broken key.
Now that we've found the two primes (`q` and `p`) - we can write a small program to decrypt the original payload.
```perl
use Crypt::RSA;
my $algo = new Crypt::RSA;
my $keychain = new Crypt::RSA::Key;
my ($public, $private) = $keychain->generate(
'q' => '98007492061325958997349177934627388613835953553459586261',
'p' => '80411114232571782218163489375797613948878398942588985417',
'e' => '65537'
);
$encrypted = "
-----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE-----
Version: 1.99
Scheme: Crypt::RSA::ES::OAEP
eJwBzQAy/zEwADE4OABDeXBoZXJ0ZXh0Ca4y//uzl/HvFoP9Klf53nEFH0T4c+ui5de8+vqGOnZc
9DlrsWQe+xxVaPaYgKAD9Wn9VWQ6A5o254r5pa4hkDIY5RRmVfqOm88HJpGdbGGTckyEwJapCLDT
tHzZWAZ0FIVj6fH2whErHoVmZ82zQJ64OLtzr1gYk+2kIZuqtLclV9RDhs6j7meTaod2BDrF26tY
d33awv0txxrgXRhd/FDFVtKb0K84cQs2xtO/9A0yLs5GEK2xpG2yM4AeWWft
=I1r6Wtzf/29vTggAK+ELEA==
-----END COMPRESSED RSA ENCRYPTED MESSAGE-----
";
print $algo->decrypt(
Cyphertext => $encrypted,
Key => $private,
Armour => 1,
);
```
All that is left is a quick execution to get our decoded message.
```
➜ ~ perl puzzle1-2ndchance.pl
33521494043430258676
```
It looks that was the answer to this specific participant's puzzle to be entered on the onion given. Unlucky for some - that page ended up crashing with a 500 Internal Error for a day or so.
Once back and working the correct password led to a successful message from Cicada saying - "*Correct. We'll email you.*" A few days later an email arrived instructing to head back to the specific onion and assigned number.
So taking the specific participant specific number (From Cicada email) to the onion - `sq6wmgv2zcsrix6t.onion/{number}` resulted in another longer new message.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This song is your own path
Another stop on the road toward enlightenment
Follow it, and share not
Let the Chorus be your guide to the depths :
Let the Priests of the Raven of dawn,
no longer in deadly black, with hoarse note
curse the sons of joy. Nor his accepted
brethren, whom, tyrant, he calls free lay the
bound or build the roof. Nor pale religious
letchery call that virginity, that wishes
but acts not.
For every thing that lives is Holy.
Good luck.
3301
- -----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.11 (GNU/Linux)
owHtWHtQVFUYv8tuKhhpTcVpwABLBwEXlm3locgCoyMmkuOjdXx0FdQY0wQtEcJY
rmbYw0eThlNOaY0paPZQ8zFmOaSllRMpTjqNji/yUc6oU2RG5z6+c8/jXmCm6b/9
676+8z1+3+/8vrO7MtIphTlQrONCpS+8l2NrYv30iPzS4mkl09xzSkuK0EVv4bin
SyRJ6iY5JKckF44rn42fEqV2R1/dLm7agrjh5aVxI6fNjUtLjUv1ZvnSs7yZ+N6T
JrWnSPqK+97p6ooxzu7vxUlfdpO+GiC1B1zdHaiH1D4xzCFJq3LkoD+Yg2+yZRTM
xtcM9UUGvkmXFSmYjm9y8Zdc7Soz1yH4/RApOI+21L9kqz6yJbQqH5vka76QZsBF
Uw1kzYBEBRdCXjn4Qw5eMUT9MIRYIrwUaSvBZTZ+n015ylIXZGn5aiuRkbjpGp7T
8Yp0bQXSFkDWJCS7wCIXWGkCoecCuZEFJjAQUksS4TKRVjbENoBZ5heDCemRG/gC
3gE7Fkt1gcwUDp2G7ITCYSFbF+3QgBiAIH0FSxtMoRpE5aAzQ39WPcqaR9ORRjoT
McDcCIlsaUmZgDOohwdOB4iGGhlI61ehPEI20lCT+gCRzh2SDBQKzYBs2ZiIyonQ
mCOEwC5+SwgubEEldQiyYC8YxhosCDaJ2BNRoAvpnYkOXzVfpO0HniAANA94ruog
V9g2JgWJAUc1WhBkTkl47SFtJ5/sotnWY8qTnVwhSgUsHAmstYXQ1jJD7Q/9gRNw
RAm5bKn41GZEBoY8dkjbQDYcxTQTIATtAJoJfBdazFXcJdHoQkKiLqKOyQu9o/SD
bbJ+NQ2pzrDjjs9XnFq8a+gIv1kpdnNjIF99Yb0rO9Ui6NH/KLmw4YVDhR6TooE4
hnVoOmMDskoDcayAbc3ppannnTLN3DvGFwCNPfOIGoyPC11w35meWUwxruyX6KMA
L2yACGxsfYli0UqIrzNRkUSRgCjEAjYhKy9UEIAI+sDVpjB6z51JWBooIt7sCGGi
IYrFlAF/EjZhY09SRpoKfQCCcywyYGXlx8iaisEf1PUVFgZizwT4qIkMCiWzlrDb
bE94Nrpi0URzQkNJ1JGW3aH2KEDm4jnKzsKQM0UUU3aIKSKnBSQJu0zKkC+ywXoE
1bNzm0BNYQ7ij5j5JnRJrIQAJzTQEAaFOYLgm3Q6WZv9rtA6F/TzWzLIHHYsqGAO
ag5XfhrYb0Vu0gikoUw7+S1psSF4HaXqNiXJ+ujKzq8ud4D9vcgfTbk2WHoVlM/2
DMFPSvu6rQRAFAuqJ8i6UiKx4t63EBirHa5YclHWK+V7AfuDP1KL0FiLqtLBqLU4
Tln1ShHw4TtE7RiozDyBsT8FKfLZ8FRgsqh27A6y+3OAEnILUhjgCMwSQIGGkz+p
ot7+739SrU6V5dpUfPXIqNajPQf92gtyg4uqTScWCD/L2nOyapCMb5LwiyTKhVv9
4KZdGG/Qah829eEXXmzqxc+2QSjnSHPuVV94qShe7Mpr6RJpHmGhT13oIwuUCuNG
MlYiAoHpCb4j7RkiGjkhUjCkACHBEELDewiQhMUJf1CrQ1px5gd9gRtf3dpVxtcK
M3eIyOGFCG6QO3gi+JFmALJs9ZRL3UBBJAuP+sXToTPb/hFLHlRbKiTj52SmEg2s
YEDImPQBggI6xLeIJ6LSlgiFudqhY4rZIVK6sD8guGChp0s1j++RB1892IC4MkqV
rFivl26YVljgrFdmUk5mKEcg0WG2SNdsJctFQlabHlMgmYUZhDHTVuFEYudgJVlh
Ehzy11d2LhDgm+VTx7SRDdqwmAmuzZ4DNLIhKYjZlUL9BuoKspdXaBxbF0MBA/+O
W2wBkWmofUCmdkLCFHhsJYCZoDdGNhVdiCaIFtECvlYTJoEPxBu/lcWZYiNoywKE
8wIDzK3KDRURfYt6Wah0CLvSBp5GQnRKvzhB4yWEmyhL/HZE62AHheZ4aI6H5nho
jofmeGiOW0ULzfHQHA/N8dAcl0NzPDTHQ3M8NMdDc7yrc1z9j74uLMYlOcKkbneF
FaGLXikivDeKdVyo9IX3KirtdSdm7/ktSfvmOwdfuLrl77GPBOvXJTiXzn6toCZy
xrs1flfE6Uuvx+5rXrSwKSNhyuYe7vi7r13YOnXWo9cjexaXnTp8/uqtkh8P5VZu
czWm3x4cuDG5Ye+sP1ra+wW6L7q09sm8iMfGjf1l+ZjLrUWTJrSl5p3Zt+bYPVP7
9a1rcc/NeSCmKCF288OjJ34y9+OUV/55rn3R3icWrSsv+Trw8/HLhZEVNyXPiIiy
hjH1aVE914w9tmS9//fY6MIBDe7R37911Le896bEw6NPXBl4cNiylrDpbdtijq6/
U/XdwkNjmmc6c1tOF2/4tvHg3oY59z+e9uyeLxom3bq0Jqk+e/HRxFEvREzInPFN
7tADK87kVhWEz4+6nFfv3H0zuXX2xWvHZrrzfjsxPqyx4o3Pqgs/KinJ3vzh8PMz
Nz4fVbxpQsyM2lcLGqKfGjalXzk6EmjNaDp7KFU+d8pVlrk0OSFwx7XxRta1rMkb
WoNRi+vaBtXINet3jWq4td1/buyg2/vjkwp2jH8/9Yd1+VVrrj/oLlkVDB5p+7U9
80CftP1bBu5o/enFouaXozeMCJ9//a/5CwZnlZ7YWls6p/lsnxFh+a4JyUOrh+5p
im97KPNg9O6CS8OiP3U5+98u61aRgEbmDw9PSas8U1sb+3l1sFop2Fzp2bX9SmFK
/5MpK48fb9xx496+OzftXPFmy5SdxcefaWmat6O8Kt73Z93JtVUfJLf9Cw==
=yk7h
- -----END PGP MESSAGE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJPGOY0AAoJEBgfAeV6NQkP7KQQAJ7qfuZgtthyD6hXiPvrYXCl
Dnbj4viLPeiwVC/dYHn76yixqImr4+gzWEGzr+MrNpaPRBtCxu7kmBtwuyNHoqlz
KINmTLuwjpLkU/VBi02b17Z5UbCguEn8ZZDq8HFJgl3I8teQOBpmNorfsR0+CmjM
btuLdiZkLS0f9LS4mCivnlJmr6ULIwiAh7KaCQbj3s908raMQL+uIg6GXort1ilo
sppcEaykOHUmz+cxG2xpOD1KVt/IqSawimB3xfveCcLyRRfRQp4ACyL+eBiTzuT9
IJ9NmCrE3OcFtzJa0S2JjlOI5x1h70GEl1D/rpTu3zOR6I3YF68RufIxtnfpDsx3
6OORSR0kWVO1fVAotL3QfPxq6cjsy5Q+Gm5QeAvI+e5k2lGIL83d3JS23s0IjopS
gJWHwwIF5q9uHrg8oPIJkYkc1Dxzrvgc5DcHsYo+KQxWYsPhjh7nQp8hl0KpK8Q/
I8yFg3afBfH1ci15HifKVwAJGtrki3+NkPDw7IuwFDtW6NCd4SJ6XQv9fw7NyYQk
/qxbiOrz4yD7MOY9tKapdDMc5B4jIBaGULoKiMqk4KBHc05Z8I4yqaCfWI0BfijJ
VvKgLCx8mLillkKKH8A+f4CG191MKd0LwfrWNDCC62e5vWRaulV0coR2DTrCFFDA
FZL1IQd0u3QtmG5aRBhi
=kTmp
-----END PGP SIGNATURE-----
```
[https://pastebin.com/VuyPwuL4](https://pastebin.com/VuyPwuL4?ref=connortumbleson.com)
Unfortunately for those who decided to leak these communications in the public got a different message.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello. You have shared your information online. You are now removed from this altogether.
Even if you crack the key you've been given it doesn't matter, because you have demonstrated
that you can't be trusted to follow simple instructions anyway.
Thank you for your participation to this point.
Goodbye.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJPEsO0AAoJEBgfAeV6NQkPJRUP/1JyxwilMLUX0J+2gLofZV/C
/eIJkO3lxYuLQQWiouJVzBSddZ/GVP2XLP86OaZpYoChzGRxYaIia62e0ZnRQHei
d7UNWvOjenveo7QUpxpY+xPvPq41l/JJAntE6H82yO4NlCTTFi7UJBG2r8EgSc/s
gQs1A5TANcJgq8mFoscPH4T1QxT5N0AXbALMNyEUS37UqBcV40/7v9AJq52tyLnQ
IInxdmY38RO/sJJIAi/4hCquJ6OYFYmQxBTldKhacEE0/e8BQXIm/eIXClPL3ff0
mET9uP8CwyFQW8nUM7dBRO4CKTUJ0cYxjj3PlHnRUdfM7AyywWeXkqwlDB4OFOy2
Jw9/18phYSxTV2cM6ETRBK1xSGwevHHBaEdJF7xZAIA3EYbqyjW09YQnf4dihEg7
O3faR8docXTPwQ0qhuU65krI5O17N3Sn731RvBz9bZcDm+E8nh0m6wA0yRBYYjYo
8SW5MscEN2SI7xq8lskHdX9uogDVnb9IqTV2YfrQplnpZIR5jfLU+uWgVXMA2faQ
i9QMtyvKGGZ6ejPX+euPmp8XRIUHeXD5H/YQSTTy6D/0WnMHpH/h9p1FRcWOZSbR
1Gmmxi/Oix4PtBXjuNJt51KuQxVsh3s1f2KTcVV3tILalYtyPtoqTRST05KwV/Jj
GnHprhtOWRq4pAHlQktc
=kPlo
-----END PGP SIGNATURE-----
```
[https://pastebin.com/3ztaEZ3W](https://pastebin.com/3ztaEZ3W?ref=connortumbleson.com)
For those that didn't share their message - the next puzzle looked to be related to music.
Just need to translate our armored (ascii) message back into binary with gpg.
```
gpg2 --decrypt song.txt > song.bin
```
One quick file command it was obvious what we were dealing with.
```
➜ file song.bin
song: Standard MIDI data (format 1) using 3 tracks at 1/96
```
It was a [MIDI data file](https://www.youtube.com/watch?v=SYU-j2rPzMc&ref=connortumbleson.com)! Lucky we are running on Ubuntu, because this looks like a job for [midicsv](http://manpages.ubuntu.com/manpages/bionic/man5/midicsv.5.html?ref=connortumbleson.com) to translate this into something more readable. The output is quite large from this nearing almost 3,000 lines so I'll leave a snippet and the full file linked.
```
➜ midicsv song.bin song.csv
```
```
0, 0, Header, 1, 3, 96
1, 0, Start_track
1, 0, Text_t, "Cicada at Fri Jan 20 03:57:39 2012"
1, 0, End_track
2, 0, Start_track
2, 0, Text_t, "Cicada at Fri Jan 20 03:57:39 2012"
2, 0, Tempo, 500000
2, 0, Program_c, 1, 6
2, 0, Program_c, 2, 41
2, 0, Time_signature, 7, 1, 24, 8
2, 0, Key_signature, 1, "major"
2, 0, Note_on_c, 1, 63, 96
2, 192, Note_off_c, 1, 63, 0
2, 192, Note_on_c, 1, 61, 96
2, 216, Note_off_c, 1, 61, 0
```
If you take a look at the large decoding - there appears to be four tracks in this file. We can find the two audio tracks that both Audacity and our CSV dump of the file show.
There is data here we want to get which probably has something to do with that chorus and MIDI data information. The lyrics in the beginning of the message hinted at the track which was [A Sony of Liberty by William Blake](http://www.gailgastfield.com/mhh/mhh.html?ref=connortumbleson.com) \- this was plate 27 in the The Marriage of Heaven and Hell from earlier in this puzzle.
One thing I noticed looking at the more zoomed in Audacity picture is these notes aren't as random as a usual song. This is probably a musical cryptogram - as it was popular in early times to hide messages within a song. Early time cryptograms would match letters to note names, but notes run out around G. I know from just glancing at this output that we have more than 7 characters.
Zoomed version of Audacity
So a simple way to do this to just to assign a consistent character to each consistent note value and brute-force it. Though, with how many possible characters or numbers or special characters - there is probably another way.
There was a hint in the puzzle with - "*Let the Chorus be your guide to the depths*". Maybe instead of guessing we have a sure fire way to obtain note to character mappings. Though, each track has respectively 1,124 items and 1,436 items compared to our character count of the chorus at 302 characters so we probably only care about the events of each individual note (play/stop).
Though, we need to understand more about the data stream we have - which thanks to the [man](http://manpages.ubuntu.com/manpages/bionic/man5/midicsv.5.html?ref=connortumbleson.com#examples) page for midicsv is quite documented.
So the first few lines of track 1 show:
```
track, time, event, channel, note, velocity
2, 0, Note_on_c, 1, 63, 96
2, 192, Note_off_c, 1, 63, 0
2, 192, Note_on_c, 1, 61, 96
2, 216, Note_off_c, 1, 61, 0
```
So to make a mapping between notes and characters. We have to toss out `track`, `event` and `channel` for obvious reasons (they are constant). `Velocity` looked promising, but it alternates between `0` and `96`. So that only leaves the columns `time` and `note` to build a mapping from.
So if we started with the two notes above. It would be
- `Time` \- `Note` \- `Letter`
- `192` \- `63` \- `L`
- `216` \- `61` \- `e`
This doesn't look right because those time entries don't exist in Track 4 and rise to insane numbers. Though, if we subtracted the off time event from on, we could get the total length the note was played. That set then becomes:
- `Time Played` \- `Note` \- `Letter`
- `192` \- `63` \- `L`
- `24` \- `61` \- `e`
This is promising. So we could script this now to read track 3, extract the length of each note along with its literal MIDI note value and proceed 1 character at a time through the chorus. Once we are done with that, we can take those mappings of length/note and use those to solve Track 4.
`Time` grows to some insane values so it probably isn't seconds or milliseconds - it must be some unit for MIDI measurement. Unfortunately for us using track 3 to decode track 4 results in nonsense string of characters.
```
rorrrrrorrrrrorrrrrrrrorrrrrorrrrrorrrrrrrrorrrrrorrrrrorrrrrrr
```
We probably have to skip characters once used, so once we use the letters `l e t` from the chorus - no more `l` or `e` or `t`.
Perhaps our key was wrong. Since it was `Time - Note`. Though, even `Note - Time` doesn't give anything real. So we must be doing this wrong. No matter how many times we swap Track 3/4 and tweak our alphabet we aren't having much luck. So it took a bit of manually debugging and diffing. If we spell out what we know, then dump out what we don't know. We see a pattern.
MeldDiff - "we know" (left) "secret" (right)
We can see a pattern starting that none of our matches ever finds a corresponding `Time Length-Note` match unless we subtract 12 from the Length. At that point we get something readable immediately. Still confused on the magic aspect of 12, it must have to do with the tempo or some time signature between the tracks. As you can see *The Secret* goes up nearly twice as fast with units vs *The Chorus*, but my knowledge of MIDI is not good enough to dig into that further.
```
verg,oodgokhaveproventoyejostdedibatedtobojethisfartoattainenli,htenjentbreatea,p,cegforgokrejailaddressandkploadittothejitcegserversthenenbrgptthethefollowin,wordlistksin,thebibadathreethree eroonepkylibcegsi,nitwithgokrcegsendtheasbiiarjokredbipherte ttothe,jailaddressfrojwhibhgokrebeivedgokrnkjyersgokrwordsarejksbledroppkjpcneeyirdwatbhyellyallhajjerpobcethoochokseyracefeathercnottibcetyoatyo joonblokdyklybarria,eyo trags karebkpstationjatbhtoothovenhorsepenbiltragbollartreesbissorsyrkshdraweryribcarjen,inesobckjyrellasheepapplehornhatbhainforcsbrew
```
This is good, but not great. We can see the start of a phrase but a few characters are just not right. I can tell the commas were probably not expected in this character set. If we remove all non-alphabet characters and output the intended key (instead of an empty character) for mismatches our decoded message becomes:
```
verygoodyouhaveproventobemostdedicatedtocomethisfartoattainenlightenmentcreateagpgkeyforyouremailaddressanduploadittothemitkeyserversthenencryptthethefollowingwordlistusingthecicadathreethree[44-384]eroonepublickeysignitwithyourkeysendtheasciiarmouredcipherte[55-192]ttothegmailaddressfromwhichyoureceivedyournumbersyourwordsaremuscledroppumpkneebirdwatchbellballhammerpockethookhousebrakefeatherknotticketboatbo[55-192]mooncloudbulbcarriagebo[55-192]trays[43-192]uarecupstationmatchtoothovenhorsepenciltraycollartreescissorsbrushdrawerbrickarmenginesockumbrellasheepapplehornhatchainforkscrew
```
Still isn't perfect, since we have a few unknown pairs outputted. Though, we might be able to detect the proper value for the unknown pairs from context of the word or sentence.
- `44-384` \- `z` \- *three three *z*ero one*
- `55-192` \- `x` \- *cipherte*x*t*
- `43-192` \- `q` \- *s*q*uare*
> Very good you have proven to be most dedicated to come this far to attain enlightenment.
>
> Create a GPG key for your email address and upload it to the MIT Key Servers, then encrypt then following word list using the cicada three three zero one public key.
>
> Sign it with your key, send the ASCII armoured ciphertext to the gmail address from which you received your numbers.
>
> Your words are:
>
> muscle drop pump knee bird watch bell ball hammer pocket hook house brake feather knot ticket boat box moon cloud bulb carriage box tray square cup station match tooth oven horse pencil tray collar tree scissors brush drawer brick arm engine sock umbrella sheep apple horn hat chain fork screw
There was probably a much easier way to do this versus writing PHP code, but alas the source.
```php
getRecords())->groupBy('0');
$mapping = [];
$index = 0;
$onNoteCache = [];
$usedLetters = [];
$track4 = $track4->filter(function (array $record): bool {
$key = trim(Arr::get($record, '2'));
return $key === 'Note_off_c' || $key === 'Note_on_c';
})->each(function (array $record) use (&$onNoteCache, &$mapping, &$index, &$usedLetters, $chorus) {
$key = trim(Arr::get($record, '2'));
// Store this note for the next "off" event.
if ($key === 'Note_on_c') {
$onNoteCache = $record;
return;
}
$length = Arr::get($record, '1') - Arr::get($onNoteCache, '1');
$mappingKey = trim(Arr::get($record, '4') . '-' . $length);
if (!Arr::has($mapping, $mappingKey)) {
$character = $chorus[$index++];
while (in_array($character, $usedLetters)) {
$character = $chorus[$index++];
}
$usedLetters[] = $character;
$mapping[$mappingKey] = $character ?? null;
}
});
$decodedMessage = '';
$track3 = $track3->filter(function (array $record): bool {
$key = trim(Arr::get($record, '2'));
return $key === 'Note_off_c' || $key === 'Note_on_c';
})->each(function (array $record) use (&$onNoteCache, &$mapping, &$decodedMessage) {
$key = trim(Arr::get($record, '2'));
// Store this note for the next "off" event.
if ($key === 'Note_on_c') {
$onNoteCache = $record;
return;
}
$length = Arr::get($record, '1') - Arr::get($onNoteCache, '1');
$mappingKey = trim((Arr::get($record, '4') - 12) . '-' . $length);
if (Arr::has($mapping, $mappingKey)) {
$decodedMessage .= $mapping[$mappingKey];
} else {
$decodedMessage .= "[{$mappingKey}]";
}
});
$this->info($decodedMessage);
```
- It uses Laravel [Collections](https://laravel.com/docs/8.x/collections?ref=connortumbleson.com) & [Helpers](https://laravel.com/docs/8.x/helpers?ref=connortumbleson.com) and [The PHP League/CSV ](https://csv.thephpleague.com/?ref=connortumbleson.com)package
At this point these words were signed with the Cicada GPG key and sent in an email to Cicada. The public/private key exchange was almost complete with the participant uploading their own to MIT Key Servers for Cicada to retrieve. Unlucky for the participant messages above - we won't find a key for the email. Presumably because this participant shared their message - not solve it. At least we got the chance to solve it 10 years later.
With that the puzzle went highly unverified. Those who got past challenge after challenge grouped together with like minded individuals to solve whatever came next. This ended with a username/password onion where it was presumed all those who solved it joined together for something that remains unknown.
*Note - All signed messages were found via Pastebin search and crossed checked against Cicada known key to ensure validity.*
---
- [Puzzle 1](https://connortumbleson.com/2019/09/30/the-cicada-3301-mystery/) (2012)
- Puzzle 1 - 2nd Chance (2012) - You are here
- [Puzzle 2](https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/) (2013)
- [Puzzle 3 - Part 1](https://connortumbleson.com/2021/02/15/the-cicada-3301-mystery-puzzle-3-part1/) (2014)
- [Puzzle 3 - Part 2](https://connortumbleson.com/2024/02/05/the-cicada-3301-mystery-puzzle-3-solve-part-2/) (2014)
- [Puzzle 3 - Part 3](https://connortumbleson.com/2024/06/03/the-cicada-3301-mystery-puzzle-3-solve-part-3/) (2014)
- [Puzzle 3 - Part 4](https://connortumbleson.com/2024/12/23/the-cicada-3301-mystery-puzzle-3-solve-part-4/) (2014)
### Delivery Only - Uber Eats
URL: https://connortumbleson.com/2021/04/05/delivery-only-uber-eats/
Last updated: 2025-02-04T11:43:12.000Z
Photo by [Kai Pilger](https://unsplash.com/@kaip?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I've been working remote for now a year and counting due to the global pandemic and one thing that has increased is my amount of orders to delivery services like Uber Eats.
I've been noticing something lately that has required a blog post which is the idea of these virtual "delivery-only" restaurants. Uber Eats has an entire [page](https://restaurants.ubereats.com/us/en/innovations/virtual-restaurants/?ref=connortumbleson.com) dedicated to this idea which gives some solid good reasons for attempting to try additional restaurant concepts from the same brick and mortar existing store.
Though, I want to talk about the experience good and bad from my perspective. I hinted at this story before in [another blog](https://connortumbleson.com/2020/12/07/the-business-evolution/), but this has happened a few times so I want to bring it up again.
[Tampa - House of Burgers](https://www.ubereats.com/tampa/food-delivery/house-of-burgers?ref=connortumbleson.com)
I'm browsing Uber Eats and I see a new place called "[House of Burgers](https://www.ubereats.com/tampa/food-delivery/house-of-burgers/?ref=connortumbleson.com)" and what I noticed is the address is eerily close to an area I drive by quite frequently. So strange that I didn't remember seeing such a place. So I pop open Google Maps for that address to see whats up.
The address says "Shamrock's Ale House"
This matches my memory of what I recognize at this location. Just a regular ole Irish Pub feeling sports bar - not my favorite place by any means. Though, if I wanted to watch a match with some beer and unhealthy food I could be tempted to drop by.
Though ordering this food for delivery is not really a preferred solution. As I look at the menu of *House of Burgers* I noticed that it matched pretty much 1-1 with the specials at Shamrock's Ale House.
So from my perspective it looks like this is a venture for additional types of burgers, but still sell a large subset of what the brick and mortar place sells as well. It looks like based on metadata that menu was generated in May of 2020 so I can't blame them - it was a rough time for many and continues to be.
For my tiny pessimistic approach though, I see a new place and have to research who is fulfilling it because I don't really want to order a burger for delivery from this place regardless which marketing name is fulfilling the order.
[https://mrbeastburger.com/](https://mrbeastburger.com/?ref=connortumbleson.com)
So I stopped paying attention as much until I heard about this Mr Beast Burger which was unique in the sense that I couldn't find a common brick and mortar behind the 300 locations launched in the United States.
So some very popular YouTuber (MrBeast) paired with enough places (or higher management company) to launch this digital experiment worldwide. Is this company providing the food to all locations? Is each location using what it has? Will a MrBeast burger in California look the same (ingredient wise) as one in Florida?
I have no idea to the answers of these questions, but it was interesting to think about when I really started researching. This is a big new phase in restaurant brands so I started finding all the new iterations of them from known national locations.
| Brick/Mortar | Delivery-Only |
| --------------- | ------------------------- |
| Applebee's | Cosmic Wings |
| Denny's | The Burger Den |
| Denny's | The Meltdown |
| Chuck E. Cheese | Pasqually's Pizza & Wings |
| Chili's | It's Just Wings |
| TGI Fridays | Conviction Chicken |
| Carrabba's | Tender Shack |
So for the sake of this post to evolve from just research. I looked at the list above and went down Uber Eats until I saw one. For me - the first one I saw was Cosmic Wings fulfilled via Applebee's.
So I ordered some wings with a strawberry lemonade so I could mix in some alcohol for this journey. This food, without any doubt, had nothing special about it - it was the quality and packing and expectation I would personally expect from Applebee's which wasn't great.
Was it fulfilled by the same crew that is working the orders for Applebees? My research needed to be perfect despite my body hating me. So I ordered wings again the next day - this time from Applebee's itself, not Cosmic Wings. My research was complete - I could have probably just predicted this, but it was the same quality, packing and more. The only difference was the sticker on my bag.
Thankfully today - the world is a bit easier to run to the grocery store. My moving is complete and I can rely on my own cooking vs the world of delivery-only restaurants. I applaud these places for adapting to the changing world embracing technology and social media to re-market themselves, but at times I feel like its done solely to leave the stigma with their brick & mortar name and that part I'm not a fan of.
Since imagine all the mom and pop shops that ran to Uber Eats for delivery now not only have to compete with the large chains, but as well as the chains spamming their same restaurant (sometimes same menu) under a different brand name. That definitely does not sit right with me.
Who knows what delivery-only places will arrive in a few month's time.
### SSL Tracking Links on Mailgun with Ghost Blog
URL: https://connortumbleson.com/2021/03/29/ssl-tracking-links-on-mailgun-with-ghost-blog/
Last updated: 2025-02-04T11:43:12.000Z
Photo by [Solen Feyissa](https://unsplash.com/@solenfeyissa?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Last week I blogged about [Ghost v4](https://connortumbleson.com/2021/03/22/hello-ghost-v4/) and the upgrade to it. It has put front and center the notion of independent professional publishing. With that release came the ability to send email subscriptions of blog posts for those subscribed.
Behind the scenes it uses Mailgun to add some enhanced features like:
- Approximate location of subscriber
- Detect whether email was opened
- Detect whether email was interacted with (clicked on)
How does Mailgun even do this? Lets stop with a quick lesson on email tracking.
**1px images**
```html
```
The first trick is embedding a specific query string image into the email. It will probably be a 1 pixel by 1 pixel transparent image and you won't even know its there. Your email browser behind the scene will download that image as instructed.
> If you are using [Gmail](https://support.google.com/a/answer/3299041?hl=en&ref=connortumbleson.com) they actually pre-download images from their servers and show them to you. This has the benefit of preventing the email from knowing if you interacted with the email as they only see Google viewing the image.
So if you pop open the email on your desktop and your computer reaches out to Mailgun to download that tiny image. Mailgun sees your web request and that specific image being downloaded. It can then obtain quite a bit of information.
```json
{
"geolocation": {
"city": "Tampa",
"region": "FL",
"country": "US"
},
"tags": [
"bulk-email"
],
"timestamp": 1616411499.964054,
"log-level": "info",
"event": "opened",
"campaigns": [],
"user-variables": {
"email-id": "[redacted]"
},
"recipient-domain": "gmail.com",
"ip": "47.xxx.xxx.xxx",
"client-info": {
"client-name": "Thunderbird",
"client-type": "email client",
"user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.12.0",
"device-type": "desktop",
"client-os": "Linux"
},
"message": {
"headers": {
"message-id": "20210322023002.1.2A977408ED7C81D8@mg.connortumbleson.com"
}
},
"recipient": "[redacted]@gmail.com",
"id": "[redacted]"
}
```
So you can see it knows my Thunderbird client downloaded this image and approximated the location to Tampa Florida. So Ghost can easily API this information out to see where your subscribers approximate location is.
---
So now how does Ghost know if you clicked on a link in the email? Well that is pretty easy in the scheme of things. Mailgun simply rewrites all links in the email to Mailgun specific links.
So if I had a link to my blog, Mailgun would translate it to:
```
http://email.mg.connortumbleson.com/c/{randomchars}
```
This subdomain is a `CNAME` to `mailgun.org` as instructed by Mailgun during sign up. So when that request hits Mailgun, much like the image trick, the string of characters at the end of URL makes perfect sense to Mailgun to preform a redirect.
```html
Redirecting...
Redirecting...
You should be redirected automatically to target URL: https://connortumbleson.com. If not click the link.
```
If clicked that link that will redirect back to my intended location probably without myself even noticing, but that middle jump resulted in Mailgun being able to track that click.
```json
{
"geolocation": {
"city": "Tampa",
"region": "FL",
"country": "US"
},
"tags": [
"bulk-email"
],
"url": "https://connortumbleson.com",
"timestamp": 1616582042.542381,
"log-level": "info",
"event": "clicked",
"campaigns": [],
"user-variables": {},
"recipient-domain": "gmail.com",
"ip": "47.xxx.xxx.xxx",
"client-info": {
"client-name": "cURL",
"client-type": "library",
"user-agent": "curl/7.47.0",
"device-type": "unknown",
"client-os": "unknown"
},
"message": {
"headers": {
"message-id": "[redacted]@mg.connortumbleson.com"
}
},
"recipient": "[redacted]@gmail.com",
"id": "[redacted]"
}
```
So boom - Ghost blog can see who opens and clicks on their emails which leads to all the cool graphics/images they show in this [help post](https://ghost.org/help/email-newsletters/?ref=connortumbleson.com).
However, when I enabled this originally. This is what subscribers saw when they clicked on a link.
This wasn't good as subscribers getting an invalid link hurts the experience so I disabled the open/link tracking while I investigated.
It didn't take long to realize that [HSTS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security?ref=connortumbleson.com) was the culprit. I saw this header in the response while debugging.
```
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
```
What this means to browsers is my domain should never be accessible in a non-secure manner as well as any subdomain I have and this should last 2 years at a minimum. This is a protection against downgrade attacks and just ensuring that a secure transport mechanism is always used.
So `email.mg.connortumbleson.com` is a `CNAME` for `mailgun.org`, which is just an alias for a domain. This means that the SSL would have to be setup by Mailgun and I don't think Mailgun is in the market to setup SSL certifications for their clients.
Mailgun has a [help guide](https://help.mailgun.com/hc/en-us/articles/360011566033-How-to-Enable-HTTPS-Tracking-Links?ref=connortumbleson.com) for this and instructs you to use Cloudflare to set this up. However, we don't use Cloudflare here and not going to use it for one subdomain. So lets do this ourselves.
---
First off, lets remove the `CNAME` we previously had to Mailgun. We can't mix these type of records as we will be pointing our own `A` record to our server.
We know we basically have to setup that domain to proxy requests to Mailgun, so the request can remain secure to the end user, but we are communicating as the server behind the scenes insecurely to Mailgun.
So we will setup a simple nginx block for this.
```conf
server {
listen 80;
server_name email.mg.connortumbleson.com;
location ^~ /.well-known/acme-challenge/ {
allow all;
}
location / {
resolver 1.1.1.1 8.8.8.8 valid=300s;
set $mailgun "http://mailgun.org";
proxy_pass $mailgun;
port_in_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
```
We are basically doing two things here. We are only setting up an insecure block first as we will leverage LetsEncrypt for securing it. We want to exclude the verification block that LetsEncrypt uses so we don't redirect the verification calls to Mailgun.
Now the proxy to Mailgun required a bit of a trick. The IP for Mailgun seemed to change quite heavily and I didn't know if there was a constant IP to hit. So we will query for the IP using a 5 minute cache from the popular DNS resolver of [Google](https://developers.google.com/speed/public-dns/docs/using?ref=connortumbleson.com) and [Cloudflare](https://1.1.1.1/dns/?ref=connortumbleson.com).
Now anytime we request a URL to `email.mg.connortumbleson.com` that will be passed behind the scenes to `mailgun.org`, much like the previous `CNAME` did. So now we just have to secure this domain with a certificate.
```
root@dune:/etc/nginx# certbot -d email.mg.connortumbleson.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for email.mg.connortumbleson.com
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/email.mg.connortumbleson.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled
https://email.mg.connortumbleson.com
```
This server already had certbot configured for renewals and crons so this is now supported. All we had left to do was wait for a few hours for all these DNS changes to propagate.
So now we are in business - a secure tracking link through Mailgun ourselves. Just one support ticket to Mailgun to enable SSL for us and we are done.
Technically, we don't need to ask Mailgun since the HSTS automatically upgrades non-secure to SSL, but I don't want to rely on that.
```
➜ curl https://email.mg.connortumbleson.com/c/[redacted] -i
HTTP/1.1 302 FOUND
```
### Hello Ghost v4
URL: https://connortumbleson.com/2021/03/22/hello-ghost-v4/
Last updated: 2025-02-04T11:43:12.000Z
[Credit - Ghost v4 Changelog](https://ghost.org/changelog/4/?ref=connortumbleson.com)
When I saw Ghost v4 released I knew there was a few features I was excited for and a few that I was not - so lets jump into it. Ghost has been taking on the mantle of becoming the focal point for independent publishing and we saw that with the members module that launched in v3.
This once toggled member feature is just a core feature now. This for someone like myself with a personal blog was a pretty big shock since I don't intend to ever charge for my little hobby blog. This means that despite myself keeping these features intentionally disabled in v3 - they are now enabled in v4 with no option to turn off.
My Admin Panel - Ghost - v4.1.0
So above you see my dashboard now when I sign in. I get to look at a money making graph that will always say $0\. I have to look at email/members that will also remain near zero until I decide to offer a subscription (which by the time this post goes live - may already be here).
There are marketing widgets given to me describing how to help my membership despite not using it. So I'm not too excited about this, but I pay $0 for Ghost and only myself sees this - so I can't be too angry. I'm no longer a target audience for Ghost and that is fine.
My theme which used to have if statements around member components now had login/register/subscribe buttons littered throughout. Thankfully, I could open those Handlebar files and remove that logic. While once again not happy that I was forced to edit my own theme to remove logic that a previous toggle setting once did - I will survive.
There are a few other places this feature permeated as well that I will just have to ignore:
- Post blocks for paid/free members only while writing a post
- Publish menu asking which type of members should receive it
- A forced `portal.min.js` ([source](https://unpkg.com/@tryghost/portal@1.0.2/umd/portal.min.js?ref=connortumbleson.com)) that loads on pages for a feature I disabled
Now one thing that is currently fresh in my mind with this upgrade is the speed hit I took after the upgrade. I've been busy grabbing profiles to help [isolate](https://github.com/TryGhost/Ghost/issues/12791?ref=connortumbleson.com#issuecomment-802764190) this stuff instead of just complaining with no proof, but this release so far isn't my favorite. As of writing this post, the speed issue was confirmed and triaged to be fixed in the next release so never mind on that.
---
Though, I don't want to rant about this release for this entire post - there are a couple of features in this major milestone that I'm very much of a fan of. So first up is the new preview mode.
Previewing this post
So this preview screen allows you to:
- Preview the page (Mobile and Desktop)
- Preview the social impact (Twitter, Facebook)
- Preview the email (if post is to be emailed)
- Send the email itself to test
- Share a unique URL to the draft
This is pretty nifty and helpful for making sure a post is good to go before scheduling it or publishing to the world. The tab for previewing the social snippets has a slightly strange UI, that I'm sure is a bug - otherwise this feature is amazing.
Next up is probably my favorite enhancement of this release is responsive lazy-loaded images. If we look back at last week's post - [Halo Depot](https://connortumbleson.com/2021/03/15/project-halodepot/) we can take a snippet of 1 of the images.
```html
```
What is important to see here is both the `srcset` and `loading="lazy"` changes.
[https://caniuse.com/loading-lazy-attr](https://caniuse.com/loading-lazy-attr?ref=connortumbleson.com)
The lazy attribute is relative new, with support only really hitting Firefox and Chrome. This attribute helps instruct the browser to only load images as you get closer to them in the page. So if you were to view my [Panda Love post](https://connortumbleson.com/2021/02/22/pandalove-clan-site/) with nearly 60 images - assuming you have a supported browser you'll only download the images as you get close to them.
This feature is futuristic and being supported in more and more ways every month. For Ghost to adapt this change quickly is part of the reason I'm always eager to take the next release.
The other snippet of HTML above includes a lot of `srcset` attributes which are basically a set of sources (images) that have hints for which browser should use that image. So a large monitor can grab a large image with maybe higher quality, while the mobile device can grab a smaller image. This is great because it just leads to a faster more optimized load, which can led to better SEO.
Now this doesn't mean I have to carefully upload different versions of an image every time I want to post one. Ghost is smart enough to take the original I upload and optimize, resize and cut based on internal parameters or based on logic that my theme requests.
With that - this blog is now upgraded to v4 and the [full change log](https://ghost.org/changelog/4/?ref=connortumbleson.com) of features is linked. Next up, I'm eyeing a 1.7 upgrade for my comment system.
### Project: Halo Depot
URL: https://connortumbleson.com/2021/03/15/project-halodepot/
Last updated: 2025-02-04T11:43:13.000Z
After blogging about a Halo 2 Mappack I made ([Phantom Mappack](https://connortumbleson.com/2016/05/06/phantom-mappack-project/)) and then my more in depth blogs about the decade old [patchers](https://connortumbleson.com/2020/04/12/halo-2-patch-format-types/) & [map editors](https://connortumbleson.com/2021/01/11/halo-2-map-editors/) I wanted to archive the actual mods of the past.
This idea was created in the form of Halo Depot ([GitHub](https://github.com/iBotPeaches/HaloDepot?ref=connortumbleson.com)) - a site that could hold all the patches off the past with one key advantage - it wouldn't suck.
My greatest gripe with all the other sites that remained were full of either forced sign ups, ads before download, forced 30s delays or even just flat out not working links. So the goal was Halo Depot was to be very easy. We'd have a minimal site with no accounts needed and a very easy upload system requiring only the patch of the mod.
I've blogged about the types of patch files, but what is important to note again is that a specific type of Halo 2 patch - Serenity has the ability to directly embed the author, description and image of the mod.
MrMurder's Nightwinder 2 in Serenity v3.3
So if a mod took the extra time and produced an enhanced patch file it could be used to patch the clean map itself (to produce the map) as well as patching the main menu to add the mod to the list.
Now obviously, Halo Depot isn't interested in patching main menu files, but it can read that same data to automatically produce a mod page for that patch file. It isn't much, but it has the benefit of being entirely pain free. Just upload the patch and done!
MrMurder's Nightwinder 2 in Halo Depot
To make the page a bit more populated, I added some helpful information like name of the original map file, type of patch and even the platform intended for the patch. This would be for the future expansion to other Halo games and platforms.
I spent some time ensuring all the proper structure data tags were properly filled. This resulted in all the weird formats that all social sites depended on.
```html
Sunnision by xheadshotmastax
```
So I was pretty happy - it seemed my first few tests worked well, but then I quickly learned that only about 7% of the Halo 2 mods I had archived were even viable.
Most weren't even `.serenity` patches instead in `.sppf` or `.ppf` and the few remaining `.serenity` patches did not have the required properties for me - author, mod name, description and image.
So I decided to expand Halo Depot to a multi-platform tool known as Assembly. As Halo versions continued being released into the wild it became obvious that a cross-game and platform tool was needed. The most known and popular being [Assembly](https://github.com/XboxChaos/Assembly/?ref=connortumbleson.com).
This patcher learned from Serenity and offered the ability to directly embed very helpful information into the patch so it was off to adding support for it.
I hit two things that ended up just killing my drive to work on this project. The first being just the size of the patch files in later games. Halo 2 patches usually capped out around \~70mb at the absolute max - most ranged from kilobytes to a few megs.
Most of my test patches for various Halo games in Assembly ranged from 110mb to 240mb - it was insane. Quickly I realized my bills of uploading content to AWS for transfer and hosting was going to be a bit more than I wanted to pay for a site that would earn no revenue.
However, I wanted to continue to test how good my plugin system could support another patch type. I kept getting stuck reading the patch format with constant out of bounds errors while trying to read the mod image.
```php
// Screenshot
$length = $this->reader->readUInt32();
if ($length > 0) {
$imageData = $this->reader->readBytes($length);
}
```
[AssemblyPatch.php](https://github.com/iBotPeaches/HaloDepot/blob/master/app/Services/Patch/Assembly/AssemblyPatch.php?ref=connortumbleson.com#L67) \- HaloDepot
I couldn't figure out what was wrong. I was stepping through the bytes block by block in a hex editor and every looked fine.
So I thought I would look back at the code that generated this in Assembly.
```csharp
// Write screenshot
if (patch.Screenshot != null)
{
writer.WriteInt32(patch.Screenshot.Length);
writer.WriteBlock(patch.Screenshot);
}
else
{
writer.WriteInt32(0);
}
```
[AssemblyPatchWriter.cs](https://github.com/XboxChaos/Assembly/blob/dev/src/Blamite/Patching/AssemblyPatchWriter.cs?ref=connortumbleson.com#L51) \- Assembly
So I realized that I used an unsigned int32 read, while the software was writing signed 32 int for the block size. This didn't make much sense since a file size can't be negative, but either way - it still didn't work.
Under the hood, Halo Depot used a php package for reading/writing binary files - called [php-binary-reader](https://github.com/mdurrant/php-binary-reader?ref=connortumbleson.com). Funny enough there was a bug report - "*[ReadInt32 with not aligned byte](https://github.com/mdurrant/php-binary-reader/issues/10?ref=connortumbleson.com)*" which seemed to explain my issues.
This package was pretty abandoned - not having any work since 2017\. It worked so I wasn't complaining, but working on the project was another story. Coverage and tests suffered with my updated versions of PHP so I set off to update it to the latest and greatest of everything.
This took far longer than I thought since I was taking the chance to really learn pack/unpack functions in PHP which have remained semi unchanged since Perl. Once everything was [updated](https://github.com/iBotPeaches/php-binary-reader?ref=connortumbleson.com) with GitHub Actions and 100% coverage and PHP7.4 features I realized I was an idiot. I never fixed the reason I forked the package in the first place.
At this point with the disappointment that most legacy Halo 2 mods were not compatible, recent Halo games having insane patch sizes and a low level bug in my binary reader - I gave up.
PHP isn't the language for binary reading and deciding to storing large assets on AWS where I get billed for transfer and storage vs just a flat $5/month Linode wasn't smart either. So with that, here are some screenshots of the project.
### Project: LeafApp
URL: https://connortumbleson.com/2021/03/08/project-leafapp/
Last updated: 2025-02-04T11:43:13.000Z
For the 3rd week in a row I'm blogging about a project I created and let slowly die in the wind.
This was Leafapp which is the only domain that remains in my control after owning:
- leafapp.co
- trunkapp.co
- treeapp.co
- stumpapp.co
- twigapp.co
- branchapp.co
Funny enough, the domains were either gifted to me or purchased myself at the $12/year mark. Little did I know that renewals could be different than the purchase price so I found myself with a $30/renewal per domain per year. That instantly changed my dream of having a different Halo modding site on each domain and I let them go one by one. A friend took over BranchApp and I kept LeafApp and let the others expire.
Though, we have to turn the clock back to learn what Leaf really started at. It began in January in 2013 based on Halo 4 and Halo Waypoint. Scraping an API that the website used - a friend (Xerax) discovered you could just emulate that flow and login programmatically to extract the token needed. So he built Auntiedot which provided the credentials Leaf used to authenticate against Halo Waypoint to pull stats.
[Leaf ](https://github.com/TheTree/Leaf/tree/master?ref=connortumbleson.com)\- Early 2014
Looking back at this image, Leaf looked pretty cool compared to the Leaf of 2016, but the code was horrific. The codebase was a CodeIgniter install with MongoDB as the database. I quickly learned that MongoDB was not a tokenized database ~~yet~~ ([ever](https://jira.mongodb.org/browse/SERVER-863?ref=connortumbleson.com)) and I was storing very long key names of many many records.
My $2.95/month oversold shared hosting did not like that and I found myself in a bit of pickle with constant resource abuse messages. So I thought I could cleanup the database with its 200k\~ records with manual tokenization.
```php
/**
* Our enum of Layout for the Halo 4 profile. Due to the use of MongoDB, it replicates the category names
* in every file of the collection. Thus you can store
*
* array(
* 'totalKills' => 123123
* )';
*
* OR
*
* array(
* 1 => 123123
* )';
*
* (in every file of the collection). So each of the above arrays times 200,000.
*
* The ID then corresponds to this enum. Saves a few bytes here and there which adds up.
*
*/
```
[July 22, 2013](https://github.com/TheTree/Leaf/commit/333b74229410c10d40970e0d5df5b5d3b2598eca?ref=connortumbleson.com)
This resulted in a weird database where all the keys were numerics only readable from my [enum file](https://github.com/TheTree/Leaf/blob/master/application/libraries/structs/h4/H4.php?ref=connortumbleson.com). This meant my mess of databases was MySQL, MongoDB and even redis for a cache. This was a disaster and the project while looked pretty slick was horrifically buggy.
So I shut it down and decided to rewrite it in Laravel. My next biggest mistake was trying to use the abomination that was the database of the previous Leaf in the new codebase.
This led to models in Laravel that looked like:
```php
protected $guarded = ['0x00', '0x15', '0x16', '0x18', '0x2a', '0x3d', '0x3e', '0x3f', '0x40', '0x41'];
public function get0x1dAttribute($value)
{
return self::unpack_msg($value);
}
```
So I gave up and put the site on hold. Competitors were far more succesful and I lost the chance to compete, but I very much enjoyed using Laravel instead of CodeIgniter. So I decided to resume Leaf with Halo 5.
---
When Halo 5 launched the idea of true competition was born - leaderboards with seasons to track placement was the perfect idea for Leaf to track. So I built a leaderboard that requested the top 250 gamers for every playlist and tracked it. Additionally tracking the movement up/down the leaderboard to provide visual indicators of the progress of an agent.
This was a new Laravel project on Laravel 5.2 - the UI was more professional and designed in a far more standard way then previous iterations. I additionally spent a lot of time on attempts at SEO techniques with automatic sitemap generation and proper meta tags. All in all, Leaf never really attracted any viewers. It worked for years without a commit and one day stopped syncing data - I never dug into why.
Like [ReachStuff ](https://connortumbleson.com/2021/03/01/project-reachstats/)and [PandaLove ](https://connortumbleson.com/2021/02/22/pandalove-clan-site/)\- my focus went elsewhere and this project just stopped getting updates and was abandoned. Looking back at the [code ](https://github.com/iBotPeaches/Leafapp?ref=connortumbleson.com)\- it's also very embarrassing.
A little tidbit - I attempted to launch [Trunkapp ](https://github.com/TheTree/Trunk?ref=connortumbleson.com)doing Halo stats as well in Revel (a go framework) and was massively in over my head so gave it up.
When another Halo game comes around - who knows maybe Leaf will make another appearance on a new written codebase.
### Project: Reach Stats
URL: https://connortumbleson.com/2021/03/01/project-reachstats/
Last updated: 2025-02-04T11:43:13.000Z
Last week I blogged about [Panda Love](https://connortumbleson.com/2021/02/22/pandalove-clan-site/), a project that was still online that I started years and years ago. This time I wanted to blog about another project that was unfortunately shutdown a decade ago. So it was much more difficult to collect assets for this blog.
ReachStats was a plugin I built for the Invision Power Board (IPB) forum system for a site I launched called "*reachstuff.com*". This was my first attempt at using a framework (albeit a paid forum) to help launch a product.
This code looking back at it on [GitHub](https://github.com/iBotPeaches/ReachStats?ref=connortumbleson.com) is god-awful, but everyone starts somewhere and I was teaching myself how to program PHP.
This was a project I started after seeing the success of "*halo2.junk.ws*". A site that did the same thing for Halo 2 in 2004-2006\. With a peek of the archive machine we can find the homepage and some snippet of signatures.
So then below I found a snippet of signature examples from the Halo 2 era. These are what I drew my inspiration from for my iteration 7 years later.
What I think I have to mention for those unaware is that these were dynamic images. Basically every x hours the image was regenerated with the stats, level and emblem.
So you could put these into your signature on forums and just hotlink to their images and have it update automatically. Now depending on how many users you have - this turns out to be quite a bandwidth sink. You aren't sending an image and having browsers cache it - you are basically remaking images daily so browsers have to continually redownload the newly updated image.
Lets stop there though talking about halo2.junk.ws - that was the inspiration for Reach Stats.
---
Since Reach Stats was built into the IPB framework, it hooked into the software at multiple points:
- \[Admin\] Reach API Key entry
- \[Admin\] Caching Settings
- \[User\] Adding Gamertag to system
- \[User\] Purchase faster upgrades
- \[User\] Preview all signature types
- \[User\] Settings for specific signatures
- \[User\] Leaderboards for stats collected
I used [gd](https://www.php.net/manual/en/book.image.php?ref=connortumbleson.com) behind the scenes for image creation. It helped really push me to understand that making a wrapper/library for some PHP modules would be very handy. Nowadays when I'm looking to do image manipulation in PHP - its straight to [Intervention](http://image.intervention.io/?ref=connortumbleson.com) I go.
I quickly realized that even building templates for these images was too difficult for me. Thankfully others in the scene lent a hand and provided many base templates that I could wire up with stats.
Base templates for signature type #3, #4 and #5
So with all the colorful base plates, I could ask members of ReachStuff to pick their preferred color.
These nameplates were pretty cool and entirely automated. They would combine a few things together to form an image.
- Selected background image color
- Emblem from game
- Highest rank from game
- Callsign
- Gamertag
- Watermark (if free)
The playtime image was a fan favorite to show off how much you played video games.
While the other signatures were just combinations of stats, design and even some included medal counts for selected medal types.
I quickly realized how important it was to have backups, which back then were files named like ".old1" and ".final2". Thankfully I learned about revision control by the next project, because the amount of times I broke this service was embarrassing due to stupid mistakes.
This also became my first project to register a specific Twitter account and tweet from it about all the downtime, releases and more.
[Grammar and all](https://twitter.com/ReachStuff/status/115874883107438593?ref=connortumbleson.com) \- 2011
Not only did I tweet about the shutdown, I built a pretty horrific design of a shutdown message.
From a personal perspective - this was my first project that I spat out money for a domain, purchased some hosting and launched a mini marketing campaign (Twitter). I failed miserably in the grand scheme of things only tracking 264 accounts before shutting down.
I've debated in my head taking another stab at this when Halo Infinite drops, but I struggle to figure out the use case for it anymore. Forums are dated, some forums even re-upload your assets anyway so the dynamic images couldn't update. Though it might be fun with all the enhancements to PHP and image manipulation to see what is feasible.
### Project: Panda Love Clan Site
URL: https://connortumbleson.com/2021/02/22/pandalove-clan-site/
Last updated: 2025-02-04T11:43:14.000Z
Before the test of time takes another project I wanted to blog in depth about an [open source project](https://github.com/iBotPeaches/PandaLove?ref=connortumbleson.com) that I maintained for my clan. It started as a website for us to record Destiny 1 games from raids to multiplayer combat.
It quickly grew from that for each integration we needed. We added support for:
- Destiny 1
- Destiny 2
- Halo 5
- Overwatch
- Xbox
- Calendar
- Google Hangouts
So I've already blogged quite in depth about the [Google Hangouts / Xbox](https://connortumbleson.com/2015/10/29/fun-with-hangout-bots/) integration so I'm going to skip that one. However, the rest of this blog will be a deep dive into the functionality of the other modules.
---
**Destiny** **1**
iBot Profile Page (Destiny 1 - Titan)
Panda Love began building profiles for each of the characters that clan members had. It packed some basic stats that the API provided for gear, light level and current gear stats. This page was just a pretty interface as the only number we were truly interested in was light level. This was exposed through the API that our Google Hangouts bot consumed.
Destiny 1 Roster (Panda Love)
Light level generally just referred to how strong or weak you were - so building a roster for an activity generally needed high light individuals. This allowed us to check our entire clan via the chat, as needed, when an event was being organized.
Though after a game was over. We wanted to start logging those activities to share with other clan members and/or just brag about it. So the game history module was invented.
Panda Love - Destiny 1 Game History
This page could log many things:
- PVP Activities
- Raid Tuesdays (2-3 raids back to back)
- Trials of Osiris (5-9 games back to back)
- Flawless Raids (0 deaths from all)
- Prison of Elders (round based challenges)
- Raids (1 off raids)
All of these activities acted a bit differently when viewed. For example, the important aspect of Raid Tuesday is to see how every clan member preformed overall. While a singular added Raid was probably because of some unique event (first completion, 0 deaths, etc).
On the player vs player side of things - it was always related to amount of deaths and just pure speed. Winning 7 games in under 45 minutes was just pure destruction. Collecting successful wins in Trials became an addition which I [blogged](https://connortumbleson.com/2018/09/16/ending-an-addiction/) about [many times](https://connortumbleson.com/2019/10/21/passion-without/) before.
Tabs were leveraged to organize and round or multi-game based activity. So a snippet of all modes below.
Games could be ingested into the system with a basic command to our bot, such as `/bot addgame d1 raid {gameId}`. With that, that was our Destiny 1 module.
---
**Destiny 2**
With Destiny 1 having such large development - our clan was excited for the prospects of Destiny 2 and more powerful APIs.
However, Destiny 2 at launch was just horrible. Our pinnacle game mode (Trials) was no longer 3v3 and everything that made it addicting was gone. It became 4v4 with respawn tokens and 15 second timer. Everything that made Destiny 1 clutch with abilities, 3 vs 1, and ammo management was gone.
The pinnacle raids that used to drop sweet pieces of gear didn't drop anything this time. Resulting in pure anger when you got tokens. You had to accumulate those and turn them into a vendor. It surprised me how a studio that built such an amazing game ended up destroying it.
I'm not alone in this opinion. Enough of the entire community complained and player stats dropped that the replacement game mode was removed indefinitely. It took a year for the replacement to be ready (Which was just the Destiny 1 iteration).
So we stopped playing it. A sad day for our group. We've attempted to return to the game with each major DLC, but that burning flame for the Destiny franchise is gone. Destiny 2 ruined it for us.
---
**Halo 5**
Halo was a game to our clan that was always there. We grew up playing Halo 1 and 2, played an enormous amount of Halo 3 and then kinda went quiet. Halo 3: ODST had no multiplayer and Halo Reach introduced bloom which killed the series for me.
The studios changed after Reach - Bungie would go on to build the Destiny games above. 343 Studios took over Halo producing Halo 4 which was just a generic Halo game and this one - Halo 5 Guardians.
iBot Profile Page (Halo 5)
The game didn't hold us like Halo 2 or 3, but it was a Halo game that was enjoyable to play. What was interesting about Halo 5 is the hugely documented and powerful API it launched with. This had so many endpoints that 343 launched an API competition for folks to build the best project from the available data.
So I begun just overhauling our pages adding detailed information of all types of analytics.
iBot Detailed Profile Pages (Halo 5 Arena)
These modules could track historic seasons to see final placements and overall stats. It could list the current seasons with the same graphics used in games to track process up the ranks (or down in my case).
A few clever pages that just showed all weapons and medals obtained. Though I wanted to go further and build a post game carnage report system much like Destiny 1, but for all the features that Halo 5 offered.
Panda Love - Halo 5 Breakout Match
This resulted in a page that provided quick facts of a bunch of random stats. Using all the data available in the API we could determine interesting analytics like most accurate shot. The other tabs would allow a deeper dive into team based stats or even visibility into personal analytics for that match.
Though, I'm sure you've noticed it - what was the Enhanced Game Look button in bottom left? It was an attempt at visualizing the most amount of game data possible. Leveraging each timestamp of every action throughout the game.
This was trying to reach the pinnacle of features - a top down view of a map with lines drawn on top correlating to the kill location and death location of everything. I [blogged](https://connortumbleson.com/2020/02/24/turning-a-hobby-into-a-job/) in detail about that journey of why that feature never launched on this blog in the past.
Match Events - Breakout - Halo 5
These features were pretty nifty. The graph would plot kill times over time elapsed to gauge how the game went over time. The round module would just track each round to see who died first and last to paint a picture of the MVP of each round.
Finally, the timeline view was an enormous list of every single event in the game that could be filtered down to any combination of players. From a weapon being dropped or picked up or a kill. I'd extract whatever information was available (like kill distance) during each event. A tiny snapshot of the timeline does not give this feature justice, so I did a full [screenshot](https://connortumbleson.com/uploads/2021/02/h5%5Ftimeline.png) (2.5mb).
Even cooler was the rare "multi-team" event that would push 4 teams against themselves and Panda Love enjoyed the variety of colors that this pushed into the UI.
Halo 5 - Match Overview (Multi-Team)
Unfortunately the addiction that Halo held did not hold long on Halo 5\. The game quickly became god tier players vs blind players and was not very fun. Stacked teams ran train and a bunch of goobers playing while drinking would just get smashed. So the development slowed and eventually stopped.
Halo 5 - Panda Love
Our stats showed with not a single clan member breaking 1000 games played and only 1 clan member breaking through the level 100 mark.
We thought it would be quite clever to automatically map our KD/KDA nightly into an updating graph. For the first few months this was pretty sweet to see who was improving vs sucking, but then we stopped playing and the feature was turned off after it quickly just turned into static lines.
---
**Overwatch**
A few of our clan wanted to switch to Overwatch as it looked like a popular multiplayer game to play. However, it had no API so only sites that scraped the Overwatch website could extract information. It had a big problem that the instant a season ended and you played a game on the new season - your stats of the previous season disappeared.
iBot Profile (Overwatch)
Panda Love aimed to fix this by just storing all information locally and correlating the stat time pull with the active season. The test of time resulted in these seasons not being updated properly and data being lost so it became useless rather quickly.
Not to mention Blizzard added private stats which effectively destroyed the only avenue for stat collection. However, from the data we had during the prime-time (Season 5-11) resulted in some cool character specific leaderboards.
The stats blizzard returned were often strange and not character specific, but were interesting nonetheless. The "per 10 minutes" aspect was the best stat as you get easily get 100% accuracy but only 3 minutes playtime.
This resulted in some cool clan specific stats to see who excelled at certain heroes. You could pick any character and any stat category and get a season breakdown of clan members on that hero. If Blizzard had a real API and we weren't dependent on the wonderful work of 3rd parties scraping the website - this could have been quite the project.
I switched to PC gaming and introducing PC alongside Xbox made it very difficult for Panda Love to adapt. It was hard-coded for Xbox support and now it had to balance PC and Xbox which led to very unstable software.
---
**Fortnite**
Fortnite - Roster List
Our clan also jumped onboard the worldwide phenomenon that was Fortnite. Our group could play squads (4) or duos (2) or even solo play and all would be logged by an API that Fortnite exposed through the Epic launcher.
This would really expose the limitations of Panda Love and a dated code base. Fortnite was not only cross platform, but you could use the same account in multiple places. So the unique qualifiers that Panda Love worked from suffered badly in trying to merge those together. I was known as `iBot` on Xbox Live, but `iBotPeaches` on Epic.
The profile pages for Fortnite had nothing special, just showing the collection of match count vs wins. This was hooked to our Google Hangout bot as well for updates, so any time a clan member issued a `/bot fn` call - we knew someone had probably just won a game.
The detailed stats existed for each category to show how you preformed in each mode. Fortnite support died as quickly as it was added. We played hard for a few weeks, but the game adapted quickly and it wasn't too fun to play anymore for our crowd of gamers.
---
**Calendar**
Finally, our tool had a complex system for confirming to attend an event. The details around this system were once again, [blogged about](https://connortumbleson.com/2015/10/29/fun-with-hangout-bots/). However, it is important to note that each game above had support inside the calendar with proper amounts of max players allowed.
This meant you could view game specific stats during registration as we could correlate the authenticated user with their game specific profile. For example, viewing a Destiny 1 event might have this output.
Panda Love - Destiny 1 Calendar Event
While an event specific to Overwatch might show the player's best hero as well as stats at a glance.
These features were used quite heavily as the amount of players wanting to game were usually more than the max. The calendar became the source of truth for who was allowed to play.
This quickly died out as the clan numbers fell. Remember, we were all in college during the prime time of Panda Love - and that led to many many hours of free time in between classes.
I showed this project during an interview when asked about hobby projects and it got me my first job. Thanks to Panda Love - [https://pandalove.club](https://pandalove.club/?ref=connortumbleson.com). (*Who knows if it's still online or working when you read this*)
### The Cicada 3301 Mystery (Puzzle 3 Solve) - Part 1
URL: https://connortumbleson.com/2021/02/15/the-cicada-3301-mystery-puzzle-3-part1/
Last updated: 2025-02-04T11:43:14.000Z
Photo by [Michael Herren](https://unsplash.com/@mdherren?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Another year struck and after two years of puzzles from Cicada ([Puzzle 1](https://connortumbleson.com/2019/09/30/the-cicada-3301-mystery/) and [Puzzle 2](https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/)). Every new day of 2014 was anxious to see if another puzzle awaited.
Sure enough, January 6 of 2014 a new image showed up on the [Twitter account](https://twitter.com/1231507051321?ref=connortumbleson.com) which was involved in Puzzle 2.
@1231507051321 - 1:59am - [Jan 6, 2014](https://twitter.com/1231507051321/status/420087183957966849?ref=connortumbleson.com)
We knew the pattern at this point and it was off to outguess to see what was hidden beneath.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The work of a private man
who wished to transcend,
He trusted himself,
to produce from within.
1:2:3:1
3:3:13:5
45:5:2:3
20:3:20:5
8:3:8:6
48:5:14:2
21:13:4:1
25:1:7:4
15:9:3:4
1:1:16:3
4:3:3:1
8:3:26:4
47:3:3:5
3
13:2:5:4
1:4:16:4
.
o
n
i
o
n
Good luck.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJSyjguAAoJEBgfAeV6NQkPsgAP/A3tMC3lpyFNAc/sj+Izu15S
CzUjZJMe20Gu9UMNokQ2UJabktv9w0GMyK17TrMkUcU+ZpjdzGNqKoE2ETVxLmD/
uBZtR5PnF9EE3D08tJUPN1vSrYNkYk+9zcaUJZMPNgYNCt/CACutPwrOci9i9FDO
7BIpnhGqT3ZruqrSwO2Y73LJI1xxUt1XUqh1NQ+fJeAFMRkJBZZazkxRlgk3GGsF
fLrcEKrS+KBipV1EQaaKxjISc9hc2c1TfxE66evlkN+zLcoyDcYuyruNM5wiZzgM
2uR58c+xgWQgG5UuLFClfvjDxUvDkrKt4mzEeaYSUm1MsYueuYklz4ydlg5Mf6l2
p1WyAxO52XfXVUZASk6VmaEQ0WjODTXvLeFTxUSDoKDMkvxDVxX6wGkufS9JwakB
nTZizZ8Ypv8GcNCuNNGd6gZ1Vk2MYntggXdX8INd0Itcd3QnLqbBnATDOinDxlOs
5zTrtyTHNaxxDagPfAbU1jMXM0aHd7PFAzjjp7kgCTWqMyBch+8Vt80bjkdL9iw8
Q3hxuanq8mh6nUGc+tNe0UfqKHEbE+jWIezYqgawJB0M9R5OhxWE+E+jPXtZKkXQ
JHYndPDrrsV8q27b7p0KN0+oblTkjqsItIAuLu7FNd0B4xb1jjp1Sbh7WJdZ/rbi
mCO0vN/obU9qK1Vfapy0
=6Gxk
-----END PGP SIGNATURE-----
```
Another book code which took a quick Google search to identify this was an essay written by Ralph Waldo Emerson.
[Self Reliance (1841)](https://amzn.to/2MH9HWy?ref=connortumbleson.com)
This book code worked a bit differently working off 4 numbers, which corresponded to:
- Paragraph #
- Sentence #
- Word #
- Letter #
After following this you'd end up with another onion URL and the next puzzle had just begun.
```
auqgnxjtvdbll3pv.onion
```
This onion simply had one image present, which appeared to be some sort of collage of various paintings thrown together. It was discovered these were various paintings of [William Blake](https://en.wikipedia.org/wiki/William%5FBlake?ref=connortumbleson.com).
Image found on auqgnxjtvdbll3pv.onion
Running outguess over this image resulted in a new type of puzzle.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Welcome.
Good luck.
3301
e = 65537
n = 75579125746085351644267182920580212556413102071876330957950694457000592\
10248050757270234679993673844203148013173091173786572116639
- -----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE-----
Version: 1.99
Scheme: Crypt::RSA::ES::OAEP
eJwBswBM/zEwADE2MgBDeXBoZXJ0ZXh0LE2jxJS1EzMc80kOK+hra1GKnXgQKQgVitIy8NgA7kxn
2u8jNQDvlu0uymNNiu6XVCCn66axGH0IZ9w4Af3K/yRgjObsfA1Q7QqpXNALJ9FFPgYl5rh07cBP
M9kbSH6DynU/5cYgQod2KymjWcIvKx3FkjV4UOGakDnBf1eQp1uwvn3KxDVwTyzPqbMnZvOA06Ec
AfKtyz1hEK/UBXkeMeVrnV5SQQ==
=yTUshDMKN65aPaKAR0OU8g==
- -----END COMPRESSED RSA ENCRYPTED MESSAGE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJSyly/AAoJEBgfAeV6NQkPHhUP/R7nuYiTMw+3sbe0xV+4rmiN
liSDmW6ibOK4UTkZDTeAS5kAKIjxCC3DwWi0lXqBGZyabojWHM2wRwYLOhvfKvgg
DgPnW1BSZ/R67GaUy0CM/vtZOtktBeIdntlZamk9DpW5bQ311c7N9dy6uWc8+hOM
umkcnT7u799zESazFgCeDSOw0cFgHDiG9UTAQxbe+NsXY/NKm4N0WAtgWmdte5ym
dU8ImpmXWg8NChdn49UtuAACi8s8tcI/lHj1Yjh+AQRbO2+Ozn9eSxUAQ1TsXSgt
30jKmXI5ss4WHS16nYsS97BUbo4oX3NBXaCjSZb7fKO9CRJBo3gm2R8/NcIMIkEc
GlQ/7rCQWHXA0MC+415ut5dcJf2ihwid81c1xsDyqQdfhEsWE/wVnK7Ujje+BgcO
ybBHl8ejJzWhZkCvesHOmIo1RLEanxlGUC5jcRLqImrT7A9CrO+EVFW16EZpvzug
Tsopo56+JbIFiIzAq+CGujHgDZnoHJFtB574utjOnZz9xzsVZ3lirQyAFOGauH+g
K+XxjXjY8tT5lppAgmF3zWKqha7NoV+9FgFl2q2SS9ue+s4Joyn5PYKnICJeze3i
K9BZ7gIT694s4dLEzu6kGaRyuNmx8qaoDs0kjvEB5pI+1buGuNAysHQWIDyY3DWb
CjJ1AnBLY0ObxaMbWMR/
=d5E8
-----END PGP SIGNATURE-----
```
This signed message included an encrypted message as well as some plain text information.
The plain text portion had both an `e` and `n` number. Since it was obviously hinted to us with an encrypted RSA message - we know this is the exponent (`e`) and modulus (`n`).
Those two handed out together basically make up the public key of the ever popular RSA algorithm. If we want to decrypt the message we need the private key corresponding to this public key.
Lets quickly talk about how to break this assuming we cannot find the private key. This breaks down to having to find what two primes equal `n` or `7557912574608535164426718292058021255641310207187633095795069445700059210248050757270234679993673844203148013173091173786572116639` which is quite a number. It comes down to 130 digits which is an insane length of a number.
Though, not very secure as machines have gotten pretty good so they can effectively in a few hours answer that question - *what primes make up that number?*
Now before you freak out. Modern RSA is known as RSA-2048 which stands for 2048 binary digits or 617 length digit number. If you think that number above of 130 digits is a lot - try breaking the modern algorithm at 617 digits. It would take hundreds of thousands of years with current tech to even come close with RSA-2048.
So I decided to use the docker image [rsacrack](https://github.com/b4den/rsacrack?ref=connortumbleson.com), which basically put a wrapper around [cado-nfs](http://cado-nfs.gforge.inria.fr/?ref=connortumbleson.com). This would be the tool leveraged to accomplish our task of finding two large primes for a large number (RSA-432). So I grabbed my laptop started the task and let it run.
```bash
ibotpeaches@foundation$ time docker run -it b4den/rsacrack 755791257460853516442671829205802125564131020718763309579506944570005921024805075727023467999367384420314801317309117378657211663
[] pubkey.e: 6553
[] pubkey.n: 755791257460853516442671829205802125564131020718763309579506944570005921024805075727023467999367384420314801317309117378657211663
[] Key looks like 432 bit
[] Using cadonfs to compute prime
[] results are: [u'97513779050322159297664671238670850085661086043266591739338007321', u'77506098606928780021829964781695212837195959082370473820509360759', 65537L
[] Key extraction done
-----BEGIN RSA PRIVATE KEY----
MIIBDAIBAAI3AK50gkj06lhiMbT/iIsA+l1l517rgOiDK25eRHiXDIgpO0NuKFHO3U/5YHNaIjM
YqZZ4ilSnwIDAQABAjZtP5cLOxy6RpvcPh3y9qTS8mrnHVH3yZTcI/lwoIubRaCJaifErsBrjIv
e7LQ1fgyRo+c8hECHADtCvlDTZS6NNntQIAKTebM9nwGSpu4imfXoxkCHAC8aCngGxUhK0bNdTn
h4An2V1NmuWt2dhy0ncCGwcXfSAieOKBt851ZR3Jj1gA/Yd59zPLwxw4uAIbNsOR69rhfdX5eVH
4QFynOdXzrhchHsl3IjkAhsmGCSA2T0fTd6T+mJ7XHMpxqj9oFdz93zmJLk=
-----END RSA PRIVATE KEY-----
real 717m2.977
user 0m1.752
sys 0m0.245
```
It took my computer roughly 12 hours to do it, but it successfully cracked the corresponding primes. We now had both `p` and `q`:
- `97513779050322159297664671238670850085661086043266591739338007321`
- `77506098606928780021829964781695212837195959082370473820509360759`
Now we still have to decrypt this and we were given a hint where to start.
```
Scheme: Crypt::RSA::ES::OAEP
```
Now probably dated, but the double colon instantly points me to Perl packages. We could easily find that referenced Encryption Scheme (ES) and package it belongs to.
Now we will probably need to install this [package](https://metacpan.org/pod/Crypt::RSA?ref=connortumbleson.com) to both decrypt and put our keys into a usable format. I haven't touched Perl in almost a decade so it was time to dust off `cpan` and remember how this all works.
```
cpan
install Crypt::RSA
...
Appending installation info to /usr/local/lib/x86_64-linux-gnu/perl/5.22.1/perllocal.pod
VIPUL/Crypt-RSA-1.99.tar.gz
/usr/bin/make install -- OK
cpan[2]>
```
Now, write up a quick program looking at the documentation for this plugin.
```perl
use Crypt::RSA;
my $algo = new Crypt::RSA;
my $keychain = new Crypt::RSA::Key;
my ($public, $private) = $keychain->generate(
'q' => '97513779050322159297664671238670850085661086043266591739338007321',
'p' => '77506098606928780021829964781695212837195959082370473820509360759',
'e' => '65537'
);
$encrypted = "
-----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE-----
Version: 1.99
Scheme: Crypt::RSA::ES::OAEP
eJwBswBM/zEwADE2MgBDeXBoZXJ0ZXh0LE2jxJS1EzMc80kOK+hra1GKnXgQKQgVitIy8NgA7kxn
2u8jNQDvlu0uymNNiu6XVCCn66axGH0IZ9w4Af3K/yRgjObsfA1Q7QqpXNALJ9FFPgYl5rh07cBP
M9kbSH6DynU/5cYgQod2KymjWcIvKx3FkjV4UOGakDnBf1eQp1uwvn3KxDVwTyzPqbMnZvOA06Ec
AfKtyz1hEK/UBXkeMeVrnV5SQQ==
=yTUshDMKN65aPaKAR0OU8g==
-----END COMPRESSED RSA ENCRYPTED MESSAGE-----
";
print $algo->decrypt(
Cyphertext => $encrypted,
Key => $private,
Armour => 1,
);
```
Basically, we start with our imports and creating a few helper variables. We now need to initialize the private key so we can decrypt the message via the API given from this package. It requires 3 parameters, one of which we already had (`e`) then the two primes we solved from cracking the key above - `p` and `q`.
Now we needed to pass our encrypted message to our algorithm using our private key, as well as throwing the armored flag because we are looking at an ASCII iteration of the message (commonly used when traversing network). Now all we have left is to execute it.
```
➜ perl cicada3301_p3.pl
cu343l33nqaekrnw.onion
```
Another onion we go.
This onion had an empty page with a collection of random hexadecimal characters.
```html
634292ba49fe336edada779a34054a335c2ec12c8bbaed4b92dcc05efe98f76abffdc2389bdb9de2cf20c009acdc1945ab095a52609a5c219afd5f3b3edf10fcb25950666dfe8d8c433cd10c0b4c72efdfe12c6270d5cfde291f9cf0d73cb1211140136e4057380c963d70c76948d9cf6775960cf98fbafa435c44015c5959837a0f8d9f46e094f27c5797b7f8ab49bf28fa674d2ad2f726e197839956921dab29724cd48e1a81fc9bab3565f7513e3e368cd0327b47cf595afebb78d6b5bca92ba021cd6734f4362a0b341f359157173b53d49ea5dff5889d2c9de6b0d7e8c615286ce596bfa83f50b6eeabd153aaf50cd75f39929ba11fb0f8e8d611442846
```
The characters on this page kept growing every few minutes larger and larger. At some point it just stopped and folks began rapidly trying to decode this blob of text.
Then the entire page went away. In its place was a massive 3 megabyte collection of text and a new comment.
```
....
```
[full file](https://connortumbleson.com/uploads/2021/01/cu343l33nqaekrnw.onion.txt)
Continuing our pattern from the previous puzzles, we can assume this file needs a quick conversion back to binary. So back to [xxd](https://linux.die.net/man/1/xxd?ref=connortumbleson.com) we go.
```
xxd -r -p cu343l33nqaekrnw.onion.txt cu343l33nqaekrnw.onion.bin
```
Run binwalk over that and nothing. So take a peek via a hex editor.
```
00000000 00 27 00 1f ff ef b5 b9 b6 b9 ff fe fe ff ff fe
00000010 ff fe ff ff 00 24 ff bc ff fe fe fe fe fe fe fe
```
After doing enough Halo 3 screenshot injecting you start recognizing magic (first few bytes of a file) of images. It's a bit flipped JPEG. I'm half reaching there, but anytime you see `00` then non `00`, then another `00` that hints at a variety of file headers. For example, JPEG normally is `FF D8 FF`.
So back to Perl we go, leveraging [unpack/pack](https://perldoc.perl.org/perlpacktut?ref=connortumbleson.com) to bit flip this.
```
perl -pe 'BEGIN{$/=\1} $_ = pack("C", unpack("C", $_) ^ 0xFF)' < onion.bin > onion.flipped
```
So now [binwalk](https://github.com/ReFirmLabs/binwalk?ref=connortumbleson.com) worked.
```
➜ binwalk onion.flipped
DECIMAL HEXADECIMAL DESCRIPTION
-----------------------------------------------------------------
0 0x0 JPEG image data, JFIF standard 1.01
168876 0x293AC JPEG image data, JFIF standard 1.01
1228573 0x12BF1D QNX IFS
```
It looks like 2 images with a file system image in the 3rd location. Lets ask binwalk to extract those two.
```
binwalk -D 'jpeg image:jpeg' onion.flipped
```
Now this 3rd item is not making sense. So off to the hex editor we go.
ghex - ubuntu
Scrolling to the bottom of the file we see the magic header of the JPEG file, but its reversed. It appears cicada put the 3rd image into the file reversed. We can't trust binwalk here, because it doesn't know where the reversed start point of a JPEG file is.
Like most unix tools, we have `cat` which just outputs a file, but there is also [tac](https://man7.org/linux/man-pages/man1/tac.1.html?ref=connortumbleson.com) which as the name suggests is just cat backwards. Lets read the file line by line with `xxd` to non-binary, pipe the output to `tac` and then reverse it back to binary.
```
< onion.flipped xxd -p -c1 | tac | xxd -p -r > onion.reversed
```
```
➜ binwalk onion.reversed
DECIMAL HEXADECIMAL DESCRIPTION
-----------------------------------------------------------------
0 0x0 JPEG image data, JFIF standard 1.01
```
I'm sure there is a less strange way to do that, but we basically just flipped the entire file to make the extraction easier. Now we ask binwalk to extract that one and collect our images.
One thing we should immediately check is if these jpeg files can be handled by outguess.
```
➜ for file in *.jpg; do outguess -r $file $file.out; done;
Reading 1.jpg....
Extracting usable bits: 154283 bits
Steg retrieve: seed: 163, len: 2899
Reading 2.jpg....
Extracting usable bits: 1025122 bits
Steg retrieve: seed: 115, len: 2899
Reading 3.jpg....
Extracting usable bits: 158963 bits
Steg retrieve: seed: 94, len: 2899
```
[Outguess #1](https://connortumbleson.com/uploads/2021/02/1.jpg.txt), [Outguess #2](https://connortumbleson.com/uploads/2021/02/2.jpg.txt), [Outguess #3](https://connortumbleson.com/uploads/2021/02/3.jpg.txt)
We are in luck. Now lets just double check these validate from Cicada to ensure we decoded them properly.
```
➜ for file in *.out; do gpg2 -d $file | grep 'Good'; done;
gpg: Signature made Mon 06 Jan 2014 10:16:41 PM EST using RSA key ID 7A35090F
gpg: Good signature from "Cicada 3301 (845145127)" [unknown]
gpg: Signature made Mon 06 Jan 2014 10:16:48 PM EST using RSA key ID 7A35090F
gpg: Good signature from "Cicada 3301 (845145127)" [unknown]
gpg: Signature made Mon 06 Jan 2014 10:16:44 PM EST using RSA key ID 7A35090F
gpg: Good signature from "Cicada 3301 (845145127)" [unknown]
```
Now we have 3 decoded files and the start of a book that is runic in nature. I guess lets start to decode these runes and see what we find. With a bit of research we find these are runic characters that all have a matching [unicode](https://en.wikipedia.org/wiki/Runic%5F%28Unicode%5Fblock%29?ref=connortumbleson.com) character. We must finally have a use for this decoding chart we discovered in [Puzzle 2](https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/)!
Chart discovered from Puzzle 2 in 2013
It seems some runes can be decoded to multiple characters or even different combination of characters. So lets just slowly start with the first few letters of - `ᚱ ᛝᚱᚪᛗᚹ`. We will put the characters in brackets like `[C|K]` if we don't know which one to put.
- `ᚱ ᛝᚱᚪᛗᚹ` \- `R [NG|ING]RAMW`
Nothing looks too much like a word there. If you read it backwards it looks kinda like a word, but not enough. Maybe lets try reversing our entire decoding progress. So instead lets order these runes in order of the numeric values from 2 to 109, then reverse it so we pick the opposite character than we'd normally do. It seems sane to try this because this image was reversed in the payload we got from the onion above. Lets build a little tool to make this easier as its getting tough to do this manually.
```
➜ php cicada app:translate
Enter a sentence to translate:
> ᚱ ᛝᚱᚪᛗᚹ
Reverse the translation? (y/n) [n]:
> y
A WARN[NG|ING]
```
[https://github.com/iBotPeaches/cicada\_3301](https://github.com/iBotPeaches/cicada%5F3301?ref=connortumbleson.com)
Wow - that is starting to make sense. Commonly a reversed decoding is also known as an atbash cipher, so it seems we've found the cipher for this page. Lets run this entire thing through now.
```
A WARN[NG|ING] BELIEUE NOTH[NG|ING] FROM
THI[S|Z] BOO[C|K]EX[C|K]EPT WHAT YOU
[C|K]NOW TO BE TRUE TE[S|Z]T THE [C|K]
NOWLEDGE FIND YOUR TRUTH EX
PERIEN[C|K]E YOUR DEATH DO NOT EDIT O
R [C|K]HA[NG|ING]E THI[S|Z] BOO[C|K] OR THE ME[S|Z][S|Z]AGE
[C|K]ONTAINED WITHIN EITHER THE WO
RD[S|Z] OR THEIR NUMBER[S|Z] FOR ALL I
[S|Z] [S|Z]A[C|K]RED
```
Now lets run this through manually and fix-up the characters that could be either-or and fix the split up words.
> A WARNING
> BELIEVE NOTHING FROM THIS BOOK
> EXCEPT WHAT YOU KNOW TO BE TRUE
> TEST THE KNOWLEDGE
> FIND YOUR TRUTH
> EXPERIENCE YOUR DEATH
> DO NOT EDIT OR CHANGE THIS BOOK
> OR THE MESSAGE CONTAINED WITHIN
> EITHER THE WORDS OR THEIR NUMBERS
> FOR ALL IS SACRED
Wow - guess this is the beginning of a large book for more challenges and puzzles. At this point we've exhausted our runes - lets head back to the data hidden within the images (outguess) and take another look.
If all these images started together, maybe we were meant to merge them back?
We could dump the message of each signed payload and reverse it back to binary.
```
➜ gpg < 1.jpg.out | xxd -r -p > 1.bin
➜ gpg < 2.jpg.out | xxd -r -p > 2.bin
➜ gpg < 3.jpg.out | xxd -r -p > 3.bin
```
We know the exclusive or (xor) operation loves being used after doing puzzle 2\. So lets just XOR all these files together. The helper python code we used in puzzle 2 can't take 3 files, so lets just merge 1 & 2, then merge that with 3.
```
➜ python2 xor.py 1.bin 2.bin 1-2.bin
➜ python2 xor.py 1-2.bin 3.bin merged.bin
➜ binwalk merged.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------
0 0x0 PGP armored data, signed message
155 0x9B PGP armored data,
```
[xor.py](https://raw.githubusercontent.com/ITAYC0HEN/XOR-Files/master/xor.py?ref=connortumbleson.com)
Wow. The merged file was detected as another PGP message.
```
➜ strings merged.bin
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
IDGTK UMLOO ARWOE RTHIS UTETL HUTIA TSLLO
UIMNI TELNJ 7TFYV OIUAU SNOCO 5JI4M EODZZ
Good luck.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJSy23PAAoJEBgfAeV6NQkPeJwP/0IoafJ1SbmhD+KNbL5I2EdH
jgPRnZNrKCyMpWFSIw1qs6ujuw6VnW/rfnOD+df4kpzoAwEFfZDcRnBVsvIzOJ31
Txj9jXD22ki/CNRY88NyIzW9fjKs+iOylsa7Tx+6PBb3ndoYNEwnQwLIq3K4S3kQ
tgMzE3LiVq2pQwqFNdN+zGqcq7POEs0GmnL1aNpqU+Wrba4gSfoWwQBWUDv3S/s8
vY0hEqhWNd76wphig6hH6OyIaX/t1eYfcsSYhzAE5oKKahGr1E7cX1GBpHCIr1WM
ZwNaGVArQAkyEzT++tmF01O9h218CiTUFoBM/Zxyra7vxI2UOYS/pLonuV+eXARY
YfPHaZZxfk3bUWXcxioRukFSY2+xNdPfuBIT8rcJqa1kPJOzeZVC/IcwHA2mmG4l
3ltiVcDnQrZgz6Im3/ugFg8bqW12qqZ6XizRP3EXm4EnyhpfKZnXKPLEOvPKCj6j
1kYCrLmGtTTPFx79fZfryGXQIEAmipRbjVS5sVbUCfgmqUagmdU6v9VI53n6+r0J
b2amxREA+2MflkEoVJUaLQJ1rKZLFFJ9J17zUaXKMllsDBWXJS4Mb54o2+8bkEcM
3cP+16XV9pf2wZBkJE0AwoXI4L8JEyjNZZcGSLy8BojlAupX3Fg9KKt71XXrm9FD
tuBhMYWo/TDz+4UzLB+I
=57tj
-----END PGP SIGNATURE-----
```
Now at this point - this is a random collection of letters in groups of 5\. Commonly in a transposition cipher you group letters kinda like the above and use a key to shift them into position. In this case though we had no key, which points to perhaps a column based transposition cipher. This means that instead of an explicit key you normally pass along a string of numbers that correspond to the proper way to orientate the columns.
2,8,9,1,12,13,11,4,5,7,3,0,6,10
What was discovered is that simply brute forcing a column based cipher until human words appear worked. You have to clean up the spacing, but you get:
```
GOOD WORK
ULTIMATE TRUTH IS THE ULTIMATE ILLUSION
JOIN US AT FV7LYUCMEOZZD5J4ONIO
```
This message forgot the closing `n` of `onion`, but presumably the effort required to include it was too much. So we were off to another onion - `fv7lyucmeozzd5j4.onion`.
At this point we are only a few puzzles into the 2014 challenge and we haven't really even discussed the Liber Primus book briefly shown above. The problem is after this point the puzzle becomes less linear. While all puzzles up to this point worked generally in a linear fashion which made it easier to blog about.
Check back for [Puzzle 3 Part 2](https://connortumbleson.com/2024/02/05/the-cicada-3301-mystery-puzzle-3-solve-part-2/) where we learn more about the Liber Primus.
---
- [Puzzle 1](https://connortumbleson.com/2019/09/30/the-cicada-3301-mystery/) (2012)
- [Puzzle 1 - Extra](https://connortumbleson.com/2021/04/12/the-cicada-3301-mystery-puzzle-1-extra/) (2012)
- [Puzzle 2](https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/) (2013)
- Puzzle 3 - Part 1 (2014) - You are here
- [Puzzle 3 - Part 2](https://connortumbleson.com/2024/02/05/the-cicada-3301-mystery-puzzle-3-solve-part-2/) (2014)
- [Puzzle 3 - Part 3](https://connortumbleson.com/2024/06/03/the-cicada-3301-mystery-puzzle-3-solve-part-3/) (2014)
- [Puzzle 3 - Part 4](https://connortumbleson.com/2024/12/23/the-cicada-3301-mystery-puzzle-3-solve-part-4/) (2014)
### GameStop, Robinhood & 2021
URL: https://connortumbleson.com/2021/02/07/gamestop-robinhood-2021/
Last updated: 2025-02-04T11:43:14.000Z
Photo by [Brett Jordan](https://unsplash.com/@brett%5Fjordan?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
After a crazy year of 2020 and Coronavirus (Which isn't actually gone yet) we saw that plenty of folks overnight were convinced they knew how to handle a situation that many folks spent careers studying. We will see that again right now with my pathetic attempt to explain the situation with GameStop (GME) that is all over mainstream media.
I want to do this though because day after day on the week of January 25 to 29 I have to sit and listen to billionaires, hedge fund managers, CEOs and more talk about the retail investor. Why hasn't any news station interviewed a regular retail investor?
So let's get a viewpoint from a retail investor that tossed a couple thousand dollars into this circus.
---
GME - January 29, 2021 - [Google Stock](https://www.google.com/finance/quote/GME:NYSE?ref=connortumbleson.com)
So let's start with what things look like right now typing this post. Of course GameStop has made quite a jump trading from around an average of $4/share to \~$200/share - what happened?
Let's roll back the clock to July 27, 2020 when a YouTuber known as [Roaring Kitty](https://www.youtube.com/channel/UC0patpmwYbhcEUap0bTX3JQ?ref=connortumbleson.com) decided to upload a 1 hour video going into the background of $GME and his research estimating at within 18 months a quick rise to GameStop.
[100%+ short interest in GameStock stock (GME) – fundamental & technical deep value analysis](https://www.youtube.com/watch?v=GZTr1-Gp74U&ref=connortumbleson.com)
What caught my eye here is at one point in the video he shows some research/tool that shows GameStop is over 100% shorted.
[High Short Interest Stocks](https://www.highshortinterest.com/all/?ref=connortumbleson.com)
For one - shorting a company to me seems so ethically wrong - you are basically making money on a company failing. For those unaware, let's do a basic example with pillows.
*I borrow a pillow from you (the reader) and you want it back when you are back from a month long cruise. That pillow type is sold out so I sell your pillow for say $100\. I'm hoping that those pillows will be available to buy before you return home. Turns out a new shipment arrives at my local store and I buy the same pillow for $50 just in time for you to return - I just profited $50\.*
*Let's say they never got a shipment in time and the only pillow I could find was on Amazon for $300 so instead of profiting $50 - I ended up having to spend $300\. As you see - the possible difference is infinite so risk is quite high.*
Though we are in the stock market where the rules are a bit different. Some wealthy companies decided to short GameStop and sell huge lots of shares which they don't actually own! GameStop was trading around $5/share during the video above and a couple months later it was trading around $20/share.
If you are a large fund shorting GameStop - you are already in trouble. You are going to eat a lot to buy back the shares you borrowed. Though, a $15 difference per share isn't too bad, but those corporations are greedy - they refused. As more retail investors caught wind of this - they learned that large corporations had to buy the stock back in time - so why not buy more of it now? The continued buying drove the stock up to $20, $30, $40, $50 and then exploded to $200/share.
The companies weren't going to lose a tiny bit now - they might be losing upwards of $6 billion dollars. So of course this is corrupt America where heavy pockets make up rules as they go. The morning of January 28, 2021 was a rough one for retail investors.
[Robinhood ](https://blog.robinhood.com/news/2021/1/28/an-update-on-market-volatility?ref=connortumbleson.com)& [M1](https://www.m1finance.com/blog/urgent-trading-announcement-1-28-21/?ref=connortumbleson.com) restricting buying select securities.
Now I can understand the following:
- Removing trading on margin
- Removing instant deposits (margin)
- Removing partial share purchases
As all of these have inherent risk attached, but for me to sit with $2,500 in Robinhood with money that isn't margin and be prevented from using it how I want seems just plain wrong. I'm allowed to go to a casino and lose/win if I want, but god forbid I want to treat the market like a casino like every other billion dollar company does.
This to me is another field that is ripe for a wake up call. Gone is the era where knowledge was inaccessible and kept solely for Wall Street. One person can buy a few subscriptions and make educated decisions from their own research.
Though, let's go back to 2008 for a bit. Who got bailed out when families were losing homes, cars being repossessed and jobs being lost? I think everyone remembers the big business bailouts leaving the retail consumer to pick up the pieces. No one came around to help families - we collectively as a nation bailed out the hedge funds.
Those kids who were probably in middle school during 2008 have grown up and they have read and learn. Markets don't move based on actual merit of the companies anymore and it bugs me. Emails are sent, secret groups of big funds communicate in conference rooms and momentum pushes stocks up or down.
Yet, in strange instant where a couple million Americans stand up and start making their own stimulus checks - we have to close the markets and remake the rules.
[GME YOLO update — Jan 27 2021](https://www.reddit.com/r/wallstreetbets/comments/l6ekdz/gme%5Fyolo%5Fupdate%5Fjan%5F27%5F2021%5Fguess%5Fi%5Fneed%5F102/?ref=connortumbleson.com) \- /u/[DeepFuckingValue](https://www.reddit.com/user/DeepFuckingValue?ref=connortumbleson.com)
Roaring Kitty made a huge risk - putting down nearly $54,000 dollars into $GME, but he did hundreds of hours of research and his return was insane - netting nearly $34 million in profit. He hasn't sold the majority yet even as the stock tumbles down.
Are some folks hoping they can click a few buttons and get rich? Yeah and they will be hurt badly when they try to sell with the masses and no one is buying. The price will correct and fall.
This I hope when it's all said and done is a wake up call to big money and funds. If they try an outrageous play on shorting - someone will see and cause them to pay.
### Blog Updates - 2021
URL: https://connortumbleson.com/2021/02/01/blog-updates-2021/
Last updated: 2025-10-05T10:44:27.000Z
Photo by [Corinne Kutz](https://unsplash.com/@corinnekutz?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Every year or so I feel the need to update the blog. Some years it's drastic with a new theme and other years I do next to nothing. If you count the year I left Wordpress for Ghost then that year I did quite a lot. This January of 2021 I did some serious updating to the existing theme.
---
**Tags**
Tag Hell - 2020
I had this issue that during the blog move tags went from an afterthought in WordPress to prime time in Ghost. I had so many tags that it reminded me of the meta tag spam of the early Google SEO era.
Ghost had upgraded to allow colors, images, descriptions and more with the tags. So I went through every post I had re-tagging them to a smaller list of tags. Additionally, dropping some old (10+ year) posts that were simply just bad.
The result was a small list of tags that make exploring what this blog offers quite easy.
Tag Cleanup - 2021
So now those interested in a specific tag can easily find it and even subscribe directly to the RSS feed from that specific tag page.
I believe this will help for the readers to the blog that only care about Apktool for example. Though, not sure how many people, outside of hardcore nerds, even use RSS feeds anymore. I like loading them into Thunderbird, but I'm sure that is a minority group not majority.
---
**Dark/Light Toggle**
Toggle for Light/Dark Mode
The blog now has a specific icon to help toggle between dark & light mode. Now we've opened up space in the navigation instead of having a navigation element that only acted as a toggle.
Additionally, the mobile component for this will also slip in some text to help explain what the icon does. This joins the search icon that lives on the drop-down during mobile use.
Toggle for Light/Dark Mode (Mobile)
Since a good chunk of my readers read via a mobile device. It makes sense to ensure the reading experience for those is perfect as well.
---
**Read Time**
The Past
The cards across the site used to just give out title, date and tag. The author tag was removed, because every single author was me. So with that removed space I slipped in an estimated reading time.
The Current
So now we have a cool little snippet of reading time on each post, which has helped prove that most of my posts are just too short. So the benefit being when you see a +10 minute read - you know I spent some time on that one.
---
**Buy me a ~~Coffee~~ Beer**
[My Author Page](https://connortumbleson.com/author/connor/)
I additionally wanted to clean up a donation mechanism that used to be just a cryptic hash of a Bitcoin address. While I can probably only count a few instances where someone has offered a donation - I wanted to make it easier.
I don't yet feel comfortable plastering the link on each blog post. Instead, hiding the donation link on the author page as I want my blog to be about the content being read, not guilt tripping folks into a donation.
The "[Buy Me a Coffee](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)" project is quite simple and just allows folks to setup a landing page for donations. With support on both Stripe & PayPal it opens pretty much every avenue for methods of donations.
---
Finally, I wanted to continue exploring optimizations for automatically optimizing images, but uploaded assets are just a complicated matter. If I push for AWS for a CDN and optimized images - that would be amazing, but then I'm paying 20-30$ a month for images.
I looked into some binaries that can just crawl my assets directory and optimize images because writing a plugin for Ghost seems like a lot more work. However, the tools available don't have a good method for determining if a file has been optimized or not and I don't want to reprocess 8GB of assets often.
I also want to explore [webp](https://developers.google.com/speed/webp?ref=connortumbleson.com) images, but seeing how it would require some integration with Ghost to rewrite URLs - I held off.
With that, I was happy with the changes so far and will revisit more as Ghost and time moves on.
### The Cicada 3301 Mystery (Puzzle 2 Solve)
URL: https://connortumbleson.com/2021/01/25/the-cicada-3301-mystery-puzzle-2/
Last updated: 2025-02-04T11:43:15.000Z
Photo by [Ellicia](https://unsplash.com/@ellicia%5F?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Only 366 days since [Puzzle 1 dropped](https://connortumbleson.com/2019/09/30/the-cicada-3301-mystery/) from the mysterious Cicada 3301 when another image was uploaded to 4chan.
4chan's /x/ & /b/ imageboards - January 5th, 2013
Unlike the first puzzle. There was no obvious information attached to this file to give any hints. It was straight to "[outguess](http://web.archive.org/web/20150419030527/http://www.outguess.org/)" to extract whatever information hide in this image.
Another book code journey awaited.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Welcome again.
Here is a book code. To find the book, break this riddle:
A book whose study is forbidden
Once dictated to a beast;
To be read once and then destroyed
Or you shall have no peace.
I:1:6
I:2:15
I:3:26
I:5:4
I:6:15
I:10:26
I:14:136
I:15:68
I:16:42
I:18:17
I:19:14
I:20:58
I:21:10
I:22:8
I:23:6
I:25:17
I:26:33
I:27:30
I:46:32
I:47:53
I:49:209
I:50:10
I:51:115
I:52:39
I:53:4
I:62:43
I:63:8
III:19:84
III:20:10
III:21:11
III:22:3
III:23:58
5
I:1:3
I:2:15
I:3:6
I:14:17
I:30:68
I:60:11
II:49:84
II:50:50
II:64:104
II:76:3
II:76:3
0
I:60:11
Good luck.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJQ5QoZAAoJEBgfAeV6NQkPf2IQAKWgwI5EC33Hzje+YfeaLf6m
sLKjpc2Go98BWGReikDLS4PpkjX962L4Q3TZyzGenjJSUAEcyoHVINbqvK1sMvE5
9lBPmsdBMDPreA8oAZ3cbwtI3QuOFi3tY2qI5sJ7GSfUgiuI6FVVYTU/iXhXbHtL
boY4Sql5y7GaZ65cmH0eA6/418d9KL3Qq3qkTcM/tRAHhOZFMZfT42nsbcvZ2sWi
YyrAT5C+gs53YhODxEY0T9M2fam5AgUIWrMQa3oTRHSoNAefrDuOE7YtPy40j7kk
5/5RztmAzeEdRd8QS1ktHMezXEhdDP/DEdIJCLT5eA27VnTY4+x1Ag9tsDFuitY4
2kEaVtCrf/36JAAwEcwOg2B/stdjXe10RHFStY0N9wQdReW3yAOBohvtOubicbYY
mSCS1Bx91z7uYOo2QwtRaxNs69beSSy+oWBef4uTir8Q6WmgJpmzgmeG7ttEHquj
69CLSOWOm6Yc6qixsZy7ZkYDrSVrPwpAZdEXip7OHST5QE/Rd1M8RWCOODba16Lu
URKvgl0/nZumrPQYbB1roxAaCMtlMoIOvwcyldO0iOQ/2iD4Y0L4sTL7ojq2UYwX
bCotrhYv1srzBIOh+8vuBhV9ROnf/gab4tJII063EmztkBJ+HLfst0qZFAPHQG22
41kaNgYIYeikTrweFqSK
=Ybd6
-----END PGP SIGNATURE-----
```
This book code followed patterns like the previous story. The hint at the top quickly pointed to [The Book of Law](http://en.wikipedia.org/wiki/The%5FBook%5Fof%5Fthe%5FLaw?ref=connortumbleson.com) by Aleister Crowley.
[The Book of Law](https://www.sacred-texts.com/oto/engccxx.htm?ref=connortumbleson.com)
The code followed (given the example - `I:1:6`) - Chapter 1, line 1 and letter 6\. Once completed this actually built a now defunct Dropbox address.
```
https:--www.dropbox.com-s-r7sgeb5dtmzj14s-3301
```
This when downloaded was actually a 130mb ISO file. With tools available in 2021 it was easy to virtualize this with a few clicks. So below is an animation of the boot process.
Cicada 3301 OS - Hyper-V Manager (Gen1)
If you watch this a few times you can notice a pause before it writes out 1033 and 3301\. At this point in the world of Cicada - you can only assume iterations of 3301 are involved.
This OS ends and continues looping on a message.
```
@1231507051321
The key is all around you.
Good luck.
3301
```
So investigating the ISO further led to the discovery of a few obvious files:
- `AUDIO/761.mp3`
- `DATA/_560.00`
- `DATA/560.13`
- `DATA/560.17`
Outside of the mp3 file, the other files appeared to be gibberish with no known file magic/pattern. Though back to the message from the OS and it didn't take long for researchers to match that `@` sign to the familiar Twitter.
[Cicada - 3301 Twitter](https://twitter.com/1231507051321?ref=connortumbleson.com)
With a bit of scripting - you can dump all the tweets and the picture becomes a bit clearer.
```
0000000: b69ccce300104a464802545959580001008d0000ff
0000041: 404a727b0843460c44595114476a555f5c5b576040
0000082: 5a5712565b445b5c5b464b12455b465a5b5c12535c
...
```
snipped for readability - [full file](https://connortumbleson.com/uploads/2021/01/3301%5Ftwitter.txt)
This is commonly seen when exploring files at the hex level. The left side corresponds to the offset and right had the data itself. This output you see above is common when using the `xxd` tool.
However, the trail was running cold so it was time to look back at the Cicada 3301 OS. Looking back at the audio file (below) we can see this filename is `761.mp3` which is prime, and the song is also 167 seconds long which is also prime. Is anything by chance with Cicada?
The Instar Emergence - 3301
Your browser does not support the `audio` element.
I'd take a minute and listen to the song, but if you wanted to run `xxd` over this song to dump the headers. You'd see something like:
```
➜ xxd 761.mp3 | more
00000000: 4944 3303 0000 0000 0144 5458 5858 0000 ID3......DTXXX..
00000010: 008c 0000 0050 6172 6162 6c65 2031 2c35 .....Parable 1,5
00000020: 3935 2c32 3737 2c36 3431 004c 696b 6520 95,277,641.Like
00000030: 7468 6520 696e 7374 6172 2c20 7475 6e6e the instar, tunn
00000040: 656c 696e 6720 746f 2074 6865 2073 7572 eling to the sur
00000050: 6661 6365 5c6e 5765 206d 7573 7420 7368 face\nWe must sh
00000060: 6564 206f 7572 206f 776e 2063 6972 6375 ed our own circu
00000070: 6d66 6572 656e 6365 733b 5c6e 4669 6e64 mferences;\nFind
00000080: 2074 6865 2064 6976 696e 6974 7920 7769 the divinity wi
00000090: 7468 696e 2061 6e64 2065 6d65 7267 652e thin and emerge.
000000a0: 5449 5432 0000 0015 0000 0054 6865 2049 TIT2.......The I
000000b0: 6e73 7461 7220 456d 6572 6765 6e63 6554 nstar EmergenceT
000000c0: 5045 3100 0000 0500 0000 3333 3031 fffb PE1.......3301..
```
Though if we look at the metadata that Ubuntu can read (presumably via the ID3 tags) we are missing some of that text.
Thankfully the text is human readable which reads:
```
The Instar Emergence
Parable 1,595,277,641
Like the instar, tunneling to the surface
We must shed our own circumferences;
Find the divinity within and emerged
```
This appeared to be a dead end for research. So we had a data file from Twitter, 3 random data files and an audio file. It was a tweet posted a day after all the data dumps from Cicada that hinted that the dumps of data were over.
Now that we knew column size and a hint to basically start at the beginning and skip nothing. So lets get this stream of tweeted data back into a binary format. (Presumably it was only hexadecimal for Twitter consumption)
```
xxd -c 65 -r 3301_twitter.txt > 3301_twitter.bin
```
- *\-c cols* | *\-cols cols*
- *\-r* | *\-revert*
For those unaware with `xxd` it is quite strict when trying to revert a hex dump. Throwing random commands at this wouldn't be working so getting a succesful revert was promising.
Next up was just brute forcing the binary file with the OS files as the binary file itself appeared to be nothing usable. There were so many logic gates to combine files (AND, OR, XOR, NOR, NAND, etc) that it just took a few iterations to land on XOR.
```
➜ python2 xor.py 761.mp3 3301_twitter.bin output
[*] 761.mp3 XOR 3301_twitter.bin
[*] Saved to output.
➜ file output
output: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 598x842, frames 3
```
[xor.py](https://github.com/ITAYC0HEN/XOR-Files/blob/master/xor.py?ref=connortumbleson.com) \- [ITAYC0HEN](https://github.com/ITAYC0HEN?ref=connortumbleson.com)
The breath of relief when the binary Twitter posts XOR\`d into the mp3 file resulted in an image!
Decoded from `761.mp3`
I'm sure at this point you know what is next. Time to outguess this image to assert the validity and look for clues.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJQ5lDTAAoJEBgfAeV6NQkP7nMQAJVg7DQiIA7NpkacR0RA4eBs
NZHJBQNHO2P22h+aFfP/rI1gjGaV3hMWaa2sQ4Vbi/W8eZuH40AsmZUy3EOb+4j0
3cJRJgAJI99ZjDcVXITm5VyUv+WIqCzBr+bHMK7pkMYQ/rEzeWD56tlsrDgFdjmh
PA/b7XrDcofd9JfBNFI7D/sF84HL2ig5baNo+MGjYl4Dq2cHX+SAafXmlN9PXFjx
HRBbuoMLlviKywQ8MnePBPYG6V8sIMmrJlHS5ZcNEaSJ9nGL4X0XbECqV79ermye
1EeNKcckoeeZMU86SabfMeyZozG04Vkbemn8JH5cssbuF8hf4fdN/LSP4NG0r5y9
jfRv7z59pL577ZpGAju5zBtlCBUvmxxNYR5IGLg+Fi/ICqcRC98mzesFnQ7wbDLS
HKyV95SBQK82bbqSREBfIrrNb+MjVtJwIvOY5OPTBViHPqrIuMw8KDGfSvw9ncCt
dase7vUjXxIrn36xDSRN6cMzTmFZ9lkQYkRAYq5ApERud+JfKCwszG/UxRwo1WOU
0ALaWXq5VMp+w5pvQkqg9eHpOriG9Z11VLdb53eTmxKrwyX/2eaiybsnMrRNuxv1
iE8PVRkifCcJccw1bGq8TyCQF3a5ozeiBRngAUT7BwZhLa4bShtki7amR0ZZgbKk
8JRMGvoSA5NNTEwvUhwl
=ZeNf
-----END PGP SIGNATURE-----
```
outguess
This was slightly alarming - the message was empty, but at least it validated with a signature from Cicada. Maybe the signature was just validating that we indeed decoded the image correctly. It took a bit more investigating, but it turns out that empty space is not truly empty but a mix of tabs and spaces.
We can leverage vim for this. If we open up the file. We can ask vim to replace spaces and tabs with preferred characters.
```
:set list
:set listchars=tab:0x,space:1
```
Since my vim knowledge isn't the best. This generates a line like:
```
001xxxxx1xxxxxxx001xxxxx1xxxxxxx001xxxxx1xxxxxxx001xxxxx1xxxxxxx001xxxxx1xxxxxxx0000001x1xxxxxxx0001xxxx
```
Which isn't exactly binary, so a quick expression with bash `echo: "$(STRING//x)"` and we get:
```
010000110110111101101101011001010010000001110100011011110010000001100101011011010110100101110111011100000011010001101101011101010111010100110010011010110111010001110111011010110110111001100110001011100110111101101110011010010110111101101110
01010111011001010010000001110011011010000110000101101100011011000010000001100001011101110110000101101001011101000010000001111001011011110111010100100000011101000110100001100101011100100110010100101110
01000111011011110110111101100100001000000110110001110101011000110110101100101110
00110011001100110011000000110001
```
Then we are just one step away from readable text.
```
"Come to emiwp4muu2ktwknf.onion"
"We shall await you there."
"Good luck."
"3301"
```
Without getting too far down this path though - what is the Gematria Primus? Our hunt is taking us to an onion URL, but we just decoded an image that looks like a rune table. Traveling to the onion page resulted in a text representation of a cicada with a hint that web browsers are useless.
over http
It didn't take long to realize the dated telnet protocol was the answer here. The server accepted a bunch of commands, but it appears the lucky "*hello*" resulted in the output that pushed this puzzle further.
```
hello
A message for you:
0000000:2d2d2d2d2d424547494e20504750205349474e4544204d45535341474
0000041:20200a596f75206861766520646f6e652077656c6c20746f20636f6d6
0000082:0a20200a476f6f64206c75636b2e0a2020200a333330310a202020202
00000c3:6f6e3a20476e7550472076312e342e31312028474e552f4c696e75782
...
Offset: 3301, Skip: 0, Col: 65, Line: 16.
```
snipped for readability - [full file](https://connortumbleson.com/uploads/2021/01/3301%5Fhello%5Ftelnet.txt)
Once again we were given a hex dump of a file. Smaller in size, but still 65 columns so off to `xxd` we went.
```
➜ xxd -c 65 -r offset.msg > output_telnet
➜ file output_telnet
output_telnet: ASCII text
```
This time our journey just resulted in a plain text file. Another message awaited.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Very good.
You have done well to come this far.
xsxnaksict6egxkq.onion
Good luck.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJQ6S0HAAoJEBgfAeV6NQkP/J0QALDqa3VJy9xLLlgI5jPhRIp4
fxebbNhtELOHYFkD5Z9ztQYGle7lKPM8lkMSnciIY059KIi5NSTV7I97sJboG3wt
khHtZgNRw1v2WQ5uurCu5l1w+84/L5Jz2NmElxOBzWr68dlQYt2qfBQxk2zR/fTI
TLCEGvFZtlnrNfBk7jsIyJYcXXPgabS47oP9vOEXlB1+Pm0C7uPPBPN7aqkfUPGl
o1f2hscJf7Je2DvbZt+6exxYsm57Fp953XANAd/UpFVzT/852Xg63gtZrI+Smf3Z
BVcjpCzyH3wS8R0iM+rp02CwJpJzsWGLxeQGmXL2SXBB43zVZAJql5UdXLTGXkbd
nPMd3/CbJ+l7rO0YAg5p3Jf4KauX7Zd6Zc2wHKLOvfjQvEWXIY1CMhI68Bj0rZo/
M/fi313FFTPAm6xhKRv/tH/8wVrar2jY7wnE8XxhRsy74AZ5GqA2oHMefTAq3YuW
5PX8s682J4pkDUKHGa4y65vjIp16pmEInMALJGbwz6mtauBQqlS6ARsQfekDn3oZ
yosS+gWC3jdIvH5s5WUQGVl7jyz9t4+3Tg5cT9Rn6pX2NVNXSxgzXXB4nI2XrrYa
4kQr5aWB8lssav3ryj5Cg2FHl1+MKO0gYv/UF3QT75MixQMu4M+5wCnNekgfuyO6
Zvybzp4s4SzRjkk9sMM6
=WYVO
-----END PGP SIGNATURE-----
```
The onion resulted in a pretty boring output.
```
3301
Patience is a virtue.
```
This was a unique onion as a configuration error led to the leaking of some data. A curious researcher attempted to telnet into this instance and caused an error to spew out.
```
501 Method Not Implemented
Method Not Implemented
abc to /index.html not supported.
Apache/2.2.22 (Ubuntu) Server at li528-4.members.linode.com Port 81
```
What is interesting to note here is the [Linode](https://www.linode.com/?r=e92c46a37fb8d23182a473696f336b261ff2ec78&ref=connortumbleson.com) address. So at least Linode has some billing information on the entity behind Cicada, but I doubt they will share any of that.
So after a period of time. The waiting was over. The page updated with the following message:
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
You already have everything you need to continue.
Sometimes one must "knock on the sky and listen to the sound."
Good luck.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJQ85gbAAoJEBgfAeV6NQkP6joP/iHzBMvK6YZO24wv24RtstGJ
dEMrC9BjtUhrB+F0++sHqWeYuueZ37bDstIoh6EOenRHpECD0QBPTc40aUl2Op1L
4NuUVCUQvfqo/kdWBmSdTP4xGoCtwcXoISfhSM/i+wXqRONSy4z0FrXA3N9yxFaK
eqlNk47aZvyWWHcyYACUEar/V4kfGo8j58r2CisnfeNwat6I6ZfL9P370UVJQyG1
a0WV7rF015TLbwAJkwI1jX7GLPWOkRK3lP8qLJJodNvMPSSyUPyPB01ElgBopm+t
U9bQb/wIGtGG74ezUvwhtDGtXJLWllZtrZx82mQQWzzn8hReqqX0T35idJlTfxIz
aZDNjLCOQJZCngmXEN7iz47w/g67BQ5eoa6iEj7blFwzMwVO7M7pL+L6LZLnuXml
Zv1oDNCuENrIo4j8VGLro9pLptiilsUA6xFRS9bfE7qeeBfmS4J8DScOddzLYNVv
5fKd6iaLJoAqJGkcKnAWPl5VViDhYRL0z1N80zpjm1cWtPBIS2odLMZT80VfMYQI
8XXaEmRqoP8/9EImapqeSk+qcrUkT1+2opKRTOf7754ptjvJq31jQJgeY2gKGtp1
jPXZiu9Pp3QQ5cRKIWIIdOFvcrVtIZ/P3OYhT0p4Z+L13fScUbr/kxI6KcZmY/1D
Szqzyr8SW7zRz1ypGffc
=UPkJ
-----END PGP SIGNATURE-----
```
Immediately I recognize this phrase from Tron, but I don't think that will help much. A "port knock" exists, but that isn't right. A "ping" on a server is an echo from an ICMP packet, so this was pointing at pinging the server and listening to the reply.
Normally though the payload response to a ping is the same as you send. Basically why it "echos" it back. Cicada's server was responding to pings with not one response, but two. This could be called many things from a damaged packet, invalid packet or out-of-band communication so it was clear this was intentional.
In today's age most ISPs are probably filtering these or even blocking them, so this part of the challenge was probably difficult for some.
It took some pings in order to correlate the data message sequences on these extra responses. Combining all those data payloads led to a file that looked like just a blob of data.
```
1f8b080843f5ee5000036d6573736167652e7478742e617363006d93
49b3aa460085f7fd2b582645dd8b80a2bcaa2c804668440691417620
202d43338bfefadc57c92e39db337cabf3f5f52359d59045399a4379
48b354489d55cf9334f5b7f705f4642c7f519e2eb1008030af6b2a23
6dfe4d5137325365b2e4d49d34395524c337005d55372b97e7a5503c
a7fda7f8262d262d001a211955cff7ea27c3f39bdf535fff454b57ff
...
```
[full file](https://connortumbleson.com/uploads/2021/01/3301%5Ficmp%5Fecho.txt)
This output was hex, but missing the offsets that `xxd` normally uses. We could try using `-p` which is a plain text format since this appears to be the pattern going on with this puzzle.
```
➜ xxd -p -r pinged > pinged.out
➜ file pinged.out
pinged.out: gzip compressed data, was "message.txt.asc", last modified: Thu Jan 10 17:07:15 2013, from Unix
```
Sure enough that worked and we now had a compressed data file. So it was time to undo the compression.
```
➜ gunzip pinged.out
gzip: pinged.out: unknown suffix -- ignored
➜ mv pinged.out pinged.out.gz
➜ gunzip pinged.out.gz
➜ file pinged.out
pinged.out: ASCII text
```
Turns out `gunzip` can't take files without extensions. I thought it read magic bytes, but must rely on the file extension. A quick rename to include the listed `gz` compression and we can easily undo it.
We had another message.
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Well done. You have come far.
pklmx2eeh6fjt7zf.onion
Good luck.
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJQ7vVDAAoJEBgfAeV6NQkP9x4P/31A5LPzIhkii8sBjuVxIcOn
4KFQO+uVVsR53zImSqlhq6iVAE9+Ko7vIqjD2whTIUFVYZNBq/92wEZJuCSonovH
HqYZTQihIS9d+QDuwUNvXr4ilrRmITKMrWw3D23rpWs6ZlnehuUDVI8unbN9Zi3h
3hvok3/+/FofLia9Kvbo+FIDi7T9NNRpqepgXd/6dQIP4kn63kKCP20QMdRf2fXF
ZLx5ADS14OvaNFNUAHTJ1qdkPYcdTiNDJkxqk1s82y2doGoEP0ChBUJxlyMiUVXn
1iLOwm2KNrf6If64KxEoetOraWqg9P6l3BjGVPCkrotB608SSs2Lihsa4B0ifI33
ABlpvSDIgpBu/zIO/WFYOfnnrtdvDpVP/Wy+pgqZJ/wOUuhJZhzi5vppjVCm/q9H
C/aXQxa+XXe7his4f9tuIBD1wIYAtnE8M0uDCsfiZjBaZNMnOO7/hOwnNQSBAMcr
KqL5yHSnpI50CtoA+6ycWZURBkrt1rt4eNxsCqQ1XWed/hWbqb6SlJJemJOPbbmt
V5D7iDUO+r2OIUEZTfCSjdzrXcJ8FLtqCGVaLJhCdsyirRHmURwkYLw/B8TpcJQz
qbY6oeDxDosIbE6uhDNV2RVKmpWqLDMhLGHVjkDjJpodE5L3ObbylWuRnHfFqfKH
1mubvMAGo03rxxlY+9XG
=6Sgs
-----END PGP SIGNATURE-----
```
This onion was familiar (when it opened) and included a list of lat/lng locations. They corresponded to:
- Dallas, Texas - USA
- Okinawa - Japan
- Moscow - Russia
- Little Rock, Arkansas - USA
- Annapolis, Maryland - USA\*
- Portland, Oregon - USA
- Columbus, Georgia - USA
```
* = never recovered - bruteforced
```
Running into the world and the poster(s) were recovered one by one.
Little Rock, Arkansas
The posters had a phone number and an access code. Presumably to stop random bystanders from calling and accessing. The automated voice on the other end did not respond to the access code LM (56 on the keypad)
Gematria Primus (L & M)
So finally the weird rune table had a purpose. Plugging in L (73) and M (71) resulted in *7371* as the code and entry was allowed. The automated voice dumped out some verbal data which for Little Rock was:
```
Dataset:13
Offset:13831
Data:5edb5e8029dd2182560da925ec6cd3e1257efc0b8328b4
```
This was (hopefully you see the pattern now) another data blob to be XORed with another data file. The line saying "*Dataset: 13*" must be referring to the file from the ISO - `560.13`. While offset `13821` resulting in the location to reference in the file.
Assuming we are grabbing the same length of the string. We should count the characters of the above data blob from the phone call. Open it up and vim says 46 characters. Knowing that the `-l` parameter for `xxd` works on octets we can assume the default of 2\. So we should do 23 octets of data at offset 13831 ( `0x3607`).
```
➜ xxd -p -seek 0x3607 -l 23 560.13
6ab768f540ad4ff1226fce429b06aa970b119262ec46be
```
Now a quick utility to XOR hex data, but output in plain ASCII. We can leverage GNU tools in PHP to do this with a quick and dirty script.
```
Welcome to your new home. I have a welcome gift for you. Please give me a call at - 877-927-2360\.
>
> Thank you, Alicia :)
I unforunately only took a photo of this letter, but I had gotten many just like it. All with the same exact pattern - some form of message saying I have a gift, that I had just missed and signed with a woman's name.
It didn't take long searching this phone number to come upon a news article titled: [7 Investigates: Housewarming "gifts" tricking homeowners](https://www.ktvb.com/article/news/investigations/7-investigates/7-investigates-housewarming-gifts-tricking-homeowners/277-184755933?ref=connortumbleson.com). Which led me to **Nu Home Promotions, LLC** behind the phone number.
This, according to [Glassdoor](https://www.glassdoor.com/Overview/Working-at-Nu-Home-Promotions-EI%5FIE1355508.11,29.htm?ref=connortumbleson.com), is a company in Arizona with over 200 employees who specialize in telemarketing for which I presume is a call center. Too bad their website is just dead at this time. The history of websites paint a story of how this company used to operate.
April 15, 2016 - [nuhome.com](http://nuhome.com/?ref=connortumbleson.com)
Thankfully the news article above sheds some light on this technique. A free gift at the door with a complex set of legal bindings inside. Should you call the number and enter the confirmation code attached on the gift and you'll find your information sold to all the agencies.
Though what happened to that business model? I didn't get a welcome box, but I got the letter for the gift. My guess being that sending the gift doesn't have much return vs waiting for an explicit "reaching out" from the victim to the company.
We can also peek what the archive shows when the website changed in 2017.
June 6, 2017 - [nuhome.com](http://nuhome.com/?ref=connortumbleson.com)
It appears the company pivoted from just products and services to helping homeowners knock out any of the never ending lists of tasks that appear when owning a home.
---
Though we have to pause a bit, the reason website is offline is an interesting tale.
> Some employees said they were asked to clear off their desks on Monday. In a letter handed to staff members, dated January 30, company officials said they have been "trying for some time to acquire additional financing required to continue its business operations", but that the efforts were unsuccessful.
> [Hundreds out of a job following company closure](https://www.fox10phoenix.com/news/hundreds-out-of-a-job-following-company-closure?ref=connortumbleson.com) \- Fox 10, Feb 2017
What bugs me is that this happened in February of 2017\. Yet I'm getting letters in the mail in 2021 that follow the same exact pattern described above and even match the phone numbers for the company.
> An executive for the company declined to speak on camera Wednesday, and would not confirm the number of people affected by the closure.
> Fox 10 Phoenix, Feb 2017
My gut feeling is that the company was just bleeding money with a borderline gray area scam that could not stay profitable, but the idea could work with less than a few folks. The masses were probably fired and the business fell down to the bare essentials in both brick and mortar and personnel.
### Halo 2: Map Editors
URL: https://connortumbleson.com/2021/01/11/halo-2-map-editors/
Last updated: 2025-02-04T11:43:16.000Z
[Halo 2 - Entity - troymac1ure](https://github.com/troymac1ure/Entity?ref=connortumbleson.com)
As each year ticks by the memories and visible web-pages of the original Halo 2 era of modding fades further away. I [blogged about the patchers](https://connortumbleson.com/2020/04/12/halo-2-patch-format-types/) (ppf, sppf and serenity) - and this time I put my eyes on the map editors of the era. Researching everything about the tools to wrangle together another post to survive the challenge of time.
For those who remember the era - Halo 2 Map Editors took modifications to the next level enabling creations of maps that ranged from funny manipulations of the game to extremely precise and professionally balanced game play.
Map Snippets from [Phantom Mappack](https://connortumbleson.com/2016/05/06/phantom-mappack-project/)
What were the tools behind these creations? Well reverse your clock to the original Xbox era and you'll find yourself with a difficult question. Software didn't auto update behind the scenes, Electron didn't exist and 64bit architecture was just beginning. It would be very difficult to pinpoint which tools generated which mods.
Tool authors may have shared many different versions of tools by passing around compressed binaries as revision control wasn't mainstream yet. So for this post we will take a look at some of the most popular map editors of the era, including some tidbits of knowledge we picked up along the way.
---
dothalo v1.0b3.0 - farklem
You can't talk about map editors without talking about Dothalo and that is where our story begins. We will soon learn that February of 2005 was a major month for tools where many editors made their public debut onto forums across the scene.
Dothalo may have started as H2Edit, but the big red DH logo became a staple for this tool. This tool launched with the support and help from many within the community with a feature set that set the bar high on what a map editor needed to compete. It launched onto HaloMods with:
- Meta Extraction / Injection
- Tag Editing (Supported HMT, HHT, CH2R plugins)
- Dependency Swapping
- Signature Correction
- Bitmap extraction/injection
- Sound extraction
- Hex Editor / Utilities
- Patch creation (ppf)
It also launched with an auto updater, which was nothing more than checking for a `DotHalo.txt` file located on the `halomods.com/bocked/DotHalo` folder. This would download the updated RAR file if the version didn't match and excelled at providing updated versions.
---
Entity Alpha 1.1 - pokecancer / The Tycko Man
Next up we have Entity which is a program that has survived through so many authors and versions - probably because of the released source nature of it. Most versions of Entity released not only included the binary, but the source code itself. In terms of the interface it rocked a 3 column design where the tags held the left column, which the main configurable tools in the middle and all meta information on the far right.
Once Alpha was out in the wild, this attracted the help and attention of many. The next release (Beta) packed more features and some of the more known names of the era helped out in some way in this release. With such a large application, it became one of the first applications in the scene to include some "call home" functionality.
Entity Beta v1.3.9 - "Call Home"
Signing into select versions of Entity back in the day would send an AIM message to either "*mjdpdu*", "*thetyckoman*" or "*pukeanddeadstuff*" using a hard-coded list of accounts to send the message. The accounts sending automated messages had clever passwords such as:
- loser
- halonazi
- l337
To save the curiosity - those accounts have been deactivated for being abandoned.
Entity v1.3.9 - AOL accounts deactivated.
As Halo 2 DLC was released - the clever "*patch.lvl*" files came to light. shade45 ended up releasing what was known as Entity UE 1.6 which built upon the previous versions with features and fixes. Shade also released many fixes in this version which helped with SLC (System Link Compatibility).
I was curious if the different author versions still included the same AIM messaging "call home" feature and sure enough Entity UE 1.6 had the same code as Entity Beta 1.3.9.
Finally, we can't talk about Entity without mentioning Entity 2.0 and [troymac1ure](http://www.remnantmods.com/forums/memberlist.php?mode=viewprofile&u=2649&sid=9efc8ed55bbaff721ef9501d02a4fa01&ref=connortumbleson.com) who started in 2009 releasing updates to the tool and updating it year after year till 2014 on [GitHub](https://github.com/troymac1ure/Entity?ref=connortumbleson.com). While the GitHub inclusion was just massive commits for each release - it was an excellent step in the direction of community based development.
---
ADI & CH2r
Next up, I want to talk about ADI and Ch2r which were some of the first map editors on the scene - I believe the first public release of Ch2r was in November of 2004\. Both allowed tag browsing via a pretty bare-bone implementation of plugins which had begun slightly earlier in the Halo era of tools.
```xml
adlg
Main
0
reflexive
0x0
Dialogs
Dialogs
96
```
adlg.xml (ADI - 2005)
This meant that plugin authors could map out one of the many tags and contribute by simply sharing plugins. Ch2r also used the same design of plugins which was quickly becoming a chance for improvement as multiple iterations of plugins were being designed.
- The above which was code named "xml"
- There were "ent" plugins, a sort of hybrid of the above
- There were "ifps" plugins, the format to withstand test of time
As usual Iron\_Forge rushed to the scene like he did with patchers and signers and contributed a design for a plugin that would survive the test of time. The idea wasn't that different from the current - just extracting some meta information like version, author, revision and the format could automatically generate blank/unknown structs to be filled in later.
This meant you would get something like
```xml
Added basic layout of plugin...
...
```
adlg - snippet - halo 2
Now a decade and more later the design of the plugin has tweaked a bit, but the idea stays the same. We can peek at the public plugin of Assembly Halo3 adlg.
```xml
Generated plugin from scratch.
naming stuff
Responses/Indexes
Updates and corrections
thanks h5
```
[Halo 3 - Assembly - adlg.xml](https://github.com/XboxChaos/Assembly/blob/dev/src/Assembly/Plugins/Halo3/adlg.xml?ref=connortumbleson.com)
Though, lets bring this back to ADI & Ch2r. Ch2r first few builds were quite a departure from what became the norm for map editors.
Ch2r - v0.3 - November 2004
The builds rocked a calculator with basic add/subtraction, endian swap and a plethora of information that isolated around finding offsets and data to help with direct hex editing.
ADI - v1.2c - December 2004
ADI was an upgraded version similar to the popular HHT (Halo Hacking Tools) for the original Halo. I don't believe ADI stands for anything - the author: The Swamp Fox just liked the ring to it.
Much like the other programs around at this time. The big deal was the plugin system which could read dynamic plugin files written for each of the many tag types. For example listed above is the Weapon tag looking at the SMG.
---
Moving onto to more editors we have to talk about Dark Matter, which was produced by pokecancer who also had his hands in Entity, H2X and H2G/H2C. It seemed pokecancer just kept making or helping with new tools that had one specific advantage over another. H2X for example excelled at the weird niche of model injection/viewing while Dark Matter specialized in recursive injection for the "snd!" tag (which was sound files).
H2X - December 2005
Once one tool added support for something - prying eyes added the support to others.
Dark Matter Alpha - January 2005
In the case of Dark Matter - prying eyes weren't needed as pokecancer open sourced it in October of 2005 after losing the drive to work on the tool. My guess is that after intentionally rewriting it to C# didn't leave much effort remaining for the editor itself.
---
We can't talk about map editors without Insolence which any modder in the time would recognize as the only tool capable of tag injecting (via drag n drop). This of course over time would make it to other tools, but if you needed to fix SLC (System Link Compatibility) - chances are Isolence would be used.
Insolence v1 - June 2005
tjc2k4 produced Insolence which can be traced back to a June 2005 release. This editor properly imported data from the single player shared map which basically prevented issues when importing and linking tags. It additionally packed an auto update system for plugins, but most modders only used Insolence for tag importing as it was known commonly to "break maps".
It was unfortunate for tjc2k4, but the era of open source and revision control wasn't thriving yet. A computer crash took down his computer and all the source code with it. Working with an old source copy that Aequitas provided he would go on to release Insolence Map Studio in November of 2005, but the project never really took off or stabilized.
---
Halo Mutator - dfmjw - February 2007
We can continue to talk about editors like Halo Mutator which was the first mainstream Java application map editor. It came out in February of 2007 and had most of the features from all the previous editors in one tool plus some unique features like a built in FTP browser.
The language (Java) behind this editor was unique at the time as most of the tools discussed so far lived in the Microsoft world of Visual Basic and C#.
---
Profane by Prey
As the years moved on tools continued to be released and Profane was no exception. Created by Prey and released at the same time as Blu, Menu Menu Menu & Visual Scenery Mover. This was December 2006 and Profane was a map editor that was not even 50% complete, but it was built from scratch and didn't share any DLLs from any of the previous editors.
The tool resembled a bit of Entity but otherwise continued the trend of using Sandbar. While still a beta piece of software, the communication on pieces remaining to be done was very well communicated. Prey's builds of Profane frequently included a progress page of features remaining or completed.
April 2007 Profane To Do List
Strangely only one of the tools a decade later that won't open on my Windows 10 machine due to complaining about a missing "Dark.Globals" reference.
---
Before we move onto more editors - we have to talk about how every editor discussed thus far worked by directly editing the `.map` file. The map file was a cached/compiled file - which a good example would be a compiled final JavaScript `app.js` file that may be been generated from hundreds of Typescript files. You can obviously painfully edit `car.js` in that state, but it would be much easier to edit like `Hood.ts` and `Wheel.ts`.
Rough picture of a map file structure.
The map file was being mapped out, and as usual Iron\_Forge [released](https://xboxdevwiki.net/Halo%5F2?ref=connortumbleson.com#Map%5FFile%5FFormat%5F.28Iron%5FForge%5Fwhitepaper.29) a good chunk of research in November of 2004\. This is what led to the many tools we've talked about above. Though talented modders started thinking - *what if we don't edit the map file directly?*
This would mean disassembling the map into parts, modifying those and then rebuilding it back into a cached `.map` format. This would require understanding the entire format, but would open up modifications to new levels.
H2C/H2G
So now we enter H2C / H2G, which was H2Core & H2Guerilla. These tools were released by Anthony, Brok3n Halo & pokecancer and were very unique. The idea was that H2Core would disassemble a map file into meta files. Those meta files could be opened/edited within Guerilla and rebuilt into a `.map`.
This tool wasn't quite understood with the population with only a few tool authors understanding the complexity behind it. There were two versions of the tool passed around known as the 3-7-7 Release & 4-2-7 Release. If a mod was released with a BSP conversion - chances are H2C/H2G played a part.
---
For this next tool we have to turn the clock years later to 2009 when [Grimdoomer](https://github.com/grimdoomer?ref=connortumbleson.com) was hinting at Mutation launching. It was a strange piece of software that had more forum threads and posts about progress than an actual binary. Once released it promised to basically be what H2C/H2G attempted to be with more stability.
[Mutation](https://github.com/grimdoomer/Mutation?ref=connortumbleson.com) (GitHub) - August 2010
The UI was the classic DevExpress toolkit of UI elements, but this software included wizards, a log of output/warnings and a good set of quality of life software enhancements. It could submit feedback and bugs as well which would have been perfect if the tool and community hadn't fallen to under 50 people.
The idea of the tool was similar to H2G/H2C - dissemble a map into pieces, edit those pieces within Mutation then compile them back into a `.map` file when ready. This editor (at launch) was slow, but granted you gave it a clean map file to start with - it worked. 10 years later using the editor - it only took 20 seconds to disassemble my map, but that would be expected with the increase in computer specs.
Bugs existed with shoving dirty map files at it, but with plenty of different tools that could have corrupted the `.map` file it would be difficult for Mutation to handle every map possible.
Many were excited for Mutation, but by the time it launched the crowd around Halo 2 was limited to just a handful of folks and it never truly got to shine. Though an impressive piece of software that a decade later could still be opened, decode Ascension and rebuild after some random tag changes.
---
Continuing this train of talking about unique map editors. We have to talk about Prometheus.
[Prometheus Alpha](http://geeklit.blogspot.com/2005/12/prometheus-future-of-modding.html?ref=connortumbleson.com) \- December 2005
[Prometheus](https://github.com/HaloMods/Prometheus?ref=connortumbleson.com) was never actually released for the masses. A few builds might have gone to a few folks, but by the time the source was released onto GitHub by [kornman00](https://github.com/kornman00?ref=connortumbleson.com) we could finally see [rewritten](https://github.com/HaloMods/Prometheus?ref=connortumbleson.com) [source](https://github.com/HaloMods/ProtoPrometheus?ref=connortumbleson.com) of the mystic software rumored for years. However, it was a decade later so only those around during the original era would remember the occasional voice hinting at Prometheus.
Building Prometheus a decade later is a challenge for any, so our only remaining proof is the above screenshot from a personal beta build.
---
There were plenty of other map editors like:
- Excalibur by OwnZ joO (*RTH Built in*)
- Abide by Click16 (*for RC builds of Halo2*)
- Incompetence by Shalted (*for Linux*)
- Oxygen by bcnipod (*for Mac*)
- Sunfish by JacksonCougar (*An attempt at disassembling/compiling*)
However, the test of time has taken a toll on these with not much details to go on. With that, I'll end this deep dive into the Halo 2 era of `.map` editor programs. If I messed anything up or you can correct something I said - feel free to leave a comment or contact [me](https://connortumbleson.com/author/connor/). This is only the beginning - more Halo scene history blogs to come.
### Environmental Water Resource
URL: https://connortumbleson.com/2021/01/04/environmental-water-resource/
Last updated: 2025-02-04T11:43:16.000Z
Buying a home is asking for the most amount of letter spam ever. Shown above is the notice I got. The full text for searching is
> **Water Update!**
> Unfortunately we were unable to reach you by phone or in person. Upon receiving this notice we ask that you contact our office within 72 hours.
>
> Office Hours
> Mon-Fri 9am to 6pm
>
> Water Resource Dept. Jack Travis
> 352-346-5943
Now after growing up with the explosion of email spam, text spam and more - it is pretty obvious when you get a real piece of spam in the mail.
This threw so many alerts in my head:
- A postcard as the means of contact.
- My address/name just a sticker on the postcard.
- No company website listed
- No details why I should contact just generic "Water Update"
- Claimed I missed a call and in person contact. (Working from home so no)
- 9am to 6pm hours (Government entities must be 8-5)
So I called the number to see how far this rabbit hole went. Jack Travis was currently "with a customer" so I could not speak with him. I couldn't glean much from the call as the only piece of information interested from the other end was asking for my name and address.
Which is quite strange to ask for if you are masquerading as a government entity in order to gain entrance to a home, but a needed piece of information to get a salesman over.
So I hung up & did some digging.
---
Behind 352-346-5943 I stumbled upon the [Better Business Bureau](https://www.bbb.org/us/fl/spring-hill/profile/water-purification-equipment/environmental-water-solutions-0653-90011818?ref=connortumbleson.com) which had an alert across the top of the page.
> *Consumers have reported to the BBB that they have received a deceptive advertisement from this business that appears to be from a government entity. The advertisement states you must call the business within 72 hours regarding your water.*
>
> *BBB has contacted the business regarding their advertising practices. The business states that there is no misrepresentation in their advertising.*
Which just further proved my concerns that this company uses deceptive tricks to get in the door. Sell an overpriced product, push the loan to a 3rd party and prey on continued funds from "maintenance" and the high interest.
I then found an article from the city of Tarpon putting out an alert about this company.
[Patch.com](https://patch.com/florida/tarponsprings/tarpon-police-water-update-not-from-city-county?ref=connortumbleson.com) \- Tarpon Police: 'Water Update' Not From City, County
What made this even more perfect was one comment on the article from Dan himself (who is involved with the company).
"Dan" from Environment Water Resource
Now this is just a hilarious response. I can't tell if Dan was using speech to text or had never been in front of a keyboard before as this was the largest run on sentence I've ever seen. Not to mention he seems to be lying. Nothing on the postcard mailed to me says anything about a free analysis. It is intentionally vague and preys on the fact I may assume it is from the city.
I'm more interested in this company though, so a few more searches from that phone number led me to their website.
http://www.makemywaterbetter.com \[domain behind letter\]
I didn't know WordPress could be changed to look so boring, but this page also had a hint of scummy behavior with most pages all pointing to the same "Contact" page.
http://www.makemywaterbetter.com/contact/
It bugged me that the email was a domain - until you clicked on it. That resulted in the email: `wtrboy2001(at)aol(dot)com`. I didn't even know AOL still had email, but pretty unprofessional to use a generic AOL email for your company website.
So I started reading some reviews and it wasn't good. It appears this is how it goes down:
1. You (Victim) call company accidentally because you were mislead by fake advertising.
2. Them (Company) say "Jack" is not available right now helping a customer, but offer to get "x" to drop by for a free inspection.
3. Free Inspection shows up to claim x,y,z is wrong with your water. This may be true or an exaggeration.
4. Attempt to sell water purification for thousand of dollars at a near 20% interest rate and/or other plans.
5. Sell maintenance for the product which is more so than needed charging every time.
---
Back of Postcard-
I'll end this blog with a short snippet - **don't use this company**. They are not the water company and just spamming homes with postcards that were recently purchased.
EDIT: - From an email tip it appears this company may come in as the following on the postcard:
- Environmental Water Solutions
- Environmental Water Resource
### Running CAT6 (Part 2)
URL: https://connortumbleson.com/2020/12/28/running-cat6-part-2/
Last updated: 2025-02-04T11:43:16.000Z
Photo by [Jordan Harrison](https://unsplash.com/@jordanharrison?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is Part 2 of a journey of wiring CAT6 into an older home. If you missed [Part 1](https://connortumbleson.com/2020/12/21/running-cat6-and-failing/) \- feel free to check it out prior to reading this article.
Hole in vaulted ceiling - cut out
Where we left off last was a hole in the ceiling and some damaged drywall. A larger hole was cut out to accomplish two tasks - finish the wiring itself & patch the damage.
It turns out it is difficult to make a perfect rectangle on a vaulted ceiling 14ft in the air. Judging from the photo above you can tell there is quite a bit of distance until the wall. I was nervous going up the ladder if the cable I ran would even be in arm's reach.
So the first win of the day was seeing the snake and dual CAT6 cables I threw into the corner before I left the attic on day 1 of this project. So immediately a sigh of relief, because I figured my only remaining task was to lean over the edge - drill a tiny hole and drop the cable down.
---
This wouldn't be a blog post if it was that easy. My first issue was the distance before the double 2x4 to drill through was at least 1ft below the attic ground level. So imagine standing near the top of a ladder leaning across 1 panel of drywall to look down a 1ft gap while holding a drill to find a place to drill.
Immediately it became obvious that you could not drill through the entire wood block. It felt like there was a concrete/stone block right after the wood - whether that makes sense or not I could hit the concrete block from the snake below and attempt to drill into it from above.
So I started doubting where to drill. Looking at the above photo the top portion is the exterior wall so it isn't that and the middle wood block is right on top of the concrete blocks. I don't think I'm intended to drill through every single concrete block on the exterior.
That only leaves a tiny 1 inch gap which you can see at the bottom of the image between the drywall and the exterior wall. It was very difficult to drill in that location at the top of the drill would prevent a perfectly straight drill. Not to mention I couldn't even drill it with the size bit I had.
So after a trip to the store for a masonry 18" bit - I was back and immediately drilled through the masonry block and my drywall :(
So now I had a hole in my wall like 2ft down from the ceiling, but at least there was a hole in the masonry. I ended up cutting out a box to remove the damaged drywall to patch, then could use this hole to help find my snake when trying to push it up from the ground.
From the photo above this also had the benefit of seeing my two CAT6 cables pushed through the concrete block and into the wall space. At this point it was an easy job, just patch the cables and mount them into the bracket.
Unfortunately the damage that remains to patch:
- Two wrongly placed junction box holes to patch
- One hole near ceiling (pictured above)
- Large hole in vaulted ceiling
- Damaged drywall on ceiling near large hole
At least the speed test worked on both ports :) - The gig line was working first try, but now I have many mistakes to patch and fix up.
### Running CAT6 (Part 1)
URL: https://connortumbleson.com/2020/12/21/running-cat6-and-failing/
Last updated: 2025-02-04T11:43:16.000Z
Photo by [Gavin Allanwood](https://unsplash.com/@gavla?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
So after moving to a home and getting gigabit connection - the wireless signal around the home could be better. Yes, a cheaper solution would have been a mesh wireless network but I wanted wired in my office and the eventual location where a nice TV setup will be.
So the first step for me was to hire someone to do this and that turned out to be too difficult. Calling place after place resulted in the same outcome - "*We won't run residential cable in an old home for 1 or 2 drops."* There were a few options on craigslist for $90-$120 an hour, but with a couple Reddit threads saying this might take a solid 5-6 hours - means some money would be spent.
So I decided to do it myself - this is the journey.
---
**The** **Materials**
So at first after watching videos, I knew that a low voltage box bracket would be needed to nest my cable. What I didn't know if I needed one that mounted directly to a stud or drywall. So I picked up both the [Carlon SC1000A](https://amzn.to/2Ja3uAK?ref=connortumbleson.com) (stud) and [Carlon SC100RR](https://amzn.to/3nAflHi?ref=connortumbleson.com). Turns out that the one on the left with my drywall placement is much easier to use. I imagine if you are building a home you use the on the right and then build the drywall around the boxes.
Now I needed the actual tools and cables associated with CAT6 which ended up being:
- [500ft CAT6 Riser Cable](https://amzn.to/37y5c8c?ref=connortumbleson.com) \- $75.00
- [Klein Tool Set - Twisted Pair, Punch down, Crimper, Stripper, Plugs](https://amzn.to/37AGUuA?ref=connortumbleson.com) \- $39.97
- [CAT6 Plugs (25 set)](https://amzn.to/2J6g7g1?ref=connortumbleson.com) \- $12.59
- [CAT6 Jacks (10 set)](https://amzn.to/2J91XLe?ref=connortumbleson.com) \- $15.99
- 2 Patch Cables (3ft) - Not needed
Turns out I'm an idiot buying patch cables when I can just make my own cables with all the tools above. I just overthought that when purchasing materials. The quantities could have been less in some departments, but I figured I might mess up and/or do this again.
Next up I needed everything to make holes, traverse an attic and more. So I picked up:
- [A full body suit](https://amzn.to/2WzylJU?ref=connortumbleson.com) \- $15.99
- Tape
- [Steel fish tape](https://amzn.to/3mAovSE?ref=connortumbleson.com) \- $21.19
- [Drywall Knife](https://amzn.to/2Kk8uDe?ref=connortumbleson.com) \- $6.69
- Gloves
I figured a full suit designed for painting would help protect from loose insulation and generally just keep a layer on me from all unknowns of an attic. So now I had everything I needed.
---
Now the goal was to extend the CAT6 into the room shown above from my office. This had many problems to overcome:
- Exterior wall Office/Porch
- Exterior wall TV/Outside
- Vaulted Ceiling (TV area)
Then problems encountered during the cabling:
- Very small attic opening (6-8") in vaulted portion
- 2x4 sealing gap between drywall at top
- Existing wire stabled to studs
It was quickly learned in the attic how confusing some of this was. Most of the existing cables were following a T shape. Where they dropped in the attic, went horizontal along a stud then dropped down. This meant that simply pulling out coaxial/phone to swap for CAT6 was not feasible.
It appears that an attic just becomes a graveyard for all cabling - I saw coaxial everywhere with both Frontier & Spectrum labeling. After a long grueling process realizing that taping CAT6 to an existing phone line and pulling from attic wouldn't work a new hole was made in wall. The snake could go up to the attic and be heard, but the 2x4 over wall made it very difficult to isolate exactly where it was.
My idea was to drill a hole in the attic in my best guess location, turn off the lights in the below room and see if a light could be seen from below from shining in attic. That worked which meant the drop could occur. The snake was brought into attic and fished downward to the hole in wall. Once grabbed the CAT6 was disconnected and snake retracted.
So using the same twist tie color (red) as the various points in attic and both ends would help me or some future homeowner identify this cable. Just match the colors and good to go. Crimping cables and building a few jacks wasn't difficult just took a few tries to understand how all the tools work together.
So one side down, just the vaulted ceiling to go...
---
This ended up being the failure as I poked a hole through the ceiling when trying to navigate the small portion of the vaulted slanted ceiling. So lets set the stage.
- 150ft CAT6 (x2) in the attic to be carried
- a backpack of phone/twist ties/drill bits
- a full body suit
- gloves
- a corded drill with 150ft of extension cable
- darkness (flashlight)
Getting into the attic was easy and navigating the almost standing height was also easy, but then you hit this portion (picture above) where you either have to army crawl across beams or navigate a weaving under/above supports as you make your way to the other end of the house.
Yes, my goal was to make it to that reflecting box you see at the end. It was 17 supports to pass which was a grueling hot journey. Just to make it to the end and realize I had to traverse 6-8ft down a vaulted ceiling which shrunk down to a literal foot of space towards the end.
Accessing my phone at this point or anything else became impossible. I was balancing between trusts using my elbows and knees to keep my weight off the drywall. Once I tried to grab the CAT6 to move closer to wall - I lost my grip and let my full weight onto the drywall and boom - it cracked. Thankfully I heard the noise and regained my grip, but falling 16ft on my back didn't seem like something I wanted to continue.
So the day was over feeling defeated with a hole in the ceiling, so it was time to regroup and plan on just cutting a larger hole (to both fix the problem and finish the wiring). That part of the story will have to wait as that is what I'm attempting to do tomorrow.
[Part 2](https://connortumbleson.com/2020/12/28/running-cat6-part-2/) is here.
### Dependabot Pull Requests
URL: https://connortumbleson.com/2020/12/14/handling-dependabot-pull-requests/
Last updated: 2025-02-04T11:43:17.000Z
ini - pull request to \[redacted\] project.
So for this blog I want to run through my checklist & brain dump when a security pull request comes in. For a little background, the [Dependabot](https://dependabot.com/?ref=connortumbleson.com) project was automating detection of vulnerable dependencies and automatically producing a change to the project to resolve it. It cost money, but then GitHub [acquired it](https://dependabot.com/blog/hello-github/?ref=connortumbleson.com) and gave it to everyone for free.
So in short - every single project owned had it enabled overnight. Since the ecosystem for child dependencies in both PHP & Node became unmanageable. Lets take the above project "[ini](https://github.com/npm/ini?ref=connortumbleson.com)". What is it? I sure as hell never installed it directly.
Right off the bat, it lives in the "npm" namespace which is a bit strange. Since it seems strange that npm itself would be hosting a project. We can take a look at the `package.json` and it wasn't always this way.
```
"url": "git://github.com/isaacs/ini.git"
```
So the project lived at `isaacs` namespace and then moved to `npm`. I can't find any authoritative source that explains the exact reasons this happens, but there are 322 other repositories under `npm` so I imagine it happens for crucial dependencies that become slightly abandoned. To prevent the accidental project takeover, abandonment and/or deletion.
So lets figure out why I even have this package. Since if it's unused - lets drop it. Yarn has a helpful command known as "*why*" that will do just that.
```
➜ project git:(master) yarn why ini
yarn why v1.22.5
[1/4] Why do we have the module "ini"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "ini@1.3.8"
info Reasons this module exists
- "laravel-mix#webpack-cli#global-modules#global-prefix" depends on it
- Hoisted from "laravel-mix#webpack-cli#global-modules#global-prefix#ini"
- Hoisted from "laravel-mix#webpack-cli#findup-sync#resolve-dir#global-modules#global-prefix#ini"
info Disk size without dependencies: "20KB"
info Disk size with unique dependencies: "20KB"
info Disk size with transitive dependencies: "20KB"
info Number of shared dependencies: 0
Done in 1.05s.
```
Turns out this dependency exists because of [Laravel Mix](https://github.com/JeffreyWay/laravel-mix?ref=connortumbleson.com), which requires [Webpack CLI](https://github.com/webpack/webpack-cli?ref=connortumbleson.com), which requires [Global Modules](https://github.com/jonschlinkert/global-modules?ref=connortumbleson.com), which requires [Global Prefix](https://github.com/jonschlinkert/global-prefix?ref=connortumbleson.com) which requires finally - [ini](https://github.com/npm/ini?ref=connortumbleson.com). If that was complicated to read, we can leverage `npm` for a tree view.
```
➜ project git:(master) ✗ npm ls ini
/home/ibotpeaches/Projects/PHP/project
└─┬ laravel-mix@5.0.9
└─┬ webpack-cli@3.3.12
├─┬ findup-sync@3.0.0
│ └─┬ resolve-dir@1.0.1
│ └─┬ global-modules@1.0.0
│ └─┬ global-prefix@1.0.2
│ └── ini@1.3.8 deduped
└─┬ global-modules@2.0.0
└─┬ global-prefix@3.0.0
└── ini@1.3.8
```
So basically this dependency is in use because something 4 layers deep than a direct dependency uses it. A bit scary, but that is the ecosystem we live in. It isn't feasible to audit all code that every dependency uses.
---
So now we have the security pull request above, which correlates to a low severity prototype pollution.
[npm advisory #1589](https://www.npmjs.com/advisories/1589?ref=connortumbleson.com)
So we can see I was running version *1.3.5* and now being upgraded to *1.3.8*. The advisory will even show me the exact commit that fixed the issue, but I'm not too interested in that. I want to quickly scan the diff between what I have and what the new version is to look for nefarious changes.
Thankfully, GitHub and Dependabot offer a [compare view](https://github.com/npm/ini/compare/v1.3.5...v1.3.8?ref=connortumbleson.com) to examine the diff.
[ini - v1.3.5 - v1.3.8](https://github.com/npm/ini/compare/v1.3.5...v1.3.8?ref=connortumbleson.com)
This is a lot of changes (9 files, 11,224 additions and 3,650 deletions) to review. Thankfully looking at the diff we see the majority of changes occur in the `package-lock.json`. A security fix that is also updating its dependencies is slightly alarming, but a quick inspection shows its all dev dependencies.
With that I see tons of changes in regards to CI/automation and linting. This means that most files have spacing changes, but after some scrolling you can spot the security fixes.
[Direct commit to fix - ini](https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1?ref=connortumbleson.com)
So after a quick examination everything looks safe. With the amount of scrutiny put into checking a security upgrade sanctioned by GitHub - it probably is unnecessary. Since I don't exactly do this to every 1058 package I have during a `yarn upgrade` command.
Thanks to GitHub & Dependabot
### The Business Evolution
URL: https://connortumbleson.com/2020/12/07/the-business-evolution/
Last updated: 2025-02-04T11:43:17.000Z
Photo by [Peter Bond](https://unsplash.com/@pvsbond?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
When this post goes live, it will have been 315 days since this pandemic began. One thing that has become painfully truthful for some is that the business landscape has changed.
I remember in the first few weeks of the pandemic when in-person dining was removed, nearly every restaurant had pick-up, delivery and/or was loaded onto some of the various Uber Eats methods. Outside of having to spend a bit more money the amount of food options now on these services exploded and became quite tempting. Those businesses who didn't evolve with the quickly changing scene - probably found themselves in a tough situation.
House of Burgers (Shamrock's Ale House)
Another interesting thing I discovered is one day scrolling Uber Eats I saw a "*House of Burgers*" restaurant to order from. It was in a location that I pass frequently and never remember seeing it, turns out its just the re-branded delivery only service building - Shamrock's Ale House. Is this just the food from Shamrock's re-branded? Or is this an establishment using the infrastructure of the brick and mortar building to prepare food? - I couldn't figure this out in my research and was too lazy to call someone to confirm.
---
Next up is the movie industry which was shaken up for sure. No longer feasible to sit in an indoor room for hours in close proximity to others. The first change was the ability to just buy out an entire theater for you/friends. The price tag for this varies by location, but cheaper than I would have thought.
It seems the drive-in movie attracted a lot of attention early in the pandemic with the safety of staying in/around your own vehicle outdoors while watching a movie. These theaters seem to be busier than I ever remember driving by, so good to see an older business is making a comeback.
The biggest bombshell news though in the movie industry was Warner Brothers [announcing films](https://pressroom.warnermedia.com/us/media-release/hbo-max/warner-bros-pictures-group-announces-innovative-hybrid-distribution-model-its-2021?ref=connortumbleson.com) released in 2021 would be straight to digital. They may give some exclusivity to HBO Max for the first month of each film, but otherwise films will release on a digital ecosystem.
I'm excited for this because the large ticket price to drive somewhere, get the movie [experience interrupted](https://connortumbleson.com/2019/04/29/the-movie-experience/) by randoms munching down on hugely overpriced food is just not as tempting anymore as I age older. [AMC is not happy](https://finance.yahoo.com/news/amc-starts-urgent-dialogue-with-warner-bros-over-its-plan-to-put-all-its-2021-movies-on-hbo-max-125942687.html?ref=connortumbleson.com) with this as it threatens their business model - so we may see some changes continue in this space.
---
Finally, the remote era is here and I wonder how much is going to stay. Tons of jobs seemingly overnight learned they can be done remotely without an office. Turns out adults can be trusted to do what they are paid to do without being somewhere.
This of course though requires a solid Internet connection and more than likely a video camera of some sort. This is where things got shaky - overnight people realized their Internet was not good enough to support a streaming video connection and/or dropped frequently. This is 2020, we are in America and yet our Internet infrastructure at times feels embarrassingly weak. Businesses and lifestyle continues to change as COVID-19 lives on and I wonder what changes will be here to stay.
### Apktool v2.5.0 Released
URL: https://connortumbleson.com/2020/12/02/apktool-v2-5-0-released/
Last updated: 2025-02-04T11:43:17.000Z
Apktool v2.5.0 has been released! This is a long overdue release that fixes many long-running issues.
The last release was way back on November 29, 2019 and by the time this version is released - It will have been over 1 year since our last Apktool release. So what happened?
Honestly a combination of 2020, burnout and life changes. None of which are important to this release post. Though if you are interested - I [blogged](https://connortumbleson.com/2017/05/01/the-human-behind-the-keyboard/) about some of the burnout of long-running open source projects.
Let's talk about maintaining a backlog. Apktool prior to this release had over 250 tickets ranging from 8 years old to 1 day old. It was frankly insane. Some of the topics hadn't even been responded to in years. So I spent [roughly 20 hours](https://twitter.com/iBotPeaches/status/1333065159552757760?ref=connortumbleson.com) over Thanksgiving and went **through every single ticket**. The backlog is now 40 tickets, organized and ready to be fixed. Some tough choices were made on a handful of tickets, but I had to be realistic when it came to fixing some of these anti-tamper issues.
I wouldn't have done this without the help from "peret" who helped build aapt/aapt2 binaries for me on Mac. For some reason (still to this post) a few select repositories cloning from AOSP result in:
```
RPC failed: HTTP 499 curl 16 Error in HTTP2 framing layer
```
This was blocking me for months from completing the release. However, that is enough meta discussion. Apktool development is active again, a smaller backlog has me hooked and a helpful community of authors will keep the discussions and features going.
So lets talk about the changes.
---
This release packs in Android 11 support, which will require a framework update as well as upgrading to the latest and greatest [smali](https://github.com/JesusFreke/smali?ref=connortumbleson.com) project. We embraced GitHub Actions dropping TravisCI and started the deprecation process for 32 bit machines. (Sorry, AOSP is pushing me here)
Error messages were overhauled to help explain why things aren't working. Test cases were enhanced to prevent regressions and each pull request is automatically tested again all 3 major operating systems and a variety of Java versions.
The obfuscation war never ends and Apktool v2.5.0 makes leaps of improvements when it comes to parsing files. Apktool will survive when all namespace references have been removed. Apktool will survive with dummy resources if all resource names have been stripped. Apktool will also survive if all resources have been tweaked to the same name. This of course makes compilation very difficult, but at least the application can be disassembled now.
Binaries for aapt/aapt2 received another great set of patches aiming to lessen the errors that either will encounter during compilation. This led to patching many compression related bugs when it comes to rebuilding applications as well as patching many crashes that result when resources can't be found.
Features were added for the new `compileSdkVersion` property as well as a `apktool list-frameworks` command. Finally, some quality of life enhancements for error codes, helper scripts and copyrights. So with that, the detailed change log and author breakdown.
---
**This release had 180 commits by 11 people**
- Connor Tumbleson (iBotPeaches) - 160 commits
- Giacomo Ferretti (giacomoferretti) - 4 commits
- Frieder Bluemle (friederbluemle) - 3 commits
- Peter Retzlaff - 3 commits
- Ankit Pati (ankitpati) - 2 commits
- Comnir (Nir) - 2 commits
- Leo Wandersleb (Giszmo) - 1 commit
- Patrick Decat - 1 commit
- Steven Arzt (StevenArzt) - 1 commit
- Taras - 1 commit
- chris-sharl - 1 commit
- vladimir (vldmrrr) - 1 commit
# Changes since 2.4.1
- \[[#2399](https://github.com/iBotPeaches/Apktool/issues/2399?ref=connortumbleson.com), [#2397](https://github.com/iBotPeaches/Apktool/issues/2397?ref=connortumbleson.com), [#2369](https://github.com/iBotPeaches/Apktool/issues/2369?ref=connortumbleson.com), [#2167](https://github.com/iBotPeaches/Apktool/issues/2167?ref=connortumbleson.com)\] Android 11 Support.
- \[[#2006](https://github.com/iBotPeaches/Apktool/issues/2006?ref=connortumbleson.com), [#1718](https://github.com/iBotPeaches/Apktool/issues/1718?ref=connortumbleson.com)\] Upgraded smali/baksmali to v2.4.0.
- \[[#2110](https://github.com/iBotPeaches/Apktool/issues/2210?ref=connortumbleson.com), [#2053](https://github.com/iBotPeaches/Apktool/issues/2053?ref=connortumbleson.com)\] Deprecate 32 bit operating systems.
- \[[#2251](https://github.com/iBotPeaches/Apktool/issues/2251?ref=connortumbleson.com)\] Fix thread crash with binary name collision.
- \[[#2323](https://github.com/iBotPeaches/Apktool/issues/2323?ref=connortumbleson.com)\] Fix compression on `resources.arsc`.
- \[[#2333](https://github.com/iBotPeaches/Apktool/issues/2333?ref=connortumbleson.com)\] Fix crash with empty files during compression. (Thanks peret)
- \[[#2328](https://github.com/iBotPeaches/Apktool/issues/2328?ref=connortumbleson.com), [#2364](https://github.com/iBotPeaches/Apktool/issues/2364?ref=connortumbleson.com)\] Fix debug mode handling with aapt2\. (Thanks Comnir)
- \[[#2386](https://github.com/iBotPeaches/Apktool/issues/2386?ref=connortumbleson.com), [#2217](https://github.com/iBotPeaches/Apktool/issues/2271?ref=connortumbleson.com), [#2119](https://github.com/iBotPeaches/Apktool/issues/2119?ref=connortumbleson.com)\] Fix handling XML files with `$` in name.
- \[[#2300](https://github.com/iBotPeaches/Apktool/issues/2300?ref=connortumbleson.com)\] Fix NPE while disassembling manifest with no resource matching resId.
- \[[#2438](https://github.com/iBotPeaches/Apktool/issues/2438?ref=connortumbleson.com), [#1903](https://github.com/iBotPeaches/Apktool/issues/1903?ref=connortumbleson.com)\] Fix aapt2 with dummy properties of bool(false) to ref(null).
- \[[#2317](https://github.com/iBotPeaches/Apktool/issues/2317?ref=connortumbleson.com), [#2188](https://github.com/iBotPeaches/Apktool/issues/2188?ref=connortumbleson.com), [#1859](https://github.com/iBotPeaches/Apktool/issues/1859?ref=connortumbleson.com)\] Fix non-standard namespaces in obfuscated manifests.
- \[[#1945](https://github.com/iBotPeaches/Apktool/issues/1945?ref=connortumbleson.com), [#2146](https://github.com/iBotPeaches/Apktool/issues/2146?ref=connortumbleson.com)\] Fix NPE when finding referent of a missing resource.
- \[[#2343](https://github.com/iBotPeaches/Apktool/issues/2343?ref=connortumbleson.com)\] Fix error message when framework directory cannot be written.
- \[[#2411](https://github.com/iBotPeaches/Apktool/issues/2411?ref=connortumbleson.com)\] Add tests for `classes[1-3].dex`
- \[[#1913](https://github.com/iBotPeaches/Apktool/issues/1913?ref=connortumbleson.com)\] Added new list frameworks command.
- \[[#2368](https://github.com/iBotPeaches/Apktool/issues/2368?ref=connortumbleson.com)\] Added support for `compileSdkVersion`.
- Updated response codes to properly be non-zero if invalid parameters passed. (Thanks Giszmo)
- Updated license headers to reflect start date of project & remove javadoc style. (Thanks friederbluemle)
- Added support for `JAVA_HOME` variable on Windows helper script. (Thanks vldmrrr)
- Added support for SDK Codename "S"
- Upgrade to gradle 6.4.1
- Replaced TravisCI with GitHub Actions
## Notes
- Applications are becoming more and more difficult to build with aapt1, using the `--use-aapt2` flag during rebuild is a good test.
- There are only 40 issues in the [backlog](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com). Have an idea for a fix? Fancy reviewing some [pull requests](https://github.com/iBotPeaches/Apktool/pulls?ref=connortumbleson.com)?
## Download
- [Apktool 2.5.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.5.0.jar?ref=connortumbleson.com)
- md5 `4958ad93cba461f084a47d5626e2d486`
- sha256 `b392d7cb99b592e9c5acc3c06f1b0f180edde96c66b86b3d6932b7c0c4079fe4`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [GitHub](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [Buy me a ~~Coffee~~ Beer](https://www.buymeacoffee.com/iBotPeaches?ref=connortumbleson.com)
### Dedication
URL: https://connortumbleson.com/2020/11/30/dedication/
Last updated: 2025-02-04T11:43:17.000Z
[iBotPeaches GitHub Profile - Nov 28, 2020](https://github.com/iBotPeaches?ref=connortumbleson.com)
At some point in November of 2020 my GitHub profile showed the message:
> 10,170 contributions in the last year
This was the first time I crossed into 5 digits. After peeking the last few years it becomes pretty obvious that working in the same field that you spend hobby time causes an acceleration of values.
I don't really want to discuss the values themselves because they are useless. In 2011 I might have committed an entire project under "wip". Now 1 file may require 3 atomic commits to properly describe why changes were made.
If we examine the animation for the last year so far, it becomes obvious that I don't do much on the weekends anymore. I'd attribute this to having a job and after 40-50 hours of development during the week - its tough to really sit down and spend another batch of time. I basically traded programming weekends while in school to programming week days at a job.
[The Human behind the Keyboard](https://connortumbleson.com/2017/05/01/the-human-behind-the-keyboard/)
I wrote about why these weekend are on the low side before (link above) and I believe that is the piece that defines dedication.
If you are a soccer player - do you only practice at sanctioned official practice? The real dedicated athletes train outside of practice whether via diet, running or anything that helps.
The same deal applies with programming. You may spend a full week's worth of programming, but I'd venture the dedicated individuals spend a chunk of time outside of work honing skills, working on hobby projects or even balancing another programming gig.
---
Though lets pivot this discussion. Dedication to me is staying with something even if you take a few breaks and I took quite a break from [Apktool](https://github.com/ibotpeaches/apktool?ref=connortumbleson.com). Letting the bug tracker go from 60\~ bugs to 250\~ in the course of a year.
One might just give up at this point and throw in the towel, but that is not dedication to the cause. Paired with 4 days off work due to Thanksgiving - it was a perfect shot.
[Apktool "Pulse"](https://github.com/iBotPeaches/Apktool/pulse?ref=connortumbleson.com)
I went through all 253 issues and now only have 43 remaining. Tickets were tested (if feasible), duplicates collected, some flat out closed and more importantly being honest with the ticket opener if the ticket wasn't going to be solved.
---
Lets pivot again - One of the reasons this post came to me was the Hacker News article titled - "[*Hire people who give a shit*](https://alexw.substack.com/p/hire?ref=connortumbleson.com)". I think the author was looking for the idea of dedication and to really care about a product at a company, but instead it came across quite nasty. Instead suggesting that you should blindly work the amount of hours that a founder might, push overtime and give a shit. In reality, if your employer gives a shit about you - a good employee should give a shit about the company.
I think this is where dedication comes in. You'll need to be dedicated to your field, dedicated to not put shit out the door. Dedicated to improved. Dedicated to improve/learn. The instant you start just working for a paycheck and losing that dedication means you quickly find yourself wondering what happened to a field you liked.
### Destiny 2: Beyond Light Review
URL: https://connortumbleson.com/2020/11/23/destiny-2-beyond-light-review/
Last updated: 2026-01-30T00:57:25.000Z
[Media Kit Image #3 - Bungie.net](https://www.bungie.net/7/en/Destiny/BeyondLight/Media?ref=connortumbleson.com)
On November 10, 2020 Beyond Light launched for Destiny 2 and that was the 4th DLC for the game joining:
- Curse of Osiris (December 2017)
- Warmind (May 2018)
- Forsaken (September 2018)
- Shadowkeep (October 2019)
- **Beyond Light (November 2020)**
If you want to backdate those expansions in comparison with Destiny 1 since this is the same world. It becomes
- The Dark Below (December 2014)
- House of Wolves (May 2015)
- The Taken King (September 2015)
- Rise of Iron (September 2016)
So we've had a solid amount of DLC's to compare against and while only a few are large scale releases - this is the first DLC that actually removed a large chunk of content in the history of Destiny.
Bungie first [alerted to this](https://www.bungie.net/en/Explore/Detail/News/49189?ref=connortumbleson.com) in June of 2020 that Destiny 2 was getting a tad bit difficult to balance and update.
> For example: Warmind’s campaign represents only **0.3%** of all time played in Season of the Worthy and yet the Warmind Expansion accounts for **5%** of our total install size.
> Instead of building a Destiny 3 and leaving D2 behind, each year, we are going to cycle older, less actively played content out of the live game and into what we’re calling the **Destiny Content Vault (DCV)**.
So what exactly did we lose? Well without sounding too harsh - a lot of content.
We lost the following planets/destinations:
- Mercury
- Mars
- Titan
- Io
- The Farm
- The Leviathan
We lost the following activities:
- Gambit Prime (merged into Gambit)
- The Reckoning
- Escalation Protocol
- Black Armory Forges
- Zero Hour
- The Whisper
- Regular Nightfall
- Niobe Labs
- The Menagerie
- Supremacy
- Countdown
- Lockdown
- Breakthrough
- Doubles
- Momentum Control
- Scorched
- The Tribute Hall
We lost the following campaign story lines:
- The Red War (D2 launch campaign)
- Curse of Osiris (D2 DLC #1)
- Warming (D2 DLC #2)
We lost the following season "lore" / "content":
- Season of the Forge
- Season of the Drifter
- Season of the Opulence
We lost the following raids:
- The Leviathan
- Eater of Worlds
- Spire of Stars
- Scourge of the Past
- Crown of Sorrow
We the following exotic quests:
- Relics of the Golden Age (Sturm)
- Sight, Shoot, Repeat. (MIDA)
- Rat King's Crew (Rat King)
- Legend of Acrius (Acruis)
- Nodes and Protocols (Sleeper)
- Nascent Dawn (Polaris Lance)
- Cayde's Will (Ace of Spades)
- The Cleansing (The Last Word)
- A Butterfly's Grace (Le Monarque)
- A Giant's Might (Jotunn)
- A Mysterious Box (Izanagi's)
- The Essence (Thorn)
- Bearer of Evil's Past (Lumina)
- A Scrap of Paper (Truth)
- The Other Side (Bad Juju)
We lost the following crucible maps:
- Meltdown
- Firebase Echo
- Eternity
- Solitude
- Legion's Gulch
- Retribution
- Equinox
- Gambler's Ruin
- Vostok
- Emperor's Respite
- The Citadel
- Cathedral of Scars
- Kell's Grave
We lost the following strikes:
- A Garden World
- Tree of Probabilities
- Savathun's Song
- Pyramidion
- Festering Core
- Strange Terrain
- Will of the Thousands
We lost the following vendors:
- Ada-1
- Benedict-66
- Werner 99-40
- Ana Bray
- Sloane
- Asher Mir
- Brother Vance
- Visage of Calus
Wow. That is a lot of content.
---
So what did we gain with Beyond Light?
- A new campaign
- New Planet: Europa
- Restored Planet: Cosmodrone (From Destiny 1)
- New Subclass: Stasis
- New Raid: Deep Stone Crypt
- Tons of new activities / quests
- New Characters / NPCs
**PVP**
Let's talk about PVP first which was quite a slap in the face. We are talking about Bungie here. The company that literally slapped down Halo in front of the faces of millions and revolutionized the FPS scene can't add a single new map or game-mode on a huge DLC release.
It feels weird - I know Destiny has no competitive scene for a myriad of reasons, but a major DLC to effectively not touch PVP just hurts. So lets briefly talk about the new subclass (Stasis) which I don't think was ever play-tested ever in PVP.
[Streamer Gladd Testing](https://twitter.com/Gladd/status/1326713241897152513?ref=connortumbleson.com)
A good chunk of multiplayer is building up your "Super" which takes a few minutes and then unleashes a mega powerful ability on the enemy. Now shown above shows a class ability that can restores itself near instantly (based on perks) can freeze someone out of a super. Any competent player will kill a frozen enemy.
Forbes even reported on this with - [Destiny 2 Has Hilariously Broken PvP With Stasis In Beyond Light](https://www.forbes.com/sites/paultassi/2020/11/12/destiny-2-has-hilariously-broken-pvp-with-stasis-in-beyond-light/?sh=1080c92267cc&ref=connortumbleson.com). It just honestly blows my mind - did anyone ever at Bungie ever test this? How is this fun? What is the point of the 9 other sub-classes if 3 of them can reign down complete ultimate domination?
Is this a time issue with COVID-19? I know the DLC was delayed once already, but this just blows my mind. Destiny is not a true ability game like Overwatch, but instead relies on guns. However with the launch of Beyond Light and ice formations flying around the map freezing people - this game feels like a pure ability based game now.
[Bungie Tweet](https://twitter.com/BungieHelp/status/1327056486242029569?ref=connortumbleson.com)
To stab the wound even further - the pinnacle PVP mode was disabled until November 27, 2020 for discovered issues. I was hoping the issue was the obviously busted Stasis class, but no it was an infinite super glitch on Warlocks.
On November 19 - a little under 10 days since the release of the DLC marked a new patch ([v3.0.0.3](https://www.bungie.net/en/News/Article/49861?ref=connortumbleson.com)) that ended up nerfing Stasis in PVP. What was interesting to read was the following:
- *Cold Snap freeze duration lowered (was 4.75s now 1.35s).*
- *Ice Flare Bolts freeze duration lowered (was 4.75s now 1.35s).*
- *Penumbral Blast (Stasis Warlock melee) freeze duration lowered (was 4.75s now 1.35s).*
Which generally just begged the question if anyone tested this as being froze for almost 5 seconds in a video game is basically a death wish.
---
**Guns**
I knew something was up with guns when I finished a portion of the campaign of the brand new DLC and I got a Long Shadow sniper.
[Destiny Tracker - Long Shadow](https://destinytracker.com/destiny-2/db/items/3745990145-long-shadow?ref=connortumbleson.com)
Let's talk about this gun. It was added during a manifest update on August 27, 2018 into Season 4 which was the release of Forsaken. It kept receiving perk changes through season 5 through 12 (Beyond Light).
Once again it blows my mind that completing the primary quest line in the brand new DLC results in a gun that is 2+ years old and been around for almost 10 seasons. Like what happened to complaining about just re-skinned models? It has literally gotten to the point that a new DLC just gives you weapons from previous seasons.
So I was curious why this was and went researching on light.gg. The previous large DLC added 98 new legendary/exotic weapons. Beyond Light added 31 - if you ignore the Trials weapons that number is 25\. If you ignore the re-issued Iron Banner weapons (just higher light) that number is 23\.
Forsaken at release day was the same price as Beyond Light but the comparisons are far between. I haven't even started to talk about the pinnacle weapon of this season/DLC which is just a re-skinned Beloved.
Beyond Light - Season Pinnacle - Adored
How come every other season launched these weapons with unique models and perks? The Adored (re-skinned Beloved) is a great weapon no doubt, but it had to be added because of the forced retirement and sun-setting of the previously loved Beloved.
So lets think about this. The Beloved was added during Season 7 and was a drop from The Menagerie. If your memory is right - the Menagerie was removed so you can't get this weapon anymore and the light is capped at 1060\. However the game current power cap is 1200+. So you now have a useless gun that you once paid for that you have to re-earn under a different title.
This bothers me for many reasons. Guns may become outdated and useless, but I can still boot up Destiny 1 to this day 6+ years later and play an old activity with an old gun. This mantra is now different because that old content is gone and the weapon cannot rise with the difficulty.
---
**Forced Delay**
Map of Europa - The new Planet
Let's talk about the new map with my wonderful drawing above. The red drawings notate an area you can spawn in. The first annoyance you'll notice is that most activities require effort in either Eventide Ruins, Asterion Abyss or Cadmus Ridge. So you'll have to spawn in Charon's Crossing and drive through invisible loading screens to the other main areas.
This is obvious game design for an artificial delay. Campaign will take longer if you have to drive a few minutes on every single trip to this planet. Though this is a pattern that isn't new to Bungie. They tried it for the first time for the new planet - Dreaming City back during Forsaken.
Sure enough - I hated it then and I hate it now. When activities are so far from the spawn destination it just becomes a turn off to visit it. I'm past my prime of gaming - I don't want to waste all this time driving around. I want to do what I want with my small amount of time before work.
Now this entire planet is a mess of ice which was cool for the first hour, but now just feels like a bland landscape with very beautiful dynamic weather. I have so many bounties that are asking me to do things on this planet, but I'll have to drive 3-5 minutes to even start completing them so not sure I'll be completing those anytime soon. Seems crazy to say, but the slow creep of delay is just turning me off completely.
---
**Conclusion**
Though what most DLCs are judged from is the continued season support & raid (which launched yesterday). The raid may be fun, but will it stand up to the test of replay-ability or become another Scourge?
### Disqus to Remark42
URL: https://connortumbleson.com/2020/11/16/moving-disqus-to-remark42/
Last updated: 2025-02-04T11:43:18.000Z
Photo by [Jordan Whitfield](https://unsplash.com/@whitfieldjordan?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
About a year ago I posted about upgrading to [Ghost v3](https://connortumbleson.com/2019/10/28/prepping-for-ghost-v3/) and during that upgrade I dropped Google Analytics, because frankly it benefits this data tracking era which I'm not a fan of.
I always knew that I had to get rid of [Disqus](https://disqus.com/?ref=connortumbleson.com), but I just couldn't find a good alternative. I messed with [Commento](https://commento.io/?ref=connortumbleson.com), [Isso](https://posativ.org/isso?ref=connortumbleson.com) and [Remark42](https://remark42.com/?ref=connortumbleson.com) and settled on Remark42 so this post is that journey.
---
**So why leave Disqus?**
I'm sure the answers are the same as any other blogger leaving it. I noticed that my site was loading way too much content for a little personal blog with no ads.
Disqus spamming requests
Like my [Pi-hole](https://connortumbleson.com/2019/07/01/pi-hole) (ad blocker) was having a field day just trying to block all these trackers that slip in when you want to leverage Disqus comments. I can't in good faith subject my readers to the same tools that I despise. Not to mention it is ridiculous that 73 web requests are required to load via a single post.
Once I swapped out Disqus to Remark42 that number was now 31 web requests, which is basically a \~60% decrease in web requests.
Next reason was the rapid changing of Disqus for both good and bad. Reactions was a pretty cool thing, but then Disqus [announced](https://blog.disqus.com/advertising-will-remain-optional-for-over-95-of-sites-on-disqus?ref=connortumbleson.com) ads being added to free plans and a whopping $10/month charge to remove them. I'm not paying more to remove ads from a comment system than my hosting.
It turns out though once the details came out, personal blogs and a few other categories still had a choice to not run advertising so this blog never actually saw ads so I wasn't forced to run any or pay.
Finally, I just got tired of running 3rd party tools. I like self-hosting my own Ghost blog with everything there. If I die that blog will continue to run till my Linode server dies instead of depending on multiple 3rd parties.
---
**So why Remark42? Why not Commento or Isso?**
This snippet is probably why you stumbled upon this post and I gave a good deal of research into them all.
[Commento Homepage](https://commento.io/?ref=connortumbleson.com)
**Commento**
- \[Pro\] Very clean UI, professional looking website.
- \[Pro\] [Mozilla Sponsored](https://blog.mozilla.org/blog/2018/01/23/moss-q4-supporting-python-ecosystem/?ref=connortumbleson.com)
- \[Pro\] Self-Host
- \[Con\] Required Postgres
- \[Con\] Author disappeared for 7+ months and counting
So the main reason I didn't pick Commento was the look of abandonment from the project from the author. I'm no stranger to open source projects, but I still respond to issues even when I'm taking a break from development. I didn't want to pick something that would eventually just slowly die.
Additionally, it required Postgres and my blog is MariaDB so I didn't really want to run two different large databases. I wouldn't mind something small like SQLite, but this was too large to pair on this server.
---
[Isso Homepage](https://posativ.org/isso/?ref=connortumbleson.com)
**Isso**
- \[Pro\] SQLite backend
- \[Pro\] No hosted plan, so just open source offering
- \[Pro\] Very active development
- \[Con\] Debian packages outdated
- \[Con\] Documentation is rough
- \[Con\] Initial setup is painful
So Isso was doomed from the start from probably my own mistake of running - `apt-get install isso`. It was silly of me to think a package install would be up to date as the tool itself. The issues began during the import step where I had all these errors and I learned it was because my install was in multi-site mode.
I was only intending to use it for my own blog, but figured I could just configure in multi-site mode with my site being the only. That worked, but then I stumbled upon a new error about running it in a sub-directory vs subdomain.
I put myself in these errors and I didn't want to bother an open source project with more support - as it was probably self inflicted. Though, it turned me off from the project. I didn't want to continue to mess with a tool that I thought would be an easy install whether my fault or not.
---
[Remark42 Homepage](https://remark42.com/?ref=connortumbleson.com)
**Remark42**
- \[Pro\] BoltDB much like SQLite
- \[Pro\] Easy environment based configuration
- \[Pro\] Very large Readme
- \[Con\] UI not the prettiest
- \[Con\] All configuration through the comment system itself
Remark42 felt differently because it honestly just worked. I launched the binary and got told I was missing a parameter, thus added it and started it again and it was running! All I had to do was setup a reverse proxy on the port it was listening and make a quick systemd service and I was set.
```nginx
server {
server_name remark.connortumbleson.com;
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
location / {
proxy_redirect off;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_pass http://127.0.0.1:8080/;
}
}
```
nginx.conf
```
[Unit]
Description=remark42
After=network.target
[Service]
User=remark42
Group=remark42
EnvironmentFile=/var/www/remark42/remark42.conf
WorkingDirectory=/var/www/remark42
Restart=always
RestartSec=3
ExecStart=/usr/local/bin/remark42
[Install]
WantedBy=multi-user.target
```
remark42.service (systemd)
The import from Disqus was easy with a simple command to remap URLs so it would detect comments on the new system. The `rules.txt` was as simple as
```
OLD_URL NEW_URL
OLD_URL/path/* NEW_URL/newpath/*
```
```
remark42@dune:/var/www/remark42/var# remark42 remap -f rules.txt
remark42 master-71dcb13-20200426T12:41:26
2020/11/07 01:50:08.243 [INFO] start remap, site remark, file with rules move
2020/11/07 01:50:08.342 [INFO] completed, status=202, {"status":"convert request accepted"}
```
Once I had my old comments - I wanted to see about testing before I swapped over my blog.
Remark42 Demo Page - Installed at $URL/web
Remark42 has a little playground installed at "*/web*" so you can test the software before switching over your real site.
Now my installation of it was quite simple with Ghost. I simply took the `disqus.hbs` partial that existed in my current theme and swapped it out.
```html
```
I can read local storage to detect if the theme is in dark or light mode and use that to initialize Remark42 with. So now no matter the theme - it looks quite perfect.
Now if someone clicks the "Light" or "Dark" navigation icon (which is actually a theme toggle). I just run:
```
window.REMARK42.changeTheme('light|dark');
```
It sits on the global window with an object called "REMARK42" so you can directly interact with a few functions to hook it into your blog/theme.
Dark & Light Mode on this blog.
The design could use some work here and there, but I'm happy with my choice and thanks to the open source nature I can begin to slip in fixes upstream. I've setup 3 login providers between Google, GitHub and Facebook.
So now if you scroll below this - welcome to Remark42.
---
Update: August 2022 - I've switched to [native comments by Ghost](https://ghost.org/changelog/native-comments/?ref=connortumbleson.com). This is not because of any fault of Remark42, I just like to have less dependencies and the only reason I needed a 3rd party comment option was that Ghost did not provide one.
### Tribalism
URL: https://connortumbleson.com/2020/11/09/tribalism/
Last updated: 2025-02-04T11:43:18.000Z
Photo by [medienschoepfer](https://unsplash.com/@medienschoepfer?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
At this point in this blog, I've spoken about Ingress a lot. If you haven't heard about it before - the short version is a massive online game played in the real world with a phone with two teams - green & blue.
As the game aged it became quite clear the lines between these teams became more and more rigid. This is probably because playing the game at the higher regional level took an insane amount of time, money and energy. Losing because someone leaked a detail kept enforcing the notion that more and more walls between the teams had to go up.
Secret groups formed on each respective side, secret tools were built on each respective side and intense competition was born. It was healthy competition, but every so often there were folks who crossed the line in the sand. It may have been physical intimidation team against team or an actual crime with property damage as some folks are so deranged they cannot keep a game in the game.
[Texas - Ingress Event](https://connortumbleson.com/2018/11/19/travel-blog-austin/)
Anytime an event occurred the worse came out in folks as you would immediately see the poor logic of faulty generalization. It would normally go like:
- A guy on blue is cheating, they all support it!
- Green has no job, none of them have any job!
- Blue stalked me home, they all are stalkers!
This just continued till one of a few things occurred:
- A team switch - a grueling long process to actually move from green to blue or vice versa.
- Quitting - putting down the game and never returning.
- Splitting - Leaving a group, but staying on the same team to distant yourself from x.
What was once a healthy rivalry between teams evolved to a toxic tribalism attitude. I think the company behind this, Niantic, started realizing that as well. Events were slowly becoming less about team vs team and more about every person against every person.
However, 7 years into the game is a bit late to do a massive change like that as folks didn't want to play nice with others. So lets take a look at what happened when Niantic launched Pokemon Go.
---
[FevGames - Pokemon Go Teams](https://fevgames.net/pokemon-go/guide/concepts/teams/?ref=connortumbleson.com)
It became quite clear that Pokemon Go was launching with 3 teams, even though the lore of the Pokemon universe could have many more. Was Niantic trying to squash the toxicity that occurs when it is simply two teams?
As the game matured it was fairly obvious the 3 distinct teams and the ability to swap teams with $10 (1 year cool down) really changed the culture around the game. The toxic team vs team was just gone - it was more a group effort for every challenge.
Sites and groups spawned that didn't limit joining based on team and meeting folks in person rarely asked the question - "which team?". Which was a large departure from Ingress where folks normally demanded seeing your phone and watch you open the game and confirm you were indeed on a specific team. Sometimes asking as much for you to sign out and sign back in to prove you didn't have multiple accounts.
Though when you take the team vs team nature out of a game - what happens? Those that are attracted to games for the competitive nature and not so much the collection nature fall away.
[Sensor Tower - 2019 Location Based Stats](https://sensortower.com/blog/pokemon-go-has-best-year-ever-in-2019-catching-nearly-900m-usd-in-player-spending?ref=connortumbleson.com)
It appears that the majority doesn't really care in the location-based game space. As you can see from SensorTower, Ingress doesn't even place alongside other location-based games from Niantic or other companies.
This isn't exactly a fair comparison since Ingress launched 8 years ago without in-app purchases and pretty much created this space, but it was interesting to see regardless. So lets pivot one more time and talk about other Niantic games.
---
Niantic launched after Pokemon Go, Harry Potter: Wizards Unite which of course following the lore of Harry Potter had 4 teams:
- Hufflepuff (badger, yellow)
- Gryffindor (lion, red)
- Slytherin (snake, green)
- Ravenclaw (eagle, blue)
The game became just another collecting game with rivalries between teams/houses never taking off. The game basically broke down to individual achievements for collecting stuff. I was curious what the next Niantic game would be seeing how games in order went:
- Ingress - 2 teams
- Pokemon Go - 3 teams
- Wizards Unite - 4 teams
I then saw the 4th Niantic game - [CATAN](https://catanworldexplorers.com/?ref=connortumbleson.com) launching with 3 teams:
- Golden Eagles
- Blue Bears
- Red Wolves
So that was enough proof to me that Niantic would never return to the two team structure as it inevitably leads to a toxic ecosystem where players are forced to live between. So what else in the world is two groups?
---
Yep - politics. The great Republican vs Democrat. Red vs Blue. Right vs Left. Conservative vs Liberal.
[Democrat vs Republican - Diffen](https://www.diffen.com/difference/Democrat%5Fvs%5FRepublican?ref=connortumbleson.com)
I've noticed with every election I've lived that the party lines have gotten really bad to the point that some folks have ended friendships or stopped speaking to someone solely for the person they vote for.
The problem being that politics isn't ready for a 3rd party as most things are designed for blue vs red. Take the few senators who are independent and don't pledge towards any specific party - they are forced to caucus with one party and that normally falls on the democratic party.
Is the solution that Niantic implemented in games the missing key to solve turmoil in the political spectrum? I'm no political expert so I can't answer that - I'm sure 3 parties would present some new issues much like no parties. I can probably safely say that the politicians of the late 1700s and early 1800s probably did not predict the tribalism that exists today in 2020\. I can only fear that each election will continue to escalate tribal behavior until something crosses a line that forces reform.
Yes - I wrote this post on November 3rd, 2020 setting it go live on Sunday - November 8th.
### The Good Times
URL: https://connortumbleson.com/2020/11/02/the-good-times/
Last updated: 2025-02-04T11:43:18.000Z
Photo by [Volkan Olmez](https://unsplash.com/@volkanolmez?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I was re-watching the office again and towards the end of the entire series, Andy (below) said this quote.
> *I wish there was a way to know you're in the good old days before you've actually left them.*
> Andy Bernard
I started thinking about this quote again, which isn't anything new after my posts like "[slow down](https://connortumbleson.com/2018/01/07/slow-down/)", "[an evening of nostalgia](https://connortumbleson.com/2018/02/05/an-evening-of-nostalgia/)" and "[passion like a fire](https://connortumbleson.com/2019/10/21/passion-without/)". I tend to write about the past and correlate with the present and this post is no exception.
This time I was looking back at a childhood website (iBotModz) which I started in November of 2006 and shutdown October of 2011\. This site was built from the community of those who soft-modded and hard-modded an original Xbox. When I wrote the [shutdown](https://ibotmodz.net/forum/topic/20917-it-was-fun/?ref=connortumbleson.com) post I compared that era to Halley's Comet due to the rarity of the community.
["It was fun."](https://ibotmodz.net/forum/topic/20917-it-was-fun/?ref=connortumbleson.com)
We were in an era of the Internet truly taking off from dial-up to broadband. Pair that with a relatively cheap game and Xbox was all you needed to scratch the itch of technical modifications. This community tried to exist again with the Xbox 360 and Xbox One, but everything was different.
You can't repeat the past as the future is different. We had faster computers, revision control and the world of e-commerce had entered. Why share research when you could put it behind a pay wall? Computer got smarter and tools began stretching into the gray area that mixed with legality. All in all, it was clear the times were not the same. Were the good times the era of Xbox modification? - I'm not sure.
---
Moving along from Xbox, I grew up during the spawn of Xanga -> MySpace -> Facebook and then saw the rise and fall of Vine. The explosion of Snapchat, then continued success of Instagram and the scary rise of TikTok. Now I sit and see all these sites that launched in my childhood become the best worse thing to happen.
I'm nervous for kids of these newer generations. I've done some embarrassing things in my life and those lie in the memories of the kids that saw it. Today more than likely anything is recorded on a variety of cell phones and shared far and wide. A digital history being written daily from younger and younger ages that will follow forever.
[Netflix - The Social Dilemma](https://www.netflix.com/title/81254224?ref=connortumbleson.com)
The vast spread of social media also lends itself to creating a pretty sad dynamic for children who can't separate from it. Most posting anything to collect likes, shares, retweets and more chasing an euphoric high. Trying to catch this high leads to this anxiety and sometimes depression from just seeing the good times of everyone.
Most unaware that every single action you do on anything online just continues to build a profile of you. So that targeted advertisers will pay big money to put an ad right in your face knowing your type of "person" will see it.
---
So now 500 words into this blog post - I want to get my point. I think technology has passed the good times and we are knee deep in a scary time. People are arguing right now why Twitter is allowed to stop sharing of individual posts they deem untrue and whether that infringes on free speech.
I think we've forgotten that freedom of speech has nothing to with freedom of amplification. 20 years ago someone blogging about a critical life event with an alternative viewpoint would generally go quite unnoticed. Today a random user can post anything that leads to a massive viral spread of information. Is the medium responsible for that post supposed to do anything?
[Twitter Safety - June 23, 2020](https://twitter.com/TwitterSafety/status/1275500569940176897?ref=connortumbleson.com)
Twitter literally has a [department](https://twitter.com/TwitterSafety?ref=connortumbleson.com) now that is responsible for that. Probably because a good deal of our population isn't great at determining fact from fiction.
Though why am I talking about social media? I'm addicted to this stuff as much as anyone else. My phone even tells me now what I spend time on. So lets look back at the last week for time spent on phone and notifications received.
- Monday, Oct 19 - 5h 34min (most - Chrome, 486 notifications)
- Tuesday, Oct 20 - 3h 55min (most - Signal, 361 notifications)
- Wednesday, Oct 21 - 3h 16min (most - Phone, 333 notifications)
- Thursday, Oct 22 - 3h 52min (most - Reddit, 380 notifications)
- Friday, Oct 23 - 4h 36min (most - Reddit, 438 notifications)
- Saturday, Oct 24 - 5h 7min (most - Ingress, 384 notifications)
- Sunday, Oct 25 - 3h 14min (most - Reddit, 232 notifications)
That is quite depressing to see and even more depressing for some of these numbers, but I also know it can be much much worse. I also know I'm a human at the end of the day and it will take hundreds of thousands of years for my species to evolve a bit more and technology is evolving way quicker than myself.
My Nest Installed. (It is even, the picture isn't)
I'm naturally at a loss against the technological evolution, but in a better position than most of the population because I also work in it. I may be able to spot a bot on their first Tinder message, run a [Pi-hole](https://connortumbleson.com/2018/03/25/taking-a-look-at-9-months-of-pi-hole/) to block ads & privacy invasive trackers and be able to research a clickbait title without assuming anything. Though, I still fall victim and buy devices that allows Google to now even monitor my house temperature and air quality.
My data profile is enriched and companies know me more than I know myself - though I do one thing that I think helps. I don't un-follow folks I don't agree with. Nervous that a feed of everything I agree with would subject me easily to swaying opinions.
What really scares me though are my feeds changing [behind the scenes](https://connortumbleson.com/2018/05/27/the-death-of-chronological-order/) showing me what I want to see instead of what I follow, thus enabling suggestions into my sight line. The technology good times are gone - be vigilant and welcome to the scary era.
### On the day of hack
URL: https://connortumbleson.com/2020/10/26/on-the-day-of-hack/
Last updated: 2025-02-04T11:43:19.000Z
Photo by [Azamat E](https://unsplash.com/@picsaf?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
So I got an interesting email and I thought it would be the perfect chance to blog about it.
Oct 18, 2020 - "On the day of hack..."
So this email goes as follows...
1. Says one of my passwords.
2. Claims I visited a porn site and was infected.
3. Claims it recorded that porn site and my own camera in parallel.
4. Claims I should pay a BTC address $1,052 dollars.
5. Claims should I not - the video will be released.
6. Claims any back n forth communication is useless due to non-negotiation.
So let's go through these claims and see what is happening.
---
**(1) My password has been leaked!**
Yes welcome to the Internet. We have a growing problem where accounts and data are hacked from the source and released to the web. Depending on the company - the passwords may be in plain text or easily reversed. So your password will be discovered and correlated with an email. If the password worked - they would probably take your email - not email it.
So use a different password per website or even a password manager.
https://haveibeenpwned.com - my history
**(2) Claim I visited a porn site and was infected.**
Well any real hacker would just tell you which site you were visiting. However, this is an obvious scam so the wannabe just has to say something vague like porn to pray on a negative reaction to the victim. Hoping they will panic and react quickly to whatever the demands are.
**(3) Claim I was recorded alongside my screen remotely.**
While this is theoretically possible - my camera has a little slider on it and it turns on with a little light when in use. So lets say I stumble upon a porn site and notice my camera light turn on - I would nope out of there quickly.
**(4) Claim I should pay a BTC address.**
This is wanted from the hacker because it isn't exactly a paper trail like something like PayPal. Not to mention you can't really undo it. So the goal being that you send money down a trail you can't effectively trace or recover.
**(5) Claim the video will be released if I don't comply.**
Well this assume there is a video. A proper hacker would slip in a gif of the video into the email body for a few seconds to really instill fear, but the video isn't real. So obviously the hacked contacts to message isn't real either. Since they just picked popular social media sites like Facebook in hopes that you actually use it and will be nervous.
**(6) Claims this is non-negotiable so don't respond**
You can just read this from the email itself, but the sender explains:
> if you are planning on going to the law, surely, this e-mail can not be traced back to me, because it's hacked too.
So the real meaning of not responding is because the email account is stolen and/or misconfigured and within minutes abused to fire out as many emails as possible. This is the pattern used because hackers hope the stolen email accounts have the credibility to send emails vs a brand new signed up domain which have trust issues when it comes to sending emails.
However, we can ask Google for the original details of the email and can look for the SPF records.
> Received-SPF: fail (google.com: domain of metcalfe@silavit.com does not designate 193.187.193.127 as permitted sender) client-ip=193.187.193.127;
So this SMTP server does not allow the above IP to be a sender. Lets check that IP real quick.
So that IP that sent the "hacked" email came from Russia. The failure of the SPF rules is what led Google to put some big red warning over this email - as well as probably having a ton of machine learning behind the scenes.
So yeah at this point it is some mass script of a leaked database that someone/something in Russia executed against misconfigured or stolen servers.
I'll end this post with the raw text for Google searches to index in case someone else gets a similar message.
---
> *I know {password} is one of your password on day of hack..*
>
> *Lets get directly to the point.*
>
> *Not one person has paid me to check about you.*
> *You do not know me and you're probably thinking why you are getting this email?*
>
> *in fact, i actually placed a malware on the adult vids (adult porn) website and you know what, you visited this site to experience fun (you know what i mean).*
>
> *When you were viewing videos, your browser started out operating as a RDP having a key logger which provided me with accessibility to your display and web cam.*
> *immediately after that, my malware obtained every one of your contacts from your Messenger, FB, as well as email account.*
> *after that i created a double-screen video. 1st part shows the video you were viewing (you have a nice taste omg), and 2nd part displays the recording of your cam, and its you.*
>
> *Best solution would be to pay me $1052.*
> *We are going to refer to it as a donation. in this situation, i most certainly will without delay remove your video.*
>
> My -BTC -address: {btc}
> \[case SeNSiTiVe, copy & paste it\]
>
> You could go on your life like this never happened and you will not ever hear back again from me.
>
> You'll make the payment via Bitcoin (if you do not know this, search 'how to buy bitcoin' in Google).
>
> if you are planning on going to the law, surely, this e-mail can not be traced back to me, because it's hacked too.
>
> I have taken care of my actions. i am not looking to ask you for a lot, i simply want to be paid.
>
> if i do not receive the bitcoin;, i definitely will send out your video recording to all of your contacts including friends and family, co-workers, and so on.
> Nevertheless, if i do get paid, i will destroy the recording immediately.
> If you need proof, reply with Yeah then i will send out your video recording to your 8 friends.
>
> it's a nonnegotiable offer and thus please don't waste mine time & yours by replying to this message.
### Blog Spam & Sponsored Content
URL: https://connortumbleson.com/2020/10/19/blog-spam-sponsored-content/
Last updated: 2025-02-04T11:43:19.000Z
Photo by [NeONBRAND](https://unsplash.com/@neonbrand?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Today I received another email along the lines of "*paid content on connortumbleson.com*". These emails show up so frequently and I've never gone through with one once - my gut being that my site becomes some spam spot where I'm forced to publish content I did not write.
So I want to just drop some examples I've gotten and talk through them a bit.
Interesting Case #1
In this above example, we don't have a lot of details outside of some entity (with US writers) who will write high quality content specific to my website. I just need to let the author know how much I charge per post.
What bothers me is:
- It doesn't mention what type of content, just that it will relate to my website.
- It doesn't actually name my website once in the content.
- Since it has to mention "via PayPal" my "scam" detection is going off.
The answer was - "*I don't do paid/sponsored posts.*" and no response as expected.
---
Interesting Case #2
This email was a bit strange because it was directed towards my blog, but about a job search engine. This bothered me because the name used in the content did not match the name in the footer and what the hell does a job search engine have to do with my blog?
A bit of [research](https://foxyrating.com/en/review-15731-jooble-job-aggregator?ref=connortumbleson.com) shows this is common tactic to reach out to bloggers to switch links, but Jooble will never place your link anywhere instead just claiming "it takes a few weeks" for hits to appear.
I can't find Jooble on any top ten board of job searches, so yeah this looks like a complete scam.
---
Interesting Case #3
This case was a strange one, because attached in the body was a photo of a women with name and contact information for a business. I followed the website linked and it was a real business that matched the information in the footer of email.
Though the business felt eerily like Instagram influencer syndrome to me. This is because the whole premise is to link related advertisers with the content you write. All in all, it seemed like the most professional and sane setup, but I passed with.
> Thanks, but I try and keep my blog free from any paid/sponsored work. Keeps it more clean and trustworthy.
---
Interesting Case #4
This post is the tactic I get a lot of emails about. The idea from all the emails is the same - convert text from old blogs into hyperlinks to the mentioned URL from the email for some money.
It seems easy up front, but some of these emails have actually sent the text and URL to link and the sites are never something I would legitimately link. Usually some sketch website and/or link farm which can end up hurting your site as well.
So for this another - "*I'm the right person, but not really interested. I strive to keep my blog free from all paid influence.*"
---
Interesting Case #5
Finally is a clever written email with the research done to link a specific blog post. My problem though is - this is a high traffic blog, since release notes for an open source tool are quite popular. So what does encryption of an Android device have to do with my v2.2.1 release of Apktool?
I can't find any reference in that post that has anything to do with encryption outside of maybe signature scheme v2 of an Android package.
I never responded to this one, but it really caught my eye for the strangeness yet normal vibe from it.
---
With that - 5 examples from my history of folks reaching out for links/sponsors/paid content. With all this talk about sponsorships - I bet this post will be flagged by another email to me soon.
### Mosquitoes & O Blood
URL: https://connortumbleson.com/2020/10/12/mosquitos/
Last updated: 2025-02-04T11:43:19.000Z
Photo by [Егор Камелев](https://unsplash.com/@ekamelev?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
It has become the norm that if an event is outside in Florida and I don't bring bug spray - I will suffer. This isn't a couple bug bites, but hundreds of little red dots that will cover random spots of my body. It may be some reaction in my body, but these will react, turn red and itch beyond belief.
You may be asking yourself - it can't be that bad and I'm overreacting. I don't want to sit here uploading photos of my arms, legs and normally covered portions of body, but I'll start with a photo of my hand/arm.
A few days after the bug bites. \~15 or so
If you got bite by a mosquito and let five days pass - would you have the red spots remaining? Would you subconsciously itch some of them to the point of bleeding?
If you take the above photo as an example, I may have only felt one or two of those bites, yet 10x show up. Is this normal?
---
So I started researching this personal phenomenon as I sit here with 46 bites on my right leg and 72 on my left. It itches and I've tried everything from caladryl to rubbing alcohol to simply stop the urge to itch so I was determined to research.
I found a [Smithsonian snippet](https://www.smithsonianmag.com/science-nature/why-do-mosquitoes-bite-some-people-more-than-others-10255934?ref=connortumbleson.com) that gave 9 reasons why some folks are bite more than others. They listed them as:
1. Blood Type - O
2. Carbon Dioxide Emission
3. Lactic Acid Sweat
4. Bacteria on Skin
5. Beer
6. Pregnant
7. Clothing Color
8. Genetics
9. Natural Repellant
I'm blood O Negative as we [learned in this post](https://connortumbleson.com/2019/06/17/learning-blood-types/), I don't think I emit too much carbon dioxide, but I for sure exercise a good deal to be releasing lactic acid. I can't tell if my skin is full of bacteria that bugs like or not, but I shower daily so probably not.
I don't drink beer, I'm obviously not pregnant and it doesn't matter what I'm wearing clothes wise - I still get bite. My genetics & natural repellant may be non-existent as the bugs love to chomp down on me.
So after reading that the only interesting one to me was blood type. Can mosquitoes actually identify a preferred blood type?
I found some studies from 1974, 2004 and 2019 to help back up this claim.
[Preferential Feeding of Anopheles gambiae Mosquitoes on Human Subjects of Blood Group O](https://www.jstor.org/stable/41459967?seq=1&ref=connortumbleson.com) (1974)
> Analysis of the blood group data revealed that the mosquitoes preferentially selected hosts of blood group O.
[Landing preference of Aedes albopictus (Diptera: Culicidae) on human skin among ABO blood groups](https://pubmed.ncbi.nlm.nih.gov/15311477/?ref=connortumbleson.com) (2004)
> We demonstrated in this study that blood group O subjects attracted more Aedes albopictus than other blood groups (B, AB, and A)
[Blood Feeding Preference of Female Aedes aegypti Mosquitoes for Human Blood Group Types](http://www.sciencepublishinggroup.com/journal/paperinfo?journalid=547&doi=10.11648/j.aje.20190302.13&ref=connortumbleson.com) (2019)
> The highest preference was observed for the blood group “O”
---
I want to add a few more photos of red dots all over my body, but the idea of publishing some disgusting photos for the entire world to see doesn't seem that pleasant.
Instead I'll strive to not forget bug spray. I always have a bottle in my car, backpack and scattered throughout the place, but I guess I need to apply some anytime I head outside. It is the season for the bugs.
### Lost Treasure: Rokenbok
URL: https://connortumbleson.com/2020/10/05/lost-treasure-rokenbok/
Last updated: 2025-02-04T11:43:19.000Z
An example set of Rokenbok Items
For this new blog tag I want to jump into some childhood treasures that may have fallen off the grid in today's time.
We are starting the tag off with [Rokenbok](https://en.wikipedia.org/wiki/Kid%5FSpark%5FEducation?ref=connortumbleson.com). This company started in early 1995 under the name - *Rokenbok Toy Company* and they had one purpose. To build children toys that were high quality interactive pieces.
Pictured above is a truck that when connected with a little adapter would bind it to a controller to drive it. You could pick up the little red/blue balls and dump them into the truck. Once collected - you would drive the collected balls to a lift that would sort them by color.
Now that of course assumes you built a similar structure as the one above, which might not be the case. You could design whatever you wanted - granted if you had the pieces. The main pieces you built designs around was either the lift (to carry balls up) or the shoots (to dump balls into the back of a truck).
---
Though, I want to do a deep dive into the history of the company behind the toys and see how it has changed/evolved since 1995\. The first obvious change is the name, which *Rokenbok Toy Company* changed to *Rokenbok Education* and then finalized on *Kid Spark Education*.
It seems in 2010 the company pivoted to attempt to place these tools in K-8 schools worldwide as part of the STEM program. It took a few years until 2015 when the company restructured as a 501 c(3) non-profit. After that a few more years and these toys were used in 22 states around the United States.
I couldn't find much out besides that, so let's jump back to this toy and creativity.
---
I remember my goal when building these structures was to always build a 1st floor so you could accidentally "fall" off the structure with one of the cars. This would evolve into battle of the cars with the brother or friends.
We would use the controllers to drive the cars up to the 1st floor to compete in basically king of the hill. Whoever got the sweeper would normally win as it could over power the loaders (green cars) anytime it got in a 1v1 situation.
At the end of the day though you were basically building a structure to move balls around - the replay ability wasn't really there unless you created ad-hoc games like king of the hill.
I went digging and I found one truck remaining in childhood boxes. The colors and design of the current toys have appeared to change, but as shown above and littered over eBay - the design was once pretty basic.
With that, one lost treasure down - many more to come when I remember what they are.
### The Disconnect: Consumer vs Company
URL: https://connortumbleson.com/2020/09/28/how-do-companies-mess-up/
Last updated: 2025-02-04T11:43:20.000Z
Photo by [Nastuh Abootalebi](https://unsplash.com/@sunday%5Fdigital?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
After years and years of being upset with companies, I decided to rant about it a bit. All of these stories directly affected me and I'm not sure if there is any merit to them or if I'm just crazy.
1. **Cox Networks**
While living in the great state of Arkansas, I switched to COX for my ISP as AT&T was no longer available at the location I moved. They have an option that allows you to [bring your own modem](https://www.cox.com/residential/support/cox-certified-cable-modems.html?ref=connortumbleson.com). This seemed preferred to me, because doing so removed the $10.99/monthly fee for equipment rental.
I just needed to purchase a $120 DOCSIS 2.0 modem and I already had the router. Assuming I stayed with COX for a year and more, I would save money vs the combined $131.88 I would have to pay for equipment yearly.
This seemed great until a few months into payment, the strange 10.99 monthly fee showed up again. I called support and got moved between plenty of support agents, none knowing that I could even use my own equipment. It took a few calls and escalations, but I finally got the refund for the 11 bucks and it was removed from my bill.
I thought the story would end here, but a few months later again the item showed up again. I started thinking since I now work in the development field, was this some bug on their system looking for accounts without the monthly rental field and adding it? Was this some scummy intentional behavior to add new fees to see if consumers would notice? Did COX even care this kept happening?
Thankfully after about 2 years of dealing with this - I moved to Florida leaving COX behind.
---
**2\. Bungie**
I was [addicted](https://connortumbleson.com/2018/09/16/ending-an-addiction/) to the first iteration of Destiny, playing **2,246 hours** before putting the game down after **1,070 days**.
Destiny 1 was intentionally crippled months before the 2nd game's release, thus breaking my addiction as the events I played in the game were permanently shut down.
With that aside, I bought the game on launch with 7 others and we began to play our favorite game modes from the 1st game so lets talk about those.
Raids which were amazing complicated journeys taking hours of work now only dropped these little useless tokens to later be redeemed for gear. This destroyed the fun of everyone waiting together at the end of a successful run chanting in hopes for that piece of yellow text to show up on the screen.
The other event (Trials) which only appeared from Friday to Monday morning changed from 3v3 to 4v4\. Which made finding a 3rd into finding a 4th which made the experience of finding great players much more difficult. Additionally, re-spawn times increased 10 fold, weapons were pea shooters and health regeneration took so long that it was pretty difficult to "carry".
This mode sucked so badly I wanted the original game to return. So bad that I couldn't find a single player in our 20 person clan that was playing the game.
Apparently, we were not the only ones disliking the game.
> **Destiny Dev Team**: As longtime Destiny players know, Trials of Osiris was released in May of 2015 as the original high-stakes weekend PvP event. Trials had an amazing impact on our game and our community. It was a pinnacle venue for players to show off their best skills, strategies, and gear. The 3v3 elimination mode combined with the card system created the coveted reward of earning a trip to the Lighthouse.
>
> With the introduction of Trials of the Nine in Destiny 2, we made a few changes to the formula which never really hit the same mark. We were unhappy with its role in the ecosystem. The new activity wasn’t achieving the goal of bringing the community together every weekend. Both Destiny and the online PvP scene have evolved since 2015, so we don’t believe that bringing back the 2015 version of Trials of Osiris would accomplish what our goals are today.
>
> Until we have a solid prototype for a pinnacle PvP endgame activity, Trials is staying on hiatus indefinitely and will not return over the course of the next few seasons. When we have those new plans ready, we’ll be sure to share them with you.
> [https://www.bungie.net/en/Explore/Detail/News/47630](https://www.bungie.net/en/Explore/Detail/News/47630?ref=connortumbleson.com)
Bungie themselves killed the game type and took about a year to return the original implementation of the mode. I just don't understand how a game-type so successful that community sites were programmed and developed for it. Services for hiring people spawned from it. Hundreds streamed it every weekend and much more. What went wrong in the office of Bungie for this game to miss the mark entirely?
---
**3\. Niantic (Ingress)**
The company behind Pokemon Go and Ingress has made some pretty obvious but minor mistakes over the years. Publishing dates for major events on social networks just for them to be wrong. Mixing the wrong city with country on published materials.
However, this mistake was pretty bad. Events that since 2012 were primarily organized by players was now attached with a price tag weeks before the event. For those unaware planning an Ingress event in a city is pretty insane. Players help other players organize lodging, travel, food and more.
This sounds easy, but organizers have real life jobs and families and all this work is free unpaid hobby help. Organizing a couple hundred people with logistics for attending a city isn't easy. Most who end up taking on this role end up cutting back on the game entirely after the event is over due to shear amount of stress and work it takes.
So with an already announced event weeks away, Niantic announces forced payment for tickets. While the price wasn't bad, it was the mess that followed. Apparently a free event in the city doesn't require as many permits or approval. The instant you begin charging for that event, you need permits, police, bathrooms and more. While matters were being investigated and resolved - COVID19 struck and all events slowly but surely were cancelled worldwide.
---
**4\. Streaming Services**
For this item - I just wanted to rant about a disconnect between new streaming startups and the reason streaming became so great. Imagine just one service (Netflix) where you can watch anything for a low monthly fee. It was amazing, it was legal, it was great.
Now in 2020 if you want to watch Disney content you need Disney+, if you want to watch some network TV - you'll need either HBO Plus/Go/Max. Some shows may be on Hulu, but others may be on Amazon Prime. Some exclusives may even be on Apple TV. If you want to watch old content then you are probably out of luck unless you find it on Vudu.
So now we find every company racing to make a streaming solution to keep users on their platform longer. Today it may be NBC with Peacock, tomorrow it may be someone else.
This is sending me no where except back to illegal content consumption, because I'm not signing up for 15 services to watch some movies & TV.
### Travel Blog: COVID-19
URL: https://connortumbleson.com/2020/09/21/travel-chicago-covid-19/
Last updated: 2025-02-04T11:43:20.000Z
Photo by [engin akyurt](https://unsplash.com/@enginakyurt?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The travel blog has gained a post with this blog - this time discussing how travel has changed since COVID-19 struck.
For the first time ever since moving to Tampa, I drove my own car to the airport and parked it for the trip. I was uneasy trusting an Uber for the travel to/from the airport, but honestly that was nothing compared to packing into a flight with people everywhere. Though, the $66 spent in parking in a garage compared to 2 $30 Uber rides comes out about the same.
So lets talk about the airport itself. So many things are closed now and probably for good reason. You don't need to be shopping for jewelry in an airport during a pandemic, but even places such as food, tech stores and more were closed for the foreseeable future.
Tampa International - Sept 18
Outside of the shops the seating area had changed quite massively with these little social distancing stickers over the chairs. There is this unwritten airport rule that you generally don't sit right next to someone - unless you know them. So this didn't seem that different, it just led to more people standing around close together as the space itself can't grow.
The boarding procedure (for Southwest) was a bit different. Instead of boarding A1-30, then A30-60\. It went more like A1-10, A11-20, A21-30, etc. This also meant that before the next 10 were allowed to board, the staff member would peek down hallway to ensure there was no line on the passage between airport and plane.
Once boarded I was glad to see that the plane was only sold to the point that 1 seat would be available in every row. So this meant that you could scan down the isle and see no middle seat - it was amazing.
Bad attempt at showing empty row - Sept 20
On the flight down, no one in the middle seat. On the flight back - no one in my entire row (as shown above). I don't know what that means to flight costs, but it is such a more enjoyable experience to fly without being placed next to randoms like sardines. Flying with a mask took some training because I either ripped out my headphones or mask when trying to eat the crackers and/or water I got.
I was happy they offered water as that always makes a flight more enjoyable with a nice ice cold drink.
Once landing it became pretty obvious that the actual 6ft social distance circle is not followed. Everyone unloading the plane in one back to back line. Everyone cramming together on the train to get back to the terminal. Everyone standing around baggage claim like they forgot COVID existed. Everyone grouping together in small terminals to wait for boarding for their flight.
I hope I stay clean after that travel, but I followed all the guidelines and walked around with mini hand sanitizers after any forced human interaction, which I recorded:
- Tampa - garage to terminal elevator button clicks.
- Tampa - boxes to put stuff in before security.
- Chicago - not automatic door from terminal to garage.
- Chicago - payment system to purchase train key card.
- Chicago - boxes to put stuff in before security.
I was happy to see that the one manual process of humans scanning IDs for terminal access was now replacing by some automated system in Tampa.
With that - a small short blog about the changes I saw traveling during a global Pandemic. Check out the [travel](https://connortumbleson.com/tag/travel/) tag for real travels or [coronavirus](https://connortumbleson.com/tag/coronavirus/) for COVID related blogs.
### Where does Dust come from?
URL: https://connortumbleson.com/2020/09/14/where-does-dust-come-from/
Last updated: 2025-02-04T11:43:20.000Z
Photo by [Joel Henry](https://unsplash.com/@joelhenry?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A strange blog topic, but I'm tired of dusting and cleaning this never ending state of dust. What makes up dust?
I found an old [2010 article](http://content.time.com/time/health/article/0,8599,1966870,00.html?ref=connortumbleson.com), that made a claim that "*60% of dust comes from outside*". This doesn't really help me understand it, but we can look back to the Time's article to see the list of what makes up dust:
- Human skin
- Animal fur
- Insects
- Food debris
- Lint
- Organic fibers (clothes, bedding, fabrics)
- Soil
- Soot
- Particulates from cooking/smoking
- Lead
- Arsenic
- DDT
So of course, I had no idea what DDT was - turns out it's an insecticide. The more deadly one when paired next to DEET. One is a repellent while the other is a killer.
Though as I started researching DDT, I realized C&EN had their [own article](https://cen.acs.org/articles/95/i7/Tracing-chemistry-household-dust.html?ref=connortumbleson.com) describing the compounds that are found in 90% of dust. Listing these compounds would be quite boring, so instead I'll list the common product associated with them:
- Vinyl flooring
- Food packaging
- Scented products
- Baby products
- Treated furniture
- Paint
- Nail polish
- Personal care
- Insulation
- Cosmetics
Both articles go on to say that each list is not the full story as dust is literally just a mix of tons of things, but it gives us enough to go on.
It seems you can cut down on dust by doing a few things:
- Never go outside.
- Never open window/doors.
- Never cook/smoke.
- Never own a pet.
- Never take care of yourself.
- Have an expensive air purifier system.
So yeah obviously that is not possible, so how can you cut down on dusting? Since it seems like a never ending job to dust the surfaces of everything.
---
After some research I learned if you want to take dust cleaning seriously you have to rethink the way you clean. If you just vacuum you start stirring around dust that may not even be isolated to the carpet. It may be on the walls, furniture or fans and then just be dislodged into other areas.
You must start from the top of your home and work down using tools to clean fans, windows, doors, ceilings, etc. What I found the most interesting is that many websites referred to using a water/vinegar solution after dusting on surfaces to help repel dust. The smell of vinegar, even diluted, is quite strong so I wonder how viable or used that option is.
> Some flame retardants are made of chemicals called volatile or semi-volatile organic compounds (VOCs or SVOCs), which simply means that they can become airborne or collect on the dust particles we breathe.
> [National Center for Health Research](https://www.center4research.org/home-sweet-home-flame-retardants-home-can-harm/?ref=connortumbleson.com)
After that research I stumbled upon the term "flame retardant" which helps make up some of the dust particles if you are rocking furniture older than 2013\. This chemical was used to help prevent furniture turning into fuel if a home caught fire. Turns out, it really didn't work and instead just poisoned the homes.
There is too much research about it causing issues with children, learning and more so it sounds like living with dust or even poorly made furniture can have an affect on you. That is probably why a breeze of fresh air outside on a clear day feels better than a poorly ventilated unclean home.
I may have done a bit too much research, but all I've learned is I need to clean more often and look into better quality air filters.
### Home Hunting Stress
URL: https://connortumbleson.com/2020/09/07/home-hunting/
Last updated: 2025-02-04T11:43:20.000Z
Photo by [Ярослав Алексеенко](https://unsplash.com/@webaliser?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
While the home pictured above is not in my wheelhouse, these stories are. Let's pretend you are tired of the [apartment life](https://connortumbleson.com/2020/07/06/the-apartment-life/). It could be noisy neighbors, the constant price hikes or even just the annoyance of tossing money away on something you can never sell.
So you decide to enter the home hunt for the first time ever. You weren't taught about this process in school, so you begin to rely on family, friends and of course your realtor.
You start with a download of Zillow and Redfin and begin the search - starting with the hunt for a condo. Basically a more formal apartment lifestyle that you can resell when done. A weekend is picked and the hunt begins - driving from place to place looking at condos that look arguably worse than the one you rent. The difference of course being - you are aiming to own, not rent.
None of these places feel like home to you, so you slowly stop caring about seeing condos or even researching them. Months pass after a few cookouts and you realize that you want to explore the house hunt.
---
Hunting for homes is a bit more interesting to you than a condo as you can picture an office, backyard and a variety of projects to accomplish for each home you find. The search begins but you are worried about putting an offer on anything - this is a lot more money than you've ever dealt with.
After a few months of isolated looking - you find a home at your max. It fits everything you are looking for so you are convinced. Its now time to put down an offer. You learn from your realtor that this county runs on average of 96% of asking price - so you put down your first offer nervously.
A day or two passes and out of some strange luck - the seller responds they would like to counter your offer for an extra 2k and shorter inspection window. You are still learning exactly what the inspection period is, but you agree and enter your first inspection period.
500$ is dropped and a PDF is in your hands with a bunch of red warnings that you probably need to investigate. The most important being a suspect roof leak that a professional should investigate. You have a few business days left, but Florida is suffering a crazy thunderstorm near daily - so it takes some stressful calls to get someone out there.
House \[redacted\] - Leaking roof
Calls keep flaking so you call more and more people until you find you have 3 roof appointments scheduled. The news keeps getting worse - the roof is over 15 years old, it has active leaks and the chimney was flashed improperly. This is not good as the seller claims they patched a leak via a repair years ago.
You start learning the procedure for contract amendments trying to figure out a sane agreement for the roof. The seller doesn't ever admit to an issue despite having multiple sources citing it, but they counter your amendment with a few thousand off the purchase price.
You learn a lot here - as this is not a credit. This is just a cheaper purchase price and a few thousand dollars at a large dollar amount does not really affect your 20% down payment. So can you really buy a house, drain your pocket then be prepared to spend a solid amount on a roof? Probably not. So you tell the seller you are walking.
They end up bumping it another 2k, but you aren't ready for your first home purchase to have an expensive roof replacement waiting - so you walk.
---
The next few homes begin following this weird pandemic pattern. Interest rates are quite low and it is almost cheaper to buy then to rent, so homes start going quick. You being noticing that homes listed on Zillow are marked pending the next day. So the idea of marking homes throughout the week and visiting on the weekend is no longer feasible.
You have to start leaving work to see these places and even decide pretty much there and then if you want to make an offer.
You start organizing the folders of offers put out and they follow the same pattern of just being outbid. The idea of homes going for 96-98% of purchase price is gone. Homes are going for asking and the winning bid is over asking which changes the game in terms of your pre-approval letter.
Luck strikes with another offer and the seller wants to counter with just a tiny bump in price. With a couple of the issues you saw in the home - you stand your ground and say no and ask the seller to agree to your original offer. They verbally agree via the realtor and this is it! It begins again, but the seller realtor ends up following up and says the seller does not agree. Were they speaking on behalf of their client? Was someone lying? This stuff messes with your head and stresses you out, but you move on as that contract is never executed.
---
More offers come and go and you find an interesting home that is accepting offers until the weekend - then will select an offer on Monday. They ask for the highest offer out of the gate and this seems more fair to you. There is no rush, just go, visit and offer.
The home checks your boxes and you toss out an offer. As the weekend hits, the seller realtor asks if your offer is final. You say yes, because you actually listened to the realtor when they requested the highest offer first.
You think this is another washed offer, but you are selected! This time with a shorter appraisal time, which seems weird to request as that is not exactly in the control of the buyer, but you proceed on. Inspections come and go and the seller and you enter an agreement with a credit at close.
Weeks become months and you get the clear to close. Is it is finally over, until the title company discovers a mess regarding the title. The word probate is thrown around and your life that is already packed in boxes becomes a stress filled world that you don't want to deal with. You were days away from ownership and now the time-frame being spoke to you is now in months, not days.
The light at end of tunnel is gone and now you are fighting out figuring out next steps before getting removed from current.
---
You wake up and it was all a dream — or was it?
### 2020: Hurricane Edition
URL: https://connortumbleson.com/2020/08/31/2020-hurricane-edition/
Last updated: 2025-02-04T11:43:20.000Z
Photo by [Shashank Sahay](https://unsplash.com/@shashanksahay?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
2020 all things considered is shaping up to the be the strangest year to date. We've watched Australia burn, COVID spread and now named hurricanes earlier in the year than expected.
[Source - Ella Dorsey](https://twitter.com/Ella%5F%5FDorsey/status/1296651073797656582?ref=connortumbleson.com)
So imagine my surprise when I see this tweet across my stream about two almost hurricanes, at the same time, approaching into the gulf. I don't think I've ever seen this once in my lifetime, so off to Google I went to identify if this had happened before.
I found two interesting dates. First we have June 18, 1959 when both Tropical Storm Beulah existed with a non-named storm in the gulf. So this doesn't count as the 2nd storm was unnamed, but an interesting stat none-the-less.
I wasn't happy with that, so kept digging and found that in 1933 the Cuba-Brownsville hurricane struck Texas and then Florida had it's own tropical storm hitting the shore. However, that is still not two named hurricanes so I think we can safely say this is the first time this has happened.
---
As of today, August 29 2020 (when I'm writing this post). Hurricane Laura had already struck at the Texas-Louisiana border at a CAT4 storm packing winds of 150mph. This quickly dropped to 100mph, but still a dangerous CAT2 storm capable of [doing a fair amount of damage](https://weather.com/photos/news/2020-08-27-hurricane-laura-aerial-photos-damage?ref=connortumbleson.com#46).
The Marco storm briefly peeked at a hurricane in the middle of the gulf (as shown above), but then collapsed to a tropical storm, then depression before slamming into the Louisiana coast as nothing but a rough storm.
So the dual hurricanes in the gulf might have happened for a brief moment, but only one was a true dangerous storm. Though, that got me thinking - why is this hurricane season so early?
[Weather.com - 2020 Atlantic Season Status](https://weather.com/storms/hurricane/news/2020-08-28-2020-atlantic-hurricane-season-status-august?ref=connortumbleson.com)
Looking at an animation I saw we have had quite a lot of named storms and September hasn't even hit. The average is normally 13 named storms for the entire season and we hit it before August was over.
I hope this doesn't mean we are building ourselves up for the most dangerous hurricane season to date, because I don't think 2020 can take it.
---
If we take a step back though and only examine named storms that targeted the United States we can look at weather.com again for a graphic.
[2020 Static Report - weather.com](https://weather.com/storms/hurricane/news/2020-08-28-2020-atlantic-hurricane-season-status-august?ref=connortumbleson.com)
I would expect something like this at the end of the year, not before August's end. This is going to be one crazy hurricane season and I hope Florida can continue the luck and stay out of the path of a storm.
Though, the Atlantic is already buzzing again with more storms in formation. The 8pm update on August 30 from [NOAA](https://www.nhc.noaa.gov/gtwo.php?ref=connortumbleson.com) resulted in the below graphic.
[NOAA - Aug 30 - 8pm EDT](https://www.nhc.noaa.gov/gtwo.php?ref=connortumbleson.com)
It seems one of the storms may form and then just fizzle out in the ocean, and the other Caribbean disturbance may just collapse after hitting the Mexico/Belize border.
The sub 40% chance storm near Africa is too early to tell, but the odds are in the favor for that one to just collapse into a regular storm. Keep watching as this year is going to continue to surprise - even with hurricanes.
### The Hobby Project Phases
URL: https://connortumbleson.com/2020/08/24/the-hobby-project-lifecycle/
Last updated: 2025-02-04T11:43:21.000Z
Photo by [Markus Winkler](https://unsplash.com/@markuswinkler?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The amount of projects I've started and never completed is amazing, but also amazing is how many projects I've started - launched and then abandoned. So for this blog I wanted to discuss some phases of these projects and spell out a hobby project's life cycle in my eyes.
---
**The Idea**
Like all projects they start with an idea. Just recently this was my idea for a centralized location to find patches for Halo mods. This was going to solve a personal pet peeve where you have to rummage across various sites and social media to discover download links for mods. Yet, patch formats can embed metadata about the patch itself. So why not create a website where you simply upload a patch file and go on your way?
So with an idea that I was personally driven by, it is much easier to go on to the next phase.
---
**The Over Engineering**
With an idea in mind - development will soon begin. This is a new project though, so why not go with the latest and greatest language? Soon you'll end up with a checklist like:
- Automated tests (GitHub Action)
- Automated code style
- Automated deployments
- Server
If any of these steps are new - you'll quickly realize you are spending more time on just logistics instead of your idea. In the good news, but the more time you mess with the logistics the easier it gets.
---
**The Deployment**
After all the stress and misery of setting up your project - you finally have it deployed somewhere. This is a great moment, because you now you can just work the project and the logistics take care of themselves.
You'll quickly spot issues on your first deployment that you need to fix. The good news is that assuming you didn't mess up - changes you make should automatically be released.
---
**The Honeymoon**
At this point in the project you are either burnt out from the setup or engaged in continued development. This leads to spurts of development as you race to squeeze in fixes and add all the features your project is missing.
You aren't ready to show it to the world, but you continue working pushing for the day that you tweet it to your followers. This phase feels great as everything is working and you have the drive to continue work.
---
**The Expiration**
Days become weeks and weeks become a few months. Your project isn't finished and you aren't exactly jumping out of bed to complete it anymore. Since no one knows about it yet - no one is jumping at your heels to push you to completion.
An automated security alert draws your attention to the project, but that doesn't hold enough interest to stay and do much more. You start to plan out time to finish the project, but your drive is just gone. As every week passes you get closer and closer to the next phase.
---
**The Abandonment**
This phase can be entered at really any point of the project. What generally happens for yet launched projects is you realize you are paying for services for a project that has not launched in months and doesn't appear to be ever launching.
You start doubting why you are paying yearly for a domain name for something you haven't used. So you turn it off and say good bye. All you have left is an [archived repository](https://github.com/iBotPeaches/ReachStats?ref=connortumbleson.com) to remember the past.
---
**The Green Grass**
If you haven't abandoned a project - you more than likely have launched it. This is the first time you can really relax - until you start getting feedback. The project is launched and now folks around the world may be using it.
[Leaf](https://leafapp.co/?ref=connortumbleson.com)
This is the first time you can just lay down in the grass and appreciate the work. Your vision was built and launched - it may never be over with enhancements and support, but at least it was launched.
---
**The Error**
[Image Credit - Laravel News](https://laravel-news.com/laravel-5-5-error-views?ref=connortumbleson.com)
This phase is really only encountered if you launched your site and abandoned it. At some point maybe even years later - something happens. It may be an API change, server package upgrades or any possible combination of some problems.
You basically have a choice - investigate this error and resolve it or just give it up. Chances are since the project was abandoned this will be "The Error" - the one that results in you shutting the site down.
You may take a hot fix approach, but you are simply delaying the next large problem. This really only leaves one phase left - a potential revival.
---
**The Revival**
As a project hits success and slowly makes it way through the phases it may be at a stagnant point. It might have been a catastrophic error that brought you back to it - this might be the hump you needed to work on it again. You have been revived with a drive to update it to the latest code & framework. You've learned a lot since you started this project so you start the over-engineering all over again.
Sometimes the words "rewrite" start rambling around in your head. However, you may abandon the [project](https://github.com/TrackerNetwork/DestinyStatus?ref=connortumbleson.com) during the rewrite. If you made it this far - you've probably launched a hobby project or two.
### Fast Food Reviews 2020
URL: https://connortumbleson.com/2020/08/17/fast-food-reviews-2020/
Last updated: 2025-02-04T11:43:21.000Z
Photo by [Jonathan Borba](https://unsplash.com/@jonathanborba?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is my 2nd food post, joining my [top ten sandwich reviews](https://connortumbleson.com/2019/08/05/sandwich-shop-reviews-2019/). The rules are quite simple:
1. The fast food must be a chain.
2. The fast food must have a drive through.
3. The place must be a "burger" / "chicken" place.
With that, my top 8 places. Lets start at the worse and make our way up to #1.
---
**#8 - Arby's**
While mainly found in the rural places of the Midwest and encountered on family trips between Kansas and Nebraska. This was a favorite place of mine for a few years of childhood for the "pick 3" option. I could get a cheesy ham sandwich, curly fries and a Jamocha shake.
Though, as I grew older it became quite apparent this place was not that good. The idea of just steaming meat destroyed the flavor. Constantly inconsistent and the place just felt "dirty" every time I went. I don't think I've been to an Arby's in nearly a decade now.
---
**#7 - Hardee's**
Keeping the trend of Midwest we had White Castle in Nebraska, but Hardee's in Kansas. This meant the idea of learning about "mini sliders" originated at White Castle, but not living in Nebraska led to going to Hardee's more often.
This was just a burger place that I could order a bunch of little cheeseburgers from. They had this organization of little onions and mustard that had such a unique flavor. Though it sits at #7 because Hardee's did not evolve like the competition. Dirt and grime became the pattern, the store never modernized and the menu went stale. I'm sure if you find yourself 150 miles north of Arkansas in a town of 500 people - Hardee's is your best fast food, but today I won't be going there.
---
**#6 - Burger King**
While not yet breaching into the top 5 - we have Burger King. If you think about the fast food trio - you are probably thinking of McDonald's, Wendy's and Burger King. I'm placing Burger King at #6 because of the Whopper, which pretty much took the Big Mac from McDonald's and actually added some flavor. The ingredients seemed like they had flavor and complemented a burger that actually looked like it was grilled (Whether this is true or not).
The pattern continues, I grew older and this place did not move with me. There were healthier options, I lived on campus and I learned to cook. It just didn't seem that "cool" to rip over to the BK Lounge for a burger as it look pretty dated in pale to the comparison.
---
**#5 - Sonic**
["SuperSONIC burger"](https://www.flickr.com/photos/55676959@N00/2298167924?ref=connortumbleson.com)by [wfyurasko](https://www.flickr.com/photos/55676959@N00?ref=connortumbleson.com) is licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=ccsearch&atype=rich)
At the back of the top 5 is Sonic, which was the only fast food in my knowledge to have this "pull in" approach where you just parked your car, talked into a machine and then food was delivered (Not always on roller-skates) to your car.
This place was the go-to after intense soccer practices in high school, then was even across from campus in Arkansas. So my exposure to this fast food was always there - and I did indeed go. From getting Powerade slushes to mix with alcohol or picking up a burger with fries on the late drive home from campus.
I'd still go to Sonic given a chance that warranted it, but the locations aren't close to me anymore and I can't justify a 45 minute drive for a Sonic burger.
---
**#4 - Steak 'n Shake**
["Steak 'n Shake"](https://www.flickr.com/photos/80259611@N00/6716801685?ref=connortumbleson.com)by [Blue387](https://www.flickr.com/photos/80259611@N00?ref=connortumbleson.com) is licensed under [CC BY-NC-ND 2.0](https://creativecommons.org/licenses/by-nc-nd/2.0/?ref=ccsearch&atype=rich)
This place remains at number 4 strongly because of hours of operation. Too many times I find myself on late trips home and most places are closed by 10pm. Steak 'n Shake is not and while the burgers aren't extravagant - they are consistent. I know exactly what I'm getting and sometimes that is exactly what I want.
The burger is usually pretty smashed together and tastes the same whether eaten immediately or 30 minutes later, which has an advantage. It won't excel to #1 overnight, but this is consistent okay food and I'm happy to have that.
---
**#3 - Culver's**
["IMG\_3547"](https://www.flickr.com/photos/40978177@N00/2759538609?ref=connortumbleson.com)by [BierDoctor](https://www.flickr.com/photos/40978177@N00?ref=connortumbleson.com) is licensed under [CC BY-SA 2.0](https://creativecommons.org/licenses/by-sa/2.0/?ref=ccsearch&atype=rich)
A place not often found in all locations, but excels with the ice cream portion of the business with a side hustle of burgers. So basically a Dairy Queen with actually good food. The burgers, while known as butter burgers pack a red onion that has real flavor.
The patties taste like real meat and when mixed together with lettuce, pickles and condiments give a burger that has all the characteristics of a real home cooked burger. The only reason that I can't put it higher up is the time to a completed product is far too long. Sometimes I sit in line for 10-15 minutes for a single burger. This may be due to just sheer popularity at times or the price I pay for a higher quality item.
---
**#2 - Wendy's**
[Meat Poultry](https://www.meatpoultry.com/articles/20463-wendys-reports-underwhelming-sales-in-q3?ref=connortumbleson.com)
Holding at number 2 is Wendy's, one of the top 3 probably known fast food establishments. The reason they sit at number 2 is for constant change with the moving market. They added steak fries, introduced a healthy option, added chicken and much more iterations of items.
The only true complaint I had was only some locations had breakfast, but now all locations offer breakfast. I can come here and get a spicy chicken sandwich or a Baconator and not be disappointed. While that isn't often much anymore, the food at least is consistent when I do visit.
---
**#1 - Chick-fil-A**
["Chick-Fil-A, Wallingford, CT,"](https://www.flickr.com/photos/39160147@N03/19286626291?ref=connortumbleson.com)by [JeepersMedia](https://www.flickr.com/photos/39160147@N03?ref=connortumbleson.com) is licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=ccsearch&atype=rich)
Holding the crown at number 1 is Chick-Fil-A, which is spelled crazily when I just want to type "Chick Filet". The marketing went global with "*EAT MOR CHIKIN*" and the store was always clean and always friendly. It basically threw the norm that fast food should be dirty.
The lemonade was always fresh, the chicken tasted fresh and it had so many sauces that you could change it up every time. The breakfast resembled the normal menu, albeit in morning iterations of the items. While some days I wish it was open on Sunday, I keep them at #1 for just great consistent chicken.
---
With that, my own personal deep dive into fast food.
### Are you taught to be an adult?
URL: https://connortumbleson.com/2020/08/10/are-you-taught-to-be-an-adult/
Last updated: 2025-02-04T11:43:21.000Z
Photo by [Kimberly Farmer](https://unsplash.com/@kimberlyfarmer?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This blog is a culmination of years of thoughts of just wondering - when are you taught to be an adult?
The story really begins with college - University of Arkansas where folks from all over were thrown together and living on their own. For most, the first time leaving the parent's nest and living on their own.
This is why the phrase - Freshmen 15 exists, as folks are tossed into an eating schedule where they can eat meals (up to their meal plan) whenever they want. Imagine eating that just plain bad high school food, then walking into the below image 3 times a day.
[Brough Commons - University of Arkansas](https://universityofarkansas.myuvn.com/eat/?ref=connortumbleson.com)
It is an entire circle, basically with the following stations:
- drinks
- entrees
- pasta
- soap / salad
- fruits
- pizza / burger / meats
- sandwich station
- deserts
It was a huge amount of food and some folks just got plate after plate after plate for each meal. Its tough to see a freshmen 15 when you see those folks every day, but it can be obvious when you scroll back through photos.
Lets take another jump though, another year in college where a few move out into the nearby apartments or homes. This is where things get interesting - I watched someone put the wrong soap in a dishwasher and overflow the kitchen with escaped bubbles. A honest mistake, but really begged the question - did they ever do the dishes while at home?
Talking about college though is boring - I want to talk about when you leave college, have a job and truly on your own.
---
You start running into things that I guess you either have to learn from your folks or take a class during school. In reality, I just pop open Google and start researching everything I stumble upon. What did folks do before the Internet?
Though is there anything you should just know? Let me just list a bunch of things that I've found myself in post college.
- The correct cable setup for jumping a car
- The in/outs of insurance for apartment/home
- Finding an in-network health/eye/teeth/skin doctor
- The need of replacing an HVAC air filter
- What an amortized loan calculation is
- Learning how a fridge/freezer works to defrost
- Hurricane prep for living days without power
So a few of these you might be laughing at, but they indeed happened and I was caught without the knowledge I wanted in such situations.
---
So this begs the question - when are you taught to be an adult?
Should I continually embarrass myself when I open up Google to remember which cables go where when jumping a car? I think maybe our society with knowledge at fingertips has changed what we need to know.
[Hyundai Sonata 2019 Blue](https://www.kbb.com/hyundai/sonata/2019/?ref=connortumbleson.com)
When I stepped into a dealership to purchase my first car and heard I qualified for a 4% interest rate. I quickly did the math in my head and I thought I knew the total interest I would pay over time. I was wrong. The interest is pulled from each pay cycle based on the remaining amount of principal to pay. Looking back at that - it seems pretty dumb I didn't know what an amortized loan calculation was, but I didn't take any class in school that focused that.
These stories can continue for tons of random other things in my life. Just recently I had to have an insurance agent spend 30 minutes on a call with me just explaining the line items on home insurance.
School needs a class just called "life" where you learn the common everything you'll eventually run into.
### Stumbling into Comp Sci
URL: https://connortumbleson.com/2020/08/03/stumbling-into-computer-science/
Last updated: 2025-02-04T11:43:21.000Z
The early days. Two monitors was insane! Showing off my "setup"
A few times a year I get asked - "*How did you get involved with programming?*" - this time from a curious individual after one of my talks. I tried to explain it in a short few words, but this post is the real story.
**The Internet Curiosity**
We had a family computer growing up, one singular computer in a room. The room was so professional with an expensive wood desk, a keyboard that slide out and large monitor that a cat could sleep on top of. This was running probably Windows 95 or 98, but the interesting thing was that it was password protected.
In order to use the computer a parent had to be present to enter the password and then watch you use the computer. This was primarily just games, because using the Internet required opening some AOL program and listening to a bunch of phone noises as you waited and hoped for it to connect. I was fascinated by all of it, and as time went on and I learned that the password entered was only a few characters, perhaps only two.
[Windows 98 - Defrag Video](https://www.youtube.com/watch?v=dc%5FSDyLYq3U&ref=connortumbleson.com)
Days became months and it became obvious on the keyboard which two characters it was. Since the wear and tear of those keys was destroyed compared to the others. I was in. A computer with no Internet without supervision. I clicked on every menu item possible. I couldn't really yet process what they did, but I knew what buttons did what things. Like defragging a disk to watch the colors move and align for no reason. I of course was playing the pinball game, but I more-so clicking every button possible and seeing what it did.
Nothing really changed until we got Roadrunner Broadband - the real connection to the internet. No more waiting for AOL to connect, we had a real connection. This is where things began to explode. The family computer was now a Windows 2000/ME system and it had broadband. The research that occurred here was all networking related. Learning how modems connected to routers and how coaxial was twisted pair cables - this led to using money I earned to purchased a 100ft Ethernet cable - which sounds expensive but it was barely $20\.
I could now drag a cable from my dad's office all the way down the hallway, down the basement stairs to a computer that was in the basement that in the past was just games. This led to Red Alert & Age of Empires multiplayer and an explosion of research. More games, more research, more competitiveness and the drive to continue learning things.
Years went on and the computer in the basement changed to a newer computer in my bedroom, I vaguely remember parents did not agree with Internet in my room, but my complex 100ft Ethernet cable was no longer needed. Our source of Internet had a new location directly beneath my bedroom in a closet where a router now existed to broadcast Wireless Internet.
99% of everything I did was just addicted to online gaming, whether it was rounds of Age of Empires, Simcity 3000, Sim Ant, Sim Tower, Red Alert & that dumb game from school known as Zoombinis. It was until a family trip to Canada (my first ever) to fish when I encountered an Xbox.
---
**The Console Era**
A family friend had an original Xbox with Halo and we played split screen for a few hours on a trip break before pushing onward into Canada. At this point - I realized that console gaming was revolutionary compared to my then present PC gaming.
[3 Generations of Halo](https://connortumbleson.com/2020/04/27/3-generations-of-halo-modding/)
The blog linked above is the story from a technical perspective, but what I quickly learned is that I loved breaking things from exploring things. This absolutely cemented the drive that computers were my interest.
That further got compounded on the day I got spawn killed over and over again in a Halo 2 match. The game ended in a few minutes and we lost 50-0\. I encountered my first cheater and my mind was set on figuring that out. This led to soft-modding, mod-chips, breaking xboxes, getting banned and much more.
The rabbit hole had just begun - little did I know I was training for my future.
---
I think I got off topic from the point of this post of answering why I got into computers and instead just describing a few events. The answer from my perspective is simple - there is a drive inside of me for technology and I cannot shake it. I didn't go into college wondering what my major would be. My eyes were set since I was born during the era of affordable home computing - moving from Windows 98 onward.
There may be plenty of students that chase computer science for the job security and salary, but my gut says you gotta love this stuff to stay in this field. I can't explain that, but I'm sure you know it when you feel it.
### The Onus of New
URL: https://connortumbleson.com/2020/07/27/the-onus-of-new/
Last updated: 2025-02-04T11:43:22.000Z
Photo by [Sushobhan Badhai](https://unsplash.com/@sushobhan?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Since my last blog post I've spent $987 replacing a Pixel 4 that slipped into the salt water of Tampa Bay. It was misleading as the phone didn't technically break until 72 hours later.
[Twitter - @iBotPeaches (me) - July 21, 6:10pm Eastern](https://twitter.com/iBotPeaches/status/1285698671980564480?ref=connortumbleson.com)
This was an impulse buy and not the smartest as the Pixel 4 has aged in time and I'm sure a better phone is launch soon. However, for this moment when work and hobbies depend on a phone that works - there is no time to spare. The time for careful research, review watching and logistics is gone.
I'm now typing this post with a brand new Pixel 4 next to me. It still feels brand new and I'm happy to feel comfortable with the same phone I've been using for almost a year.
---
Though this post is not about the phone, but just the notion of new things. I can look to my left and see a TV that was gifted to me when I left for University of Arkansas nearly 9 years ago. It has multiple bad pixels, even one entire pixel row that is busted refusing to show color. Additionally, it lacks any "smart" TV functionality and the available ports are starting to age with updated tech.
The TV
I've even had a few people ask me why I don't buy a new TV, because in comparison to a decade ago - it is relatively cheap to get a nice TV.
I can't explain why, but I will spend too much money on a gaming monitor and replace an expensive phone in under 24 hours. Though, my TV hasn't seen an upgrade in nearly a decade.
My car lasted a decade till the repairs were rivaling just purchasing a new one (I bought the same car - just 10 years later)
I'm still using a laptop that just hit a decade as well. It won't survive if unplugged, and I had to purchase a new hard drive a few years ago, but it works. I can feel the speed difference when I work on my work computer or new gaming computer, but I still continue to use this older laptop for hobby development and even writing this post.
---
So what drives humans to always strive for new things? My gut feeling it is all connected to experiences. A new item is a new experience at the end of day so like the humans we are - we avoid boredom and purchase things.
My Apartment Pool - Citrus Village
Though, I overheard a conversation at the apartment pool that really let me down. I was reading my book in the highly humid Florida weather when these two women were discussing swimsuits in the pool in front of me. One girl mentioned she only had one bikini that made her look cute and she wasn't going to meet this guy at the pool unless she had another cute one to wear. (*My assumption here is that she already went swimming with this swimsuit once*)
I can almost guarantee that unless the guy is an ass, no one will notice the same swimsuit or think badly because of it. It just bothered me that someone is so focused on buying new things to impress someone else.
---
My guess is there some scientific research regarding this phenomenon of chasing new things. The brain probably responds to the novelty of items and pumps our brains full of dopamine.
I'll keep buying a few things often, but otherwise I'll continue to drive a few types of items into the ground before purchasing a new thing.
### Coming Soon - Laravel 8
URL: https://connortumbleson.com/2020/07/20/coming-soon-laravel-8/
Last updated: 2025-02-04T11:43:22.000Z
[laravel/art - repo](https://github.com/laravel/art/blob/master/logo-lockup/4%20PNG/3%20RGB/1%20Full%20Color/laravel-logolockup-rgb-red.png?ref=connortumbleson.com)
Laravel has become the framework of choice for my hobby and work life. For that reason I enjoy following what is on the horizon. Every major version increase of Laravel always brings some interesting features. So this is the upcoming major features that caught my eye.
---
**Maintenance Mode Overhaul - [PR](https://github.com/laravel/framework/pull/33560?ref=connortumbleson.com)**
This feature was a rarely needed, but highly appreciated when needed. If you've ever leveraged `php artisan down` to take your Laravel website offline temporarily. That page can still not work if you run into an issue with dependency installs or some low level package issue. This is because the entire Laravel framework needed to be booted in order to render the error page.
So lets talk through the new features from just an example run.
```bash
➜ php artisan down --redirect=/ --status=418 --secret=sekrit --render="errors::503"
```
What this does is:
- Put the application offline
- Redirect all routes to "/"
- Use a custom HTTP Status (418 Teapot)
- Set a secret to bypass maintenance mode (sets a cookie to allow site use)
- Render a view file for the downtime.
Laravel does this by writing all the above parameters into a JSON file. The framework before booting checks if that file exists. If so, all the logic is contained to a different path of execution. So without Laravel booting it can render and do the logic required for the maintenance mode.
The view says 503, but the status code is 418 :)
```bash
➜ ~ curl -I http://127.0.0.1:8000
HTTP/1.0 418 I'm a teapot
Host: 127.0.0.1:8000
```
---
**Queued Closures - [PR](https://github.com/laravel/framework/pull/33463?ref=connortumbleson.com)**
Sometimes you are writing code that is just too slow to run on the main thread. In those situations a Job is written. That Job can be queued asynchronously in Laravel, but the boilerplate to get that running for some types of jobs may be a lot.
Laravel will soon support its first namespace\`d function of `queueable` which as the name suggests allows a closure of an Event to be directly attached to a listener.
```php
use function Illuminate\Events\queueuable;
App\User::created(queueable(function ($user) {
info($user->name);
}));
```
---
**Better Model Support - [PR](https://github.com/laravel/framework/pull/33390?ref=connortumbleson.com)**
How many people throw models just into `app/`? For small projects sure - I do. For medium projects I love the organization of `app/Models`. For huge projects each component will have `app/Models` in its own directory state.
Laravel will now properly detect if you have an `app/Models` folder and use that instead for generation commands. Hopefully this drives package authors to no longer hard-code model locations.
---
**Job Batching - [PR](https://github.com/laravel/framework/pull/32830?ref=connortumbleson.com)**
If you have a bunch of jobs and need to fire them all out and wait on the responses, then the batching enhancements is for you.
```php
Bus::batch([
new TestJob(),
new TestBlogJob()
])->then(function (Batch $batch) {
if ($batch->hasFailures()) {
// die
}
})->allowFailures()->dispatch();
```
---
**Rate Limiting Enhancements - [PR](https://github.com/laravel/framework/pull/32726?ref=connortumbleson.com)**
For those who commonly rate limit applications - you might see a line like - `'throttle:6000,1'` \- what does that even mean? 6000 per 1 what?
Laravel has recognized this and introduce a new method for this. First off you have to generate a name for your rate limit - perhaps for downloads, uploads or even an expensive API.
```php
RateLimiter::for('downloads', function (Request $request) {
if ($request->user()->isPremium()) {
return Limit::none();
}
Limit::perMinute(1)->by($request->ip());
});
```
A rate limiter for 1 download per minute, unlimited for premium members.
So at this point we have a named rate limit of `downloads`. So this can be used as a common middleware.
```php
Route::middleware(['throttle:downloads'])->group(function () {
// routes
});
```
Leveraging custom rate limit above.
So future contributors or coworkers can easily understand the purpose behind these rate limits.
---
**Schema Dump - [PR](https://github.com/laravel/framework/pull/32275?ref=connortumbleson.com)**
As a project continues for years - I assume the migrations folder is quite heavy with files. This means every time the CI process or even a new contributors begins they have to sit through maybe minutes of migrations.
Migrations may even add and then remove columns or tables that aren't even in the finalized database structure.
The Rails project solved this by introducing a `schema.rb` file which is updated as migrations are ran which updates the flat file. The benefit as Rails describes it is as...
> There is no need (and it is error prone) to deploy a new instance of an app by replaying the entire migration history. It is much simpler and faster to just load into the database a description of the current schema.
> [Guides - Ruby on Rails](https://guides.rubyonrails.org/v3.2.8/migrations.html?ref=connortumbleson.com#schema-dumping-and-you)
So lets how Laravel did this. I'll start with a new Laravel 8 project and immediatly migrate and dump the schema.
```bash
➜ php artisan migrate
Migration table created successfully.
Migrating: 2014_10_12_000000_create_users_table
Migrated: 2014_10_12_000000_create_users_table (864.55ms)
Migrating: 2019_08_19_000000_create_failed_jobs_table
Migrated: 2019_08_19_000000_create_failed_jobs_table (244.85ms)
➜ php artisan schema:dump
Database schema dumped successfully.
```
So now I should try and refresh the database.
```bash
➜ php artisan migrate:fresh
Dropped all tables successfully.
Migration table created successfully.
Loading stored database schema: /home/ibotpeaches/Desktop/laravel/database/schema/mysql-schema.sql
Loaded stored database schema. (1,187.28ms)
Nothing to migrate.
```
So we can see Laravel leveraged the schema file and then didn't need to run any other migrations. Since this was a brand new project - the amount of migrations to process was just the ones Laravel gives you.
This will be interesting for large projects to try out for a real test and should greatly cut down the CI process for those large legacy projects you might have. (Granted legacy projects probably won't be upgrading to Laravel 8)
---
**Conclusion**
[Laracon](https://laracon.net/?ref=connortumbleson.com) is online only this year on August 26\. My gut (like every other Laracon) means we will probably have Laravel 8 launching and some other unannounced package/feature/service.
Tickets are only $29/person if you want to sign up. With that - I'm excited for this upcoming version for a couple of these features.
### Isolation Day 119
URL: https://connortumbleson.com/2020/07/13/isolation-day-119/
Last updated: 2025-02-04T11:43:22.000Z
Photo by [Ryan Loughlin](https://unsplash.com/@rylomedia?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is now the 9th COVID-19 post, but the 7th in this series of isolation ([Day 7](https://connortumbleson.com/2020/03/23/isolation-day-7/), [Day 21](https://connortumbleson.com/2020/04/06/isolation-day-21/), [Day 35](https://connortumbleson.com/2020/04/20/isolation-day-35/), [Day 49](https://connortumbleson.com/2020/05/04/isolation-day-49/), [Day 63](https://connortumbleson.com/2020/05/18/isolation-day-63/) and [Day 77](https://connortumbleson.com/2020/06/01/isolation-day-77/)). While this has just taken a toll on the basics of life - we can dive into what has happened in the past six weeks. I took a break from the bi-weekly posts as this style of life has just become the new normal and thus not much changed every two weeks.
---
**Round 2**
[Google News - Data from New York Times](https://news.google.com/covid19/map?hl=en-US&mid=%2Fm%2F02xry&gl=US&ceid=US%3Aen&ref=connortumbleson.com)
COVID is not going away anytime soon with cases spiking as summer nears to an end. However, you can't continue to live life locked down, money must be made and bills must be paid.
At this point, there are so many arguments and discussions and every individual thinking they know the best way to handle this that I've just run out of energy to research arguments and present facts. So instead, let's just peek at the headlines for today.
> Coronavirus: Florida reports single-day record of 15,300 new cases
> Florida breaks state, U.S. record with 15,300 coronavirus cases reported in single day
> Florida Shatters Daily Record With 15,300 New COVID-19 Cases
Not looking good for Florida and schools will be starting in about a month.
---
**Masks and Masks**
With the mask order coming to Tampa - you'll need to wear one to pretty much any place you go. Buying barely reusable medical masks is one route, but unless you are packing an N95 fitted for your face - you still run the risk.
So with that, I researched some cool designs and picked up a Panda and USA mask.
[Etsy](https://www.etsy.com/shop/SeesanGeneralGoods?ref=connortumbleson.com)
So now I carry a mask in my car and one at home. I still run without a mask, but otherwise leaving the house has one on. I don't know how long this will go on, but I might need to buy some more filters at this rate.
---
**College without Campus**
I saw an interesting [article](https://www.forbes.com/sites/susanadams/2020/07/06/harvard-will-hold-all-undergraduate-classes-online-this-fall-and-invite-only-40-of-students-to-campus/?ref=connortumbleson.com#3838dce22bdd), where I learned that Harvard would host all undergraduate classes online for the upcoming Fall semester. They would however open up campus for under 40% of students who might not otherwise have the technology in place to learn at home.
What is crazy to think about is the price of tuition of some of these brick and mortar colleges not changing after going to forced online. Imagine a student that paid for a previous year of school that got cut short immediately, then went digital.
Can you imagine that student paying the same price with no campus experience the next year? Sorry, but that is just insane. The world of higher education is about to be shaken up.
---
**Online Education**
[Khan Academy - COVID Update](https://www.khanacademy.org/?ref=connortumbleson.com)
Not everyone is watching Netflix during the pandemic and Sal of Khan Academy had a huge influx of traffic to the non-profit education for all company. A glimmer of hope in our dark world.
---
**Conclusion**
The inside of my apartment is quite boring at almost day 120, but in the safety of others - it must go on. Errands outside are still only for essentials, but I'm very glad Uber Eats exist. We might take a few more weeks off the "[Isolation](https://connortumbleson.com/tag/coronavirus/)" series, but I'll be back next week.
### The Apartment Life
URL: https://connortumbleson.com/2020/07/06/the-apartment-life/
Last updated: 2025-02-04T11:43:22.000Z
Photo by [Karla Alexander](https://unsplash.com/@kmvrlv?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
For this post I just wanted to blog about apartment experiences. I started my apartment journey after being kicked off campus sophomore year of college. Since then I've just jumped between complexes.
However, I'm reaching 5 years of working post graduation and the charm of apartment life is fading.
---
**Rent vs Own**
For an apartment, every month I give up money that does not compound towards ownership. It effectively is just spent money in order to live. I think this is probably a circle dumb argument of "rent vs own", but it is something to think about.
You generally don't have to worry about any maintenance in an apartment and you can safely budget with a month to month rate. This of course will change every year though as inflation rockets price. This gives merit to owning a home as hopefully inflation follows your property increasing value as every year passes.
---
However, the downsides to apartments are becoming too much:
- Asshole neighbors
- Forced payment (liability facility fee, increased valet trash fee)
- Asshole neighbors
So lets talk about some stories.
**The Killer**
For years living in my current complex there was this orange calico cat. It would sleep under cars and in the mornings you would startle it as it ran back to this corner apartment. Getting back from work late I would see this cat relaxing on the sidewalk. It wouldn't run away, it was a playful friendly neighbor cat.
On December 18, 2019 I saw this cat flattened dead via a tire track in the middle of the apartment complex road. Let me tell you, there are corners and stop signs every 100 meters in this complex. I'm hoping this was an honest accident, but based on the location of the lifeless body, I'm thinking it was negligence or even intentional.
**The Destruction**
I [blogged about this](https://connortumbleson.com/2018/05/06/malicious-actors/) before, but I can't tell if I'm being intentionally targeted or just one unlucky individual. My car was vandalized here across the passenger side on 3 different panels. I thought it was directed at me, but then I started paying attention more and noticed similar key marks on other cars in the parking lot.
One morning I came outside and the door handle of my car was ripped off. I imagine because someone was checking door handles for an easy to open theft.
I imagine car vandalism becomes quite difficult if you own a home and garage.
**The Annoyances**
In my current complex, we have valet trash boxes outside of every door. They are picked up nightly (except Friday & Saturday) and are taken to the trash compactor on-site for disposal. This would seem fine, except people are just frankly idiots.
The rules aren't insane. They break down to basically.
- Please tie and bag your trash.
- Please don't have leaking bags.
- Please don't put out trash if you missed pickup window.
However, generally every Friday getting home from work my corridor is littered in bags. I think folks are well aware they aren't picked up till Sunday, but they put them out there anyway.
You know what happens in 90 degree Florida weather with a bunch of trash outside? It starts to smell and attracts critters. I just can't fathom why folks can't follow a simple rule. Why trash the place you live?
Our apartment complex has caught on and started issuing $25 fines to people for violating this. However, these boxes are everywhere. So when I get home from work about 50% of the time there is trash in my bin! It is so upsetting because I have to either take my trash manually to the compactor or do the same thing someone did to me - and find an open trash bin for my trash.
The "Bad Guy" putting trash in my bin. (Those aren't my bags)
I thought I would be an investigator and confront who keeps putting trash in my bin, but not a single bin in my building has the same white bag with red ties. This just blows my mind. Is someone intentionally using a different trash bag to dispose in my bin?
---
I want to leave the apartment complex life, because I'm either unlucky or have an enemy. Though, its a big jump to become an owner of a condo or home. So I guess the research begins.
### The Collapse of "Dr. Disrespect"
URL: https://connortumbleson.com/2020/06/29/the-collapse-of-the-doc/
Last updated: 2025-02-04T11:43:22.000Z
Photo by [Caspar Camille Rubin](https://unsplash.com/@casparrubin?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On June 26, 2020 one of the top ten streamers on twitch.tv was permanently banned. This was Dr. Disrespect ("The Doc") who was known for creating a unique character among the streaming service. This character rocked a mullet wig, tactical vest and large reflected glasses (shown below).
A random screenshot from an old [DrDisrespect](https://www.twitch.tv/drdisrespect?ref=connortumbleson.com) Stream
In early 2010, justin.tv (now Twitch) was the home to the climbing persona. While most streamers just pointed a camera at themselves, The Doc took more of an entertainment approach to the service. Rocking transitions and multiple green-screen backgrounds separated The Doc from the rest.
The Doc popularity kept growing as he switched between games like H1Z1, PUBG and Call of Duty.
[Twitch Tracker](https://twitchtracker.com/drdisrespect/statistics?ref=connortumbleson.com)
As of 2020, he was the only streamer to win the Esports Industry - Streamer of the Year for both [2017](https://esports-news.co.uk/2017/11/14/dr-disrespect-esports-industry-awards/?ref=connortumbleson.com) and [2019](https://www.svg.com/175387/2019-streamer-of-the-year-revealed/?ref=connortumbleson.com). So I'm basically trying to set the stage that while Dr. Disrespect was not the most followed streamer, he indeed seemed to be the most decorated.
**Fame Collapses**
Being in the limelight of millions of folks is not easy, but does not excuse some of the mistakes that The Doc found himself in. The first major incident was exposed when Herschel (Dr. Disrespect) uploaded a video out of character.
Announcement of being unfaithful to wife - DrDisRespect
It was a rough video to watch as the goofy character was gone, it was just a sad discussion about cheating on his wife. He mentioned he would be gone for a few months to repair his family and he disappeared.
When he returned to Twitch, it was an explosion of popularity with the return stream launching into a peak of 388,000 viewers. Just imagine being a single person streaming from your home and having near 400,000 people watching you and a couple million being notified of everything you do.
**The Virtual World Escapes**
This led to scary moment where someone connected the virtual world with the real world and discharged shots into the real home of Dr. Disrespect.
["The Doc" House Shot](https://www.youtube.com/watch?v=3gypV7YX3ME&ref=connortumbleson.com)
This became known to viewers as he disappeared from the stream and returned partially out of character to abruptly end the stream. The police [identified](https://www.sandiegouniontribune.com/news/public-safety/sd-me-twitch-shooting-20180911-story.html?ref=connortumbleson.com) the bullets from a BB gun shot on two different days, but never identified the culprit.
**The Mistakes**
As streaming in real life became more popular, The Doc found himself streaming with a crew at the E3 conference. The camera crew followed him into the bathroom, which violated Twitch's rules and of course the laws in California. This led to a two-week ban from Twitch.
---
**The Permanent Suspension**
The final stream of Dr. Disrespect on Twitch was riddled with strange messages in the final minutes. (Start at 7m 30s)
My guess is the video above won't be working at some point when you are reading this article, so some important phrases to note.
- "*Life is weird right now.*"
- "*We will get through this, ok?*"
- "*We will get through this Champions club.*"
- "*Fuck*" (Stream end)
So whatever "The Doc" saw off stream had some realization that things were seriously wrong. I imagine anything ending your estimated 80k a month in revenue would be life changing to see.
This news absolutely exploded online (Probably due to the streamer being a two time streamer of the year)
[Subscriptions to DrDisRespect ended.](https://twitter.com/Dexerto/status/1276694463897907201?ref=connortumbleson.com)
The news continued further with rumors saying the ban came from outside of the Trust/Safety team. So something major happened that pushed Twitch to just abruptly end the account.
In the era of the sexual allegations movement, perhaps we don't know the truth about "The Doc". Though, everyone is innocent until proven guilty so I cannot even hint at that.
His wife posted an Instagram message thanking the fans for the support, so if it was something so heinous maybe his wife would not be supported him.
News sources way more powerful than my little blog - [Forbes](https://www.forbes.com/sites/davidthier/2020/06/26/report-dr-disrespect-permanently-banned-from-twitch?ref=connortumbleson.com), [ESPN](https://www.espn.com/esports/story/%5F/id/29371026/dr-disrespect-banned-twitch?ref=connortumbleson.com), [TheVerge](https://www.theverge.com/2020/6/26/21304907/dr-disrespect-twitch-ban-no-reason-given?ref=connortumbleson.com), [Insider](https://www.insider.com/dr-disrespect-banned-from-twitch-report-permanent-2020-6?ref=connortumbleson.com), [Kotaku](https://kotaku.com/twitch-bans-dr-disrespect-1844182541?ref=connortumbleson.com) and [Polygon](https://www.polygon.com/2020/6/26/21304828/twitch-bans-dr-disrespect?ref=connortumbleson.com) have all covered the story - all missing the same curious point of why.
Though, lets just summarize what has happened in 24 hours on June 26.
- The Doc [permanently banned](https://twitter.com/Slasher/status/1276611805629026310?ref=connortumbleson.com) from Twitch.
- Sources say it is [not DMCA](https://twitter.com/Slasher/status/1276613302483812352?ref=connortumbleson.com) related.
- Sources say it is not related to Trust/Safety.
- Discord partnership [pulled/ended](https://twitter.com/Slasher/status/1276740177306755072?ref=connortumbleson.com).
- Twitch [subscriptions refunded](https://twitter.com/Slasher/status/1276740177306755072?ref=connortumbleson.com) for current month.
- Twitch [custom emotes removed](https://twitter.com/Slasher/status/1276740177306755072?ref=connortumbleson.com).
Twitch went [public](https://twitter.com/Shannon%5FLiao/status/1276617617730568195?ref=connortumbleson.com) with a statement to reporters of:
> As is our process, we take appropriate action when we have evidence that a streamer has acted in violation of our Community Guidelines or Terms of Service. These apply to all streamers regardless of status or prominence in the community.
This comes 2 days after a [blog](https://blog.twitch.tv/en/2020/06/24/an-update-to-our-community/?ref=connortumbleson.com) about Twitch cracking down on sexual abuse. Who knows when the truth will come out, but one of the top streamers has fallen.
All we have now is an announcement from the man himself.
> Champions Club, Twitch has not notified me on the specific reason behind their decision... Firm handshakes to all for the support during this difficult time. - Dr Disrespect
> [Twitter](https://twitter.com/drdisrespect/status/1277060051744591872?ref=connortumbleson.com)
### Deploying Ghost Themes
URL: https://connortumbleson.com/2020/06/22/automatic-ghost-theme-releases/
Last updated: 2025-02-04T11:43:23.000Z
For this blog, I want to take a dive into more automation that helps make the blogging procedure easier. The issue was anytime I wanted to update my theme I normally had to do the following:
1. Launch ghost locally
2. Test/make fix against theme
3. Package up theme
4. Upload and set as active theme
The problem with these short steps is that it reminds me of the phpBB3 era of uploading files in order to execute plugins. So I wanted to make this process easier.
Theme as it exists - June 21, 2020
My modified theme though is quite different than what I purchased. I introduced a pre-processor so I could write sass and generate transpiled minified files. I tweaked it beyond belief to fit my use-case. So I wanted to stick with this theme, but pushing updates was quite archaic.
So I started off just cloning the repository into the blog directly and did "git pull" whenever I wanted to update it. This worked most the time, but broke occasionally when I had a file with the wrong permissions or forgot to build my production assets after a pull.
So I started writing a script, but then I wanted to automate it even further after commits to the repo.
However, I knew that Ghost itself has tons and tons of demo themes and they probably have something automated.
[Deploy Ghost Theme](https://github.com/marketplace/actions/deploy-ghost-theme?ref=connortumbleson.com)
Sure enough I stumbled upon a GitHub Action that leveraged the API in Ghost to automatically release a theme. One minor additional step and my theme was automatically releasing to this blog.
So now a new upgraded version of this theme has been released:
- Dropped Disqus link
- Added "Buy me a coffee" link
- Updated dependencies to latest
With that though, I didn't want to accidentally break my theme since it automatically deploys. Thankfully Ghost has thought of this already and built [gscan](https://gscan.ghost.org/?ref=connortumbleson.com) ([GitHub](https://github.com/TryGhost/gscan?ref=connortumbleson.com)).
> GScan is a tool for validating Ghost themes. It produces detailed reports of issues where themes need to be modified in order to be compatible with a specific version.
So with this tool, I attached a new test workflow to my CI process.
```
$ gscan --fatal --verbose .
Checking theme compatibility (fatal issues only)...
✓ Your theme has no fatal compatibility issues with Ghost 3.x
Get more help at https://ghost.org/docs/api/handlebars-themes/
You can also check theme compatibility at https://gscan.ghost.org/
Done in 1.13s.
```
If it returns a non-zero return code, I know something has happened with an upcoming Ghost version and I should not push these changes. It additionally just helps catches mistakes with handlebars.
So now I have a repository that mimics my theme, I would open source, but I paid money for the theme so I don't have permission to do that. I can however share the workflow I built which is below. The repository will remain private, but it has made deploying theme changes to this blog much much easier.
```yaml
name: Deploy Theme
on:
push:
branches:
- master
jobs:
deploy:
runs-on: ubuntu-20.04
steps:
- uses: actions/checkout@v1
- uses: actions/setup-node@v2
name: Use Node.js
with:
node-version: 14
cache: 'yarn'
- run: yarn install
- run: yarn run production
- uses: TryGhost/action-deploy-theme@v1.4.1
name: 'Deploy Ghost Theme'
with:
exclude: node_modules/*
api-url: ${{ secrets.GHOST_ADMIN_API_URL }}
api-key: ${{ secrets.GHOST_ADMIN_API_KEY }}
theme-name: [theme-name]
```
### Is Nuclear Energy Returning?
URL: https://connortumbleson.com/2020/06/15/is-nuclear-energy-clean/
Last updated: 2025-02-04T11:43:23.000Z
Photo by [Johannes Plenio](https://unsplash.com/@jplenio?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The [nuclear](https://connortumbleson.com/tag/nuclear/) tag on this blog gains another post, this time digging into the debated topic - is Nuclear Energy coming back any time soon? Lets jump into some topics regarding Nuclear and catch up on our knowledge.
### Renewable
Renewable energy is no joke in the funding department, where we can see nearly 2.3 trillion dollars over the past 10 years has spent (excluding hydro). This is nearly triple the amount of funding since the last decade. We can see the breakdown from the U[N 2019 report](https://connortumbleson.com/uploads/2020/06/GTR2019.pdf) below:
- Solar - 1.3 trillion
- Wind - 1 trillion
- Biomass - 115 billion
So why isn't Hydro on this list? I don't really fully understand the claim, but hydro is debated on being renewable due to the environmental concerns it causes. The power may be renewable from flowing water, but it comes at the price of building damns onto rivers which can completely change the area for both the wildlife and land left behind.
So can you classify Nuclear as renewable? Depends on how you look at it, the burn may be clean, but it requires a finite source of uranium and produces waste which harms the environment.
---
### Price
There is no way to shake it, initial build out of a nuclear facility is beyond expensive in comparison to other energy production. Nuclear plants look to take 14-18 years to go profitable, but once that happens - they often out profit other energy sources.
[Page 3 - The Economics of Nuclear Power](https://connortumbleson.com/uploads/2020/06/economicsnp.pdf)
Another interesting thing to note is about the shutdown procedure of a nuclear plant. You can't just close the doors like a brick and mortar store and sell the land. We are talking a long process to safely dismantle or entomb (which I've [blogged](https://connortumbleson.com/2018/07/08/decommission-nuclear-power/) about before). It costs so much money to shutdown a nuclear plant that the NRC (Nuclear Regulatory Commission) requires you to set aside money as plant earns profit for the eventual shutdown (or renewal).
---
**Safety**
You can't talk about nuclear energy coming back without discussing the pure safety hazard that exists with a plant. Our last global accident was August of 2019, so nuclear accidents still happen.
You can peek [Wikipedia](https://en.wikipedia.org/wiki/Nuclear%5Fand%5Fradiation%5Faccidents%5Fand%5Fincidents?ref=connortumbleson.com) and thankfully the amount of accidents every decade is less than the year before. Perhaps that is the technological advance of our societies leading to enhanced safety mechanisms or more sadly a correlation with the less and less nuclear facilities in the world.
---
**Technology Advance**
It has been nearly 30-40 years since the United States built a new nuclear plant, so could that long of new science even invent a nuclear reactor type?
There is a lot of research and science following new and improved designs being denoted as Generation 4 Reactors:
- Sodium-Cooled Factor Reactor ([SFR](https://www.gen-4.org/gif/jcms/c%5F42152/sodium-cooled-fast-reactor-sfr?ref=connortumbleson.com))
- Very High Temperature Reactor (VHTR)
- Molten Salt Reactor ([MSR](https://www.gen-4.org/gif/jcms/c%5F42150/molten-salt-reactor-msr?ref=connortumbleson.com))
China is currently the first nation to begin construction of a Generation 4 reactor, building a VHTR, which started construction in 2016 and the last news announcement was installing main helium fans, which should be completed in 2020.
---
**Conclusion**
The era of energy is a huge political topic, but it will be fun to watch what will happen as this generation will have to see either the decommissioning or renewal of hundreds of nuclear plants.
For me in Florida, some of our nuclear reactors at Turkey Point are the first reactors in the history of United States where a reactor has been licensed beyond 60 years.
### A Few Bad Apples
URL: https://connortumbleson.com/2020/06/08/a-few-bad-apples/
Last updated: 2025-02-04T11:43:23.000Z
Photo by [Spenser](https://unsplash.com/@spensewithans?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
*Graphics in this post are not meant for everyone. If this was a movie it would be rated R or NC-17\. Fair warning.*
Today, June 7 2020 is not a pretty day, but it began on May 25, 2020 when George Floyd was killed in custody after passing a fake $20 bill at a grocery store.
George was unforunately committing a crime, while under the influence of fentanyl. However, regardless of those crimes - was death an acceptable resolution?
Obviously not, the story paints a picture where a Mr. Floyd does not want to enter the police vehicle due to claustrophobia, but to be honest is probably just the abundance of drugs in his system messing with his head.
This is where the situation goes pretty dark, the officers pin him to the ground resting a knee on his neck as the call for non-emergency medical goes out (due to bleeding from his mouth).
The call then gets upgraded to an EMS Code 3, which apparently means emergency medical assistance, but the knee remains on Mr. Floyd. This becomes 8 minutes and 46 seconds of kneeing on the neck as Floyd repeatedly says "*I can't breath*". The officer claims if Mr. Floyd gets in the car, he will stop to which Floyd says "*I can't*" for obviously being pinned to the ground.
[NYTimes - George Floyd Investigation](https://www.nytimes.com/2020/05/31/us/george-floyd-investigation.html?ref=connortumbleson.com)
Even after minutes pass of a pretty much lifeless body, Derek Chauvin continues to hold his knee on Floyd's neck. He only stops when the medical assistance basically points to removing the knee. As the ambulance transported his body to the nearby hospital Mr. Floyd was pronounced dead at 9:25pm local time (About an hour after the police arrived).
---
**Protests**
This led almost immediately to protests in the area in which a crowd of folks walked from the memorial to the Minneapolis 3rd Precinct headquarters. As the protests died down and the sun fell - it evolved to riots.
*This video has been removed for violating YouTube's Terms of Service.*
It is estimated that nearly 308 businesses were looted or completed destroyed (As of June 2). It is unfortunate that some folks take advantage of the protesting to escalate things to the point of burning down the city they live.
Morning comes and the city looks like something out of a post apocalyptic video game.
*This video has been removed for violating YouTube's Terms of Service.*
---
**Police Brutality**
This movement really just show how untrained some police personnel are. It is frankly embarrassing and disgusting these personnel are supposed to protect us. When it seems most can't deescalate a situation.
For some of the force, it seems they are living out call of duty excited to be taking down their own citizens.
[Cop waits in excitement, like it's a game - Reddit](https://www.reddit.com/r/PublicFreakout/comments/gtg2cb/cop%5Fwaits%5Fin%5Fexcitement%5Flike%5Fits%5Fa%5Fgame/?ref=connortumbleson.com)
You should like your job, but I don't think you should be excited to be yelling "*shut up bitch*" and attacking the folks you are sworn to protect.
---
This next clip is a group of friends sitting on their porch as military personnel patrol the neighborhood. The original clip hears the call out "*Light em up!*" to citizens on their own private property.
[Shooting civilians on their property.](https://www.reddit.com/r/PublicFreakout/comments/gtsaam/please%5Fmake%5Fthis%5Fgo%5Fviral%5Fi%5Fam%5Fbegging%5Fyou%5Fpolice/?ref=connortumbleson.com)
The curfew order literally said [this](https://dps.mn.gov/macc/Pages/faq.aspx?ref=connortumbleson.com)
> Can I be outside my house (on my property) after 8 p.m. and before 6 a.m.?
> **Yes**
After this incident was voted up on Reddit nearly 230,000 times and commented 22,000 times the FAQ page was updated.
> Yes. You can be on your porch, yard, patio, etc., but if a law enforcement officer or other public safety official asks you to go inside, or take any other action, you must follow the instruction.
You can watch the clip and there is no asking to go inside, the first verbal command we hear is "*Light em up!*". Absolutely disgusting.
---
This next clip is an elderly gentleman just engaging in commentary with the marauding police force.
[Niagara Square Incident](https://twitter.com/WBFO/status/1268712530358292484?ref=connortumbleson.com) \- June 4, 2020
This clip has been seen 80 million times at this time of this post and just shows that this police would rather push a gentleman to the ground at his age, ignore his recovery claiming "*we have an EMT with us*".
Buffalo Police, after this incident hit the news, suspended the two officers.
---
**Questioning Police**
Every instance I have with police is just bad. They are supposed to be protectors, but even my latest instance with them was not fun. My left hand turn out of my complex was blocked by a police car and they would not allow u-turns either at the upcoming intersection, so basically I was going to be late to work by 20 minutes.
I asked the officer why I couldn't take a turn as he ushered me and he refused to say, just saying "Sir, you need to go this way". Honestly, in any engagement from digital video game engagements to major choices at work. I always need to know WHY.
Turns out there was a fire at the house behind the high school and they were closing the major road in front of it. Why not just tell me that officer????
---
**Militarizing Police**
For this topic I just remember how our hospitals were pleading for masks and materials to protect the staff from the incoming COVID-19 patients. Yet it seems that every police department across the nation has enough military tech to go to war with its citizens. This doesn't seem right to me.
---
**Positive**
I can't just sit here and claim all police are bad, because we do have some great officers and below is a Michigan sheriff taking off his gear and speaking with the protesters and even walking with them!
[Flint, Michigan](https://www.reddit.com/r/PublicFreakout/comments/gtrcj3/michigan%5Fsheriff%5Ftakes%5Foff%5Fhelmet%5Fand%5Fdrops%5Fbaton/?ref=connortumbleson.com)
We are in sad times, but I cannot stay silent. Our police force needs to be completely revamped. Training is too short when it takes more time to be a hair stylist than police officer. If officers can't take some trash talk without escalating to guns, then they shouldn't be a cop.
I don't want to wake up tomorrow and see another human killed by the folks sworn to protect them.
### Isolation Day 77
URL: https://connortumbleson.com/2020/06/01/isolation-day-77/
Last updated: 2025-02-04T11:43:24.000Z
Photo by [Simon Migaj](https://unsplash.com/@simonmigaj?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is now the 8th COVID-19 post, but the 6th in this series of isolation ([Day 7](https://connortumbleson.com/2020/03/23/isolation-day-7/), [Day 21](https://connortumbleson.com/2020/04/06/isolation-day-21/), [Day 35](https://connortumbleson.com/2020/04/20/isolation-day-35/), [Day 49](https://connortumbleson.com/2020/05/04/isolation-day-49/) and [Day 63](https://connortumbleson.com/2020/05/18/isolation-day-63/)). While this has just taken a toll on the basics of life - we can dive into what has happened in the past two weeks.
---
**The Reopening**
Since day 63 a lot of things have re-opened. Some of my favorite restaurants have re-reopened, but they are only allowed to be at like 50% capacity and tables must be spaced 6ft apart. I see some clever tricks happening at some places where some new tables have been placed in hallways or outside in the parking lot.
I imagine this allows more tables properly spaced out, so they sit at 50% capacity. Since it is not feasible to get 50% capacity in the same space on top of having to space tables out.
There is a bit drama with stores requiring masks and some folks complaining loudly that it infringes on their rights. I think that is insane, because stores can refuse service for no shoes or shirt - so this seems like an extension. However, I'm not a lawyer and with the disability act - what if someone literally cannot put on a mask? That seems implausible, but I guess the business can just offer to shop/help on behalf of that use case.
---
**George Floyd**
Australia may have burned for months and a pandemic may be destroying the world, but once again one bad apple in the police force went over the line killing an African-American man known as George Floyd by kneeling on his neck.
At some point in America police stopped being an icon of support for a community, but a feared icon. For most, their only interaction with police is a traffic stop. For others, interactions with police may be the end of their life.
[Grand Rapids burning](https://twitter.com/AlexaSkonieski/status/1266966162446987265?ref=connortumbleson.com) \- [@AlexaSkonieski](https://twitter.com/AlexaSkonieski?ref=connortumbleson.com)
The day (Saturday May 30, 2020) started with peaceful protests around the states, but as night fell - things escalated. I wish all protests would be peaceful, but to be honest - even the peaceful ones I dislike if they disrupt me. Traffic gets blocked and errands or returning from work becomes a nightmare. I would never expect that a simple 20 minute drive would become 2 hours due to closed roads.
However, I also understand that you have to disrupt the world at times for a message to be heard because people keep dying. I don't think rioting is going to solve anything, it is just sad to see.
[Reddit - gifs](https://www.reddit.com/r/gifs/comments/gtq05v/nypd%5Fdrives%5Fthrough%5Fbarricade%5Fand%5Fprotesters/?ref=connortumbleson.com)
Not everything happened during the night. New York Police have been seen in the viral media due to the above clip. Blocking police seems rough because who knows if they are trying to go somewhere for a reason or just trying to maintain peace. I'll tell you running over citizens who you are sworn to protect is not the best path though.
---
**Proud to be Human**
[@SpaceX](https://twitter.com/SpaceX?ref=connortumbleson.com) \- [Twitter](https://twitter.com/SpaceX/status/1266906697454555137/photo/2?ref=connortumbleson.com)
Taking a break from the pure sadness of the rest of the world, humans have successfully privatized space travel with the human test by NASA to certify that SpaceX can be used for human travel to the ISS (and beyond hopefully).
Watching Dragon 9 DEMO-2 on Saturday was just amazing - the last hour of the countdown was so interesting to watch. Learning about the fuel loads and all the go/no-go checks that occur till the final 10 second countdown. It about brought me to tears watching this launch, it just felt proud to be a human.
Too bad the camera for the landing of the booster went out, because it is amazing to see the booster land back on Earth. I'm writing this post as Doug/Bob are under an hour from connecting to the ISS - that will mark the end of the "launch" and the only thing left is the return.
---
My office may open up soon, but otherwise this just feels like the new normal. Will driving daily back to work feel weird? Will buying gasoline weekly to fill up the car feel weird? I just want some sense of normal back, but I fear we have some time to go especially now with an invisible virus and visible riots.
### Things that confuse me
URL: https://connortumbleson.com/2020/05/25/things-that-confuse-me/
Last updated: 2025-02-04T11:43:25.000Z
Photo by [Melanie Dretvic](https://unsplash.com/@designwilde?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This post has always been a thought in my head and draft for awhile, but now this is the week where I finally complete it. This is a brain dump of things that just confuse my brain when I attempt to seek a solution. There might be a solution or answer for some, but they still boggle my brain.
---
**The UFO - "Bob Lazar"**
[Netflix - Bob Lazar - Area 51 & Flying Saucers](https://www.netflix.com/title/81083891?ref=connortumbleson.com)
In the early days of civilization before the boom of technology, I imagine lots of things were exaggerated because there was no video proof. Today in 2020 we suffer the reverse problem that deep fakes are so good you can have video proof and be unaware if it is true or not.
So the above, Bob Lazar, in short claimed alien technology was being studied at S-4 (A facility at Area 51) that leveraged elemental 115 to provided propulsion on a craft. At the time he mentioned 115, that was not an elemental yet - it is now known as Moscovium.
It just seems so insane and with no proof and more and more records proving otherwise, it either is the largest cover up in history or he is lying. Either way - I want to know.
---
**The Nuclear Race**
[Atomic Heritage](https://www.atomicheritage.org/event/march-28-1979?ref=connortumbleson.com)
For those alive in the 1960s onward you probably remember the huge race for nuclear power and expansion of cities. It was cut short due to public perception of safety after Three Mile Island and Chernobyl accidents. Nuclear accidents, [as I blogged](https://connortumbleson.com/2020/05/11/dangerous-nuclear-accidents/), can be immensely dangerous harming citizens simply in range of a nuclear plant.
While these accidents are overall quite small in the grand scheme of nuclear power - I'm just wondering why we haven't built any nuclear power since 1990\. We are a civilization that has 30+ years of additional knowledge. Can't we build things safer and better? I've watched phones in my short life time evolve from useless flip phones to mini computers packing 8gb of RAM in my pocket.
Maybe nuclear power will expand in my lifetime.
---
**Steven Avery**
[Making a Murderer](https://www.netflix.com/title/80000770?ref=connortumbleson.com)
This is a story that just grinds my gears. Steven Avery was wrongfully convicted in 1985 for a sexual assault and then got free 18 years later when evidence exonerated him. While a lawsuit was ongoing against Manitowoc County, Mr. Avery found himself once against accused of a crime - this time a murder of a women whose bones were discovered on his property.
At first glance this seems like a slam dunk case, especially with a confession from Brendan Dassey. However, the more you read about this case the more it gets strange.
- Dassey's confession is believed to be a lie (Dassey was 16 at the time)
- Manitowoc excused themselves from the case due to the ongoing lawsuit
- However, Manitowoc officials discovered all the incrementing evidence days after crime scenes were searched multiple times...
Everything about this trial and evidence just smells, which basically leaves two opinions. Steven spent 18 years in prison planning a murder for when he was released or Steven was framed due to an ongoing lawsuit by the state for 36 million.
I don't know what to believe anymore, but boy I want to know - because this itches my brain.
---
**Epstein didn't kill himself**
[Stephen Ogilvy - *Cosmo* magazine, July 1980](https://www.thedailybeast.com/when-jeffrey-epstein-was-cosmopolitan-bachelor-of-the-month?ref=connortumbleson.com)
This is just a disgusting story where a wealthy individual (\~500 million) Jeffery Epstein gets caught and pleaded guilty of just sexual disgusting things with underage women. We are talking prostitution, solicitation and trafficking - so pretty damn bad.
What makes this even worse is this is a wealthy individual had private residences on the Virgin Islands which have been claimed to be wired with hidden cameras. So other wealthy individuals would visit under promise of underage women and be recorded for blackmail.
Until he was caught and thus in prison. Truth was coming out and the iceberg of how large this scheme was growing. That was until July 23, 2019 where Epstein was found dead in his cell. Lets figure out why this is suspect.
- He was moved in a special unit with a cellmate to be checked every 30min
- His cellmate was transferred and was not replaced
- Guards failed to check on him for 3 hours
- The cameras malfunctioned that faced his cell
- The guards falsified records
The public wants to believe that someone in the circle of big money asked for him to be killed before he talked. Federal prosecutors seem to agree something is fishy so they are still investigating. I want to know what happened in that prison before I die.
---
4 stories. 4 things that confuse me. Maybe one day that list will shorten with the truth released.
### Isolation Day 63
URL: https://connortumbleson.com/2020/05/18/isolation-day-63/
Last updated: 2025-02-04T11:43:26.000Z
Photo by [Tanya Nevidoma](https://unsplash.com/@nevidoma?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is now the 7th COVID-19 post, but the 5th in this series of isolation ([Day 7](https://connortumbleson.com/2020/03/23/isolation-day-7/), [Day 21](https://connortumbleson.com/2020/04/06/isolation-day-21/), [Day 35](https://connortumbleson.com/2020/04/20/isolation-day-35/) and [Day 49](https://connortumbleson.com/2020/05/04/isolation-day-49/)). While this has just taken a toll on the basics of life - we can dive into what has happened in the past two weeks.
**Flatten the Curve**
The news is proclaiming that the worse of this is over, tests are available and the slow "re-opening" of businesses can begin. Restaurants have been allowed to operate at 25% capacity, which [becomes 50% on Monday](https://www.flgov.com/wp-content/uploads/2020/05/EO-20-123.pdf?ref=connortumbleson.com). We can peek at the curve for just Florida to see if this claim is true.
[Google COVID-19 Dashboard](https://www.google.com/search?q=florida+covid+graph&oq=florida+covid+graph&aqs=chrome..69i57j0l6.3668j0j7&sourceid=chrome&ie=UTF-8&ref=connortumbleson.com)
The curve, if you drew a line, for sure has a general downward trajectory. It isn't perfect, because the peeks are still 800\~ cases a day. However, as sad as it is to admit the stats show really only the older generation is the chunk of deaths.
> In Florida, 83 percent of those who’ve died of the virus were over 65 years old. One in four people over 85 with a confirmed infection has died.
> [tampabay times](https://www.tampabay.com/news/health/2020/05/17/in-florida-83-percent-of-coronavirus-deaths-are-people-65-and-older/?ref=connortumbleson.com)
So it sounds like our state will slowly re-open, but if you are over 65 years old - I wouldn't leave your home. You can't trust what other people will do for your safety and you'd be basically rolling the dice with death.
---
**Work**
Working 63 days at home proves that the majority of working adults are perfectly capable of self-organizing a schedule to get what is needed done without driving to a physical building and working x to y. This is obviously not possible in fields where physical presence is required, but it was an interesting test to basically overnight force all employees to work from home.
However, this isn't the same for all employees as you can read online. Some may have kids, some may lack a professional space for working, some may be distracted when not at the office.
My setup - Gaming / Hobby / Work
For myself - I live alone and program on the weekends and program for work on the workdays. If this hasn't proven that I do enjoy programming, then I don't know what will. I may be going a bit crazy with this isolation, but tons of hobby projects have received much needed updates.
I sit above with my work laptop (no additional monitors), usually The Office running on repeat or some techno music stream. The chair thankfully is a Workpro Quantum 9000, which I purchased after my back surgery. Since honestly, if your insurance [spends $136,000](https://connortumbleson.com/2020/03/09/30-hours-136-000-later/) to fix your back - you can buy an expensive chair to protect the ole back.
---
**The Apartment**
> *The pool will be open from 11am to 5pm to *authorized lease holder residents only*, at a maximum capacity of 50%. *Any minors, 18 years old or younger must be accompanied by an adult lease holder.**
My apartment pool is re-opening, but most of the chairs are gone and you have to get a wristband in order to go. These wristbands really just stop friends of friends from all attending since you only get 1 per person in apartment. If you remember back to your childhood or mine, we for sure just bounced around neighborhood pools for whichever had the most relaxed rules. So I can't blame the kids who show up in a horde to swim and chat among themselves - I was there once. For now, they just have to wait till this thing is over.
As a mini rant about how they handled this - this is a snippet from an email.
We got this email and I noticed these words "*updated guidelines*", but to my surprise I could not find anything different from what is normal.
- Rent is still due by 3rd.
- A note about social distancing, so use online...
- Another note about paper (checks, etc) in drop box like normal...
- Another reminder about no staples, envelopes etc like normal...
- Another note about how to fill out a money order...
- Another note about the delayed utilities charges in panel...
- A final "*additional questions*" note
Am I crazy with the hundreds of emails I have from companies that with language like "*updated guidelines*" something would change? Because you know paying for a pool, clubhouse, grills and gym while none were accessible for 52\~ days is pretty unfortunate.
Don't worry though, look at what positive thing we did get!
Mon, Mar 30, 2020, 6:46 PM - No ACH fees
No more fees for ACH (online) transactions! However, before you get your hopes up. Lets see what this fee actually is, because this fee wasn't always here.
Wed, Jan 30, 2019, 7:40 PM - ACH Fee Added
So basically, January of 2019 we got an email that our rent payments would be going up by $1 little dollar for each transaction if paying by ACH. Rent sadly isn't just one transaction, but 5 for each sub group (Rent, Garage, Pest, Water, Trash) but that is getting waived.
Funny enough, that is a 3rd party company so my guess is they waived such fee being a nice company, then downstream (my apartment) benefited from it and tried to market it as its own.
---
**Conclusion**
Everyone is just trying to survive this unprecedented time of life so maybe I'm being too harsh on my apartment. Who knows, hopefully this ends soon.
### Dangerous Nuclear Accidents
URL: https://connortumbleson.com/2020/05/11/dangerous-nuclear-accidents/
Last updated: 2025-02-04T11:43:26.000Z
Photo by [Dan Meyers](https://unsplash.com/@dmey503?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Quarantine life has led me to research more and more about everything [nuclear](https://connortumbleson.com/tag/nuclear/), joining a tag on this blog that already has a few posts. It started with research on why we haven't finished a nuclear plant (In the US) since 1990.
Only those alive in the 1960s to 1970s would remember the huge growth of nuclear expansion that was ultimately cancelled before or even during construction. I didn't realize the pure scale of a plant until some explorers on YouTube went visiting the abandoned [Hartsville, Tennessee plant](https://en.wikipedia.org/wiki/Hartsville%5FNuclear%5FPlant?ref=connortumbleson.com).
So what caused nearly 50% of the 253 reactors from 1953 to 2008 to be cancelled in the United States? This is obviously the huge perception change that occurred after a few nuclear accidents, which resulted in the US Nuclear Regulatory Commission expanding the regulations to protect the public health.
The increased delays for licensing pushed costs higher and with the public turning against nuclear - plants were cancelled.
So for this post, lets dig into the worse nuclear accidents and figure out how we classify them.
---
**International Nuclear Event Scale (INES)**
[iaeg.org](https://www.iaea.org/resources/databases/international-nuclear-and-radiological-event-scale?ref=connortumbleson.com)
This scale was produced to help communicate the significance of any nuclear event to the world. This is because the general public is not versed in nuclear reactions to completely understand the ramifications of any type of accident.
When you hear about a tornado with 150mph winds most folks can understand the severity of that issue. However, tell someone they just took a dose of 200 rads due to an accident. What does that mean? - I can't tell you because the units of a regular MRI is a different unit than rads and I honestly don't know the conversion.
So lets look at the top accidents and see why some have some debates over the INES scale.
**Level 7 - Major Accident**
- Chernobyl, USSR (1986)
- Fukushima, Japan (2011)
**Level 6 - Serious Accident**
- Kyshtym, USSR (1957)
**Level 5 - Accident with Wider Consequences**
- Sellafield, United Kingdom (1957)
- Harrisburg, Pennsylvania (1979)
- Chalk River, Ontario (1952)
- Goiania, Brazil (1987)
The lower we get the more events that show up, but looking at the top 3 deadly classifications is enough for this blog. So some criticism has begun because another event joined Chernobyl at Level 7 which arguably probably should have its own level to the sheer scale that accident was.
The arguments really root from the fact that the INES scale has an upper limit at 7 which is tough because it naturally causes people to compare/contrast disasters. So this led to the proposed NAMS scale.
**Nuclear Accident Magnitude Scale (NAMS)**
This scale works off the quantity of radioactivity released into the atmosphere and is graded in the way that each 1.0 jump on the scale correlates to a factor of 10 increase in severity.
This scale really hasn't caught on, but here are known disasters re-rated under NAMS:
- Chernobyl - 8.0
- Three Mile Island - 7.9
- Fukushima - 7.5
- Kyshtym - 7.3
So the Three Mile Island accident, which was a Level 5 on INES, is a 7.9 on NAMS, which is a bit tough to correlate, but can be answered by the peek of the disaster.
This is much like a hurricane which may be CAT5 all the way though the ocean, but right before it makes landfall be downgraded to CAT4\. The reports after the fact will call it a CAT5 (for the peek), but for the majority of land travel it was not a CAT5.
So now lets peek at a few of the most dangerous nuclear accidents.
---
[ModernClassics.info - Goiania](https://modernclassics.info/Worst%5FNuclear%5FAccidents/nuke-accident-5.html?ref=connortumbleson.com)
**Goiania Accident, Brazil 1987 - Level 5 INES**
This is classified as an accident, but is really a theft gone wrong. An abandoned hospital was looted and some radioactive source (caesium chloride) was stolen as the unique glow it emitted was cool. It was passed and traded among many until people started dying and the government intervened.
---
[Wikipedia (Z22)](https://en.wikipedia.org/wiki/Three%5FMile%5FIsland%5Faccident?ref=connortumbleson.com#/media/File:Three%5FMile%5FIsland%5FNuclear%5FGenerating%5FStation.jpg)
**Three Mile Island, Pennsylvania USA - 1979 - Level 5 INES**
This was the worse (so far) nuclear accident on United States soil in which a failure in a non-nuclear system caused reactor coolant to leak back through a broken open value into an air line. This caused the pumps to turn off and trigger an automatic emergency shutdown.
As the control rods inserted to halt the reaction, secondary pumps began to cool the decay heat still there, but they stopped working which should have led to the auxiliary pumps to kick in. However, they were all shutdown for maintenance. The story continues with just a chain of events that ultimately resulted in the core overheating and melting inside the inlet leaking radioactive elements into the area.
---
[ModernClassics.info - Kyshtym](https://modernclassics.info/Worst%5FNuclear%5FAccidents/nuke-accident-8.html?ref=connortumbleson.com)
**Mayak, Kyshtym, USSR - 1957 - Level 6 INES**
A production site in modern day Russia had an issue where a cooling system for radioactive waste went offline and was not repaired. While unknown why it wasn't repaired, the temperature simply rose until an explosion occurred blowing the roof (160 tons of concrete) off the facility.
Due to the shroud of secrecy that resolved around the USSR and nuclear related activities made this really difficult to research even decades layer.
---
[ModernClassics.info - Fukushima](https://modernclassics.info/Worst%5FNuclear%5FAccidents/nuke-accident-9.html?ref=connortumbleson.com)
**Fukushima, Japan - 2011 - Level 7**
The most recent and dangerous accident yet which joined Chernobyl at Level 7 on the INES scale. What was ultimately caused by an earthquake (shutting down the reactor automatically) then tsunami (flooding the generator) caused the temperature to continue to rise.
As heated steam escaped to suppression pools the mixture of gases and water led to explosions in 3 of the reactors. Now cooling methods weren't properly working which led to the remaining water evaporating exposing the fuel and started melting into corium.
Like all nuclear accidents such a large chain of events result in an accident, so this tiny post does not give it justice. For more information, I liked the detail video below.
---
[ModernClassics.info - Chernobyl](https://modernclassics.info/Worst%5FNuclear%5FAccidents/nuke-accident-10.html?ref=connortumbleson.com)
**Chernobyl, USSR - 1986 - Level 7**
Now we arrive at Chernobyl that everyone knows about. A delayed test (resulting in the reactor running at low power) led to an abundance of "poison" (xenon 135) not being burned off due to low power.
So the reactor when needed to be brought up for the test (it had fallen even further) had the control rods pulled out to effectively increase the power. Details are fuzzy on what happened during the test, but the emergency shutdown was triggered (which is common) to shut down the reactor after the test.
Unfortunately the control rods were tipped with graphite which when began inserting accelerated the reaction process and caused some fractured fuel lines blocking the control rods in a partially inserted position.
The reaction was accelerating now uncontrollably due to the tipped control rods which led to an explosion after the plant registered a power 10 times its maximal operational output. [Estimations](https://www.independent.co.uk/news/world/europe/chernobyl-disaster-cause-scientists-wrong-nuclear-power-plant-accident-ukraine-study-a8067026.html?ref=connortumbleson.com) later on put the explosion at nearly 10 tons of TNT.
---
**Concluding**
I wonder if nuclear energy will make a revival with the construction of new plants and reactors in my lifetime. Until then, I will just have to keep researching mistakes of the past.
### Isolation Day 49
URL: https://connortumbleson.com/2020/05/04/isolation-day-49/
Last updated: 2025-02-04T11:43:28.000Z
Photo by [Aaron Burden](https://unsplash.com/@aaronburden?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is now the 6th COVID-19 post, but the 4th in the series of isolation ([Day 7](https://connortumbleson.com/2020/03/23/isolation-day-7/), [Day 21](https://connortumbleson.com/2020/04/06/isolation-day-21/) and [Day 35](https://connortumbleson.com/2020/04/20/isolation-day-35/)). While this has sadly just become the new temporary normal - there is still a bit to talk about.
**Shopping**
Publix has stepped it up once again all the blue painter tape has been removed and the marketing department has created:
- Full height banners
- "Stand up" green tape
- Directional arrows for aisles and walkways
Basically instead of Publix looking like an emergency setup before a hurricane, it looks like corporate solidified a design change for how all the stores should look during this time.
Standing in line at Publix
---
**Arguments**
As I approach day 50 of isolation, I've noticed we've hit that phase where everyone thinks they are right. One thing that bothers me the most is people saying "*Well 60k people die every year from the Flu and we don't shut the economy down.*"
[CDC - 2019 Flu](https://www.cdc.gov/flu/about/burden/preliminary-in-season-estimates.htm?ref=connortumbleson.com)
Though, I don't think people realize that on average between 39 million and 56 million Americans get the flu yearly. Lets take the middle point of infections and deaths.
*Flu: 43k deaths (avg), 45.7 million infections (avg) = 0.094% death rate*
Lets play that over stats as of today (May 3, 2020) for COVID-19 in the states.
*COVID-19: 67k deaths, 1.165 million infections = 5.75% death rate*
That basically shows that this thing is dangerous and I can't believe people still relate it to the flu. Do you know what 5.75% of 45.7 million is? That is 2,627,750.
---
**Monotony**
It is amazing how quickly something new can become a routine. The world may be bleak with jobs threatened everywhere, but we have time to establish a new monotonous routine.
I find myself going to bed early, waking up earlier and just working more than I would in a physical working space. The line between work and personal has been blurred since I'm always home now. I can order from Uber Eats and just sit in the same corner of my apartment for hours on hours.
There is this patch of grass behind my apartment complex and I only rarely see someone tossing a Frisbee or playing catch with a dog. Now that area is littered with camping supplies and cookouts and busy every moment of the day. Not only that, but it is trashed. I see a bag of charcoal just laying empty, knocked over chairs and trash.
The only thing I can excuse being left behind is the fire pit, because those stay hot for quite a while. What is wrong with people during this pandemic? Can't they pick up things when they are done? Is this how they treat the beach when I can't see them?
---
**Conclusion**
As this blog post shows there isn't a lot of energy this week. This is the new normal and I'm waiting for our city to return to normal. I miss my escapes to the islands or trips to nature preserves. I want to drive (strangely) and sit at my organized work desk.
HaloDepot - Launching soon.
Though I've found some drive for a new hobby project. Halo Depot is launching soon to index and archive patches for modified .map files. A future post will dive into the details for that.
### 3 Generations of Halo Modding
URL: https://connortumbleson.com/2020/04/27/3-generations-of-halo-modding/
Last updated: 2025-05-09T14:31:31.000Z
My Original Xbox
So this post is about three generations of modding - the community, the tools and the changes from my memory.
My intro to modding began with Halo 2 on the original Xbox. This was as easy as buying [Splinter Cell](https://en.wikipedia.org/wiki/Tom%5FClancy%27s%5FSplinter%5FCell%5F%28video%5Fgame%29?ref=connortumbleson.com) and getting some sort of device for modifying saved games on a memory unit. This was huge - anyone could "[softmod](https://en.wikipedia.org/wiki/Softmod?ref=connortumbleson.com)" their box by simply buying two relatively cheap things.
If you are interested in how this actually worked, [XboxDev Wiki](https://xboxdevwiki.net/Xbox%5FSavegame%5FSystem?ref=connortumbleson.com) has tons of details for the process, which was basically finding vulnerabilities (in this case a buffer overflow)
I'm under the belief that an easy to mod console with a cheap barrier to entry led to the explosion that was Xbox modding, specifically Halo 2.
[Halomods](http://old.halomods.com/forums/?ref=connortumbleson.com)
Halomods was the home to hundreds of utilities and thousands of thousands of discussions for modifying the game. Tools were built for controlling the water on levels while many other tools were full blown map editors. Competing sites launched and the scene erupted with chats strewn across IRC, AIM and MSN.
Those old enough to really understand the technical complexity of things could even leverage debug dashboards and certain version of Visual Studio (I think 2003) to attach a debugger to the Xbox itself. This would make research eons better as well as growing to the continued expanse of tools (Xbox Media Center, Xored Trainer Launcher and Xecuter Mod Chips)
Doing anything for 6+ years takes a toll though and the leadership around Halomods retired as the Xbox 360 and Halo 3 was about to be released. This takes us to my 2nd generation of Halo modding with the Xbox 360.
---
My Xbox 360s (Test kit, JTAG, etc)
This era of modding entered the world of hiding knowledge behind walls. The previous generation shared information, but this was difficult as popular mainline revision services like GitHub, Bitbucket and Gitlab simply did not exist yet.
So lets talk the process of modifying Xbox 360s which was not easy. You basically had to purchase a developer kit (illegally) or discover an exploit in the console for retail users to chain into something to run home brew code.
AssemblerGames (Shutdown in 2019)
AssemblerGames became a place to buy "kits", which ranged in price from a few hundred bucks to thousands of dollars. If you were lucky enough to get one of these you could experience the modification of Halo 3, 4 and Reach. However, nothing ever resembled the community and knowledge that Halo 1/2 offered.
Instead communities spawned aligning themselves behind some closed source massive game save editors. I remember from memory Modio, Horizon and Valhalla which was an interesting era. Sites competing against supporting the most amount of games for tool editors.
Horizon
The folks I hung around were on team Horizon and we hated Modio. This started an ugly era of the scene where research was locked behind payment and stuck in Skype chats and passed between groups. It almost became like loyalty to a specific site and this led to large groups being formed. I remember sitting in chats and being asked to ban a user because of x,y,z (I was still running iBotModz at that time).
Though this was not good for the growth of the scene. It was more beneficial to keep research, tools and plugins locally and promote your own website or YouTube instead of putting whitepapers forward.
I was semi guilty of this myself, racing to find a secret in some research that I was keeping to myself.
Halo CE - [Debug Mode](http://ibotmodz.net/forum/topic/20975-halo-ce-debug-mode/?ref=connortumbleson.com)
This is not at all what the leadership of the Halo 2 era wanted. They gave us whitepapers in 2004 ([Iron Forge's H2 Whitepaper](https://xboxdevwiki.net/Halo%5F2?ref=connortumbleson.com)) and the next generation of Halo simply destroyed that chasing fame and fortune instead of sharing.
There was a light at the end of the tunnel though and that was the return of open research. Kornman's [Open Sauce](https://bitbucket.org/KornnerStudios/opensauce-release/wiki/Home?ref=connortumbleson.com) launched which included an interesting license attached to it.
> OpenSauce is [licensed under GPLv3](http://www.gnu.org/licenses/lgpl.html?ref=connortumbleson.com). The main reasoning behind this is to force the community to share derivative works.
I don't really know how to enforce an open source license if someone violates it, but Kornman was around during the beginning of Halo era so I imagine he could relate to the drastic changes between the scenes as later Halos were released.
This good fortune continued with another good boom for the community as XboxChaos launched the following with source code for free:
- [Composer](https://github.com/XboxChaos/composer?ref=connortumbleson.com) \- Halo 4 Audio Extraction
- [Liberty](https://github.com/XboxChaos/Liberty?ref=connortumbleson.com) \- Halo Gamesave Editor
- [Nitrogen](https://github.com/XboxChaos/nitrogen?ref=connortumbleson.com) \- Halo 4 Map/Game Variant Editor
- [Assembly](https://github.com/XboxChaos/Assembly?ref=connortumbleson.com) \- Multi-Generation Blam Engine Research Tool
Though the damage was done - the barrier to entry was still too high. While some retail exploits were discovered they were either [too complicated](https://free60project.github.io/wiki/King%5FKong%5FHack.html?ref=connortumbleson.com) (KK Hack), [too restrictive on requirements](https://free60project.github.io/wiki/King%5FKong%5FHack.html?ref=connortumbleson.com) (JTAG Hack) or just [too finicky](http://www.logic-sunrise.com/news-341321-the-reset-glitch-hack-a-new-exploit-on-xbox-360-en.html?ref=connortumbleson.com) (RGH Hack).
Though people pushed on (normally pushing for COD hacks) - I took the JTAG route and soldered cables together to get myself into the game. It was not that fun - as nothing built resembled the spectacular nature of the modifications I experienced in Halo 2\.
---
My Gaming PC
So now we reach the 3rd generation of Halo modding which as the photo suggests is on the PC. Halo MCC is launching title by title (Currently retail just has Reach and Halo 1) which is promising the return of modding for Halo 2, 3 and 4.
I don't know the scene anymore, I don't know where people hang out. I'm hoping research continues in the open light and based on Assembly having commits in the past 48 hours might prove the era of open research is back.
Assembly - [GitHub](https://github.com/XboxChaos/Assembly?ref=connortumbleson.com)
I'll keep following the scene, helping where I can and patiently awaiting Halo 2 and 3 on the PC.
### Isolation Day 35
URL: https://connortumbleson.com/2020/04/20/isolation-day-35/
Last updated: 2025-02-04T11:43:29.000Z
Photo by [Cassie Boca](https://unsplash.com/@cassieboca?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is now my 5th post ([Day 7](https://connortumbleson.com/2020/03/23/isolation-day-7/), [Day 21](https://connortumbleson.com/2020/04/06/isolation-day-21/)) on this subject, but the world will never hear the end of it and my blog is no exception. Let's take a look at what has changed since day 21 of my isolation.
**Shopping**
My trips to Publix have introduced a new change among this pandemic. First was the forced [direction of aisles](https://www.tampabay.com/news/business/2020/04/10/publix-introduces-one-way-aisles-to-promote-social-distancing/?ref=connortumbleson.com) with large signs saying "wrong way" with the arrows directing which way traffic should go. An interesting change to stop folks constantly passing back n forth from going any direction down the aisles.
Sadly toilet paper is still no where to be found - counting down the days till a new problem appears, but in good news Publix opened a special hour early in morning and late at night for first responders and hospital staff.
---
**Curfew Come, Curfew Go**
**[April 13 - Curfew Starting Tonight](https://www.tampabay.com/news/health/2020/04/13/hillsborough-has-a-curfew-starting-tonight/?ref=connortumbleson.com)**
A surprise announcement on April 13th said a curfew was starting in Hillsborough (my county). It was quite a confusing [announcement](https://www.tampabay.com/news/health/2020/04/13/hillsborough-has-a-curfew-starting-tonight/?ref=connortumbleson.com) with some officials saying that "*walking and jogging outside is not essential*" therefore blocked between 9pm and 5am. However, the Twitter account of Tampa tweeted that it was allowed.
This is only lasted a few days until Thursday morning when the curfew was rescinded.
[April 16 - Curfew Scrapped](https://www.tampabay.com/news/health/2020/04/16/hillsborough-scraps-curfew/?ref=connortumbleson.com)
> “I believe we made the wrong decision at our last meeting,” said School Board chairwoman Melissa Snively.
So that was interesting to read about, but I believe our city was just trying to curb the abuse that continues. Parties being busted with over 100 people in attendance is just the beginning - people are ignoring the stay at home order so the city tried to step up the rules.
However, much like copyright and warnings on DVDs that can't be skipped - they only affect legitimate folks. Once illegal films are created that content is ripped out and never seen again. The folks continuing to host parties are not going to be stopped by some curfew until they are arrested.
---
**Numb (Ft. Linkin Park)**
While the song and video is about depression, I wanted to just draw the point about everyone is just becoming numb to this situation. While my whiteboard has just hit day 35 - that means I've been working at home (required) for 35 days.
News isn't worth watching with about two sides arguing consistently between more lock-downs and opening up America. I can't pretend to know what will work.
If you sit on the side of "herd immunity" - there is the understanding that through natural or vaccines you just ride out the infections quickly and at once. This would more than likely overwhelm the hospitals and result in loss of life for the at risk groups. I don't think this will work as we don't really have a vaccine or know a lot about COVID-19.
The flip side is just locking down a city (ala South Korea) and stopping contact for 21 days to recover from any cases. This is a tough battle, because once re-opening it just takes one affected person to restart the entire thing again (since no immunity). I heard an interesting thing that compared deaths from virus to deaths from unemployment. Will the deaths from everything shut down and fallout be more than the virus itself?
That is probably too tough to tell. We can peek at the CDC [website](https://t.co/nKL6CKKYC6?amp=1&ref=connortumbleson.com) for Swine Flu in the states and then take the [numbers](https://www.worldometers.info/coronavirus/country/us/?ref=connortumbleson.com) for USA.
- Swine Flu - 12 months - 60 million cases - 12,469 deaths - 0.02% kill rate
- COVID-19 - 90 days - 710,272 cases - 37,175 deaths - 5.23% kill rate
Which is just bleak and sad to read.
---
**Money Please**
This section is about the stimulus payments that have arrived since Day 21, basically money (up to $1200 I think) for every American who fit some criteria. I should have probably taken more business classes in school, because where does that money come from? That is nearly 2 trillion dollars which I can't even fathom as an amount.
Outside of individuals, the PPP (Paycheck Protection Program) started for businesses.
> The Paycheck Protection Program (“PPP”) authorizes up to $349 billion in forgivable loans to small businesses to pay their employees during the COVID-19 crisis. All loan terms will be the same for everyone.
> [Treasury.gov](https://home.treasury.gov/system/files/136/PPP--Fact-Sheet.pdf?ref=connortumbleson.com)
[Outcome thus far of PPP - April 16](https://home.treasury.gov/system/files/136/SBA%20PPP%20Loan%20Report%20Deck.pdf?ref=connortumbleson.com)
This was an interesting, but sad graphic after reading what the Internet had to say. Basically the lender column was hidden to protect the banks, but you can see immediately from the numbers which company helped small vs large businesses.
Though, first come first serve shouldn't have a merit on the size of a business. That is until you read some first hand experiences about it [online](https://news.ycombinator.com/item?id=22901237&ref=connortumbleson.com). The banks weren't fighting an easy battle either with this unverified snippet.
> *Throwaway, because I work for a bank doing PPP. First off, I want to say I feel for anyone struggling - I know from my exposure a lot of loans didn't get in. We had random people from all over the bank working nights and weekends trying to get these loans into the SBA. The news didn't do justice how much of a disaster this program was with the SBA. For example during training, the SBA app crashed 11 times while trying to enter one application - and this was after hours. We spent days on the phone trying to get someone to get us access to the SBA's API - no one could help us. In the end, a lot of loans didn't end up getting into the system.*
> [https://news.ycombinator.com/item?id=22904919](https://news.ycombinator.com/item?id=22904919&ref=connortumbleson.com)
I can't really speak to this, but for anyone dealing with this - it looks rough.
---
**Nothing is Immune**
The last section is for my own job which was not immune to this. A sad all-hands call as we learned the measures that had to be enacted to increase our survival. I still have a job for now, but I took a cut for the company to survive.
We need this thing to end before we start living the movie - Book of Eli. With that - I'll see you next week. The blog never sleeps.
### Halo 2: Patch Format Types
URL: https://connortumbleson.com/2020/04/12/halo-2-patch-format-types/
Last updated: 2025-02-04T11:43:30.000Z
Four years ago I made a [blog post](https://connortumbleson.com/2016/05/06/phantom-mappack-project/) about a distant Halo 2 memory - discussing the thought process behind launching a modded mappack. I find myself during this global pandemic having more time at home, thus I booted up my old chipped Xbox and wanted to start writing this stuff down before it fades into the past of the Internet.
One thing that always escaped my mind as a young kid patching Halo 2 map files, is how did patch formats even work? So I began a deep dive investigation into `.ppf` , `.sppf` and `.serenity` patches from the Halo 2 world to figure out how they are made and what makes them different.
---
**PPF**
First up we have `.ppf` which was actually started a long time ago. I can't pinpoint the exact release date, but a few discussions with folks place it between 1994 and 1996\. So a common question is how does a program that predated Halo 2 by 10 years work for patching the map files?
Lets take a step back and understand how patching works. Lets pretend you (the reader) and I (the writer) both have the same large file. If I wanted to correct something in that file, I have two options --> send you the modified file or tell you what to change in yours.
We are in the late 1990s or early 2000s here - it wasn't exactly easy to share large files (40-100mb) and not to mention probably illegal due to it being some licensed game content.
This enters the world of patches. An automated way of preforming actions on a clean (unmodified) file to produce the same exact dirty (modified) file.
So lets say I produce the following file.
```
ABCDEFG
Connor
Test
```
Clean File
If I change it to
```
ABCDEGG
Connor
Test
```
Modified File
I can tell my friend - "*Go to the letter F in line 1 and switch to G*" and that will work. However, in the real world not everything is pretty human readable text so that may not always work. So if I take those two files and ask PPF Studio to generate a patch. I get a tiny little 70 byte patch file.
ghex - Ubuntu
As you can see, most of this file is just the "magic" to denote it as a PPF3.0 patch along with a little description. We can see that offset 5 (last line in image above) has `0x147` associated with it - which we have to think about. The first part (`0x1`) represents probably 1 byte to follow, followed by the byte - `0x47` (decimal 71 or ASCII 71 or *G*). So if we broke it down to English the character in position 6 will be replaced with 1 character which will be *G*.
Screenshot of PPF-O-Matic by Paradox Team
Now above I simply select the "clean" file and then the 70 byte patch file produced. It probably works the same way as a human, but automated. It sees that offset 5 should be `0x147` (1 length of value `0x47`) so it seeks to that location and sets the value, overwriting what is there. The clean file given should now match the modified file above.
Now lets talk about how this works in theory with "shifting". If you begin adding/removing bytes this will cause every character to "shift" the position it is in. This may result in a very large patch format which will take even longer to apply. As more than likely every byte after the shifted characters will have also moved a location.
Not to mention with a name `PPF` which stands for **P**laystation **P**atch **F**ormat proves this format wasn't even designed for Halo 2\. Though I was curious who produced this patch type and it wasn't easy to dig that up. The best I got was the team behind PPF-O-Matic which was *Icarus*, *H2O* and *Zweifeld* of Paradox.
> Paradox is an Amiga and console cracking group. They were originally formed in late 1989 by members of the Danish group [Trilogy](http://demozoo.org/groups/711/?ref=connortumbleson.com)
> Demozoo.org - [Group #1853](https://demozoo.org/groups/1853/?ref=connortumbleson.com)
These guys started with Amiga & Playstation mods, which were just patches on top of the games. It seems the Paradox team's first release was in 1995 on the Amiga so this group had been around for quite awhile. From research on those 3 members, 2/3 of them are from Germany so I can only guess that the 3rd is as well.
So now we enter the realm of Super PPF and Serenity, which were enhancements in the realm of `.map` patching.
---
**SPPF**
SuperPPF UI - Comics Sans & Rainbows
The story here is interesting - a member known as "*low8*" which had never before been seen in the scene posted this program around September of 2006\. It was promoted as producing smaller patch files than PPF and including both the creation of patches and applying of patches inside the same tool.
Remember, the very generic `.ppf` patch required both PPF Studio (to make) and PPF O Matic (to apply), but could be applied to really any type of file.
SuperPPF did indeed produce smaller patches by introducing 4 blocks (chunks of data) to prevent large shifts. Basically if you added data into a specific tag those changes would only shift until that block ended, unlike `.ppf` which would make patches as large as the original map file. This meant that patches were generally smaller and the ease of use sky-rocked the program into the hands of all Halo 2 modders. If a mod was posted with only a `.ppf` patch normally the first few response were pleading with the poster to add support for `.sppf` or `.serenity`. Since smaller files were easier to transfer and apply.
So why did *low8* produce Super PPF? The design was obviously a big joke rocking comic sans font and a huge mess of rainbow colors. The name hinted at mocking other members of the HaloMods scene. Was this another known member playing a joke?
Whoever low8 was took some small effort into building the most basic but effective patch tool of that time-frame. If we examine a disassembly of the application, we see all assembly metadata was empty.
```
[assembly: AssemblyCopyright("")]
[assembly: AssemblyTitle("")]
[assembly: AssemblyKeyFile("")]
[assembly: AssemblyDelaySign(false)]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyKeyName("")]
[assembly: AssemblyProduct("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyVersion("1.0.2220.21515")]
```
[ILSpy](https://github.com/icsharpcode/ILSpy?ref=connortumbleson.com) \- SuperPPF.exe - April 11, 2020 Disassembly
The code for this application had zero obfuscation and looked like most first time developers with variables just being named "*num1, num2, num3, num4*". Though my guess is this was the intention. There was no error handling and there were no updates provided. This was SuperPPF - released once and quite popular despite all the strangeness that surrounded it. It was only after investigating Serenity did the dots begin to connect and allow us to discover who *low8* was.
---
**Serenity**
[XboxHQ - Release Announcement for Insolence/Serenity 1](https://www.xbox-hq.com/html/article2092.html?ref=connortumbleson.com) \- Jun 15, 2005
This program was built for Halo 2 in mind, it was not a generic patch tool for anything. Since it was built specifically for Halo 2 it had some really interesting features.
- Very small patch size
- Built in author/main-menu support
- A parse-able patch file for systems to read
What sounded like a good idea in theory just wasn't ready for the time span it was built in. The first release of Serenity I see was version 1 on June 15, 2005 and it's release had mixed reactions. Some appreciated the small patch size and features it had -- it patched quickly and provided a more professional patch for modders.
Serenity v3.30 by Iron\_Forge
However, building a patch format specific to Halo 2 required the map file to not be malformed completely. Some modders were just hex-editing a `.map` file at this point while any of the 15 other map editors may slightly invalidate some component of the map. This would mean that Serenity would simply not work, it expected perfection to produce perfection.
This would slowly change as versions were released:
- v1 - June 15, 2005 (*Released alongside Insolence v1*)
- v2 - June 29, 2005
- v2.02 - January 21, 2006
- v3 - March 20, 2006
- v3.1 - April 14, 2006
- v3.20 - June 25, 2006
- *(Release of SuperPPF) - September 2006*
- v3.30 - April 15, 2007
This proved to be problematic for the modders around during the releases. If you got a serenity patch you had to apply it for the version it was produced from. This became moot once v3 dropped as it could handle older Serenity patches.
[XboxHQ - Release Announcement for Serenity v2](https://www.xbox-hq.com/html/article2163.html?ref=connortumbleson.com) \- June 29, 2005
Ignoring that though, Serenity was powerful and had this aura of professionalism around it. HaloMods started allowing file uploads for it because the file size was normally very small. Additionally some sites (I think Snaver) built a web solution that could parse the `.serenity` patches and extract the meta information from it. This produced a cool table of mods that was dynamically produced simply from the patch file.
However, getting to perfection took 7 releases - which in 2005/2006 was not easy for the community. While auto updating programs are just the norm in 2020 - that was not the case back then. This meant that folks needed to track down the tool, download a newer version and maybe update a dot net framework.
*Iron\_Forge* was probably upset after building an amazing tool that folks continued to use `.ppf` for map patches. Computers weren't that fast in 2005, so*Iron\_Forge* decided to troll the community and release SuperPPF under a false alias of "*low8*".
The idea was simple. Make something so ugly and crazy but slightly better than `.ppf` to prove a point. I'm not sure if he intended the outcome. SuperPPF boomed as it just worked with maps thrown at it while the various Serenity versions suffered bugs and issues with malformed maps. *Iron\_Forge* would regularly remind folks in the release threads of Serenity that issues were with the maps, not the tool.
After about 6 months after SuperPPF's release, Serenity v3.3 dropped and that would be the last release ever to land. It included an interesting snippet in the release notes.
> New in Serenity v3.30 is NFG Mode...This will basically use the same 4 points as an sppf patch for those of you who are poor excuses for modders, don't care about the size of mod you're forcing people to get, and in general horrible human beings...This will allow you to take full advantage of the features Serenity provides, though it will mean for larger patches than the other 2 Serenity modes, which will usually prevent from halomods hosting, and thus additions to the serenity repository...It also means SPPF can be phased out the same way PPF has been, and we can all sleep easier at night...
> Iron\_Forge - Serenity v3.3 Release Notes
That comment just seemed strange especially with `NFG` mode which probably meant - "*No Fucking Good*" or "*No Fucks Given*". It seemed the joke had ran out and *Iron\_Forge* just wanted people to stop using `.ppf` and now `.sppf`. So now Serenity in this specific mode would replicate the behavior of SuperPPF, but also include all the benefits Serenity had outside of the patch size.
Additionally [Serenity v3.3](https://ibotmodz.net/forum/files/file/26-serenity-33/?ref=connortumbleson.com) had introduced "Non-compliant" mode. The default mode was to break the map into 35 blocks + a block for every single tag.
> A tag basically represented [every resource](https://github.com/XboxChaos/Assembly/tree/dev/src/Assembly/Plugins/Halo2?ref=connortumbleson.com) of a map (biped, sound, item, etc) and was the building block the Blam engine leveraged for .map files.
This was great as any change to a tag would be isolated to that block, but break if a map was not built in the best of ways. So non-compliant mode just used a single block for all meta information which generally lead to a succesful creation of a patch (though less optimized).
All in all, Serenity was just a professional piece of software. Dialog boxes had filters to only look for `.serenity` files and likewise the clean file had a filter for `.map` files. It would read the Serenity patch to automatically find the clean map (if they were named the same as on the disc) as well as producing a new `.map` file named after the mod. This would prevent dirtying up clean maps which was a very helpful enhancement.
---
With that, I'll end this deep dive into the Halo 2 era of `.map` patching programs. If I messed anything up or you can correct something I said - feel free to leave a comment or contact [me](https://connortumbleson.com/author/connor/). This is only the beginning - more Halo scene history blogs to come.
### Isolation Day 21
URL: https://connortumbleson.com/2020/04/06/isolation-day-21/
Last updated: 2025-02-04T11:43:30.000Z
Photo by [Fabian Mardi](https://unsplash.com/@fabianmardi?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This is now my 4th post on this subject and the world is probably tired of hearing about it. Pandemic news spews to every news source, chat group, Twitter page and even online gaming.
However, regardless of how you feel about it. This will be in the history books forever and etch its place into history. So time to document what has happened between day 7 and 21 due to the continued pandemic: COVID-19.
### Shopping
In terms of my runs to the grocery store chain (Publix). I've noticed the following in just the time-span of 14 days.
- Blue tape for all lines to denote safe distance between folks
- All toilet paper still missing.
- Plastic shields installed in front of cashiers
- [Apple/Android Pay support](https://ww4.publix.com/publix-coronavirus-updates/customer-shopping-tips/contactless-pay-options?ref=connortumbleson.com) (finally)
- [A special hour for senior citizens on select weekdays.](https://ww4.publix.com/publix-coronavirus-updates/reserved-shopping-hours?ref=connortumbleson.com)
- Lanes closing and simply rotating to get cleaned
All in all, the shopping experience has changed. Walking in I'm greeted to clean my hands at this touch-less cleaning station as well as being offered a cart that is being wiped down before given to me.
### STAY AT HOME
This announcement came from the [Whitehouse](https://www.whitehouse.gov/wp-content/uploads/2020/03/03.16.20%5Fcoronavirus-guidance%5F8.5x11%5F315PM.pdf?ref=connortumbleson.com) urging people to stay at home and it was suggested until April 30\. That was quite an announcement to get after already being on a forced work from home for 2 weeks. This meant I would have to spend another month at home working.
This wasn't preferred, but then I thought about all those less fortunate that don't have a job that can transition remotely, as well as the people that just flat out lost their job. So I thought it was pretty disgusting to complain as it could be much much worse for me.
It became eerily close how much the line between work and home line blurred while working remotely. As we approach day 22 of this, I think a consistent routine based on timing will help instead of rolling out of bed onto a work computer.
### #JOE EXOTIC
[The Tiger King - Netflix](https://www.netflix.com/title/81115994?ref=connortumbleson.com)
What a time during a pandemic for a new documentary to drop capturing the focus of everyone stuck at home. I couldn't believe how many of my social media chats and feeds were all talking about this show. People were messaging me saying - "*Isn't Big Cat Rescue near you?*" and it was, but I didn't understand why they mentioned that.
While I imagine the show exaggerated some details - it just proved how you can have no idea about a section of the world. The exotic animal business and private zoos were something I honestly knew nothing about. I may go to zoos and Big Cat Rescue, but they were for Ingress Portals first and animals second. To watch this and learn about deception, fraud, arson, murder and more was just insane. I couldn't believe this was a real story - it was something you should see in a feature length movie.
### The Remote Journey
While staying home and working during the week and being isolated during the weekend I noticed most services could not cope with the increased demand for online services. From my memory...
- Xbox Live temporarily disabled custom avatar uploads and real time chat typing notifications.
- Netflix dropped quality in Europe to lessen strength on connections.
- Azure disabled new instance creation for those on the free tier.
- Amazon Prime delays pretty much delaying "same day / next day" delivery
With such a short time frame of most of the continental USA pivoting to remote shows that some services couldn't hold up with the increased demand. Even my internet, which I pay for a 75/75 split is averaging at more 13/5 so I imagine all residential networks are clogged.
### Conclusion
I hope we get through this unscathed, but I'm continuing to hear about friends who weren't as luckily to be able to work remotely or found their hours sliced to 0\. To all those affected, best of luck - I'm trying to support local businesses to help where I can.
Another month to go so please stop buying all the toilet paper.
### Ghost Blog to 100% Speed
URL: https://connortumbleson.com/2020/03/30/chasing-the-speed/
Last updated: 2025-02-04T11:43:31.000Z
Photo by [chuttersnap](https://unsplash.com/@chuttersnap?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few [months ago](https://connortumbleson.com/2019/12/16/blogging-to-the-future/#) I moved my blog across hardware and changed things up chasing that 100% PageSpeed Insights.
March 28, 2020 - Audit - [https://connortumbleson.com](https://connortumbleson.com/)
Now I was pretty excited to see the work paid off with a 98% overall. However, what does it take to push that 98% to 100%? Let's see what I'm missing.
---
**PWA - Progressive Web App**
Right now Ghost does not support PWAs out of the box. I could probably hack in support for them, but if I've learned anything in my WordPress era - hacking in features for something results in a nightmare of maintenance later on.
Basically, a PWA is a bit of JavaScript (called service workers) that your site can install on a user's device, which starts caching pages as you view them. They can optionally add your website as a "mini app" and it continues to function highly leveraging this cache of resources and pages.
For Ghost though, you aren't recommended to cache full pages as those are usually dynamic. In the case of my blog - I could only cache 5 resource files, which could even drop down to just two which doesn't seem worth the effort at this time.
I think if Ghost built this into the product, they would leverage the content API in order to cache the blog posts themselves and the resources resulting in a very high hit count for the cache. I noticed a [few other people](https://forum.ghost.org/t/progressive-web-app-version-of-ghost-blog-install-service-worker/2013?ref=connortumbleson.com) interested on the forums, but time will tell if that becomes part of the official package. For now, I think it simply is too niche to belong in "core" Ghost.
---
**Lazy Loading**
[HTMLSpec](https://html.spec.whatwg.org/multipage/urls-and-fetching.html?ref=connortumbleson.com#lazy-loading-attributes) \- Lazy Loading
Lazy loading is a technique that resources aren't loaded until you actually need them. This is common when reading a blog post that is a couple thousand lines long littered with images. It wouldn't make sense to load all 30 images at once in that post - just load them as you scroll those images into view.
However, that sounds easy but what about the layout of the site? Does it constantly repaint and redesign as images load in? Hopefully not, but that requires you to know the size of the image before the load so you can reserve that portion of the layout.
I found a [blog](https://addyosmani.com/blog/lazy-loading/?ref=connortumbleson.com) that really breaks down and describes this new feature, but between all the fallback support and JavaScript you need to support it. I don't feel comfortable implementing this yet.
[CanIUse](https://caniuse.com/?ref=connortumbleson.com#feat=loading-lazy-attr) \- March 29, 2020
Not to mention, it is relatively new still so browser support isn't yet perfect. A few more cycles of browser releases may change this and I will re-approach this then.
---
**WebP**
Google's WebP [documentation](https://developers.google.com/speed/webp?ref=connortumbleson.com)
Google is an interesting position here. Let me break it down into a bullet point list.
- Invent new image format that is superior in a few areas.
- Build support for that new image into their own browser.
- Add support into Google products for Google browsers.
- Convince people to use Google browsers as Google products are more efficient.
- Leverage new format into Google search placement forcing others to catch up.
- Dominate market with self created/invented options.
I think that is basically a good breakdown, but not everyone has the strength and power of Google. For me to get WebP support in PHP, I need to build GD with some special flag and install some dependency from some source. For the case of standard image types - it just works.
[CanIUse](https://caniuse.com/?ref=connortumbleson.com#feat=webp) \- March 29, 2020
Much like the previous section, browser support for WebP is not everywhere so you can't just change images to WebP. You have to either leverage the HTML tag "picture" or use CSS/JavaScript to swap them out at run time based on what the browser can support.
For blogs that are already written, neither are easy without manual labor or only supporting things "moving forward". Google does not like things that only a percentage of a site supports, because those legacy pages will show up in Google Webmaster console with warnings and errors.
For now, I won't move on WebP images until Ghost supports them. In the meantime, I can probably just optimize my existing image formats to cut down on unneeded data transfer.
---
**Minify Resources**
This one is relatively easy to solve. If you were to inspect my site's resources a few days ago. You would see something like this.
Basically, human readable but then all the spaces and comments have to be transmitted over the wire. Now, they are compressed little files with all extra information removed.
```
DONE Compiled successfully in 1108ms
Asset Size Chunks Chunk Names
/assets/css/screen.min.css 79.7 KiB [emitted]
/assets/js/global.min.js 14.1 KiB [emitted]
/assets/js/index.min.js 78.5 KiB [emitted]
/assets/js/ityped.min.js 1.79 KiB [emitted]
/assets/js/post.min.js 21.1 KiB [emitted]
Done in 14.61s.
```
This basically shows that I don't have to develop with unreadable files, I just "build" them and zip them up into the theme. Now these are deployed alongside the unminified files (just in case I missed a reference).
---
All in all, most of these changes are just not worth the development time for a few extra percentage points. As months go on it will become easier to do and then I'll revisit.
### Isolation Day 7
URL: https://connortumbleson.com/2020/03/23/isolation-day-7/
Last updated: 2025-02-04T11:43:31.000Z
Photo by [Dan Meyers](https://unsplash.com/@dmey503?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I first started this series in January discussing [Wuhan](https://connortumbleson.com/2020/01/27/lets-talk-epidemics/) and again last weekend [discussing](https://connortumbleson.com/2020/03/16/once-in-a-lifetime-pandemic/) the classification of COVID-19 becoming a pandemic.
A lot has changed since then, so this blog is another week of sad depressing news.
[https://www.wbtv.com/2020/03/18/all-k-schools-kansas-closed-rest-year/](https://www.wbtv.com/2020/03/18/all-k-schools-kansas-closed-rest-year/?ref=connortumbleson.com)
The first bit of crazy news was the announcement that my home state of Kansas was closing all Kindergarten through 12th grade schools for the remainder of the school year. That was on March 18, which basically is around spring break, so spring break was now extended permanently.
I didn't get out of school till end of May or even June depending on the amount of snow days. So kids that normally get June, July and a part of August for summer vacation now have the remainder of March, April, May, June, July and parts of August. That is insane to think about with all the parents and logistics that goes into raising a child who is no longer at school.
---
More locally, Florida put out a notice that restaurants must only be 50% full for dining and all bars/nightclubs are to be closed for 30 days. This was only for about 72 hours until things got kicked up a notch.
[https://www.news4jax.com/news/local/2020/03/20/gov-desantis-bans-all-on-site-dining-in-florida/](https://www.news4jax.com/news/local/2020/03/20/gov-desantis-bans-all-on-site-dining-in-florida/?ref=connortumbleson.com)
Our governor (Ron DeSantis) put out another executive order this time suspending ALL on-premise food and alcohol consumption effective immediately. Instead forcing all establishments to leverage delivery and take-out options. As part of this change, alcohol was also allowed to be delivered and/or picked-up as long as this order was in place (and of legal age of course).
Also included, but not really talked about was the closing of all gyms and workout facilities.
I don't know how something like this is enforced, so I decided to walk down to the grocery store near me and see what I could find. For every store I passed I jotted down what I saw.
- McNatt Cleaners - sign - hours shorter - closed on weekends.
- Yoshi Sushi - sign - "togo orders only" written on it.
- China Dragon - sign - closed for 1 week.
- Papa John's - sign - hours shorter - open for pickup/delivery.
- Yogurtology - sign - no sitting inside.
- Louis Pappas - sign - takeout only - shorter hours.
- Smoothie King - no sitting inside - shorter hours.
- Pinch a Penny - Table in front of store, no going inside. Tell person what you want, then wait outside.
- Advanced Dental - Sign about cleaning procedures.
- Nails n More - Closed until further notice.
- Great Clips - Closed (due to weekend).
- Publix - Cleaning stations, max of "1" of listed items.
I have never seen anything like this in my time. Hurricanes had a dose of this, but the difference was the majority of people leave during hurricanes so while some stores are closed - the open ones aren't packed.
Empty Shelves
I walked into a Publix where people were crowding the employee area waiting for palettes to come out with items that were immediately grabbed. Shelves were empty beyond belief with things like milk, paper products, beef, toilet paper, soap and cleaning products just completely gone.
The folks walking around ranged from bio-hazard mask and gloves to folks dressed like every day Florida attire. Staff quantity looked to be the amount of staff usually there around Christmas and Thanksgiving - a huge amount of staff to deal with the absurd action of people. Thank you to those staff risking their own health for keeping grocery stores open.
The stuff missing just was strange. No pasta, but plenty of red sauce. Hot-dogs, but not a single source of bread or buns to pair with. Lettuce completely gone, but fruit & vegetables seemingly untouched. Beef and chicken completely gone, but fish remaining.
---
The COVID-19 Emails
As every day continued, the amount of emails from businesses was insane. 90% of the emails were doing the right thing - delaying payments, offering help or even discounts during the difficult time. The emails won't stop, so I started dropping them into a folder to look back at this time.
I fear Florida is approaching a time where an executive order prevents any travel unless crucial. Whatever happens, I want to continue to blog about it, because this will be in the history books or wikis forever.
### Once in a Lifetime Pandemic
URL: https://connortumbleson.com/2020/03/16/once-in-a-lifetime-pandemic/
Last updated: 2025-02-04T11:43:31.000Z
Photo by [CDC](https://unsplash.com/@cdc?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On March 11, 2020 the WHO made an [announcement](https://www.who.int/dg/speeches/detail/who-director-general-s-opening-remarks-at-the-media-briefing-on-covid-19---11-march-2020?ref=connortumbleson.com) that COVID-19 (2019-nCoV) had been classified as a Pandemic. This is my [2nd post](https://connortumbleson.com/2020/01/27/lets-talk-epidemics/) on this matter with my first beginning during the first few situation reports on January 27, 2020.
Though, what does Pandemic even mean? I don't have scientific answers but we can break down some common words like so...
- **Outbreak** \- Huge rise of disease in some place.
- **Epidemic** \- Large outbreak of disease in places.
- **Pandemic** \- Global (World) outbreak of some disease.
So when the WHO re-classified "Coronavirus" to a Pandemic the world stepped up and in just a few short days. Things went to a point that I've never seen in my lifetime before.
The first news I heard was the NBA season ending until further notice after a Utah player tested positive for the disease. This was just the beginning as PGA Tour and NHL also put a pause on their seasons. The MLS just put a 30 day hold on the season even though it had just begun and the MLB cancelled the remainder of spring training and pushed back the regular season by at least two weeks.
That wasn't all, as the NCAA followed along with national teams for US Soccer and even internationally with the Primer League, La Liga, Series A and much more.
While every sport in existence was going on hold, theme parks from Disney Land to World were closing. In terms of conferences, everything you could imagine from E3, Google I/O, F8, MWC, GDC and more were postponed, moved online or cancelled until next year.
---
As days went on if an event, gathering or more involved more than 50 people it was probably postponed. No company or individual wanted to be responsible for the spread of a virus. Even locally yearly events were cancelled in a heartbeat and school spring break extended. Some colleges moved online forcing kids out of dorms.
Locally, USF made the following statement:
> *As directed by the Florida Board of Governors, we will begin **transitioning all of our classes to remote instruction for two weeks following spring break, March 23 through at least April 5*.*
> [https://www.usf.edu/coronavirus/index.aspx](https://www.usf.edu/coronavirus/index.aspx?ref=connortumbleson.com)
My theory is that with spring break ending, they want the 2 week padding of online teaching to prevent thousands of students re-uniting and spreading whatever. Which makes sense, but even then it wasn't over.
---
Graphs started being produced showing how other countries reacted and case counts to which to the average American probably said - "*get ready*".
[Coronavirus case counts - /r/dataisbeautiful](https://www.reddit.com/r/dataisbeautiful/comments/fiun99/oc%5Fcomparison%5Fof%5Fitaly%5Fusa%5Fand%5Fcalifornia%5Fcovid19/?ref=connortumbleson.com)
This led to people rushing grocery stores, which in turned drained all soap, toilet paper and random types of food from the shelves. I remember going for my usual shopping trip and it was like the day before Thanksgiving - people everywhere and no food.
Publix [noticed this](https://twitter.com/Publix/status/1238632442560499713?ref=connortumbleson.com) and announced the store would close 2 hours earlier than normal until further notice.
No matter what, the world has changed drastically in the past few weeks and this will be event in the books like major other human events. It is sad, but it is interesting to see this unfold. I've never seen anything like this before and I don't think I ever will again.
### 30 hours. $136,000 later.
URL: https://connortumbleson.com/2020/03/09/30-hours-136-000-later/
Last updated: 2025-02-04T11:43:31.000Z
Photo by [Daan Stevens](https://unsplash.com/@daanstevens?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
While doing taxes I got to dig up my single medical event in 2019 and it is pretty crazy to think about. Though, before I dig into this - **I want to make clear, the staff and service was phenomenal.** This is simply a deep dive into the insurance, claims and statements that follow a medical procedure.
---
The 2019 Breakdown
Lets just jump right into it - I paid $3,500 in 2019 out of pocket for my surgery. In the grand scheme of things - I'm very lucky insurance exists, but what makes up that $136k?
We can start at the breakdown of the provider, which for April 5 & 6 is:
- Tampa General - $125,164.23
- Doctor H - $6,104.00
- Doctor S - $3,731.00
- Doctor C - $67.00
I don't really want to put full names, because I don't think the doctor is truly involved with the pricing. I know the surgeon was the 2nd most expensive doctor, so I'm wondering who the others are.
- Doctor H - Anesthesiologist
- Doctor S - Neurosurgeon
- Doctor C - Pathologist
From my little knowledge of the medical industry and Google searches, I learned the following:
> *The average Anesthesiologist salary in the United States is $387,000 as of February 26, 2020, but the range typically falls between $335,300 and $438,700*
> [salary.com - March 8](https://www.salary.com/research/salary/alternate/anesthesiologist-salary?ref=connortumbleson.com)
Though I would have thought my surgeon would have billed more, seeing how salary.com says:
> *The average Neurosurgeon salary in the United States is $607,101 as of February 26, 2020, but the range typically falls between $457,001 and $768,201.*
> [salary.com - March 8](https://www.salary.com/research/salary/alternate/neurosurgeon-salary?ref=connortumbleson.com)
With the years and years of school and the stress of literally being able to kill someone makes sense of the return in pay with all those responsibilities. Though my guess is the large $125,000 bill from the hospital may have included some of the surgeon charges. So I requested an itemized bill from the hospital.
They actually sent it, but it said $121,964.23 was the total, yet my insurance says they billed $125,164.23\. I did the difference report on that and it was $3,200 exact.
So that makes sense. At the time of my surgery I only had $300 of my $3,500 deductible. So I had to drop $3,200 for the surgery. That explains the price difference.
Snippet of my itemized breakdown - April 5/6 - Tampa General
I don't want to spam the blog post with a ton of words, because I honestly have no idea what half of these itemized items are. I just want to bring up a few of them.
**ESMOLOL**
- 2 quantities at $313 a piece
- ESMOLOL 100 MG/10 ML (10 MG/ML) SOLN
- It can treat heart rhythm problems. It can also slow down a fast heartbeat and treat high blood pressure during or after surgery.
- Price only is $70.75 a piece online, so a 342.4% markup
**HB OR SPECIALTY LEVEL 2 MIN**
- This appears to be Operating Room, Level 2 billed per minute
- At $2,030 per minute (1st minute), then $228 every additional minute.
- I was billed at 284 minutes or 4.73 hours
- Quite longer than 3 hour estimate
- Probably due to the complications that arose ([details](https://connortumbleson.com/2019/04/14/double-lumbar-microdisketomy/))
**HB ANESTHESIA GENERAL 1MIN**
- Anesthesia while in Operating Room
- Billed at $153.41 per minute
- Total of 284 minutes or 4.73 hours
Snippet of my itemized breakdown (Page 2) - April 5/6 - Tampa General
I remember the bar-code I had attached to my wrist was used every time I was taking any pills or being injected. They would scan my wrist and I assume the machine could immediately alert if I should not be injected with whatever. A very technical system that also has the benefit of turning into an itemized billing report.
Though as I end this post, I can't seem to understand the massive price difference of things.
My Report Overview - Year 2019
Above I'm shown billed $136,974.93, but only "allowed" $29,759.72 which I believe is what my insurance believes my care provider should be paid. Why are these numbers different? What is there a nearly 5x difference in the numbers? It just my blows my mind how I spend one surgery and one night in the hospital and rack up $136k in charges.
What do people without insurance do? What do people do that spend weeks in a hospital? Is this the same elsewhere in the world? What classes do I need to take to understand the insurance/medical industry?
This stuff is confusing, but I'm glad my back pain is gone.
### Why I play Ingress
URL: https://connortumbleson.com/2020/03/02/why-i-play-ingress/
Last updated: 2025-02-04T11:43:32.000Z
Photo by [Alexandre Godreau](https://unsplash.com/@alexandre%5Fgodreau?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few weeks ago I landed in Tampa shortly after 1am on a Sunday with work on the next day (or rather same day). Coworkers wonder why I do it. My parents wonder why I do it. My ex wondered why I do it. Sometimes I wonder why I do it.
Who pays money to visit another city to play a game on their phone? We aren't talking professional e-sports here, just a hobby game. So I took a step back and wrote this post.
At the basic level, Ingress is a massive digital territory game. Every monument, post office and a variety of other things are the digital footprint this game is played on. You can play at any location of the world assuming you have signal. The game pioneered the digital map that PokemonGo and Wizards Unite were built upon. With that catch up let me dig into all the things that continue to keep me addicted to Ingress.
### Community Management
Tampa Ingress Resistance Community Site
At the core of Ingress regions are controlled by either blue or green (the two teams). That control may be because of pure chaos, but is more likely due to organized control. This means that no matter what city you visit across the world the leading team has some self-organizing group of agents. This may be a Facebook group, Slack team, association of Telegram chats or a handful of other community options.
This means it's in the best interest of the succesful team to reach out to unknown agents in the area to loop them into their community. Public communities won't work due to the competitive nature, so how do a bunch of random people self-organize online?
Sometimes it isn't pretty, but I find it fascinating to see how people self-organize groups. It reminds me of the days I hosted a forum for Xbox modding. It takes a healthy amount of self-control and community management skills. A community can easily become a toxic mess and thus drive people away.
### The Portal Game
Portals are the key focal point of Ingress and these things are everywhere. One popular avenue of this game is engaging in the difficult portal hunt. That portal on an island requiring a kayak makes it difficult to visit. That portal which is a dead-zone of AT&T and requires carrier knowledge. That portal located in the middle of Gulf of Mexico which requires satellite data. That portal located in a restricted area requiring convincing of staff to access.
Myself - Cedar Key - Atsena Otie Key
Above is myself on an island off the coast of Cedar Key solely there to capture a few portals for a game on my phone. Though, the journey and food and local experience of visiting all these places really pays off. I learn a bit about history of areas I didn't even know existed without this game.
Some of these journeys require a backpack of interesting technology for the signal game in order to have a data connection at the portal. This can grow quickly to be an expensive route, but a fun one nonetheless. Since there is something quite funny to see an opponent learn about the difficulties with such a portal.
### The Logistic Game
Since the game requires communication with nearby areas in order to succeed you are left with an interesting dilemma when you live on the coast. Can the game span across time zones and languages? It does and that once again blows my mind with chat groups full of trusted players ranging from United States, Mexico, Grand Cayman, Aruba and every little Caribbean island.
To maximize success you need to move digital items between these areas, so travel sharing begins to identify someone traveling from X to Y. Those travels part of usual every day life prove to be immensely helpful when attempting to succeed not only locally, but regionally in Ingress.
So then what happens when you visit one of these areas yourself? Or even travel to a nearby city? You now have friends of friends across a game that you can leverage for local knowledge and more than always - a friend to drink with.
### Turning a Hobby into a Job
URL: https://connortumbleson.com/2020/02/24/turning-a-hobby-into-a-job/
Last updated: 2025-02-04T11:43:32.000Z
Photo by [Ian Schneider](https://unsplash.com/@goian?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Like most blog posts, someone linked me my own GitHub with the message - "*Do you think you'll hit 10k this year?*". I didn't understand the context, but it was in relation to commits in a year.
Snapshot of my [GitHub](https://github.com/iBotPeaches?ref=connortumbleson.com) \- Feb 22, 2020
Around 8,000 commits seems pretty far from 10k, but then when you look at each year before that does it seem sane.
- 2011 - 21 commits
- 2012 - 553 commits
- 2013 - 678 commits
- 2014 - 559 commits
- 2015 - 1,460 commits
- 2016 - 2,495 commits
- 2017 - 2,303 commits
- 2018 - 5,206 commits
- 2019 - 7,313 commits
- 2020 - 7,926 commits (rolling year, not complete)
So the first question is, what the hell happened to pump those numbers up? Well lets take this year by year and figure out how a little hobby became a full time job.
---
**The Early Days**
Before the era of online source code sharing in the public space, I worked on projects with revision control being various iteration of renamed files. This would be like *"rewritten-function-2.txt"* and *"final-loop-test.bak.3".* The problem though is I had no idea what I was doing. Progress was slow or non-existent for any project I began. This is what led to shoveling snow and doing errands just to earn enough money to PayPal it to some random people across the world. They would sit with me in Skype sharing their screen teaching me programming questions I had.
I was addicted to programming, but really had no idea about the true concept of it. One of my Skype sessions was because I had asked - "*How do you build an auto updater for a VB program?*" - That $25 Skype call really helped cement an understanding to problems for me.
I couldn't wrap my head around what a program needed to do in order to auto-update, but this training session showed me. All the various pieces for a server to hold a text file to represent the current version. Another small application that could handle closing and downloading the intended application.
My 2011 [GitHub Profile](https://github.com/iBotPeaches?tab=overview&from=2011-12-01&to=2011-12-31&ref=connortumbleson.com)
Shown above is my 21 commits I did throughout 2011 in the public space. My first foray into the world where anyone could provide feedback or flat out insult you for what you programmed and how you did it. I had the drive now, but not the skills to succeed.
---
**The Joint Effort**
At one point in a Halo related hobby project, I started a project with someone I never met before in the real world. We worked together and this led to the wonders and stress of team programming.
- We both worked too much without sharing work, leading to merge messes.
- We didn't communicate who was doing what.
- We both wrote our own style, undoing the others when we conflicted.
- We both had our own idea of what the project should be.
With all the bad, there was some good.
- I learned from him and I hope vice-versa.
- I learned how to break problems down to allow parallel effort.
- I learned our interests were in success of project, never personal attacks.
Though, we could never quite solve our problems and the project ended. This just furthered my addiction to programming. I thoroughly enjoyed working on projects where I wasn't the smartest - just reading and learning from the peers around me.
---
**The College Years**
[2014 GitHub Page](https://github.com/iBotPeaches?tab=overview&from=2014-12-01&to=2014-12-31&ref=connortumbleson.com)
The years of school began the increase in working in the open source space, no matter the project whether it was Android, Ingress, Destiny, Halo or Minecraft - I was working on some project for it.
This was also where projects started getting abandoned for the sake of not having enough time to dedicate to them all. Projects would start with this intense drive to complete them as soon as possible, eventually dying off into the next great project. Though it didn't matter, each project was unique and interesting and fed that drive to just solve a problem.
Looking above, I remember my summer of 2014 programming activity nearly halted completely as I started dating a girl. Looks pretty interesting once you had the data and the reasoning to correlate it. Just shows how something so dumb like a count of commits over time can tell a story with the correct background.
As school was nearing the end, I had developed a few styles of programming that developers could spot once working with me. It had been years and years of working with others on projects. Years of failure and success. Years of debugging and solving complex problems.
Overhead Image copyright to [PrimaGames](https://primagames.com/games/halo-5-guardians?ref=connortumbleson.com) \- Our first few attempts
I remember working with a great group of friends to attempt to use x,y,z coordinates of deaths in Halo to lay on top of a map to find the most "dangerous" area of a map. We just couldn't get overhead screenshots of maps to draw on top of nor could we figure out what point 0,0 was or our directions. We attempted to take screenshots in game from high levels and merge them together, but it would never work.
So we would start a game, kill someone in a corner of the map. End the game, rinse and repeat until we discovered the bounds of the map to help orientate ourselves.
The image above is from a copyrighted game guide by PrimaGames which we took to build the feature. Unfortunately due to the legal copyright, it was never released. Funny enough, a few months after we abandoned the project, the company behind Halo released overhead images for all Arena maps. It wasn't all maps and the project was abandoned by the time they were released.
---
**The Job**
With all the hobby projects over the years I had built a pretty nice collection of work on GitHub, which now as someone who interviews people is my favorite place to start to search. It resembles how you work when no one is watching and shows how you solve a problem (if you commit often).
My little hobby projects helped me get my job and I continue to make them. So if you need a piece of advice when looking for a programming gig, please have some sort of open source (GitHub, Bitbucket, Gitlab) contribution of code.
### Scum of the Web
URL: https://connortumbleson.com/2020/02/17/scum-of-the-web/
Last updated: 2025-02-04T11:43:32.000Z
Photo by [Leon Seibert](https://unsplash.com/@yapics?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
One morning I woke up with a scary email in my inbox, it was from Linode (my host) with a Terms of Service violation due to spam. The countdown till my server would go offline was 4 hours. This post is that journey.
The rest of email included the base64 payload, tips on recovering from a hack and the decoded base64\. This is a server that has been around since 2011 and hosts a lot of sites so my heart was racing to resolve this problem.
I alerted my office immediately that I would be late, even though it was only 6:30am in the morning - I did not know how long this would take.
---
**Step 1 - Check for complete takeover.**
My server is on a non-standard SSH port and only allows login via [key based](https://connortumbleson.com/2018/04/15/the-mystery-and-power-of-encryption/) authentication. So I didn't think it would be possible for a complete shell takeover, so I signed in and checked `w` and no one else was signed in. That was good news, so I then pivoted to check the ssh logs.
Opening that file last login was mine and everything I could see in my visible screen height was also me dating back to February 3rd. So that was good, this attack must have been something else.
**Step 2 - Identify the client.**
Since the server itself looked okay, it had to be one of the clients on the machine. Since it was a cPanel box, it was pretty segregated with 20-30 different sites. Decoding the base64 of the spam email contained links with a domain that I recognized as a domain I host.
So now I was nervous.
**Step 3 - Stop the bleeding.**
cPanel has a neat feature known as suspension, which basically just redirects the public directory to a generic "suspended" page and a few other logical things you'd expect when suspending an account.
The affected website was now down.
Once that was done, I knew anything malicious was no longer viewable. So it was time to investigate.
**Step 4 - Identify the entry-point.**
This was a Wordpress blog, so maybe it was out of date or outdated plugin with an automated exploit. I pivoted myself to the user's home directory and ran a command to dump all files edited in past 24 hours.
```
find . -mtime -1 -ls > changed_last_24hrs
```
**A good tip* \- When investigating a potential hack. The less you do the better to not affect logs/modification times/etc, so all my commands will output to a file so I can maintain that state.*
It dropped a bunch of files, but a few caught my eye.
- `.well-known/acme-challenge`
- `./ssl/keys`
- `./ssl/certs`
- `./public_html/amx`
- `./public_html/amx/Online`
With this investigation though, nothing in WordPress was touched. So could WordPress have been the entry point with no files modified? I'm not sure, but to be safe I database edited the only two users in that system to random characters for the password hash.
Now my focus was back at the modified SSL files. I took a trip to my favorite "[crt.sh](https://crt.sh/?ref=connortumbleson.com)" domain and looked up the affected website. Sure enough a new SSL certificate was created for "\*.domain.com", so someone generated a wildcard certificate.
This makes sense, because the domain was "american.express.####.domain.com" in the malicious spam email.
Immediately I connected the dots. WordPress cannot generate SSL certificates so the only thing capable of doing that is AutoSSL on my cPanel machine. This must have been a password leak.
I changed the password, forcing a password reset to obtain access. Before that, I confirmed no new users were created and the email attached to the main user remained the same.
**Step 5 - Cleanup**
I went through and deleted all the affected files:
- The bogus PHPMailer (for spamming) and phishing website
- The wildcard certificate after instructing LetsEncrypt I wanted to revoke it
- The entire "amx" directory
Additionally, I reinstalled WordPress deleting all files outside from uploads and themes. I double checked the remaining files were not modified in past 24 hours.
**Step 6 - The Post Investigation**
With the affected website clean and back online (12-18 hours later), the warning notices on Google had already gone away. Which just blows my mind how quickly Google/Firefox notice a phishing website, flag it, block it and then remove the warning once removed.
Now that I understood the entry, I went peeking in the logs and found all the actions that occurred, including the IP from where it occurred from. It was Russia, which was probably just some scummy automated script or some deranged individual set on illegal actions.
[Transparency Report - Google Safe Browsing](https://transparencyreport.google.com/safe-browsing/overview?hl=en&ref=connortumbleson.com)
This page above blew my mind, since it claims nearly 40-50k websites are marked DAILY for phishing or malware. My guess is hosts are infected or hacked, much like this one. The legitimate history of them allows them to be used for abuse until some automated system catches on.
My logs show my server emitted 4 emails that were phishing attempts against American Express, so I guess it could have been worse.
The grammar in the phished email was so bad. Here are some snippets.
- *For your protection, online banking has been lockn exceeded the number allowed.*
- *We are sorry to inform you that your online account has been temporarily locked after too many unsuccessful log*
- *Will review and vd take necessary steps to protect your account from fraud.*
Any sane person could easily spot that phishing attempt a mile away. It was a bit of a wake-up call that I need to take security on a shared machine a bit more seriously.
I went overkill and forced password changes for all my hosted clients and strongly requested 2FA to be enabled. I could not find a way to enforce it at this time.
To end this post, I guess after 10 years of a server - this is probably bound to happen. Don't re-use passwords. Leverage 2FA (not SMS based). Stay safe.
---
The timeline (UTC):
- 2020-02-14 10:15:16 - Attacker login.
- 2020-02-14 10:16:35 - First phished Email sent.
- 2020-02-14 11:26:00 - Abuse Email from Linode detecting it.
- 2020-02-14 11:33:00 - I begin investigation.
- 2020-02-14 11:40:00 - Site Suspended.
- 2020-02-14 14:10:00 - Cleanup complete.
- 2020-02-15 00:27:00 - Site enabled. (Owner setup 2FA)
- 2020-02-16 00:45:00 - Blog post written.
### the Peoples Temple
URL: https://connortumbleson.com/2020/02/10/the-peoples-temple/
Last updated: 2025-02-04T11:43:34.000Z
Photo by [Jametlene Reskp](https://unsplash.com/@reskp?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This post blog is the first in my new tag called "[cult](https://connortumbleson.com/tag/cult/)" where I do a small investigation into a cult, whether past or present.
This started from just discussions with coworkers and friends that some large events in our world's history are sometimes not known among today's citizens, myself included.
We may watch movies that are loosely based on true events, but what is the true event?
---
For this blog, we are going to discuss Jim Jones and the Peoples Temple. Jim Jones convinced 909 people to commit suicide...at the same time. Though most readers to this blog may not have been born when this event took place.
Though we need to take a step back in time way back to 1931 where Jones was born. We are going to skip some time and just skip to his 20s where he began an immense interest in communism. From that research it bubbled into a vast interest into religion. Jones became a pastor at a local church, but after integrating African Americans was barred from it.
We are talking the early 1950s at this point, so basic human rights haven't yet reached the black community. Angered by this Jones opened his own church inviting all ethnic groups.
Jones obtaining award from Pastor Cecil Williams - [Nancy Wong - CC BY-SA 4.0](https://en.wikipedia.org/wiki/Jim%5FJones?ref=connortumbleson.com#/media/File:Jim%5FJones%5Fshakes%5Fhands%5Fwith%5FCecil%5FWilliams%5F-%5FJanuary%5F1977.jpg)
The story begins to get strange though as Jones began fearing a nuclear holocaust after reading a variety of articles. Among those articles it was shown that a city in Brazil would be a safe zone when the missiles flew.
Jones traveled to Brazil hoping to set up more Template locations. He did, but the language barrier made it quite difficult to keep them growing. Having left Indiana, the locals began to guilt him for leaving until he folded – heading back to Indiana.
Once back in Indiana Jones needed a change. He [told](https://www.nytimes.com/1978/11/26/archives/jim-jonesfrom-poverty-to-power-of-life-and-death-arrested-for-lewd.html?ref=connortumbleson.com) his entire congregation that nuclear war was close and that California was the Eden. Most of the congregation moved and this is where things painted a different story for those inside.
Some folks started digging into the truth of Jim Jones and it wasn't pretty. The dark past and present included beatings, sexual assault, child abuse and just plethora of crimes. He abused his power of pastor with his followers and this was catching up with him.
Jim Jones fled to Guyana (the country) on the tip of South America along with followers who would join him. As time passed, a congressman Leo Ryan flew into the city to investigate all the claims and darkness that surrounded Jones. During the visit, a temple member attacked the congressman, which led to a hurried plan to leave.
Unfortunately the armed followers of Jones met the congressman at the airport and opened fire. The congressman was killed along with most of the NBC media crew. This was the hectic day that would forever be recorded in history.
As the day went on, Jim Jones unloaded a [45 minute speech](https://jonestown.sdsu.edu/?page%5Fid=29084&ref=connortumbleson.com) that was secretly being recorded. He mentions these conspiracy theories of folks parachuting into their home to torture them.
> *I don’t know who fired the shot. I don’t know who killed the congressman. But as far as I am concerned, I killed him. You understand what I’m saying? I killed him. He had no business coming. I told him not to come.*
>
> Jim Jones - "Death Tape" - [source](https://jonestown.sdsu.edu/?page%5Fid=29079&ref=connortumbleson.com)
He then begins and succeeds to convince all followers to drink a poison kool-aid to die with dignity. You can listen to this audio if you wish, but knowing that over 900 people are dying during and after this speech may add a bit of unsettling nature to it.
The kool-aid mixture of cyanide and some relaxants was made to create a fatal potion that would lead to sleep without waking up.
All credit to Associated Press ([source](https://www.nydailynews.com/news/nydn-the-jonestown-massacre-20191114-photogallery.html?ref=connortumbleson.com))
For those who aren't squeamish, the [Associated Press](https://www.nydailynews.com/news/nydn-the-jonestown-massacre-20191114-photogallery.html?ref=connortumbleson.com) has a photo gallery from the events that unfolded on that day November 18, 1978\. Additionally thank you to [San Diego State University](https://jonestown.sdsu.edu/?ref=connortumbleson.com) & [Military Response to Jonestown](https://www.militaryresponsetojonestown.com/?ref=connortumbleson.com) where my information was sourced.
### Fear is a Currency
URL: https://connortumbleson.com/2020/02/03/fear-is-a-currency/
Last updated: 2025-02-04T11:43:36.000Z
Photo by [Kristina Flour](https://unsplash.com/@tinaflour?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This post is going to be interesting, because it is a bunch of thoughts I had which I didn't know how to connect. The connecting piece was re-watching the first episode of American Horror Story: Cult.
It kept touching on the point of fear and how that has become a currency. Businesses, politicians and more trade that to win over your attention and thus money. It seemed like writing just reaching for the point of a good show, but then I started processing it.
For the sake of these points, first lets start with a recent Netflix movie: Apostle.
[Apostle - Netflix](https://en.wikipedia.org/wiki/Apostle%5F%28film%29?ref=connortumbleson.com)
This film was based in the year 1905 with a little remote Welsh island where a cult lives. We see new converts to the cult arriving, but any modern text or information they are carrying is burned. Cult members without information are then forced to cling to the leaders for any knowledge.
Remember, we are talking 1905 in this film so there is no magical device in every citizen's pocket for complete knowledge. Paired with a desolate isolated island leads to very little outside influence. If someone told you the soil wouldn't be fertile to support farming unless a blood sacrifice was made, would you believe it? You wouldn't know the truth from false statements because it is all you knew.
---
You can see a pattern with this in the religious space in our world. Church was a great place to learn some of life's greatest question or even learn how to act in a "religious" manner.
Though as cities began connecting and civilizations went online, it was quickly learned there was hundreds, if not thousands, of religions out there. What did you do when religious text contradicted each other? Who was right? Who was wrong? Were any of these religions scared of the connected world?
[U.S. Church Membership Down Sharply in Past Two Decades - Gallup](https://news.gallup.com/poll/248837/church-membership-down-sharply-past-two-decades.aspx?ref=connortumbleson.com)
As my random Google search showed, church membership is going down and I think I know why. Years ago when knowledge traveled via paper & voice, it was slow to learn anything. You trusted what your town, family, teacher or neighbors said. If I don't know anything now, I have an unlimited number of sources to learn that information. Children these days are born with this technique jumping on family iPads and phones researching everything and anything.
---
So with that prior information, lets jump back to "*Fear is a currency*". When you prevent your child from biking to a friends house is that because you are fearful of kidnapping? Do you lie to your friends fearful of them to know the truth? Do you prevent explicit media fearing what it will cause?
I just feel like every time I tune into a news story, its about fear. Fear about a potential war, fear about a shooting, fear about an airborne virus.
That fear drives humans to do one thing - lose their attention and focus on something else. Whether it is a school shooting to change who you vote for in politics or buy an expensive bulletproof backpack.
---
A few weeks ago I was at a park in the early morning playing Ingress, when the park was way more popular than it should be. There was an event going on and people everywhere. As I did my laps, someone with a clipboard approached me and asked if I was registered to vote in Florida.
I said yes and that was my mistake. They asked me if I would sign this paper for some purpose. I continued to make up excuses because I just didn't want to until they moved on to someone else. Whatever they were talking about was not simple to process, much like this amendment on the 2018 ballot.
> Ban Offshore Oil and Gas Drilling and Ban Vaping in Enclosed Indoor Workplaces Amendment
> [ballotpedia.org](https://ballotpedia.org/Florida%5FAmendment%5F9,%5FBan%5FOffshore%5FOil%5Fand%5FGas%5FDrilling%5Fand%5FBan%5FVaping%5Fin%5FEnclosed%5FIndoor%5FWorkplaces%5FAmendment%5F%282018%29?ref=connortumbleson.com)
It blew my mind because its completely two unrelated things in one question, which reminds me about the mess in politics. We have two large parties right now which many pledge their allegiance to. You may not agree with the entire viewpoints of either side, but you normally have to pick one at the DMV or label yourself undecided.
These labels are outside of politics as well in genders, religions, race and more. The world wants you to fear being unlabeled. Though once you fit a label, you fall into the group and get classified in it as well. I want no alliance to any label and just want to fall into what I feel is right.
I dislike how every incident on the news gets classified as some label against another. It incites fear for both groups, fear gets manufactured into action and action leads to money or attention which every entity out there wants.
So to end this post of rambling thoughts, the next time you get fearful. Remember what is driving that fear. Is it some survival based instinct mechanism or some manufactured emotion to drive you to some point?
### Epidemics (Wuhan Outbreak)
URL: https://connortumbleson.com/2020/01/27/lets-talk-epidemics/
Last updated: 2025-02-04T11:43:36.000Z
Photo by [CDC](https://unsplash.com/@cdc?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The news is currently roaring about this "*Wuhan coronavirus*", which according to the CDC is known as [2019-nCoV](https://emergency.cdc.gov/han/han00426.asp?ref=connortumbleson.com). In my memory this will join the other vast epidemics of [swine flu](https://en.wikipedia.org/wiki/2009%5Fflu%5Fpandemic?ref=connortumbleson.com) (2009), [ebola](https://en.wikipedia.org/wiki/Ebola%5Fvirus%5Fepidemic%5Fin%5FWest%5FAfrica?ref=connortumbleson.com) (2013) and [zika](https://en.wikipedia.org/wiki/2015%E2%80%9316%5FZika%5Fvirus%5Fepidemic?ref=connortumbleson.com) (2015).
The history, so far, for this Wuhan outbreak seems to have begun on the last day of 2019 at Huanan Seafood Wholesale Market in Wuhan City, China. Ten days later on January 10, 2020 the entire genomic sequence of the outbreak was submitted to public databases.
Though from December 31, 2019 to January 7, 2020 it was still an unknown etiology. Only after was it correlated that the outbreak was the start of 2019-nCoV. As the severity increased, the involvement with the WHO and CDC hit a global level. Our first situation report showed the numbers already in the hundreds globally.
[WHO - Situation Report #1 - 21 January, 2020](https://www.who.int/docs/default-source/coronaviruse/situation-reports/20200121-sitrep-1-2019-ncov.pdf?sfvrsn=20a99c10%5F4&ref=connortumbleson.com)
Five days later that situation report got a bit more serious with confirmed cases increasing to 1,320.
[WHO - Situation Report #5 - 25 January, 2020](https://www.who.int/docs/default-source/coronaviruse/situation-reports/20200125-sitrep-5-2019-ncov.pdf?sfvrsn=429b143d%5F4&ref=connortumbleson.com)
---
However, lets talk about the virus itself. What are the symptoms and how does it evolve to the point of death?
The [CDC](https://www.cdc.gov/coronavirus/about/symptoms.html?ref=connortumbleson.com) once again gives us the symptoms, which are scarily just the same as a common cold:
- runny nose
- headache
- cough
- sore throat
- fever
- general unwell
It also spreads just like the cold via person to person from sneezes and [coughs](https://www.cdc.gov/coronavirus/2019-ncov/about/transmission.html?ref=connortumbleson.com). The good news though is it isn't as deadly as the other corona-viruses like SARS and MERS.
What does make this deadly is there is no vaccine as of January 26, 2020\. So if you contract this virus and already a bit ill, it may evolve to kidney failure, difficult breathing to pneumonia to death.
Where this iteration makes it difference from MERS and SARS is the incubation period, as it ranges from 10-14 days. All of which you are contagious during that time.
---
The WHO met on January 22, 2020 in an emergency meeting to discuss if this event should be classified as a PHEIC (*Public Health Emergency of International Concern*).
> *On 22 January, the members of the Emergency Committee expressed divergent views on whether this event constitutes a PHEIC or not. At that time, the advice was that the event did not constitute a PHEIC, but the Committee members agreed on the urgency of the situation and suggested that the Committee should be reconvened in a matter of days to examine the situation further.*
> [source - who.init](https://www.who.int/news-room/detail/23-01-2020-statement-on-the-meeting-of-the-international-health-regulations-%282005%29-emergency-committee-regarding-the-outbreak-of-novel-coronavirus-%282019-ncov%29?ref=connortumbleson.com)
At this time affected regions in China have been quarantined like you would see in a movie.
[Global News Video](https://www.youtube.com/watch?v=DrBhd7wQFWw&ref=connortumbleson.com)
Which is just crazy to think about, as the logistics for day to day life when cut off from civilization must be dire. In addition to a quarantine a nationwide temporary ban of wildlife sale has been put into affect for markets, restaurants and websites.
The next few days will be interesting to follow as flights within the incubation period from Wuhan, China landed in Atlanta, Chicago, Los Angeles, New York and finally San Francisco. There is even rumor as of writing this post that the 3rd confirmed case in USA has been identified.
Stay healthy.
### DDoS Revisited (Bio-Zombie)
URL: https://connortumbleson.com/2020/01/20/ddos-revisited/
Last updated: 2025-02-04T11:43:36.000Z
Photo by [Taylor Vick](https://unsplash.com/@tvick?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
About 10 years ago [my first blog post](https://connortumbleson.com/2009/08/27/understanding-ddos-for-the-confused/) was about DDoS attacks - the reason behind this was because my first few websites were victims to it. Childhood DDoS attacks were just a collection of infected hosts flooding HTTP requests to my server. Now with 10 years more knowledge - we are going to dive into DDoS attacks again.
*Everything in this post about my experience is 10+ years old all from memory. *I do NOT do this stuff anymore.**
---
My introduction to DDoS attacks was from booting people from games of Halo in order to win. This was the childish me, opting instead of the right path, I went down a dark path becoming a type of kid I am not happy I was.
I started asking around and met a few folks who hooked me up with tools. The idea of them was simple: create a malicious file and spread it over torrents. Once you infected enough hosts you could leverage those machines to overload your intended victim.
Bio-Zombie - Early DDoS
Looking back at this a decade later, I realized how much of a pawn in a larger system I was. Infected hosts need to communicate back to something so they show up in this tool. This is known as a **CnC** *(Command and Control)* host. This is the control machine or host the infected binary communicates back with in order to register itself.
Those CnC machines are normally blocked or sink-holed at a global network level once law enforcement becomes aware. This leads creative hackers to run their bots from social networks like Twitter posts and Pastebin, because what ISP or network is going to globally block those websites?
This makes sense to me now, because even with my computer offline my infected binaries I spread among torrents would still increase my host count whenever I returned to the application.
My guess is that the author I obtained this from owned a "master" binary and build. This would have control over all infected hosts, but could produce "child" binaries. The child binaries would be passed to chumps like myself and I did the dirty work. Spreading malware to the world to boost my own infected count, unaware I was probably growing the host count of the mastermind.
The booting tool supported the following types of DDoS attacks:
- UDP Flood
- HTTP Flood
- Ping Flood
- Custom Port Flood
These are nothing special, which would just abuse the amount of infected hosts towards one target on the specified port.
CommView
So with a large enough army of infected hosts, the next step was the simple part. Proxy your Xbox connection through your computer, identify through multiple matches the IPs that never change and play with your friends. That left you 4 IPs you didn't know. Target your bots towards one of those IPs, lag them enough for the game to kick them. Win the game against an outnumbered team. Disgusting but effective.
---
Moving on from that, the tools I used upgraded with time.
iBot XR - 2.3
With success in spreading malware, I got "upgraded" to custom labeled applications and smarter malware which was less detectable. However, my method of spreading was still laughable. I would just make torrents named after movies in theaters with an *exe* as the download. It amazed me how many people downloaded and clicked it.
One thing that started around this time was the idea of amplification DDoS attacks. Some creative people noticed that instead of just leveraging infected hosts, why not make a spoofed DNS request from the infected host to a legitimate open DNS server. Inside the spoofed request would be a return IP of the intended victim.
This would produce the following jump
- *CnC -> Infected Host -> Open DNS Server -> Reflected to Target*
Breaking down the words "*reflection*" and "*amplification*" we can understand how DDoS attacks evolved.
- Reflection - The reply of a request going to a spoofed origin.
- Amplification - The reply larger than the request.
[Cloudflare - DNS Amplification Attacks](https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/?ref=connortumbleson.com)
[Cloudflare](https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/?ref=connortumbleson.com) does a good job making an image for this example for one infected host sending multiple spoofed DNS requests. You can see how easily it is to make this a massive attack. More infected hosts or more open DNS resolvers can make this a deadly attack.
Paired with the amplification factor, it could be even deadlier. Imagine a web request you send to a DNS server of roughly 60 bytes. However, you ask the DNS server to respond with the largest payload it has to your victim. This would generate probably over 4000 bytes in response. So you can see how much more data the victim would receive.
With the abuse of DNS amplification, web-server administrators globally began patching to prevent the abuse. However, DNS was just one medium for reflection. Soon it was NTP, SNMP, then memcached. The list is never ending and the attacks will only continue to evolve.
I hope this part story and part knowledge can help bring more information to the ever expanding landscape of DDoS attacks.
### Travel Blog: Kansas City
URL: https://connortumbleson.com/2020/01/13/travel-blog-kansas-city/
Last updated: 2025-02-04T11:43:37.000Z
Photo by [Briana Tozour](https://unsplash.com/@britozour?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The past weekend I flew from the warm Florida into the cold Kansas for a wedding. A college roommate and friend since as early as I can remember was getting married so I flew up as both a groomsmen and friend.
I grew up in Kansas and it had been a long time since I had returned. The first thing I noticed was the massive construction at the airport, since the legacy 3 terminal structure of MCI was being destroyed for a new singular terminal.
[buildkci.com](https://www.buildkci.com/?ref=connortumbleson.com) tracking the construction
For those who've never traveled into Kansas, the airport after being dropped off is a giant circle. Depending where you entered you can walk a few steps and be at your gate (40 years ago). This was the 1970 pinnacle of "drive to your gate" before the era of airport security was added.
Now that airport have shops, food, security and amenities MCI is frankly just ugly and dated. Terminals aren't connected and you could walk 20-30 gates just to get through security to then have to back-track back to your intended gate.
They closed Terminal A in order to start the massive construction effort that would take years to complete. After closing it, they destroyed it and then [started re-purposing the 120,000 tons of concrete](https://www.buildkci.com/recycling-terminal-a/?ref=connortumbleson.com).
So long story short, the construction is just beginning and will be there for years to come.
After landing, thankfully the wedding venue was downtown so the Uber into town was not bad at all. In the past living in Kansas, the travel time to airport was easily 40-50 minutes. I arrived at the hotel way too early for check-in around 9am, but surprisingly my room was ready.
I walked in the freezing weather next door to grab an early lunch while waiting for other friends to arrive.
Buffalo Mac n Cheese
This food tasted great at the time, but didn't feel so great afterwards. I started glancing at the reviews of the place and it scared me how many other reviews said they got food poisoning as well. I left a bad review as well to save whoever from the pain I felt.
As the rehearsal neared, it was my first time visiting the Bride and Bauer, which was a cool little building downtown.
Preparing for the wedding Saturday morning
The wedding was a sweet little venue and was great to see another friend get married. I got to run into some old friends that I hadn't seen since College, even some that I hadn't seen since High School. It is amazing how fast you can just catch up with friends even though you haven't seen them in 4-8 years.
The night went late with stories and catching up, celebrating the marriage of two great friends. The walk home from bar to hotel reminded me that I hate the cold weather and below freezing temperature is not for me anymore.
As Sunday approached it was time to Uber around and visit all my friends still in Kansas. Dogs were met, food was eaten and all around a great time. For the first time in the history of my flying, sitting in the airport at 940pm on a Sunday, I learned only 47 people were boarding my Kansas to Tampa flight home.
The staff explained that every row could hold 1 person and no one needed to sit in the middle seats. I was tempted to sit in the available aisle seat of the first row, but instead opted for the first free row I found after boarding last.
Near Empty Flight - Kansas -> Tampa (940pm -> 1255am)
The classic late night arrival to Tampa with Uber home, walking in the door around 1:40am. A weekend wedding adventure over, with another travel blog completed.
### 2020 Meetup: CLICK_HERE.exe
URL: https://connortumbleson.com/2020/01/06/2020-meetup-click_here-exe/
Last updated: 2025-02-04T11:43:37.000Z
Made by Graeme at Sourcetoad
Welcome to 2020 with a new resolution for myself. After attending a few meetups around Tampa I wanted to create my own, but didn't want it to become a task vs a hobby. So I made a meetup with the goal to speak once a month and then shut down the group after a year.
This group will be about digital security, but not highly specific to any field. For example, I want to talk about the basics of SQL Injections but also the common confusion between encryption and hashing. All talks will follow the same pattern in the format of discussing history of the topic, a bit of basics for it and then prevention measures (if applicable).
My discussion topics (which may change) are as follows:
- January \- SQL Injections
- February \- XSS/CSRF
- March \- MITM/DDoS
- April \- Vulnerabilities and 0-days
- May \- Data Breaches & Passwords
- June \- Serialization and XXE
- July \- Tracking & Cookies
- August \- Bots & Scams
- September \- HTTPS/TLS/SSL
- October \- Malware & Ransomware
- November \- Encryption vs Hashing
- December \- WiFi Hacking
---
After giving this idea to a few co-workers, I needed help coming up with a good name for the meetup. I didn't want to do something boring, so co-workers helped me come up with a list of good names.
- *Shell this*
- *SUDO Come to this Meetup*
- *; – DROP TABLE USERS*
- *CLICK\_HERE.exe*
- *Amazing Exploits*
After a bit of thinking, I went with *CLICK\_HERE.exe.* Unfortunately going through review with meetup.com resulted in the following:
*Click Here.exe* \- as excessive caps not allowed.
So the [meetup](https://www.meetup.com/CLICK%5FHERE-exe/?ref=connortumbleson.com) was born with a lowercase iteration due to rules. The page is under creative construction for some banner and logo images, but the first event is scheduled and ready to get started.
In terms of the content of the meetups. I just wanted to talk about so many things that interest me without going into extreme technical details. I had noticed at other meetups around town that things I thought were common knowledge in this field was actually not known. So my goal is to help teach a good intro for a variety of topics.
All slide decks as they are presented will join my growing collection.
2. [http://www.fao.org/ag/againfo/programmes/en/rinderpest/home.html](http://www.fao.org/ag/againfo/programmes/en/rinderpest/home.html?ref=connortumbleson.com)
3. [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2129311/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2129311/?ref=connortumbleson.com)
### The Connected World
URL: https://connortumbleson.com/2019/09/16/the-connected-world/
Last updated: 2025-02-04T11:43:45.000Z
Photo by [Steve Johnson](https://unsplash.com/@steve%5Fj?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Like most blogs I write they revolve around the idea that every human is connected in this world far more than the generation before them. I recently re-watched the film: [The Village](https://en.wikipedia.org/wiki/The%5FVillage%5F%282004%5Ffilm%29?ref=connortumbleson.com) and this brought up a good point had the Internet and communities not evolved.
For those unaware, the film is about a tiny village in which all inhabitants are scared of "monsters" that live in the woods. This keeps the villagers fearful of leaving their town and they grow up among each other, until one day a child falls ill. After much discussion they send "Ivy", a blind girl, into the woods with a piece of paper and told to walk to the end of the woods.
[Bryce Dallas Howard](https://www.imdb.com/name/nm0397171/?ref=connortumbleson.com) \- The Village (2004)
The twist in this movie occurs when the above girl stumbles onto a paved road running into a park ranger who easily is dressed like 50 years has passed. We learn that the civilization the village is built is surrounded by the real present world. The girl is given the medicine and returned to the village truly unaware of what she saw, as the elders vote to continue living in the past in the village.
This movie got me wondering - why did the elders lie to their entire population? Did their past traumas justify lying to everyone?
Moving into the point of this post is we live in a connected world. I remember shoveling snow to make enough money to buy a 150ft Ethernet cable so I could drag a cable from our router up a flight of stairs into my room. This turned my computer from a gaming machine to an infinite pool of knowledge.
Google hadn't really kicked off yet, but I was using AskJeeves, Yahoo and Altavista to search whatever I was curious about. This led researching thousands of thousands of things related to web development, Internet networking structure and how to beat a variety of video games.
> I remember visiting the parent's place and finding some of my self-made binders of documentation. Hundreds of pages of just forums, official language documentations and quick facts for HTML, CSS, PHP and more. I was building my own offline repository of knowledge for when I wasn't near my computer.
The era of asking parents, buying books or attending conferences to glean knowledge was losing steam compared to the infinite knowledge of the connected world. The connected world knew when I googled about a random shadow transparent blob in my eyesight that it was "eye floaters" and perfectly normal unless they appeared in mass.
The Internet does not judge when you research anything. Which helps free users who live in a situation where knowledge is contained, limited or even just fed in lies. So I'll end this with a quote and I'm not sure who originally said it, but "*knowledge is power."*
### The Collapse of a Treasure Hunt
URL: https://connortumbleson.com/2019/09/09/the-collapse-of-a-treasure-hunt/
Last updated: 2025-02-04T11:43:46.000Z
Photo by [Roman Kraft](https://unsplash.com/@romankraft?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
In the early 2000's I was given a book by my grandma when I was barely 12 years old. This book contained a treasure hunt - that if solved could result in finding tokens in the real world. Those tokens when redeemed could result in cash or a crystal jewel representing a character from the book.
The book - [A Treasure's Trove](https://www.amazon.com/Treasures-Trove-Treasure-Parents-Children/dp/B000IFS0P4?ref=connortumbleson.com)
This puzzle launched while the Internet was still really expanding as there wasn't a Telegram, Groupme or real-time chat service available to help spread a global hunt. Although the book had plenty of popularity as it surfaced at #2 on the New York Times bestsellers list.
---
Solving these puzzles was far more difficult than a little kid could probably piece together. Outside of that though, what was interesting is the trees on each page resembled the tree in which the prize could be discovered. The image below shows what the tree looked like in the book and real life. Inside the tree was a token worth $50,000.
[David Somers, July 2005 - Solve PDF](https://connortumbleson.com/xda/beetlesolution2.1.pdf)
For those interested in the solve for one of these puzzles. A PDF of the Beetle solve can be found [here](https://connortumbleson.com/xda/beetlesolution2.1.pdf). It was one of many prizes that was hidden within the words of the book.
- **Ant** \- (Swanny City Park, Moab, Utah)
- **Bee** \- (Santa Rosa Lake State Park, New Mexico)
- **Beetle** \- (Badlands National Park, South Dakota)
- **Butterfly** \- (Nantahala National Forest, North Carolina)
- **Caterpillar** \- (Lake Dardanelle State Park, Arkansas)
- **Dragonfly** \- (Ricketts Glen State Park, Pennsylvania)
- **Firefly** \- (Foss State Park, Oklahoma)
- **Grasshopper** \- (James Baird State Park, New York)
- **Hummingbird** \- (Jackson, Wyoming)
- **Ladybug** \- (Paintsville Lake State Park, Kentucky)
- **Snail** \- (Lake Anita State Park, Iowa)
- **Spider** \- (Prickett's Fort State Park, West Virginia)
However, like all puzzles. An undocumented 2 extra puzzles were discovered leading to the following creatures:
- **Pook** \- (Newaygo State Park, Michigan)
- **Rustful** \- (Golden Gate Park, San Francisco)
Now older me wonders how you can keep such a challenge secret from the team producing the puzzles and preventing leaked answers. However, ignoring that we can look at some of the prizes this hunt rewarded.
[Crystal Pook - My Favorite](https://jewelrydesigns.com/jewelry/custom-jewelry/custom-jewelry-projects/treasures-trove-project/?ref=connortumbleson.com)
Thankfully the team at Jewelry Designs maintains a [page](https://jewelrydesigns.com/jewelry/custom-jewelry/custom-jewelry-projects/treasures-trove-project/?ref=connortumbleson.com) to examine all these cool designs.
The spider - sitting at a $450,000 evaluation
The spider had a crazy design boasting the following features:
- Kashmir blue sapphire (head)
- 21.23ct light yellow diamond (body)
- bead set diamonds weighing 12.73ct (legs)
Which was such a cool treasure hunt and even a decade later reading the solves is pretty fun.
---
Moving on from Treasure's Trove though, the 2nd iteration of the book was set to be much larger with more puzzles and more prizes.
[The 2nd book - Secrets of the Alchemist Dar](https://www.amazon.com/Secrets-Alchemist-Dar-Treasures-Trove/dp/0976061880?ref=connortumbleson.com)
This was said to have over 2 million in prizes for a treasure hunt of 100 rings. Unfortunately this story ends sadly due to a dispute between the distributor and author(s). The company behind the books was put into bankruptcy and ultimately collapsed. With no prizes in the world, the puzzle fell apart.
It was learned only 5 rings were produced from Aaron Basha, which ended up being resold at an auction.
[1 of the 5 Rings from "Secrets of the Alchemist Dar"](https://www.jckonline.com/editorial-article/treasure-hunt-rings-at-jck-las-vegas/?ref=connortumbleson.com)
---
There is a small group of people trying to solve the puzzle despite almost two decades passed since the book was released. It wasn't all worthless though as the author a few years after the bankruptcy put out a [press release](https://www.prnewswire.com/news-releases/previously-unbroken-code-in-ny-times-bestselling-book-secrets-of-the-alchemist-dar-to-be-released-by-author-until-code-is-broken-160985455.html?ref=connortumbleson.com) with hints to help solve the puzzles.
Michael Stadther first public hint
The puzzles at this point had no money, but it was only fair to those who were attempting to solve. Today in 2019 the websites devoted to once solving the puzzles are offline and any collection of solves is difficult to find.
However, this hunt was different with decoding leading to PO boxes throughout the United States. The true puzzle was figuring out what to send in a letter to those PO boxes. Since the company went bankrupt the puzzle never proceeded farther than knowing what to send to what PO box. At point in my research no letter sent to any PO box was ever responded to.
Treasure hunts continue to evolve and I will be speaking about them in person at the upcoming [Tampa Bay BarCamp](https://connortumbleson.com/2019/08/26/bar-camp-tampa-bay-2019/) (October 5, 2019)
### Hurricane Dorian and Tampa Florida
URL: https://connortumbleson.com/2019/09/02/hurricane-dorian-and-tampa-florida/
Last updated: 2025-02-04T11:43:46.000Z
[NOAA Cone Estimation](https://www.noaa.gov/dorian?ref=connortumbleson.com) \- August 29, 2019
What seems like a pattern around Labor Day every year, news began that a hurricane was forming in the Atlantic and would make a direct impact with Florida.
Since I moved here the major hurricanes to hit Florida have been Irma in September of 2017 (CAT 4) and Michael in October of 2018 (CAT 5). So naturally I've learned how Tampa reacts when news of an impending storm nears.
## The Discussions
Like most storms, the first talk with an impending storm is people discussing what happened during the last one. All the stories are about the same, either the person evacuated or didn't and their experiences during either. This really puts in comparison in the difference in experiences depending on the person. One person might talk about the sick hurricane party they hosted and how they got trashed on a 30 pack of beer. While the other might talk about the pure destruction of their home and intense flooding which destroyed their landscape.
It's like a car crash when people wander outside to see what the commotion is about, except the car crash is throughout the entire city. While getting a sandwich at a local shop the overheard conversation at nearly every table is the same - the hurricane.
### The Gasoline Panic
While the path of a hurricane may change in the days leading to the impact - this points the question in everyone's mind. "*Do I have enough gasoline to leave the state if needed?*"
It might be days away and you might just be filling up in order to make the drive to work, but the lines will be long or even worse - empty. After some research it seems Florida uses roughly 30 million gallons of gasoline daily \[[1](https://www.tampabay.com/hurricane/2019/08/30/florida-has-enough-gas-for-dorian-but-patience-is-required/?ref=connortumbleson.com)\]. This seems like a huge number and that is just the average, so it make sense why gasoline becomes such a problem for a state that only has entry via Georgia or Alabama.
When evacuations got bad during Irma some gas stations even closed. That is a scary site to see for those trying to evacuate with no gas available, but probably a side affect of evacuation.
### The Shopping Nightmare
Even when it was becoming apparent that Dorian was heading up the east coast instead of cutting across Florida - Tampa grocery stores were still more crazy than they should be. I walked in to refill on my usual grocery supplies and was met with an interesting display.
Water pallets full of water front and center. Signs in front of items like bread saying "2 per customer max". People walking around with two shopping carts filling them with a ton of supplies.
Am I ill-prepared? Are they over-prepared? We are talking about a storm on the other coast of Florida here. I guess I can't blame people - we went from estimations of Tampa in the path.
[13News Now - Tim Pandajis](https://www.youtube.com/watch?v=-5zPFNZFT8M&ref=connortumbleson.com) \- Aug 29, 2019
To 24 hours later estimations looking more like:
[Cyclocane - spaghetti model](https://www.cyclocane.com/dorian-spaghetti-models/?ref=connortumbleson.com)
Right now The Bahamas is getting destroyed, so best of luck goes out to them. Not often we have a Category 5 storm. Labor day is tomorrow and hopefully by that time this storm will decide to just curl into the Atlantic and die out.
### BarCamp Tampa Bay 2019
URL: https://connortumbleson.com/2019/08/26/bar-camp-tampa-bay-2019/
Last updated: 2025-02-04T11:43:46.000Z
Coming up in 2 months on October 5, 2019 in Tampa Bay is the 12th annual BarCamp.
> BarCamp is an international network of user-generated conferences where the agenda is set by the attendees the morning of the event.
This will be my 3rd time attending and 3rd time speaking, so I just wanted to run through some benefits if you are in the Tampa area.
## The event is free!
If you are available on October 5 - there is no reason you should not be at this event. You have the chance to hear a huge range of topics from local residents. I'm not going to lie and say every talk is perfect - some people are standing against great nerves and speaking for the first time. However, some prepare slides in advance and treat the conference like any other - with a plan of attack.
## The food is free!
When the doors open at 8am, you can find donuts and a variety of common breakfast items. When lunch rolls around some form of catered food will also be provided. Last year was box lunches from Firehouse subs. If you stay till the end where the event moves to an after party - the snacks and first drink is covered as well.
## The talks are vast!
I attended a talk where someone discussed attending burning man, including tons of photos. It was something I was not aware of and quite possibly the best talk I attended that year. Last year, I just attended all events related to security to hear from industry players in a variety of related fields.
## The community is great!
You may be attending your first event - like I did a few years ago and I guarantee you will meet some interesting Tampa folks and exchange conversation. I'm not the most sociable human and I seem to be fine talking with attendees there.
---
So if you've missed a few years, then not to worry. I want to recap my previous talks and convince you to attend this year. If not to attend my future talk, then to attend one of the various others.
This conference is great because there are no committees reviewing your slides and no strict guidelines of topics to use. Those guidelines are great for major conferences to prevent people just flat out selling you things or someone not understand the balance of what you can and cannot talk about.
So in 2017 on October 22 - I spoke about the "Top 10 Vulnerabilities in the past 5 years".
[Slides](https://connortumbleson.com/slides/2017-10-22-TopTenVulnBarCamp.pdf)
This talk was a fun one to make. It started because I just wanted to talk about the mess of things that occurred in 2017\. It started with Shadow Brokers leaking a variety of tools and then leaked into KRACK. So I turned it into a countdown of severity (in my opinion) for a variety of more popularized vulnerabilities.
The talk was in a classroom at USF and was quite interesting. It felt like being a professor with a classroom of students. All in all - thought it went well and led me to doing it again the next year.
[Slides](https://connortumbleson.com/slides/2018-11-10-BiggestBankHeistBarCamp.pdf)
So on November 10, 2018 I spoke again. This time about the greatest bank heist that I'm betting my attendees did not know about. This time in a re-purposed room in a soon to be renovated mall. The talk grew a medium crowd so maybe my advertising could have been better, but all in all another great talk.
This leads to the upcoming October 5, 2019 talk. In which I will be talking about the greatest Internet mystery. I don't want to spoil anything - so you'll have to attend to see.
---
**Website:** [https://barcamptampabay.org](https://barcamptampabay.org/?ref=connortumbleson.com)
**Date And Time**
Sat, October 5, 2019
8:00 AM – 5:00 PM EDT
**Location**
Keiser University - Tampa
5002 W Waters Ave
Main Entrance
Tampa, FL 33634
Hope to see you there!
### Constraint is the Rage
URL: https://connortumbleson.com/2019/08/19/constraint-is-the-rage/
Last updated: 2025-02-04T11:43:47.000Z
Photo by [Uriel Soberanes](https://unsplash.com/@soberanes?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Over the weekend I saw a clickbait title which said - *Die with Me.* This caught my attention so I of course clicked it. Without feeding my readers additional clickbait, lets take a look into what it is.
[Die With Me - Apple App Store](https://apps.apple.com/us/app/die-with-me/id1317265106?ref=connortumbleson.com) \- [Dries Depoorter](http://diewithme.online/?ref=connortumbleson.com)
The idea is simple. Once your phone has less than 5% battery - the app drops you into a chat with other users in the same boat. This means you can chat with others as your battery hits zero (thus dying).
I haven't known about this app for more than a few hours, but I already discovered you can purchase upgrades to allow access to the app at 15% or below instead of the regular 5%. Can't blame the guy who wants to make some money on a clever idea, but lets take this idea of a constrained application and bring it to more popular applications.
---
[Tweet from Jon Erlichma](https://twitter.com/jonerlichman/status/883673552075071490?ref=connortumbleson.com)n - July 8, 2017-
Enter Snapchat in 2011, well back then it was briefly known as "Picaboo". The idea was simple - send a photo to a friend and it would disappear shortly after. This was a constrained feature, since you could send unlimited photos and view them forever on any messaging service. This application exploded in popularity, slowly adding a bunch of features from videos/chat/emojis/groups and much more.
What attracts people to something that is intentionally constrained? Was it the notion that you could send inappropriate photos without a trace? Was it just time for a new social medium to take over? I don't know the answer to these, but we can look back in time to figure things out.
Take Xanga/MySpace which were popular social networks in the early 2000s. Both of these had in common customization that allowed you to personalize your page. Whether this was an ugly color scheme or blaring music - they had it. Facebook then entered the market with a profile page that could not be changed. They built your profile page from available info and it frankly made the site look clean and professional.
Facebook exploded despite not offering functionality that other competitors had. It seems people appreciated the constraints or maybe it was just a better thought out social network.
We can think of plenty of these examples. Twitter started with 140 character limits, an intentional constraint on micro blogging and it also exploded. Today, Twitter's limit is not 140 but instead much larger and offers so many methods for expanding the limit that it might as well not exist.
Why does this happen?
- Snapchat - Photos disappear automatically (in past)
- Facebook - No customization of profile page (in past)
- Twitter - 140 character limit (in past)
- Die With Me - Requires almost dead battery to use
Can you compare constraints to exclusivity? Probably not, because only "Die with Me" is exclusivity while the others anyone can join just with constraints. We live in a wonderful time where taking things away becomes the most popular.
### The End of Streaming
URL: https://connortumbleson.com/2019/08/12/the-end-of-streaming/
Last updated: 2025-02-04T11:43:47.000Z
Photo by [Jakob Owens](https://unsplash.com/@jakobowens1?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I learned the news a few weeks ago that "The Office" was leaving Netflix in 2021 to a competing streaming provider. I watch The Office all the time over Netflix even though I've seen every episode multiple times. I don't watch as much as it just sits in the background while blogging or programming.
However, I started thinking about why I started paying for Netflix anyway. In the beginning a good majority of students just stole media. Most students used Limewire or some iteration of torrenting. Others used file-sharing websites to accumulate large media collections. With both burning them to DVDs to bring to houses for "movie night".
Times started changing. TVs became smart. Chromecast was invented. Computers were sold without DVD burners. It became more difficult and annoying to steal content. You could have an MP4 stolen video on your desktop, but no system you had could cast it properly. You could try 3rd party extensions, Xbox Live streaming or Windows 10 streaming. It was buggy and normally wouldn't work, or if it did - it would lag horrifically. So your options were quite limited to watching the video on a computer, with something like VLC.
Netflix was gaining steam. Application support on major game consoles and all computers, including some smart TVs. This meant that for just a small monthly fee you could watch a seemingly unlimited stash of content legally. There was still no legal solution to watch a new TV show if you missed it a day prior, but this was progress.
Source: [VOX - The history of Netflix price increases in a single chart](https://www.vox.com/2019/1/16/18185174/netflix-price-increase-subscription-chart-original-content-streaming?ref=connortumbleson.com)
What started to happen though is the price started going up. The abuse of adding 5-6 friends per account was ending as well. Accounts were limited to viewings at a time, including the quality of the content you could view.
While that was happening the 3 premium movie providers (HBO, Starz & SHOWTIME) began reaching into the world of streaming services. No longer were these services isolated to TV providers. Each site wanting to pull you in holding exclusive content that the others didn't.
At the same time of all of that - Vudu, Hulu and Amazon Prime were growing and with that a non-stop battle of content/rights and exclusive content.
Are you expected to pay for all the services to legally watch media? If you missed an episode of Game of Thrones, where do you watch it? If you want to catch up on an episode of Walking Dead, where do you watch it?
I for one am not going to pay for 10 different streaming providers. Do media companies want me to go back to stealing content? I just want a service like Spotify to exist. I want to potentially watch every bit of media in the world legally. Netflix was the nearest I've been to that dream, but every year splits up the empire of Netflix and the only one it hurts is the consumer.
I don't know what I'm going to do when Netflix loses The Office in 2021\. I'm mad at Hulu, because you can pay for their service and still be given ads. I'm mad at the media conglomerates that seriously think the solution to the problem is to add another streaming provider.
I might have to dust off my Kodi box, wire up couch potato and scan the depths of newsgroups for content.
### Sandwich Shop Reviews 2019
URL: https://connortumbleson.com/2019/08/05/sandwich-shop-reviews-2019/
Last updated: 2025-02-04T11:43:47.000Z
Photo by [OLA Mishchenko](https://unsplash.com/@olamishchenko?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This post is quite possibly one of the weirdest posts I've written, but I have an urge to talk about all the sandwich shops around and organize them in my own personal list.
The rules are simple.
1. They must be a chain.
2. I must have eaten there.
With that, my top 9 places. It could have been 10, but I've never been to Potbelly so I cannot rate it. So lets start at the worse and make our way to #1\.
---
**#9 - Subway**
In my early college years, I would pass a Subway on the 3 hour drive into Fayetteville Arkansas every time I did the drive from home (Kansas City). This is rural Midwest America - the best option outside of a dilapidated fast food is a Subway. The buffalo chicken sandwich was my go to, but this place just fell apart. Never clean, never consistent and just bad experience after bad experience.
My only preferred option was removed as well, so I had no reason to ever return. Not to mention the sight of seeing pre-sliced meat sitting in plastic containers awaiting an order is not the definition of fresh in 2019\. Subway sits on the bottom of my chart for these reasons.
**#8 - Schlotsky's Deli**
It hurts to put Schlotsky's so low on my list, but over the years their quality has just been destroyed. This place pioneered this sourdough pressed cheesy sandwich known as "The Original". The iceberg lettuce was the cooling aftertaste on top of the warm gooey cheesy sandwich. However, I moved and this place was no where to be found.
Years passed and tried it again. The menu was different, the branding was different and I couldn't even find my favorite sandwich on the menu. Instead hiding away in front of pizzas, flat breads and salads. I finally ordered The Original and the sandwich was just bad. Did my taste change over the years? Was it a bad experience isolated to one time? I tried it again and was disappointed even more. I haven't been back since.
**#7 - Panera Bread**
Panera is one of those places that I will still continue to visit, I just don't have anything interesting to say. The food is fresh, but nothing stands out here to drive me back to visit. Getting an Italian sandwich is a sandwich that taste fresh, but I'm usually given a spicy mustard or mayo packet. The place is just about taking some fresh bread and fresh meat, slapping it together between two pieces of bread and giving the consumer the veggies and condiments to make the final picture.
I recently learned you can get any sandwich pressed, which has upped the quality and taste. However, on multiple occasions I've asked for the sandwich to be pressed and it shows up just hot. Like I want the sandwich pressed, not heated in some oven.
**#6 - Firehouse Subs**
When Firehouse first appeared - I very much enjoyed this place. A wide menu and tons of hot sauces at every location. However, this place reminded me of Arby's where everything is just steamed. Meats are steamed and placed between two long pieces of bread and after a few trips - it becomes old. I don't want a big melded steamed sandwich, I want to taste the flavors. Something about steaming a sandwich makes it a muted taste that I'm not too into anymore.
**#5 - Quiznos**
If Quiznos still existed in its prime time - this might be a top 3 sandwich. The entire experience of picking a sandwich watching it be made and then see it go through a little conveyor belt of cooking was such a unique experience. Pair that with the condiment station and this was an excellent place.
Pepper/Condiment Station - [Source (BusinessInsider)](https://www.businessinsider.com/what-led-to-quiznos-bankruptcy-filing-2014-3?ref=connortumbleson.com)
However, as dumb as it sounds. At some point in the history they changed from cooking the entire sandwich to only cooking the cheese/meats. This meant that veggies were added after the cooking process. This sounds good in theory, but I liked the sandwich prior to this change. The entire taste of the sandwich changed after this and I didn't like it.
Stores are closing [everywhere](https://www.restaurantbusinessonline.com/financing/brief-history-quiznos-collapse?ref=connortumbleson.com) and I guess for reasons outside of the food quality. They remain at #5 in my opinion for what they were and what I remember.
**#4 - Jimmy Johns**
Jimmy Johns exploded onto the scene with their amazingly fast service. Sandwiches would be made as you ordered them. I remember ordering a sandwich and saying "no tomatoes" and watching the employee then pull the tomatoes off. This place was great if you never ventured from a menu item. However, if you wanted wheat bread - then good luck. It won't be the sub iteration, but instead just two piece of wheat bread.
[Italian Night Club #9 - Jimmy Johns](jimmyjohns.com)
Mayo is smothered on both sides which causes the meat to slide around, but otherwise I like these sandwiches. I tend to get the Italian Night every time and with spicy mustard I enjoy it. A fresh combination of ingredients and this sandwich can survive over time. It will taste the same at the restaurant vs driving it home and eating there.
**#3 - Mr Goodcents**
Isolated to the Midwest, this chain of sandwiches excels in my book for two reasons. The bread and the slicing of meats in front of you. No matter what you order, they will slice the meats and prepare the sandwich in front of you. The standard dress is everything I would put on a sandwich, so I only have to add my favorite pickles and spicy mustard.
Mr. Goodcents Original, [source Yelp (Dann S)](https://www.yelp.com/biz%5Fphotos/goodcents-deli-fresh-subs-phoenix-3?select=aHY-7aJieAngUKpK4pkqqQ&ref=connortumbleson.com)
The consistency here is what puts it at number 3\. No matter how many times I go, I can expect the same quality and food. A few times the bread has been not as fresh as other trips, but the sandwich is always the same. I can get wheat bread and a cookie and not be disappointed.
**#2 - Which Wich**
A store unknown to me until I moved to Florida and immediately found a new favorite place. The approach for Which Wich is unlike others stores, instead of ordering from someone. You pick a bag (which will soon hold your sandwich) and fill out items with a red marker.
You build your sandwich and hand the bag to the staff who then makes it.
Example of ordering - [Source EatBreathYogini](https://eatbreatheyogini.wordpress.com/tag/which-wich/?ref=connortumbleson.com)
The reason I like this place is I imagine is because it reminds me of Quiznos. A sandwich is prepared on one side of a cooking belt and finalized on the other side. Paired with a vast menu of options and quite a lot of toppings allows you to have the creativity to make a sandwich like Subway pioneered, but actually fresh.
The store is clean, the staff is nice and while their reward program sucks horrifically due to fast expiration time. I just love experimenting with new food options. Mixing balsamic vinegar with jalapenos or some other weird mix is a fun time at this place. The food tastes great and haven't been disappointed yet.
**#1 - Jersey Mikes**
Holding my personal number one spot is Jersey Mikes. This place has a hot top for hot sandwiches and wraps along with a cold station for your regular cold subs. It has a meat slicer for fresh sliced meats and cheeses which reminds me of Mr. Goodcents. The bread is never too filling (Unlike Jimmy Johns) which brings out the flavor of the sandwiches.
Jersey Mikes Store - source
The staff is always very nice, arguably too nice opting to ask me how my day went. Which is kinda strange to hear from employees in this day in age. The sandwich liquids (oil/vinegar) are put in between the mayo/meats so they can't cause soggy bread (cough Firehouse).
Everything taste fresh which is sometimes not the common trait at other shops. All in all, I continue to go back to Jersey Mikes as my current number one sandwich shop.
### Travel Blog: Madison
URL: https://connortumbleson.com/2019/07/29/travel-blog-madison/
Last updated: 2025-02-04T11:43:47.000Z
Madison, WI Capitol building
For this trip, two flights were required as I couldn't find a direct from Tampa to Madison. The Friday morning started off as most travel weekends with a 4am Uber to make a 6am flight into Atlanta. It was my first time in the Atlanta airport and it was pretty cool. I landed in the A terminal and needed to be in C, so I just walked through these cool historical areas which made a boring airport walk - much more interesting.
Air travel is never easy and this was no exception. This time, some passenger after the doors were closed decided they no longer wanted to be on this flight. I don't know why, but they made a scene and it took 10 minutes for the crew to open the doors again in order to let out one person. It pissed me off, but maybe they had some emergency to attend.
Once I landed in Madison I quicly learned my first tip - this city hates Discover cards. I think my success was 2 out of 8 places accepted my card. Annoying, but life goes on. I quickly then learned that Madison hates T-Mobile. I was standing outside trying to call an Uber and I had 5 bars LTE, but nothing was working. Speed tests were timing out and nothing worked. Randomly all the queued notifications would show up, but it was impossible to use my phone on LTE.
I thought it was an isolated incident, but whether on campus or visiting the Capitol. I had full LTE and no working phone. I crumbled and bought a Verizon Hotspot for 3gb of pre-paid data for the trip. Upsetting, but I couldn't handle my phone not working - especially when it was needed to work for this trip. Others in my group on T-Mobile also duplicated these issues, so we shared the hotspot. As I sit here typing this post on Sunday (July 28), I have 23% of the data left. It was well worth the purchase, because there must be some regional issue going on - LTE and T-Mobile just isn't working well here in Madison.
**Food**
The quote in the airport was "best beer and cheese", so I figured I had to try the beer and cheese. I stuck with cider I can't really tell a bad cider from a good one, so have no opinions on that. As for the cheese curds, they are just mini cheesesticks. I'm not sure why they are hyped up at every restraunt, when they are literally just breaded and fried cheesesticks.
Sandwich shops had bars inside them, which is probably a relic of being in a college town. Places advertised kool-aid as an option for a drink, which as I tested and confirmed reminded me exactly of the same drink I had as a kid.
**Area**
Walking campus led me to a nature trail that outlined the lake. This lake had long-boat training in practice. Additionally I saw, sailing, kayaks, wakeboarding and much more. The lake was a few minutes off campus, so I was curious how busy the docks and area becomes when school is in session. There were enough students tanning for the summer that I imagine it becomes quite crowded as school begins.
Dock right off campus, 8am (July 28, 2019)
In closing, this post is set to go live at 1030pm EST. I'll still be in an airplane at that time returning home to Tampa.
Wisconsin reminded me of the midwest hospitality and was a treat to spend two days with. Another travel post to index into my history.
### The Evolution of Open Source
URL: https://connortumbleson.com/2019/07/22/the-evolution-open-source/
Last updated: 2025-02-04T11:43:48.000Z
Photo by [Markus Spiske](https://unsplash.com/@markusspiske?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few weeks ago, I shutdown my personal GitLab server in favor for moving all my projects to the "gitlab.com" domain. The reasoning was simple - [MySQL was being removed](https://about.gitlab.com/2019/06/27/removing-mysql-support/?ref=connortumbleson.com) and changing the database requirement to only Postgres.
GitLab was not in the wrong at all, managing two different databases is not easy. You can't write anything specific to either system and need double the tests for your CI/CD process. However, the day I installed GitLab myself in 2012 I picked MySQL due to my server constraints.
Years went on, I continued to patch and upgrade my own installation. Perhaps my own fault for never switching to the newest and greatest pre-built packages, but I upgraded my own source installation of GitLab every month for 7 years.
I made many mistakes hosting GitLab myself. I went against the norm and used MySQL and Apache. This worked against me multiple times with upgrades enforcing a change that wasn't completely documented for the rare Apache/MySQL combination. It was open source though, so normally a few Google searches an existing knowledge kept my self-hosted copy of GitLab running.
Release after release would add things that would require some work, like adding GoLang as a dependency and updating to latest and greatest Ruby/Node. These are things I would normally have to do, but the monthly GitLab upgrade would force my hand quicker than normal.
The tipping point was when MySQL was removed, the open source product was no longer feasible for me to self-host. While developed in open source, it no longer was feasible for me to use. The barrier of entry was too high. I had to move my projects and shut down my instance. I noticed this pattern with another piece of software, known as Sentry.
### Sentry
Sentry is an error tracking piece of software that anyone could easily self-host and is developed in the [open source space](https://github.com/getsentry/sentry?ref=connortumbleson.com). It's an amazing piece of software, because it was open source and free unlike the expensive alternative at the time - New Relic. The open source nature meant I could host it for all my hobby projects. Projects that in total hosting cost $2 month simply wasn't worth any SASS offering.
For years this was an excellent product and still continues to be, but early 2018 something changed. A product that had a release very often hadn't had one in 3 months. Additional months passed and it seemed something had changed - the SASS iteration of Sentry (at [sentry.io](https://sentry.io/?ref=connortumbleson.com)) was continuing to gain features, but no official release had been tagged in the open source iteration.
I could technically upgrade to the latest bleeding code, but without release notes or documenting. I'm sure I would be entering a dangerous area. Unfortunately a tipping point also hit for Sentry, which started with this [blog post](https://blog.sentry.io/2019/05/14/sentry-9-1-and-upcoming-changes?ref=connortumbleson.com).
> We know this will be painful for anyone self-hosting Sentry, and, while we hope to provide a reasonable migration path, it’s always a good time to reflect on the value of self-hosted Sentry versus letting us operate it securely in the cloud for you.
> [https://blog.sentry.io/2019/05/14/sentry-9-1-and-upcoming-changes](https://blog.sentry.io/2019/05/14/sentry-9-1-and-upcoming-changes?ref=connortumbleson.com)
Companies have to make money and supporting open source iterations of their software probably doesn't make sense. We could argue that working on open source attracts attention which may eventually lead to the SASS option, but more than likely some analytical decision was made that hours spent on a product that does not directly benefit paying users is not worth it.
I'm sure the SASS offering requires some tools to handle the large amount of users. These tools in the case of Sentry are Apache Kafka, ZooKeeper and a few more. Sentry doesn't want to have a crippled open source iteration of their software, while their SASS has a different product offering. This means that unforunately the future releases of Sentry open source will require these new dependencies.
I could stay on the old version, but this is just a ticking time bomb with dependencies and versions till it no longer works. I could attempt to install the required dependencies, but then my hobby project work might become pure dev-ops. Sentry wants paying customers and I don't blame them, but my history with Sentry in the open source space for little hobby projects is now over.
(*Context - The only reason I know about the SASS iteration of [sentry.io](https://connortumbleson.com/2019/07/22/the-evolution-open-source/sentry.io) is I use it at work*)
### Ghost
Finally in our list is the project known as Ghost. An amazing blog written in Node trying to compete with the giant - WordPress. This project is [open source](https://ghost.org/about/?ref=connortumbleson.com) along with a SASS offering.
For a few years I've run three blogs self hosting them using Ghost. This has had some hiccups, especially during the upgrades of 0.x to 1.x, but I understood a non 1.0 release would have some growing pains.
Things are great with Ghost and I have no complaints. I upgrade when new versions happen and nothing has gone wrong - yet. However, as shown with Sentry and GitLab is my dance with Ghost going to come to an end? Time will tell, but I hope I can continue to self host Ghost for the foreseeable future.
### Is Craig Wright Satoshi Nakamoto?
URL: https://connortumbleson.com/2019/07/15/craig-wright-is-not-satoshi/
Last updated: 2025-02-04T11:43:48.000Z
Photo by [André François McKenzie](https://unsplash.com/@silverhousehd?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The [Satoshi Nakamoto](https://en.wikipedia.org/wiki/Satoshi%5FNakamoto?ref=connortumbleson.com) is a pseudonym of an unknown individual who, in short, created Bitcoin. Research for years has occurred with profiles, source code and any bit of evidence to try and discover who this person is/was.
This led to investigations by the hive-mind of the world and even journalists trying to uncover the person behind the pseudonym, but nothing has gained more steam than the ongoing (June 2019) court case of [Kleiman vs Wright](https://www.courtlistener.com/docket/6309656/kleiman-v-wright?ref=connortumbleson.com). The full 38 page report can be found [here](https://www.courtlistener.com/docket/6309656/1/kleiman-v-wright/?ref=connortumbleson.com).
In short, Kleiman and Wright worked together prior to and after the inception of Bitcoin. They met sometime around 2003 in online forums. They accumulated some unknown large amount of bitcoins from 2009 to 2013\. Rewards for mining a new block in 2009 to 2013 was 50 BTC per block. That of course halves itself every 210,00 blocks, which occurs roughly every 4 years. This means that today rewards are only 12.5 BTC per block mined.
[Graph](https://bitcoinvisuals.com/chain-block-reward?ref=connortumbleson.com) showing rewards dropping from 50 to 25 to 12.5
So it was easier in 2013 and prior to quickly amass a Bitcoin collection, which explains why this case even exists. As it is rumored that over one million of Bitcoins would be mined. However, Kleiman passed away and it wasn't pretty.
> In April 2013, Dave was found dead in his home. The scene of Kleiman’s death
> was gruesome. His body was decomposing, there were wheelchair tracks of
> blood and fecal matter, open bottles of alcohol, and a loaded handgun next to
> him. A bullet hole in his mattress was found. The exact details surrounding his
> death remain unknown.
> Page 13, Point 50 - Kleiman v. Wright
This is important, because in February of 2011 Kleiman & Wright formed a company to specialize in Bitcoin mining / Software development / Research. This company was the complicated legal matters that decided who owned the Bitcoins that were mined. We can see from court proceedings that it looked like a 50% split between Kleiman & Wright.
That is until Craig Wright allegedly created three fraudulent documents to create a paper trail that all 50% of Kleiman's Bitcoin rights were to be transferred to himself.
> a. 2011 contract titled “Intellectual Property License Funding Agreement” (the “2011 IP Agreement”) (Ex. 10);
> b. 2012 contract titled “Deed of Loan” (the “2012 Deed of Loan”) (Ex. 10);
> c. 2013 contract titled “Contract for the Sale of Shares of a Company Owning Business” (the “2013 W&K Sale Agreement”) (Ex. 4).
> Page 20, Point 76 - Kleiman v. Wright
These documents through professional analysis seem fraudulent due to the following:
- Signature computer generated
- There are no witnesses or notary
- The grammar and agreement don't make much sense
- Some of the contracts conflict with each other
- Factual errors with Bitcoin amounts
- The contracts favor Craig so much
Basically, why would the deceased Kleiman weeks before his death haphazardly create such conflicting contracts with Craig in order to give away his assets? Unfortunately he isn't here to ask, but my thinking is what is what was presented - they were forged.
Around February 2014, Craig reached out to the family of Kleiman trying to explain that himself and Dave Kleiman created Bitcoin. This was apparently the first time the family heard of the friendship with Craig. Ira Kleiman became the heir of Dave position in the company and acted as the correspondence with Craig. However, Ira began learning about the strange contracts that basically relinquished all assets to Craig.
Ira reached out to Craig questioning this:
> To keep Ira from going public, Craig promised Ira that he could be paid out of what was owed to Dave’s estate “based on what Dave and I had been arranging.” He then told Ira “October \[2014 would be\] the first payment.”
> The payment never came. Craig blamed the delay on the ATO investigation and kept promising Ira he would see value when the investigation closed.
> Page 31, Point 114-115 - Kleiman v. Wright
This is when things get weird, as October 2015 Craig went dark with correspondence with Ira along with Gizomodo & [Wired](https://www.wired.com/2015/12/bitcoins-creator-satoshi-nakamoto-is-probably-this-unknown-australian-genius/?ref=connortumbleson.com) publishing articles that Craig was Satoshi Nakamoto. As of today, those articles have been updated to retract that statement due to an abundance of fraudulent evidence.
However, Craig Wright himself is claiming to be the pseudonym responsible for creating Bitcoin, who hasn't been seen online in an official capacity since an email on April 23, 2011\.
> I've moved on to other things. It's in good hands with Gavin and everyone.
> [Source](https://plan99.net/~mike/satoshi-emails/thread5.html?ref=connortumbleson.com) \- Email to Mike Hearn from Satoshi
The Internet is quite split on this topic with people both claiming aggressively that Craig is Satoshi Nakamoto. However, it is difficult to trust either as Craig Wright has positioned himself highly involved with Bitcoin SV, another iteration of the fabled Bitcoin currency. This means it is in the best interest of those involved with Bitcoin SV to stick with Craig to keep the currency healthy in terms of value.
Craig does this from his company "nChain", who continue to file for patents related to block-chain technology for which Bitcoin and many thrive from.
### The Court Case
Now, switching topics we can look into the transcript of the proceedings from the case on June 28, 2019\. This is a large 239 page PDF, but we can find some strange discussions among it.
```
Q: Well, let me get this straight. A company you didn't buy until 2014 is listed as a beneficiary of a trust document you claimed was formed in 2012?
A: No. You have put documents I don't recognize.
Q: Documents you produced in discovery?
A: Yes, from other machines in my organization.
```
[Page 96](https://www.docdroid.net/5LZMLHb/06-28-19-ber-kleiman.pdf?ref=connortumbleson.com#page=96) \- 6/28/2019 Proceedings
A strange occurrence when a trust document lists a beneficiary of a company that wasn't purchased by Craig until 2014, but the trust document was made in 2012 apparently.
```
Q: Which is Satoshi Nakamoto?
A: Yes.
Q: I.e. Craig Wright?
A: Yes
```
[Page 139](https://www.docdroid.net/5LZMLHb/06-28-19-ber-kleiman.pdf?ref=connortumbleson.com#page=139) \- 6/28/2019 Proceedings
This is the first time I noticed in an official record under oath that Craig Wright said he was Satoshi Nakamoto. Things continue to get weird with the witness (Wright) denying evidence his team produced.
```
Q: Okay. We were at plaintiffs' exhibit 9, Dr. Wright, and we were looking at the last page --
A: This is Craig Steven Wright dot something. This is not my blog, which was GSE secure -- this is a separate blog.
Q: You produced it to me, Dr. Wright.
A: It was in files that we had. It doesn't mean it's my blog
```
[Page 149](https://www.docdroid.net/5LZMLHb/06-28-19-ber-kleiman.pdf?ref=connortumbleson.com#page=149) \- 6/28/2019 Proceedings
As I continue to read this, it just hurts to read. The witness knows the question being asked, but instead defers to some technicality to avoid any information.
I'm no legal specialist, but it looks like there are two avenues of this case. The first being trying to prove contempt by proving that Wright willfully ignored the court's request for information and the second disapproving the documents that allegedly looked forged.
```text
THE COURT: Dr. Wright, you throw another document in my courtroom --
THE WITNESS: I'm sorry, Your Honor.
THE COURT: -- you will be in handcuffs so fast yourhead will spin. Do you understand me?
```
[Page 47](https://www.docdroid.net/5LZMLHb/06-28-19-ber-kleiman.pdf?ref=connortumbleson.com#page=47) \- 6/28/2019 Proceedings
It seems during the case, Wright threw a document across the room in disgust claiming it was a fake document. Seems like Craig lost his cool for a bit.
Following this case is just so annoying. There are plenty of ways to instantly silence any debates, which could not be argued. However, Wright refuses to do so instead putting forward documents that allegedly have been forged. This in my opinion just proves that he is a pathological liar, but we will know officially in a few short months as this case proceeds.
### The birth of an open source project
URL: https://connortumbleson.com/2019/07/08/the-birth-of-an-open-source-project/
Last updated: 2025-02-04T11:43:48.000Z
Photo by [Christian Wiediger](https://unsplash.com/@christianw?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On July 1st, 2019 Google [open sourced](https://opensource.googleblog.com/2019/07/googles-robotstxt-parser-is-now-open.html?ref=connortumbleson.com) their *robots.txt* parser. Something that was written 20 years ago and updated with the evolving web. I really enjoy reading the code of open sourced projects, even if I don't understand it. Very rarely do companies also open source the commit history, but when they do - that is even more interesting.
However, what I've noticed is a common pattern in every single existing project that has been open sourced. The larger the company open sourcing and the larger the code base just increases this phenomenon.
First 15 Pull Requests to [google/robotstxt](https://github.com/google/robotstxt?ref=connortumbleson.com)
The above image shows what I'm talking about. Out of the first 14 pull requests to the project, we can group them into the following categories.
1. 7 spelling fixes
2. 3 real code contributions
3. 2 unneeded code contributions
4. 1 style fix
5. 1 bad code contribution
I know the first question is "*how do you determine a bad code contribution?*". Well, lets dive into it.
[Force Crawling TurboTax Free File Edition](https://github.com/google/robotstxt/pull/5/files?ref=connortumbleson.com)
This change is requesting that the Google robots.txt parser that runs probably on a couple thousand computers should be patched to explicitly check for Turbo Tax Free edition and allow it to be indexed. There are so many reasons why this is wrong and won't be accepted, but it blows my mind that someone put forward this change request hours after the project went open source.
Was this person just itching to get Turbo Tax indexed online? Was is a big joke? I have no idea, but we are more interested in the obsession with getting spelling fixes into the code base.
- Correcting "*against*" and "*initialized*" - [#2](https://github.com/google/robotstxt/pull/2/files?ref=connortumbleson.com)
- Correcting "*anywhere*" - [#3](https://github.com/google/robotstxt/pull/3/files?ref=connortumbleson.com)
- Correcting "*terminated*" - [#7](https://github.com/google/robotstxt/pull/7/files?ref=connortumbleson.com)
- Correcting "*initialized*" - [#8](https://github.com/google/robotstxt/pull/8/files?ref=connortumbleson.com)
- Correcting "*against*" - [#10](https://github.com/google/robotstxt/pull/10/files?ref=connortumbleson.com)
- Correcting "*outside*" - [#12](https://github.com/google/robotstxt/pull/12/files?ref=connortumbleson.com)
- Correcting "*utf-8*" - [#14](https://github.com/google/robotstxt/pull/14/files?ref=connortumbleson.com)
For me, it is slightly upsetting for a code-base to go public and the only thing people want to do is correct grammar in comments. They may genuinely care about the grammar quality of the code-base, but more than likely it was a script or auto-correcting plugin of the browser. I'm assuming the urge for simple spelling fixes is to forever mark the code change in the history of time with that author's mark.
Outside of the spelling fixes, there is a unique function in the Google that is responsible for looking for the word "Disallow" in the *robots.txt* files. Google commonly saw people worldwide misspell that, so they introduced this function.
[KeyIsDisallow](https://github.com/google/robotstxt/blob/master/robots.cc?ref=connortumbleson.com#L691)
This basically allows you to misspell the word in your *robots.txt* file and Google will still understand. It looks like common typos along with some regional spellings of the word.
While logic like this is pretty fast to run, I noticed a new pull-request to the project in the first 24 hours it was open sourced. They wanted to change this function to this:
[Adding more possible iterations of "disallow"](https://github.com/google/robotstxt/pull/11?ref=connortumbleson.com)
Which basically adds every iteration of the misspelling of the word. This much overkill for a parser that needs to be fast is just too much. Not to mention if you spell "disallow" wrong like "dissallov" do you deserve for Google to understand what you meant?
This is just one example of a recently open sourced project, but I enjoy reading them every time they come around.
### Pi-hole: 19 months later
URL: https://connortumbleson.com/2019/07/01/pi-hole/
Last updated: 2025-02-04T11:43:49.000Z
Pi-hole "Chronometer" feature
In mid 2017 I installed Pi-hole into my network on a Raspberry Pi and routed all my internet traffic through it. Today is now June 30, 2019 and I've been running it the entire time. Since this is installed directly in front of my router, all devices on my network including phones, cameras, laptops, game consoles and all benefit from the software.
A lot of features have been added since my last post, so we will briefly cover them:
- [**4.0** \- FTLDNS - Basically a forked dnsmasq with changes.](https://pi-hole.net/2018/08/06/pi-hole-v4-0-released-with-ftldns-improved-blocking-modes-regex-docker-and-more/?ref=connortumbleson.com)
- [**4.1** \- Cache & Server information](https://pi-hole.net/2018/12/03/pi-hole-v4-1-is-now-available/?ref=connortumbleson.com)
- [**4.2** \- Blocking modes & Shared Memory](https://pi-hole.net/2019/02/03/pi-hole-v4-2-available-with-shared-memory-new-blocking-modes-and-more/?ref=connortumbleson.com)
- [**4.3** \- Network Information table](https://pi-hole.net/2019/05/18/pi-hole-4-3-now-available/?ref=connortumbleson.com)
Screenshot from my Pi-hole on 6/30/2019
If we take a look at my dashboard above, we see a few things:
- Sleeping & work keeps the graph relatively quiet
- Rebooting your router/modem/pi-hole is destructive
- Turning on your phone in the morning spikes the graph hard
What I'm more interested in is pulling the sqlite database file and doing some analytics. I have a `710.2 MB` file with the first request dated September 28, 2017 and last date being June 30, 2019\.
Eagle eyed readers will note my [previous blog](https://connortumbleson.com/2018/03/25/taking-a-look-at-9-months-of-pi-hole/) about these analytics started earlier than September 28, 2017\. Unfortunately I didn't realize the database purged itself of records older than a year. It took me a few months to notice, so I lost the data from June to September in 2017.
Between these dates we find 579 days or 833,760 minutes. Between that time, we have recorded 9,760,005 requests. Some simple math puts that at 11.7 requests a minute. So wow - my home network is busy.
First off, I want to figure out what domains my systems hit the most. With 19 months of data, we are bound to find a good list of frequently hit domains. So here are the top 13 requested domains.
| Domain | Count (allowed) |
| ----------------------------- | --------------- |
| localhost | 1,587,626 |
| b.canaryis.com | 675,921 |
| clients4.google.com | 350,605 |
| play.google.com | 308,702 |
| i.canaryis.com | 181,002 |
| ssl.gstatic.com | 179,409 |
| clients6.google.com | 123,544 |
| wpad.local | 105,164 |
| api-global.netflix.com | 103,379 |
| www.googleapis.com | 87,924 |
| safebrowsing.googleapis.com | 82,977 |
| clientservices.googleapis.com | 78,155 |
| beacons.gcp.gvt2.com | 70,674 |
There are some things to talk about with this list. First off, why do I have 1.5 million requests for localhost? Easy. All the Laravel projects I work for development listen on localhost. I guess I program - a lot.
Next up is the combined almost 1 million requests for [Canary](https://canary.is/?ref=connortumbleson.com), which is my security/home-health system. Not sure why it needs that many, but I'll dig into that later.
Finally, we have "wpad.local" & "beacons.gcp.gvt2.com". What are those? The first seems to be the "Web Proxy Auto-Discovery Protocol" of Windows 10\. I'm a bit alarmed, because the Internet has click-bait titles like - "*[Disable WPAD now or have your accounts and private data compromised](https://www.pcworld.com/article/3105998/disable-wpad-now-or-have-your-accounts-and-private-data-compromised.html?ref=connortumbleson.com)*". However, it seems okay with a bit of an investigation.
Next up is the beacons domain, which seems to be owned by Google and related to Chrome updates. I do run Chrome, normally 10-20 tabs open on every computer. Perhaps this is related, but otherwise the list of domains is pretty consistent with my internet usage.
Below is the query I used in sqlite to generate the above list.
```
SELECT DOMAIN, count(DOMAIN)
FROM queries
WHERE (STATUS == 2 OR STATUS == 3)
GROUP BY DOMAIN
ORDER BY count(DOMAIN) DESC
LIMIT 15
```
Query to obtain top 15 (most requested) allowed domains
Moving on though, we are more interested in what the Pi-hole has actually blocked.
| Domain | Count (blocked) |
| ------------------------------- | --------------- |
| ssl.google-analytics.com | 307,864 |
| watson.telemetry.microsoft.com | 253,549 |
| graph.accountkit.com | 151,263 |
| e.crashlytics.com | 120,996 |
| settings-win.data.microsoft.com | 109,639 |
| secure-dcr.imrworldwide.com | 78,896 |
| reports.crashlytics.com | 64,326 |
| analytics.localytics.com | 57,114 |
| wpad.local | 56,538 |
| graph.instagram.com | 54,875 |
| api.mixpanel.com | 47,647 |
| mobile.pipe.aria.microsoft.com | 47,045 |
| app-measurement.com | 44,163 |
So what is interesting is "*wpad.local*" is both a blocked and allowed domain. Did it become blocked later on? Did it become unblocked? I queried my system and it indeed was not blocked.
> *\[i\] No exact results found for wpad.local within the block lists*
So perhaps the blocking was too aggressive and blocking a legitimate feature so it became unblocked.
A strange domain that I didn't recognize was - "*secure-dcr.imrworldwide.com*" and a quick Google search shows that the domain is owned by Nielsen who tracked TV habits. However, it seems to be connected to the ESPN Android application used for Fantasy leagues. Since I'm in between seasons - I uninstalled it. It thankfully is being blocked, but I don't need an application sending almost 100,000 requests to some analytical database.
Below is the query I used to generate the above list.
```
SELECT DOMAIN, count(DOMAIN)
FROM queries
WHERE (STATUS == 1
OR STATUS == 4
OR STATUS == 5
OR STATUS == 6
OR STATUS == 7
OR STATUS = 8)
GROUP BY DOMAIN
ORDER BY count(DOMAIN) DESC
LIMIT 15
```
Query to obtain top 15 (most requested) blocked domains
Pi-hole is an interesting piece of software, so I tossed them a donation for blocking 1,339,468 requests for me. The features keep getting better, so I'll do another post in a year or so with even more analytics.
Running live query log (June 30, 2019)
### The Internet Never Forgets
URL: https://connortumbleson.com/2019/06/24/the-internet-never-forgets/
Last updated: 2025-02-04T11:43:49.000Z
Photo by [Valentin Lacoste](https://unsplash.com/@valentinlacoste?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
While bored one day, I decided to Google myself in quotes like - "*Connor Tumbleson*" and continue to click/view every link that I did not understand. Page after page continued to find results I was not happy with indexed for anyone else to find.
I spend my fair share of time on the Internet releasing more content under my name that is indexed. Whether that is blogs like this one or some social network public content. However, I'm more interested in the content that I have next to no control over. So this post we will take about those random links I discovered.
**Athletic.com**
*Track and field stats from High School, digitally recorded.*
- Pro: My track history forever recorded
- Con: My high school exact years for each grade recorded
- Con: I've been out of school for 10+ years. Why is this still online?
**Whitepages.com**
*The classic white pages digitized instead of the bulky phone book.*
- Con: My full name, phone, address for the world to see
- Con: My home history from 13\~ to now (27)
- Con: Relatives & Family connections
**kansas\[redacted\]bonzi.com**
*Team website from an old competitive soccer team*
- Pro: During the time - cool to have
- Con: Full name, birthday and address
- Con: Lots of [Knowledge Based information](https://connortumbleson.com/2018/08/13/the-slow-death-of-passwords/)
**spokeo.com**
P*ublic information aggregation in a creepy manner*
- Con: Full name, age, address
- Con: Contact information
- Con: Location history
- Con: Social profiles
- Con: Court/government records
What I found interesting is that some of the discovered content was entirely a PDF document. Uploaded and stored on some service, probably not intended to be indexed. However, the web has evolved both with the robots that automatically scan it and the technology that can parse text from a PDF.
I even found a tweet from someone I've never met that said - "*Connor Tumbleson is on my plane.*" Creepy, but indexed.
I searched a bit using my history of online aliases and the problem was just as bad. Thankfully there is no easy connection online to connect my long history of usernames, but someone given enough time and energy could probably unearth them. This would bring up some interesting IRC channel communication that for some reason was logged and indexed to the web.
I then switched to social networks and began digging, this time behind the authentication wall of them. Thankfully "yfrog" no longer exists as 50 of my tweets from 2011 included media (from them) that is no longer available. I'm sure some part of the Internet archived that, but I appreciate broken content in this case.
Facebook was full of photos (both in my control and not) that included me in a not preferred forever frozen snippet of time. My only option was to remove the tag on myself, but that photo still exists in the account that holds it. Less easy to find, but with the improvements in automatic face detection - it isn't long till scrapers can automatically find photos of me.
This was 30 minutes of research of indexed content of a nobody. What else exists in the not index-able section of the web? I'm not sure, but as technology enhances and database get larger - the indexed content of individuals will continue to grow.
### Learning Blood Types
URL: https://connortumbleson.com/2019/06/17/learning-blood-types/
Last updated: 2025-02-04T11:43:49.000Z
Photo by [Hush Naidoo](https://unsplash.com/@hush52?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As part of my [recent surgery](https://connortumbleson.com/2019/04/14/double-lumbar-microdisketomy/), it was the first time I had my personal information entered into a digital hospital system available to view at my leisure. Part of that was my blood type and it was the first time I could confidently say I knew my blood.
The world most commonly uses the ABO Blood Group system, which wasn't coined or discovered until 1901 by Karl Landsteiner. However, there are a few others less popular notations for blood from the [MNS System](https://www.ncbi.nlm.nih.gov/books/NBK2274/?ref=connortumbleson.com), [Kell System](https://www.ncbi.nlm.nih.gov/books/NBK2270/?ref=connortumbleson.com) and [Lewis System ](https://www.britannica.com/science/Lewis-blood-group-system?ref=connortumbleson.com)for blood grouping.
These creates the ABO blood types of
- O
- A
- B
- AB
In addition to the letters, a positive or negative is attached based on the Rh factor of the blood type. This correlates to the Rh antigen and is quite simple. If the red cells have the antigen - it is Rh-positive. This produces a larger list of types:
- O- / O+
- A- / A+
- B- / B-
- AB- / AB+
So take a child with two parents and you can come up with the following blood types, which can even be broken with very rare situations.
| Blood Type | O | A | B | AB |
| ---------- | ---- | ----------- | ----------- | -------- |
| O | O | O, A | O, B | A, B |
| A | O, A | O, A | O, A, B, AB | A, B, AB |
| B | O, B | O, A, B, AB | O, B | A, B, AB |
| AB | A, B | A, B, AB | A, B, AB | A, B, AB |
So taking a deeper dive into these types results in:
- A - Antigen A in Red, Antibody B in Plasma
- B - Antigen B in Red, Antibody A in Plasma
- AB - Antigen A & B in Red, No Antibody in Plasma
- O - No Antigen in in Red, Antibody A & B in Plasma
So from that information. There are two interesting types:
- Type O Negative - Universal Red Cell donor
- Type AB - Universal plasma donor
To build a true donation of giving/receiving would be too much work for this blog, so instead an image provided by [HÉMA-QUÉBEC](https://www.hema-quebec.qc.ca/sang/savoir-plus/groupes-sanguins.en.html?ref=connortumbleson.com)
So as you can see. AB+ can receive from all and O- can give to all. So with that, let's examine the average rareness of the types. \[[source](https://www.healthline.com/health/rarest-blood-type?ref=connortumbleson.com#rarest-type)\]
- O Positive (37.4%)
- A Positive (35.7%)
- B Positive (8.5%)
- O Negative (6.6%)
- A Negative (6.3%)
- AB Positive (3.4%)
- B Negative (1.5%)
- AB Negative (.6%)
With that list however, it changes rapidly from race to region. For example, India's most common blood type is B Positive. This all comes into play when you need a blood transfusion.
Thanks to [RedCross](https://www.redcrossblood.org/donate-blood/blood-types.html?ref=connortumbleson.com) for most of the research material - **I am O Negative, a universal donor.**
### Safeness in Familiarity
URL: https://connortumbleson.com/2019/06/10/uncomfortable-situations/
Last updated: 2025-02-04T11:43:49.000Z
Photo by [T L](https://unsplash.com/@onelast?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
My first day of college was quite possibly one of the most nerve-racking days of my life. I had already walked the campus multiple times prior to that day so I knew where all the buildings were. However, just knowing the buildings was half the battle. Just walking into a building on my first day ever with shuffling students would make my heart race.
There was nothing to be nervous about, but I was scared with simple things as opening a door to a classroom because I didn't know if the class prior had been dismissed or not. Finding a place to sit was even more stressful, sometimes there were no seats available at the ends so I had to push my way through rows in front of kids much older than me.
As days became months - this never was an issue ever again. I remember my last semester of school I stumbled into the first day of class without any supplies. I was going to buy them after my first break in the day.
This nervousness extended to my first interview, first day at a post college job and the first time I went to a Meetup.
I started thinking about those situations and they were forced onto me and thus became less uncomfortable, but other activities that were optional have fallen by the wayside.
[Tampa Bay Young Professionals](https://www.meetup.com/YoungTampa/?ref=connortumbleson.com)
I attended the above group when I first moved to Tampa 3 years ago. I was 24 years old - on the beginning spectrum of the age of this group. I showed up at the location and I didn't know anyone there. I didn't know who was part of the group or who was a random visitor. In order to not look more awkward - I got a drink to hold in my hand and kept looking around.
One great individual noticed me and walked up and asked if I was here for the meetup. I said "yes" and he introduced me to a few people. It was very thoughtful, but I was an outlier to the group by age and familiarity. These people were talking to each-other and I was just standing there awkwardly. I drank my drink quickly just from wanting to look like I wasn't bored. I didn't have the social power to interject into the conversation with people I was standing around.
I went to the bar and closed out my tab and left without anyone (I think) noticing me. As of today (June 8, 2019) I've never been back to a Tampa Bay Young Professionals meetup. I attended other groups, more focused towards Android and PHP. The small attendee list and office space meant that everyone met everyone and generally forced me to get involved.
**I learned that I suck at doing things that make me uncomfortable.**
Which I think is a problem that probably many suffer from. I've gotten too comfortable in front of screens, which has led to some pitfalls in the real world. Tinder/Bumble matches usually fade out, because it is too nerve racking to just plan a date.
Things were easier when you were forced to interact with people in school. Just seeing the same people 20-30 times a day really makes interactions easier.
So last week, unintentionally, I tried to end that nervousness. During an event in downtown Tampa someone walked up and gave me a flyer for a party later that night to celebrate a women's swim suit store opening up. It was on dock #2 and I could see it being setup at 4pm. So after my event ended, I got a few more drinks and wandered back towards the dock around 7pm.
As I got in range of the dock, I was greeted and told all about this company. I lied to the face of everyone explaining that my girlfriend was out of town, but she might be interested. Truth - there was no girlfriend, but all in all the party was interesting. I got one of the few standing tables to rest my drink so naturally other people came up to me. I was quite tipsy at that point anyway, so conversation flowed. No one was even talking about the business at that point, but just random topics.
I broke over a mound of uncertainty, but I think I owe the alcohol for that certain success.
### Apktool in the Wild
URL: https://connortumbleson.com/2019/06/02/apktool-in-the-wild/
Last updated: 2025-02-04T11:43:50.000Z
Every so often I run into Apktool used in the public eye and the creativity or use-case is always very interesting. Seeing it used for automated translations, static analysis and a variety of mass analytical research when bulk examining applications.
However, this time I doubted what I found until I triple checked my work and then asked a friend to confirm and thus this blog post.
Before we get into it, we need to look into some history/context of an Apktool feature. If you were to dump the resources of an application (without Apktool). We would use a tool known as Android Asset Packaging Tool (AAPT), which is crucial to building applications but also has a few helper functions for viewing a compiled application.
I've done a post about [AAPT](https://connortumbleson.com/2018/02/18/taking-a-look-at-aapt2/) before, but this time we are only interested in dumping resources.
```
aapt d resources
....
spec resource 0x7f0d00a2 com.nianticproject.ingress:id/textview_track_name
spec resource 0x7f0d00a3 com.nianticproject.ingress:id/gridview
INVALID TYPE CONFIG FOR RESOURCE 0x7f0d00a4
spec resource 0x7f0d00a5 com.nianticproject.ingress:id/placeholder
```
So what we are interested in is the line about "INVALID TYPE CONFIG", which can mean a variety of things depending on the situation.
- No package identifier for resource number
- No known package when getting name from resource number
- No type identifier when getting name from resource number
- Bad identifier when getting name from resource number
- No packages found from resource
- Bad index for the resource
So basically, unless you understand and debug the low level of Android build tools - you probably don't know why a single resource experiences this behavior. However, we can't just remove this resource because then if we rebuild the application without constant resource identifiers - we might shift all resources by however many ids we remove.
So reverse engineering tools (Like Apktool) that have to rebuild applications after disassembly need to do something with these bugged resources. So here is where Apktool comes in. It generates dummy resources so the resource table isn't malformed due to removing resources.
For the resource above, Apktool would generate something like this.
```
spec resource 0x7f0d00a4 com.nianticproject.ingress:id/APKTOOL_DUMMY_a4
```
Since we know the type information, we generate a resource in that same class (or in the case of the above resource - an ID.
```
[
new FlatButton(
child: const Text("Ok"),
onPressed: () {
Navigator.pop(context);
})
]);
showDialog(context: context, builder: (BuildContext context) => alert);
}
```
This is an example method in Flutter, using Dart. It is pretty easily to read due to strict nature of the language, but it basically shows a pop-up message with an "Ok" button to dismiss it. On the code side, syntax that might only be familiar from ES6 makes it appearance in Dart. It is simple and hardly an example of the larger picture, but a good example of the use of Dart.
## The Journey
This weekend is only the 3rd weekend of working on this Flutter project. I have lots to learn and to improve on, however I want to loop back to this as I learn more to provide insight to incoming searches if using Flutter is worth their time. So far my journey is better than any previous example of Iconic or React Native. I'm happy to see where it goes.
### Travel Blog: Boone, NC
URL: https://connortumbleson.com/2019/05/12/travel-blog-boone-nc/
Last updated: 2025-02-04T11:43:50.000Z
Airbnb [Cabin](https://www.airbnb.com/rooms/20848863?ref=connortumbleson.com) In The Woods
I've been to [New Orleans](https://connortumbleson.com/2019/02/24/travel-blog-nola/), [St Louis](https://connortumbleson.com/2018/05/20/travel-blog-st-louis/), [Austin](https://connortumbleson.com/2018/11/18/travel-blog-austin/) and [Aruba](https://connortumbleson.com/2018/06/10/travel-blog-aruba/) while blogging and this trip to Boone, North Carolina is no exception. A very early travel this time around with a 5am departure from Tampa arriving into Charlotte around 620am.
Still about 2 hours from a destination an early car rental with a Mitsubishi resolves that problem and I'm off towards Boone. I stop frequently in towns along the way, including Hickory and Blowing Rock to play Ingress and stretch my legs. It is only an 1hr 40min drive, but I have to remain active recovering from this back surgery. So random town stops serve two purposes - Ingress and health not to mention its still very early in the morning.
Boone is reached and I can immediately tell this is a college town, vibrant and active during the school year but probably a ghost town during the summer. Wikipedia put the [population in 2010 at 18k](https://en.wikipedia.org/wiki/Boone,%5FNorth%5FCarolina?ref=connortumbleson.com), but in 2018 Appalachian State put the amount of enrolled students at 19k. So basically, a majority of the seasonal population are students.
There are only a handful of major roads here and with graduation going on - means they are at a standstill. Other roads wind through mountains with steep inclines putting the average speed around 20-30mph. Despite getting my surroundings and slowing down more than I needed - no one honked at me. This is comparison to Tampa, where nearly anything can net you a honking driver.
## The Wilderness
Outside of the school and campus lies an infinite forest of trees and mountains as far as you can see. During my trip here I walked the Glen Burney Trail in Blowing Rock as well as climbing to the summit of Elk Knob State Park.
Panoramic from the top of Elk Knob
The trails were full of loose rock, steep inclines and pretty flooded due to the rainfall days prior. A great nature difference from the swamps and islands of Florida, since we just have tons of sand and bugs. I visited Elk Knob around 620pm, with the park closing at 745\. This meant I only saw one other family on the hike to the top, getting back to my car with minutes to spare before park close.
I'm not sure how busy these trails are usually, but it was a great experience to solo hike on a peaceful day.
## The City
There is no giant airport in Boone, which meant that after arriving in Charlotte, NC I still had a 2 hour drive in front of me. I'm just spoiled with Tampa's airport, since I live 10 minutes from an international airport. Perhaps this tiny town away from all major cities and airports leads itself to becoming a secluded little town.
However, despite the hidden away homes among the mountains. The non-existent cell coverage in most parts, I still was able to find Overwatch League on ABC.
Overwatch League 2019 Semifinals
With that, another trip is completed with experiencing more nature and great food. Congrats to the sister for graduating, which brought me to this city. Additionally, happy mothers day to the mothers, especially my own for getting a mothers day weekend with her daughter.
Till next travel blog.
### Raising Cain
URL: https://connortumbleson.com/2019/05/06/raising-cain/
Last updated: 2025-02-04T11:43:51.000Z
Photo by [Mitchell Orr](https://unsplash.com/@mitchorr?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Earlier this week, I woke up with nothing immediate on my plate to do, so I did some morning gaming before work. This was around 6am local and my first game unforunately had a "[thrower](https://connortumbleson.com/2018/03/04/comprehending-online-trolls/)". This is someone who actively works against winning in a team oriented game. I had another teammate who was livid against this individual saying things like - "I'm going to fucking kill you man, where do you live?"
It was just another day in online gaming, but this time the thrower responded with "Houston, TX", to which the screaming individual responded, "I live in Dallas, I'm fucking coming to kill you". They continued yelling back n forth getting more and more detailed with the time and place these two individuals would meet. It got so loud and obnoxious so early for me, that I muted chat and went along with the game. Ignoring the fact that two individuals might be meeting up to kill one another.
I feel I've become accustomed to just pure toxicity and anger. It wasn't even a day later and I saw a house cat jolt across the road, freeze in panic to turn around and get run over by a car. It was a gruesome sight and the white 4 door car just kept driving. Now, this could have been a genuine accident unavoidable, but this car had already commited a F in the grading scale of driving minutes earlier. This was the same car that accelerated in front of me, then swerved into my lane and hit the brakes hard solely to wait in line for this left hand turn.
So that asshole was not only a bad driver, but a cat killer.
Was the world always this toxic before I started paying attention? Am I part of the toxicity? Does anyone complain about my actions when I'm not aware?
Though, this post is labeled "Raising Cain" for the biblical times reference of raising/striking with pure anger. Too much of the world is too angry these days and I can't be the only one.
Even when I'm trying to do something good, like letting a car into my lane during stand still merges - the car behind me blares the horn. It is common courtesy, but to someone else I've just delayed them a few seconds which is of course deserving of a horn. It upsets me, it angers me and the cycle never ends.
The online world is full of toxicity and anger, and the offline world seems to be catching up with that.
### The Movie Experience
URL: https://connortumbleson.com/2019/04/29/the-movie-experience/
Last updated: 2025-02-04T11:43:52.000Z
Photo by [Jake Hills](https://unsplash.com/@jakehills?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Thursday of last week I attended Avengers: Endgame, it was the first time I've seen a movie in theaters in awhile and this post is about that adventure. No worries about any spoilers here - I'm not about that spoiler life.
The dawn of streaming services and watching movies from the comfort of your home have been growing. Not to mention the ease of piracy with things like Kodi and Plex able to organize and collect downloaded media. It makes watching a movie experience 10x easier than the early 2000s of burning illegal movies to a disc and playing them over a DVD player.
However, I didn't want that experience for a brand new movie due to the inevitable point of spoilers. I wanted to see this movie on the day it came out - so I did.
The movie experience in a theater as I've gotten older is just not worth it anymore, so here is my breakdown.
### The atmosphere
Walking into this theater was full of younger kids everywhere. In the lines, talking loudly in corners, walking in front and behind me. They were loud, they were disruptive. I just wanted to see a movie in peace.
Once I finally got into my individual theater. I sat with my phone, texting and such waiting until the movie finally started. Which due to the 3hr runtime of Endgame happened right at the movie start time instead of previews prior to the film.
Once the lights went out as the movie started, my phone went away. However, I could see little white light glares around the audience, this continued throughout the film and bothered me to no end. Why pay money to go see a movie on opening night if you are just going to look at your phone?
Next up was the dilemma of food/drink. I'm not a savage so I can see the merit for enjoying a drink or food during a film. However, there is a time and place for ripping opening a bag of skittles and/or messing with a loud bag of popcorn. It seemed during every quiet dialog scene the audience was amplified by someone ripping open some bag creating noise, and this wasn't someone 20 rows behind me. This was usually someone a row or two near me.
Finally in this atmosphere section was the people who can't help but talk during the film. Whether during a crucial moment to yell - "Don't do that!" or whispering to their friend next to them. Just please, shut up. This is a shared environment with hundreds of people and the safest appropriate option is to simply not to talk.
### The film
Now this section is entirely moot, as this was my mistake. When I first was purchasing a ticket - the movie theatre option has grown like crazy. Years ago it was two options - IMAX/Regular. Now on my list was Dolby, 70mm, IMAX, Regular and more.
It seems some options included a server staff to bring food/drink during the film and I'll probably never do that. I don't need further distractions.
As for the Dolby vs regular is where my mistake was made. I paid $11 for a ticket to the regular film and the Dolby film carried a massive $20 something dollar fee. My guess is if I pay the extra all my complaints about the atmosphere of the film will go away.
The $11 for a regular film was the inflated price of $6 I paid in high school. It is abused by younger kids, but I doubt anyone is in the Dolby theater messing around at a steep $20+ a ticket.
### The end
Not many movies push me to the theaters, but the next one that does - I'll give Dolby a shot.
### Fallen Shopping Carts
URL: https://connortumbleson.com/2019/04/22/fallen-shopping-carts/
Last updated: 2025-02-04T11:43:52.000Z
Photo by [Markus Spiske](https://unsplash.com/@markusspiske?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
With a grocery store nearby, I can walk to and from the store. I'm of course bound with the items I can physically carry, but this led to an interesting discovery.
Why are there so many abandoned carts? I'm not talking about a cart left on a sidewalk, but carts hidden in bushes, thrown in the water and/or broken beyond belief. These aren't carts hidden within visibility of the grocery store, but carts minutes away on trails and sidewalks.
> The Food Marketing Institute reports that nearly 2 million shopping carts are stolen each year, translating into a per-store loss of $8,000 to $10,000 annually — and that’s only in the food industry.
> [FMI](https://www.fmi.org/our-research/supermarket-facts?ref=connortumbleson.com)
It seems this is a problem that plagues grocery stores worldwide and perhaps just a nature of the beast, that is the human population. We steal, break and destroy and that translates to every avenue of society, including grocery stores.
A cart found on the walk home, Publix Citrus Park, FL
So the above photo is one of the carts I found thrown in the water on the bridge towards the way home. This cart cannot fall in by any natural force, due to huge railing on this bridge. Due to placement of the cart, it did not enter via the side of the water. So it was lifted and dropped into the water. Who did this and why?
You take a closer look and see a myriad of trash also in the river, so that explains that. Humans being humans. Why pollute the environment we all share? We not only share this environment with other humans, but a basically unlimited amount of organisms.
This reminds me of a series I just finished - Our Planet.
Throughout this series, a common denominator hinted by the narration for any destruction of habitat is: humans.
Frankly it makes sense. You don't have to wander far from anywhere you live to see the destruction we cause. It bothers me greatly, because I can't even walk 10 minutes to my grocery store without seeing fallen shopping carts everywhere.
### Double Lumbar Microdiscectomy
URL: https://connortumbleson.com/2019/04/14/double-lumbar-microdisketomy/
Last updated: 2025-02-04T11:43:52.000Z
Photo by [Piron Guillaume](https://unsplash.com/@gpiron?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As the title suggests, the surgery to heal my 7-8 month chronic back pain was a double lumbar microdiscectomy for the disc between my S1 & L5 and L5 & L4\. My [last post](https://connortumbleson.com/2019/04/07/the-price-of-healing/) talked about the entire journey until I walked into the hospital, and this post will conclude that story.
Spoiler alert - I survived and on day 8 since the surgery. For this post though, we are going to rewind the clock to 6:50am on Friday morning - April 5, 2019\. Dropped off by the parents as they figure out a place to park, I walk in and asked to confirm a variety of information in admissions of the hospital. I'm wearing my pajamas as recommended and feeling pretty relaxed.
I'm asked to take the elevator to the 2nd floor and off I go. I'm greeted and assigned a bed and asked to change into a classic hospital gown as basic health heart rate, weight, blood pressure, etc is taken. A resting heart rate of 58 showed I was quite calm.
April 5, 2019 - 7ish am - Pre Surgery
Contacts out, head shaved and ready for the surgery. However, it isn't scheduled for another 2 hours. A nurse comes in, once again confirming information, but instead connecting my gown to some hot air cannon. This machine keeps pumping hot air around my body, warming me up (I presume for some surgical reason).
Employee after employee visit, including my surgeon double checking all avenues of the upcoming surgery. Around 8:30am, the anesthesiologist gives me an injection before we start traveling to the operating room. At this point, I'm starting to lose consciousness and only remember a cold room with a bunch of huge TVs around.
From this point, all information is from other parties repeated back to me post-surgery.
I went into surgery late, by about 40 minutes according to the text message my family received of "surgery starting". The surgeon mentioned a 3 hour estimate of the surgery, so my family got cryptic text messages about every hour saying - "*The procedure is going as planned.*"
That was until a nurse came into the waiting room asking for my family members, which is never a good sign. A phone was passed to them, with the surgeon on the phone. He mentioned that my first discectomy (S1-L5) went successfully, but the (L5-L4) was worse than the MRI showed. As the disc was cut and removed, my body continued to shove more herniated contents out. Additionally, he had spotted a splash of spinal fluid and thus a leak had occurred. This would increase the duration of the surgery, due to a slice of fat needing to be cut and then glued onto the location of the leak.
We clicked into the 4th hour, myself completely knocked out and unaware of any of this. With the family in the waiting room, probably googling whatever a "spinal fluid leak" means. Though the light at the end of the tunnel came, when the message around 1:20pm local time said I was in recovery.
## Waking Up
While barely remembering this, I woke around 1:44 local in the recovery room without my phone barely awake. I dozed in and out of consciousness as a family member asked me how I was doing. Apparently I responded - "Things went well, except for the alien that broke out of my chest". So it was good to hear that I was being myself, despite not remember it.
It took until about 4pm until I awoke for real in recovery. After a few questions, it was time to move me to my room. It was explained that due to the delay and spinal fluid leak, I would be forced to stay a night at the hospital in order to monitor for complications.
So it seems in the 2-5/100 people, I was one of those affected.
Once I arrived in my hospital room, sharing with another individual (who seemed quite old and sick). I got access to my phone and my first messages were out at 4:44pm local.
4:40pm\~ April 5, 2019 - Post Surgery
My 2nd obligatory selfie and I learned that I had to sit still on my back until 7:30pm local. That proved to be very annoying and difficult to do, as my entire back and body ached. The nurse asked my pain between 1-10 and I said 3\. There was some pain, but it wasn't anything that truly bothered me.
I started moving my toes and feet, angling them in ways that used to hurt massively. This time, there was no pain - at all. It was instant, the surgery must have succeeded. I only had to recover. Excellent staff and nurses and a long overnight stay of no sleep in the hospital was day 1.
The wheelchair pushed me out the next day and here I sit on day 8 of the recovery. Mixing between Netflix and walks around my apartment complex. I'm feeling pretty good, with a small 4 inch stitched incision on my back.
### The price of healing
URL: https://connortumbleson.com/2019/04/07/the-price-of-healing/
Last updated: 2025-02-04T11:43:52.000Z
Photo by [Martin Brosy](https://unsplash.com/@cinestock?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
If you are an avid reader of my weekly blogs, this post is probably just another discussion of the medical industry. I first blogged about the [injury](https://connortumbleson.com/2018/10/07/the-most-important-system/), then the months of [working through system](https://connortumbleson.com/2019/01/06/healthcare-woes/) to arrive at the hospital where I completed my [pre-op](https://connortumbleson.com/2019/03/31/safety-in-protocol/). Now I'm writing about the journey to the surgery, with the caveat that I haven't had the operation at the time I'm writing this.
I've set this post to go live at 7:30pm eastern on Sunday April 7th, 2019\. I might tweak some things in this article post-surgery, but in case the worse happens - this post will go live with or without me.
### The Follow up Neurosurgeon
Months passed and I finally got a follow-up appointment with one of the best rated neurosurgeons in the Tampa area. My back pain was still with me and at this point, it had been 6-7 months since the accident.
> Most people improve in 6 weeks and return to normal activity. If symptoms continue, surgery may be recommended.
> [Mayfield Brain & Spain](https://mayfieldclinic.com/pe-hldisc.htm?ref=connortumbleson.com)
Something wasn't right and my back should have healed itself, so the neurosurgeon sent me to another MRI. As my previous one was too old to base a surgery on. Like my previous post, I animated the section of my MRI that looked the most abnormal.
MRI - Lower Spine
This time instead of waiting another few months for an appointment, I was given 4 business days to get an MRI and make it to my new appointment with that MRI and just that I did.
Thankfully my new appointment after my 2nd MRI did not require a copay, because all these appointments, physical training, doctors, etc had been adding up. I had almost reached my deductible until it clicked into 2019 :/
### The 2nd MRI Consultation
After doing the usual nurse questionnaire, I met with my neurosurgeon for the 3rd time with my 2nd MRI. Almost immediately the discussion moved to surgery as a younger adult back herniation should have resolved itself and I agreed. It is beyond annoying for 6-7 months unable to bend over, hold foot down on brake pedal while driving and a slew of other things.
I never realized how often I bent my back until I suffered doing basic tasks:
- Bending over to mail box
- Resting my body on a railing
- Emptying dishwasher
- Doing laundry
- Cleaning
So I sat with the doctor and he walked me through the surgery itself. Answering all my questions and let me go, telling me to await a phone call for the surgery date.
### The Call
The next day I received a call, the date was set - April 5\. So onward to the preop I went, then I counted down the days till now. Where I sit back at the hospital awaiting to drop my belongings (phone) and finally get a healed back.
The recovery might suck, but the end result is worth it. I'll be sure to take care of my back going forward. You don't realize how important it is until you lose the flexibility of it.
### Safety in Protocol
URL: https://connortumbleson.com/2019/04/01/safety-in-protocol/
Last updated: 2025-02-04T11:43:53.000Z
Photo by [Marcelo Leal](https://unsplash.com/@marceloleal80?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A couple of days ago I found myself in a "pre-op" or the shorthand for Pre-operative. Basically the area you go before the actually surgery and I learned a lot. I was given a bracelet during the check-in procedure, in which I had to visually confirm the information on it. It was then affixed to my arm and I was into my first room.
The first nurse who entered, covered up my arm and asked me to spell my first and last name, including providing my birthday. She was comparing it to the information I presume on my bracelet. This ensures that I am indeed the person on the bracelet. Probably preventing mistakes of people getting valid wristbands for the wrong person.
The next pair of medical staff who entered were part of the blood team. They did a similar procedure, albeit in a slightly different fashion. One lady woke the computer up and presumably looked up my record. As the other staff member covered my wristband, they asked me to read my name and date of birth aloud. As I read, both staff were checking my information against my band and the computer. As that finished, the staff read the numbers on my wristband as the other confirmed on the computer.
I thought that was it, but they switched positions and did it again. I re-confirmed my name and date of birth as they did the same procedure, but in different roles.
As I met with blood team, anesthesia and a case manager - this flow continued. A protocol in place to prevent mistakes and when done properly, does just that.
I started thinking about protocols, that have been burned into my memory. Basically patterns that become protocol.
- Looking both ways when crossing road.
- Seatbelt when entering car.
- Helmet when getting on bike.
Weak in comparison to the protocol in place in the medical industry, but it reminded me of things I have built.
I wrote[ internal public documentation](https://github.com/iBotPeaches/Apktool/blob/master/INTERNAL.md?ref=connortumbleson.com) for my open source project - Apktool. A protocol for steps to follow, so I don't mess up. Seeing this protocols in place throughout the world is interesting to me. Its basically documentation that is followed to prevent mistakes.
### A Boneheaded Mistake
URL: https://connortumbleson.com/2019/03/25/a-bone-headed-mistake/
Last updated: 2025-02-04T11:43:53.000Z
Photo by [Franck V.](https://unsplash.com/@franckinjapan?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
My back pain lately has not been in my favor. I've blogged about it when it [initially happened](https://connortumbleson.com/2018/10/07/the-most-important-system/), and then once [again](https://connortumbleson.com/2019/01/06/healthcare-woes/) a few months later when the pain had not subsided.
With nearly 6 months of chronic back pain, this weekend felt really good so I wanted to take advantage of it. So I went to a nature trail I had never visited and began the exploration. No 20lbs weight in my backpack this time, just a regular water bottle and some bug spray.
I attempted to make some photo-spheres and document the trails for future visitors.
[My photosphere](https://www.google.com/maps/contrib/112346535434889804882/place/ChIJf3ypvuPrwogRRw%5FKWwfdtio/@28.0130657,-82.6333894,3a,75y,156.47h,88.76t/data=!3m7!1e1!3m5!1sAF1QipPephji-A-FpPi1o5iyArjQSeTzeO0PnlfEuGPK!2e10!6shttps:%2F%2Flh5.googleusercontent.com%2Fp%2FAF1QipPephji-A-FpPi1o5iyArjQSeTzeO0PnlfEuGPK%3Dw365-h260-k-no-pi-0-ya203-ro0-fo100!7i9728!8i4206!4m6!1m5!8m4!1e2!2s112346535434889804882!3m1!1e1?ref=connortumbleson.com) \- March 23, 2019
Turns out, having a non-360 camera makes this difficult to produce. So I continued down the trail into the uncharted territories. This time stepping through mud, water, trees and more. I ran into something interesting - a rope tied from a branch in a tree.
I looked around and no one in sight, so I wanted to climb this rope. I knew my back was better than normal and with surgery near, probably never a better time to climb.
This is where the mistake began. I began climbing, interlocking my legs bringing me back to my memory of climbing ropes. As I neared the branch at the top, my back unforunately experienced a spasm. This meant my interlocked legs gave out, leaving just my hands on the rope. I could not hold myself with just my hands on a swinging rope, without my legs.
I began to slide down the rope and my hands were getting too hot - too fast. I let go of the rope and fell to the ground. It wasn't much of a fall, since I landed on my feet, but I immediately felt pain on my right hand. I looked down and it was like a friction burn had ripped the skin off my hand.
Things were not good and I knew my adventure was over. I turned around and began heading for my car. Googling everything I could regarding friction burns. Thankfully, none of my burns looked like anything major. Just a layer or two of skin burned off.
I was 45 minutes from home and my hand was burning, so I set my GPS to the nearest pharmacy and arrived at a CVS about 20 minutes after the incident. My right hand was bleeding pretty badly, but I picked up band-aides, hydrogen peroxide, Neosporin and a large water bottle.
Using my car hood outside a CVS as a cleaning zone. I dumped the water over my hand, burning even more. Clearing all the dust, dirt and junk that got over the wounds by leaving the nature zone.
I thought that was the worse pain of this incident, until I dumped the hydrogen peroxide over the wounds. This foamed on every cut burning so much that I could tell random bystanders wandering into CVS were curious what I was doing.
At this point, I carefully placed Neosporin on band-aides and began placing them all around my hand. This hurt even more, but once the wounds were guarded from open air - the pain subsided. However, each wound still felt like they had their own heartbeat.
The next morning came, the same morning I sit here writing this post. I re-dressed all the wounds when I awoke and the healing one day later looks majorly better.
This incident led me down some interesting rabbit holes of research.
- Hydrogen peroxide kills bacteria and good cells. It is not recommend anymore vs just water and a mild soap.
- Keeping a cut covered heals quicker than allowing it to dry and scab over.
- Don't do stupid things
With that story, don't do dumb things or you pay the price. No photos to see here, because they look pretty disgusting.
### Learning about the Refrigerator
URL: https://connortumbleson.com/2019/03/17/learning-about-the-refridregator/
Last updated: 2025-02-04T11:43:53.000Z
Photo by [Dev](https://unsplash.com/@dev%5Firl?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A unique story we have here, regarding myself and a refrigerator. It started when I unknowingly forget to completely close my freezer. Not sure how it happened, but somehow my bag of flour got caught on the door, thus couldn't close completely.
A few hours pass in the day and I realize this, and then completely close the freezer door. I wish my story would have ended here, but it did not.
Days pass and my freezer becomes louder and louder, a large fan noise and I notice ice building up around the walls. This is strange, because I've never noticed ice inside my freezer. I turn my freezer down to the lowest setting and this helps, the freezer is less quiet. However, this fix is only temporary - the noise comes back and even louder this time.
At this point, I know I've messed up so I file a maintenance request knowing that I am no handy man. However, this isn't an emergency and it will take a few days so I decide to unplug my fridge and pull it from the wall.
First off, previous tenants of this apartment must have dropped some glass bottle behind the fridge. There was glass everywhere and took me a good bit of time just to clean that up. So now my fridge is off and I begin cleaning my freezer, prying off the mess of ice. I was following some blurry YouTube video teaching me how to use a hairdryer / heat gun to melt the freezer.
This was a slow process of about 2 hours of work, meanwhile all my perishables living without cooling. I finally plug in my fridge and its silent, I finally succeeded.
Or so I thought.
I get home from work and walk into my apartment and step into a puddle of water. It is a nightmare, standing water in my entire kitchen.
I begin googling things, learning about how a fridge has no moving parts. The real moving parts occur in the freezer and deep below, where an evaporation coil exists to evaporate extra water. As I slide my fridge out into the center of my kitchen, every slide is dropping more water into my kitchen.
I immediately unplug it and began cleaning up the water, but it keeps dripping. So I locate some screwdrivers and take the back panel off my fridge. Once there, I find a huge pan full of standing water. This water looks disgusting, probably the same water since the beginning of life for this appliance.
I use a shot glass to move water out of the pan into a bowl, then empty the bowl. This is a useless process. So I try again with paper towels which is another useless process. So this time I tip my fridge and this just dumps a stream of water on the floor. I have another large mess to clean up, but now the pan under my fridge is empty.
I clean up the mess, plug in my fridge and take a shower. I come back to the kitchen and its silent. The freezer has no trace of ice on the walls so I go to work and come home and my freezer is silent again. I successfully fixed my fridge from a bone-headed mistake I made on my own.
### The Digital War
URL: https://connortumbleson.com/2019/03/10/alone/
Last updated: 2025-02-04T11:43:53.000Z
Photo by [Joshua Aragon](https://unsplash.com/@goshua13?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
It seems every few days the news is filled with some tidbit of news about some systems online being hacked. Most of the time, hacking is the wrong word used. Most of the mistakes resulting in loss of data was just a configuration error on the entity responsible for the data.
Take for example this email I got from [HaveIBeenPwned ](https://haveibeenpwned.com/?ref=connortumbleson.com)a few days ago.
> In February 2019, the email address validation service [verifications.io suffered a data breach](https://securitydiscovery.com/800-million-emails-leaked-online-by-email-verification-service?ref=connortumbleson.com). Discovered by [Bob Diachenko](https://twitter.com/mayhemdayone?ref=connortumbleson.com) and [Vinny Troia](https://twitter.com/vinnytroia?ref=connortumbleson.com), the breach was due to the data being stored in a MongoDB instance left publicly facing without a password and resulted in 763 million unique email addresses being exposed.
I don't know this company, I don't remember them but they lost my personal information along with 763 million other people. They made a mistake that seems like a day zero student of the computer science industry would make. I wouldn't expect a company to make mistakes of this size, but time and time it happens again.
### Default Security
I remember an article a few years old about the [default security in Redis](http://antirez.com/news/96?ref=connortumbleson.com). The article basically was in response to lashback in the community about default Redis installs lacking any default security. The response was that early adoption would be difficult if users had to create ACL rules or perform some complicated procedure of granting access.
What happened in actuality is users worldwide would move Redis installs into production environments without changing any security settings. This means data is just sitting out there in public environments. As Redis evolved, later versions continued to change the default settings to be secure first. This meant that users had to intentionally change settings to get things less protected.
Yet data is still lost and its due to configuration issues. So why is this happening? Is this because security is set aside? I remember getting into a difficulty with the occasional complicated mess of security groups on AWS, but never in my mind did a thought occur to open everything to everywhere.
AWS has additionally evolved setting default protections on a S3 bucket to be private. This means that accidents can not happen unless an administrator wants a public bucket.
### Finding a comparison
Most of those above paragraphs are difficult to understand unless you work in this industry, so let's take a different approach. How many people had a house key under a doormat? This was so that anyone coming home could use the key to unlock the door.
I had one of those, except it was under a pot. At one point, our thinking finally evolved and instead we produced enough house keys for everyone to have one. The key under the doormat is a good example of what is happening now. If everyone in the world had good intentions, everyone could leave their doors unlocked. However, that is not the case and thus servers left in the default (key under mat) will be targeted.
Data is being leaked faster than I can sign up with and this just makes me nervous. My entity history of KBA (Knowledge based authentication) is public at this point. With enough time someone can figure out every bit of information about me, because multiple companies made a mistake and lost my data.
The online war goes on and we are simply casualties in the never ending battle.
### Apktool v2.4.0 Released
URL: https://connortumbleson.com/2019/03/03/apktool-v2-4-0-released/
Last updated: 2025-02-04T11:43:54.000Z
Apktool v2.4.0 has been released! This is a overdue patch release, featuring fixes from all around the tool.
Last release (2.3.4) promised official support for select Android devices. I went back on this decision and turned down the merge request to bring in official Android support for Apktool. It's no secret that my AOSP knowledge (especially C++) is not good, this means taking a feature and making sure it survives is more of a challenge for me. Pairing this with the difficult and ever evolving feature of running binaries on Android, led me to ultimately turning down this feature.
On the front of aapt, we have an exciting announcement that Apktool is now fully tested on each commit on all three major operating systems - (Unix, Windows and Mac). Since we bundle aapt and appt2 in the Apktool binary, we need to ensure that those binaries work. We've unforunately regressed in Windows multiple times throughout the history of this tool and this change will hopefully prevent that from happening going forward.
This release was primarily produced by members of the open source community and I can't thank them enough. The [logistical nightmare](https://connortumbleson.com/2017/05/01/the-human-behind-the-keyboard/) of open source projects leaves a never ending list of things to do. So when members of the community discover an issue and put forward a fix just puts a smile on my face.
**This release was incremented to a new minor version (4) due to the requirement of Java 8\.**
This release had 69 commits by 6 people.
- Connor Tumbleson (iBotPeaches) - 49 commits
- Igor Eisberg - 15 commits
- Vincent Barthelemy - 2 commits
- Frieder Blumle - 1 commit
- Sebastian Rasmussen - 1 commit
- a-bahmani - 1 commit
# Changes since 2.3.4
- \[[#1893](https://github.com/iBotPeaches/Apktool/issues/1893?ref=connortumbleson.com)\] Updated baksmali/smali to v2.2.6
- \[[#1918](https://github.com/iBotPeaches/Apktool/issues/1918?ref=connortumbleson.com)\] Fixed issue with new restriction with non-empty `ids.xml` file. (Thanks gino247)
- \[[#1909](https://github.com/iBotPeaches/Apktool/issues/1909?ref=connortumbleson.com)\] Fixed issue with `PlatformBuildVersion` properties changing to unexpected values. (Thanks gino247)
- \[[#1943](https://github.com/iBotPeaches/Apktool/pull/1943?ref=connortumbleson.com)\] Fixed issue with pending v5 Gradle upgrade, by taking point release v4.10.2\. (Thanks Frieder Blumle)
- \[[#1849](https://github.com/iBotPeaches/Apktool/pull/1849?ref=connortumbleson.com)\] Added `no-crunch` support via new parameters - `-nc | --no-crunch`. (Thanks Novex)
- \[[#1975](https://github.com/iBotPeaches/Apktool/issues/1975?ref=connortumbleson.com)\] Added automatic tests on Windows environment.
- \[[#1952](https://github.com/iBotPeaches/Apktool/issues/1952?ref=connortumbleson.com)\] Fixed issue when decoding `.xsd` files between aapt1/aapt2\.
- \[[#1976](https://github.com/iBotPeaches/Apktool/issues/1976?ref=connortumbleson.com)\] Fixed issue with decoding applications with a malformed chunk header. (Thanks sebras)
- \[[#1996](https://github.com/iBotPeaches/Apktool/issues/1996?ref=connortumbleson.com)\] Fixed issue with Mac scripts stealing focus.
- \[[#1994](https://github.com/iBotPeaches/Apktool/issues/1994?ref=connortumbleson.com), [#1922](https://github.com/iBotPeaches/Apktool/issues/1922?ref=connortumbleson.com)\] Fixed issue with `array` resource bag items having wrong type. (Thanks vbarthel-fr)
- \[[#1522](https://github.com/iBotPeaches/Apktool/issues/1522?ref=connortumbleson.com)\] Fixed issue with 9patch images missing vertical or horizontal divs. (Thanks IgorEisberg)
- Fixed issue with resolving references to non-standard framework files. (Thanks IgorEisberg)
- Fixed issue with resolving SDK Version Codes that were references. (Thanks IgorEisberg)
- Added 32bit binaries for `unix` and `win` for aapt1/aapt2.
- Added ability for `api-level` to be passed to smali. (Thanks IgorEisberg)
## Notes
- Applications are becoming more and more difficult to build with aapt1, using the `--use-aapt2` flag during rebuild is a good test.
## Download
- [Apktool 2.4.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.4.0.jar?ref=connortumbleson.com)
- md5 `327b9389153ea29509963878e69012e4`
- sha256 `a0f116e8916d6f21160e1559847bb8b8c32ee71900f321cafeadbe37b87ebcc1`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Travel Blog: NOLA
URL: https://connortumbleson.com/2019/02/24/travel-blog-nola/
Last updated: 2025-02-04T11:43:54.000Z
Like most of my travel posts, the idea of how to structure these posts is pretty unknown. I sit here in the airport writing this hungover beyond belief with barely enough energy to type. This time I found myself in New Orleans, Louisiana the week prior to the official Mardi Gras.
This mini three day vacation was of course for Ingress, but attempting to play Ingress in downtown New Orleans during parades is another story. The entire city shuts down and puts focus on the parades. Police department litters the streets preventing cars and people from crossing the path of the parade. The ground floor is shoulder to shoulder with a ground that you don't want to look at. You are at the source of the party and it's a mess.
In some areas of the route, high risers exist where those with funds to spend can stand above all. They can rain down beads from the safety of an enclosure while having a party of their own. Thankfully, my hotel was on the route of a parade and near a bar. So I could go from bar onward to parade as much as I wanted. The people of NOLA make the experience for you. I ran into people from Canada & Germany, as we exchanged stories while awaiting the next float.
There was no shortage of drugs being offered to me by individuals that didn't seem to stay in the shadows. Just a whisper in my ear if I wanted some molly or weed. It was a non-stop party in the streets, as float after float passed by.
Mardi Gras is slated as family friendly, but the amount of topless women I saw says otherwise. The kids I did see were just picking up every toy off the ground and once you look at the ground in NOLA, you don't want to remember it. The lesson I learned quickly is that once something touches the ground, it stays there. A mix of mud, vomit, urine and unknown liquids coat the ground.
[The Scorpion from Tiki Tolteca](https://tikitolteca.com/drink-menu/?ref=connortumbleson.com)
Outside of the parades, the alcoholic drinks were amazing. Hurricanes, scorpions and random other cocktails fueled the weekend making sleep difficult. Local food was amazing ranging from beautiful breakfast entries to basic Po Boy sandwiches.
The ability to buy drinks from any stand and consume it in the open is a big change from Florida where the alcohol has to stay in the bar. I kept buying drinks and just exploring the city following the parades.
Picking up a Daiquiri
New Orleans during Mardi Gras is an experience I'll never forget, but I learned a lot of things I'd do differently if I arrive in the city again.
### Ecosystem of Illegal Films
URL: https://connortumbleson.com/2019/02/17/ecosystem-of-illegal-films/
Last updated: 2025-02-04T11:43:54.000Z
Photo by [rawpixel](https://unsplash.com/@rawpixel?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Watching an illegally obtained film is probably something everyone has done accidentally or intentionally once in their lifetime. The battle of streaming services attempted to solve this problem by giving an avenue for users to legally obtain media. However, even today illegal downloads of media continue to be a populated source of the Internet Ecosystem.
While I could talk about the absolute mess of legal avenues, today I want to focus on the people/companies behind the illegal portion of the media industry, but how do you find these people?
Well the easy part is - these uploaders "brand" their content so users know where it came from. For example, I googled "*The Hills Have Eyes*" and wanted to download it illegally. In under 30 seconds I found this download:
- `The.Hills.Have.Eyes.2006.UNRATED.BrRip.600MB.YIFY.mkv`
So there is a lot to break down here. Basically we were giving the following information:
- Title - *(The Hills Have Eyes)*
- Year of release - *(2006)*
- Rating - *(Unrated)*
- Source - *(Blu-ray)*
- Filesize - *(600MB)*
- Uploader - *(YIFY)*
I was available to download it without any payment or account. Now I know from simple technical knowledge that Blu-ray is not that small. The discs for Blu-ray range from single-layer to quadruple-layer with each layer containing a possible 25GB. So while the movie may have started from a Blu-ray, the quality took a dive into order to release it to the world.
Like most of this ecosystem, discussing the format/source and encoding of films could be a blog post about itself. This time we are focusing on the uploader.
So who is **YIFY?** Are they a person or a corporation?
It doesn't take long to find a small snippet on Wikipedia.
> YIFY is a peer-to-peer release group known for distributing large numbers of movies as free downloads. YIFY releases were characterised through their HD video quality in a small file size, which attracted many downloaders. The official YIFY/YTS website was shut down by the MPAA in 2015, although one website imitating the YIFY/YTS brand still gains a significant amount of traffic. The name 'YIFY' is derived from the name of the website's founder, **Yif**tach Swer**y**.
> [Source - Wikipedia (US) - February 12, 2019](https://en.wikipedia.org/wiki/YIFY?ref=connortumbleson.com)
Reading up on this Yiftach Swery guy shows he is very technically inclined, as he learned tricks with the x264 video encoding codec to take HD movies into very small (400-800MB) file sizes. Unfortunately for him, his trade was infringing massively on copyright of big corporations across the world. This lead to his ultimate end, with a multi-million lawsuit against him.
How did he get his films? There was many more questions I had, so armed with YIFY. I went to the Internet to research as many uploaders as I could find. I quickly realized this search would take me months and hundreds of paragraphs to complete. There are popular uploaders everywhere so I set my eyes on the following:
- aXXo
- Ganool
- HRA v3
- YIFY
I started with a [Google trend report](https://trends.google.com/trends/explore?date=all&geo=US&q=ganool,axxo,yify,hra&ref=connortumbleson.com) over the past decade with the above uploaders.
Google Trend (Ganool, aXXo, YIFY & HRA) - 2004 - 2019
So it became apparent that "**aXXo**" was maybe a name of the past so I started there. This was an interesting uploader who popularized quick releases of DVDs into AVI files, including the same style of NFO files.
An NFO file from an "aXXo" download
> A download-tracking firm [BigChampagne](https://en.wikipedia.org/wiki/BigChampagne?ref=connortumbleson.com) found — in a sampling period in late 2008 — that almost 33.5% of all movie downloads were aXXo torrents.
> [Source - Wikipedia (US) - February 14, 2019](https://en.wikipedia.org/wiki/AXXo?ref=connortumbleson.com)
As the "whack a mole" continued with torrent sites, eyes would point towards "aXXo" who was an unknown individual holding 33% of the illegal download space. From what we do know, "aXXo" retired in a final statement to his followers.
> I can only say a big thank you for your appreciation mates, hope you all enjoy the darkside as much as you can My home is my beloved Darkside and as I've said so many times before on each of my torrents.... Be aware of bogus sites and lamers See ya
> [Source - DarkSideRG Forums ](https://web.archive.org/web/20100126025423/http://94.75.224.58/forums/index.php?showtopic=87576&st=60&p=1379803&#entry1379803)
So we encountered YIFY who got caught, aXXo who retired (allegedly), but the first thing in common with those two was torrents.
Torrents (without VPN or proxies) expose your IP address as it connects to computers around the world to upload/download content. This allowed ISPs to simply sit and wait and issue letters/warnings to customers. However, early 2000s torrents were the only effective method to exchange large content. Finding a place to "host" a 700MB file without chopping it up into 90 parts was difficult.
This led to file-sharing sites that skirted the rules and normally was hosted outside of the United States. This led to sites like RapidShare and MegaUpload that would also, like uploaders face the repercussions of legal entities.
**Ganool** unlike the previous uploaders seemed to be a group of people who hosted file upload links on a regular free Blogger website. The accessibility and ease of use for these links shot Ganool into the light, with the primary target looking to be India. This was of course until Blogger shut down the site and Mediafire deleted their account removing 2 years of illegal content with it.
"For those who are waiting..."
The battle of uploaders, upload sites, torrent takedowns and more continues forever. So we enter our final uploader known as "**HRA v3**" who is remains popular in 2019.
How does he evade the constant detection and takedown of law enforcement? He has his own site hosted on Cloudflare and hides behind an alias. Based on his comments, the individual looks to be quite young. With the following post about why an uploading site deleted his account.
> \[redacted\] permanently suspended my account. I sent an email to find out the reason. Even if I open a new account, this could happen all over again.
> Source - Redacted.
I'm not sure if the charade is for his followers, but I'm sure he knows why his accounts get deleted. His followers however, sometimes suffer from lack of common sense. I found the following post from a follower in response to his announcement.
> I purchased \[redacted\] services in ordered to download and watch programs I can't get on my Television. I use \[redacted.com\] to get the shows to download. Now you have suspended \[redacted.com\] from your site and I would like to get my money back and go another way to download programs. Unless you are going to reintall \[redacted.com\] as a host for downloads.
So this user basically sent a support request to the hosting service saying he is downloading content from a site.
**HRA v3** themselves seems to spend time on uploading TV shows with nearly 800 different uploads. The equipment and storage to upload this content must be large for what seems to be one individual. HRA v3 doesn't miss a beat, which keeps his community growing and illegal money flowing. He apologies when he has delays, because he is just human.
HRA v3 site announcement of delay
This ecosystem of uploaders seems to get more vast the longer I spent time researching it. I could blog about this for months without running out of content, since there are uploaders everywhere. Along with science to all the different encodings and we haven't even begun to discuss the sources of this media. So next week we might take a look into the sources of illegal media and trying to make sense of all the encodings.
### Attention Control
URL: https://connortumbleson.com/2019/02/11/attention-control/
Last updated: 2025-02-04T11:43:55.000Z
Photo by [Stefan Cosma](https://unsplash.com/@stefanbc?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I found myself browsing Netflix to find something to watch and Netflix in 2019 is not the same as Netflix a few years ago. Instead of broad categories of years past each grouping of movies says - "*Because you watched {movie}, you will like...*". The system is slowly learning what movies I like and puts those forward so I continue to stay on the platform.
The goal being that I continue to find content to watch, ergo I continue to spend money, ergo Netflix makes money.
I've written about this plenty of times. I talked about how everything [instantaneous is preferred](https://connortumbleson.com/2018/08/19/instant-is-preferred/), how services are [removing chronological updates](https://connortumbleson.com/2018/05/27/the-death-of-chronological-order/) and how we are [depending massively](https://connortumbleson.com/2018/04/08/the-facebook-dependency/) on social networks.
So here we are in 2019 where every online services wants to hold your attention as much as possible. You can see this with applications like Tinder and Bumble (online dating apps) where notifications are pushed to you, if you ignore the application.
I then found an outlier, a website that encouraged you to not get addicted.
> *Like email, social news sites can be dangerously addictive. So the latest version of Hacker News has a feature to let you limit your use of the site. There are three new fields in your profile, noprocrast, maxvisit, and minaway. (You can edit your profile by clicking on your username.) Noprocrast is turned off by default. If you turn it on by setting it to "yes," you'll only be allowed to visit the site for maxvisit minutes at a time, with gaps of minaway minutes in between. The defaults are 20 and 180, which would let you view the site for 20 minutes at a time, and then not allow you back in for 3 hours. You can override noprocrast if you want, in which case your visit clock starts over at zero.*
For those that don't know, [Hacker News](https://news.ycombinator.com/news?ref=connortumbleson.com) is basically an aggregator of technical news whether it be a new version of a language/software or a news story that involves tech.
Snippet of website on 2/10/2019
As you can see from above image, this website is not anything special. It reminds me of Craigslist, but it works and I'd rather it never change. It loads quick and gives me the information I want, then after 20 minutes I can't visit again for 3 hours.
The message you get when measures kick-in
Not every website needs to enforce its own mechanism of time management, but when every application out there is trying to steal my time it is a strange sight to see something do the opposite. I wonder what the public perception of all these attention demanding services will be in a decade.
### Ranting about people in Florida
URL: https://connortumbleson.com/2019/02/04/ranting-about-florida/
Last updated: 2025-02-04T11:43:55.000Z
Photo by [Jorge Vasconez](https://unsplash.com/@jorgeluis?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
While driving home from work I got stuck at a red light not more than 500 meters from the turn into my apartment complex. As the light turned green, I accelerated but not much at all opting instead to turn on my turn signal and slowly take my turn into my complex. Apparently I greatly upset the car behind me who instead blared his horn, swerved around me and gave me a middle finger.
Which caught me off guard greatly, because a blaring horn in the darkness wakes anyone up. Apparently slowly breaking to take a right hand turn with a turn signal is no longer allowed. According to this driver, I should take my turn at 45mph. At first I thought my blinker was perhaps broken, but after parking and testing - that was not it. With this incident, I decided to rant about everything that bothers me around Florida.
**People who bulk order food in line.**
It seems with just my luck that coming into Chipotle or some sandwich shop will put me behind someone that is ordering for their entire business office or extended family of 15 people. There is a reason call ahead orders and/or online ordering exists, please use it people! Its such a slap in the face to everyone waiting in line as you order an endless list of things that you read off your phone.
**People who talk on the phone while ordering food.**
On Friday of last week, I watched a girl in front of me attempt to talk to a cashier while talking to someone on the phone. It was beyond annoying and I wasn't even the cashier! It would be such a more peaceful experience for the customer and cashier if the customer wasn't also trying to yell into her phone.
**People who suck at parking.**
This one is tough to rant about, because you never really know if someone else started the bad parking and the person you are talking about was forced into that position. However, too many times I see a car obviously parked over the line. Swallow that pride and back out and re-park. I've done it multiple times out of fear of getting door-dinged so I'm absolutely centered in my spot. No one is going to judge you for taking the 10 seconds to reverse and fix that parking.
**People who trash our beautiful beaches**
A common pattern for me is to head out to the beaches early and jump in the kayak. Start a slow trek out to an island and relax the afternoon exploring with a little lunch. It always blows my mind of the conditions of the beach when I return. Cups, beer cans and the random assortment of trash liter the beach. There are trashcans on the beach everywhere, I just don't understand how people can trash something that looks so beautiful every morning.
**People who leave shopping carts in parking spaces.**
I see an empty parking spot towards the front and I pull towards it, but unforunately a shopping cart is hiding there. I have to park 3/4s of the way, get out of my car and then complete parking my car once the block has been removed. I look down the row of parking spots and there is a cart return 3 spaces down! Who is lazy enough to push a cart into an empty parking spot instead of just taking it to the return?
I could probably rant a bit more, but those are some things that annoy me and most of them can probably be applied to any part of the world.
### LTS (Laravel) is a joke
URL: https://connortumbleson.com/2019/01/28/lts-is-a-lie/
Last updated: 2025-02-04T11:43:56.000Z
Photo by [Neil Thomas](https://unsplash.com/@finleydesign?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Today while looking at some old hobby projects, I realized I built two of them on Laravel 5.1 which happened to be the first LTS for Laravel.
> Laravel 5.1 is the first release of Laravel to receive ****long term support**. Laravel 5.1 will receive bug fixes for 2 years and security fixes for 3 years. This support window is the largest ever provided for Laravel and provides stability and peace of mind for larger, enterprise clients and customers.
> [Laravel 5.1 Release Notes](https://laravel.com/docs/5.1/releases?ref=connortumbleson.com)
At face value this sounds like a good deal. You get a product that will continue to be supported into the far future. In Internet time, supporting a product for 5 years is not an easy task so consumers probably very much appreciate it. Normal Laravel releases seem to come every 6 months, so keeping up to date with those is sometimes difficult.
This is why I was drawn to LTS, but now years later I feel completely different about the entire ecosystem of LTS releases.
### Delaying Technical Debt
Starting with a hobby project, picking Laravel 5.1 allowed me to pretty much ignore every Laravel release until the next LTS, which was Laravel 5.5\.
- Laravel 5.1 LTS - June 9, 2015
- Laravel 5.5 LTS - August 30, 2017
However, when August of 2017 rolled around my hobby project wasn't in active development, just the occasional small commit to fix an issue. The technical debt required to jump to the next LTS was too large to take. For the PHP framework world, you can't just jump from 5.1 -> 5.5\.
Upgrade notes only existed for 5.1 -> 5.2, 5.2 -> 5.3, 5.3 -> 5.4 and 5.4 -> 5.5\. This meant that I needed to do each individual (non-LTS) upgrade in order to get to the next LTS release. With my current LTS no longer supported and fighting incompatibilities with the newer PHP language, I needed to upgrade.
The upgrade from 5.1 -> 5.5 was not an easy task. Something as simple as updating my dependencies would be met with stress and anger. Imagine a popular dependency that has support for LTS versions (5.1 & 5.5 and the latest Laravel release - 5.7). While upgrading to Laravel 5.2, I cannot find a suitable package version for a certain package. This means I have to mess around with specific tags and commits in order to run an old version of software solely to complete my 5.2 upgrade.
When this hobby project was in its prime time of many hours of development a week, I should have taken the 5.2 upgrade. Package versions would have been aligned and 1 upgrade would be easier than 4.
I have this problem with more projects both at work and at home. You think you are saving time and energy, but you are only delaying the problem and by doing so just making it that much harder to complete when the time arrives.
The next time I've given a choice between LTS and non, I'm sticking with a regular release cycle. If a product isn't dead, there isn't any reason to restrict myself to the technical debt that an LTS carries.
### Burnout
URL: https://connortumbleson.com/2019/01/21/burnout/
Last updated: 2025-02-04T11:43:56.000Z
Photo by [Uillian Vargas](https://unsplash.com/@vargasuillian?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I've been noticing in the development community, a problem I can only describe as burnout. It started with an [article](https://medium.com/s/story/exploiting-developer-infrastructure-is-insanely-easy-9849937e81d4?ref=connortumbleson.com) that a large open source package maintainer gave another user write permission to it. This happens occasionally, but usually the new user has some sort of history with the project. In the linked case, this user had no prior work in the project.
This user turned out to be malicious and attempted and partially sucedded to infect those in the Node community by adding malicious code into the project and releasing it. This blog could be about that entire mess, but I was more curious why the original maintainer added someone else so willingly.
Before we jump into that though, we need to start with myself that has more hobby projects than free time. Projects have a few phases which I'd describe as developing, developed and abandoned. Some projects never leave the developing phase, which could be for any reason. Perhaps the project is too difficult or time gets in the way.
A majority of my hobby projects are in the developed or abandoned phase. Developed projects live somewhere and I occasionally fix them or enhance them with features. Depending on the popularity of my projects, sometimes others in the world use them or in most occasions the project is used by just me.
Most projects end up abandoned, as I no longer use them myself but they are still deployed out there in the world. This means an occasional support request might come by. I got one a few days ago for a project, asking me to support the newest version of some game. Multiply this by a few projects, while working on new projects and you have a pile of too many things. This just leads to burnout.
I don't want to spend time on projects that I no longer use, because it selfishly doesn't help me anymore. I'm more driven to work on projects I also use, because I immediately have a return on any work. What happens though is some user meets me 50% of the way and presents code to solve a problem for an abandoned project. I might merge it, but then I have to do a release and write notes and at this point I've put too much time into it.
This is where just giving up an open source project is tempting, but as proven in the beginning of this article can lead to dangerous abuse. However, what can you do with an eager world of users wanting to prolong the life of every single piece of code anyone has written?
Taking this full circle back to the original point. The internet has changed, where even a little blog about a development topic is littered with years of support questions. All these avenues for support on developed or abandoned projects eat at you until you slowly burn out. This leaves projects in a rough state until you collapse and pass it on to someone else, much like what happened in the linked article above.
### Tech & Anxiety
URL: https://connortumbleson.com/2019/01/14/tech-and-anxiety/
Last updated: 2025-02-04T11:43:56.000Z
Photo by [sydney Rae](https://unsplash.com/@srz?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I was eating dinner at a local restaurant a few weeks ago when an army of kids walked in. I'm very much exaggerating, because it was more like one group of six high school kids. At one point during dinner, I heard them mention grades had been posted and most of them whipped out their phone and began looking.
This reminded me of the intro of online grading and submissions. It started as early as middle school for me when my language arts class was the first class to use some piece of software known as Moodle. It allowed students to download assignments and for one of our required typed papers, we actually had to upload the paper into Moodle and it did some plagiarism detection. Which was quite an interesting feature, to immediately see some percentage of how much your paper was "copied" from online sources.
As technology evolved, so did the tools and this was no exception when I moved onward to high school. The software this time around was known as Blackboard, and from what I can remember - plenty of people hated it.
Blackboard
Blackboard was everywhere from students to parents, which meant that hiding grades were a thing of the past. Parents could simply log in and see grades for assignments and tests, but students could take it a step further and get a notification when grades were posted.
In my early days of school, after a large exam the classic attitude was to go out and hang out with friends and forget the exam completely. Only when back at school when the exams were returned would I discover my grade. This meant there was no reason to worry or stress over the break, because you couldn't figure out your grade till class started again.
This changed entirely with online education tools. The dreaded blackboard notification would light up and with my history in school show me numbers I'd rather not have seen. Those notifications were anxiety bombs, as more than likely the notification was attached to a large exam which controlled 10-30% of your grade. This met that sometimes you had a discussion with your parents about a grade before you even discussed it in class. For example, a bad grade shown immediately on Blackboard might not have a curve applied which meant conversations are happening before anything is final.
Ignoring any parent aspect, the idea that grades can be pushed instantly to students and parents is today's scary real world. There is no downtime, there is no "blissful ignorance". Maybe this isn't a problem if you get excellent grades, but I can save my rant on that for another post.
### Healthcare Woes
URL: https://connortumbleson.com/2019/01/06/healthcare-woes/
Last updated: 2025-02-04T11:43:57.000Z
Photo by [rawpixel](https://unsplash.com/@rawpixel?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The first time I [blogged](https://connortumbleson.com/2018/10/07/the-most-important-system/) about this, I was on the way to healing. Today is nearly 5 months later and I frequently am stuck on a couch or bed unable to walk without crawling. My body has additionally been giving me these muscle spasms, which I've learned is my body protecting itself. These spasms hurt only for a few seconds, but normally knock me over if I'm standing.
This blog post is the journey from pain to continued pain, because as of today (January 6, 2019) the pain lives on. As I was a kid, if I became ill, I just jumped in a car and attended a doctors appointment. I did nothing, as the parents filled out every paper, paid every bill and took me to the appointment. This is my first injury living on my own that required more than a prescription to fix.
This is that story, along with all the complaining about the process.
### The Chiropractor
My first instinct with some aching back pain was to attend a chiropractor. As I described my injury that led to this problem, they wanted to preform a few x-rays. The thing about x-rays and most imaging is the two part payment. You pay for the operation (co-pay), then pay again for radiology to process and make sense of those images.
| Date | Insurance Paid | I Paid |
| --------- | -------------- | ------ |
| 9/17/2018 | $229.27 | $0 |
| 9/17/2018 | $621 | $152 |
| 9/18/2018 | $0 | $66 |
| 9/19/2018 | $229.27 | $50 |
| 9/21/2018 | $314.46 | $50 |
| 9/24/2018 | $0 | $50 |
| 9/25/2018 | $0 | $50 |
I attended 5 sessions, but my insurance claim history shows a different story. I can't pretend to know how they organize and bill things, but it looks strange. The important things to note is after 5 sessions I wasn't getting better. While the sessions were short and helped, the relief was short-lived so I decided to move on to my primary care. I didn't want to keep paying $50 (or more) for no relief.
### Primary Care
The thing is, I didn't have a primary care. Whoops. Lived here for 3 years and never had to attend a doctor. So took some time and research and days later had a brand new appointment at primary care. Since my condition at this point was pretty bad, I immediately got prescribed - METHYLPREDNISOLONE and a "script" for an MRI.
At this point I learned, just because you have a "script" for an MRI doesn't mean you have one organized. I called the number on the paper I was given and was told it was the wrong number to call. I called another number and planned myself an MRI in about a weeks time. For these sessions at primary care and some drug pickups, I had the following expenses.
| Date | Insurance Paid | I Paid |
| ---------- | -------------- | ------ |
| 9/26/2018 | $172.35 | $35 |
| 9/26/2018 | $12.70 | $10 |
| 10/03/2018 | $168 | $35 |
| 10/03/2018 | $5.72 | $0 |
| 10/23/2018 | $168 | $35 |
### The MRI
The day was finally here for the MRI, my first one ever. Besides the boring 30 minutes of paperwork, it was okay. I couldn't figure out how to put on the little robe correctly and sitting still while your back is throbbing in pain wasn't easy. It was a high co-pay of $200 and I still had to pay again once I got the 1990s letter in the mail asking me to mail a check back.
| Date | Insurance Paid | I Paid |
| ---------- | -------------- | ------ |
| 10/01/2018 | $1550 | $200 |
| 10/01/2018 | $66 | $10.13 |
The official report and images came back, with the following news:
- L4-L5 - There is a moderate loss of disc height and disc signal. There is a moderate size central and right paracentral disc protrusion with marked encroachment right lateral recess and resultant moderate to marked spinal stenosis at L4-L5 level noted. There is mild encroachment of foramina bilaterally by the bulging disc and mild bilateral facet arthropathy.
- L5-S1 - There is a 4mm retrolisthesis of L5 on S1 noted. There is a central disc protrusion with focal annular tear identified. There is mild indentation on thecal sac with minimal spinal stenosis at L5-S1\. There is mild bilateral foraminal encroachment by the bulging disc and mild facet arthropathy.
My attempt at GIF\`ing my back damage (Herniated and Bulging disc)
Looking at this report is 100% doctor talk. I have no idea what any of it means, but perhaps if I was in the medical industry then it would make sense.
### The Physical Therapy
I was assigned 18 sessions of PT and with $50 co-pay a session, I was not looking forward to it. My doctor explained that herniated/bulging discs were common so just a couple weeks of PT. It was some early PT, with appointments ranging from 7-8am every other day.
As PT went on, my pain got worse. I became less flexible and pain moved sides. For this reason, already being 12 sessions in - I cancelled the rest and requested another appointment with my primary care.
## The Neurosurgeon
As the title leaks, my primary care with the increased symptoms gave me a "script" to see a Neurosurgeon. This was quite possibly the most annoying aspect of this entire journey. You have to find a neurosurgeon yourself, basically shopping for someone that can kill you or heal you. I called places and most refused to talk to me, instead asking me to submit my MRI to them, their "schedulers" would then call me back after they examined my MRI.
At this point, day to day was walking very slowly around afraid to do any action that might cause my body to collapse in spasms.
Finding a doctor to heal you isn't easy either. Looking online made things worse, as the doctor I finally got an appointment with had a 3.1 star online, while others I was calling were at the 4.5-5 star range. Weeks went by and I finally had my first neurosurgery appointment, which in short was useless. It took 4 weeks to get my first appointment and I either learned to live with the pain or it had primarily gone away. I was prescribed an injection (ESI) and it was set for 3 weeks away.
The day before that injection, I was called and told my insurance hadn't approved the request. I was pissed, as someone who hadn't touched their company insurance for 26 months couldn't get an injection approved. I called my insurance and they explained there was nothing they could do and shifted blame back to the doctor.
Sitting on hold with doctors and insurance was beyond a waste of time. No one answered any question I had and sure enough, when 2 weeks went by, I was denied again from having the injection. I called the doctors office in pure anger and cancelled the injection. I yelled at them for making me wait months for a stupid injection and then called my insurance and did the same.
No one I talked to deserved it, but I needed to complain somehow.
## The 2nd Neurosurgeon
A little early holiday miracle was the 5 star doctor office calling me, saying my MRI had been viewed and was a valid reason to make an appointment. The appointment was days away downtown at a major hospital.
I attended it, which was a nightmare. There was people and traffic everywhere, each counter of a person redirecting me to another. I finally get to the part of the hospital I need to visit and I'm turned away, because I need x-rays. Remember, my x-rays were at a chiropractor and not in the system of this hospital.
The part of the hospital for imaging had a very awkward exchange. Apparently an emergency occurred and the MRI/CT machines were in use. This caused some older gentleman to get all agitated claiming that his wife's MRI was more important than this emergency. He started yelling that he donates 100s of thousands of dollars to this hospital and demanded to be seen. This made the experience really awkward, as I just was there to get some more x-rays.
I finally got my x-rays and went back to the office of the neurosurgeon and sat and waited. Finally my appointment arrived, I was seeing a 5 star doctor 3 months 16 days after my accident. He was a great guy who took notes, did some investigations and walked me through my x-rays and MRI. The conclusion was nothing more than 9-12 months of swimming and rest. Apparently my discs are so thin they resemble that of a 60 year old man.
I need old fashion time and hydration to slowly heal my herniated, bulging and thin discs.
## The Relapse
That was, until it happened again. Just a regular walk from my bedroom to kitchen and something happened. I collapse to the ground, afraid to move as I can feel any small movement causes intense pain. This pain was familiar, reminding me of the pinnacle of pain from just a few months ago.
Getting hurt around New Years isn't easy either. Doctors seem to take 3-4 weeks off. I'm sure they deserve it, but boy does it put an annoyance in scheduling an appointment. Every receptionist told me the same thing - "If it hurts too bad, please hang up and call 911".
Sorry receptionist, but I know from online that one call to 911 for an injury can result in a fat bill. I'm tired of spending thousands of dollars, spending hours doing paperwork and without being an annoying asshole - you can't get anywhere when you need specialized care.
## The Billing Rant
Random days throughout this journey, I would receive some bill in the mail. It would be from some doctor/radiology department that I had no idea about. They had the shortest window available for support, but all calls ended about the same. Some doctor Y sent results to company X and we used talent Z and thus charged you for it. What is hilarious is some company sent me two bills for two different amounts. It was the same company, so I made one check equal to the sum and sent it back. They responded with a hand written sticky note over the check saying I didn't owe anything.
So I guess I read that bill wrong, who knows. The story gets better though, weeks later I get another letter saying I owe $1.88 (Yes 1 dollar and 88 cents) and if I don't pay it will be forwarded to collections. That was the first time I had seen that letter, so guess these companies don't mess around for barely $2 dollars. It probably cost more time and effort to mail me that request. Paying for any of these things after the fact is so clunky, even online operations fail to work unless I'm using Internet Explorer.
## The story continues...
This story has caught up with the present as I await the next appointment with my neurosurgeon. We are exploring surgery options to operate on my disc to remove this pain. The recovery will be much shorter than a year of stretches and at this point - I want that.
### A Year of Blogging (2018)
URL: https://connortumbleson.com/2018/12/30/a-year-of-blogging/
Last updated: 2025-02-04T11:43:57.000Z
Photo by [Steven VanDesande Jr](https://unsplash.com/@swviiphotography?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
As 2017 was coming to an end, I wanted to make a resolution that I could complete. Simple an easy - blog once a week. As I write this post, I am setting it to go live at 6:30pm EDT on Dec 30, 2018\. When that goes live, I will have successfully blogged every week in 2018.
Some posts have been rushed as I write them before I go to bed on Sunday, while others took days of research and were written slowly throughout the week. While a minor accomplishment, I set a goal and made it. So for this post, I want to recap some of my favorite blog posts of 2018.
[My Original Media Center](https://connortumbleson.com/2018/01/21/my-original-media-center/)
The above post served as a memory in time for my life in the original Xbox modification scene, which started when I was still in middle school. The hardware remains and still works.
---
[Stumbling into a MLM (It Works!) on Accident](https://connortumbleson.com/2018/02/11/stumbling-into-a-mlm-on-accident/)
This post started because while being downtown, I stumbled upon a huge gathering of people all dressed in green attire. It turned out to be a party for a multi-level marketing scheme. They haven't posted income disclosures since 2016 - so guess I was right. They are going out of business and just milking money from uneducated people.
---
[9 Months with a Pi-hole](https://connortumbleson.com/2018/03/25/taking-a-look-at-9-months-of-pi-hole/)
This post was a great analytical deep dive into my Pi-hole Raspberry Pi. It helped show how many analytical requests are sent and just how many things this piece of technology helps block.
---
[The Death of Chronological Order](https://connortumbleson.com/2018/05/27/the-death-of-chronological-order/)
This post was fueled from pure anger. It seemed more and more of applications had removed chronological ordering and defaulted to some AI based sorting mechanism. Probably to shove ads and more information towards me. Defeating some of the reasons I used these tools, because what is the point of Twitter if the tweets aren't in order?
---
[The Unfair Comparison](https://connortumbleson.com/2018/06/17/the-unfair-comparison/)
This post idea came from a conversation I was having about holding a record at my local elementary school. Technology had allowed us to compare nearly anything with the world and helped show that what was once a record is nowhere near the top in pale with the world.
---
[Decommissioning a Nuclear Power Plant](https://connortumbleson.com/2018/07/08/decommission-nuclear-power/)
For some reason I got interested in Nuclear energy. I was googling things and next thing I knew I had spent most of the day researching anything related to Nuclear energy. This led me to research how these complicated sites get decomionished in sa safe manner.
---
[Eradicating Smallpox](https://connortumbleson.com/2018/07/22/eradicating-smallpox/)
What was quite possibly the best featured image I found for 2018 was attached to my post looking into Smallpox. This post was because I heard in the news that our government spent absurds amount of money purchasing TPOXX which is a vaccine to Smallpox. However, if Smallpox is eradicated then why is the government spending money on a vaccine? This post dives into that question.
---
[Halo MCC Revisited](https://connortumbleson.com/2018/09/02/halo-mcc-redux/)
Halo was the first video game I probably ever played that hooked me to it. From the first Halo at a friends house, I was addicted to getting an Xbox for the highly successful Halo 2\. Halo MCC was filled with bugs, glitches and more making it a complete utter flop and embarrassment to the industry. Years later, they fixed these mistakes.
---
[I am a Nerd](https://connortumbleson.com/2018/10/28/i-am-a-nerd/)
This post took a strange look at the theory known as NADD. It tries to explain why I act the way I do and how I balance many things. It was based from a chapter I read in a book which resonated with me greatly.
---
[Discovering Neil Breen](https://connortumbleson.com/2018/11/04/discovering-neil-breen/)
A co-worker showed me Neil Breen and it blew me away. Movies that rival the worst best movie of all times. Diving into his ecosystem of movies was filled with interesting discoveries which gave the body for this post.
---
[Water Treatment - Cosme (Florida)](https://connortumbleson.com/2018/12/09/learning-about-water-treatment/)
The final post of this recap and this post takes you through the discovery of a water treatment center I stumbled upon. What started as a Google search for US Code 42, section 300i-1 lead to an investigation and research about water treatment plants.
---
### In Closing
I don't know what 2019 holds for my blogging lifestyle, we might continue weekly posts or explore larger monthly posts. Only time will tell. Thanks for reading throughout 2018.
### Florida DevFest 2019
URL: https://connortumbleson.com/2018/12/24/florida-devfest-2019/
Last updated: 2025-02-04T11:43:58.000Z
Photo by [Jayme McColgan](https://unsplash.com/@jayme?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
In a few short weeks on January 19, 2019 I will be speaking at Florida DevFest in Orlando, Florida.
### 2017 - Attacking Android
This will be my 2nd time speaking at this event, as I spoke about attacking Android applications at the last one.
[Slides for the November 11, 2017 Talk at DevFest](https://connortumbleson.com/slides/2017-11-11-AttackingAndroidDevFest.pdf)
For 2017, I spent most of the time block discussing things at the application level. We looked at common methods attackers use to extract information whether from assets or APIs.
I don't want to dwell in this post about talks in the past, but if you are interested you can watch this [slightly embarrassing video](https://slideslive.com/38904065/attacking-an-android-application?ref=connortumbleson.com) of my 2017 talk.
### 2019 - Security & Pie
For 2019, I've taken a different approach with my talk and will be discussing snippets of history regarding security on the device itself. We start from the hardware manufacturers and work our way up to the Google Play Store. What makes this talk interesting is every talking point involves Android 9 (Pie) somehow. This might be showing how Android 9 brought enhancements to an existing feature or something like that.
[Slides for the January 19, 2019 talk at DevFest 2019](https://connortumbleson.com/slides/2019-01-19-SecurityAndPieDevFest.pdf)
For those who've attended any of my talks before - you know we explain everything so there isn't a single confused face. If you don't know what MITM, CFI or ASLR is - do not worry. If you are a veteran of the industry with 30+ years, then come on down as well. Perhaps the history aspect will be a trip down memory lane.
I could type plenty more about this talk, but I don't want to ruin the mystery that surrounds it. So I'll leave you (the reader) with our plan of attack for this upcoming talk.
- System on Chip (SoC) - Hardware
- Android Platform - Monthly Updates
- Kernel - ASLR + CFI
- Android Ecosystem - PHA + SafetyNet
- Applications - Signing Blocks
A lot to talk about in 45 minutes, but we will do it with a fun slide deck and energy packed session. Thanks to [Sourcetoad](https://www.sourcetoad.com/?ref=connortumbleson.com) for sponsoring my accommodations for the event.
### Attending DevFest 2019
Tickets are [on-sale](https://devfestflorida.org/?ref=connortumbleson.com) and range from $99 to $225 depending your status (student) and other factors.
I don't want to rehash the official website, so just head on down if you want more information - [https://devfestflorida.org/](https://devfestflorida.org/?ref=connortumbleson.com). If you are attending - I'll see you there!
### Risk vs Reward
URL: https://connortumbleson.com/2018/12/17/risk-vs-reward/
Last updated: 2025-02-04T11:43:58.000Z
Photo by [Lubo Minar](https://unsplash.com/@bubo?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This weekend (December 15, 2018) I was driving towards Fort De Soto Park and saw the recent outcome of a car crash. It looked pretty bad as the back of a car was smashed and the other car was laying in the grass in not so good of shape.
A large semi truck was also pulled off on the side of the road so really no idea what happened, but it strangely reminded me of this idea of risk vs reward. My guess is that someone was doing something they shouldn't - whether that was speeding to arrive quicker or doing something on a phone. These are of course guesses, but led me to the same thought process of risk vs reward.
I can speed home at 80mph with cruise control, but I have to balance the risk vs reward. The risk in this case could be as bad as death or a pretty deadly crash. The reward in this case is getting home earlier. If you pair those together it doesn't seem like the risk is worth the reward.
So I wanted to give this theory of mine a test. I had plenty of tasks to do this weekend:
- Take cardboard to recycle bin (across apartment complex)
- Vacuum
- Laundry
- Wrap Christmas gifts
- Empty dishwasher
- Follow up with work email
- Complete hobby project open pull request
- Clean backpack (Dropped it in mud)
- Buy light bulb, toothpaste & groceries
So I awoke at 6:02am today. I ate some breakfast and started my tasks, spending zero time on any distractions. I could parallelize some tasks and did so plenty of times. As the sun came up, I was down to just running the store errands and folding clothes.
At 9:43am I was done. Barely 4 hours of work and all my tasks were completed. If I examined that work through the lens of risk vs reward. I removed every risk I had, leaving just the reward. However, now it is 2:48pm and I've already programmed some hobby projects and played some video games. I can't workout or run due to my ongoing messed up back injury.
The remaining hours of the day (reward) don't feel as rewarding, because there is no risk balanced with them. The decision to play two rounds of a video game and then get back to work makes those two games more worth it. This perhaps is some irrational thinking, but I don't have a single task left today and yet I don't feel fulfilled doing whatever random reward I want.
Taking this post back to the sight that started it - I really wish people compared the risk vs reward before doing anything.
### Water Treatment - Cosme (Florida)
URL: https://connortumbleson.com/2018/12/10/learning-about-water-treatment/
Last updated: 2025-02-04T11:43:58.000Z
While wandering around playing Ingress, I walked onto a fence with barbed wire. Slightly strange as I was pretty far from the road and I began following the perimeter of it. It didn't take long until I stumbled upon the following sign.
Cosme Water Treatment Station warning sign
It was the first time I had a seen a sign like that up close so I quickly googled the code it referenced.
> 42 U.S. Code § 300i–1 - Tampering with public water systems
> [Law Cornell ](https://www.law.cornell.edu/uscode/text/42/300i-1?ref=connortumbleson.com)
Three years living within five minutes of this location and while I recognized some weird silos and buildings I never connected it with a water treatment center. If we take a look at Google Maps, we get a better picture of the location.
Cosme Water Treatment Google Maps (3D View)
I stumbled upon the east fence while playing a game, which looks to be unused land on the surface.
What was slightly weird is all the warning signs around this property referenced St Petersburg. I was in Keystone, which is at least 45 minutes from St Petersburg. So why was this treatment plan for a city nearly an hour away?
### The History
In the late 1800s, St Petersburg used Mirror Lake as the source of drinking water. This was a spring fed water source, but by 1920 was showing signs of saltwater intrusion. With the explosion of population to the area and no method of removing salt from water - the city went exploring.
> It was found in Northwest Hillsborough County, and in 1930 a 26 mile pipeline was constructed to carry fresh water from deep wells located there to the city.
> [Treatment & Supply - St Pete](https://www.stpete.org/water/drinking%5Fwater/treatment%5Fand%5Fsupply.php?ref=connortumbleson.com)
So quite the engineering feat to construct a 26 mile pipeline to carry this new source of water to the destination. That was nearly 100 years ago, which means no way that a groundwater had been the source of drinking water for this massive city.
### The Present
[Tampa Bay Water](https://www.tampabaywater.org/current-water-sources-in-use-tampa-bay-region?ref=connortumbleson.com) is sourced from 3 different water sources at this point in time (December 2018).
- Groundwater
- Surface water
- Sea water (Desalinated)
**Groundwater**
To the untrained reader, this type of water is not water found on the ground but water deep within the ground in aquifers. The Floridan Aquifer is the main limestone layer that collects billions of gallons of water that seeps down from the surface.
[Tampa Bay Water (Groundwater)](https://www.tampabaywater.org/water-supply-source-groundwater?ref=connortumbleson.com)
> Tampa Bay Water is permitted to withdraw an annual average of 120 million gallons per day (mgd) from 13 wellfields in Hillsborough, Pasco and Pinellas counties.
> [Tampa Bay Water - source](https://www.tampabaywater.org/water-supply-source-groundwater?ref=connortumbleson.com)
**Surface water**
This water source was the first addition to groundwater in which water is skimmed off rivers around the city. This water during rainy seasons is stored in a massive reservoir capable of holding 15.5 billion gallons of water. I was curious what this body of water looked like, so off to Google maps again.
[C.W. Bill Young Regional Reservoir](https://www.google.com/maps/place/C.W.+Bill+Young+Regional+Reservoir/@27.8041433,-82.1840564,4132m/data=!3m2!1e3!4b1!4m5!3m4!1s0x88dd2c86c0301def:0x35e7b7f7a2602200!8m2!3d27.7997686!4d-82.1740826?ref=connortumbleson.com)
I'm not sure what I expected, but a large pond like structure fits that thought. It seems this water is used
> The reservoir measures approximately 2 miles long by 1 mile wide with depths varying from 40 to 80 feet. Surface water collected here could stay in storage for months, so the water must be aerated and circulated to prevent algae blooms and protect taste and odor.
> [C.W. Bill Young Regional Reservoir](https://www.tampabaywater.org/cw-bill-young-regional-reservoir?ref=connortumbleson.com)
**Seawater (Desalination)**
The final type of water which separates Tampa Bay Water from others is the ability to take sea water and produce fresh drinking water through a process known as a reverse osmosis.
> High pressure forces the pretreated water through semi-permeable membranes to separate the freshwater, leaving twice-as-salty seawater and other minerals behind.
> The size of each RO membrane pore is about .001 microns, which is about 1/100,000th the diameter of a human hair.
> [Tampa Bay Seawater Desalination Plant](https://www.tampabaywater.org/tampa-bay-seawater-desalination-plant?ref=connortumbleson.com)
This process can not produce as much drinkable water as ground and surface water, but can be combined, as needed, with the other sources. Tampa Bay Water provides up to date [statistics](https://www.tampabaywater.org/current-water-sources-in-use-tampa-bay-region?ref=connortumbleson.com) on this.
| Type | Millions Gallons Per Day (MGD) - Nov 2018 | |
| ------------- | ----------------------------------------- | ----- |
| Groundwater | | 104.6 |
| Surface Water | | 69.8 |
| Sea Water | | 0 |
A random adventure led me to a water treatment plant that put me on a Google search marathon. I took drinking water for granted without knowing what it takes to make it happen.
### Entering the Spice Dome
URL: https://connortumbleson.com/2018/12/03/entering-the-spice-dome/
Last updated: 2025-02-04T11:43:58.000Z
Photo by [Samantha Sophia](https://unsplash.com/@samanthasophia?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
There were times in my life where every meal had to include either ketchup or ranch. I remember watching a friend use ranch with french fries in middle school and after trying it - I was hooked. This continued in some form or faction until I stumbled upon Sriracha. It was a perfect blend of heat and flavor with the emphasis on heat.
Co-workers took my heat obsession to the next level as our company kitchen was littered in hot sauces. We had sauces that could be found at any grocery store, but also sauces that take a bit more effort to obtain.
[Dave's Insanity](https://store.davesgourmet.com/ProductDetails.asp?ProductCode=DAIN&ref=connortumbleson.com)
The above sauce was the first sauce I tried that introduced me to the mega heat game. I was reheating my pasta for lunch and a coworker tempted me to put a few dabs into my pasta. Almost instantly the pasta smell in the air was covered with an intense heat and every bite burned my lips. It was painful, but strangely good.
The compound that causes this pain is none other than **capsaicin**. Idon't want this blog post to be some scientific investigation into it, but the gist is it has a few benefits that doesn't make it completely useless.
I started researching hot sauces, because I wanted some at my own home and stumbled upon "Hot Ones". This is an online show on YouTube where celebrities are interviewed while eating progressively hotter wings. This was the first video I saw, which started giving me a good background and knowledge of hot sauces to purchase.
Week after week of watching, I finally decided to purchase some hot sauces and chose the Queen Majesty sauces.
[Queen Majesty sampler](https://queenmajestyhotsauce.com/products/queen-majesty-5-oz-sampler?ref=connortumbleson.com)
They arrived and every sauce was perfect for a different thing. The scotch bonnet sauce was perfect on wings, while the lime sauce was great on pizza and finally the red habanero spiced up my pasta creations. Messing with heat allowed me to continue the trend at any restaurant I visited. Trying new hot sauces everywhere, including [some](https://heatonist.com/collections/brands/products/hot-ones-the-last-dab?variant=378416136201&ref=connortumbleson.com) that sent me straight to endless milk and water.
I look into my fridge now and ranch is nowhere to be found, instead replaced by tons of little bottles of hot sauce. The health benefit of a tiny bit of hot sauce vs globs of ranch is probably in my favor to stick with hot sauce. I don't know enough yet in the realm of sauces, but I'm interested in the continued chase of heat.
### The Dyatlov Pass Incident
URL: https://connortumbleson.com/2018/11/25/the-dyatlov-pass-incident/
Last updated: 2025-02-04T11:43:59.000Z
A view of the tent as the rescuers found it on Feb. 26, 1959\. (Public Domain)
This week we take a look at an interesting unsolved mystery that occurred in February of 1959\. The story starts with nine hikers who were hiking in the northern Ural mountains. This was the Soviet Union in 1959 or modern day Russia. The group was attempting to earn their Category III certification for climbing, which required a 300km travel. All members (8 men, 2 women) had Category II certifications which made them experienced hikers.
The goal was to reach Otorten (Отортен) which was the mountain tip. The group set up camp 10km from the top and would sadly never reach it. There were 9 hikers sleeping on the night of February 1, 1959\. The 10th hiker had gotten ill on the climb up (Jan 28, 1959) and left the expedition.
Family and friends weren't expecting the return until February 12\. As was common in hiking usually delays were had so it wasn't until February 20 that search and rescue groups were dispatched. On February 26, 1959 the tent and campsite was discovered and the mystery began.
### The Discovery
There were no bodies discovered at the campsite. Two bodies were discovered roughly 1.5km from the site, frozen solid in nothing but underwear and socks. Three more bodies were discovered at various lengths (300, 480 and 630 meters) from the tree. Initial reports suspect these individuals were trying to find the makeshift campsite, but succumb to the cold. It took two more months to find the remaining four hikers who were discovered 4 meters below the snow about 75 meters from the other bodies.
The clothing on the remaining four hikers suggest they took the clothing from the clothesless two hikers discovered at the campsite.
### The Investigation
While the medical examiner determined that all nine hikers died of hypothermia, but outlying details sparked discussions worldwide.
- The tent had been cut open from within
- Footprints show the hikers walked calmly from the tents into forest
- Dubinina was missing her tongue, eyes and part of her face.
- Clothing was missing from many hikers
- Tree branches broken at the makeshift campsite for up to 5 meters high
- Non fatal skull injuries were discovered on Slobodin
- Clothing contained high doses of radiation
- Bright flying spheres spotted in that area throughout February & March of 1959
> Baffled investigators said the group died as a result of “a compelling unknown force” — and then abruptly closed the case and filed it as top secret.
> [sptimes (russia)](https://web.archive.org/web/20080226101529/http://www.sptimes.ru/story/25093)
So a list of strange discoveries, no witnesses and a top secret file. This is grounds for theories to run wild and they did. Rumors from avalanches, infrasound, military tests, paradoxical freezing, yetis, local tribes, animals.
### The Culture
A film using the popular phrase - "Based on true events" produced a film about the incident, but used more fiction than fact.
For this reason, this film is nothing more than an attempt to mainstream an otherwise unknown incident.
### The Debunking
An author known as [Lemmino](https://www.lemmi.no/post/dyatlov-pass?ref=connortumbleson.com) produced a video consisting of hired Russian translators to dive into all the public information and draw conclusions from that information.
This video did a great job at breaking down possible explanations for each unknown discovery. So we can explore each point and use the rebuttal from Lemmino.
**Claim: The tent had been cut open from within**
This is probably because a fire from a [stovetop](https://youtu.be/Y8RigxxiilI?t=851&ref=connortumbleson.com) filled the tent with smoke. In a rash moment choice to breath, the hikers slashed the tent to clear the smoke.
**Claim: Footprints show the hikers walked calmly away**
This is probably due to the fact that they wanted to return to the tent, but the immediate danger (smoke) was preventing it. So they calmly walked to the shelter of the nearby trees.
**Claim: Dubinina was missing her tongue, eyes and part of her face.**
While used highly in theories, the logical explanation put forward is that Dubinia fell face first into the snow which might have had a tiny stream under the snow. This wet climate with running water could putrefy organic matter and destroy it.
**Claim: Clothing was missing from many hikers**
Rushed from the original campsite and hikers who passed away first led to clothing harvested from them for the remaining others.
**Claim: Tree branches broken at the makeshift campsite**
While suggested this was for hiding from something, the real logical suggestion is that a height advantage would allow the hikers to see their tents.
**Claim: Non fatal skull injuries were discovered on Slobodin**
This can be explained from a small fall, which may have been triggered from a minor avalanche in the forest. This is what led to the four hikers being buried under meters of snow away from the makeshift campsite.
**Claim: Clothing contained high doses of radiation**
While initially interesting, only three pieces of clothing had radiation and those three belonged to hikers who worked at buildings where radiation was common. This might have led to containment prior to the hike.
**Claim: Bright flying spheres spotted in that area throughout the month**
There is no way to argue this either direction, but that is the nature of UFOs. These claims stem from the following photo discovered on a camera.
Photo from Krivonischenko’s camera.
I think this claim is just reaching. I just took my camera and zoomed in a photo on a black battery pack.
Taken by me, 8:36am EST - November 25, 2018
As you can see from my test photo, there are plenty of little circles that could be used to claim UFO.
### The Conclusion
While no official explanation exists, there are plenty of unofficial theories and ideas to keep this incident alive for decades to come. Now should anyone mention the Dyatlov Pass Incident - you should know.
### Travel Blog: Austin
URL: https://connortumbleson.com/2018/11/19/travel-blog-austin/
Last updated: 2025-02-04T11:43:59.000Z
Keeping this style of blog posts, this weekend was a trip to Austin, Texas. Like most Ingress oriented trips I take the earliest flight possible on Friday and the latest flight possible on Sunday. This ends the same, as I sit here typing in an airport beyond exhausted with an estimated arrival at home at 11pm. I still don't know how to write these posts, but I don't have my full brain power after an exhausting weekend.
When I landed on Friday, my first stop was to check in at the hotel. They allowed early check-in which gave me a nice break to recharge my devices after the flight. After that I went downtown to find a nice place to eat. I stumbled upon a place with "Surf n Turf" in the name.
[Turf N Surf](https://www.yelp.com/biz/turf-n-surf-po-boy-austin?ref=connortumbleson.com) \- Mahi Mahi Po' Boy
I guess I underestimated what "everything" meant on a Po' Boy. The sandwich was quite large and took some serious effort to eat without looking like a dog.
After that meal, my meeting point for the weekend's activities was open. I set my navigation to Republic Park and started walking. I showed up at a park that any regular Texan probably wondered what was going on.
Blue (Resistance) & Green (Enlightened) tents denoting both teams
Throughout the weekend this park was full of people, events and staff members. The event structure of Ingress events has increased greatly since the days of a few people standing in a park.
Every Ingress trip brings me to a city, I might not have ever visited before. Austin was a first for me and it suffered the same problems like most urban cities. One way roads litter the street with homeless sprinkled around which makes late night walks a bit alarming.
Drinking into Saturday night led me on a 35 minute walk home around 11pm. The trail was dark, peaceful and slightly chilly as the night weather in Texas drops unlike Florida. What continually surprised me was the amount of bikes and scooters abandoned on the dirt trail. The premise of these devices (which are springing up in cities all over) is the ease of use. Scan a QR code from your device, pay $1 and depending on the time use - pay for it. When you are done, just leave the scooter or bike wherever you want. I don't know how the city approves this, because it leaves sidewalks, trails and more littered with things.
Sunday was a 40 degree raining day, which my Florida body can not handle anymore. I was shivering beyond belief as I stood outside for 8 hours. Even I sit here typing in the airport, my body still has not recovered from the cold shock it experienced.
My flight is boarding now, I see my line of passengers decreasing. It may be time for me to end this post and catch my flight back to the warmth of Florida.
### The Greatest Bank Heist
URL: https://connortumbleson.com/2018/11/12/the-greatest-bank-heist/
Last updated: 2025-02-04T11:43:59.000Z
Photo by [Etienne Martin](https://unsplash.com/@etiennemartin?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This blog post will be a story of the greatest bank heist so far in time. This story was presented by me in talk form at the 2018 Tampa Bar Camp conference.
[My slides](https://connortumbleson.com/slides/2018-11-10-BiggestBankHeistBarCamp.pdf) via this [tweet.](https://twitter.com/iBotPeaches/status/1061284452171767808?ref=connortumbleson.com)
This story starts in the Philippines in May of 2015\. Where four brand new accounts were opened with the minimum of funds placed inside. These accounts will soon play a huge part in this heist. At that point in time though, these accounts are nothing out of the ordinary.
Next up we jump to January 2016 where an employee at a the Central bank of Bangladesh inadvertently opens an email that contains a malicious macro which executes code giving the hackers access to the bank. This starts the countdown until the hackers strike again - which takes about a month.
**February 4, 2016 (Thursday - Bangladesh)**
The day is nearing the end which is the beginning of the weekend in Bangladesh. Due to Muslim prayers on Friday, the weekend is Friday/Saturday. This means the full staff won't enter the Bank again until Sunday. Even though the bank is closing and staff are leaving, the Bangladesh is about to be very active.
**February 5, 2016 (Friday morning - New York)**
Due to time zones, the end of the day in Bangladesh is roughly 7-8am in New York. This is important because Bangladesh holds money at the Federal Reserves there. The first of many malicious activity from the hackers have begun. They began sending 35 transactions via the SWIFT network totaling 951 million dollars. Money moves a lot in the international scope so this isn't out of the ordinary.
Perhaps in the context of Bangladesh bank it isn't normal, but unforunately that was not realized. Fortunately all 35 transactions were denied due to not having proper information on the SWIFT form. This was a simple fix as only the field "correspondent bank" needed to be filled out. This should have been another red flag when the hackers resubmitted those 35 transactions with the necessary fields. This was at 1am local time for Bangladesh which should have alerted the New York staff that it was more than likely not legitimate.
Now we have a 2nd batch of 35 transactions at the New York reserves and while the formatting was okay, 30 transactions were blocked due to violating US Sanctions.
> “Today we are lifting the veil on an intricate Iranian scheme that was designed to evade international oil sanctions,” said Treasury Under Secretary for Terrorism and Financial Intelligence David S. Cohen. “We will continue to expose deceptive Iranian practices, and to sanction those individuals and entities who participate in these schemes.”
> ...
> Name: Jupiter Seaways Shipping
> [Treasury.gov 3/14/2013](https://www.treasury.gov/press-center/press-releases/Pages/jl1879.aspx?ref=connortumbleson.com)
This was a fluke situation because the word "Jupiter" was in the SWIFT message which flagged the request. What is very strange involves the 5 remaining transactions.
- 4 sent to RCBC (Rizal Commercial Banking Corporation) in Philippines
- 1 sent to Shalika Foundation (Sri Lanka)
The 4 transactions sent to an RCBC branch were located at the address - "*122 Jupiter St, Makati. 1209 Metro Manila, Philippines*". While other transactions got denied for including the "Jupiter" word, these 4 transactions were unharmed. Either way, the New York office reached out to Bangladesh via the SWIFT network.
**February 5, 2016 (Friday morning - Bangladesh)**
The small staff available on a Friday before Muslim prayers enter the bank and notice the printer responsible for printing SWIFT related messages is not working. This happens occasionally so the staff made a note to fix the printer and left. Had the printer been working, stacks of paper would point to the messages about money moving. The hackers knew this and thus hacked the printer, rendering it useless until repair.
**February 7, 2016 (Sunday morning - Bangladesh)**
The start of the week for Bangladesh and fixing their printer is all the worry. Employees can't process transactions if no SWIFT messages have been printed. It takes them a few hours, but they finally fix the printer and discover what is going on. This gives a heart attack to all the staff at the bank, they immediately begin trying to contact New York and sending "STOP" orders back to the banks with funds transferred.
This proves to be useless in terms of communication with New York, as the working day on Sunday in Bangladesh is still the weekend in New York.
**February 8, 2016 (Monday - Sri Lanka)**
Employees show up to work in Sri Lanka and surprised to see a transaction of 20 million dollars in route to a non profit. An employee asks the referring bank (Deutsche Bank) to confirm the company. The hackers spelled Foundation - "Fundation" which led the investigation to prove that the company in question did not exist. The transaction was denied, which only left 4 transactions remaining of the 35 sent, or roughly 81 million dollars.
**February 8, 2016 (Monday - Philippines)**
If you remember back to the beginning of this blog post, I mentioned 4 bank accounts opened at a small branch bank of RCBC. You guessed it. The remaining 4 transactions funded those 4 accounts and that was very much intentional. Bangladesh was trying to reach this bank, but it was failing as February 8, 2016 was Chinese New Year which meant the bank was closed.
Those accounts moved 51.65 million dollars before RCBC made contact with Bangladesh the next day. At that point due to local law, the accounts could not be frozen until a criminal case was involved. Once that happened, only 65k\~ remained of the 81 million dollars.
The hack was partially succesful. In the scope of the original heist for 951 million dollars, only 80.65 million was actually stolen. The money was laundered via casinos and moved to Macau. Following the money is a blog post in itself, so I want to pause there and go back.
This hack abused/benefited from the following things.
- Close times across time zones
- Holiday times in various countries
- Various countries to abuse local laws
- Hacking knowledge to disable printers
- Extreme planning
The 4 accounts created in the bank that received 81 million dollars were created roughly 10 months prior to the hack. Paired with the timing knowing Chinese New Year would prevent Bangladesh contacting the local branch bank was even more perfect timing. This was a carefully planned and organized hack that was botched from being perfect by stupid mistakes like improper formatting and misspellings.
All these pieces together paint a very scary picture for the digital world and how money moves. For this incident, even two years later the story isn't over. The money is being followed and someone is blaming someone else for this hack. We might have to revisit this topic again in a few years.
### Discovering Neil Breen
URL: https://connortumbleson.com/2018/11/05/discovering-neil-breen/
Last updated: 2025-02-04T11:44:00.000Z
Photo by [Felix Mooneeram](https://unsplash.com/@felixmooneeram?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
During a lunch at work, I discovered via coworker the filmmaker [Neil Breen](https://en.wikipedia.org/wiki/Neil%5FBreen?ref=connortumbleson.com). Without reciting his Wikipedia page, all his films are self-produced and as evident by them - quite low budget. As of today (November 4, 2018) there are 5 films:
- Double Down (2005)
- I Am Here...Now (2009)
- Fateful Findings (2013)
- Pass-Thru (2016)
- Twisted Pair (2018)
Here are the snippets of each movie
> A brilliant computer loner seizes Las Vegas and its terrorist attack, while fighting against his fits of clinical depression and obsession for romance and death.
> **[Double Down](https://www.imdb.com/title/tt1561457/?ref=connortumbleson.com)**
> Disappointed by its creation, the almighty being that created Man arrives on Earth in a human form and interacts with various troubled, wicked and sinful people on his journey to Vegas.
> **[I Am Here... Now](https://www.imdb.com/title/tt1560653/?ref=connortumbleson.com)**
> A computer scientist/novelist reunites with his childhood friend and hacks into government databases, while facing the dire and fateful consequences of his mystical actions obtained as a child.
> **[Fateful Findings](https://www.imdb.com/title/tt2332623/?ref=connortumbleson.com)**
> A messianic entity from the future travels to modern-day earth to wipe out 300,000,000 "bad people" and usher in a new era of peace.
> **[Pass Thru](https://www.imdb.com/title/tt5445074/?ref=connortumbleson.com)**
> Identical twin brothers become hybrid A.I (artificial intelligence) entities, yet torn in different directions to achieve justice for humanity.
> **[Twisted Pair](https://www.imdb.com/title/tt8196068/?ref=connortumbleson.com)**
Each film follows the same pattern. Some entity (Neil Breen) upset with the world needs to cleanse it via some crazy acting, stock footage and monologues of random current event news.
What makes these movies interesting is the ecosystem around Neil Breen. For example his [Twitter](https://twitter.com/NeilBreen?ref=connortumbleson.com) bio still references his 4th movie Pass-Thru while his 5th movie has been the constant talk for the past few months.
### The Website(s)
[http://www.fatefulfindings.biz](http://www.fatefulfindings.biz/?ref=connortumbleson.com) (Custom)
[http://www.pass-thru-film.com](http://www.pass-thru-film.com/?ref=connortumbleson.com) (Custom built)
[http://www.twisted-pair-film.com](http://www.twisted-pair-film.com/?ref=connortumbleson.com) (Wordpress)
From a developer point of view - these websites blow my mind. The first two make sense from someone messing around with HTML/CSS, but the 3rd website is powered via WordPress. How someone can manipulate Wordpress to make it look so strange - I don't know.
The trailer for these films are just as interesting as the website. Here is the first movie (Double Down) and last movie (Twisted Pair) trailer.
### Purchasing Films
For films such as Fateful Findings & Pass-Thru, PayPal links will redirect you for
- Domestic - $25.95
- International - $41.95
Which is quite a steep price to pay for a film, especially when it says
> \* The DVD will be sent via USPS (U.S. Postal Service)
> \* Allow 3 to 4 weeks for delivery.
> \* Made in the USA. In English. No subtitles. No artwork.
> \* The DVD will be in NTSC or PAL standard. The DVD buyer shall select NTSC or PAL standard.
All in all, buying these movies is tough and you'll be getting a disc with none of the features that become expected in today's world. It'll take weeks to show up and you'll pay more than you want, but then you will get to experience a Neil Breen film.
If you want to purchase some of his older films - good luck. Our best knowledge is a cryptic tweet from the man himself.
[https://twitter.com/neilbreen/status/674400203588243458](https://twitter.com/neilbreen/status/674400203588243458?lang=en&ref=connortumbleson.com)
So purchase a different film and slip some notes into the description. A few weeks will pass and hopefully the film you intended to purchase will show up at your doors. When they do - you will get to experience some of these moments.
Twisted Pair (2018)
I Am Here...Now (2009)
Double Down (2005)
These films are full of actors and actresses that I wonder how they found themselves on the set of one these films. Acting so bad or awkward at times - it's hard to watch, but at that same time much like The Room I continue watching.
As a few of the films end they keep giving with an interesting note.
> Any of the above listed companies in the credits with an 'N' or a 'B' in their name are fictitious. This work was actually done personally by 'Neil Breen'.
So you sit reading the credits trying to pick out every fake company and person that is actually Neil Breen. Why he does this? I can't begin to know.
If you stumble upon a Neil Breen film, grab a friend and watch it. It'll be the best worst experience watching a film you have.
If you are reading this Neil, keep kicking ass. Someone has to lead the "cult bad" film industry.
### I am a Nerd
URL: https://connortumbleson.com/2018/10/28/i-am-a-nerd/
Last updated: 2025-02-04T11:44:00.000Z
Photo by [Kobu Agency](https://unsplash.com/@kobuagency?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I was reading a book called "Managing Humans" and one of the chapters was titled NADD (Nerd Attention Deficiency Disorder)
> Folks, I'm a nerd. I need rapid-fire content delivered in short, clever, punchy phrases. I need this type of content because I'm horribly afflicted with NADD.
> \- [Chapter 36, Managing Humans - Michael Lopp 2016](https://www.amazon.com/Managing-Humans-Humorous-Software-Engineering/dp/1430243147?ref=connortumbleson.com)
While reading this chapter, I had never read anything that described my life so perfectly. The chapter references an idea that those afflicted need to be over stimulated with content in order to function.
As I sit writing this post, I have a YouTube video playing of [DJ Ravine](https://www.youtube.com/watch?v=szK9Nyrk%5FG8&ref=connortumbleson.com). The music is very fast paced and I have good quality headphones on to really hear the quality of music. If you think that is all, you are gravely mistaken. On mute, I have Netflix open watching Season 8 of The Office. I'm not watching it, but I glance over a few times while writing this post to watch a few seconds.
I haven't even begun. I have Slack, Telegram, Discord, Keybase, Google Hangouts and GroupMe open. All these chat programs range from work to family to hobby chats. When they light up, they draw my focus and I respond within minutes. I feel naked without those chat programs open, but they don't distract me from my goal at hand - writing this post.
I still have plenty of other applications open - Thunderbird for my mail, more tabs than I can count in Chrome, Firefox is open for testing issues that require another Google account, PHPStorm for development and finally more terminal windows than I know - hidden behind windows and/or desktop screens.
I feel normal with these amount of applications and they aren't distractions to me.
> You may think that core competency behind NADD is multitasking – and its true. NADD sufferers are amazing multitaskers – but that isn't their fundamental skill. **It is the context switch.**
> Page 229 - Managing Humans
Just now while I was formatting that above quote, Slack went bold which indicated a notification. I am in 11 Slack teams on this computer and while 6 of them had a notification icon, only one had an alert - a direct ping. Slack popped up over this tab that I'm using to write this post and I answered the Slack message. It took about 20 seconds and I'm right back to writing this post.
I switch among tasks without thinking about it and my brain has been working to do that for longer than I can remember. My desktop may look messy, but there is organization to the digital madness. I know where things are and I frequently reorganize my digital desktop to leverage frequently used files & applications.
I love this style of work and I think my employer does as well. I power through a variety of tasks, because I have them all open. I don't think I have ADHD, because I chose to give my attention to something and hold it there. I just have so many things going at once that my focus jumps consistently.
## The Bad
With all those paragraphs above, I've seem to put NADD humans on a pedestal above others. That is not the case, because there are a bunch of downsides with this style of living.
Figuring out my own schedule is not easy. I left a piece of food in the microwave for 20 minutes yesterday morning, when it was done after 30 seconds. This is because I sat down at my computer and noticed I was being charged an extra $5.99 for something I did not agree with. In that 20 minutes, I did a support chat - argued with someone and then cancelled my business with that company.
Sometimes I come off as a know-it-all ass. This isn't intentional, but just this morning I've already read the 10am front page of [Hacker News](https://news.ycombinator.com/?ref=connortumbleson.com). I read the articles about [Stephen Hawking’s final paper](https://www.nytimes.com/2018/10/23/science/stephen-hawking-final-paper.html?ref=connortumbleson.com) & the news that the [Hubble is back in business](https://www.nasa.gov/feature/goddard/2018/update-on-the-hubble-space-telescope-safe-mode/?ref=connortumbleson.com). It may be today or next week that I enter a conversation about one of these topics but now that knowledge lies in my brain - until I forget it.
Finally, I suffer with patience for those who don't act in this aggressive consumption of content life style. It isn't fair to those who I lose patience with, but much like bad habits - its tough to break. I feed this NADD affliction daily which doesn't help when I cross path with someone who doesn't.
I've made a surprisingly embarrassing technique for this when I know I don't want to upset the other party. I just take a walk before whatever engagement is happening. This slow paced walk with no distractions slows down my body and allows me to focus in the upcoming situation.
## In Closing
I started writing this post at 1:06pm and the clock just struck 2:02pm. I'm not done writing yet, so probably a 3-10 minute buffer at the end. To summarize my thoughts - I think a healthy amount of NADD in everyone's life would be beneficial. The benefits of nearly instant context switching is a great help at work.
There are plenty of downsides though, which might explain why all my Tinder dates don't go well.
If any of this reminds you of your life - you might be NADD afflicted. There is nothing wrong with that.
Thanks to [Michael Lopp](https://www.amazon.com/Michael-Lopp/e/B001JP9ZV0?ref=connortumbleson.com) for the "[*Managing Humans*](https://www.amazon.com/Managing-Humans-Humorous-Software-Engineering-dp-1484221575/dp/1484221575/ref=mt%5Fpaperback?%5Fencoding=UTF8&me=&qid=&ref=connortumbleson.com)" book which gave the idea for this blog post.
### Why is The Lottery getting bigger?
URL: https://connortumbleson.com/2018/10/21/why-is-the-lottery-getting-bigger/
Last updated: 2025-02-04T11:44:00.000Z
Photo by [dylan nolte](https://unsplash.com/@dylan%5Fnolte?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I bought my first 5 lottery tickets ($10) a couple days ago for the $960 million jackpot. I heard it on the news and figured it was worth a random shot in the dark. No one won, so this week is a $1.6 billion jackpot. I wondered why these jackpots were so high, this wasn't common to hear so something had to be different.
I found an image that described and showed the chances of winning. If you are interested in the jackpot, you are out of luck. I can't even come up with a good analogy for what one in 302 million odds are.
Chance % - Oct. 21, 2018
> Players may pick six numbers from two separate pools of numbers - five different numbers from 1 to 70 and one number from 1 to 25
>
> [source - Mega Millions](http://www.megamillions.com/how-to-play?ref=connortumbleson.com)
The math isn't too hard to do if you remember permutations and combination class. You just break the problem down into different thinking.
- You want how many combinations of 5 numbers can be drawn from 70 unique numbers.
- You want how many combinations of 1 number can be drawn from 25 unique numbers.
From there you can calculate each chance of winning (all 5 white balls + gold ball).
I got curious why the lottery doesn't get higher more often. After viewing old versions of the website, I found a change occurred around October of 2017.
Chance % - Oct. 7, 2017
So the lottery became more difficult to win the grand prize. My thought behind this is that not everyone has "lottery fever", I venture to say most people go day to day without having a clue when the next lottery drawing is. If the lottery wants to attract attention, they need to hit the news – which means larger jackpots.
The larger jackpot attracts attention of all walks of life. What is $2 to spend, if the payout is life changing? This means that more flock to the lottery increasing the jackpot, but also more entries equals more chances at a possible winner.
The last time the lottery was this high, 3 people won at once. I'll take a random guess and say we will have multiple winners on this next drawing. Until then, I'll take 5 tickets and join the fever.
### The end of Google+
URL: https://connortumbleson.com/2018/10/15/the-end-of-google/
Last updated: 2025-02-04T11:44:01.000Z
Photo by [Paweł Czerwiński](https://unsplash.com/@pawel%5Fczerwinski?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
In early 2011, Google+ launched. I assume in response to the Xanga, MySpace then Facebook era. I joined Google+, because of the interesting "circle" features it provided. I could separate my online life from my online school life, which was a big deal for me. I didn't want my friends to know that I spent hours daily doing some nerd things, while at the same time didn't want my online friends to know that I was some kid still in school.
My first Google+ message, September 25, 2011.
Before this social network is gone forever, I'm going to list some random topics I talked over the years.
- November 4, 2012 - Purchased my first video game soundtrack (Halo 4)
- November 14, 2012 - Getting access to the Apktool Google Code project
- December 18, 2012 - Showing off my Samsung S3 (MIUI Port)
- February 2, 2013 - I released Apktool v1.5.2
- May 15, 2013 - The new Google+ layout is released
- September 10, 2013 - Joining the Fayetteville Ingress Resistance
- March 2, 2014 - I upload photo of myself to private Ingress circles
- November 17, 2014 - Launched a new blog as it was difficult to blog on G+
- February 14, 2015 - Showed off my "PandaLove" PHP project
- February 1, 2016 - Ranting about open source projects
- December 20, 2016 - Ingress rant about spoofers.
- March 4, 2017 - Ingress rant about spoofers
- October 30, 2017 - Step down from Ingress Brand Ambassador
- January 27, 2018 - Ingress rant about spoofers
- May 30, 2018 - Story about drunk guy at airport
- October 9, 2018 - Post about internal project
Since the beginning of my Google+ experience, I attempted to only post about topics that were interesting to somebody. Release notes, rants and/or topics about projects I was interested in. Since those posts only went to the interested parties, I could keep things separated. All of this fun over the year is coming to an end.
> **Finding 1:** There are significant challenges in creating and maintaining a successful Google+ product that meets consumers’ expectations.
>
> **Action 1:** We are shutting down Google+ for consumers.
>
> [Google Blog (source)](https://www.blog.google/technology/safety-security/project-strobe/?ref=connortumbleson.com)
This is not something I am happy about, but nothing free last forever and Google has a big pattern of killing off projects. Who remembers
- Google Wave (Replaced by Google Docs)
- Google Videos (Lost to YouTube)
- Google Answers (Lost to StackOverflow)
- Google Buzz (Replaced by Google Reader)
- Google Reader (Lost to competition)
- and many others.
I don't want to go back to Facebook due to the cringe worthy content from my past friends and Twitter no longer shows me things in [chronological order](https://connortumbleson.com/2018/05/27/the-death-of-chronological-order/). I might have to leverage a bit of Reddit, Instagram and various chat applications to fit the spot that Google Plus is leaving.
### The Most Important System
URL: https://connortumbleson.com/2018/10/08/the-most-important-system/
Last updated: 2025-02-04T11:44:01.000Z
Photo by [Meta Zahren](https://unsplash.com/@aurificina?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Roughly 2 months ago I was walking in the park with my 20 pound weight backpack. I was busy playing Ingress and walking deeper into this park. The trails at the back were a swamp, slightly muddy from whatever rainstorm happened around that time.
I began stepping over larger and larger branches, until I slipped. Falling backwards with a large weight pulling me down. A little pain, but I got back up and continued my journey.
Days became a week and I had this strange pain in my back. I thought it would heal itself, but after another week or two passed - this didn't seem to be the case. I live next door to a chiropractic place so figured it would be a good place to start. The first session consisted of x-rays which on my next visit resulted in the outcome of a stress fracture in my lower spine.
They weren't positive on that though, so we were going to wait on radiology to confirm. The confirmation came back and rejected that, which was good to hear. I didn't have a stress fracture, but still had a ton of spine pain. At this point, it was time to schedule an MRI.
My first MRI ever and boy those machines are loud. A bunch of large metal circles spinning around really make some noise. At this point nearly 3-4 weeks after this fall in a park, I was in pain. Sitting hurt, driving hurt and generally anything that wasn't laying down - hurt.
The MRI came back with the official news - A herniated disc and a bulging disc both in my lower spine (L4-L5 & L5-S1). Knowing the diagnosis doesn't help cure the pain though, the 15 sessions of Physical Therapy over 4 weeks is going to cure that.
I've only been through one session and I've failed my body. I am active (I think), I play soccer, I swim, I run, I walk, I hike with heavy weights. Yet, my first session of PT put me through so many stretches and activities that I could barely do. The human body is a complex system that we (I) must take care of. Once I get through this recovery, daily stretches and preventive care will be my top priority.
Spending money for recovery and being a useless crippled young adult is beyond annoying. The human body is the most important system and I won't forget that again.
### Winners and Losers
URL: https://connortumbleson.com/2018/09/30/winners-and-losers/
Last updated: 2025-02-04T11:44:01.000Z
Featured image from the [Facebook post](https://www.facebook.com/photo.php?fbid=10216718689696576&set=a.1124654793522&type=3) of Diane Tirado.
I heard a story on the [radio](https://connortumbleson.com/2018/05/13/revisiting-the-radio/) about a teacher who gave 0% to students for not doing their work. She got fired for not listening to the district "50%" minimum rule. There might be more to that story, but what went viral is that portion.
> Port St. Lucie teacher Diane Tirado taught U.S. history at West Gate K-8 School until she was fired on Sept. 14, she told WPTV. She said her school has a "no zero" policy that requires educators to give students at least a 50 percent grade for all assignments - even if the students don't turn in any work at all.
> [Source ](https://www.knoxnews.com/story/news/2018/09/25/florida-teacher-says-she-fired-not-crediting-students-unsubmitted-work-port-st-lucie-wptv/1421953002/?ref=connortumbleson.com)\- Knox News
In my days in school, zeros were very much a thing. I forgot plenty of assignments, whether from a genuine forgetfulness or intentional choice to not do an assignment. I was left with a 0%, which meant different things as school progressed. In some years of school, missing assignments meant spending your recess inside. This meant the one activity that most looked forward too was attached to doing your homework.
Once middle school was reached, the idea of recess was gone. Not doing an assignment was a 0% for that assignment. Thankfully with assignments nearly daily, you could miss a few assignments without a problem. This is where things got interesting – there are students in every school who never do homework. This might be a problem at home or something in that child's life that is preventing them from sitting down and doing homework. I remember those kids, until they were no longer at our school.
My district back in Kansas had a school that was unlike the others, it started later in the morning and had a different style of teaching. It had very small class sizes and wasn't something you could attend - you were asked to go there. When a student failed to preform at any of the high schools in my childhood, they were asked to switch schools to this strange one. This wasn't falling one test, but repeat failures and no path to success in the original school. In the big picture, this other school was better equipped to handle the learning style they needed - whether it was later start, personalized teaching or a different medium to learn.
The students who went there were usually mocked, because it was known among the kids as the stupid school. However, those kids would be back at our main school during any big assemblies, graduation, etc. They were still part of our school, but not learning at our school. My guess at the legal level is by teaching at a different building, their grades didn't count for the original school they attended. This allowed all the high schools to maintain the "[Blue Ribbon](https://www.publicschoolreview.com/kansas/blue-ribbon-public-schools?ref=connortumbleson.com)" as the students who would destroy that badge were moved to a different school.
Bringing this back to the original point, let me think about this from a work perspective. If I showed up and did nothing (0%), should I get paid (50%)? In an hourly based job, it would be outrageous to not show up for work - yet get 50% of the pay. There would be no incentive to work at all, you could do nothing and get 50% pay.
Photo by [Ariel Besagar](https://unsplash.com/@arielbeagar?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I see a similarity in children sports with regard to partial success for failure. I was busy playing Ingress at a park and witnessed a line of players (in different jersey) colors walking up to get a medal. Perhaps this was the away and home jersey arrangement, but it sure looked like two different teams were receiving medals from the same person. Was this a 1st/2nd place of a major tournament? Participation trophy for end of season? Who knows.
I do know that in my years of competitive soccer, the losers sat and watched the winners get medals/trophies as 2nd place got nothing. We tried and lost - there was nothing wrong with that. It taught us to get better, train more and goof around less to better.
What are we starting for the next generation if they get something for nothing? That is what this boils down to and as you can tell - I'm not too happy about it.
### The Safety of Repetition
URL: https://connortumbleson.com/2018/09/24/the-safety-repetition/
Last updated: 2018-09-24T00:57:01.000Z
A couple days ago I went to [Which Wich](https://www.whichwich.com/?ref=connortumbleson.com), walked right in and grabbed the Italian sandwich bag. I filled it out and ordered my food and left. I didn't look at the menu, I didn't try a new ingredient or topping. I got the same exact thing I do any other time I visit. This pattern is everywhere in my life from sports bars, restaurants and fast food.
With that in mind, this applies to not only the items at a place, but the place itself. I don't experiment, I find a place and continue to visit it. Once a place disappoints me, I generally never return.
I have a sushi place in walking distance, I used to love it. The owners sold it and new management took over. I tried the place multiple times after they took over and never enjoyed it. It hurt because this meant my safety net for the occasional urge for sushi could no longer be fulfilled at a place I knew. So I began looking and ran into a new, arguably creepy feature of Google Maps.
There was a new tab called "For you", so I tapped it.
Google knew from my many lunch trips to a Cuban place that I might be interested in a new location. I haven't tried the place so I can't comment, but I wondered what Google put for a place I really enjoy.
It was accurate, creepily accurate. I go to this location every few weeks and never have a bad experience. So Google is letting me of new locations that it thinks I will like. I haven't given Google a chance but perhaps I should.
Featured photo by [Matthew Hamilton](https://unsplash.com/@thatsmrbio?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### An Addiction Ended
URL: https://connortumbleson.com/2018/09/16/ending-an-addiction/
Last updated: 2021-01-20T23:55:06.000Z
I started playing Destiny on September 9, 2014 and had no idea what I had just begun. It took three years for me to put the game down.
> Destiny is an online-only multiplayer first-person shooter video game developed by Bungie and published by Activision. It was released worldwide on September 9, 2014.
I played **2,246 hours** over 1,070 days which is roughly **2.09 hours a day**
This is shown via [time wasted on destiny](https://www.wastedondestiny.com/xbox/ibot?ref=connortumbleson.com). This also showed the breakdown per class of character.
- 903 hours - Titan
- 702 hours - Hunter
- 640 hours - Warlock
Destiny brought competitive multi-player & team based combat against the computer. This pair of PVP (Player vs Player) & PVE (Player vs Environment) was a combination that kept me hooked. Whenever bored of the other activity, I could swich to the other.
I was still in college when this game began, which became an outlet to connect with friends. We played a lot together and sometimes I played too much.
For a few days out of the past 3 years I played more than 13 hours in a day. I am not a streamer, I was not paid to play. I was simply addicted.
- Jan 10, 2015 - **13 hours 38 minutes**
- Sep 18, 2015 - **16 hours 25 minutes**
- Oct 24, 2015 - **14 hours 5 minutes**
I additionally had 21 days between 9 and 12 hours of game play. So where was I fitting all this time playing?
The clan I was a part of - that I designed quite a website for - [PandaLove](https://connortumbleson.com/panda-love-project/) did something we called "Raid Tuesday". Tuesday was the day the game "reset" and allowed you to do activities again earning gear. So at 4am CST every Tuesday that reset would happen.
Our group was spread among 3 timezones, so Raid Tuesday became a thing. Every single Tuesday our group did the hardest available content. Blasting through it from 4am CST until someone had to leave. I embarrassingly skipped class a few times as a victory in these complicated challenges felt more successful than sitting in a boring class.
As we completed these challenges, we began taking "group" photos.
This was a way to remember the members of the group who completed the activity. This was a PVE activity (as mentioned earlier) so what did I do for PVP?
Destiny had something called Trials Of Osiris which began at 1pm on Friday and lasted till "reset" (Tuesday 4am). This was the competitive PVP itch I needed to scratch. Grab two other friends from the clan and you were ready to enter a 7-9 game challenge to attempt to win. Winning in this mode was visiting the "Lighthouse", an area reserved for those who went flawless in victory.
This area shown above was my addiction. Three characters meant three chances a week to reach that area. That was at minimum 21 games required, however this game mode only launched at 1pm Friday ending at the 4am CST reset on Tuesday. This basically meant you had the weekend and Monday to complete this task.
I didn't always succeed, which led to retries and failure to completing all three characters in that weekend.
As shown above, I played a bit too much of this game mode logging nearly 4,400 matches throughout my time, but keeping a 1.6 kill/death ratio throughout that time frame wasn't easy either. I've [talked about](https://connortumbleson.com/2016/06/18/becoming-the-best/) this before, but I was in the top 1000 players on Xbox.
As friends and clan members left the game or took breaks, they lost the ability to compete at the level of competition my account would draw. Once you hit a certain rank, you recognize the other accounts at that level. Whether organizing teammates or fighting against others - you would recognize the names.
This is where mistakes really began for me. I stopped playing with the friends that I knew in real life, because it normally resulted in losing. When we did play together, I became a toxic mess attempting to reach that victory. I chose the random gamer who shared my rank instead of my friend. This continued for months until it backfired.
I don't remember the exact details, but I was in roughly the top 500 players so my teammates at this point were way better than me. They must have given up looking for players early in the morning and settled for me.
We played and played and destroyed the competition. I was climbing ranks faster than ever playing with gamers much better than myself. We then ran into a game against the #16 gamer on Xbox. My teammates were excited to play this individual, I made mistake after mistake in that game ultimately causing us to lose. These individuals yelled non-stop at me and vowed to never play with me again.
It was one loss, but it was enough to crack me from this fake charade I was living. I began playing with real life friends, losing and having fun. Losing the useless internet points I once craved. I would grab a friend and find a gamer who had never won before. This gave me the title of "Sherpa" after a few successful wins. My stats weren't great, but we had fun with friends.
Destiny then ended that game mode permanently in preparation for the 2nd iteration of the game. Without that game mode to draw me back every week, I didn't play Destiny anymore. The addiction was broken.
### The 100% Kill Rate - Rabies
URL: https://connortumbleson.com/2018/09/09/rabies/
Last updated: 2025-02-04T11:44:02.000Z
[Reddit post](https://www.reddit.com/r/rarepuppers/comments/9e8u8i/winged%5Fpupper/?ref=connortumbleson.com) via [PM\_ME\_THEM\_4\_SCIENCE](https://www.reddit.com/user/PM%5FME%5FTHEM%5F4%5FSCIENCE?ref=connortumbleson.com)
While browsing Reddit, I stumbled upon a post with someone petting a bat. I've heard all the horror stories about keeping bats, but as the title suggested, it did look like a winged puppy.
The comment section [linked to a fictional mini-story](https://www.reddit.com/r/AskReddit/comments/48ujhq/whats%5Fthe%5Fscariest%5Freal%5Fthing%5Fon%5Four%5Fearth/d0mz5uq/?st=JLUJN3AP&sh=e1f3a426&ref=connortumbleson.com) describing an infected bat biting someone at a camp site. The story was eerie, so I begun the research looking into rabies.
> Rabies is present on all continents with the exception of Antarctica, but more than 95% of human deaths occur in Asia and Africa. Once symptoms of the disease develop, rabies is nearly always fatal.
>
> [source](http://www.who.int/news-room/fact-sheets/detail/rabies?ref=connortumbleson.com) \- World Health Organization
The good news being, there are vaccines so the deadly rabies disease only affects those who are not vaccinated.
## Infection
What helps make rabies so deadly is the infection process. A tiny scratch or bite from an infected animal is the transferring of saliva which is all it takes. It may be a week or a year before symptoms develop. This is because of the location and viral load transferred changes the time frame.
Commonly known associated with rabies is the fear of water or hydrophobia. This is part of a form of rabies known as the "furious" stage. The list below shows the two forms with the associated symptoms.
- Furious Form
- Hyperactivity
- Excitable Behavior
- Hydrophobia
- Aerophobia
- Death within days
- Paralytic Form
- Paralyzed Muscles
- Slowly onset coma
- Death
The paralytic form was often diagnosed due to the long incubation period and long slow course to death.
# The One who Lived
In the world of rabies, most are familiar with Jeanna Geise who was 15 years old in 2004, when she was bit by a rapid bat. She was unvaccinated and only visited the emergency room a month later when the symptoms worsened. This meant that the post-exposure vaccine would no longer work.
The hope was grim, so doctors began an unique treatment known today as [The Milwaukee Protocol](https://www.nejm.org/doi/pdf/10.1056/NEJMoa050382?ref=connortumbleson.com). Describing the treatment in the most basic sense was a chemically induced coma. In detail though, it was a mix of drugs including Ketamine, Midazolam, Ribavirin and Amantadine.
As her body sat in a coma, the body produced rabies antibodies allowing the body the fight back. Roughly a week later, she came out of the coma having to relearn how to talk, walk and stand. She will continue to live with balance and running issues, but is alive.
[Research papers](http://www.mjdrdypu.org/article.asp?issn=0975-2870;year=2017;volume=10;issue=2;spage=184;epage=186;aulast=Agarwal&ref=connortumbleson.com) showed that the MP (Milwaukee Protocol) is no longer an ideal treatment. Its expensive, doesn't always work and has a few ethical issues regarding the induced coma.
# Conclusion
The World Health Organization currently has a goal "Zero by 30" which is a goal to have zero human deaths by rabies by 2030\. This just comes down to vaccines and affordable methods of vaccinating animals in all parts of the world. I wish the world good luck - rabies is a deadly looking disease.
### Apktool v2.3.4 Released
URL: https://connortumbleson.com/2018/09/05/apktool-v2-3-4-released/
Last updated: 2025-02-04T11:44:02.000Z
Apktool v2.3.4 has been released! This is a release to add compatibility for the recently released Android Pie (API28).
This release also packs many fixes for the recently included aapt2 binary. As applications evolve, using aapt2 to rebuild applications will be required.
Unrelated to the features, this release was later than I hoped. My goal of a release every 3-4 months slipped for this one. We will stay on track and hopefully have another release out before 2018 ends.
This release had 34 commits by 3 people.
- Connor Tumbleson (iBotPeaches) - 31 commits
- Alexei Khlebnikov (alexeikh) - 2 commits
- sunshouxiang - 1 commit
# Changes since 2.3.3
- \[[#1864](https://github.com/iBotPeaches/Apktool/issues/1864?ref=connortumbleson.com)\] Android Pie Support
- \[[#1776](https://github.com/iBotPeaches/Apktool/issues/1776?ref=connortumbleson.com)\] Fixed issue rebuilding applications in `aapt2` with `$` or `_`.
- \[[#1809](https://github.com/iBotPeaches/Apktool/issues/1809?ref=connortumbleson.com)\] Fixed process executor to wait for response when identifying aapt versions. (Thanks sunshouxiang)
- \[[#1843](https://github.com/iBotPeaches/Apktool/issues/1843?ref=connortumbleson.com)\] Fixed issue with 0 byte file being detected as not compressed. (Thanks alexeikh)
- \[[#1817](https://github.com/iBotPeaches/Apktool/issues/1817?ref=connortumbleson.com)\] Updated aapt2 builds to latest `android_9.0.0_r3` build tag.
- \[[#1889](https://github.com/iBotPeaches/Apktool/issues/1889?ref=connortumbleson.com)\] Align codebase so `aapt` and `aapt2` are built from same code.
- \[[#1884](https://github.com/iBotPeaches/Apktool/issues/1884?ref=connortumbleson.com)\] Upgrade Gradle to v5.0 to fix Java warnings.
## Notes
Version 2 of aapt is still relatively new. There will be issues, so it still is not the default binary for rebuilding applications. If you experience issues with `aapt`. It is recommend trying another build with `--use-aapt2` to see if that resolves anything.
The next release of Apktool will be 2.4.0, packing an interesting feature with official support for certain Android devices. Thanks to dongfangxunlei for leading this effort.
## Download
- [Apktool 2.3.4](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.3.4.jar?ref=connortumbleson.com)
- md5 `ea45fba42cc01f82b7b805a1823af211`
- sha256 `758b1bd58f9c9dd5ca85258d31c75f32e5878a502e3d75c66f3bfacf74b9dc1d`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Halo MCC Revisited
URL: https://connortumbleson.com/2018/09/02/halo-mcc-redux/
Last updated: 2025-02-04T11:44:02.000Z
Splash Screen for Halo MCC, copyright 343
Nearly 4 years ago, I started a blog post called "*Ship Broken. Patch Later*", it was a draft that never went public describing the frustration of the video game industry back then. Major AAA title games launched with serious problems that took months to years to resolve.
In the extreme case of Halo MCC (Master Chief Collection), I could not even get into a match for 7 days straight after purchasing the game on day zero. It was a bleak time for the game, but patches kept coming in hopes to fix the bleeding pig.
---
- [November 14, 2014](https://www.halowaypoint.com/en-us/news/halo-the-master-chief-collection-content-update-11-14-14?ref=connortumbleson.com) (Day One Patch)
- [November 20, 2014](https://www.halowaypoint.com/en-us/news/11-20-14-halo-the-master-chief-collection-content-update-notes?ref=connortumbleson.com) (6 days later)
- [November 26, 2014](https://www.halowaypoint.com/en-us/news/11-26-14-halo-the-master-chief-collection-content-update-notes?ref=connortumbleson.com) (6 days later)
- [December 3, 2014](https://www.halowaypoint.com/en-us/news/12-3-14-halo-the-master-chief-collection-content-update-notes?ref=connortumbleson.com) (7 days later)
- [December 7, 2014](https://www.halowaypoint.com/en-us/news/12-7-14-halo-the-master-chief-collection-content-update-notes?ref=connortumbleson.com) (4 days later)
- [December 15, 2014](https://www.halowaypoint.com/en-us/news/12-15-14-halo-the-master-chief-collection-content-update-notes?ref=connortumbleson.com) (8 days later)
- [December 22, 2014](https://www.halowaypoint.com/en-us/news/12-22-14-halo-the-master-chief-collection-content-update-notes?ref=connortumbleson.com) (7 days later)
- [January 19, 2015](https://www.halowaypoint.com/en-us/news/the-latest-on-halo-the-master-chief-collection-content-playlist-updates?ref=connortumbleson.com) (28 days later)
- [March 3, 2015](https://www.halowaypoint.com/en-us/news/3-3-15-halo-the-master-chief-collection-content-update-notes?ref=connortumbleson.com) (43 days later)
- [April 21, 2015](https://www.halowaypoint.com/en-us/news/4-21-15-halo-the-master-chief-collection-update-notes?ref=connortumbleson.com) (49 days later)
- [May 30, 2015](https://www.halowaypoint.com/en-us/community/blog-posts/5-30-15-halo-the-master-chief-collection-update-notes?ref=connortumbleson.com) (39 days later)
- [August 27, 2018](https://www.halowaypoint.com/en-us/news/mcc-update?ref=connortumbleson.com) (1185 days later)
The list above shows that 343 tried to fix things. A patch basically weekly for 6 straight weeks. These patches did fix some of the most crazy bugs this game suffered.
- Matchmaking would no longer split your party. (11/14/2014)
- Communiticating the status of matchmaking to stop people in an endless loop of joining/leaving matchmaking (11/20/2014)
- Fixed the issue that allowed players to "boot" others from matchmaking (11/20/2014)
- Allowed games to start once minimum players found (12/3/2014)
- Fixed parties being broken after a matchmaking game ended (12/7/2014)
Releases kept coming, including some patches that had features! Halo 3: ODST launched in the May 30, 2015 update. This was an apology to the world for the absolute mess that was Halo MCC. Personally though, I didn't want new content. I wanted a game that worked.
> [Last month](https://www.halowaypoint.com/en-us/community/blog-posts/a-status-update-from-bonnie-ross-on-halo-the-master-chief-collection?ref=connortumbleson.com), I promised the **Halo* and Xbox community that addressing the matchmaking issues and other bugs impacting players’ experience with **Halo: The Master Chief Collection* was our #1 priority. We’ve been working around the clock deploying weekly content updates and numerous server-side adjustments that have shown good results and we’re encouraged by the feedback we’re hearing from you.
>
> [Bonnie Ross (12/19/2014)](https://www.halowaypoint.com/en-us/news/halo-the-master-chief-collection-thank-you?ref=connortumbleson.com)
Regardless of the patches made, things didn't really work. I imagine this was a by-product of weekly releases on such a large game. While games did start now, they sometimes started uneven, so a group of 7v7 might start 9v5 or something strange.
The game was still filled with bugs and queue times for most playlists took 20-30 minutes. There was only a few playlists even possible to get a game in under 5 minutes and even then the bugs started. The game might just crash during load, freeze for no reason, end at some random kill value (IE 30, instead of 50) and filled with network issues.
Custom games were an entirely different beast of bugs, you couldn't join a game in progress! This meant that if you started a game with 4 friends and another got online, you would have to end the game and go back to the lobby. This meant balancing the mess that was joining friends just to start the game.
As months went on, new games came out and the population in Halo MCC suffered. Months became years and while the collection of Halo campaigns was still working, multiplayer in Halo MCC was a complete failure.
## The Hope
Rumors in September of 2017 started hinting that 343 was looking into MCC again. These were of course just rumors until Frankie (Frank O'Connor), the Franchise Development Director released a [post with lots of information](https://www.halowaypoint.com/en-us/forums/84ad72a8b51847978545f685f651fc15/topics/halo-mcc-what-happened-and-what-happens-next/32dd5e4a-1001-4aae-b51b-22c091e8d21a/posts?ref=connortumbleson.com).
> I’d also like to be clear, up front about what’s not contained here – there’s no excuses. We’re explaining some of the issues in more depth than we have before, in part because we now have the resources, OS and capability to make meaningful changes. So please don’t mistake explanations for excuses – we’re trying to be as transparent as possible, but there are loads of proprietary things we can’t talk about at a granular level.
>
> [Frank O'Connor (10/20/2017)](https://www.halowaypoint.com/en-us/forums/84ad72a8b51847978545f685f651fc15/topics/halo-mcc-what-happened-and-what-happens-next/32dd5e4a-1001-4aae-b51b-22c091e8d21a/posts?ref=connortumbleson.com)
This post explained lots of things, including why 343 just stopped doing updates. After this there wasn't a real official update until January 31, 2018 when the [first](https://www.halowaypoint.com/en-us/news/mcc-development-update?ref=connortumbleson.com) of five development update posts went live.
Frankie did not lie, these posts were highly technical and dove down into the nitty gritty of the problems at hands and the solution they planned to take. These posts showed things I never expected 343 to disclose.
[diff for elite\_stealth.character from H2V vs MCC](https://www.halowaypoint.com/en-us/news/mcc-development-update-4?ref=connortumbleson.com)
The developer updates even included screenshots of the internal of game development. I [used to mod the earlier](https://connortumbleson.com/2016/05/06/phantom-mappack-project/) Halo's, so it was great to read an official source of things we used to change.
The 5th developer update even had a shout out to us modders.
> The problem with adding or removing assets to Halo 3 is that you run the very high risk of breaking map variants. Since the 360 days, and up until my fixes go live, Halo 3 map variants embedded content IDs for the things which are placed in them. Content IDs are dependent on the order in which content is linearly added to a map file. **Modders know these as “tag indicies”**. To ship MCC originally, a hard coded table was made to map a 360 content ID to the content ID which it is assigned to in MCC. That lets you ship, but that doesn’t solve the problem. If you add or remove content those IDs shift. Here, I’m trying to add back content to make Halo 3 be Halo 3 again. So we have to be more…indirect.
>
> [The Scoop (5th Development Update)](https://www.halowaypoint.com/en-us/news/mcc-development-update-5?ref=connortumbleson.com)
A company now unafraid to discuss problems, solutions and attempted solutions was something you rarely see. 343 even posted blooper videos of attempts to fix MCC!
## The Test
On August 27, 2018 the [update launched](https://www.halowaypoint.com/en-us/news/mcc-update?ref=connortumbleson.com) at a massive 73 gigabytes. It was basically a new release of the game. Impossible to download 73gb on my connection in reasonable time. I went to bed then work, looking forward to playing on August 28.
Game after game I played without error. I couldn't believe it. The nostalgia of playing Halo CE, Halo 2, Halo 3 & Halo 4 was back. I had zero crashes, one game with a toxic teammate and loved every bit of game. It took basically 4 years after paying $60, but the game was fixed.
The days of Nintendo 64 games are gone, where a company would have to spend years perfecting a game because they had no ability to push OTA (Over the Air) updates. We have DLC, updates, patches and more now to bridge the gap between a released game and a completed game.
343 is not the only company to seriously mess up a release of a game and won't be the last. I'm glad they did the right thing and fixed what was needed at $0 to the consumer.
You are earned my business back 343\.
### Moving to Ghost v2
URL: https://connortumbleson.com/2018/08/26/moving-to-ghost-v2/
Last updated: 2025-02-04T11:44:03.000Z
Photo by [Ash Edmonds](https://unsplash.com/@badashphotos?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I started this blog on Wordpress nearly 10 years ago. It was started in August in 2009 and has evolved a few times. A big step today was the upgrade to Ghost v2\. While the [release notes](https://blog.ghost.org/2-0/?ref=connortumbleson.com) show off the feature changes, this blog serves as a tiny reminder that things are always evolving.
WordPress used to be the defacto blogging software, but today WordPress runs a scary amount of the web. The drive to never break anything has given WordPress a large market share. You can install a 2 year old plugin on a current WordPress install and it will probably work. It may throw some warnings in [developer mode](https://connortumbleson.com/2018/03/11/the-internals-of-a-premium-wordpress-theme-gonzo/), but the production version of that plugin will still operate. Without forced change, WordPress has gone from a slim blogging tool to a full blown e-commerce landing page website starter kit.
WordPress simply was not for me anymore. So I moved to Ghost, then Ghost started looking a bit dated compared to the ever popular Medium.com. Individual bloggers to large corporations had blogs there, but due to the closed source feel of it - I stayed with Ghost.
Ghost hit v1.0 and added some cool features, but broke a good deal of things. A requirement on some node CLI tool to install/update was proving to be difficult to run on a server setup that I thought was fairly common. It took some hacking of the script and my server with 3 different Ghost blogs was up and running. I reported a [bug](https://github.com/TryGhost/Ghost-CLI/issues/388?ref=connortumbleson.com) and recently saw [another](https://github.com/TryGhost/Ghost-CLI/issues/745?ref=connortumbleson.com) reported with a similar problem, for these reasons I feared the next upgrade.
Breaking things though is how you grow without technical debt and Ghost is free. If I have to spend a few hours every few months to fix something, that isn't too bad. I cannot complain given how I don't pay for this software, so I'm happy reporting a bug/feature and hacking scripts so they work for myself.
Now Ghost v2 is out and it launched with a new editor & allowed native spell check to work. This editor reminds me of Medium.com editor along with the upcoming [Wordpress 5.0 - Gutenberg](https://wordpress.org/gutenberg/?ref=connortumbleson.com) editor. The world is moving towards "block" based writing, where text is supplemented with interactive elements.
So to end this post, I picked a random Instagram image of mine and dropped the link below. Ghost will do the rest and display it, but now I've placed a dependency on a service that may not be around in a few years.
> [Just another day on the water. #hurricaneseason #boat](https://www.instagram.com/p/BjVQTTIAIZp/?utm%5Fsource=ig%5Fembed)
>
> A post shared by [ Connor Tumbleson](https://www.instagram.com/ibotpeaches/?utm%5Fsource=ig%5Fembed) (@ibotpeaches) on May 28, 2018 at 12:01pm PDT
### Instant is Preferred.
URL: https://connortumbleson.com/2018/08/20/instant-is-preferred/
Last updated: 2018-08-22T01:19:24.000Z
Featured photo and above by [Cris Ovalle](https://unsplash.com/@crisovalle?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Today I opened up Uber Eats, because support was finally added for my home location. I had plenty of food in my fridge and the ability to walk to my next door grocery store, but the list of food nearby with delivery was tempting.
The application even was tempting me with ordering within five minutes to get a $2 cheaper fare. I refreshed the application a few times and the five minute countdown would restart. The list of restaurants sometimes changed, so it must be a nice marketing trick in order for me to order.
Scrolling the list of all food places is fun, seeing a menu of all nearby places is tempting. Trying the buffalo chicken sandwich from every nearby place is something I would seriously do, but I'd much rather go in person than have the delayed and sometimes stale delivery option.
---
Moving from Uber Eats, I ordered another battery pack for my phone on Tuesday of last week. It wasn't until 4 days later on Saturday that I got a text that my order was shipped. A bit maddening, but the estimated delivery was Sunday (the next day). Times have changed with deliveries coming on Sunday and sure enough around 9am the package arrived.
The delivery including the days it didn't ship, equals the estimated free delivery of 5-7 days. Hopefully Amazon didn't intentionally hold the package for no reason in order to entice me to pay for quicker shipping.
Though quicker shipping is beyond tempting. There are some things you can order and receive same day! This means you click a button on a website and in real life someone shows up with the object at your door. This box used to be a brown box full of shipping labels. Shown below is the box I received.
Advertising has entered this field of quick shipping, whether I like to admit it or not. My eyes read this box and thus vaguely remember the name "Ace Snacks". It sits in my brain and if I ever see it again, I will make the connection. If I find myself in a situation where I might purchase snacks and "Ace Snacks" is an option then this form of advertisement worked.
Things are becoming faster, whether it is my Internet speed or method of shipping packages. Speed costs either money or my attention, both of which are very important. I think Amazon Prime is changing a field along with Uber Eats, I'm very interested to see how things are in a few more years.
### The Slow Death of Passwords
URL: https://connortumbleson.com/2018/08/13/the-slow-death-of-passwords/
Last updated: 2018-08-22T01:19:24.000Z
My first online account consisted of nothing more than a username and a password. The username being some strange alias I made up, fearful of using my real name online. The password was just my first name, an all lowercase six letter word.
The pattern of just username & password has quickly been strengthened with additional methods. We are going to take a look at a few of them and examine the strengths and weaknesses of each one.
### Knowledge Based Authentication (KBA)
This method is incredibly common in the credit & banking industry. You would be presented with a small multiple choice questionnaire. The questions would be something like, "*Select the county you previously lived in*". The more questions you add, the arguably more secure it becomes.
- **Pros**
- Additional layer of security
- Prevents malicious actors from impersonating others
- **Cons**
- Knowledge is not private. It can be found.
All in all, this method relies on the individual history of people remaining secure in the system they live. With more and more services going online and another data breach weekly, this method of authentication will probably cease to exist in a few years.
### Security Questions
This method has grown to a variety of industries. It basically works by giving you (the user) a set of questions. You pick one of them and answer it however you wish. During a login session, those selected questions will be presented and must be answered. For example, one of my questions was "*What was the name of your childhood friend?*". This question sucks though for a variety of reasons. I've had so many childhood friends, I even forgot what I put!
- **Pros**
- Additional layer of security
- Questions can be answered truthfully or not. It doesn't matter.
- **Cons**
- Truthfully answered questions are just another form of knowledge based authentication.
### 2 Factor Authentication (2FA)
A common method used on millions of sites these days. Commonly text (SMS) based 2FA has been used, which sends a random code to the phone number registered. This code must be entered within a few moments during the sign in procedure.
2FA additionally has non-phone based methods, software applications can act as time based tokens which refresh every 30 or so seconds.
- **Pros**
- Additional layer of security
- Can be cloud based
- **Cons**
- Losing non-cloud based 2FA device can be painful
- SMS can be social engineered
- Cloud based 2FA could be stolen
### Hardware Enigma
Hardware based sign in techniques have existed since I joined the Internet and that was way back in the 1990s. While the hardware of the past was more a time based token with digital display the new generation dabbles in cryptography with a USB connection.
I have two hardware authentication devices, they are sometimes clunky, but the idea is basic. They must be plugged in, otherwise I cannot sign into my account.
- **Pros**
- Not at software level.
- Easy to use, when it works.
- **Cons**
- Wireless vs Wired acts differently
- Steal the hardware and done?
---
Theres just a few of additional authentication measures set out to aid or even replace passwords. There are plenty we didn't even talk about from biometrics, face recognition and simple mobile phone prompts. I wonder what new types of authentication will appear in the next few years.
Featured photo by [Matthew Brodeur](https://unsplash.com/@mrbrodeur?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### Wires in an Increasingly Wireless World
URL: https://connortumbleson.com/2018/08/05/wires-in-an-increasingly-wireless-world/
Last updated: 2018-08-22T01:19:24.000Z
Featured photo & above photo by [Jaz King](https://unsplash.com/@jking?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Almost two years ago, Apple released the AirPods (The headphones in above image). There were plenty of wireless headphones in the market, but these took the market to the next level. Adding location functionality to find lost ones and a charger that doubles as a location to store them. I don't have these headphones, but I see plenty on the streets and they are easy to spot.
I used to be a major fan of wireless products. They fit my vision of having a minimal desk, apartment, TV, etc. The wireless internet for my Xbox allowed me to hide a crucial cable that would otherwise be spotted. Wireless mouse and keyboard allowed my peripherals to stay on my desk without any cable leading anywhere. A wireless charging pad to prevent having to plug my phone in to charge. This design pattern allowed me to keep a very organized look.
I abandoned that train of thinking and now nearly everything I own is wired for a variety of reasons.
#### Batteries
Too many times some device ran out of AA/AAA batteries and I needed to replace them. More than I'd like to admit, I would have none of those batteries in stock. My options were either an annoying trip to the store or borrow another pair of batteries.
I remember borrowing batteries from my TV remote so my computer mouse would work. This become annoying not only from the replacement factor, but the almost weekly spending on batteries.
#### Connection
While this was a rare occurrence, my wireless mouse after waking the computer would randomly not connect. I'd have to manually reconnect to the Bluetooth device, which was just an annoying amount of steps for my crucial peripheral to work.
Additionally, while Wi-Fi is incredible for phones and tablets it isn't the best for devices that sit stationary. My living space didn't make this feasible to wire up all devices until I had my ISP make some Ethernet ports around my place live. With wired devices on my network, I had less devices on the Wifi so benefits all around.
#### Response Lag
Before I switched to exclusively using a wired Xbox controller, I began noticing that my input response in first person shooters was lacking. I could see something on the screen, react from it, click a button and still fail. When my batteries died one time, I connected a "Play n Charge" kit, since I had no rechargeable batteries it just became a wired controller. It was night and day difference in my reactions and it showed in my gaming.
---
In closing, There are probably plenty of instances where wireless devices have the time and place, but those are very rare for me these days. I'll take the cheaper, quicker and less error prone of old fashion wired devices.
### Deadly Colors
URL: https://connortumbleson.com/2018/07/29/deadly-colors/
Last updated: 2018-08-22T01:19:24.000Z
Featured & above photo by [Ricardo Gomez Angel](https://unsplash.com/@ripato?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
I recently got a box of crayons. It was an inside joke from a coworker and I looked at mini rainbow of colors in a box. I knew that each crayon was a bit of colored wax, but how did colors get created without modern technology? I'm not talking about discovering the color orange, but how did orange plates exist in the 1930s?
There was no food dye or coloring agents, so this interested me. I began researching and stumbled upon some dangerous colors. So we will take a look at a few colors and see what made them so deadly.
### Uranium Orange
There is a company known as Fiestaware and they produce dinnerware and have been around since 1936\. A lot of time has passed since then, but based on the snapshot below, I'm sure you recognize the brand.
[source: fiestafactorydirect.com](https://fiestafactorydirect.com/?ref=connortumbleson.com)
These colorful plates I personally recognize from many dinner meals, but we are going to talk about the orange color glaze they used from roughly the 1930s to the 1970s.
Back then the world looked towards uranium oxide in order to produce shades of the color orange. Fiestaware used this oxide to produce "Fiesta red" which was an orange-red color that [launched sometime in 1937](https://www.orau.org/ptp/collection/consumer%20products/fiesta.htm?ref=connortumbleson.com).
What surprised me is that in 1943 the US government confiscated all uranium in order to be used in weapons, which halted the creation of this glaze. What was returned in the 1950s was depleted uranium, which was then used to continue making plates. You would think that elements used in making weapons isn't the safest material to be used in a glaze that you eat off of. Either way, this is what caused the radioactive plates, known as uranium orange.
### Arsenic Green
Our next color is green and as the name suggests involves the chemical element: arsenic. As early as the 1770s, colors were bland and a new shade of green known as Scheele's Green had entered the playing field. It was bolder and brighter which led to it being used in everything from soap to wallpaper.
Even in the early 1900s the toxicity and danger of arsenic was relatively unknown. Or was it? Beautiful women who wore Scheele Green, were sometimes known as "[killing](https://pictorial.jezebel.com/the-arsenic-dress-how-poisonous-green-pigments-terrori-1738374597?ref=connortumbleson.com)" it. Which was a slight shot at the fact that men who got close to her, could end up getting sick and possibly die.
[source: Smithsonian](https://www.smithsonianmag.com/smart-news/victorian-wallpaper-got-its-gaudy-colors-poison-180962709/?ref=connortumbleson.com)
Paris green (above) was produced as a poison during the same time frame that these deadly shades of green were still being worn. It surprises me that a house could have Paris Green for poisoning rodents, but unable to make the connection willingly to remove the Scheele's green tinted products/clothing they owned.
As years went on, science backed research paired with hundreds of deaths led to suspicions around the dye. It wasn't until later on in the 1900s when Cobalt Green was launched, which had all the bold color without the toxicity.
### Lead White
Our final color in this blog is the pure white, which was created via lead. The history of this color dates so far back in time that its difficult to even pinpoint when it began. Documented research show it as far back as Theophrastus, which was roughly \~320 BC.
This color was made via grounding up lead into a powder, which produced such a bright white that it attracted the use via many painters and artists. Not only the strength, but the time it maintained that color outmatched many other shades of white which seemingly decayed in the strength of white it had overtime.
[source: paintingperceptions](http://paintingperceptions.com/the-great-lead-white-shortage/?ref=connortumbleson.com)
This color stayed around until the 1970s, when it [was banned](https://www.cdc.gov/nceh/lead/tips.htm?ref=connortumbleson.com). [Lead poisoning](https://www.mayoclinic.org/diseases-conditions/lead-poisoning/symptoms-causes/syc-20354717?ref=connortumbleson.com) was no joke, due to the deadly symptoms surrounding it. Houses around the globe might still have lead based paints if built earlier than 1978.
### In closing
It amazes me that before we had chemical research to artificially create any color, compounds from radioactive materials to flat out poison were used in replacement. If you'd like to learn more, this video by TED Education summarizes everything I researched perfectly.
### Eradicating Smallpox
URL: https://connortumbleson.com/2018/07/22/eradicating-smallpox/
Last updated: 2018-08-22T01:19:24.000Z
Featured photo & above photo by [Fernando @cferdo](https://unsplash.com/@dearferdo?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
This week for a blog I wanted to take a step into the world of infectious diseases. There are a few that everyone probably knows about - smallpox, measles, polio, malaria and whooping cough. According to [World Health Organization](http://www.who.int/csr/disease/smallpox/en/?ref=connortumbleson.com), smallpox is the only eradicated disease that primarily affects humans. The only other eradicated disease, as of this post is Rinderpest, which infected cattle.
I was curious what defined **eradication**, so onward to the [CDC](https://www.cdc.gov/mmwr/preview/mmwrhtml/su48a7.htm?ref=connortumbleson.com) for an official definition.
> Eradication: Permanent reduction to zero of the worldwide incidence of infection caused by a specific agent as a result of deliberate efforts; intervention measures are no longer needed. Example: smallpox.
I began wondering what naturally caused smallpox? Outside of myths and folklore there is no real documented source. An academic paper named "[The Origin of the Variola Virus](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4379562/?ref=connortumbleson.com)" had this to say about the virus.
> Despite the distinct characteristic features of smallpox that distinguish it from the other diseases, descriptions of this disease are absent from the written sources of ancient civilizations, such as the Bible and Talmud.
So a disease that has no documented patient zero/cause is only passed via person to person contact and/or the saliva of an infected person's breath. This shows how deadly this virus was as it can travel in the air.
The last recorded case of smallpox was way back on October 26, 1977 where [Ali Mao Maalin](https://en.wikipedia.org/wiki/Ali%5FMaow%5FMaalin?ref=connortumbleson.com) in Somalia became infected. After this was vaccinated, the World Health Organization in 1980 declared smallpox eradicated.
How this is possible still confuses me. There has to be some civilization in the corner of the globe untouched by vaccines, governments and more. This fictional place may exist in which smallpox still roams, but stays contained in this unknown area.
### Is Eradication the same as Extinct?
There has been a lot of talk of whether smallpox should be extinct. This is a level above eradication where all infectious agents for scientific study are destroyed. According to public record only two locations currently have the Variola (smallpox) agent on site. This is the CDC in Atlanta, Georgia and VECTOR in Novosibirsk, Russia.
[Or so the world thought](http://www.sciencemag.org/news/2014/07/six-vials-smallpox-discovered-us-lab?ref=connortumbleson.com). In July of 2014, scientists were cleaning out a health lab in Maryland. They stumbled upon a cold storage room with some cardboard boxes. In one of those boxes six vials labeled "Variola" were discovered. Almost instantly they were moved to a high-security containment lab at the facility. The next day CDC had arrived via government plane and transferred them to the only safe facility in the United States to hold smallpox. The vials were dated from the 1950s which is a bit alarming to hear.
This awakened a committee who advises the WHO on destruction of viruses. This is the not first time nor last the fate of these samples have been discussed. It was recommended way back in 1986 to destroy all samples by December 30, 1993\. This was postponed to 1999, 2002 and then canceled as the WHO allowed temporary retention of the virus for research purposes.
The United States last public message regarding this storage happened in a [New York Times](https://www.nytimes.com/2011/04/26/opinion/26iht-edsebelius26.html?%5Fr=0&ref=connortumbleson.com) piece by Kathleen Sebelius (Secretary of the Health & Human Services).
> Although keeping the samples may carry a minuscule risk, both the United States and Russia believe the dangers of destroying them now are far greater. It is quite possible that undisclosed or forgotten stocks exist. Also, 30 years after the disease was eradicated, the virus’ genomic information is available online and the technology now exists for someone with the right tools and the wrong intentions to create a new smallpox virus in a laboratory.
> Destroying the virus now is merely a symbolic act that would slow our progress and could even stop it completely, leaving the world vulnerable. Destruction of the last securely stored viruses is an irrevocable action that should occur only when the global community has eliminated the threat of smallpox once and for all. To do any less keeps future generations at risk from the re-emergence of one of the deadliest diseases humanity has ever known. Until this research is complete, we cannot afford to take that risk.
### What if Smallpox returns?
Find your immunization records, if you were born in the past 30-40 years. I doubt you have an immunization for smallpox. You probably got shots for polio and other viruses, because those viruses still exist.
In the case of polio, three countries - Afghanistan, Pakistan & Nigeria still have cases. This means millions has spent to immunize people globally to prevent the spread. This is why the idea of eradication has so many benefits as then the need to immunize goes away. This has been estimated in the case of polio to over one billion dollars a year saved globally if eradicated.
Smallpox however is eradicated, this means we don't get immunized saving an insane amount of money globally. Money that can be used to eradicate other diseases, such as polio.
### Could Smallpox return?
The genome sequence is online, large and complicated at roughly 185,000 letters. This is no basement lab job, this would require a high-tech lab to produce this sequence. It wasn't long ago (2001) when a bioweapon was used, so the idea isn't out of the question. Anthrax was no joke and neither would smallpox be if weaponized.
With a growing population not vaccinated to smallpox, it would be deadly for that virus to return.
### Curing Smallpox
It wasn't until July of 2018 that news regarding the cure of an eradicated disease came to light. [TPOXX (tecovirimat)](https://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm613496.htm?ref=connortumbleson.com) was approved by the FDA. This paired with a news article about the United States purchasing in bulk paints a very real picture.
> The manufacturer, SIGA Technologies, has delivered two million courses (each consisting of two capsules per day to be taken for 14 days) of TPOXX to the U.S. Strategic National Stockpile — a repository of vaccines and drugs to be used in the event of a rare disease outbreak or biothreat.
> [cbc news](https://www.cbc.ca/news/health/second-opinion-smallpox-drug-tpoxx-1.4756087?ref=connortumbleson.com)
An eradicated virus may never be truly gone due to the remaining facilities and scary ability for high labs to produce it themselves, so the continued research, cures and knowledge surrounding it continues. I wonder if any more viruses will be eradicated in my lifetime.
### The Atomic Lake (Lake Chagan)
URL: https://connortumbleson.com/2018/07/15/the-atomic-lake/
Last updated: 2018-08-22T01:19:24.000Z
Continuing my blog posts related to nuclear events, this week we take a look into Lake Chagan in Kazakhstan. The reason for this lake was a test done by the Soviet Union (Modern day Russia) in 1965\. This was one of many tests classified under the PNE category, which stood for Peaceful Nuclear Explosions. The idea being that you could adapt landscape to create bodies of water without the absurd equivalent of TNT needed.
These tests were following after the United States had begun Operation Plowshare. The majority of those tests happened at the Nevada test site in which nuclear explosions were used to test excavating shafts or creating craters.
So the USSR set out to test these explosions itself, codenamed the "Chagan" test. It was the largest of any PNE explosion done clocking in at 140 kilotons of TNT. For those curious, there is actually a video of the explosion and test available.
The reason this explosion is wildly known is that a small portion of the blast went upward, thus into the atmosphere. This violated the Limited Test Ban Treaty, which basically prevented nuclear explosions in the atmosphere, under water or in outer space. After the complaints were resolved from the United States and Japan, the Soviets never tested another explosion near the size of the Chagan.
After the Soviet Union collapsed the area around the test site returned to nature and the locals. Knowing the right locals can get you a tour right up to the lake or even in it. VICE has shown this is possible with the following video:
There is no fancy radiation suits required, just some strong shoes with a drink of antler blood and vodka. Both work in unique ways to prevent the absorption of radioactive elements.
The Polygon was the name of the nuclear test site the Soviet Union used, it was located in the KSSSR (Kazakh Soviet Socialist Republic), which is modern day Kazakhstan. Most of the tests and experiments at the Polygon cared little for the environment or local people. This led to mutations and destruction of the local area, which was largely unknown by global entities until the test site closed in 1991.
For nearly a decade, starting in 1996, many countries worked together in secret to secure the nuclear waste in the mountains. As of today, if you have the money and time you can actually visit the Polygon (Semipalatinsk Test Site) on a [tour](https://caravanistan.com/kazakhstan/semey/kurchatov-polygon/?ref=connortumbleson.com).
Watching multiple videos about this lake, they all begin with a walk among a decayed bridge.
Credit: [Vice Inside One of the Most Radioactive Places on Earth: Russian Road Trip (Part 3/3)](https://youtu.be/wrn%5FekMx6cw?t=580&ref=connortumbleson.com)
Which help set the scene before the large crater and pond on the other side. Nuclear research continues to amaze me, despite being nearly over 50 years old.
### Decommissioning a Nuclear Power Plant
URL: https://connortumbleson.com/2018/07/08/decommission-nuclear-power/
Last updated: 2018-08-22T01:19:24.000Z
The United States last nuclear reactor began construction in 1973 and then opened up in 1996\. As of this blog post, the United States has not built a new plant since then. So why did we stop building plants?
Besides the obvious regulations and strict requirements, the estimated price to build a plant was vastly incorrect way back when these plants were being constructed. The 1960s/1970s raced to build more reactors for the assumed growth in electricity demand. Plenty of plants were canceled during planning or construction, or prematurely shut down due to funding.
As of this blog post, we currently have 99 commercial reactors in the United States, most of which were built three decades ago. So can these reactors last forever? For most of these reactors they have a 40 year license from NRC (Nuclear Regulatory Commission), which can be renewed in 20 year increments. These strict license force a facility to go through an expensive decommission process if they chose to shutdown.
We can take a look at the current sites in the states via this [link](https://www.nrc.gov/reactors/operating/list-power-reactor-units.html?ref=connortumbleson.com). From this list, we can pick a random reactor. In this case, the Turkey Point Nuclear Generating Unit 4 in Homestead, Florida.
```
Location: Homestead, FL (25 miles S of Miami, FL) in Region II
Operator: Florida Power & Light Co.
Operating License: Issued - 04/10/1973
Renewed License: Issued - 06/06/2002
License Expires: 04/10/2033
Docket Number: 05000251
Reactor Type: Pressurized Water Reactor
Licensed MWt: 2,644
Reactor Vendor/Type: Westinghouse Three-Loop
Containment Type: Dry, Ambient Pressure
```
We can see the site was renewed and is set until 2033\. So lets pretend this site does not renew, how does a nuclear plant shut down? The first thing needed is money and secondary payment companies in case the licensee fails to pay.
> The NRC estimates costs for decommissioning a nuclear power plant range from $280-$612 million.
There are 3 main types of decommissioning strategies, which are listed below.
- **DECON** \- This is an immediate dismantling of the facility where radioactive elements are either removed or decontaminated. This is an expensive option as the price to decontaminate highly radioactive elements can be costly.
- **SAFSTOR** \- This is a deferred dismantling where the facility is partially shutdown and simply monitored for nearly 60 years. After this long time, the radioactivity has decayed and the less expensive dismantling can occur.
- **ENTOMB** \- This is where all radioactive elements of the facility are permanently encased until decay is complete. As no NRC-licensed facility has chosen this option, we don't know much about it.
Most facilities tend to use a combination of **DECON** and **SAFSTOR**, in which some material except the spent fuel is removed. So the facility is just an interim storage of spent fuel, which requires a less restrictive license.
This tiny image from the NRC can visually explain the above three options.
[https://www.nrc.gov/reading-rm/doc-collections/fact-sheets/decommissioning.html#phases](https://www.nrc.gov/reading-rm/doc-collections/fact-sheets/decommissioning.html?ref=connortumbleson.com#phases)
Switching gears, lets talk about accidents in the industry. After the terrible events in Fukushima, regulation in other facilities across the world increased. This once again stalled the public perception of additional nuclear facilities. When discussing this incidents, the entire world agrees on the same scale when classifying nuclear events.
By [Silver Spoon](//commons.wikimedia.org/wiki/User:Silver%5FSpoon "User:Silver Spoon") \- Own work, [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0?ref=connortumbleson.com "Creative Commons Attribution-Share Alike 3.0"), [Link](https://commons.wikimedia.org/w/index.php?curid=14641473&ref=connortumbleson.com)
The only two events to be labeled as Level 7 were
- [Chernobyl disaster](https://en.wikipedia.org/wiki/Chernobyl%5Fdisaster?ref=connortumbleson.com)
- [Fukushima Daiichi nuclear disaster](https://en.wikipedia.org/wiki/Fukushima%5FDaiichi%5Fnuclear%5Fdisaster?ref=connortumbleson.com)
These events showed what can happen when mistakes are amplified in the field of nuclear energy. With every accident, other sites learn from it. We can see the NRC has many documents directly related to the outcome at Fukushima.
> US Plant Inspections following Japan Event
> Plant-Specific Actions in Response to the Japan Nuclear Accident at Fukushima Dai-ichi
Nuclear facilities will always have my interest due to the complexity, regulations and pure power all these facilities have. I think my next post will take a look into the Lake Chagan as the story involving it is quite interesting.
Featured photo by [Frédéric Paulussen](https://unsplash.com/@fredography?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### Evolution of Technology
URL: https://connortumbleson.com/2018/07/02/evolution-of-technology/
Last updated: 2018-08-22T01:19:24.000Z
Somewhere in my life, someone told me that our military technology was years ahead of any consumer grade tech. If you look at things right now, we are on the verge of affordable consumer grade virtual reality. That I believe is already highly used in the military in terms of HUD glasses. Outside of VR/AR tech, lets take a look at routers.
In my apartment, I had a Netgear R8000\. Unless you have model numbers memorized, you probably don't know what router this is. I call it the spider router and the photo below should explain why.
[credit](https://www.netgear.com/home/products/networking/wifi-routers/R8000.aspx?ref=connortumbleson.com#tabs-Sharing)
I don't have a problem with this router, it worked and I never had to mess with it. If I don't have to babysit technology constantly updating/repairing it, then that technology has solved a problem in my life and not gotten in the way while doing so.
Well I randomly stumbled upon a router that was classified as "Enterprise". It didn't require a license, so as a consumer I could purchase it. This item wasn't in a store, it was purchased online and absolutely surpassed my previous router in every measurement I could preform. I was a bit upset that it had been years that I've been purchasing consumer grade routers, when enterprise routers for a small increase in price deliver far better service.
I began thinking, if enterprise grade hardware is stronger than consumer. Is government hardware stronger than enterprise? What about military?
There are articles scattered over the web about employees at Google refusing to work on drone technology because the consumer is our United States Military. I'm completely guessing here, but I imagine our government has its own research and development budget, but the private business space (ie Google) may be surpassing that work.
Perhaps this isn't true, our government and military may have technology that I simply don't even know about. Maybe spending some money with Google is easier than spending the time to research and build something internally.
I do know I'm interested in what every year brings in terms of technology enhancements.
Featured Photo by [Ramón Salinero](https://unsplash.com/@donramxn?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### The libpng16 mozjpeg help guide.
URL: https://connortumbleson.com/2018/06/24/libpng16-a-stressful-day/
Last updated: 2018-08-22T01:19:24.000Z
One day my build scripts started failing during the creation of assets.
```
Module build failed: ModuleBuildError: Module build failed: Error: Command failed: ~/node_modules/mozjpeg/vendor/cjpeg
~/node_modules/mozjpeg/vendor/cjpeg: error while loading shared libraries: libpng16.so.16: cannot open shared object file: No such file or directory
```
So I decided to go check that binary again, to check what shared dependencies it had.
```
[~/node_modules/mozjpeg/vendor]# ldd cjpeg
linux-vdso.so.1 => (0x00007ffd5cfab000)
libpng16.so.16 => not found
libm.so.6 => /lib64/libm.so.6 (0x00007f4f95c44000)
libc.so.6 => /lib64/libc.so.6 (0x00007f4f95877000)
/lib64/ld-linux-x86-64.so.2 (0x00007f4f95f46000)
```
Usually, this is as easy as using yum to install `libpng16`. However, yum only had `libpng12` and `libpng15`. Instead of installing some bulky repository, I decided to install this one manually.
```
wget https://download.sourceforge.net/libpng/libpng-1.6.34.tar.gz
md5sum libpng-1.6.34.tar.gz
```
(ensure the md5 matches the package downloaded [here](http://www.libpng.org/pub/png/libpng.html?ref=connortumbleson.com))
Next up to configure & build it.
```
LIBS=-lpthread ./configure --prefix=/usr --disable-static && make
make install
ldconfig
```
Now we've built, installed and linked the dependency into our system. If the build failed, make sure you have the following build requirements.
```
yum install libtool automake autoconf nasm
```
Rerunning the same `ldd` command, we can print out the shared dependencies.
```
[~/node_modules/mozjpeg/vendor]# ldd cjpeg
linux-vdso.so.1 => (0x00007ffe4ca8f000)
libpng16.so.16 => /lib/libpng16.so.16 (0x00007fb440792000)
libm.so.6 => /lib64/libm.so.6 (0x00007fb440490000)
libc.so.6 => /lib64/libc.so.6 (0x00007fb4400c3000)
libz.so.1 => /lib64/libz.so.1 (0x00007fb43fead000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fb43fc91000)
/lib64/ld-linux-x86-64.so.2 (0x00007fb4409c4000)
```
Now my asset deploys were back to working :)
```
DONE Compiled successfully in 43567ms
```
Featured image by [Becca Tapert](https://unsplash.com/@beccatapert?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### The Unfair Comparison
URL: https://connortumbleson.com/2018/06/17/the-unfair-comparison/
Last updated: 2018-08-22T01:19:24.000Z
During a random discussion with a co-worker, somehow we looped into discussing personal records. I remembered that way back when in elementary school, I set the record for the pacer test. I don't remember the number, but I do remember seeing my name put on a leaderboard in the gym.
Who knows if I have the record now. The pacer test has evolved, changed and is digitized all over the web. I can now look up pacer scores for schools around the nation and quickly see that my personal record is no where near the top hundred.
Though, would that have been healthy for my young self to know that I wasn't even in the top hundred for an achievement I just set? For that, I don't know. I'm mature enough at this age that comparing myself to the entire world is not a fair comparison.
I started noticing something on social media with some friends which I can relate to this. A few photos pop up of a friend visiting some exotic foreign country. Swimsuits, beaches and alcohol which looks like a perfect island getaway. Is this person on vacation? Honeymoon? Work sponsored travel? Who knows, but they are having fun.
Photo by [Mohamed Thasneem](https://unsplash.com/@thanni?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
The next social media article is a friend on a cruise enjoying what looks like a perfect steak. The individual elements of any of these posts is nothing special. People take vacations and spend money - that is just how life works. What I noticed is that friends build some fake person in their head. This fake person becomes a combination of all the best things of social media.
They start comparing themselves and their life to that fake person they've designed in their head. At one point, I was contributing to that image of a perfect life with [my trip to Aruba](https://connortumbleson.com/2018/06/10/travel-blog-aruba/). However, what people don't know is that was my first vacation in two years.
Social media doesn't show [me](https://www.instagram.com/ibotpeaches/?ref=connortumbleson.com) running errands, attending doctor appointments or any other boring things adults have to do. Social media, in general, showcases the best and looking at the best all the time can warp an understanding of how your individual life should be.
Featured image by [Austris Augusts](https://unsplash.com/@biosss91?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### Travel Blog: Aruba
URL: https://connortumbleson.com/2018/06/10/travel-blog-aruba/
Last updated: 2018-08-22T01:19:24.000Z
The alarm clock goes off, it's 3:01am. My scheduled Uber is set to arrive at 3:21am, so a quick shower and I'm off. Some legal snafu at the airport due to my plane ticket not having my full name delays my entrance into the gate. Due to the airport slowly opening, I'm stuck in line after line with a very drunk passenger. Things escalate with this drunk individual to the point that TSA is involved. I've written about this in more details [here](https://plus.google.com/+ConnorTumbleson/posts/QHYCkMvP2kt?ref=connortumbleson.com). Thankfully this individual was removed from flying on this early morning flight.
I flew to Fort Lauderdale, then I waited for the international flight to Aruba. The flight to Aruba was shorter than I expected, not evening hitting three hours of travel time. I saw the tiny island approaching and we landed in Aruba.
My first order of business was to purchase a local SIM card, because I can't seem to separate myself from being connected.
3 gigabytes of data was purchased and it was time to enjoy the view.
## Food
Can't go wrong with a classic Ahi Tuna.
Even breakfast was fancy and delicious.
Poolside meals with a classic sandwich and fries.
Down to the expensive blackened fish dinner with spicy creole sauce.
## The Nature
Taking a journey to the end of the island was worth the intense wind pounding against me. The rocks were sharp, the erosion was real and the sight was amazing.
This is my 2nd travel blog and I have no idea what I'm doing. I once again forgot to take photos of all my food. I also don't know how to write an article about a trip that I took that would be interesting for a reader.
### Fear or Confidence.
URL: https://connortumbleson.com/2018/06/04/fear-confidence-a-tale/
Last updated: 2018-08-22T01:19:24.000Z
During a delayed return flight home, we started our descent and things got turbulent. As our plane approached the tarmac, our wheels touched down. Instead of slowly coming to a halt, we bounced back into the air as felt by the strange feeling in my stomach. We hit the ground again and this time the plane slowed and we completed the landing.
There was clapping around the plane. This wasn't an international flight to an exotic island, but a domestic flight around the states. They were clapping because there was an ounce of fear in some passengers and a successful landing after a blip of fear results in claps.
I did not clap nor feel scared. This wasn't because I was a trained pilot or had any professional knowledge in the matter. This bouncing on the tarmac incident has happened a few times in my life, so at this point if it happens, it's just a semi-normal part of the flight.
Unrelated, during a stay at a hotel I'm walking down the hallway with the family. An alarm comes over the intercom saying a fire alarm has gone off. The beeping and bright white lights begin going off. No one in the family turns around, panics or does anything. We just continued to the room to drop our luggage and relax.
The alarm kept on for nearly 10 minutes, all of which we ignored. Eventually the noise stopped and things went back to normal. Was there a group of hotel guests outside waiting? Was there an actual fire? I don't know. With all repeat fake alarms and/or tests, it is too difficult to tell a real threat from a fake one.
There are plenty of these random situations to reflect on and they make me wonder. I should have evacuated the hotel during the fire alarm. I didn't know if it was a test or not. Those minutes wasted ignoring the alarm could have been the time needed for me to escape safely. Thankfully that wasn't the case, but you see the point.
Confidence is slowly covering my fear, and I think I need to have a healthy amount of fear in order to respond to these situations differently. Since confidence is not always the smartest reaction.
Featured image by [Caleb Woods](https://unsplash.com/@caleb%5Fwoods?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### The Death of Chronological Order
URL: https://connortumbleson.com/2018/05/27/the-death-of-chronological-order/
Last updated: 2018-08-22T01:19:24.000Z
Years and years ago, back when I was actively using Facebook they made a change in which stories on your homepage were no longer in chronological order. Facebook's system changed and started ordering stories in a way they thought you would want to see. This would be posts you commented on or viewed the photos attached. The idea behind being that you would spend more time on the site if you saw content you liked vs endless scrolling through content you didn't enjoy.
The longer time you spend on Facebook, the more ads you see which means the more money Facebook earns. If a system is determining what you see now, are you missing out on any content? I can't answer that as I simply don't know.
Thankfully Facebook gave users the option between these types of ordering of content.
Perhaps I'm the minority, but I don't want a system feeding me what it thinks I want. I want to scroll a feed until I recognize the content I've already seen. This ensures I don't miss anything.
However, Facebook does not make this easy. After selecting "Most Recent", my feed now shows:
After one refresh, the default order is back to "Top Stories". Who knows how far into the settings I have to dig to make this setting permanent. What is clear though is that Facebook does not want me to use a chronological order.
Next up is Twitter, a great idea founded on the idea of chronological small tweets. In the past few years, Twitter has slowly been crippling the 3rd party applications that built them up. Probably a large exaggeration, but more and more the default Twitter website and application will work while other 3rd party services break.
On my first visit to the real Twitter website, I was met with this:
Yes, I blocked out the tweet because that isn't important. The important part to note is that my Twitter feed has decided what I should see. Scrolling below these few tweets "stickied" tweets shows a tweet 28 minutes ago. So these tweets for some reason Twitter decided I should see instead of my chronological feed.
I can't find an option to disable this. I want a chronological feed, but once again I see why Twitter did this. Imagine I sit refreshing my feed every minute. The tweets may be the same and thus I will leave the site. If Twitter wants to keep me on the site they need to feed me new content. They can find content they think I'll be interested in regardless if its new or old and show it to me.
Sites across the social networking space are experimenting or have implemented these algorithm based feeds. Right now under the microscope for changes is YouTube. Some users begin noticing a few irregularities with the order subscribed videos were showing.
YouTube ended up [tweeting](https://twitter.com/TeamYouTube/status/999150003863085056?ref=connortumbleson.com) the following:
> Just to clarify. We are currently experimenting with how to show content in the subs feed. We find that some viewers are able to more easily find the videos they want to watch when we order the subs feed in a personalized order vs always showing most recent video first.
This is getting a fair amount of black lash from not only users, but the content creators themselves. If the YouTube system decides what order videos are shown, what decides how content creator videos are shown?
Like Facebook and Twitter, I fear for the day that algorithms decide what content I should see and watch. I've embraced algorithms for finding new music, but solely because I can't listen to the same song for a month. Hopefully my intake of social networks and videos won't be controlled by machines.
Featured image by [freestocks.org](https://unsplash.com/@freestocks?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### Travel Blog: St Louis
URL: https://connortumbleson.com/2018/05/21/travel-blog-st-louis/
Last updated: 2018-08-22T01:19:24.000Z
While this blog is primarily used for technical posts, I felt for this week's blog to document my little trip to St Louis, Missouri. This trip was for the wedding of a great friend.
Every travel begins with opening up Uber and requesting a ride to the airport. $28 for a trip in the morning while fighting the 8am Friday work traffic. I arrived at the airport with about 1.5 hours until my flight.
For the first time in awhile, I wasn't required to take off my shoes, belt or remove my laptop from backpack. This made security effortless as I was just dropping off my backpack and walking through a detector.
### The boarding
For those who haven't flown with Southwest before, you get a letter (A - C) and number (1 - 60). You board A1-30, A30-60, B1-30, etc. It seems all of A is reserved for paid upgrades, because checking into the flight at the instant the clock struck 24 hours until my flight I obtained B15\. This means roughly 75 passengers are on the plane already before I board.
I walk onto the plane and the 2nd row has an open window seat. A rare sight, so I ask the couple sitting if it is reserved. It isn't. As the couple stands up to move, I realize her foot has a cast on and she requires help from her husband to move. I felt bad, because I didn't see that when I asked if the free seat was open.
The flight was estimated at 2 hours and 20 minutes duration, according to my clock and captain confirmation we did the trip in 1 hour and 56 minutes. It must be some jet stream direction benefit.
### The next Uber
As I walk out into the St Louis airport, I spot an old friend. He has flown in from Kansas City and we both landed around the same time. This was a perfect chance for us to grab a split Uber and head downtown.
With sharing the cost, I'm only looking at a $14 fee for the trip. We arrive at the Hyatt at the Arch hotel, which was pretty fancy in comparison to my usual selection of hotels. As hotels evolve, so does the check in procedure. I completed most of the check in procedure from an Android application. I just presented my driver licenses and keys were printed for the 7th floor of the hotel.
After my next friend checked in, he got the 16th floor. The very helpful staff member switched my room immediately so I was also on the 16th floor. The hotel had eight elevators with a tad bit of confusing logic on them. Four of the elevators didn't go to the top two floors. So when a trip to the soon to be meeting room was needed, we had to take our 16th floor elevator down a few floors to switch to a different elevator.
It was confusing and stressful when we had to make trips of moving wedding related items from a room on the 10th floor to a room on the 16th and 18th. The elevator that could reach the 18th floor, couldn't reach the 16th. The elevator that could reach the 16th floor couldn't reach the 10th or 18th floor.
### The return of BBQ
Living in Florida for a few years has kept me missing the great BBQ that Kansas and the midwest has. So thanks to a recommendation from our Uber driver we tried out SugarFire Smoke House. With an early flight and timezone change, I was hungry and it was lunch time.
1. 8oz beef brisket sandwich
2. Sides: French Fries & Coleslaw & A Pickle
3. Fountain Lemonade drink
This place had a unique twist with each table holding 6 unique sauces. My plate quickly became a mess of tiny pools of each sauce as I tried a fry with each sauce.
### The Rehearsal Dinner
After a quick rehearsal, our group met at Tucanos (A Brazilian Grill). These are always a fun experience getting to eat a wide variety of meats. The grilled vegetables and pineapple also hook the meal together quite perfectly.
Meeting in the bar in the hotel after dinner, we enjoyed drinks as one by one names turned in for bed. The big day was tomorrow, so lots of waters were consumed to prevent that next day hangover.
### The Wedding & Reception
From the ceremony, pictures in the park and reception were all excellent. Not a single emergency even with mother nature raining down on us. The food included at the reception was a perfect blend of salads, raviolis and slices of meat. As the reception continued the open bar ended and the party relocated to the bar at the hotel again. This time with no event on Sunday, a good deal of alcohol was consumed.
### The final day
6:30am arrived quickly as the rented clothing needed to be packed and returned. It was a day of saying bye as friends left every hour on their journey home. Back to the airport I went, with nothing more than a small 15 minute delay, I returned to Tampa around 9pm local time. An amazing weekend spent with excellent friends celebrating the marriage of another friend!
### Meta
This was my first travel post and it wasn't good. I only have a photo of one meal I had and the details of random events aren't important in the scope of you (the reader). In the future, other travel blogs will be about the travel and food of each city.
### Revisiting the Radio
URL: https://connortumbleson.com/2018/05/13/revisiting-the-radio/
Last updated: 2018-08-22T01:19:24.000Z
Nearly four months ago, my audio cable in car stopped working. My Spotify experience in my car was now ruined. I stopped at a Best Buy on the way home from work to buy a new cable and the problem remained. Months later, I've been using regular FM Radio on any trip in my car.
I'm in the Tampa area and these are my six presets as of May 12, 2018.
```
93.3 | 94.1 | 95.7 | 97.9 | 100.7 | 103.5
```
Out of those six, five are owned and operated by iHeartMedia. I noticed this, because every station is offering $1000 for texting a keyword every hour during the weekdays. At first it sounds like a good chance until you hear the phrase "nation wide contest" that only a few stations mention. This is of course referring to the other 850 stations that iHeartMedia controls around the states.
I have no idea how many people listen to each radio station, but lets guess that 100 people for each station take part in the contest. This would be 85,000 people an hour competing against one another. The odds of that winning that is pretty bad.
Texting this number (if you read the contest rules), signs you up for text notifications from iHeartMedia. You have to explicitly text "STOP" to the number in order for these to end. Every time you text the number, you sign up again while joining the contest in question. If you don't have unlimited SMS/MMS messages you might rack up a few charges on your account.
I imagine the growing pool of signed up radio listeners are used for advertising purposes. If you can instantly send an advertisement to thousands of people's devices directly, I'd venture to say lots of companies would get involved in that. I am not one of those listeners who takes part in these contests. I don't want to get my hands or phone wrapped up in some cost charging never ending notification scheme for a small chance at $1000.
Moving back to the radio, I grew up with cassettes leaving the bad sound quality AM Radio behind. I quickly upgraded to the Sony Walkman -> MP3 Player -> iPod, once again leaving behind the FM Radio. Not long after, I abandoned the static list of music on my iPod for Spotify. A small fee to pay for a machine to deliver me customized music daily. I discover new music I like, get song lists built automatically and never ever listen to an advertisement.
Streaming music services disrupted the radio, so I wondered how such a large company was still surviving doing something I thought was dead. Turns out iHeartMedia already filed for [bankruptcy](https://www.npr.org/sections/thetwo-way/2018/03/15/593868390/iheartmedia-turns-the-dial-to-bankruptcy?ref=connortumbleson.com) in March of 2018\. The article explains that this is just a shuffling of money and won't disrupt the individual 850 stations.
I'm not versed enough in the laws of bankruptcy to know what that means, but being stuck with a radio again sucks. It would be like taking a Taxi to the airport, instead of an Uber. The world has evolved and I think AM/FM radio is next for retirement.
Featured image by [Mpho Mojapelo](https://unsplash.com/@mpho%5Fmojapelo?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### Malicious Actors
URL: https://connortumbleson.com/2018/05/06/malicious-actors/
Last updated: 2018-08-22T01:19:24.000Z
Featured & above photo by [Tom Roberts](https://unsplash.com/@tomrdesigns?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On a regular Thursday morning, I walked out to my car for work and as I got in sight of my car I knew something was different. The driver side front door handle was ripped off just hanging there. I don't see how this could have happened without a malicious actor.
My guess is that while I was sleeping some individual(s) were wandering the parking lot checking door handles for unlocked doors. My car was broken into it nearly 6 years ago (I didn't lock it so my fault), so I was anxious to check the car to see if anything was missing.
Thankfully or luckily, the small contents that I leave in my car were untouched. Was my door handle about to break and the criminals sped that process? Was I specifically targeted? Who knows.
My car has been key'd on two separate occasions though. Once in [Sept 2016](https://plus.google.com/+ConnorTumbleson/posts/asn4M6cmx2z?ref=connortumbleson.com), then again in [Nov 2016](https://plus.google.com/+ConnorTumbleson/posts/QsHVAZJuLJA?ref=connortumbleson.com) so I am generally paranoid when it comes to car damage.
For further context, I've walked out on a flat tire on my car multiple times. More times than I believe that were accidental nail punctures from daily driving. I took all the receipts of my tire-patching and it became a bit alarming when put together:
- September 2016 (passenger front tire)
- March 2017 (passenger back tire)
- June 2017 (passenger front tire)
- November 2017 (unknown tire)
- March 2018 (driver rear tire)
If you create a time line of all events, it looks like this:
- September 2016 (key'd + flat tire)
- November 2016 (key'd)
- March 2017 (flat tire)
- June 2017 (flat tire)
- November 2017 (flat tire)
- March 2018 (flat tire)
- May 2018 (door handle replacement)
Fit in regular oil changes and normal maintenance and it feels like this isn't common. I looked back in my digital history to see what happened in September 2016 that might have sparked this sporadic targeted behavior. I found in September of 2016, my [server was attacked](https://connortumbleson.com/2016/09/01/surviving-an-amplified-wordpress-pingback-attack/) (flooded) with a ton of traffic. Am I drawing connections where there shouldn't be?
It isn't healthy to think about it as that leads to a path of paranoia and suspicion. So I'm not going to think about and instead write a blog about it.
### Apktool v2.3.3 Released
URL: https://connortumbleson.com/2018/04/29/apktool-v2-3-3-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.3.3 has been released! This release is a hotfix for one regression issue introduced in v2.3.2.
The regression allowed some types of files to be compressed, when they shouldn't have been. Tests to prevent regression have been added.
This release had 5 commits by 1 person.
- Connor Tumbleson (iBotPeaches) - 5 commits
# Changes since 2.3.2
- \[[#1769](https://github.com/iBotPeaches/Apktool/issues/1769?ref=connortumbleson.com)\] - Fixed regression with compressing default AOSP filetypes like mp3.
- \[[#1774](https://github.com/iBotPeaches/Apktool/issues/1774?ref=connortumbleson.com)\] - Fixed detection of aapt2 builds older than certain SDK versions.
## Notes
The release notes for the release of v2.3.2 can be found [here](https://connortumbleson.com/2018/04/07/apktool-v2-3-2-released/), as that release contains the first release of the experimental `aapt2` support.
# Download
- [Apktool 2.3.3](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.3.3.jar?ref=connortumbleson.com)
- md5 `a15507953bd9b89c2d6570f46fb1f774`
- sha256 `0e543660bf2d16fe7c543d4034ef505a6ddccb883416c8aa68d1a1d779b057f2`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Ingress Support Failure #1
URL: https://connortumbleson.com/2018/04/23/ingress-niantic-support-failure-1/
Last updated: 2018-08-22T01:19:24.000Z
This story is the start of my investigation into how regular support tickets are unfortunately treated differently than reports through a Trusted Reporter.
A Trusted Reporter is an avenue for Ingress agents to report agents who are believed to be breaking in game rules, with large focus towards spoofing. The details involving these people and process are intentionally scarce to protect the identities of those involved. Just know that on each respective faction contains agents with the ability to submit tickets which will be dealt with quicker than an average consumer.
Each article will be about one agent in order to slowly grow a collection of failures.
# Agent degetyguk
*ticket # - 524,319*
Around October 18, 2017 I noticed a brand new ENL account playing in a town not more than 20 minutes from me. I thought nothing about it. It was playing in a dense portal area, fully deploying, linking and fielding. It was a smart first time player, but you can't report for that.
However, its next actions were beyond strange and that triggered the idea in my head of a spoofer.
The account was playing in that black circle and then immediately started killing portals of a trail (walking only) in reverse! The backend of this trail is in a private gated neighborhood. However, the front of the trail is a public park. This account started killing the portals on the trail in reverse which was a big red alert in my head.
I began investigating and things got even weirder.
- Why would a level 3 account begin playing and then jump to a trail far away?
- The account never claimed a single portal, claiming it was "out of resos"
- The account stayed at 42 hacks during the entire travel, not even hacking the trail portals.
As you can see from the above image, this trail was not close to the previous area of play. You have to drive around this bay of water or kayak through it.
This account killed every portal on that trail, which was previously a resistance portal. My guess was this account was created at the site of the soon-to-be spoof and leveled up enough to use the nefarious gear placed in its account. The account never hacked past 42 times, yet had enough gear.
So it was reported.
- 2017-10-18 11:44 - Initial report for degetyguk opened
- 2017-10-20 06:03 - NIA Response. **Account unbanned**
Due to the "little" amount of spoofing this account did, I didn't do a follow-up because I was already dealing with far more devastating spoof attack of accounts wiping entire islands. This account was a small fish in comparison.
9 days later, our successful operation went up!
Roughly 5.1 million a layer for 12 layers. I love when an operation goes as planned. However, we had 1 single point of failure (Mexico). All other anchor sites had multiple portals. In my experience, spoofers target the single anchor responsible for anchoring a large field. So I began watching the Mexico anchor. It's sad, but you learn to watch the single point of failure to issue recharge notices.
The XM went missing at that portal! Someone was there, but the portal didn't die or get attacked. My guess was a bot was not high enough level to use a flip card against our anchor.
Then we spotted an Enlightened account only 3 minutes south of the Mexico anchor. That is the same account that was killing our Florida trails in reverse! Call me crazy, but a brand new account doesn't happen to be 1,627 kilometers away at the anchor site of our field.
The account played and played leveling up in the new city of Coatzacoalcos, Mexico. Luckily for us, a legitimate high level green agent walked out to the lighthouse and flipped the portal. My suspected spoof account then disappeared, not doing a single additional action in Mexico. Their target was dead via a legit hand, so their work was done.
I was now beyond convinced this account was a spoof. So I followed up with NIA in my existing ticket to reopen it.
- 2017-10-29 13:57 - Follow up response (after account "jumped" to Mexico)
- 2017-10-30 10:58 - NIA Response. **Account unbanned**
- 2017-10-30 13:05 - Follow up response (explaining more details)
- 2017-10-31 05:30 - NIA Response. **Account unbanned**
It was just not working. I forgot about it then decided to try my luck in another way. So I pinged a Trusted Reporter, sent them this Google document which has now been rewritten into this post.
- 2017-11-09 14:33 - Message to Trusted Reporter, with details.
- 2017-11-10 05:01 - **Account banned**. After using TR system.
It took an alarming 24 days since I reported the account for a ban to take place. However, it only took 14 hours for the ban after a Trusted Reporter was involved.
Entire contents of the report chain.
- 2017-10-18 11:44 - Initial report for degetyguk opened
- 2017-10-20 06:03 - NIA Response. **Account unbanned**
- 2017-10-29 13:57 - Follow up response (after account "jumped" to Mexico)
- 2017-10-30 10:58 - NIA Response. **Account unbanned**
- 2017-10-30 13:05 - Follow up response (explaining more details)
- 2017-10-31 05:30 - NIA Response. **Account unbanned**
- 2017-11-09 14:33 - Message to Trusted Reporter, with details.
- 2017-11-10 05:01 - **Account banned**. After using TR system.
This is one story of many to come. It is unfortunate that I have to continue to bother Trusted Reporters, but regular agent reports aren't dealt with the same care and resolutions that Trusted Reporters are despite what Niantic says.
The dates in this post at time of publishing are roughly 5-6 months old. In that time, Niantic has somewhat improved their process. I still have reports closed without bans on obvious spoofers, even with all the requested details provided. This forces me to use Trusted Reporters.
### The Key to Basic Encryption
URL: https://connortumbleson.com/2018/04/15/the-mystery-and-power-of-encryption/
Last updated: 2018-08-22T01:19:24.000Z
Image by [Katy Belcher](https://unsplash.com/@katybelcher?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
There are forms of communication around the world between two people on hundreds of different mediums with the intention of that communication being private between those two people.
There are services that provide encrypted communications, but they are filled with their own challenges. I am a big fan of [Keybase](https://keybase.io/ibotpeaches?ref=connortumbleson.com), but I understand that nothing is free in this world. Keybase may have unlimited funding with no strings attached, but the bills for those servers will need to be continued to be paid. If one day those servers turn off, then we take a few steps back.
For that reason, we will take a look at GPG (GNU Privacy Guard) and how easy it is to get started. Without getting too deep into the internals of how it works, we can start with the explanation that GPG relies on keys.
These aren't house keys, because what happens if you lose your house key? Whoever has that key can enter your home. In the world of GPG, there is a public and a private key at the most basic of explanations.
Think of the public key like the lock on your door and the private key being the key that opens that lock. You are free to give out as many locks (public keys) as you want. Hence, the name "public" in the name of the key. We can take a look at my public key at a few places, while the private key sits safely on my computer for only me.
```
➜ ~ gpg --list-keys --fingerprint Connor
pub 4096R/1EC7DA75 2016-05-07
Key fingerprint = B74F 1749 DC15 C852 BB51 CE64 C3CC 0A20 1EC7 DA75
uid Connor Tumbleson
uid Connor Tumbleson
sub 4096R/16154369 2016-05-07
```
With a tiny of bit of manipulation, prefixing a `0x` and removing the spaces we can visit a [public key server](https://keyserver.cns.vt.edu/pks/lookup?search=0xB74F1749DC15C852BB51CE64C3CC0A201EC7DA75&ref=connortumbleson.com) to obtain my full public key.
Pasting my public key in this blog post would be a waste of space, but you can recover it via the URL linked above or ask GPG itself.
```
gpg --recv-keys 0xB74F1749DC15C852BB51CE64C3CC0A201EC7DA75
```
With that complete, you can now send a message to me that only I can decrypt. For a demo purpose, I've created a file called "secret" and embedded a message in it for myself.
```
➜ GPG gpg --output secret.gpg --encrypt --armor --recipient connor.tumbleson@gmail.com secret
```
I'm telling GPG to encrypt the file "secret" for me (Connor) and outputting it to `secret.gpg`. The `--armor` flag is just to make the output ASCII instead of binary. We now have this message contained in `secret.gpg`.
```
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
hQIMA+w2N/8WFUNpAQ/9GP8olDYUcZkE1cJ580OK3zPG7rJzO+fD6i13TQtZoChj
nHWlwyyMzFnyzaVS6VOENIU8ZQ4NA4TvMfCDUMBdKspojSIbscOkXEVS+D+Svb/D
Ul6zxMpzSuTTuKHuAnTPnYruwapUQOcjNqDOdZsbiygH/Dqsn8RSghvmb0e5MZi1
kB5RrZKEBfLY9tDC8E2jQe61hq8ztwDDWPmDa04t9EIeKOPWPb/o1+JwnzpbZmof
EKsbwbvFPzjNQvjGjZMsq8PMEo2+/r6q9AGG59rYkx4hpWoohW08F7nRm4rrX4Y3
8tkVFlW7PZUgm0kYVrmGIG6MHFaCiGP0dJ9ZPsRoKfojo4eC9xZ8deQ12mjvoTyr
3EChGWeHsDFPmrUPg5M0z0GyvWPiP7N8JuE+azUxK5lkr8mkuomurnVZhU2ja390
GKods/9bTkN4oJHAmtkAPIA1f/bxlw/HQif0x3ZIoduRTPL1TphRdjWBgYsfOpmu
IFS1Pef4IcTX1RItrghwIeo9Z+79q2pNF3lIlSFMSEvQJSAPKyXLeqWaVlA1JLuC
sjYmSag7zELW8lEvgrCdNIT1dbzhKcaC4kEFMI1pH3R/D0lA4HU6kCqXc31tO7Hl
6c8XqlqWzh35BqKq3n125k4qzqYM2iuO7V8EGPUrAqyT+h4Y5LmaJTBywg1JT9/S
UgH26o5WCMMIfA4eQyMkrGBfRSNKF/48rJbGBh7dSaluBTMjE4nBTI0DDACVYTxa
47UNIDiw1VwfI3pqCd8GW+RknxDPTTaI12/XfMxtZxINBSo=
=8V3V
-----END PGP MESSAGE-----
```
That blob above is an encrypted version of the secret file I produced. I am free to send this blob through whatever medium required. No matter if it is intercepted or viewed by a 3rd party, only I can decrypt it.
I want to decrypt the message and post it here, but I produced the file so I know what it says. I think the more interesting thing is to leave this in the encrypted form. If someone ever decrypts the above message, we have a greater problem on our hands.
I hope a tiny demo of GPG (minus the actual creation of a key) showed how easy it is to be in control of your own encryption without any service. We arguably used websites for the key-servers, but they aren't needed in this equation.
Featured image by [Katy Belcher](https://unsplash.com/@katybelcher?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### The Facebook Dependency
URL: https://connortumbleson.com/2018/04/08/the-facebook-dependency/
Last updated: 2021-01-21T00:23:36.000Z
Photo by [William Iven](https://unsplash.com/@firmbee?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
On April 4, 2018 while sitting at work, I began getting alerts of raised error counts on one product I manage. A few minutes into my investigation, I realized I was dealing with a larger problem.
Facebook has been in the news lately, not for connecting people, but for crossing the line in terms of what it shares with 3rd parties. Many wondered how they would respond with this huge breach of privacy. The stock market already reacted with millions bleeding from the stock, but the world was still waiting on Facebook's response.
April 4 was the day Facebook took a step in the right direction. With their post titled "[An Update on Our Plans to Restrict Data Access on Facebook](https://newsroom.fb.com/news/2018/04/restricting-data-access/?ref=connortumbleson.com)" they begun what they believed was right restricting access and removing some data from what they gave out to API consumers.
An API consumer is the reason you can sign into applications or websites with Facebook. These applications are all over the world from Tinder to MapMyFitness. This is a preferred method for some users as you maintain one source of username/password and just sign into other products with that Facebook account.
Jumping back to the above linked article, we see this snippet of text:
> We will also no longer allow apps to ask for access to personal information such as religious or political views, relationship status and details, custom friends lists, education and work history, fitness activity, book reading activity, music listening activity, news reading, video watch activity, and games activity.
I can think of three applications off the top of my head that survive and depend on these fields of information. There was no warning, there was no deprecation plan. These fields were just gone as of the release of this news post. A great win for consumers, but an absolute nightmare for developers.
I opened up Tinder and to my suspected guess, I could not sign in. I assume the application was trying to obtain my Facebook education/work history, but that information was no longer available.
[https://twitter.com/Tinder/status/981633787036516353](https://twitter.com/Tinder/status/981633787036516353?ref=connortumbleson.com)
It seemed the dependency Tinder had on Facebook for some specific information was now gone. In the development world, this happens all the time. Data is added and removed, but usually in a large company there are deprecation warnings. Those are just a nice programming way of saying, "Don't do this anymore, we will turn this feature off in a few months"
Instagram is a product of Facebook and Facebook has slowly been moving the Instagram API endpoints over to the Facebook world. We received notice of this move in the beginning of 2018 with this post titled "[Instagram Graph API Launches and Instagram API Platform Deprecation](https://developers.facebook.com/blog/post/2018/01/30/instagram-graph-api-updates/?ref=connortumbleson.com)" which gave us a solid 6-12 months to update to the newest API as our old one would be going away. This in the business world allow you to schedule meetings, approve the work and do the engineering. Unfortunately for us, that removal day turned out to be April 4th.
> These capabilities will be disabled immediately (previously set for July 31, 2018 or December 11, 2018 deprecation).
Along with the Facebook news, Instagram additionally retired data and endpoints that we depended on. There was no longer time to slowly plan a method of resolution. Our features were broken and the clock had started. It was a scary sight as endpoints we were using in a production website were left with:
```
{
"meta": {
"code": 400,
"error_type": "APINotAllowedError",
"error_message": "This endpoint has been retired"
}
}
```
We aren't Cambridge Analytica taking as much data as it can extract from the service and using it to create a scary profile of 87 million users. We are using a small amount of endpoints to create a beautiful service that users enjoy using. Bad actors abused Facebook and by extension Instagram resulting in it being crippled, but should they have had the chance to do so?
The developer in me loves services with data as there is no end to the conclusions you can draw from it. Charts, graphs and more are fun to build with already collected and organized data. I see the value in the information for various reasons, but the end user in me strongly dislikes how much of my information is released in APIs, which is then pooled and used for endless reasons.
We are at an interesting time in the ecosystem of the Internet as companies are understanding the risk of sharing and profiting from collected information. None of those companies want to be the next site published on [Have I Been Pwned?](https://connortumbleson.com/2018/01/14/getting-pwned-is-getting-old/).
### Apktool v2.3.2 Released
URL: https://connortumbleson.com/2018/04/07/apktool-v2-3-2-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.3.2 has been released! This release includes an experimental feature toggle for using the new aapt2 tool, Android Developer P support and a few bug fixes.
As time goes on, more and more applications are built via aapt2\. If you try and decode an application built in aapt2, and rebuild it in aapt1 you will more than likely receive some errors. Additionally, rebuilding an application in aapt2 that was originally built with aapt1 will also not work due to the new restrictions aapt2 puts in place.
I've already [taken a look](https://connortumbleson.com/2018/02/18/taking-a-look-at-aapt2/) at aapt2 at the development level for those interested. This release is intended for the experimental aapt2 support to go out into the wild. A new test suite has begun for aapt2, separate from aapt1, as issues in one might not be experienced in the other.
This release had 57 commits by 1 person.
- Connor Tumbleson (iBotPeaches) - 57 commits
# Changes since 2.3.1
- \[[#1742](https://github.com/iBotPeaches/Apktool/issues/1742?ref=connortumbleson.com)\] - Android P Preview Support
- \[[#1689](https://github.com/iBotPeaches/Apktool/issues/1689?ref=connortumbleson.com)\] - Initial support for rebuilding with aapt2 binary
- \[[#1730](https://github.com/iBotPeaches/Apktool/issues/1730?ref=connortumbleson.com)\] - Fixed issue with application with empty `resources.arsc` file
- \[[#1703](https://github.com/iBotPeaches/Apktool/issues/1703?ref=connortumbleson.com)\] - Fixed issue with root depth kotlin folder not copied
- \[[#1741](https://github.com/iBotPeaches/Apktool/issues/1741?ref=connortumbleson.com)\] - Fixed building Apktool on Windows
- Added warning if application with non-zero `typeIdOffset` is discovered
- Upgraded baksmali to v2.2.2
- Support for treating additional photo extensions (`m4a`) as raw
- Prevent temporary BRUT files from clogging temporary directories
## Notes
If you'd like to take advantage of the experimental aapt2 support, use the parameter `--use-aapt2` when building.
# Download
- [Apktool 2.3.2](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.3.2.jar?ref=connortumbleson.com)
- md5 `953ed8a553becac4e713d1073912f15f`
- sha256 `648dba910d49365d78665f7060935802f4187d5529064e16caf34eee06cb5207`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### The stress of cross-platform Java
URL: https://connortumbleson.com/2018/04/02/the-stress-cross-platform-java/
Last updated: 2018-08-22T01:19:24.000Z
I am approaching year eight of managing an open source project known as [Apktool](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com). This project, as the blog suggests, is written in primarily Java with support on three major operating systems (Unix, Mac and Windows). I've made plenty of mistakes along this journey usually breaking a feature on a specific operating systems. This post is a few common problems I encounter when building cross-platform software.
### Java Execution
Like most are probably aware, the best way to execute a `.jar` file is to simply run.
```
java -jar path/to/file.jar
```
However, if you want to add arguments to Java and arguments to the program you are executing this slowly evolves to something like this:
```
java -jar -Xmx1024m path/to/file.jar -argument --argument value
```
This makes executing a program very tedious, so developers tend to move towards making helper files. These files have evolved over the years because you can't assume any of the following:
1. Is this Windows?
2. Is the character set UTF-8 compatible?
3. Is it a CLI application?
4. Is the user running cygwin on Windows?
After about 30 lines of code, you end up with something like this at the bottom:
```
exec java $javaOpts jar "$jarpath" "$@"
```
This is very helpful for users as they just need to drop this file into the directory where the project binary exists and it will do the rest. This changes our ugly program execution to this.
```
program -argument --argument value
```
Maintaining these operating specific helper files is not too bad, because once you solve a problem it might take years until another one crops up. This paired with the benefit the end user gets makes it a great enhancement to add.
### File Paths
As you build functionality into your application, chances are you might need to interact with the file system. The most common mistake is the difference between slashes as Windows continues to use the backward slash for separating directories.
```
C:\ = root location, usually, on Windows
/ = root location on Unix based systems
```
So imagine you write code to change to directory `/private/var/` to drop a temporary file. Next thing you know users on the Windows platform are looking at some cryptic error. This is easy enough to solve with a Java variable.
```
String path = File.separator + "private" + File.separator + "var"
```
The above snippet shows you how to create `/private/var` in a manner that works on all platforms.
### 3rd party binaries
Sometimes Java is not the best language for every task. Perhaps the Java application you wrote actually leverages another non-Java tool. This can be done in a multitude of ways, but then you need binaries built for every respective system you intend to support.
This becomes difficult and fast due to the additional logic of architecture type on top of platform. For example in Apktool at one point we balanced the following:
- Windows 64 / 32 bit
- Unix 64 / 32 bit
- Mac 64 / 32 bit
This on top of the stress of missing dependencies taught me to build 3rd party binaries statically so all binaries contain every dependency they need internally. It isn't easy using a native binary with Java so I'd avoid this, if at all possible.
### Reserved Keywords
In Apktool, there is a situation where we create folders and files based on the naming of internal Java classes. Clever developers noticed they could create a class package named "COM5" and when done, Windows once again experienced a crazy problem.
From a relic of the DOS era, none of the following words can be used in a folder name without some tricks on Windows.
```
CON, PRN, AUX, CLOCK$, NUL
COM0, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9
LPT0, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LP
```
This forces developers to create a lookup table to store the files on the file system under one name, but remember the original correct value when referenced in the tool.
### Max Command Length
In Apktool, we execute a 3rd party tool that requires a great deal of parameters. It seemed simple as we pass the parameters on and capture the result. This worked great on all platforms except Windows. Windows gave us quite a nasty error in return.
```
Caused by: java.io.IOException: CreateProcess error=206
```
We can cross check [Microsoft documentation](https://msdn.microsoft.com/en-us/library/windows/desktop/ms681382%28v=vs.85%29.aspx?ref=connortumbleson.com) and find:
> ERROR\_FILENAME\_EXCED\_RANGE
> 206 (0xCE)
> The filename or extension is too long.
Which means our command was too long. Lets take a look at command line limits in a few systems.
| Max Command Length | System |
| ------------------ | ------------------- |
| 8,191 characters | Windows 10 |
| 32,000 characters | Cygwin (Windows 10) |
| 131,072 characters | Ubuntu |
| 262,144 characters | Mac OS X |
(these values isolated to my equipment, may be different for your own)
This means in order for our application to function perfectly, we must design it in a way that never executes a command that exceeds 8,191 characters. Perhaps this is running the 3rd party binary multiple times or rethinking the problem.
### Max Folder Structure Length
Once again in Apktool, we have an interesting test case to test the possibility of all qualifiers together. This tests our decoder with the maximum possibility, which creates a directory named this:
```
/values-mcc004-mnc4-en-rUS-ldrtl-sw100dp-w200dp-h300dp-xlarge-long-round-highdr-land-desk-night-xhdpi-finger-keyssoft-12key-navhidden-dpad-v26
```
Append in the entire project path and we get this:
```
/brut.apktool/apktool-lib/src/test/resources/brut/apktool/aapt1/testapp/res/values-mcc004-mnc4-en-rUS-ldrtl-sw100dp-w200dp-h300dp-xlarge-long-round-highdr-land-desk-night-xhdpi-finger-keyssoft-12key-navhidden-dpad-v26
```
Once again, Windows strikes with an annoying problem. Our limit on Windows for the entire directory structure is 255 characters. We already have 217 above, so cloning our project into a directory path over 38 characters will break Apktool.
Looking at a few systems again shows us the max is different among the pool of systems.
| Max Path Length | System |
| ---------------- | ---------- |
| 255 characters | Windows 10 |
| 4,096 characters | Ubuntu |
| 4,096 characters | Mac OS X |
We quickly see that our application fills with complex operations for dealing with the ins and outs of every operating system. However, the benefit of writing Java and only requiring a JVM on each system prevents the stress of individually building and supporting binaries for each system. I hope a few random tidbits of what I encounter building cross-platform Java applications may help anyone reading.
Featured image by [Caspar Rubin](https://unsplash.com/@casparrubin?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### 9 Months with a Pi-hole
URL: https://connortumbleson.com/2018/03/25/taking-a-look-at-9-months-of-pi-hole/
Last updated: 2018-08-22T01:19:24.000Z
About nine months ago, I installed a piece of software called "[Pi-hole](https://pi-hole.net/?ref=connortumbleson.com)" to a Raspberry Pi and routed all my Internet traffic through it. This tool blocks advertisements for all devices on my network, so this includes mobile devices and cameras.
A feature many wanted was the ability to store long-term data on what domains were blocked, what device(s) requested that domain and how often they were requested. In the past we were limited to a rolling 24 hours, which produced a view like this:
I can infer that generally when sleeping, a majority of the requests that my devices make are blocked. What becomes more interesting is when we tabulate nine months of data and draw some conclusions.
So I ran an export which gave me a `219.5 MB` sqlite database file. The first entry was dated June 23, 2017 and the last entry being March 24, 2018\. This gives 274 days of data to parse for a total of **2,889,704 requests**.
With 274 days of data, we get 383,600 minutes. So simple math gives us roughly 7.53 requests a minute across that time span. Taking all those requests, we can break them into the following categories.
| Status | Count |
| ------- | --------- |
| Allowed | 1,927,304 |
| Cached | 684,185 |
| Blocked | 276,942 |
| Unknown | 1,921 |
So for starters, I'll grab the top ten most visited domains that are not blocked. This should give a good indication of what websites/products I normally use.
| Domain | Count |
| ----------------------------- | ------- |
| b.canaryis.com | 333,629 |
| clients4.google.com | 94,777 |
| play.google.com | 78,242 |
| clients6.google.com | 67,188 |
| ssl.gstatic.com | 59,023 |
| slack.com | 30,399 |
| www.googleapis.com | 28,989 |
| i.canaryis.com | 28,896 |
| google.com | 27,452 |
| clientservices.googleapis.com | 24,365 |
First off, the `clients#.google.com` domains are apparently Google Maps. I do use Google Maps a ton as a by product of playing GPS based games, so this makes sense.
Second, we have a few Google domains which seem to be related to assets and needed functionality that Google provides.
Finally, the interesting point is the `b.canaryis.com` and `i.canaryis.com` domains which have combined nearly 360k requests over nine months. This is probably from my [Canary Home Security System](https://canary.is/?ref=connortumbleson.com), which I very much enjoy having. The requests seem to alternate between domains roughly every minute which is probably responsible for machine learning for the temperature or detection of a person caught in the film. Looking at just the previous six minutes, this thing indeed sends a lot of requests in comparison to other devices in my home.
Switching gears to the blocked requests, we see they account for 23% of all requests. What domains are constantly being blocked? Lets take a look at my top ten blocked domains.
| Domain | Count |
| ------------------------------- | ------ |
| ssl.google-analytics.com | 62,017 |
| settings-win.data.microsoft.com | 38,691 |
| watson.telemetry.microsoft.com | 24,306 |
| e.crashlytics.com | 15,466 |
| ssl.gstatic.com | 59,023 |
| api.mixpanel.com | 9,940 |
| www.google-analytics.com | 9,385 |
| ssw.live.com | 9,183 |
| www.googleadservices.com | 6,063 |
| graph.instagram.com | 5,579 |
This table of domains seems mostly obvious in terms of blocking. I'm glad that Google Analytics and anything related to Windows telemetry is now blocked. I wasn't aware what `mixpanel` was for, but that is Twitch advertisements. I do watch Twitch quite frequently, so that makes sense.
Now that we know which domains are being blocked, lets take a look at the top six devices in my home that are making these requests.
| Device | Count | Type |
| ------------------ | ------- | --------------- |
| tombstone.local | 679,685 | Ubuntu Laptop |
| win10\_old.local | 413,741 | Windows Desktop |
| C100M1402129.local | 280,963 | Security Camera |
| 192.168.1.235 | 178,809 | Unknown |
| iBotPeaches.local | 166,167 | Windows Desktop |
| EXODUS.local | 148,916 | Windows Desktop |
Before I had host names, it would list the IP of the device that made the request. None of my devices currently have the .235 allocation and the requests it made makes me think a Windows computer, so more than likely the iBotPeaches/win10\_old host name.
As time goes on, my analytics for blocked domains will continue to increase. Which is pretty funny in a sense, because I'm blocking domains that track me while I'm recording those domains for my own tracking. I'll end this post with a snapshot of my Pi-hole, with a note to myself to buy a bigger SD Card for this Raspberry Pi.
### "You have a Package Delivery Today"
URL: https://connortumbleson.com/2018/03/18/you-have-a-package-delivery-today/
Last updated: 2018-08-22T01:19:24.000Z
Taking a trip back in time, I ordered a [OnePlus 3T](https://oneplus.net/3t?ref=connortumbleson.com) way back on November 22, 2016.
This would lead to the strangest series of text messages that I didn't fully research until a few weeks ago.
The first message nearly two years in the past (*Friday, Nov 25, 2016*) was:
> *I am a dhl agent , you have a package delivery today. If you are not going to be at home and want the package left please reply to this text: with your name, asking us to leave the package, address and package transfer number.*
This felt weird for so many reasons. I've had hundred of packages delivered and never once had the delivery agent text me. It felt like a scam, but I did actually have a package out for delivery. I was going to be at work that day and didn't want to wait the entire weekend for the delivery of my new phone so for a brief moment I considered responding.
I then saw the text message included 19 other people. My phone was going crazy with notifications due to not being able to sustain a group chat of 20 people. Responses started coming in like the following.
> *Hello..I am will be at the address after 9pm until 5pm...if i am not there please leaved the box at the Animal hospital next to us*
This was beyond strange, because of the mix of warnings and truth among each message. The grammar matched nothing of an American citizen, but the details within matched closely to my apartment, as my place is located near an animal hospital.
The details requested by the original message were as follows:
- Name
- Address
- Package Tracking Number
With those three pieces of information you can "redirect" a package to a different address. I know, because thats all I needed when I moved a package to deliver to my work address instead of home.
At this point, I knew I wasn't going to respond to this text. It was clear that it was an attempt to steal my package. The phone didn't end up getting delivered until November 29, 2016 and the lady who delivered it, when asked, did not send those text messages.
It wasn't until two years later that I began looking into this again. Was this a hack on DHL? A hack on OnePlus? Who leaked what that someone knew I was getting a package? I began doing some analytics on the numbers also in the group chat.
**Area Codes included in text message:**
- (813) - Tampa, FL - 14 times
- (407) - Orlando, FL - 2 times
- (646) - New York, NY - 1 time
- (313) - Detroit, MI - 1 time
- (239) - Cape Coral, FL - 1 time (sender)
- (913) - Overland Park, KS - 1 time (me)
There was nothing consistent to draw a pattern and I wasn't about to call these numbers two years later to complete my research for a blog post. I did look into the single address that was posted in the text group and it was within 2 kilometers of my apartment.
Most of the text responses resembled that of spam emails, littered with grammar mistakes and barely readable English. Were some of the phone numbers in this group fake? Perhaps added by the sender to falsely validate the attempt to retrieve information.
As the text conversation continued in the past, it was a dice-roll whether the response made sense or not.
> *My Wife Will Be Home Delivery The To My Home*
> *??? Who it is?*
> *This is Zak with \[redacted\] r u sure u got the right number ?*
I continued researching hacks against DHL and OnePlus and could only find a [One Plus hack](https://www.bbc.com/news/technology-42745212?ref=connortumbleson.com) in November of 2017\. The details of that hack put me outside the affected date range so I was back to the drawing board.
With the events being so far in the past, I decided to let it go. The lesson learned was simple - do not trust anything over email or text messages unless you are extremely positive it is legitimate. Had I responded with the requested details, I'm sure my package and brand new phone would have been redirected elsewhere and resold.
Featured image by [Seb Creativo](https://unsplash.com/@sebcreativo?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### The internals of a Premium WordPress Theme (Gonzo)
URL: https://connortumbleson.com/2018/03/11/the-internals-of-a-premium-wordpress-theme-gonzo/
Last updated: 2018-08-22T01:19:24.000Z
I purchased my first Premium WordPress theme called [Gonzo](http://themeforest.net/item/gonzo-clean-responsive-wp-magazine/2415788?ref=connortumbleson.com) at its `1.9.2` release. As of this blog post, the current version is `1.9.7` updated on June 29, 2015.
This theme has 8,602 sales at $49 per purchase (Not counting extended support). Now 8,602 sales \* $49 = $421,498\. That is of course without tax and fees, but still that is a lot of money even if you slice it in half, so this author must have made a pretty sweet theme.
On the outside it fit our purpose easily. A responsive design that kept that magazine style of blog posts on mobile to desktop screens. Additionally it had a multitude of customization allowed on articles and categories.
Like a Premium WordPress theme though, it came packaged with unneeded things. An entire review system, comments between Facebook/WordPress, BBPress connection, tons of widgets, extra short codes to enhance posts and more.
This post is about the internals though. Recently, I decided to create a custom WordPress plugin to build some additional functionality into our site. I wanted to leverage our current theme so I could blend it in perfectly. So I created a local install with our production theme. This OptionTree system was easy to export/import theme settings so the theme, without our menu system, was set-up locally.
So I opened up the Plugin guide from WordPress, and the first step was to enable debug mode.
> Enabling WP\_DEBUG will cause all PHP errors, notices and warnings to be displayed. This is likely to modify the default behavior of PHP which only displays fatal errors and/or shows a white screen of death when errors are reached.
This started the pain.
```
// Notice: register_sidebar was called incorrectly. No id was set in the arguments array for the "Sidebar" sidebar. Defaulting to "sidebar-1". Manually set the id to "sidebar-1" to silence this notice and keep existing sidebar content. Please see Debugging in WordPress for more information. (This message was added in version 4.2.0.)
// Notice: The called constructor method for WP_Widget is deprecated since version 4.3.0! Use __construct() instead.
```
My page was littered with 18 notices about random theme errors. So I took a look at the first one.
```
/** constructor -- name this the same as the class above */
function video_widget() {
parent::WP_Widget(false, $name = 'Video Widget');
}
```
This was a simple fix in reality, but how did this escape testing for the past few versions (Including the Gonzo current version `1.9.7`).
Well, WordPress 4.3 is throwing the notices and that came out on August 18, 2015\. This Gonzo theme hasn't had an update since then, so we can let that one slide. Even though, I don't know many PHP developers still using PHP4 style constructors. The correct solution is this.
```
/** constructor -- name this the same as the class above */
function __construct() {
parent::__construct(false, $name = 'Video Widget');
}
```
On to the next error.
```
register_sidebar was called incorrectly. No id was set in the arguments array for the "Sidebar" sidebar.
```
A quick Google search brought up the [function reference](https://codex.wordpress.org/Function%5FReference/register%5Fsidebar?ref=connortumbleson.com) for this call. We can see that WordPress 4.2 now triggers `E_USER_NOTICE` for using this method incorrectly.
Lets look at a block of code in our theme that led to this.
```
if ( function_exists('register_sidebar') ) {
register_sidebar(array(
'name' => 'Sidebar',
'before_widget' => '',
'after_widget' => ' ',
'before_title' => '',
'after_title' => '
'
));
}
if ( function_exists('register_sidebar') ) {
register_sidebar(array(
'name' => 'Footer Column 1',
'before_widget' => '',
'before_title' => '',
'after_title' => '
'
));
}
```
My initial impressions after reading this was simply stumped. First off, there is no need to run `function_exists` on every sidebar to register. You could group these 6 sidebars under one `function_exists`. Though, I'm not sure why this is even wrapped in a `function_exists` call. If this fails, your theme will have no sidebars, thus no location to insert widgets which doesn't seem possible in a WordPress envirnonment.
There is a `register_sidebars()` function designed for multiple sidebar registrations. This wouldn't work completely here, because some of these sidebars are in different locations (header, footer and sidebar).
However back to the notice (error). This theme is missing the `'id' => 'unique-id'` on each sidebar. This error I can't excuse easily. Following the Theme Testing Process step 1 says "*Fix PHP and WordPress errors*" detected by `WP_DEBUG`. WordPress 4.2, which added this notice, came out on April 23, 2015\. The latest Gonzo release as of this post should have had this patched.
At this point, the blaring notices on top of the page are gone - we can now sign into the admin panel. Though, after clicking on "New Post" we are met with some interesting console errors.
```
GET http://localhost:8080/home/ibotpeaches/Projects/PHP/wordpress/wp-content/themes/gonzo/includes/classes/meta-box/js/color.js [HTTP/1.1 404 Not Found 4ms]
GET http://localhost:8080/home/ibotpeaches/Projects/PHP/wordpress/wp-content/themes/gonzo/includes/classes/meta-box/js/gonzo.js [HTTP/1.1 404 Not Found 2ms]
```
For some reason, this system is trying to load two files (`color.js` and `gonzo.js`) using a wrong URL path. So a quick grep for `gonzo.js` returns
```
functions.php: wp_register_script('metabox-js-gonzo', get_template_directory_uri() . '/includes/classes/meta-box/js/gonzo.js');
includes/classes/meta-box/meta-box.php: wp_enqueue_script( 'rwmb-ollie', RWMB_JS_URL . 'gonzo.js', RWMB_VER );
```
So which one of these is wrong?
The first one gives:
```
http://localhost:8080/wp-content/themes/gonzo/includes/classes/meta-box/js/gonzo.js
```
That looks right.
`RWMB_JS_URL` must be wrong. So we dig into that and we get:
```
/home/ibotpeaches/Projects/PHP/wordpress/wpcontent/themes/gonzo/includes/classes/meta-box/js/gonzo.js
```
Yeah that isn't right. We are loading assets, not getting file path references.
Looking at the code that is responsible for this.
```
// Define plugin URLs, for fast enqueuing scripts and styles
if ( ! defined( 'RWMB_URL' ) )
define( 'RWMB_URL', plugin_dir_url( __FILE__ ) );
define( 'RWMB_JS_URL', trailingslashit( RWMB_URL . 'js' ) );
```
I shouldn't have to touch this though, this is a dependency inside of Gonzo. I wonder how the author handled this, maybe they defined `RWMB_URL` ahead of time. Lets grep for that.
```
~ grep -r 'RWMB_URL' *
functions.php:define('RWMB_URL', trailingslashit(get_template_directory() . '/includes/classes/meta-box'));
```
Sure enough we found it in `functions.php`.
```
// Re-define meta box path and URL
define('RWMB_URL', trailingslashit(get_template_directory() . '/includes/classes/meta-box'));
define('RWMB_DIR', trailingslashit(get_template_directory() . '/includes/classes/meta-box'));
```
I think I know what happened here. A copy and paste without testing. After looking at the docs for `get_template_directory` I see in the [notes](https://developer.wordpress.org/reference/functions/get%5Ftemplate%5Fdirectory/?ref=connortumbleson.com) that you must use `get_template_directory_uri` to obtain the URI.
A 4 character fix later, we are back in business loading those two files. So now I figured I would try out some of the short codes this theme offers. I click the "Insert Alert" button in editor and met with some interesting errors.
Okay, the first one is WordPress, but the rest are not.
I mean, what is even going on here? This doesn't look themed or styled at all. It looks like the web in 1999.
Above is the default link pop up that WordPress provides.
So why is Gonzo looking so bad?
Why why why. I can't understand it. This theme for all 6 short codes load its own HTML via a PHP page instead using the established and consistent UI that WordPress offers. I understand a custom pop up may be needed for complex operations, but these are just textboxes and an occasional listbox.
Including your own themed pop up forces you to manage the dependencies you have included, build the entire pop up UI, including keeping the API up to date since you are manually hooking into events that would otherwise be handled by WordPress. This as we can see, caused some troubles and left this theme with no styling.
Since I haven't used these shortcodes, I unregistered their buttons on the editor.
So let's switch gears. Something in this theme was eating our gallery images into their own format. We prefer to use the Jetpack Gallery, so needed to find out what was happening.
There was a `106.04Kb` file called `scripts.js` being loaded on the frontend that had some javascript I needed to change. `106.04Kb`? That is bigger than jQuery, so must be a lot of packages.
It wasn't too hard to figure out why. This `scripts.js` file loads
- Fitvids 1.1
- ElastiSlide v1.1.0
- Flexslider v2.2.2
- usagelog
- jQuery Easing
- Backstretch
- prettyPhoto v3.1.6
- Gonzo User Ratings
- ElastiSlide (yes different than previous)
Now I might be off on this, but I see in multiple other places in this theme `wp_enqueue_scripts()` which queues scripts/styles that need to be used on the page. I don't use a background image or the gonzo rating systems. That means I can remove two of those dependencies. Maybe this theme should have detected that and not simply fed the same massive `styles.js` file to everyone. When we are talking mobile load speed, clearing 30KB worth of scripts is well worth it.
A few funny things I found while digging through this theme on my adventure to fix some bugs.
While reading `scripts.js`, I noticed this line.
```
$omc('.sdfsdf').delay(500).fadeOut(500).delay(500);
```
Does `sdfsdf` stand for something I don't know? Or was this a keyboard mash for a class name.
Additionally, I found this block of code.
```
/**
* Register meta boxes
*
* @return void
*/
function YOUR_PREFIX_register_meta_boxes()
{
// ...
}
add_action( 'admin_init', 'YOUR_PREFIX_register_meta_boxes' );
```
It says `YOUR_PREFIX`. At this point, I'm not even surprised.
This next one is in the dependency that Gonzo uses.
I guess this author's meaning of a CDN is hotlinking images from imgur. I feel bad for anyone who uses this feature if/when those links die.
Some closing notes.
1. All these tests were done on WordPress 4.4.2 with Gonzo 1.9.7 clean.
2. I did the above tests with a clean download of 1.9.7 Gonzo.
3. Plugins installed: Akismet & Hello Dolly (default on install)
4. Yes this post was published in 2018 when research was done in March 2016.
The drive behind this post was simply aggravation. A weekend I had planned to hack a cool plugin was limited by first theme bugs and then my continued investigation into that theme.
Timeline
- 3/13/2016 - Emailed author asking for comment on post.
- 3/14/2016 - Author responds saying "will fix everything asap".
- 3/14/2016 - Author asks for "a week or so" to update things.
- 4/19/2016 - Emailed author asking for update.
- 4/20/2016 - Author responds "most things are fixed".
- 3/11/2018 - Release article as no new version has been released in over two years.
### Comprehending Online Trolls
URL: https://connortumbleson.com/2018/03/04/comprehending-online-trolls/
Last updated: 2018-08-22T01:19:24.000Z
We will start this post in the past with my first taste of online gaming, which dates back to the day I weaved a 100ft ethernet cable from the router to a room where an original Xbox sat. We used the free one month of Xbox Live provided and entered the world of online gaming.
Even without a microphone or a game that provided text chat, I would soon encounter my first online troll. A Halo 2 game was a classic deathmatch to 50 kills between two teams of four people. One game I started a random teammate began killing himself, waiting for the 8 second respawn and doing it again. I watched our score go from 0 to -1 to -2, etc.
I tried with my gaming friend to salvage this game as losing would destroy the effort made in the past hour of our victories. We slowly climbed out of the negative, but ended up losing the game by a solid 20 something kills. Our teammate contributed an ugly -30 kills to our score. What provoked this gamer to do this? We had surely not met before, yet this person felt the need to cause our team to lose very much intentionally.
This was just the start of a never ending circle of trolls. A new iteration of this game launched with an interesting twist - killing yourself no longer subtracted a kill, which neutralized a method that trolls utilized. Much like the flu evolves yearly, the trolls evolved their methods. They would stand in front of you, await an accidental bullet to be fired and then use the friendly damage to jump off the map. Since you accidentally fired a bullet into this individual, it counted as you "betraying" that troll. A few times of doing that and the troll had the ability to boot you from the game for abuse.
This was laughable, it became a game for the trolls to try and boot its entire team while the enemy team was pummeling them into defeat. We can find these examples in all the video games I've played in the past few years.
- **Minecraft**
- Joining a server and proceeding to burn a house down, flood a house and/or push an individual into lava. All of these destructive operations.
- **Need For Speed**
- Intentionally crashing into someone during a race. Obvious that this individual is not competing for 1st place, they just want to cause as much destruction as possible.
- **Destiny**
- Taking "power" weapons to jump off the map with. Running into the enemy over and over without attempting to fire back (feeding).
- **Gears Of War**
- Spending the shared team money on useless items, glitching out of map preventing the game from ending until one team left.
- **Halo**
- Picking up the best weapons and bringing them to enemy. Standing in corner shooting the ground attempting to "de-level"
Talking about the variety of trolls is not why I wrote this post. I want to understand why these individuals exist and what encourages them to do any of the above things.
We have to be careful when talking about this, because we aren't talking about cheating. Trolling (Griefing) lives in games without any malicious game-breaking modifications. They work within the same bounds of every other player only living to annoy other players.
I started doing research in how companies were trying to combat these trolls and I ended up with some research regarding Blizzard (video games) and YouTube (videos).
YouTube doesn't deal with trolls like the video game industry, they deal with a never ending battle of negative comments. These comments range from positive to a taste of online bullying to flat out death threats. These comments hide behind the anonymity of an online username and YouTube at one point believed that was the source of the issue.
They started to allow Google+ to be used for comments. This attached your real name when attempting to use YouTube as shown from these [old release notes](https://youtube.googleblog.com/2012/06/choosing-how-youre-seen-on-youtube.html?ref=connortumbleson.com).
Should you choose to not use the Google+ profile meant that you had to use a "Brand" profile that represented a company or persona that you created. This meant that trolls that lived on negative comments had to create either fake Google+ accounts or fake "Brand" accounts otherwise they would be posting from their real Google+ profile.
This didn't really work for YouTube. Opinions ranged from the safety of real names to people vehemently disagreeing with bridging personal profiles with their previous online alias. On the other side of the spectrum, Blizzard has a different problem to battle with troll players disrupting the experience for others. They took an approach to hire a new employee solely dedicated to proactively finding griefing across their game. This employee would monitor social media and YouTube finding those videos/snippets of griefing play and issue warnings and bans to those users involved.
A [snippet](https://np.reddit.com/r/Overwatch/comments/7vkad9/timthetatman%5Fexplains%5Fwhy%5Fhe%5Fmight%5Fstop%5Fstreaming/dtumnhf/?ref=connortumbleson.com) from a recent publicized ban of a large griefer shows the scale of this issue.
> To be clear this player is being banned, not for their hero choice, but rather for systematically ruining Overwatch games for thousands of players.
There is a good quote I learned at some point in life. The context isn't important because it can be applied to nearly everything.
> You can do what you want, as long those actions don't negatively affect others.
I could eat a tuna sandwich on an airplane, but I won't subject everyone around me to the smell of fish. I could blast my music in my apartment complex, but I won't subject my neighbors to the drowned sound of a low bass beat.
During a stressful night of gaming, I was one victory away from reaching a new milestone. Like most milestones, luck of the draw tossed me a teammate who would refuse to play a character to benefit our team. Another teammate began yelling at this individual and this individual snapped, switching characters once again, but this time just staying in the spawn room not playing.
As the minutes ticked by and it was clear we could not win out numbered, I asked this individual what drives him to "throw" games. His answer was mainly a joke.
> *I could be in Masters if I wanted, but I enjoy playing in this joke tier so I don't have to play with try-hards. However, if f--ktards will insult me for playing a character, they can take a loss. I don't care, I can level back up any time I want.*
I argued with him about his choices affecting five other people negatively, but he wouldn't budge. Ending his monologue with a statement.
> *I bought this game, just like you did. I am entitled to play however I want.*
We lost the game so I started thinking about how far trolls and griefing have evolved and it wasn't pretty. Just 3 months ago from the time of this post, the actions of a troll resulted in the [death of an individual](https://www.cnn.com/2018/01/23/us/kansas-police-shooting-swatting-lawsuit/index.html?ref=connortumbleson.com) due to "swatting". Swatting for those unaware is the action of calling in a fake threat at the residence of the target. This forces the local police to react to the notice with deadly force.
No matter the game I play or the comment enabled website I visit, these trolls will remain. I can't begin to wonder what went wrong in their brain to produce these lack of empathy humans.
*Featured image by [Tom Roberts](https://unsplash.com/@tomrdesigns?utmsource=ghost&utmmedium=referral&utmcampaign=api-credit&ref=connortumbleson.com)*.
### Retiring Unity. Hello GNOME
URL: https://connortumbleson.com/2018/02/26/retiring-unity-hello-gnome/
Last updated: 2018-08-22T01:19:24.000Z
My primary laptop is a Sager notebook purchased far too long ago. The sticker on the bottom is a license for Windows Vista if that provides any scale of age. The computer for as long as I remembered though has been running some flavor of Linux.
It started with openSUSE, but I found out quickly that flavor wouldn't work for school due to a variety of reasons. So Ubuntu became my flavor of choice for years and years to come. This laptop has had a few [issues](https://plus.google.com/+ConnorTumbleson/posts/btStEurVQik?ref=connortumbleson.com) along its journey including replacing the drive [once](https://plus.google.com/+ConnorTumbleson/posts/ZHQvksFo81K?ref=connortumbleson.com) and this is a continuation of those issues.
As it usually happens, I took an apt upgrade and things took a turn for the worse.
```
Start-Date: 2018-02-23 07:38:54
Commandline: apt-get upgrade
Requested-By: ibotpeaches (1000)
Upgrade: ...
```
I don't know why I ran an upgrade, but it cost me. After returning from my screensaver, I had a black screen with a cursor. I just rebooted as that usually fixes cryptic issues, but to no avail this time.
I did the usual searching for a solution and nothing worked. Research pointed me to Unity breaking. For those unaware, Unity is a desktop environment of choice for Ubuntu which in April of this year (2018) will be replaced with GNOME.
Instead of wasting hours or days on fixing a cryptic issue, I decided to switch to GNOME, leaving Unity behind.
```
Start-Date: 2018-02-23 19:00:02
Commandline: apt install ubuntu-gnome-desktop^
Requested-By: ibotpeaches (1000)
```
(As you can see, I already wasted a good deal of time as shown by the timestamps between those commands)
I was now presented with an option to select my desktop environment when signing in.
GNOME looked very modern compared to my last experience with it, which is largely in part due to the [GNOME 3 upgrade](https://www.gnome.org/gnome-3/?ref=connortumbleson.com).
My system booted and I was signed into my new GNOME environment. For reasons outside my knowledge, random applications had to be signed into again. Chrome lost track of my sign in, along with Keybase and Synergy. Yet Thunderbird was still working without a hitch. My guess is that I accidentally wiped some configuration in the stress of trying to repair Unity.
The desktop was bare showing nothing but a wallpaper, but still a much more modern refined look than the prior Unity.
It felt clean and looked a tad bit like the screen shots for [Elementary OS](https://elementary.io/?ref=connortumbleson.com), so I was excited to try it out. I enabled desktop icons as I still was attached to having some folders on my desktop and enabled the dark mode as looking at white/bright colors all day just hurts the eyes.
I quickly discovered there was no "launcher" visible like in Unity. This would be the task bar in Windows or the dock on Mac for comparison. Instead a simple keyboard key would launch me into a search screen with a couple of favorite/opened applications listed on a sidebar along with any programs I had open.
I couldn't discover an easy way to minimize an application besides right clicking for the option menu, but instead of piling windows into the same desktop, I could leverage the multiple desktops per monitor GNOME provided. Mastering the keyboard shortcuts for this feature I imagine will outweigh any benefit of using the outdated minimize feature.
I sit on Ubuntu 16.04 and the upcoming release (18.04 LTS) will more than likely bring tweaks/design enhancements for GNOME. I can't upgrade this computer any further for fear of breaking the system, so here I will stay. I will not fear the switch to GNOME though for any other system I have.
### Taking a look at AAPT2
URL: https://connortumbleson.com/2018/02/19/taking-a-look-at-aapt2/
Last updated: 2018-08-22T01:19:24.000Z
For those familiar with the Android ecosystem, applications built by developers and even some part of the Android system are built via AAPT. This stands for **A**ndroid **A**sset **P**ackaging **T**ool and is quite a nifty piece of software. It takes all the resources, including some preassembled files and zips them up into a zip file known in Android as an APK.
[Apktool](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com) uses AAPT internally for the build process instead of manual rebuilding files like `resources.arsc` from scratch. AAPT can be leveraged with nearly 30 parameters, which are the relics of a piece of software patched over a decade. If you were to run `aapt` now, you would get the following commands to execute.
```
$ aapt
Android Asset Packaging Tool
Usage:
aapt l[ist] [-v] [-a] file.{zip,jar,apk}
aapt d[ump] [--values] WHAT file.{apk} [asset [asset ...]]
aapt p[ackage] [-d][-f][-m][-u][-v][-x][-z][-M AndroidManifest.xml] \
aapt r[emove] [-v] file.{zip,jar,apk} file1 [file2 ...]
aapt a[dd] [-v] file.{zip,jar,apk} file1 [file2 ...]
aapt v[ersion]
```
If you wanted to build an application without the benefit of an IDE, you would probably have to use AAPT manually with something like this.
```
aapt p -F output.apk -I path/to/current/android.jar -S res -M AndroidManifest.xml
```
This basically says
- p = package mode
- \-F = Output file (apk)
- \-I = Framework package include, to reference AOSP resources
- \-S = Directories where resources can be found
- \-M = Full path to AndroidManifest file
So let's make an example application with an `AndroidManifest.xml` file and one `strings.xml` resource file and try and build it with verbosity enabled.
```
aapt p -F output.apk -I ~/.local/share/apktool/framework/1.apk -S aapt1/res/ -M aapt1/AndroidManifest.xml -v
Configurations:
(default)
Files:
values/strings.xml
Src: () aapt1/res/values/strings.xml
AndroidManifest.xml
Src: () aapt1/AndroidManifest.xml
Resource Dirs:
Type values
values/strings.xml
Src: () aapt1/res/values/strings.xml
Including resources from package: /home/ibotpeaches/.local/share/apktool/framework/1.apk
applyFileOverlay for drawable
applyFileOverlay for layout
applyFileOverlay for anim
applyFileOverlay for animator
applyFileOverlay for interpolator
applyFileOverlay for transition
applyFileOverlay for xml
applyFileOverlay for raw
applyFileOverlay for color
applyFileOverlay for menu
applyFileOverlay for font
applyFileOverlay for mipmap
Creating 'output.apk'
Writing all files...
'AndroidManifest.xml' (compressed 52%)
'resources.arsc' (not compressed)
Generated 2 files
Included 0 files from jar/zip files.
Checking for deleted files
Done!
```
That seems easy and sure enough, we have our application.
```
➜ ~ unzip -l output.apk
Archive: output.apk
Length Date Time Name
--------- ---------- ----- ----
584 1980-12-31 19:00 AndroidManifest.xml
596 1980-12-31 19:00 resources.arsc
--------- -------
1180 2 files
➜ ~
```
Now imagine you had an application with 26 languages, 500 images, 200 layouts and 10,000 strings. The process of iterating every resources and building a finalized binary became slow. Slow enough that even a developer ([Chainfire](https://forum.xda-developers.com/showthread.php?t=1907281&ref=connortumbleson.com)) got tired of waiting 30 seconds for an Android build of his application and submitted a [fix](https://android-review.googlesource.com/c/platform/frameworks/base/+/46496?ref=connortumbleson.com) to resolve that.
This would only delay the inevitable, though that fix worked quite well for awhile. As applications evolved a single dependency could bring in 1,000 strings. Applications were now building with multiple `.dex` files and upwards of tens of thousands of resources so the process became slow again.
Android was aware of this problem, but fixing a low level build piece of code was very difficult to do. So they started building "**AAPT2**" from scratch. Crawling GitHub we can see the first commit was on Nov 14, 2014.
```
From 6f6ceb7e1456698b1f33e04536bfb3227f9fcfcb Mon Sep 17 00:00:00 2001
From: Adam Lesinski
Date: Fri, 14 Nov 2014 14:48:12 -0800
Subject: [PATCH] AAPT2
First checking of AAPT2. The individual phases of AAPT2 work, but there
are some missing pieces.
For early testing we are missing:
- Need to properly mark file references and include them in package
- Need to package into zip
Final AAPT for apps we are missing:
- Need to crush PNGs
- Need to parse 9-patches
- Need to validate all of AndroidManifest.xml
- Need to write align method to align resource tables for splits.
Final AAPT for apps + system we are missing:
- Need to handle overlays
- Need to store comments for R file
- Need to handle --shared-lib (dynamic references too).
New AAPT features coming:
- Need to import compiled libraries
- Name mangling
- R file generation for library code
Change-Id: I95f8a63581b81a1f424ae6fb2c373c883b72c18d
```
It wasn't till Android Studio 3.0 (October 25, 2017) that AAPT2 would be set as default and released to the world of Android developers. Nearly 3 years after its creation -- was the world ready for a new and improved build tool?
Not really. The top search for "AAPT2" was asking how to disable it. Developers seemed to ignore the optional "opt-in" testing of AAPT2 and only when defaulted to the newer version notice the changes it brought, opting instead to revert back to the previous AAPT1 binary instead of addressing the issues it brought.
Was there anything wrong with AAPT2? I mean there are some bugs, but it's also a major rewrite of a core piece of software that was a decade old. There was bound to be issues and most of the reported issues aren't bugs, but instead new restrictions.
AAPT1 was too lenient, allowing you to do things that would create issues as Android updated. AAPT2 decided to stop those issues at build time instead of runtime. So what makes AAPT2 so different?
Executing it gives a very slim minimal output.
```
➜ ~ ./aapt2
no command specified
usage: aapt2 [compile|link|dump|diff|optimize|version] ...
```
We notice there is no longer a package command, but instead a compile & link command. This mirrors a more common build system where classes are compiled and then linked together in the final binary. This allows changes to one file to quickly be rebuilt and then linked into the final binary for a speedy build process.
So let's take this for a test drive with our sample application.
```
➜ ~ ./aapt2 compile --dir aapt1/res -o resources.zip -v
➜ ~ unzip -l resources.zip
Archive: resources.zip
Length Date Time Name
--------- ---------- ----- ----
199 1980-12-31 19:00 values_strings.arsc.flat
--------- -------
199
```
So we can see, although no output, AAPT2 crawled the resource directory and extracted our `strings.xml` file in the `/res/values` folder into `values_strings.arsc.flat` which we can guess is an `arsc` representation of our resource. I have no idea what `arsc` stands for, but I know it has something to do with Android resources.
So now lets attempt to build our application.
```
➜ ~ ./aapt2 link -o output2.apk --manifest aapt1/AndroidManifest.xml -I ~/.local/share/apktool/framework/1.apk resources.zip -v
~/.local/share/apktool/framework/1.apk: note: loading include path.
note: linking package 'com.connortumbleson.aapt1' using package ID 7f.
note: merging archive resources.zip.
note: merging resource table resources.zip@values_strings.arsc.flat.
note: enabling pre-O feature split ID rewriting.
AndroidManifest.xml: note: writing to archive (keep_raw_values=false).
note: writing AndroidManifest.xml to archive.
note: writing resources.arsc to archive.
```
Once again, another application compiled.
```
➜ ~ unzip -l output2.apk
Archive: output2.apk
Length Date Time Name
--------- ---------- ----- ----
392 1980-12-31 19:00 AndroidManifest.xml
548 1980-12-31 19:00 resources.arsc
--------- -------
940 2 files
➜ ~
```
The parameters for AAPT2 are a bit easier to understand as they are self descriptive and match much more to regular standards. The reason for this post is that Apktool is currently on the journey of bringing AAPT2 into Apktool and I've spent many hours with both tools understanding both their limitations and features.
I imagine AAPT1 will become legacy in a few years to slowly drift into the state of abandonment. While I'm angry at some issues AAPT2 is causing, I'm excited for the features and benefits it brings. I'll be following AAPT2 development closely to watch it evolve further.
If you are curious about the changes to AAPT2, I recommend following the [changelog](https://github.com/aosp-mirror/platform%5Fframeworks%5Fbase/blob/master/tools/aapt2/readme.md?ref=connortumbleson.com). If you are curious about the status of AAPT2 in Apktool, follow this [bug report](https://github.com/iBotPeaches/Apktool/issues/1689?ref=connortumbleson.com).
Featured image by [Alex Knight](https://unsplash.com/@agkdesign?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
### Stumbling into a MLM (It Works!) on Accident
URL: https://connortumbleson.com/2018/02/11/stumbling-into-a-mlm-on-accident/
Last updated: 2025-01-16T14:55:58.000Z
During the first Saturday of February 2018, I was downtown Tampa for an event. This event was planned by friends and we carefully plan these outings when there is no sporting event. Our goal being we have less stress dealing with parking and people everywhere. Downtown Tampa isn't exactly built for large events as the location is the same place as the cruise ports and large aquarium.
Point being, February 3rd 2018 was suppose to be a relatively calm day. Except, I was slammed with "EVENT" parking signs everywhere. There was no turning around at this point - **our event would go on** \- so I paid some insane parking fees and started my walk to the park.
Due to road closures and barricades, I found the easiest way to walk through Amalie Arena which was covered in some huge event of green & black colors. There was blaring music, a hummer on display and people everywhere. I had stumbled upon
> **ONE: It Works! Conference 2018**
>
> *WE’RE TAKING OVER AMALIE ARENA AND PAINTING THE TOWN WITH BLACK, GREEN, AND BLING BABY!*
>
> ONE thing’s for sure—we’re flipping the script on Conference and everyONE will be talking about this ONE for years to come! Now’s your chance! It’s time to get in the game and secure your ticket for ONE 2018! This is the stage of all stages and the perfect opportunity to immerse yourself into the culture of family that is It Works! because it really will Change Your Life!
I was early to my event and this interesting group of people caught my attention. I had no ticket so I couldn't enter Amalie Arena, but you could easily hear voices and music blaring through doors. In just a few minutes, not even being inside the event, my "Ponzi" scheme senses were tingling. Spending the last few weeks in the cryptocurrency world, Ponzi Schemes have become so common that this trip downtown felt like one.
I stood in a crowd of what I learned to be some expensive event and watched some stay at home mother discuss quitting her job, finally spending time with her kids because she joined *It Works!* enabling her to work on her time.
Calling this company a "ponzi" scheme wouldn't be right, because they actually sell a ton of products. The usability and quality of those products is another story. One can just peek at the Amazon reviews to see that. This is more known as a **M**ulti-**L**evel **M**arketing Scheme which I feel is about equal with a Ponzi Scheme. These schemes work just like a pyramid scheme, which is even clearly put in interactive graphics by the company itself.
I even snipped the graphic as it just gets more confusing. Instead of the traditional pyramid shape, this company tries to confuse with showing a mess of colors and terms across some hierarchical chart. I was already convinced, but decided to do some research as I only experienced the "fun" rally of the event.
It Works! describes its business under 3 types:
- **Retail Customers**
- Onetime purchase at retail price of an It Works! product.
- **Loyal Customers**
- Signup for recurring products through a Distributor.
- **Distributors**
- The members of the business who sell product to other distributors building this "pyramid"
One of the quotes from this document says - "*The more customers you have the more you will earn - directly through your own commissions and indirectly by the sales commissions of your team and Distributors.*"
So I continue reading this mess of a document being thrown terms like BV, PBV and GV. Which all just basically mean volume at the end of the day. This company pushes you to make more money by recruiting more to work under you. This gives you the percentage of their sales and as the chain grows more and more people provide commission to distributors higher than them.
So I wondered, why join a Distributor chain when I could instead start my own? Crawling the website, it seems my "setup" fee was $99 on my own vs $49 through a Distributor. So right out the gate they draw and entice joining under someone.
I was shown a signup page allowing me to pick a username for my own "myitworks.com" page. This had a disgusting 10$ a month paired with another 10$ a month fee for website & admin reasons. From a developer, creating these "website" clones costs exactly $0\. These are just fees to prey on the ill-informed member.
I about screamed reading the rest of this legal document that I just stopped researching further. There are fees for re-stocking items in case of returns, fees if the address is invalid, fees for someone canceling before a 3 month cycle ends.
So I wanted to dig into the profits and thankfully (or maybe by Law) the entire 2016 year of profit was published. This is the wonderful image below.
If you are a member of It Works! and you are reading this, I hope this is enough proof for you to take another direction in your life. Unless you of course are a Diamond extreme platinum whatever member, in which case, keep up the charade you are doing while your peers barely slide by!
This document shows that **77.63%** of distributors make between **$10,383 and $1** **monthly**. Yes you read that right. $1 of monthly income. These are the "pawns" of the pyramid. Some of the profits of these low tiers climb the pyramid all the way to the top.
So lets look at the Ambassador Diamond plan. Only .03% of distributors reach this level and make between **$202,577 and $10,849 a month**.
So what does it take to become an Ambassador Diamond? Everyone wants the big bucks, so you'll need to recruit and earn the following:
- 5 Qualified Legs
- 2 of which being Double Diamond
- 2 of which being Triple Diamond
- 1 of which being Presidential Diamond Leg
- All these legs must be in separate legs (Otherwise the profits would clash)
This just becomes disgusting digging deeper. The Presidential Diamond requires:
- 5 Qualified Legs
- 2 of which being Diamond Legs
- 2 of which being Double Diamond Legs
- 1 of which being Triple Diamond leg
- All these legs must be in separate legs (Otherwise the profits would clash)
I hope you see the picture now. By the time we complete the chart of an Ambassador Diamond, this individual would have 5 people working for them, which each of those 5 people also have 5 people working for them. The requirements for each leg is slightly different, but don't worry - I'll do the math.
- **Ambassador** Diamond (5)
- 2 x Double Diamond
- 2 x Triple Diamond
- 1 x **Presidential** Diamond (5)
- 1 x Qualified
- 2 x Diamond
- 1 x Double Diamond
- 1 x **Triple** Diamond (5)
- 2 x Qualified
- 2 x Diamond
- 1 x **Double** Diamond (5)
- 3 x Qualified
- 1 x Emerald
- 1 x **Diamond** (5)
- 3 x Qualified
- 1 x Ruby
- 1 x **Emerald** (4)
- 2 x Qualified
- 2 x **Ruby** (3)
- 2 x Qualified
- 1 x **Executive** (2)
- 2 x Qualified
Boy that took awhile. So time for some math. We will build each "group" by the amount of humans required.
- \[Q\] Distributor (*Qualified*) = 1 human
- \[E\] Executive = (*2Q*) = 2 humans
- \[R\] Ruby = (*2Q + 1E*) = (2 + 2) = 4 humans
- \[EE\] Emerald = (*2Q + 2R*) = (2 + (4 x 2)) = 10 humans
- \[D\] Diamond = (*3Q + 1EE + 1R*) = (3 + 10 + 4) = 17 humans
- \[DD\] Double Diamond = (*3Q + 1D + 1EE*) = (3 + 17 + 10) = 30 humans
- \[TD\] Triple Diamond = (*2Q + 1DD + 2D*) = (2 + 30 + (2 x 17) = 66 humans
- \[PD\] Presidential Diamond = (*1Q + 1TD + 1DD + 2D*) = (1 + 66 + 30 + (2 \* 17)) = 131 humans
- \[AD\] Ambassador Diamond = (*1PD + 2TD + 2DD*) = (131 + (2 \* 66) + (2 \* 30)) = 323 humans.
So in an easier to consume format. You need this many people working under you per plan, starting at the top.
- Ambassador Diamond = 323 people
- Presidential Diamond = 131 people
- Triple Diamond = 66 people
- Double Diamond = 30 people
- Diamond = 17 people
- Emerald = 10 people
- Ruby = 4 people
- Executive = 2 people
- Distributor = 1 person
So back to the above image ([source](http://static.myitworks.com/legal/images/ids/2016-IDS-us-en-vf.png?ref=connortumbleson.com)) we see that the monthly average income for ALL distributors combined is **$179**, including the fact that **6.48%** made no income.
If you feel you can recruit 323 people to work for you, day in and day out bugging people selling a grossly overpriced product, then It Works! is for you. However, anything less than the top of the pyramid is simply not worth it as you will more than likely bring in $179 a month. Regardless of that, where do you think those fees are going? There are levels probably not even described on the above image because those people don't consider themselves distributors. If that didn't convince you enough, take a look at the 2013/2015/2018 reports below.
2014 for my hour of research could not be located. So lets just look at the average rate from 2013 to 2019.
- **2013 = $937 average per month** for all distributors combined
- 2014 = could not be located
- **2015 = $226 average per month** for all distributors combined
- **2016 = $215 average per month** for all distributors combined
- 2017 = could not be located
- **2018 = $173 average per month** for all distributors combined
- **2019 = $183 average per month** for all distributors combined
- **2022 = $304 average per month** for all distributors combined
Even the images try to mislead you, by putting a total average in the graphic, but this ignores the percentage of distributors who made $0 or less. In order to get those proper total profit averages, we must explore the tiny legal text at the bottom of the graphic.
Update (April 4, 2020) - I wanted to see if I could find any more income disclosures. I still could not find 2014 or additionally 2017\. I can't find any proof of 2019 either. My guess is some legal requirement only forces these every x months, so the company is intentionally ignoring these until required as it paints an ugly picture.
Update (September 7, 2020) - I got an alert that this blog was getting hits & comments so I decided to peek back. It seems our averages for the first time in 7 years have stopped going down! 2018 average was $173 revenue per month and 2019 increased that by exactly $10 to $183.
If the average for the smaller tiers continues to dwindle will they stay as Distributors? Probably not, which in time will drop the "rank" of the people they were connected with. This in time will drop them to a lesser pay per month which will slowly collapse itself. I don't imagine It Works! to be around in a few years.
Update (January 16, 2024) - I got another alert to check this so I found the 2022 income disclosure which helps paint a picture. The average profit from 2019 to 2022 increased by over $100, which suggests as the disclosures show that the MLM is losing the folks at the bottom of the pyramid who contributed to draw that average down. Without the folks at the bottom who paid more fees than earned and increased the level of others we saw the top folks who normally brought in over $100k now falling to \~$64k. It's clear as I suspected almost a decade ago - pockets were lined for those lucky and now the company decays into nothing like every other MLM.
All this research because I stumbled into their large conference. Let me repeat it again - **It Works! is a large Multi-Level Marketing Scheme. Do not take part in it.**
featured image by [Clément\_Bardot](https://commons.wikimedia.org/wiki/User:Cl%C3%A9ment%5FBardot?ref=connortumbleson.com)
### An Evening of Nostalgia
URL: https://connortumbleson.com/2018/02/05/an-evening-of-nostalgia/
Last updated: 2018-08-22T01:19:24.000Z
Photo by [Drew Graham](https://unsplash.com/@dizzyd718?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
A few days ago on my way home I was listening to the radio. This wasn't normal, but I slammed my audio cable in the door and broke it. So gone was the infinite machine learned playlists that Spotify was feeding me - I was back to the commercial filled radio.
It was dark outside like every other night and a song came on that I remembered from years and years ago. This was a radio edit of the deadmau5 song: **Strobe**.
Nearly instantly, my brain went flying into reverse replaying this past part of my life back to me. I was back in Kansas driving at night a perfectly straight rode all the way home. I drove this path commonly when curfew arrived and roads in Kansas as the clock neared midnight were mainly empty. That same drive in Tampa is filled with the looming roar of the above highway and cars going both directions no matter the hour of the night.
Back to the past, the ten minute version of the Strobe was perfect timing for the drive home. Windows open and nearly no cars made the drive quiet except for the beat of the song. Quite a peaceful relaxing drive and just hearing that song again brought me back to that moment.
That is more obviously known as nostalgia or the yearning of past events. I'm no psychology major, but nostalgia trips of recollection are quite fun to have. So I started getting curious about memories in general. I could remember so many finer details of that memory trip, yet I can't remember some events that should be ingrained in my memory forever.
I only remembered those prior events with that feeling of nostalgia because of a common trait between the past and now: the song. That must have propelled some smaller portion of my brain back to that day, a decade in the past. I was curious if I could force my brain into remembering events just by replaying some songs.
If you can't remember what you listened to nearly a decade ago, how do you play it? Thankfully two weeks ago I recovered my [original media center](https://connortumbleson.com/2018/01/21/my-original-media-center/) and on that device was a folder titled "Music" filled with MP3s of songs. I put on some headphones, turned off the lights and started the listening in hopes to piece those events back to the song.
It scarily worked.
- **Lose Yourself - Eminem**
- This song played before every senior year soccer game. Blasted over the sound system at home games for our warm up routine. Once that event was back in my memory the events surrounding that returned.
- **10 Minute Happy Hardcore Mix - DJ Ravine**
- As my interest in techno grew, I discovered that after 10pm a radio channel would start a techno segment hosted by the local in-state college. These were mixed songs from trance to happy hardcore and I thoroughly enjoyed it. This led me to searching for music like this and I discovered DJ Ravine and this song.
- **Can't Be Touched - Roy Jones**
- Couldn't forget this song as it was on the track list for my high school weights class. Pulling me back to the brand new gym and equipment that I was lucky enough to be the first year to use. The smell of chemical cleaning agents was brought back to memory as we wiped down the equipment at the end of every session.
- **Monster - Skillet**
- It was scary how well this was working. This song was in my local library downloaded and played while gaming and programming. A decade ago there wasn't the plethora of streaming services available now so I just had a pile of downloaded music files that became my source.
Some songs made no connection, but then I started thinking back to the strobe driving memory. I was driving home and the song came on the radio. I matched two of the senses that happened a decade ago - the touch and the hearing. I was only replicating the audio as the only sense in this test of mine. I can't test what I don't remember though, so perhaps I just have to wait until another common occurrence pushes my brain to remember something in the past.
### Understanding The Matrix Trilogy
URL: https://connortumbleson.com/2018/01/28/understanding-the-matrix-triology/
Last updated: 2020-06-03T22:13:46.000Z
The series of Matrix movies is probably one of the only movie series I highly recommend anyone to watch. This post is a deep dive into understanding the series and examine my interpretation of some unknown questions.
I've watched these films many times and discovered these conclusions, perhaps wrong, on my own accord. The rest of this post does assume you've seen these movies.
We learn a lot of things in each movie, so we will start in the beginning and walk through this series.
1. **The Matrix (1999)**
Neo is located and freed from the Matrix, entering what we believe is the real world. A world decimated by machines, atmosphere clouded by humans and intrinsic tunnels littered underground holding various massive crafts used to "hack" into the Matrix.
This movie is all about the journey of learning about the Matrix, which is in fact, a large networked computer system powered by the brains of humans. The characters we follow work between the real world and the Matrix. As these characters "hack" into the Matrix, they can be loaded into their own sandbox of code. This area allows the introduction of weapons and/or items which they can load into the Matrix when ready.
With this understanding, these characters knowledge in the Matrix is infinite. They can be taught anything from fighting to hot wiring a car. Knowledge in the Matrix is just ones and zeros, which can be hacked. As these characters "jack into" the Matrix, a set of programs in the Matrix known as "Agents" are immediately after them. They are attempting to discover the entities responsible for hacking their system and eliminate them. Much like a human body works to rid itself of disease.
In this movie, we are introduced to **The Oracle**, one of the many important characters in this movie. An all knowing program who tells our characters exactly what they need to hear. After some small talk, Neo leaves with a cookie from the Oracle, which sounds eerily familiar to browser cookies. He takes a bite, absorbing a tiny amount of code from the all-seeing Oracle. Neo is under the impression via Morpheus that he is **The One**, the Oracle neither confirms nor denies this and if Neo cannot exhibit anything more than a regular human plugged into the system, is he really the One?
We don't learn this answer until the end of the movie where Neo takes 8 bullets to the chest from an agent program. He is apparently dead in the Matrix and a body without a mind cannot live, so we are lead to believe he dies in the real world. However, this is **The One** whose Matrix counterpart finally realizes it (perhaps from the cookie from the Oracle and kiss from Trinity) and awakes from death in the Matrix. With this new profound knowledge that this world is fake, Neo sees it for what it is - a bunch of computer code.
The Matrix is fake and Neo knows it now, going straight into fighting an Agent, jumping into its body killing it. We can infer from this exchange that Neo's Matrix code has overlapped with a Matrix program's code which is crucial to understanding the future movies.
**2\. The Matrix Reloaded (2003)**
As this movie begins, we get to see **Zion** which is initially depicted as an all white organized realm. The last remaining human civilization in the real world, hidden deep underground which the Agents in the Matrix are destined to discover and destroy. We learned that minds that reject the Matrix are no longer viable sources for energy which makes them useless for machines. The machines toss out these bodies for death, possibly unknown to the fact that Zion humans are saving these rejects returning them to Zion.
This is why Neo took the Red Pill in the first movie, it disrupted his real world signal tricking the Matrix into thinking he rejected the simulation he was being fed. This allowed our characters to find his rejected body in the real world and save it, as a body that hasn't moved isn't exactly usable.
Back in the Matrix, Agent Smith who was killed at the end of the first movie has returned. However, he is not connected with the machine mainframe which we can believe just makes him a rogue program. Much like a virus, Smith begins replicating himself taking over other programs, including the body of a real world human "jacked" into the Matrix.
This creates a massive problem as Agent Smith, who lived solely inside the Matrix, took over the conscious of a human being. This body when removed from the Matrix will then carry with it the mind overwritten which in this case is Agent Smith. The fear is now placed in the eyes of the viewer that Agent Smith is much like our human characters able to have a spot in both the Matrix and real world.
Agent Smith has his own agenda, he just wants to watch the world burn from killing Neo to destroying Zion and claiming every program inside the Matrix. He does not care about the ramifications for the minds connected, he just wants full control. He continues to replicate and encounters Neo, but numbers mean nothing to Neo - he continues to win.
Once again, we meet **The Oracle** this time she carries the news that Neo must meet the Source of the Matrix, otherwise known as **The Architect**. This journey is not easy, which takes a good portion of the movie as our characters fight and battle a new smarter enemy who disobeys the laws even further that the Matrix once respected.
Back at Zion, news is discovered that the machines are digging for Zion instead of blindly traveling millions of miles of tunnels. So we now have the threat of Zion being destroyed, the Matrix collapsing from a rogue program and Bane (Agent Smith) now walking the real world. Things seem bleak until we meet the Architect and that encounter drops everything on our head of what we thought we knew.
The Architect begins explaining that Neo is standing in the 6th iteration of the Matrix. This leads to a great understanding by Neo that he was either lied to or no one knew. This 6th iteration is unknown to the humans, except for **The One** and the **Architect**. We begin to learn about the previous iterations of the Matrix, with the 1st iteration being a Utopia, which failed miserably as an imperfect subject could not live in a perfect world without rejecting it. Minds awoke and the batteries they were once enslaved for began collapsing.
This led to the 2nd iteration, where the Architect made the world imperfect along with spawning a program to learn from humans who we'd discover to be **The Oracle**. This iteration also failed because of a lack of choice which the Oracle discovered. The AI responsible could not fathom a simulation where choices, perhaps invalid, could be allowed.
The 3rd iteration was born between the Oracle and Architect giving humans (test subjects) the perception of choice at a near conscious level. This worked in 99% of humans and the remaining percent was freed and would discover Zion. As an unlocked mind inside the Matrix would only increase the potential for catastrophic failure.
This destroys an inkling of hope as we learn Zion is nothing more than another machine oriented control structure. The machines built it, know exactly where it is and only chose to delay the inevitable for the perception of choice. Meanwhile, back with the Architect, Neo is given two doors each carrying a choice.
**Door 1** \- Neo selects 23 people to free from Matrix to rebuild Zion after its destroyed and the Matrix is reborn into version 7.
**Door 2** \- Neo returns to the Matrix, which is collapsing and dying. This will result in the loss of lives of millions in both Zion and the Matrix and extinction of the human species.
As the Architect explains, the previous iterations of Neo have always "reloaded" the Matrix as the survival of the species is more important than the life of his friends. With each reload the Architect hoping for 100% acceptance into his fake simulated world. The 6th iteration of Neo does something different though and goes through the door ending the species in order to save Trinity over love.
So many dots are connected here, as we learn the prophecy isn't true and this existence Neo has is one big lie in order to keep minds enslaved chasing something. His entire life has done this pattern before, being awoken and freed, trained and given the choice to reload the Matrix. As Neo saves Trinity and leaves the crumbling Matrix, he kills five Sentinels in the real world!
With the destruction of machines in the real world we are left wondering a lot of things. Is the real world another Matrix? How can Neo affect objects in the real world? This explanation jumps all the way back to the end of the first movie when Neo enters Agent Smith's body. His Matrix brain code is ran directly on a machine program and a part of it stays behind.
After his discussion with the Architect he becomes aware of this connection to the machines and can use this connection, much like a WiFi network works, to disrupt them in the real world. The 2nd movie ends with Neo passing out right next to Bane, who we remember is now the real world version of Agent Smith.
**3\. The Matrix Revolutions (2003)**
With the machines moments from the surface of Zion, the entire world of the Matrix almost consumed by Agent Smith, and the looming fear of Agent Smith in the real world. We are at an interesting dilemma which hasn't been present in the previous iterations of the Matrix. Neo is additionally trapped in between the Matrix and real world, presumably because the machines are upset he did not make the correct choice, denying his "program" exit to the real world.
This is displayed as a train track, where programs by the "Trainman" are smuggled into the Matrix. This leads our characters to an interesting battle back to a familiar face in order to free Neo. As Neo is freed, he once again takes another trip to see **The Oracle**.
The Oracle this time just has bleak news for Neo, explaining that "everything that has a beginning has an end". She is of course referring to the pending destruction of Zion and collapse of the Matrix via Agent Smith. This would cause a full reload of the Matrix with a complete loss of life of the existing minds.
As we saw in the first movie though, humans are not born they are harvested from a field in large quantities. Perhaps the idea of million of batteries (humans) dying is not so bad after all, as the machines can easily replace them in time.
At this point in time though, the ship Neo has lived on for two movies is now destroyed. The "Nebuchadnezzar" as it was called was destroyed from a mine from a Sentinel instead of being ripped apart like how the Sentinels usually attack. We can assume the machines are well aware of the defense mechanisms of these ships and therefore have changed tactics to an attack that cannot be blocked.
In the previous movie, we learn that Zion's counsel has dispatched two ships to provide backup to Neo. They understand that hundreds of thousands of Sentinels cannot be stopped so they begin to put faith in Neo and his idea.
Only one of the ships makes it to Neo, we learn the other ship fired an EMP which rendered it useless. We soon find out this was done by none other than Bane, who is Agent Smith. With the crew of Neo without a ship they are rescued by another ship destined to return to Zion to join the fight against the machines.
On their way back to Zion, they discover a ship out of commission by the hand of Bane and help to get it running again. At this point with two ships operational, Neo asks for one of them to complete his task. One of the captains disagrees with the request intent on heading home, the other folds giving up her ship on the condition that she gets to drive the other.
Neo leaves with Trinity on a brand new ship, destined for the machine homeland - a place never visited by any character we know about. However, Bane (Agent Smith) was hiding on this ship and fights Neo intent on killing him. Smith fries the eyes of Neo leaving us to believe that Neo will die unable to see.
In a turn of events we learn that Neo in the real world can perceive machines as a golden light. Much like he can affect machines he can use this gift to view machines, which by extension is Bane. After barely surviving this encounter, he and Trinity continue to head for the machine homeland.
Zion at this point has suffered its first breach to the walls. With hundreds of sentinels screaming through per second. We watch Zion fight a losing battle, which we've learned has happened time and time again. They are just simply too many machines to kill.
As Neo approaches the machine world, they discover a highly reinforced structure including machines much larger than the sentinels we've learned to hate. Neo begins to use his gift over the machines and begins destroying them in mass. The machines quickly learn that Neo has some connection to the machines and seek to destroy it.
A sentinel dives through the soul/mind of Neo in hopes to sever the connection he holds against the machines. This maneuver benefits Neo more as he gets a small glimpse further into the machines. He learns the machines cannot travel to the sky, so he instructs Trinity to head for the sun. For the first time in the series, we get to see the real world Sun and the characters love it.
What goes up must come down though and the large barreling ship crashes into the machine structure. Trinity dies from this crash and leaves a blind Neo to wander the machine halls. Zion at this point is almost destroyed with nearly a million sentinels flying around eliminating everything. Thankfully, the ship carrying Morpheus has made it home and they fire off an EMP. This move only delays the inevitable as all defensive measures have been fried. Our remaining humans alive in Zion retreat to the caves and await the final stand.
Neo finally meets the machine leader, which is known as the **Dues Ex Machina**. Seeing how the machines have probably predicted every outcome, it is in their best interest to listen to Neo. The Matrix is nearly destroyed and the possibility of all humans connected dying is real. With this danger in mind, the machine leader grants Neo his wish. Peace for Zion on the condition that he kills the rogue Agent program who decimated the Matrix.
This sets the table for the largest single battle in the history of this series. As Neo faces off against an enemy who has taken over the Matrix, Zion is in a limbo currently unharmed pending the resolution of this battle. Agent Smith back in the Matrix though has assimilated every program, foreseeing his victory against Neo. Smith has the copies watch as he fights Neo alone, Smith can't comprehend why Neo continues to fight when he knows the end.
As the battle draws to a close, Neo allows himself to be assimilated by Agent Smith. However, unknown to Agent Smith, Neo is currently connected to the Matrix at the source with the machine leader. The machines now have a direct connection to the Smith virus and purge it from existence. This unfortunately kills Neo, but we see the sentinels in Zion withdrawing their attack. The machines have kept their end of the bargain and we see the Matrix rebooting into its 7th iteration.
The sun begins to rise in a city that looks normal and we see the Oracle and Architect exchange some final words. The Oracle is concerned with the humans in this 7th iteration, but the machines do something differently this time. They provide a choice to every human. Live in a fake world or exit the Matrix for a real, but difficult life. With no humans connected to the Matrix who reject it, perhaps this iteration will survive. The machines agree that the peace will last "as long as it can", which will probably be challenged as Zion grows and/or the 7th Neo is discovered.
### My Original Media Center
URL: https://connortumbleson.com/2018/01/21/my-original-media-center/
Last updated: 2021-01-19T12:22:40.000Z
My first media center was an original Xbox, built in 2002\. Today in 2018, we have Android TV, Apple TV, Chromecast, streaming, apps on TVs and much more. In 2002 if you wanted to watch media, you only had a few options.
1. Burn a disc to watch via a DVD Player and/or game console capable of it.
2. Watch the media from some weird software that came included on the DVD.
Home-brew software was exploding in the Xbox community though. Anyone could purchase an Xbox and one of a few vulnerable games and "softmod" their xbox expanding it into a variety of features.
In the picture above though, you see some weird black module mounted on the far left side of the Xbox. This was an Xecuter X3 CE modchip which was capable of turning my Xbox into a little powerful beast.
To believe that in 2005, I would have been 13 years old soldering cables together to build this masterpiece is beyond me.
However, it worked. Custom dashboards, game trainers, media centers and a larger hard drive was at my disposal. All this work, some unnecessary, so I could play my media at my pace when I wanted.
I had plenty of movies and after watching them once, it was fun to kill time watching the best action scenes among a variety of movies. With regular software, this was advancing scenes and skipping around to find that scene, ejecting a disc and doing it all over.
In Xbox Media Center (XBMC), this was a few clicks and controller buttons and it was done. Much like my previous post titled [Slow Down](https://connortumbleson.com/2018/01/07/slow-down/), this quicker and seamless alternative reigned supreme in pale to other options.
Which sounds much like today in age, where you can purchase a subscription on a streaming service just to be fed advertisements and an incomplete library. This is why the popularity of Plex and Kodi are as strong as they are.
*Hint - Kodi was the expanded and renamed XBMC, as the software was no longer limited for the Xbox platform.*
As time went on, high definition was launched and HDMI was invented. This led to new codec formats & larger file sizes, which when played on this old console screeched to a halt. The hardware in this Xbox was significantly lower than even a budget phone in 2018.
```
CPU speed: 733 MHz
NVCLK: 233 MHz
VCO frequenzy: 800 MHz
Memory clock speed: 200 MHz
Xbox Version: XBOX V1.0
Video Encoder: Conexant
Memory Installed: 64 MB
```
It slowly became nothing but a memory as the services these home-brew applications depended on went off-line. 10 years from now, I'm curious what will happen to the current media applications of Plex & Kodi and what will replace them.
For those curious, yes the Xbox still boots and works!
### Getting "pwned" is getting old.
URL: https://connortumbleson.com/2018/01/14/getting-pwned-is-getting-old/
Last updated: 2018-08-22T01:19:24.000Z
Last month of so, I received another email telling me that some of my information has been discovered in a data breach of another website. This would normally alarm me, but I've gotten at least 8 in the past 2 years.
Photo by [Markus Spiske](https://unsplash.com/@markusspiske?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
It is becoming too common to get an email from [haveibeenpwned](https://haveibeenpwned.com/?ref=connortumbleson.com) and this is not good. For those unaware this service allows users to sign up and then be alerted if that email has been compromised in a data breach.
So taking a look at my email history we see an alarming number of affected users from even some large companies.
So what exactly was leaked? Taking a look at a random three data breaches I was involved in:
- Imgur
- Email addresses, Passwords
- GeekedIn
- Email addresses, Geographic locations, Names, Professional skills, Usernames, Years of professional experience
- River City Media Spam List
- Email addresses, IP addresses, Names, Physical addresses
First off, I have no idea what GeekedIn or River City Media Spam List is. I didn't voluntarily join either of those services. This article isn't about that but if you want to read about [GeekedIn](https://www.troyhunt.com/8-million-github-profiles-were-leaked-from-geekedins-mongodb-heres-how-to-see-yours/?ref=connortumbleson.com) or [River City](https://mackeeper.com/blog/post/339-spammergate-the-fall-of-an-empire?ref=connortumbleson.com) the articles are linked. In short, some of these services harvested my information against my will, collected it, organized it and then lost it.
With this information out in the wild, there are plenty of situations where this data would come in handy. Talking over the phone to verify yourself might present some of the following questions:
- When is your birthday?
- Last 4 digits of Social?
- Name of street you live on?
These are what the industry is calling knowledge based authentication (KBA) and if you haven't noticed some of that information doesn't change (immutable). So after a data breach exposes that information, authentication methods have to evolve or they become quite easy to answer for an attacker.
With so many breaches the question most are asking is "*Why does this site/service need this bit of information?*" Which is a perfectly valid thing to ask. If I was a corporation my goal would be minimizing the data footprint I had by only asking for information my company needed to function. However, companies seem to be going in a different direction gobbling up as much of information they can gather under the disguise of analytics.
I don't want to live in a "box" scared to sign up on any website fearing my information being breached. However, as my personally involved breaches approaches double digits companies need to step it up before breaches start including information like fingerprints.
### Slow Down
URL: https://connortumbleson.com/2018/01/07/slow-down/
Last updated: 2018-08-22T01:19:24.000Z
Throughout my life I've been told to slow down, this wasn't in reference to my driving or social life, but how I never learned to appreciate the now and kept looking ahead.
Photo by [Daniel Monteiro](https://unsplash.com/@danielmonteirox?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)
Every year technology eeks its way one step closer to our lives. Two years ago I didn't have a voice assistant waiting for my every command in my living room. Three years ago I didn't have a home automation system tracking my temperature and finally eight years ago I didn't have a smart phone capable of searching anything my heart desired.
All these enhancements require my attention and they deliver, in return, nearly instantaneous results. This without my knowledge had slipped in my every day life. Meals that took more than a few minutes to prepare were cooked less frequently. The effort and time required for a complicated meal became less preferred versus microwaving something in a few minutes.
Outside of my kitchen was a computer with endless websites and products demanding my attention. It was an addiction to follow up on whatever service required a response or read into whatever notification had appeared. It was becoming apparent that everything wanted my attention and it felt good feeding my attention to where it was needed.
However, things became quite upsetting. Live TV was difficult to watch, littered with minutes of advertisements between the content which was a distraction from what my mind was interested in. This led to online web streams, Netflix and a Plex account.
I couldn't slow down. No matter what I did, my brain craved that thing without distractions. A SunPass for toll booths to save stopping, A [Pi-Hole](https://pi-hole.net/?ref=connortumbleson.com) to block online advertisements, A Google Home to manage my media without lifting a finger.
Unfortunately, I don't think these enhancements are going away as they will continue to evolve and reach more people. So the idea of removing these products/tools is not a viable one. I simply adapted my lifestyle and started with my phone.
It was alarming how many applications had permission to generate audio notifications and even vibrate my phone. I went through every application tweaking the permissions. Nearly every application was restricted to generating silent notifications so only when I used my phone could I notice an application required my attention.
Some applications generated silent notifications that did nothing but attempt to draw me in. For these applications they lost the ability to even place a notification in my status bar. This meant that I only checked those applications when I decided to open them. This over time allowed me to see what applications I actually cared about and greatly decreased the time I spent looking at my phone.
A small run in the morning made my day actually feel longer despite taking the time to work out. I felt more awake and less drive to sit at a computer checking on notifications. I found my life slowing down and throughly enjoyed being able to appreciate each event as it happened. My focus and attention was back at my control.
### Apktool v2.3.1 Released
URL: https://connortumbleson.com/2017/12/26/apktool-v2-3-1-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.3.1 has been released! This release finishes up Android Oreo support (8.1), adds a tiny new feature and full of bug fixes.
A new feature added is `--force-manifest`. This allows you to decode a file using
```
apktool d -r -s --force-manifest
```
Which basically says. Decode this application, except for all the resources and sources, but still decode the manifest. For users who are only interested in the Manifest, this should help. We can see the speed increase from a large demo application.
```
--force-manifest --no-res --no-src : 8.1 seconds
--force-manifest --no-res : 1 min 3 seconds
```
Other changes include continued fixes for applications that are intentionally attempting to break the decoding process. This includes outrageous large strings, fake resources that aren't attached to anything and improperly decoded namespaces of minified applications.
If you missed the news, Apktool received its first sponsor from [Sourcetoad](https://www.sourcetoad.com/cool-tools/apktool/?ref=connortumbleson.com) which has helped speed development of releases. You can read about that [here](https://connortumbleson.com/2017/06/07/apktool-sourcetoad-to-sponsor-development/).
This release had 23 commits by 4 people.
- Connor Tumbleson (iBotPeaches) - 20 commits
- minsko - 1 commit
- Nic Allen (Bricnic) - 1 commit
- rubenanagua - 1 commit
# Changes since 2.3.0
- \[[#1667](https://github.com/iBotPeaches/Apktool/issues/1667?ref=connortumbleson.com)\] - Android Oreo Support (8.1)
- \[[#1680](https://github.com/iBotPeaches/Apktool/pull/1680?ref=connortumbleson.com)\] - Added `--force-manifest` to decode only the AndroidManifest file. / Thanks rubenanagua
- \[[#1630](https://github.com/iBotPeaches/Apktool/issues/1630?ref=connortumbleson.com)\] - Fixed issue with decoding files with shorthand SDK notation.
- \[[#1662](https://github.com/iBotPeaches/Apktool/issues/1662?ref=connortumbleson.com)\] - Fixed issue decoding applications with raw font files. / Thanks minsko
- \[[#1634](https://github.com/iBotPeaches/Apktool/issues/1634?ref=connortumbleson.com)\] - Fixed decoding application that skipped resource decoding.
- \[[#1587](https://github.com/iBotPeaches/Apktool/issues/1587?ref=connortumbleson.com)\] - Fixed issue decoding applications large string.
- \[[#1683](https://github.com/iBotPeaches/Apktool/pull/1683?ref=connortumbleson.com)\] - Fixed issue with applications that have repeated entry offsets. / Thanks Bricnic
- \[[#1157](https://github.com/iBotPeaches/Apktool/issues/1157?ref=connortumbleson.com)\] - Fixed issue where non-system attributes were decoded as the system instead of user in minified applications.
## Notes
This is a patch release for Android Oreo. Work has begun on a large scale change removing `aapt1` in favor of the new `aapt2` binary.
# Download
- [Apktool 2.3.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.3.1.jar?ref=connortumbleson.com)
- md5 `0641bd864e3d11a2a27f4a835d4147dd`
- sha256 `98e65037ab77fe6adb7a0e8cd41cc62a8fed52bf`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Apktool v2.3.0 Released
URL: https://connortumbleson.com/2017/09/21/apktool-v2-3-0-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.3.0 has been released! This release finalizes Android Oreo support, adds a tiny new feature and full of bug fixes.
The first important thing to note is that 32 bit binaries for both mac and unix have been removed. The Android Oreo build tools no longer is capable of building those and the effort required to restore that functionality is no longer worth it.
A new feature called (`--no-assets`) has been added. This parameter, if used, will skip decoding/copying asset files. This is helpful for use cases where decoding 100-300MB of assets isn't required to get access to simply the dex/resource files.
If you missed the news, Apktool received its first sponsor from [Sourcetoad](https://www.sourcetoad.com/cool-tools/apktool/?ref=connortumbleson.com) which has helped speed development of releases. You can read about that [here](https://connortumbleson.com/2017/06/07/apktool-sourcetoad-to-sponsor-development/).
This release had 42 commits by 4 people.
- Connor Tumbleson (iBotPeaches) - 36 commits
- Andrei Conache (xpirt) - 4 commits
- footpatch - 1 commit
- Jan Vidar Krey - 1 commit
# Changes since 2.2.4
- \[[#1594](https://github.com/iBotPeaches/Apktool/issues/1594?ref=connortumbleson.com)\] - Android Oreo Support
- \[[#1571](https://github.com/iBotPeaches/Apktool/issues/1571?ref=connortumbleson.com)\] - Run CI tests on OSX as well as unix.
- \[[#1586](https://github.com/iBotPeaches/Apktool/issues/1586?ref=connortumbleson.com)\] - Prevent apktool doing permission checks on unneeded directories.
- \[[#1595](https://github.com/iBotPeaches/Apktool/issues/1595?ref=connortumbleson.com)\] - Windows Unicode support for helper scripts.
- \[[#1598](https://github.com/iBotPeaches/Apktool/issues/1598?ref=connortumbleson.com)\] - Dropped support for all 32 bit binaries, except Windows.
- \[[#1444](https://github.com/iBotPeaches/Apktool/issues/14440?ref=connortumbleson.com)\] - Fixed `ClassCastExceptions` when producing files. (Thanks footpatch)
- \[[#1611](https://github.com/iBotPeaches/Apktool/issues/1611?ref=connortumbleson.com)\] - Fixed issue with apks that have 4 non-positional/positional nodes.
- \[[#1615](https://github.com/iBotPeaches/Apktool/pull/1615?ref=connortumbleson.com)\] - Added support for invalid `targetSdkValues` which are greater than `max` or less than `min`. (Thanks Jan Vidar Krey)
- \[[#1605](https://github.com/iBotPeaches/Apktool/issues/1605?ref=connortumbleson.com)\] - Added ability to skip assets decode (`--no-assets`).
- \[[#1589](https://github.com/iBotPeaches/Apktool/issues/1589?ref=connortumbleson.com)\] - Prevented directories being written outside of scope of decode directory.
## Notes
This is the first official release with Android Oreo support. An additional release may be required as more Oreo features are tested/used.
# Download
- [Apktool 2.3.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.3.0.jar?ref=connortumbleson.com)
- md5 `356d4e2061e611ec681e25b39c6b007b`
- sha256 `b724c158ec99dbad723024e259fd73e5135c40d652a3c599cec6ade9264a568e`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Bitcoin Cash (BTH) has been born. What happened on Genesis day?
URL: https://connortumbleson.com/2017/08/02/bitcoin-cash-bcc-is-born/
Last updated: 2021-01-18T15:01:05.000Z
I first learned about Bitcoin while in the summer before my freshman year of college. This was around 2011 and lots has happened since then. I've mined BTC, sold BTC and messed around on exchanges in the past few years selling & buying other crypto currencies. So when the news of the hard fork day approached of my original favorite currency, I was excited to see what would happen.
Soft forks weren't in my interest. I was solely curious in the hard fork or the birth of Bitcoin Cash (BCH).
For those unaware Bitcoin (BTC) believed that their future was in [Segwit](https://cointelegraph.com/explained/segwit-explained?ref=connortumbleson.com). This in absolute basic terms is separating the transaction signatures from the transaction. This frees up space for more transactions as you could only fit so many transactions in a block. With the popularity of Bitcoin, transactions were frequently delayed in the backlog (mempool) as they awaited inclusion into a block. This isn't feasible for a currency to take hours to verify - this was a problem that needed to be solved.
So lets look at a block on the Bitcoin block chain before the fork. I picked a random block a few blocks before the hard fork was signaled. At this point in time, Bitcoin Cash does not yet exist.
*Thanks to [Blockchain.info](https://blockchain.info/block-height/478555?ref=connortumbleson.com) for this information.*
The important thing to note here is that **1,249** transactions were packed into this block making it **999.146KB** in size. Which comes close to the **1MB** limit in Bitcoin. Which has become kind of a pattern over the years as transactions fight to add themselves into a block, which evolves to the blockchain we all know.
Just a sample of transactions on July 31 show that blocks are generally packed all the way to the 1MB limit. This means that in order for your transaction to be verified you need to squeeze yourself into that 1MB block thats approaching or be delayed to the next one.
So how do you get a transaction in a block? In simple terms: fees.
Not all transactions take up the same amount of digital space. It wouldn't be fair to force the same fee on all transactions. So we have a "recommended fee" when sending transactions which usually uses something like 110 satoshi's (1 satoshi = 0.00000001 BTC) per byte. This means the larger your transaction is the more your fee will be. Fees help attract miners to mine blocks to verify transactions to grow the block chain.
Bitcoin Cash changes the block size limit from 1MB to 8MB, while taking advantage of the hard fork to add some replay protection & SigHash Type (a new way to sign transactions). This allows Bitcoin Cash to fit a lot more transactions into a block.
So lets jump back to **August 1, 2017** as the world is waiting for the fork to occur, and finally block [#478,558](https://blockchain.info/block-height/478558?ref=connortumbleson.com) was mined. This meant the next block (478,559) would be different between Bitcoin & Bitcoin Cash as the fork would be active.
[478,559](https://blockchain.info/block-height/478559?ref=connortumbleson.com) showed up in the Bitcoin blockchain, but no new block was yet found in Bitcoin Cash.
Attempting to accept this block on Bitcoin Cash was met with an interesting error
```
ERROR: AcceptBlock: bad-blk-too-small, size limits failed (code 16) (block 00000000000000000019f112ec0a9982926f1258cdcc558dd7c3b7e5dc7fa148)
```
*Side note - Trying to accept a Bitcoin block on Bitcoin Cash makes zero sense. Transactions were intended for Bitcoin, not Bitcoin Cash. This was a test just to see what happened.*
This was because in order for the hard fork to start, a block over **1MB** had to be encountered. So the waiting game began. With Bitcoin Cash only taking about 2.3% of the hashing power that was in Bitcoin, it still had the difficulty level of Bitcoin plus an 8MB transaction size. This meant that minutes became hours and there was still no new block for Bitcoin Cash.
Comments began showing up on Reddit, Twitter and more. People were confused and anxious. How could something compete with Bitcoin if nothing could be verified in hours? The genesis block hadn't be found yet and nearly 5 hours had passed.
Then it [happened](https://blockchair.com/bitcoin-cash/block/478559?ref=connortumbleson.com). Block 478,559 (of the Bitcoin Cash) chain was found. It was **1.915MB** in size with **6,985** transactions!
*We can thank [BlockChair](https://blockchair.com/bitcoin-cash/block/478559?ref=connortumbleson.com) for this image.*
and then 21 minutes later we got [another](https://blockchair.com/bitcoin-cash/block/478560?ref=connortumbleson.com) block. It seemed things had finally taken off, until things got weird.
4 minutes after block 478560, a new block showed up on the chain. However, this time it was not from an exchange or mining pool and carried some interesting things with it.
This is important to note the miner, because the difficulty became so high in Bitcoin that solo mining became impossible without insane mining equipment. This meant that rewards for block mining usually went to pools that split them up between all the miners who helped "mine" that block.
So when block [478561](https://blockchair.com/bitcoin-cash/block/478561?ref=connortumbleson.com) showed up people began laughing and rightfully so. The 3rd block forever etched into the history of Bitcoin Cash was signaling for Segwit.
Yes you read that right. A big reason for the fork to even happen was to abandon the Segwit changes happening in Bitcoin. Yet, 3 blocks into the new fork Bitcoin Cash was already signaling to activate Segwit!
As you can see by the purple "SW" badge, this block was signaling for the activation of it. This had to be a joke, the client software for Bitcoin Cash literally had Segwit removed so even signaling an activation of it meant nothing.
So who were these guys in Hong Kong? Was it a simple joke or something more? They must have some serious hashing power in order to mine blocks before an exchange or pool.
Block after block guessed who continued to show up as the miner of the block?
*For the sake of the this post, I'm going to assume all the unknown miners are from the same source. I am aware anyone could write anything in these fields.*
Out of the 10 next mined blocks, 9 belonged to our random group/individual in Hong Kong. However, in 8 of those blocks Segwit was not being signaled for activation. This gave merit to the fact that the activation was simply a joke.
As of this post, 75% of Bitcoin Cash blocks has been mined outside of exchanges.
*Thanks to [cash coin dance](https://cash.coin.dance/blocks/thisweek?ref=connortumbleson.com) for this graphic.*
**So whats next for both Bitcoin & Bitcoin Cash?**
We have two interesting time frames approaching for both. As Segwit in Bitcoin was signaled for activation, it needs to actually be activated. This means the next activation period (block 479808 - 481824) will enable this. According to the current rate, this might be somewhere after August 6th.
*Thanks to [segwit.co](http://segwit.co/?ref=connortumbleson.com) for this image.*
At this point Bitcoin will gain the features of Segregated Witness which should help to alieve some of the problems affecting it.
In the world of Bitcoin Cash, we have another interesting date approaching. Since Bitcoin Cash was a fork of Bitcoin, it inherited the difficulty of Bitcoin. However, as shown the hash rate of Bitcoin Cash is no where near the power of Bitcoin which could lead to some issues.
As August 4th approaches (maybe slightly after) we could see the difficulty level of Bitcoin Cash adjust.
I hope this helped explain a bit what happened on August 1st 2017\. If you are curious about any other aspect of the Bitcoin network(s), feel free to ask a question in the comments.
### Detecting Reverse Engineering on Android Applications
URL: https://connortumbleson.com/2017/07/29/detecting-reverse-engineering-on-android-applications/
Last updated: 2018-08-22T01:19:24.000Z
Not long after Apktool received our first [sponsorship](https://connortumbleson.com/2017/06/07/apktool-sourcetoad-to-sponsor-development/), my email received two responsibly disclosed security issues found in Apktool.
My first thought was confusion as Apktool is not a service, but a local application run by the user. So my perceived idea of what constituted a vulnerability did not blend. However, I learned these were valid issues that could be exploited in the wild, thus Apktool 2.2.4 was [released](https://connortumbleson.com/2017/07/29/apktool-v2-2-4-released/) quicker than our normal release cycle to resolve these.
As Apktool is open source, the fixes are public, but most can discover the intended exploits from the code so we will just go over them in hopes to draw people to upgrade to 2.2.4\. Prior versions of Apktool greater than 1.5.2 but less than 2.2.4 are affected.
### Apktool XXE Attack
Thanks to Chris Shepherd (IBM Security) & Eran Vaknin, Gal Elbaz, Alon Boxiner (Checkpoint) who both reported this vulnerability within the same week.
This is more formally known as a [**XML eXternal Entity Attack**](https://www.owasp.org/index.php/XML%5FExternal%5FEntity%5F%28XXE%29%5FProcessing?ref=connortumbleson.com), which when properly leveraged can preform denial of service, data theft and/or user enumeration. This occurs from processing and reading the `AndroidManifest.xml` file.
For example, lets build a test application with a malformed `AndroidManifest.xml`
```xml
]>
&e1;
```
This uses the external entity reference to build a URL to a website I own (ibotpeaches.com). At this point, in Apktool 2.2.3, while decoding the application an interesting entry is added to my Apache logs.
```
47.xxx.xx.62 - - [17/Jul/2017:18:26:01 +0000] "GET /?z=APKTOOLXXE; HTTP/1.1" 200 1257 "-" "Java/1.8.0_71"
```
Which is a tad bit scary. Imagine the use case that crafty application developers inserted a special URL denoting application modification. Those using Apktool would unknowingly make a GET request to that URL exposing IP and potentially more information. The owner of that application could use that information to suspend/look into the user making the request.
This outlined a flaw in our weakly configured XML parser. Our [initial fix](https://github.com/iBotPeaches/Apktool/commit/f19317d87c316ed254aafa0a27eddd024e25ec6c?ref=connortumbleson.com) was simply
```java
docFactory.setFeature(FEATURE_DISABLE_DOCTYPE_DECL, true);
```
Which prevented Apktool from reaching out to any servers even while decoding an application that contained a DOCTYPE declaration. This proved to not be sufficient which led to another XXE related exploit, which was also disclosed by Eran Vaknin, Gal Elbaz, Alon Boxiner (Checkpoint).
### Apktool XXE OOB Attack
This is known as the [**XML eXternal Out-Of-Band Attack**](https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf?ref=connortumbleson.com) (slides from Blackhat EU 2013) which pivots the XXE category of attacks into a far more sophisticated approach.
The idea is to point an XML file, via a crafty block of a text, to an evil server you control in order to load another file.
```xml
%remote;
%int;
%trick;]>
```
This was an example I spun up with a local server to feed this `evil.xml` file back.
```
">
```
As you can see, we are going to do some interesting leaps here. These are the steps an application takes being decoded with this malicious setup.
1. Application is decoded by apktool < 2.2.4
2. During the reading of `AndroidManifest.xml` a `GET` request is made to `ibotpeaches.com:8881/evil.xml`
3. This file is read, which payload is more information to be processed. The contents is asking us to include the `/etc/file` and return that in the query string as the payload back to our `ibotpeaches.com` server.
However, this is creates an evil file that is specific to one payload and one domain. I need more control than that.
Thankfully, someone has created something for just [that](https://github.com/joernchen/xxeserve?ref=connortumbleson.com). Thanks to joernchen for creating xxeserve - a little ruby app to create a local server serving an evil file to help pivot attacks to any file based on the query string.
This makes our evil file
```xml
%remote;
%int;
%trick;]>
```
So for example, I'm going to put a fake file in the root of my file system to demo an extraction technique.
```
➜ ~ cd /
➜ / ls | grep 'hi'
hi
➜ / cat hi
exploited
➜ /
```
A file in `/hi` has the contents of `exploited`. It's important to note that the contents of the intended file have to be characters that won't cause our XML parser to choke. This means binary, newline characters and others like `>` depending on the parser (Java Xerces in the case of Apktool) might get rejected and thus fail. So lets decode this nasty application and watch our server logs.
```
47.xxx.xx.62 - - [21/Jul/2017:19:43:19 +0000] "GET /xml?f=/hi HTTP/1.1" 200 124 0.0006
47.xxx.xx.62 - - [21/Jul/2017:19:43:19 UTC] "GET /xml?f=/hi HTTP/1.1" 200 124
- -> /xml?f=/hi
47.xxx.xx.62 - - [21/Jul/2017:19:43:19 +0000] "GET /?p=exploited HTTP/1.1" 200 - 0.0007
47.xxx.xx.62 - - [21/Jul/2017:19:43:19 UTC] "GET /?p=exploited HTTP/1.1" 200 0
- -> /?p=exploited
```
What an interesting attack. The initial request was the GET parameter of `f=/hi`, which corresponding to the host machine file location `/hi`, which read the contents back into the query string and sent another request as `/?p=exploited` which shown above was the contents of this file.
We [fixed this again](https://github.com/iBotPeaches/Apktool/commit/657a44f5938b072898a0de913c03760210e0f4ed?ref=connortumbleson.com) tweaking our parser with a few more rules.
```java
docFactory.setFeature(FEATURE_LOAD_DTD, false);
docFactory.setAttribute(ACCESS_EXTERNAL_DTD, " ");
docFactory.setAttribute(ACCESS_EXTERNAL_SCHEMA, " ");
```
which seemed to finally put to rest all the XXE attacks. However, another vulnerability was discovered by the Checkpoint team regarding the unknown files feature of Apktool.
### Apktool Path Traversal Exploit
Applications since the beginning of time have been adding files to the package that Android does not know about. This may be a license file in the root of the project or some asset hidden in a custom folder structure outside of the Android asset organization.
Apktool began just recording these files (unknown to Apktool and by extension Android) and placing them back in the rebuilt application. This led to more problems as some files were STORED vs DEFLATED in the final binary. Apktool slowly enhanced itself and now keeps the unknown files in the rebuilt application in the same compression format that they were found in the application.
This feature has seen lots of bugs (some still there) in regards to this feature. Imagine an application with 2,000 unknown files with a variety of extensions. Apktool will record the relative file path to that file with the compression type of it. This leads to a yaml block like so
```yaml
unknownFiles:
hidden.file: '8'
non\u007Fprintable.file: '8'
stored.file: '0'
unk_folder/unknown_file: '8'
lib_bug603/bug603: '8'
```
This is the result of lots of tests and changes. In the past, we simply recorded the extension of the file. It was easier to say, "All PNGs that are unknown are deflated" instead of listing all 50 PNGs in the application. As you can imagine, we hit the use case where similar extensions were stored different. Additionally, files with no extension or special characters broke this use case.
So we went back to recording the full relative file path of all unknown files. This is actively [broken on Windows](https://github.com/iBotPeaches/Apktool/issues/1272?ref=connortumbleson.com) in some situations as the command generated exceeds the max length of a single command.
So this is where the bug comes into play. Imagine the following use cases
```yaml
unknownFiles:
../../relative/path/elsewhere: '8'
/etc/hosts: '8'
: '8'
```
This shows the most basic of vulnerability. If Apktool had permission, it would reach out to those locations and build those files into the final application. This does not seem feasible to exploit as you would need to provide a malicious `apktool.yml` file for the user to use.
However, what if you designed a malicious application with fake unknown files in order to build a path structure that would resemble that? Perhaps you could create a fake directory tree in your application that corresponds to a file outside the hierarchy of the decoded application. This whether intentionally or not was [discovered](https://github.com/iBotPeaches/Apktool/issues/1498?ref=connortumbleson.com) during the 2.2.3 release as an application contained a ".." folder name which caused some issues. This created the file path of
```
apk_with_relative_paths/unknown/../../folder/file.extension
```
Which as you can see escaped the hierarchy of the application and could be maliciously built into other applications in order to exploit this. Though, further examination makes this rather difficult to actually execute as the only vector affected would be those online services that automatically decodes applications behind the scenes using Apktool.
You could create a fake application with a path in order to extract a file (perhaps a shell) into the file system into a web accessible location. The reporters of this exploit (Checkpoint) hinted at the following path
```
C:\Android\tmp\sample.apk\..\..\..\..\..\..\..\wamp64\www\shell.php
```
This would be detected as an unknown file in that location and thus when improperly parsed would drop the file in `..\..\..\..\..\..\etc` which as you can see could be quite dangerous. In a real situation this would require knowledge of underlying server technology and permission to whatever location to write files. This was fixed in two different ways.
Our first patch (help from [Marvin Killing](https://github.com/mkilling?ref=connortumbleson.com)) simply ignored files that attempted to pivot out of the directory hierarchy. This did not fix people intentionally making the `apktool.yml` file malicious but fixed the problem at hand with malicious applications pivoting outside the decoded folder with an intentionally dangerous unknown folder structures.
```diff
diff --git a/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java b/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java
index a400ce34..c16dac31 100644
--- a/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java
+++ b/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java
@@ -136,7 +136,8 @@ private void loadAll() {
subname = subname.substring(0, pos);
}
- if (! mDirs.containsKey(subname)) {
+ boolean pointsToParentDirectory = (subname.equals("..") && prefixLen == 0);
+ if (! mDirs.containsKey(subname) && ! pointsToParentDirectory) {
AbstractDirectory dir = new ZipRODirectory(getZipFile(), getPath() + subname + separator);
mDirs.put(subname, dir);
}
```
The next patch I constructed from the help of community research was a simple Java patch against directory traversal. This was basically a copy and paste from [StackOverflow](https://stackoverflow.com/q/2375903/455008?ref=connortumbleson.com) as embarrassing as it is to admit. However, when it comes to security related fixes in a field I know I'm not 100% confident in, I'm willing to trust a commented and reviewed post to jump start my attempt.
This resulted in a new function to sanitize our file paths of unknown files.
```java
public static String sanitizeUnknownFile(final File directory, final String entry) throws IOException, BrutException {
if (entry.length() == 0) {
throw new InvalidUnknownFileException("Invalid Unknown File - " + entry);
}
if (new File(entry).isAbsolute()) {
throw new RootUnknownFileException("Absolute Unknown Files is not allowed - " + entry);
}
final String canonicalDirPath = directory.getCanonicalPath() + File.separator;
final String canonicalEntryPath = new File(directory, entry).getCanonicalPath();
if (!canonicalEntryPath.startsWith(canonicalDirPath)) {
throw new TraversalUnknownFileException("Directory Traversal is not allowed - " + entry);
}
// https://stackoverflow.com/q/2375903/455008
return canonicalEntryPath.substring(canonicalDirPath.length());
}
```
This as shown, and [proven in tests](https://github.com/iBotPeaches/Apktool/commit/02c8b62b00da8e45d9cf09536e73df947fceb7c2?ref=connortumbleson.com), prevents 3 types of attacks.
1. Invalid paths (Requesting entire directory)
2. Root paths (Paths starting from root of file system)
3. Relative paths (Outside of allowed hierarchy)
Apktool will die out (quit) if it encounters these situations. The idea behind this vs silent ignore is that it is no longer possible to create an application that automatically decodes to one of these 3 invalid paths. The only method to obtain this is manual editing of the `apktool.yml` to create this malicious purpose. At that point if you are manually editing files to do this or was led unintentionally via some tutorial to do this, Apktool will now issue an error and quit.
```
Caused by: brut.common.TraversalUnknownFileException: Directory Traversal is not allowed - ../../file.txt
at brut.util.BrutIO.sanitizeUnknownFile(BrutIO.java:93)
```
The error is descriptive and will tell the user exactly why things failed. With that solved, all currently reported vulnerabilities were fixed. I'd like to thank both IBM Security & Checkpoint for the responsible disclosure.
For details on the release of Apktool 2.2.4 please head to the [release post](https://connortumbleson.com/2017/07/29/apktool-v2-2-4-released/) for more details.
### Apktool v2.2.4 Released
URL: https://connortumbleson.com/2017/07/29/apktool-v2-2-4-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.2.4 has been released! This release packs some important security fixes, along with patching some slowdowns Apktool experienced when decoding applications.
This release also had a few security related fixes, I'd like to thank Chris Shepherd (IBM Security) & Eran Vaknin, Gal Elbaz, Alon Boxiner (Checkpoint) who responsibly disclosed these to me. There is a [blog post](https://connortumbleson.com/2017/07/29/detecting-reverse-engineering-on-android-applications/) going into details for those who are curious. If you use apktool in a situation that the public can use it (ie some hosted service), you will want to upgrade.
If you missed the news, Apktool received its first sponsor from [Sourcetoad](https://www.sourcetoad.com/cool-tools/apktool/?ref=connortumbleson.com) which has helped speed development of releases. You can read about that [here](https://connortumbleson.com/2017/06/07/apktool-sourcetoad-to-sponsor-development/).
This release had 31 commits by 3 people.
- Connor Tumbleson (iBotPeaches) - 28 commits
- Marc Miltenberger (MarcMil) - 2 commits
- bingqiao - 1 commit
# Changes since v2.2.3
- \[[#1520](https://github.com/iBotPeaches/Apktool/issues/1520?ref=connortumbleson.com)\] - Android O Final Dev Preview Support
- \[[#591](https://github.com/iBotPeaches/Apktool/issues/591?ref=connortumbleson.com)\] - SnakeYAML 1.1.8 (Android Support)
- \[[#1489](https://github.com/iBotPeaches/Apktool/issues/1489?ref=connortumbleson.com)\] - Fix issue with APKs taking longer than usual to parse resources. (Thanks MarcMil)
- \[[#1543](https://github.com/iBotPeaches/Apktool/issues/1543?ref=connortumbleson.com)\] - Fix issue with internal binaries not accessible in a Spring boot environment. (Thanks bingqiao)
- \[[#1520](https://github.com/iBotPeaches/Apktool/issues/1520?ref=connortumbleson.com)\] - Fix issues with rebuilding applications originally built with `aapt2`.
- \[[#1532](https://github.com/iBotPeaches/Apktool/issues/1532?ref=connortumbleson.com)\] - Patch `aapt` to support the `$` character in resource filenames.
- \[[#1561](https://github.com/iBotPeaches/Apktool/pull/1561?ref=connortumbleson.com)\] - Fix issue where apktool was holding locks onto files during execution. (Thanks MarcMil)
- \[[#1534](https://github.com/iBotPeaches/Apktool/issues/1534?ref=connortumbleson.com)\] - Fix issue with APKs that last resource in pool is `INVALID_TYPE_CONFIG`.
- \[[#1564](https://github.com/iBotPeaches/Apktool/issues/1564?ref=connortumbleson.com)\] - Fix issue with APKs that are including malformed characters to break parser.
- Only exit with `0` error code during `version` commands.
- Enforce license header on all source files.
- \[Security\] Prevent malicous directory traversal with unknown files.
- \[Security\] Prevent XXE vulnerability when given a malicious `AndroidManifest.xml`
- Upgrade to `gradle` 4.0.
## Notes
For those using apktool at your own leisure in your own environment - you can update at your own pace. For those who apktool in any public facing environment, it is highly recommended to upgrade to `2.2.4` due to the included security fixes as soon as possible. As mentioned above, more details to these security issues and steps taken to resolve can be found [here](https://connortumbleson.com/2017/07/29/detecting-reverse-engineering-on-android-applications/).
# Download
- [Apktool 2.2.4](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.2.4.jar?ref=connortumbleson.com)
- md5 `fad893aea35b598512689cc3c28b2ed8`
- sha256 `1f1f186edcc09b8677bc1037f3f812dff89077187b24c8558ca2a89186ea3251`
- Rename to `apktool.jar` and follow the [Instruction Guide](https://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Apktool v2.2.3 Released
URL: https://connortumbleson.com/2017/06/13/apktool-v2-2-3-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.2.3 has been released! This is a bug fix release for Android O preview in addition to bug fixes regarding strings and 9patch images.
This release had some great enhancements added to 9patch images by [phhusson](https://github.com/phhusson?ref=connortumbleson.com). Apktool will now properly decode optical bounds image data in addition to not affecting the opacity of grey scale images. Internally the [smali project](https://github.com/JesusFreke/smali/wiki/SmaliBaksmali2.2?ref=connortumbleson.com) was updated to version `2.2.1`.
If you missed the news, Apktool received its first sponsor from [Sourcetoad](https://www.sourcetoad.com/cool-tools/apktool/?ref=connortumbleson.com). You can read about that [here](https://connortumbleson.com/2017/06/07/apktool-sourcetoad-to-sponsor-development/).
This release had 44 commits by 6 people.
- Connor Tumbleson (iBotPeaches) - 36 commits
- Pierre-Hugues HUSSON (phhusson) - 2 commits
- Marvin Killing (mkilling) - 2 commits
- Alexei Khlebnikov (alexeikh-promon) - 1 commit
- Frieder Bluemle (friederbluemle) - 1 commit
- Marc Miltenberger (MarcMil) - 1 commit
# Changes since v2.2.2
- \[[#1453](https://github.com/iBotPeaches/Apktool/issues/1453?ref=connortumbleson.com)\] - **Android O Preview Support**
- Updated to [smali 2.2.1](https://github.com/JesusFreke/smali/wiki/SmaliBaksmali2.2?ref=connortumbleson.com)
- Updated internal aapt binaries to `android-7.1.2-r11`
- [c2b35d4](https://github.com/iBotPeaches/platform%5Fframeworks%5Fbase/commit/c2b35d41461a0fd216c54b5ca7defc997631a615?ref=connortumbleson.com) \- Don't enforce any reserved characters
- Upgrade gradle to `v3.5`. (Thanks friederbluemle)
- Removed deprecated fatJar plugin in favor of shadowJar.
- Please see updated [build instructions](https://ibotpeaches.github.io/Apktool/build?ref=connortumbleson.com).
- Fix reading string length of UTF16 encoded strings. (Thanks alexeikh-promon)
- \[[#1481](https://github.com/iBotPeaches/Apktool/issues/1481?ref=connortumbleson.com)\] - Fix issue changing default parameters on baksmali.
- \[[#1160](https://github.com/iBotPeaches/Apktool/issues/1160?ref=connortumbleson.com)\] - Fixed issue with apktool locking access to input files. (Thanks MarcMil)
- \[[#1456](https://github.com/iBotPeaches/Apktool/issues/1456?ref=connortumbleson.com)\] - Add support for animated vector drawables.
- \[[#1508](https://github.com/iBotPeaches/Apktool/issues/1508?ref=connortumbleson.com)\] - Fixes decoding brightness. (Thanks phhusson)
- \[[#1498](https://github.com/iBotPeaches/Apktool/issues/1498?ref=connortumbleson.com)\] - Prevent unknown file decode outside of archive. (Thanks mkilling)
- \[[#1511](https://github.com/iBotPeaches/Apktool/issues/1508?ref=connortumbleson.com)\] - Fixes improper decoding of optical bounds in images. (Thanks phhusson)
## Notes
This is an introductory release for support of Android O. An additional release may be required when the finalized O (8.0) release happens.
# Download
- [Apktool 2.2.3](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.2.3.jar?ref=connortumbleson.com)
- md5 `0662ded7b486d64a3f7424de1c29fe59`
- sha256 `8d05868a9fdef7ed43742b44f45c10a77263526b236e478cc9602d6a4e053f87`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](https://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Apktool: Sourcetoad Open-Source Sponsorship!
URL: https://connortumbleson.com/2017/06/07/apktool-sourcetoad-to-sponsor-development/
Last updated: 2021-01-20T23:58:33.000Z
A couple weeks ago I wrote an [interesting post](https://connortumbleson.com/2017/05/01/the-human-behind-the-keyboard/) about maintaining an open source tool. This project being [Apktool](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com), which I've maintained with the help of some contributors since 2011\. A lot of time has passed since 2011 and I've gone from a student with too much time on his hands to working a full time job. My hobby projects have suffered from this change in free time as shown by the frequency of releases and commits to Apktool.
I'm happy to announce that Apktool has received **an amazing sponsorship** from my workplace - [Sourcetoad](https://www.sourcetoad.com/cool-tools/apktool/?ref=connortumbleson.com).
You will notice two new commits to the project which are adding some sponsorship information. This is nothing more than some background and links to Sourcetoad.
What this sponsorship will allow is the Apktool project to grow in terms of the support, maintenance and development it receives. With this excellent news and the help of a co-worker at Sourcetoad I've introduced a new logo to the project.
What had been used from an unknown source since 2010 is now being replaced with a bit more modern logo.
to
With every good announcement, there is always those that look for the bad. So I'd like to clear up any confusion.
**Q: Who has access to Apktool now?**
A: Myself ([Connor Tumbleson](https://github.com/iBotPeaches?ref=connortumbleson.com)) and ([Ryszard Wiśniewski](https://github.com/brutall?ref=connortumbleson.com)). The same two people since 2011, nothing has changed there.
**Q: What direction will Apktool take?**
A: The project's future is still in the hands of the project and community contributors so we will continue to follow existing feature requests and bug reports.
**Q: Will Apktool remain free and open source?**
A: Yes! The project will remain under the [Apache2 license](https://github.com/iBotPeaches/Apktool/blob/master/LICENSE?ref=connortumbleson.com) and work will be continued in the open source space.
**Q: What is Sourcetoad?**
A: They are my employer and you can find out more information about them on their [website](https://www.sourcetoad.com/?ref=connortumbleson.com).
**Q: What are the details of the sponsorship?**
A: Since my own employer is sponsoring the project I've been given a solid amount of time to work on the project from work instead of a traditional X per month/year sponsorship you may have seen in other projects. This allows me to leverage a good portion of both work and hobby hours towards the project.
I'm excited for this change and look forward to see Apktool evolve with the additional time given to support it. Yes, I know we have 78 open bugs :)
### The human behind the keyboard
URL: https://connortumbleson.com/2017/05/01/the-human-behind-the-keyboard/
Last updated: 2018-08-22T01:19:24.000Z
A random slack message hit my inbox from a co-worker, which led me to this blog. It was a simple link to [http://git-awards.com/users/search?login=iBotPeaches](http://git-awards.com/users/search?login=iBotPeaches&ref=connortumbleson.com) with the comment "*40th in the US for Java repos. Nice*"
GitHub stars are hardly an indication for personal achievement as projects are a community effort, but it was an interesting block of stats to consume regardless.
As this screenshot shows, projects I maintain under my namespace (/iBotPeaches) put me in the top 250 Java developers (In terms of GitHub stars) in the world or number 1 in Tampa, Florida.
So for complete transparency this is because of 1 project - [Apktool](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com). This in absolute vague terms reverse engineers Android applications. I cannot call it completely mine, as the original commit and vision came from [brut.alll](https://github.com/brutall?ref=connortumbleson.com).
For a small history lesson, I was just another user of this tool during the Android Froyo/Gingerbread days. As the rumored next version of Android was approaching, new applications began breaking and I hit my first of multiple bugs in the tool.
This was November 2011 and I reported a few bugs with other random users of the tool. I was an ass in short, my replies didn't do anything but generate notifications.
> Any further word on these issues? we still cannot properly decompile and recompile any ICS apks.
To brut.alll - I was just an anxious guy trying to get something that was free to work. I had no idea how it worked or the time spent on it. I knew it worked in the past and now it didn't - I craved success without the effort.
Days became weeks and weeks became months and there was no official fix for the reported issues besides a mess of unofficial ways to work around the problems. This project was open source though, so I decided to take it into my own hands after it was abandoned and attempt to fix some bugs. Here I am 6 years later :)
##### The Mistakes
The journey to now wasn't easy though. Open source was relatively new back then and I made plenty of mistakes.
- I've committed to master with a horribly descriptive message, making searching and locating these changes difficult to find. I've paid the price for this as it's etched into history forever.
- I've force pushed over master causing trouble for those who depended on the repository. Thankfully, GitHub and other services can prevent this now.
- I've released a version forgetting to proguard the final jar file creating a bloated large file size, now the build process will automatically do this on a release build.
- I've released a version without doing a sanity check on Windows, requiring a day0 patch release. I've now written an internal but [public release guide](https://github.com/iBotPeaches/Apktool/blob/master/INTERNAL.md?ref=connortumbleson.com#releasing-a-new-version) that I follow on every release.
- I've snapped and lost my cool in the bug tracker, so I stay away from the project when I'm feeling upset or angry.
- I've merged code that simply fixed a problem without investigating the potential side effects it could cause.
- I've built native portions of the code base on Windows, Mac and Unix just to forget months later how I did it, once again resolved by [internal notes](https://github.com/iBotPeaches/Apktool/blob/master/INTERNAL.md?ref=connortumbleson.com#releasing-a-new-version).
The thing is, I'm well aware I've made these mistakes despite other negative claims on the internet. Part of being an open source maintainer is identifying where you can improve to make your project(s) better.
One thing that will never stop is the bug reports or as I categorize them - support requests. When a project is young, usually as the maintainer, you are reaching into every corner of the web spreading the news of your project - helping out in forums, StackOverflow and more as needed. As your project grows, the time needed for support soon outweighs the time to spend on the actual development of the project.
The community steps in and helps you (hopefully). Users exchange feedback with others and solve problems on their own. It may just be configuration or a misunderstanding of a feature so you as a maintainer are grateful that other people are helping you.
As time goes on, you take advantage of blips of time in your life. Sitting in the airport with a tablet? Perfect, go check up on the feedback of the last release of your project. I was surprised to count how many of those actually existed.
- An XDA-Developers project thread
- A retired Google Groups (mailing list)
- An irc channel (Freenode #apktool)
- A Gitter channel (Integrated GitHub chat)
- StackOverflow tagged questions
- Tweets
- Private communication (Email, instant messenger)
Sometimes I triage easy tickets that don't require my computer to investigate. This keeps things in a maintainable state so when I return to my development environment I can grab tickets that I know require some intervention.
Say for example you arrive home from work, it's already dark outside and you are exhausted, but your significant other is working late so you have some free time. You are tempted to grab that Xbox controller or flip on Netflix and relax on the couch. However, you know they're people depending on you so you sit down at the computer and decide to work on your hobby project(s).
Where do you start? You have a digital line of things waiting to be done. You have confirmed problems awaiting fixes, you have confirmed problems with no idea of the cause and finally you have bug reports you haven't even looked at yet. What gets priority? Do you ignore all tickets and solely deal with the tickets in your milestone?
##### The Bug Tracker
You decide to sit down and triage the new tickets. You aren't in the mood to get knee deep in the internals of Android applications and just want to clean up the bug tracker.
You start with the first ticket, the title is vague and doesn't make much sense. You open the ticket and the issue template you wrote to collect common questions is ignored. Instead it's replaced with some form of "it doesn't work". This report by ignoring the requested questions leaves you without enough information. You don't have time for this nor the time to investigate what this person is asking about. You are fairly sure its a configuration problem from the lack of information provided so you close it, linking to StackOverflow or the forums.
The next ticket is an error you recognize. It was caused by an old version, out of date dependency or something. You know there is a ticket somewhere with the initial report of this issue. You search your own bug tracker quickly and find the ticket. You wrote about the cause and solution - perfect! You close that ticket as a duplicate linking to a previously solved issue asking the submitter to upgrade.
Next you find the same issue that's been reported almost 20 times. Someone didn't run the upgrade notes from version x to y and the project isn't smart enough to automatically execute these steps. At this point you are exhausted of finding the original duplicate ticket and just close it citing "please run the command - `foo bar` from the release notes".
You are on a roll closing tickets, but the next ticket you see catches you off guard. It's perfect in every sense. The issue template is entered, code blocks are formatted to retain formatting and the example application is attached. You run through the reproduction steps and sure enough duplicate the problem. You are excited someone has met you halfway and mark the bug as confirmed. However, you feel bad in the back of your head as someone did just that a month ago and their report is still confirmed and unfixed.
You press on to the next ticket trying to get that unconfirmed issue count to zero. This ticket is about 70% on the completion scale. They left the example error, but remaking example test applications to reproduce problems you see in a log is next to impossible. You need example applications to make any progress. You make a quick response asking for more details and tag as "Waiting for reporter".
You are down to two unconfirmed tickets and excited to be nearing the end. The 2nd to last ticket has such a strange error. Somehow the tool (your project) worked absolutely fine in execution without errors, but the host device has some cryptic error about failing to load the application. You start investigating and get nervous. Nothing matches what you expect, this is some intentional written anti-tampering code. You decide the scope of your tool isn't to live patch around these enhancements so you acknowledge the problem but the resolution is "no fix". These changes are frequently built by businesses and you as one individual have no time to even begin thinking how to solve it.
Your brain is a bit fried after spending time researching a ticket solely to triage it, but here you are at the last unconfirmed ticket. You open it up and it's disgusting to read. Someone is insulting the free work you do, demanding a fix for an issue they encountered while using it. You are aware of the problem, but their tone is so full of rage you fire back with a similar message and close the ticket.
You think you are done and head back to the bug tracker index page to grab a confirmed bug to work on. Unbeknownst to you, in the hour it took you to triage a few tickets there has already been a few responses. Users around the world got your email notifications of response(s) and are quickly responding.
These responses range from a variety of tones. Some users are very happy you took the time to respond and provide the requested information or asset. A few users have a language disconnect and fire back responses requesting the exact commands to run to fix their problems we closed earlier. A couple of people circumvent the public bug tracker and fire responses directly to you whether it's in chat, email or elsewhere. You haven't even looked at your debugger or IDE yet. It's time to ignore these and work on the project.
##### The Development
You sort by confirmed bugs and a startling 50 issues are waiting for you. Some of the reports you recognize and others are a black box. You decide to sort by stars/responses and find a bug with 35 comments. Obviously people want this report fixed but you hardly remember it. You sit down and read through the comments and understand the problem at hand. You start debugging and experimenting with fixes. Remember, we are building a reverse engineer tool here sometimes just understanding the problem is half the battle. You make some code changes and have some work in progress, but 3 hours have passed since you sat down at the computer and your significant other just arrived at home. You decide to stash those changes and write a little note on the ticket to remind you when you have time.
3 hours passed on a work day and all you did was basically clean up the bug tracker and start investigating 1 ticket. You feel like the next chance you have time you are just going to jump straight to that ticket and ignore everything else. You feel close to fixing that last issue so you squeeze in some time in the morning before work. Your changes are stable enough that tests are passing and the problem is fixed. You push it online for yourself to review. There is no one else on the project team, but following the same procedure you set for others keeps things organized.
A few brave souls take that code you pushed online and build it themselves. They are anxious to have a fixed problem and report back to you that the problem is solved. You won't have time tonight because you have another engagement, but someone else confirmed the ticket so you just merge it into master without writing a regression test. This will probably come back to bite you, but the community wants this fix and fast.
##### The Release
You look at the milestone on GitHub, you are 8 days late. Somehow the 3 month sprint you set up has already passed. It's amazing how fast 3 months sneak up on you. You try and promise a release every 3 months, so you set aside time on the weekend to slice a new release. This turns out to take most of the day. Automation handles most of it, but release notes need to be written and posts need to be made while binaries tested again for sanity on all platforms. After this is all done and you've spread the news over social media you breath a sigh of relief.
However, things are about to get busy. No matter the release, regardless of the release notes, users will attempt to try things that are still broken. They will let you know in the comments, related bug report, forums, etc that version x.x.y has not fixed issue ###. You know this, but the community is only reminding you. Others are a bit more aggressive asking "when will x get fixed?" or "Why did y get fixed before z?". You decide to take a break for a bit, but you haven't checked the bug tracker since you've been ignoring it to actually work on code changes.
The unconfirmed bugs count is alarming. Barely 2 weeks has passed and you have 20+ tickets waiting for you. The best course of action is to never stop working on them. The bug tracker is out of control and you try and triage a few issues a day. Slowly but surely you will catch back up and be ready to work on the next ticket.
##### The Behind the Scenes
Behind every bug report, forum post or question there is an additional subset of private messages whether from email or another medium. Some users believe their best approach to solve their problem is a direct one on one email to ask you about x, y or z. Some of these users carry an interesting @domain email so you wonder the use case of the project in their industry. You direct these users to the public counterparts of their problem, because knowledge in private does not help the community. You think about charging for private support to make the emails worth it, but the legality of such a thing confuses you.
Unrelated to the project itself, you notice your hard drive making some interesting sounds and your computer refuses to boot. You spend days and come to the conclusion that the drive is broken. Your code is on revision control, so nothing is lost. However, the `/Downloads/Apktool` folder you have organized by ticket IDs is gone. You didn't back that up online because its size at this point is 500gb. You thought you could live without that folder, but links in tickets are dead and some applications are not possible to obtain again. You've learned your mistake and begin tar-snapping those tickets into online backups.
You spot another email in your inbox, but this time it's a pull request instead of an issue report! Some brave soul has jumped into the source code of your project and proposed a solution. These are absolutely amazing regardless of whether they will be able to be merged. You thank the user and look into the change. Sometimes these can be merged, sometimes not. You try and thank the user at all costs because you appreciate the time they spent in your project.
##### The Ugly
You have another interesting email in your inbox in the morning from a competing revision control service. They have automatically created a repository for you and imported your repository metadata from GitHub to "hold the name" for you. They are asking you to switch to their service with a plethora of reasons why. Your mind is absolutely blown that someone would do such a thing of partially signing you up already. You immediately decline and ask the company why they would do such a thing and demand your project be removed.
You don't think things can get much worse, but you have a new bug report saying that the final .jar file doesn't open. The user got a development build from some automatic service that parsed GitHub repositories looking for Java Gradle projects. Somehow this service has over a hundred downloads for your project. People must be anxious to get development versions and they are willing to use a service that produces an invalid jar. This service has now cost you a small amount of free time that you would have usually dedicated for the project. You politely email them [explaining the situation](https://github.com/iBotPeaches/Apktool/issues/1142?ref=connortumbleson.com#issuecomment-177497611) and ask them to block your project from appearing on it again.
Another interesting problem hits your inbox. Your host service for binaries - BitBucket has somehow broken and serving 0kb files for a few of your binaries. You could re-upload them, but that would break the "uploaded date" order and make it confusing to new users. You [email them](https://github.com/iBotPeaches/Apktool/commit/93ab25887db150525ed70a89138ac514d6578f5f?ref=connortumbleson.com#commitcomment-16560635) hoping they can resolve this, but things don't look good.
> We recognize the trust you place in us with your data and take that responsibility seriously. We have measures in place to protect the integrity of your data, but those failed us in this instance. We sincerely apologize, and are improving our operational procedures in order to prevent something like this from ever happening again.
You are upset, but things live on. You re-upload 3 binaries and watch their download counts of 150k each be reset to 0\. This gave you a learning experience to mirror releases onto your own private mirror and back to GitHub now that they support it. You could effectively drop BitBucket now, but change confuses people since they have been your source of downloads since Google Code was abandoned so you decide to stick with them.
You've been struck with some serious bad luck with issues outside your control, but then you get hit again with a strange problem. There is a new file being hosted by your BitBucket project that you didn't upload. You panic and double check approved users, but its just you. You reset your password despite having 2FA, but it turns out your repository was the target of a vulnerability against BitBucket internally known as BBCDEV-4320 (SEC-1136). You begin downloading every release and checking the hash scared of something more at hand. Every thing else seems to be fine, but after two strikes you begin to really doubt hosting binaries at BitBucket.
##### The Assholes
Despite problems outside your control plaguing you, they won't let up. There still is a subset of users intentionally out there trying to take what you have. Password reset emails become all too common and "failed" login attempt emails plague related services. You are hosting a free open source project, you don't understand the hate targeted towards you. Some individuals even register social media names and domains related to your project and hold them hostage demanding money for them. You decide to hold your ground and stay hosted on GitHub Pages with a github.io domain.
There is another type of asshole who creates a public facing website for your tool. They blatantly copy & paste the contents and host copies of your downloads. You can't confirm the integrity of the binaries so naturally dislike the site. Their website is plastered with 5+ ads per page which means the user is only trying to profit from your open source project. It's frankly disgusting and insulting that this page is getting any traffic at all. You don't remember how you stumbled upon it, but you send a Google Webmaster website report and move on.
##### The Good
Despite all the time you spend, issues you encounter and stress you are caused. There is some good that comes out of it. You are recognized in communities, invited to speak at conferences and people recognize you in the field. It's those simple and fun reminders that working in open source has its benefits.
Doors in your life could be opened by working or helping in the open source space, but as your project(s) grow - the hobby you once loved becomes more and more of a daunting task as some people forget a human is sitting behind the screen of every project.
### Apktool v2.2.2 Released
URL: https://connortumbleson.com/2017/01/23/apktool-v2-2-2-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.2.2 has been released! This is a bug fix release for Android Nougat in addition adding Android 7.1 resources.
This release also introduces 32 and 64 bit binaries for the internal `macosx` and `unix` aapt binary. This was in response to upgrading the internal aapt to `64 bit` and not providing any solution for the `32 bit` users. While I don't think anyone should be using `32 bit` at this point, it wasn't too much effort to additionally support this change. However, because of this our final jar for apktool grew by about 2.6mb.
This release had 25 commits by 4 people.
- Connor Tumbleson (iBotPeaches) - 22 commits
- Andrei Conache (xpirt) - 1 commit
- peter23 - 1 commit
- GabrielTK - 1 commit
# Changes since v2.2.1
- \[[#1349](https://github.com/iBotPeaches/Apktool/issues/1349?ref=connortumbleson.com)\] - **Android Nougat - 7.1 Support**
- Upgrade internal `aapt` to `android-7.1.1_r4`.
- [7cc18d91](https://github.com/iBotPeaches/platform%5Fframeworks%5Fbase/commit/7cc18d918edf45c681692ecea948a0253b73a8a0?ref=connortumbleson.com) \- Return early from filename checks(Allows unicode filenames)
- [8ae80ab8](https://github.com/iBotPeaches/platform%5Fframeworks%5Fbase/commit/8ae80ab8e27942b65fd7c8dc9401dc58860bda3c?ref=connortumbleson.com) \- Ignore character checks on XML files.
- [7945c72f](https://github.com/iBotPeaches/platform%5Fframeworks%5Fbase/commit/7954c72f55e6a2ffe8f3654498219bd7802d1171?ref=connortumbleson.com) \- Can build with any `pkgId` (Thanks peter23)
- [e37c8eab](https://github.com/iBotPeaches/platform%5Fframeworks%5Fbase/commit/e37c8eabef96b2a723924f31ee054992351442b8?ref=connortumbleson.com) \- Remove `do`/`if` from reserved list.
- Upgrade gradle to `3.3`.
- \[[#1370](https://github.com/iBotPeaches/Apktool/issues/1370?ref=connortumbleson.com)\] - Fixed NPE when styles had a parent that didn't exist.
- \[[#1382](https://github.com/iBotPeaches/Apktool/issues/1382?ref=connortumbleson.com)\] - Fixed issue that `TYPE_DYNAMIC_ATTRIBUTE` was treated wrongly. (Thanks xpirt)
- \[[#885](https://github.com/iBotPeaches/Apktool/issues/885?ref=connortumbleson.com), [#1389](https://github.com/iBotPeaches/Apktool/issues/1389?ref=connortumbleson.com)\] - Fixed issue with APKs that had invalid characters.
- \[[#1384](https://github.com/iBotPeaches/Apktool/issues/1384?ref=connortumbleson.com)\] - Prevent vector images from being versioned on build.
- \[[#1369](https://github.com/iBotPeaches/Apktool/issues/1369?ref=connortumbleson.com)\] - Fixed issue with APKs that have invalid characters in filename.
- \[[#1394](https://github.com/iBotPeaches/Apktool/issues/1394?ref=connortumbleson.com)\] - Fixed build issue where space was in filepath.
- \[[#1360](https://github.com/iBotPeaches/Apktool/issues/1360?ref=connortumbleson.com)\] - Fixed issue with APKs that have 3 non-positional attributes.
- \[[#1119](https://github.com/iBotPeaches/Apktool/issues/1119?ref=connortumbleson.com), [#989](https://github.com/iBotPeaches/Apktool/issues/989?ref=connortumbleson.com), [#1278](https://github.com/iBotPeaches/Apktool/issues/1278?ref=connortumbleson.com), [#1377](https://github.com/iBotPeaches/Apktool/issues/1377?ref=connortumbleson.com), [#1091](https://github.com/iBotPeaches/Apktool/issues/1091?ref=connortumbleson.com)\] - Fixed issue with APKs that required non-standard `pkgId`'s. (Thanks peter23)
- \[[#1404](https://github.com/iBotPeaches/Apktool/issues/1404?ref=connortumbleson.com)\] - Fixed issue with APKs that use reserved words.
## Notes
This version has a lot of changes related to `aapt`. More and more of our bugs seem to be problems at the aapt level as OEMs and other companies modify applications at the low level that aapt operates at.
# Download
- [Apktool 2.2.2](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.2.2.jar?ref=connortumbleson.com) \- md5 `1e6be08d3f9bb4b442bb85cf4e21f1c1`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Apktool v2.2.1 Released
URL: https://connortumbleson.com/2016/10/18/apktool-v2-2-1-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.2.1 has been released! This is a compatibility release for Android Nougat, in addition to bringing support for wiping the framework directory.
Android Nougat brought three interesting things.
1. `aapt2`. The 2nd iteration (rewrite) of the aapt binary. We leverage `aapt` a lot during the build procedure. The choice of whether moving to `aapt2` will be a requirement or not is still being researched.
2. [Signature Scheme v2](https://source.android.com/security/apksigning/index.html?ref=connortumbleson.com). Nougat also launched a new signing mechanism vs the old JAR signing which was easily breakable. This means modifying applications that use the v2 signature and retaining the original signature is no longer possible. This invalidates the `-c` option.
3. Moving to `64bit` binaries for `aapt`. This excludes the need for `ia32-libs`. I don't think anyone is running 32 bit systems anymore, but noted anyway.
An additional command was added to help clear framework files. As frameworks moved locations in [v2.2.0](https://connortumbleson.com/2016/08/07/apktool-v2-2-0-released/) the ability to find them in the file system became more difficult. While the move was for a good reason (to prevent cluttering `$HOME`), it made management of the frameworks difficult. The command `apktool empty-framework-dir` will dump all framework files. The full usage can be seen below.
```
usage: apktool [-q|--quiet OR -v|--verbose] empty-framework-dir [options]
-f,--force Force delete destination directory.
-p,--frame-path Stores framework files into .
```
This release had 15 commits by 4 people.
- Connor Tumbleson (iBotPeaches) - 12 commits
- amorris13 - 1 commit
- benjamin-promon - 1 commit
- jamestut - 1 commit
# Changes since v2.2.0
- \[[#1223](https://github.com/iBotPeaches/Apktool/issues/1223?ref=connortumbleson.com)\] **Android Nougat - 7.0 Support**
- \[[#1243](https://github.com/iBotPeaches/Apktool/issues/1243?ref=connortumbleson.com)\] Fixed issue with missing attributes (using Android Nougat Final Preview Sdk).
- \[[#1317](https://github.com/iBotPeaches/Apktool/issues/1317?ref=connortumbleson.com)\] Fixed issue with new value type 8 - `TYPE_DYNAMIC_ATTRIBUTE`.
- \[[#1324](https://github.com/iBotPeaches/Apktool/pull/1324?ref=connortumbleson.com)\] Gracefully handle APKs with additional data after `TYPE` chunks. (Thanks jamestut)
- \[[#1313](https://github.com/iBotPeaches/Apktool/pull/1313?ref=connortumbleson.com)\] Pass `minSdkVersion` to smali to correctly trigger edge cases where proper API needs to set. (Thanks benjamin-promon)
- \[[#901](https://github.com/iBotPeaches/Apktool/issues/901?ref=connortumbleson.com)\] Added `empty-framework-dir` command to cleanup framework directory to ease upgrades.
- \[[#1332](https://github.com/iBotPeaches/Apktool/issues/1332?ref=connortumbleson.com)\] Handle applications that trick apktool with unknown header type. (Thanks xpirt)
## Notes
With the talk of Android 7.1 quickly approaching, version 2.2.2 will follow with bug fixes and compatibility.
# Download
- [Apktool 2.2.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.2.1.jar?ref=connortumbleson.com) \- md5 `27910ecab00fd4cd249cf1e10744b37c`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Surviving an amplified Wordpress pingback attack
URL: https://connortumbleson.com/2016/09/01/surviving-an-amplified-wordpress-pingback-attack/
Last updated: 2018-08-22T01:19:24.000Z
On August 31, 2016 as I began turning off lights and heading to watch Mr. Robot, I received an interesting email.
> High 5 minute load average alert - 20.82
The email additionally showed that my traffic was extremely high.
```
1 Min Load Avg: 77.74
5 Min Load Avg: 20.82
15 Min Load Avg: 7.87
```
This traffic is not normal for my little Linode (8GB plan), so I logged into the system to see what was happening.
This was not normal and not even a Reddit/Hacker News spike of traffic would cause this. Services were beginning to be killed and my SSH connection was so slow to diagnose anything.
After finally making it to my access logs, I found the following lines
```
54.84.166.245 - - [01/Sep/2016:02:31:51 +0000] "GET / HTTP/1.0" 301 - "-" "WordPress/4.0; http://blog.roundtown.com; verifying pingback from 185.81.158.233"
52.24.240.21 - - [01/Sep/2016:02:31:51 +0000] "GET / HTTP/1.0" 301 - "-" "WordPress/4.1.12; http://52.24.240.21; verifying pingback from 185.81.158.233"
52.24.44.55 - - [01/Sep/2016:02:31:51 +0000] "GET / HTTP/1.0" 301 - "-" "WordPress/4.3.5; http://poymi.me/nya; verifying pingback from 185.81.158.233"
23.238.21.90 - - [01/Sep/2016:02:31:51 +0000] "GET / HTTP/1.0" 301 - "-" "WordPress/4.1.12; http://carbonchat.com; verifying pingback from 185.81.158.233"
```
There were hundreds, if not thousands, of these similar lines all targeted towards one domain that I host. At this point, **MySQL had been killed** so all other sites on the box were either timing out from a lack of apache workers or dying from lack of a MySQL connection.
Pingdom alerts were flying in. Each and every site I host began reporting downtime, but at least I understood the attack was targeted to one domain.
My first course of action was to suspend the site being hit. In order to do this, I fed the public directory for apache to a template for suspended domains.
Now all these requests were returning a small `index.html` file vs the previous which was a bulky PHP forum software. **Requests had no sign of stopping**, but load wasn't through the roof anymore.
I started researching the "verifying pingback from" string in order to discover what this type of attack was. It didn't take long till I found this [post](https://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-distributed-denial-of-service-attack.html?ref=connortumbleson.com) from Sucuri and what an interesting attack this was.
To summarize the attack Wordpress has a "pingback" feature which allows blogs to say, "Hey I'm linking to X post" so the original post can acknowledge another site linking to it. In theory it seems like a good idea, but what happens is that malicious authors can collect as many Wordpress installs as they find and send a fake request that appears to be from any source.
Those Wordpress installs then reach out to that source to verify the pingback. The domain being attacked was not Wordpress so these GET requests were just going to `/`.
I can't write `iptable` rules from my head so a temporary bandage was to block all the offending IPs, so I began isolating attack traffic thanks to a tip from [John Cuppi](http://john.cuppi.net/blocking-wordpress-pingback-ddos-attacks-with-nginx-and-apache/?ref=connortumbleson.com).
```
cat access-log | grep "verifying pingback from" > wp_attack.log
```
This left me with a file of all attack traffic. The next step was to get the IPs from those lines. A quick PHP script helped achieved this.
```language-php
$attack_times) {
print "Wordpress IP (" . $ip . ") attacked {$attack_times} times \n";
system("iptables -A INPUT -s {$ip} -j DROP");
}
echo "Total Attacks: " . number_format($sum) . "\n";
```
This dropped all traffic that participated in this attack and the numbers shown were quite alarming.
```
Wordpress IP (195.154.1x.x) attacked 17,267 times
Wordpress IP (37.187.1x.x) attacked 16,865 times
Wordpress IP (37.187.7x.x) attacked 15,903 times
Wordpress IP (178.79.13x.x) attacked 15,022 times
Wordpress IP (212.129.1x.x) attacked 14,424 times
Wordpress IP (91.146.10x.x) attacked 13,339 times
Wordpress IP (37.48.2x.x) attacked 12,753 times
Wordpress IP (148.251.9x.x) attacked 11,888 times
Wordpress IP (213.171.20x.x) attacked 10,478 times
Wordpress IP (149.202.19x.x) attacked 10,180 times
...
Total Attacks: 454,951
```
Immediately load dropped and IO returned to normal levels. My ghost blog (this one) and my Gitlab instance came back up and Pingdom began alerting myself to the end of downtime.
> It was down for 27 minutes and 21 seconds.
For a single server that hosts nothing mission critical this was an okay response time. Luckily I hadn't fallen asleep yet or this may have been far worst.
So now it was time to dig into the graphs and see what traffic was heading my way.
As you can see, this attack is substantially higher than any traffic I normally obtain. The attack peeked at **479 requests a second** with **179 unique IPs** totaling **454,951 requests** in roughly **28 minutes**.
The blog post mentioned above had 162,000 different IPs in their attack. I had 179\. That is roughly **0.11% the attack** than Sucuri discussed [here](https://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-distributed-denial-of-service-attack.html?ref=connortumbleson.com), but was enough to cripple my single server for a bit.
Now that it was the next morning I found an additional [resource](https://sysadminblog.net/2016/05/blocking-wordpress-pingback-verification-ddos/?ref=connortumbleson.com) that put a block at the `iptable` level by reading the packet for a WordPress user agent and "verifying pingback" string. I unfortunately did not stumble upon this resource until after the fact.
As for the website that was targeted, it rarely passes 100 unique hits a day. I'm not sure if there was a purpose to this attack, but the application attacked was definitely the most resource intensive I host. It's almost like the attack was to one of the other domains I host, but the attack just looked for the most expensive application on the same server to attack.
I missed Mr Robot thanks to this attack, but learned a bit more about `iptables`.
### Apktool v2.2.0 Released
URL: https://connortumbleson.com/2016/08/07/apktool-v2-2-0-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.2.0 has been released! This version brings a lot of fixes for old bug reports and tweaks how frameworks are stored.
Apktool has been historically creating framework files in `$HOME/apktool/framework`. As of `v2.2.0` this has been changed to
- `unix - $HOME/.local/share/apktool`
- `windows - $HOME/AppData/Local/apktool`
- `mac - $HOME/Library/apktool`
These paths resemble where applications store files per operating system. For some systems this is a hidden directory. The reason for this change was that Apktool creating a top level home directory folder wasn't exactly proper.
Additionally, a lot of fixes have been made for Dexguard built applications. Recompilation with these applications is still not possible due to [#885](https://github.com/iBotPeaches/Apktool/issues/885?ref=connortumbleson.com).
If you'd like to clean up the old directory where frameworks were stored. Commands for this can be found in the [Migration Instructions from 2.1.1 to 2.2.0](https://ibotpeaches.github.io/Apktool/documentation/?ref=connortumbleson.com#v2-1-1-v2-2-0).
This release had 22 commits by 3 people.
- Connor Tumbleson (iBotPeaches) - 20 commits
- Anthony Morris (amorris) - 1 commit
- Pierre-Hugues HUSSON (phhusson) - 1 commit
# Changes since v2.1.1
- Updated smali/baksmali to `v2.1.3`
- \[[#1269](https://github.com/iBotPeaches/Apktool/issues/1269?ref=connortumbleson.com)\] Fixed upstream issue where debug comment indexes can cause out of bounds exception.
- Adjust mac and unix scripts to force UTF8 file encoding.
- \[[#972](https://github.com/iBotPeaches/Apktool/issues/972?ref=connortumbleson.com)\] Fixed issue with hex values being truncated in `AndroidManifest.xml`.
- \[[#894](https://github.com/iBotPeaches/Apktool/issues/894?ref=connortumbleson.com)\] Fixed issue with APKs that have duplicate value names by creating dummy names.
- \[[#745](https://github.com/iBotPeaches/Apktool/issues/745?ref=connortumbleson.com)\] Fixed issue with APKs where parent reference in `styles.xml` is not found.
- \[[#1277](https://github.com/iBotPeaches/Apktool/issues/1277?ref=connortumbleson.com)\] Default framework changed on Windows & Unix to prevent visible top level home directories.
- \[[#1258](https://github.com/iBotPeaches/Apktool/issues/1258?ref=connortumbleson.com)\] Fixed issue where extensions would be different cases.
- \[[#1264](https://github.com/iBotPeaches/Apktool/issues/1264?ref=connortumbleson.com)\] Fixed issue with APKs that had no `versionCode` / `versionName` properties.
- \[[#1270](https://github.com/iBotPeaches/Apktool/issues/1270?ref=connortumbleson.com)\] Fixed issue with improper decoding of `@empty` value. (Thanks phusson)
- \[[#1244](https://github.com/iBotPeaches/Apktool/issues/1244?ref=connortumbleson.com)\] Fixed issue with improper compression with files with multiple extensions.
- \[[#1185](https://github.com/iBotPeaches/Apktool/issues/1185?ref=connortumbleson.com)\] Fixed issue with overflow for applications that have absurdly large TypeSpec indexes.
- \[[#1166](https://github.com/iBotPeaches/Apktool/issues/1166?ref=connortumbleson.com)\] Replaced public domain LittleEndianReader for Google's Guava LittleEndianDataInputStream (Apache2). (Thanks amorris)
- \[[#1097](https://github.com/iBotPeaches/Apktool/issues/1097?ref=connortumbleson.com)\] Fixed public resource reference error when using references in `android:scheme` in `AndroidManifest.xml`.
## Notes
As the release of Android Nougat is near, Apktool 2.2.1 will quickly follow to patch any needed changes. The rumored new aapt binary (aapt2) may present itself with the release, which may delay the release of Apktool.
# Download
- [Apktool 2.2.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.2.0.jar?ref=connortumbleson.com) \- md5 `75ea3ed00784cd5705104de64f33b2c7`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Bigger, Faster and Stronger
URL: https://connortumbleson.com/2016/07/01/bigger-faster-and-stronger/
Last updated: 2018-08-22T01:19:24.000Z
While writing a previous post, I did some preliminary research on track records in my high school. I was surprised to see that every year the top time recorded (with some exceptions) was getting faster.
So I started with a [TED](https://www.ted.com/talks/david%5Fepstein%5Fare%5Fathletes%5Freally%5Fgetting%5Ffaster%5Fbetter%5Fstronger?language=en&ref=connortumbleson.com) Talk which explained this. However, the reasons for Olympic records being beaten each year were
- New synthetic track surface
- Starter blocks
- Spiked shoes
- Enhanced Training
- Enhanced diet
- Enhanced drugs
and this was over the course of 100 years. I found another video which examined the 100m dash over the course of the Olympics.
Apparently there are a lot of ideas and research surrounding this, but most of the reasons listed above weren't applicable in my research.
All high school tracks had synthetic surfaces, runners who competed seriously had spiked shoes and I don't think anyone was doping in high school.
So after I graphed the times from 2007 to 2016 in the mile run (1600m), I had a few questions.
Some years (2011, 2015 and 2016) made no sense. 2011 had a runner finish 8 seconds faster than anyone that entire year. 2015 on the other hand was a huge outlier, having the best time recorded that year not even place in the top 3 in the previous 3 years. 2016 dwarfed the competition with a first place time better than any time in the last 9 years.
Was this because of prodigy kids that sometimes presented themselves in a year? Maybe, so I added an average column to more precisely represent the times.
This helps us see that times are getting faster (With the exception of 2011 and 2015). Now this is what puzzles me. 10 years is not enough for genetic evolution, so what exactly is happening?
Are lighter shoes and different training routines really responsible for the constant decrease in times?
It was said multiple times during my training that if any student ran a sub 4 minute mile as a high school student, they would be on track to be at the Olympics. The most up to date statistic I found was 1,338 runners have a documented under 4 minute mile as of April 27, 2014.
At the rate high school times are decreasing, is it expected in another 10 years that the winning times will be sub 4 minutes for the mile run? It would be quite an accomplishment if it happens or will the times plateau and hover around 4:10 - 4:20 for years to come?
### Becoming the Best
URL: https://connortumbleson.com/2016/06/18/becoming-the-best/
Last updated: 2018-08-22T01:19:24.000Z
Growing up I always wanted to be the best at something. At first it was simple things like winning the random kick ball games in elementary school or winning the Pokemon battles I had when friends and I linked Game Boy's together.
This was such a small scale that I craved bigger things. Premier soccer and the start of middle school track filled that craving. However, these were team oriented sports so it was unfair to label anyone as the "best" as you win/lose as a team.
Middle school track was an interesting time. I ran the long distance events (mile, 800m and 400m). Among our school, I always got second in the mile. I couldn't beat this great friend who consistently ran faster and better than me. It was simply defeating to be so close to that number one spot in a race, yet not obtain it.
Track meet placing swayed depending on the school's competing, but I usually placed in the top five. The top spots weren't just steps away though, those finishing ahead of me were far ahead.
High school came around and school's merged. I had another chance to strive to be the best in something I did, mainly because my middle school friend went to a different school.
Summer training was optional, as High school couldn't enforce sponsored meet ups for training. This training was at 6am daily and I attended every one throughout the summer.
I thought with the amount of training I could compete for the #1 spot, however it was not. Track meets left me in the top 10 as meets involved a lot more schools and there were always people faster and stronger than myself.
There were two thoughts in my head. The first was that these kid's chemistry just naturally gave them an edge as some were simply born as a runners. My other thought was that they trained more and thus deserved it.
Finding old track records was tough and I only found the state meetup from the end of my Sophomore (10th grade) year. Times got quicker as I grew, but the placement stayed around the same.
Once again the top spot eluded me. Though, the nights I stayed out with friends or went to the pool, I could have been training. It appeared my life had to be dedicated to the task at hand in order to hit the top spot.
College came around and any school sponsored sport was abandoned. My only activities were soccer leagues outside of school and thus less competitive.
Competitive video games though was really starting to boom. The Major League Gaming (MLG) community was growing and it was always an interest to play at that level.
I realized pretty quickly the MLG was not for me. For some games I could place in the top 1% of players and I thought that was good. However, take the total players of one game at 400,000 people. 1% of that population is 4,000 players. At MLG events there are roughly 40 players (8 teams of 4, with a coach per team).
Even after weeding yourself to the top 1% of the world, you have to once again get to the top 1% of that to find yourself at global championships.
It simply is insane and I commend anyone at that level.
However, I was not giving up yet. I tried my luck in a video game that is coming up on being 2 years old, dedicating 8 weekends of playtime. Besides eating horrible food and not taking care of my body physically with workouts on the weekend days that I played. I partially completed my goal.
For those unaware of ELO, [Wikipedia](https://en.wikipedia.org/wiki/Elo%5Frating%5Fsystem?ref=connortumbleson.com) says.
> The Elo rating system is a method for calculating the relative skill levels of players in competitor-versus-competitor games.
The flat line above is when I took a break midway through this experiment. I relaxed from May 9 to May 28 and played on the 3 weekends following that.
I played my ass off a video game towards the end, averaging 180 games each weekend for 3 weekends straight. This was roughly 3.75 days of playtime over 6 days, which is nothing I'll subject my body to again.
Starting my experiment I was in 117,601 place out of 247,673 players (Starting point at 1200 ELO). Unlike my previous track and soccer sports, video games had instant global results and I could watch my progress on the leader board live.
This was both sweet and upsetting as any defeat immediately resulted in a huge dip of progress that would take precious time to re-earn.
I peaked at 512th place during this experiment, which was the top .21% of players.
I then lost a few games and dropped down to 700th place. The time to get back to my previous high point was too much effort so I ended the experiment.
At first when I started this experiment. The top 5k players seemed like a goal, then it became top 1000, then top 500 where I failed.
I played against the #1 and #33 guy on this journey and was met with a skill and talent on a video game that was simply unmatchable. Without the nitty gritty nerd details, these players did not miss a shot and moved in ways that I didn't know was possible.
Though, I reflected back and successfully almost made it to the top 500 players. Simply not playing for hours brought my placement to 800th place as people are always playing even when I'm not.
The competitive nature inside of me will never end, but becoming the best will have to wait.
### Apktool v2.1.1 Released
URL: https://connortumbleson.com/2016/05/07/apktool-v2-1-1-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.1.1 has been released! This version brings an important fix for Samsung devices in addition to patching the now defunct SmaliDebugging mode to set `android:debuggable` to `true`.
This release had 17 commits by 4 people.
- Connor Tumbleson (iBotPeaches) - 12 commits
- Andrei Zhukouski (BurgerZ) - 3 commits
- Benjamin Dobell - 1 commit
- Sunil Shivanand (padlar) - 1 commit
# Changes since v2.1.0
- smali updated to `2.1.2`
- \[[#1220](https://github.com/iBotPeaches/Apktool/issues/1220?ref=connortumbleson.com)\] Fixed issue where APK would wrongly identify as wrong `packageId`.
- \[[#1224](https://github.com/iBotPeaches/Apktool/issues/1224?ref=connortumbleson.com)\] Added `AndroidManifest.xml` file into frameworks to satisfy stock `aapt` constraints. (Thanks BurgerZ)
- \[[#1235](https://github.com/iBotPeaches/Apktool/issues/1235?ref=connortumbleson.com)\] Restore `-d / --debug-mode` to set `android:debuggable` to `true`. (Thanks Benjamin-Dobell)
- \[[#1234](https://github.com/iBotPeaches/Apktool/issues/1234?ref=connortumbleson.com)\] Insert literal `versionName` if its a reference to satisfy `aapt`. (Thanks padlar)
- \[[#1131](https://github.com/iBotPeaches/Apktool/issues/1131?ref=connortumbleson.com)\] Fix Samsung APKs that have an unknown 4 bytes of padding.
- \[[#1240](https://github.com/iBotPeaches/Apktool/issues/1240?ref=connortumbleson.com)\] Fixed manifest rename for Adobe AIR applications.
## Notes
This was a fast patch release due to the changes in [2.1.0](https://connortumbleson.com/2016/03/27/apktool-v2-1-0-released/).
# Download
- [Apktool 2.1.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.1.1.jar?ref=connortumbleson.com) \- md5 `b7c11f1f956ad726f889831fe75ab6aa`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [Gitter Chat](https://gitter.im/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Threads](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Phantom Mappack - A Halo 2 Mod
URL: https://connortumbleson.com/2016/05/06/phantom-mappack-project/
Last updated: 2025-08-05T15:20:09.000Z
Cover art for Phantom v1
This post is nothing more than a memory of a previous project. For context, during my middle school and high school years, the modification (modding) of console Halo games was my hobby. While this may make zero sense to some people, I hope to explain the more complicated things along the way.
Halo 2 modding was a huge boom online in a variety of communities. The rise of online forums and instant messaging was home to this universe of community knowledge, tools and more. These modifications allowed you to change anything about the game (assuming the tool and knowledge existed to do such things).
This led to crazy creations such as this
This was the ever classic and replayed [Soccer Mounds](http://ibotmodz.net/forum/topic/1403-soccer-mounds/?ref=connortumbleson.com) by *Freakazoid*. As you can see the modification took things to a crazy level introducing a soccer field into the game. These mods attracted attention due to the wide variety of features they brought to what was originally a first person shooter.
Others in the online Halo communities took a more professional approach and created works of art that could be released and published in the game themselves.
This was [Nightwinder 2](http://ibotmodz.net/forum/topic/14889-h2-modnightwinder-2/?ref=connortumbleson.com) by *MrMurder*. This modification had new models for weapons, new skins and an entire new balanced sandbox of weapons. It wasn't triple AAA game standard tested, but the map was polished and excellent to play with friends.
As time went on and the population dwindled, few extremely talented creators remained. They pushed modifying the game to its limits.
[Biodrop](http://ibotmodz.net/forum/topic/3528-darkshallfall-biodrop/?ref=connortumbleson.com) by *Darkshallfall* took particle editing, object editing and HUD manipulation to the next level. A masterpiece showing what careful work and excellent tools could accomplish.
There were literally hundreds of maps released by talented creators. It could be an entire blog post in itself talking about these maps. Unfortunately the test of time have taken the proof and record of most of these maps which now only live in the memories of those who saw them.
Before links died and years passed, there were too many maps to play and the idea of "mappacks" began to form. Downloadable Content (DLC) is how official companies provided additions to the game, but through the power of modifying these DLC packs mappacks were created.
Except how did one distribute a modified (arguably illegal) build of Halo 2? This is where patches came into play. A patch was a file that had the differences between a clean (unmodified) file and the dirty file. You were left with a smaller file that could be reapplied to a clean map to reproduce the creation. This allowed people to stand in a gray area as it was okay to transfer those patch files between friends. They were also a lot smaller than 50mb `.map` files that the game had.
The first patch tool used around the communities was *PPF-O-MATIC*. This little tool allowed map creators to distribute `.ppf` patches.
These weren't perfect patches as they were originally designed and purposed for patching PlayStation ISOs (**P**layStation **P**atch **F**ormat). So SuperPPF was invented with the goal of creating a patch format for `.maps` and used 4 blocks instead of 1 internally. This meant that switching a byte wouldn't cascade changes through the entire file in PPF. It would stop after the first block, which kept full byte shifting isolated to blocks.
Besides obviously blinding you with colors and Comic Sans, it was actually designed with Halo map patching in mind. This led to a faster, quicker and more optimized patch file. However, moving from a binary single block patch meant that bugs were discovered in the handling of the Halo `.map` file as it had to read and understand the `.map` file in order to create a proper patch. Bugs due to hardcoded locations vs reading the file header and a crazy design led to Serenity.
> Correction (April 2020) - SPPF did not launch after PPF, Serenity did and then SPPF. Details can be found [here](https://connortumbleson.com/2020/04/12/halo-2-patch-format-types/).
Serenity was the 3rd iteration of Halo `.map` patching and was crucial to the sharing and patching of mods.
It packed a modern and professional layout and worked quicker with smaller patch files than its previous predecessors. Technically, it broke the patch into 35 blocks plus a block for every tag in the map. This required the map to be flawless though, as any mistakes in the tags would break Serenity as it couldn't find the proper locations to begin creating patches.
With these tools any new user to the Halo modding community could follow some steps and play any mod. He or she simply had to obtain a clean map and apply a patch to it. Creative minds already had ideas to package a bunch of patch files together and release a mappack.
This led to some amazing creations such as [Killtrocity Mappack v1](http://ibotmodz.net/forum/topic/20707-killtrocity-v1-mappack?ref=connortumbleson.com).
This was a highly modified build of Halo 2 with all modified maps. The distribution of this mappack was downloading a 408MB zip file and starting a script that would build the modified maps from the clean maps present on the host's computer. Once finished the user could burn or install this modified build of Halo 2 on their xbox. This leveraged the power of Serenity v3.1 and SPPF for patching maps.
First off, uploading a 408MB file in 2006-2008 was not easy. All the popular upload sites had a max file size for the free tier and torrents were just hard to seed. I thought I was smart buying a 2.95$ a month shared hosting plan at Bluehost to help share the file. The instant I started uploading files, it got suspended because Bluehost was a "web host" and not a "file host".
After the above mappack was released, people were hooked and this led to the release of [Killtrocity v2](http://ibotmodz.net/forum/topic/235-killtrocity-2-mappack/?ref=connortumbleson.com), and [Killtrocity AI Mappack](http://ibotmodz.net/forum/topic/147-halo-2-ai-revision-mappack/?ref=connortumbleson.com) and the reason of this blog: [Halo 2 Phantom Mappack](http://ibotmodz.net/forum/topic/17266-phantom-mappack-v1-and-v2/?ref=connortumbleson.com).
I created **Phantom Mappack** which had 90 maps. This mappack had all Serenity v3.3 patches, fully automatic patch system, custom video intro and an extensive help document that included information on how to create an `.iso` and build the mappack.
I had no idea what I started when I began this project (In early 2007), so much so that it wasn't until January of 2010 when the mappack was released. So what caused the delay?
In short: **I was in over my head.**
Creating a mappack that
- had custom mainmenu pictures
- custom mainmenu design
- automatic patch program
- documentation
- Working System Link support
- and more
was simply too much for one person, especially for someone who had no real idea what he was doing. I had started this project simply to launch a mappack off the success of popular Killtrocity mappack series.
The first daunting task was to create mainmenu pictures for every map. With the release of Serenity, the mainmenu image for mods could be embedded into the patch format. So the general flow was to patch a map, install it on xbox, launch Yelo (A trainer to take screenshots of xbox) and load the map to find a good screenshot. Once obtained, you could use a plugin for Photoshop and a template to obtain an image that looked something like this.
*This preview image was from Nightwinder2 and was more than just a screenshot cropped into a template. I did not create this one.*
This `.dds` file was picky as it required a specific size in addition to maintaining the border and special black lines. My lack of organization and constant failures made creating 90 of these quite annoying. Thankfully some of the more popular mods already had a mainmenu image embedded in the patch, which was an amazing feature of Serenity.
After months passed, I had 90 mainmenu pictures. I was ready to make the mainmenu. This was another nightmare as the tools we used to modify `mainmenu.map` might corrupt the map. There was no version control or Dropbox, so I learned quickly to save versions of my file between any operation because I feared corruption on every save.
After the long task of creating a 90 map main menu, I was presented with my first large problem. Launching this main menu only had pictures for the first 60 or so maps even though all 90 were injected. Thinking it was a mistake, I recreated the main menu and the problem was there again.
I asked for help and apparently there was a limit of images/assets and the tools available at the time could not handle that for some technical reason that I don't know or remember. A mappack without preview images was like browsing a furniture magazine with no pictures.
So I gave up.
Months and months passed and Prey released a tool called "Menu Menu Menu" which was an advanced `mainmenu.map` editor. While still unable to save all 90 maps in one file and retain images, it had such an improvement over the previous tools.
The ordering, description and images in this tool made adapting and inserting new maps a breeze. Crashes were rare and corruption even rarer. This new tool gave me the drive to split the mappack into 2 parts both at 45 maps.
> Learn about all the map editors from that time in this related blog about [Halo 2 Map Editors](https://connortumbleson.com/2021/01/11/halo-2-map-editors/)
45 maps was still pushing it. DLC and official maps used a different format for adding new maps as they couldn't patch the original `.map` file, so I believed I was encountering issues that the original file simply wasn't meant to do.
After creating a highly modified mainmenu, I had to "theme" or skin it so it wouldn't look like the original. This was another nightmare. Modifying regular Halo 2 maps was easy, but for some reason attempting to modify an already highly adapted `mainmenu.map` file led to corruption and failure. This was probably because tools probably couldn't handle the uniqueness of my two mainmenu files. Attempting to add custom backgrounds or reorganize the screen ended badly. Occasional tests worked but mostly failed, so I made a pretty basic `mainmenu.map` theme with nothing more than a color tint and different logo. After so long, I just wanted to be done.
I was still about a year and half away.
After this, it was time to build the patch system for this mappack as sending `.map` files was not allowed nor feasible. This was another stroke of idiocy from myself. I quickly found that I needed to know programmatically what clean map a `.serenity` file was hooked to. Since my brain couldn't wrap the concept I began writing the worst code possible that would read the filename to determine the `.map` file it needed to patch and then execute Serenity via command line.
A friend quickly stopped me and instructed me how to do it cleaner. Now we simply iterated through the `.serenity` files reading those for the maps needed. At this point I simply required the user to have all those files in a certain directory.
Failure to do so would have my little application scream at you. I had so much fun making layouts in Visual Studio and creating this application. I was becoming addicted to my hobby which would soon lead to my college career and job.
After months of testing, debugging and fixing. My auto patcher was complete.
Users had full control to build either all 90 maps or v1/v2 separately. It was ready to be tested. I wasn't ready to send this to any remote friend, so I had my good local friend PyroSquirrell take it for a spin. Some bugs and flow problems were discovered and he became my QA tester for the project.
We were ready to try it out and play. We got on XBConnect and joined each other. We played some maps and encountered another nightmare. Some maps froze the xbox on load. This was known as SLC bugged or System link broken. While my memory on this is fuzzy, you had to take certain steps when building modified maps to ensure they were SLC compliant. Otherwise you were left with a `.map` that would freeze xboxes when loaded in a System linked environment.
I remember crashing our xboxes to find all maps that failed. It was sadly more than 10\. Research began on how to fix this problem. It was easier than I thought for some maps and impossible for others. It involved cloning tags that existed on the map in order to use those as the reference for objects that were cloned or used from a non-local `.map` source.
Entity became my tool for this with Insolence to fix the reflexives and idents that some items needed to have fixed.
*Entity has been updated by troymac1ure on [Github](https://github.com/troymac1ure/Entity?ref=connortumbleson.com) if you are interested.*
This was a slow process of modifying the `.map` file and recreating the `.serenity` patch and retesting it with a friend. It took months, but I slowly fixed some mods. Some were removed from the mappack in favor of others who had no problem with SLC, as my knowledge wasn't there to patch all the broken maps.
Things were looking good at this point. It was just a painful process of writing documentation, recording a video, grabbing screenshots and making sure the final `.zip` file was without error.
Sifting through hours of footage and learning how to use a video editor took some time, but I wanted the release of my mappack to be perfect. The install guide was an HTML file added in the final `.zip`. I did this so no matter what happened online or how the project was shared documentation would follow it.
I'm a bit embarrassed of the design of it, but CSS was still being learned and rounded corners were amazing in early 2009.
After final tests and deleting and repatching my project too many times, I created a fake box art image like the mappacks prior.
This was the last thing before I zipped up the final package and sent it to the world. It was [released](http://ibotmodz.net/forum/topic/17266-phantom-mappack-v1-and-v2/?ref=connortumbleson.com) January 8th, 2010 on multiple sites which unfortunately was pretty late in the cycle of Halo 2 modding. The "boom" period had passed and those remaining had already played all the maps in the mappack.
It however provided a huge learning experience and was amazing to finally get released. For a few months after the release I occasionally saw a lobby on XBConnect where people were playing Phantom Mappack. It felt great that people could use my project (which was a collection of others great work) and have fun with friends remembering all the great mods that were made throughout the history of Halo 2 modding.
If you are still in a Halo 2 modding mood. [RemnantMods](http://remnantmods.com/?ref=connortumbleson.com) still exists. Technically, so does my site but it hasn't had registration enabled in 6 years.
### Apktool v2.1.0 Released
URL: https://connortumbleson.com/2016/03/27/apktool-v2-1-0-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.1.0 has been released! This version brings a bunch of fixes and adds smali as a dependency instead of a gitsubmodule. It additionally removes the SmaliDebugging feature in favour of [SmaliIdea](https://github.com/JesusFreke/smali/wiki/smalidea?ref=connortumbleson.com) (A plugin for IntelliJ to provide debugging for `.smali` files authored by JesusFreke).
This release had 30 commits by 7 people.
- Connor Tumbleson (iBotPeaches) - 18 commits
- Andrei Zhukouski (BurgerZ) - 3 commits
- Ira Hanson (ihanson) - 3 commits
- Matt Sarett (mattsarett) - 2 commits
- Chirayu Desai (chirayudesai) - 1 commit
- Dave Nault - 1 commit
- Christopher R. Palmer (crpalmer) - 1 commit
- Rover12421 (rover12421) - 1 commit
# Changes since v2.0.3
- smali updated to `2.1.1`.
- \[[#1061](https://github.com/iBotPeaches/Apktool/issues/1061?ref=connortumbleson.com)\] Removes SmaliDebugging.
- \[[#1122](https://github.com/iBotPeaches/Apktool/issues/1122?ref=connortumbleson.com)\] Fixed issue when a non-compressed file has no extension. (Thanks BurgerZ)
- \[[#1128](https://github.com/iBotPeaches/Apktool/pull/1128?ref=connortumbleson.com)\] Revamped internal storage of `apktool.yml` to be serialized objects vs entries in HashMap. (Thanks rover)
- \[[#1143](https://github.com/iBotPeaches/Apktool/issues/1143?ref=connortumbleson.com)\] Closes streams that were not properly closed.
- \[[#1123](https://github.com/iBotPeaches/Apktool/issues/1123?ref=connortumbleson.com)\] Fixes issue when `@null` was improperly decoded.
- \[[#1145](https://github.com/iBotPeaches/Apktool/issues/1145?ref=connortumbleson.com)\] Fixes issue when apk filename has trailing space. (Thanks BurgerZ)
- \[[#1130](https://github.com/iBotPeaches/Apktool/issues/1130?ref=connortumbleson.com)\] Fixes issue that all digits were treated as string using `\ ###` trick.
- \[[#1146](https://github.com/iBotPeaches/Apktool/issues/1146?ref=connortumbleson.com)\] Added additional feature to `--keep-broken-res` to ignore resource duplicates. (Thanks crpalmer)
- \[[#1186](https://github.com/iBotPeaches/Apktool/issues/1186?ref=connortumbleson.com)\] Performance enhancement - Stops using String.format() for `MISSING_RES_SPECS`. (Thanks dnault)
- \[[#1170](https://github.com/iBotPeaches/Apktool/issues/1170?ref=connortumbleson.com)\] Added support for decoding `AndResGuard` apps.
- \[[#1166](https://github.com/iBotPeaches/Apktool/issues/1166?ref=connortumbleson.com)\] Removed LittleEndianReader in favor for a public domain one. (Thanks chirayudesai)
- \[[#1180](https://github.com/iBotPeaches/Apktool/issues/1180?ref=connortumbleson.com)\] Adapt 9patch decoder to handle any format (Color Table, RGB, RGBA, Gray, GrayAlpha). (Thanks mattsarett)
- Added ability for launched executables (`aapt`) to differentiate between output and error streams. (Thanks BurgerZ)
- Fixed issue with non printable chars in unknown files. (Thanks ihanson)
## Notes
- The version bump to `2.1.x` was for the removal of SmaliDebugging. A warning of this removal had been emitted since version `2.0.3`. JesusFreke of Smali has created [SmaliIdea](https://github.com/JesusFreke/smali/wiki/smalidea?ref=connortumbleson.com) a plugin to replicate this functionality.
- `--keep-broken-res` will now ignore duplicate resources to allow decodes of applications that modify core Android. This decoded application won't be build-able, but can be used for analysis.
# Download
- [Apktool 2.1.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.1.0.jar?ref=connortumbleson.com) \- md5 `2d3334a5c400ed61df26e96b1a396cb8`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Threads](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Ingress: A morning hike
URL: https://connortumbleson.com/2016/03/03/ingress-a-morning-hike/
Last updated: 2021-01-20T23:41:12.000Z
On a regular ole morning I felt like going on a hike. I decided to make it a work out and throw on a 20 pound weight and head out.
Since I am a new resident to the area of Tampa I set out towards a new park for me known as [Lake Rogers Regional Park](http://www.hillsboroughcounty.org/facilities/facility/details/Lake-Rogers-Regional-Park-7936?ref=connortumbleson.com).
Now obviously this a blog post for a reason. This journey into a park was filled with enemy portals and some of these portals took some effort to get in range of. Trailheads were underwater and freshly plowed trails went around them. My objective however, was on the original trail.
This was my first sight of the adventure approaching me. A portal I needed to get in range of was about 40 meters further into this swamp mess. Now 40 meters isn't too hard to get. I could walk along the messy edge barely in water and get close enough to my target.
Success! I was off to my next one.
A bit of water and mud was nothing compared to the last one. This would be easier. Until I saw the trail in front of me.
My Ingress application said `165m` to target, so I had to get moving. The brush was too high to walk through, so the border between grass and water became my home. A nice mix of mud and water on every step.
This pattern continued for a bit. Find a new portal on my scanner. Identify the dry path (if available) to said portal and repeat. I found out I kinda enjoy walking around parks, even though the original intent was to capture portals.
Tried to take a photo with my phone in line with water. Didn't turn out too well, but then again it was a phone camera.
At this point, I was just taking pictures to take pictures. My feet were already wet and hot afternoon sun was beating down.
Even a [panorama](https://connortumbleson.com/content/images/2016/02/PANO%5F20160227%5F114232.jpg).
My job was done.
Every portal on that trail, including the off trail portals were mine. Some were so flooded that I could only get close enough to destroy. (The orange circles on map)
### title about graduating school
URL: https://connortumbleson.com/2016/01/25/connor-graduation-arkansas/
Last updated: 2018-08-22T01:19:24.000Z
A couple weeks ago (December 2015), I graduated from the University of Arkansas with a Computer Science degree. It didn't really hit me that I was done with school until today.
School is all I've known for the past 20 years. Climbing from preschool, kindergarten, elementary school, middle school, high school and finally college. Each school preparing you for the next adventure.
College however is a different beast. As anyone will tell you, the path you take in college is mostly dependent on you. There is no teacher guiding you from class to class or telling you when to go outside.
So let's walk through my college experience and warning - This is a long long read and gets a tad bit personal. I found myself without Internet for roughly 48 hours, so this blog is the culmination of that time.
**Freshman - The awkward beginning**
I sit packing stuff up in my guest room at my parents house. Being the first child to college we go overkill figuring out everything I will need. We have lists printed from Google and triple checking everything to bring. The only questions littered in my brain though were
1. What type of Internet will my dorm have?
2. My dorm has no air conditioning. WHAT?
3. How will I fit my computers into a room the size of my current bathroom?
O boy.
Fast forward. We show up in early August navigating the one way roads littered around town and arrive in front of my dorm building. We are swarmed by an army of kids. These kids ask us a single question: *What room?* With one piece of information, the army of kids each grab a piece of my luggage and carry it all into the unknown. So now I walk with my parents into a foreign building up to the 2nd floor. I see all my stuff outside my door.
Fast forward a couple of hours and I'm stepping out of my parents car after lunch. They are heading back home (3+ hours) and I'm walking up the hill to my dorm. Day 1 has started. I'm on my own.
My first thought. This August heat mixed with no air conditioning is insane. How will I sleep in this intense heat?
Day 1 of my new home and I'm sitting in a 95F room. The best way to keep cool was to keep both your door and windows open to create an insane airflow.
This meant that nearly every door in our dorm building was open. Meeting new friends was considerably easier than I had imagined. I met about 20 very good friends, most of which were women. Since our rooms were too hot, we always spent time together as friends in the study rooms (1 per floor) which had AC units.
This was a more social time than I was used too. Prior to this year I had my room and computers to take all my time. This was different as it was a tad bit difficult to really get any focus for development going as I was limited to this area shown below.
My laptop barely fit. I couldn't even place a monitor as that would leave no room for a keyboard and mouse. So my desktop became a bitcoin miner for my entire freshman year. I ended the year with roughly 2.1 btc. That was mining with dual Radeon 5770s 24x7 with a nice hashrate before the difficulty rose.
Every Thursday, Friday and Saturday had dorm friends stumbling back into the building at odd hours of the night. Myself being a nerd, not part of any frat, usually was the one meeting them at the door to let them in as they forgot to bring their keys. This led to some interesting conversations as I got to hear how multiple places and parties were daily. Weeks became months and my freshman year was almost over.
The planning for sophomore year began. Living on campus wasn't an option nor was a frat. So I had to find an apartment. My roommate was moving into his frat house, so I was on my own to find a new roommate. Luckily, my next door dorm friend was also alone needing a roommate. We searched and found a nice apartment about 10 minutes from campus.
So I went home for my last summer in my home state spending time with my old high school friends. The summer consisted of working and telling stories with friends about our respective schools. 3 months passed and I was returning to Arkansas - this time with my car at an apartment complex.
**Sophomore - Back to basics**
My 2nd year of school was beginning. The butterflies about college were gone and it was just another year. Thankfully this year I started in some Computer Science classes vs doing general education courses. This was a relief to me as I couldn't stand taking Geography, Government, English and Chemistry.
Friends changed as we were no longer seconds apart living amongst each other. Thankfully I met some great friends that I still remained friends with this year. We communicated our schedules and hung out frequently on and off campus. Of course drinking this year was in an awkward position. Some of us were 21 and some weren't. This split our friend group between apartment/frat parties or bar hopping. At the same time, these sorority functions were popping up so often. These were basically an excuse to drink and party on a random night. I was lucky enough to be asked by some women to attend a few of these.
Aside from drinking and classes. My development area and work rate was back. I had a desk with my computer setup again.
I was back (online that is). I was supressed freshman year, but now I had my systems back up and running and it was great. I was back translating MIUI Roms coding crazy build systems using apktool and bash scripts. I was also diving into xbox 360 modding as I had hoped it would be like the blast that Halo 2 and original Xbox modding was. (Hint - It wasn't).
This year went faster than expected and winter was already upon us. This was an insane winter. Snow and ice was everywhere and we had classes cancelled a lot. My car was stuck in the parking lot and I was getting bored out of my mind. The snow removal service here in Fayetteville was non existent. I remember walking in the morning in 5 layers of clothes to my friends house about an hour away. It was a long cold walk, but worth it after being snowed in for so long.
It warmed up and classes were on again. Tests and schedules were out of whack, which led to some large exams that I didn't do well on. I tended to put more focus in hobbies than school, but everything ended alright. I just couldn't pass up programming some kick ass projects with some friends located at other schools. Months went by and I passed another year and summer was upon us.
This time with a rent to pay and a summer class. Going home wasn't an option. This is where the separation between high school friends and new college friends really set in. No longer was I going home to spend 3 months with all my old high school friends. I was staying in my college town with my new friends.
I did go back home for a week though. I couldn't stay away from what was happening back home :)
Summer was here and a new addiction had set in. Ingress, an augmented reality game, found me and I was hooked. Within months I was taking part in communities and driving to random parts of the state to play the game. If you have no idea what I'm talking about, maybe give the [Wikipedia Article](https://en.wikipedia.org/wiki/Ingress%5F%28video%5Fgame%29?ref=connortumbleson.com) a read.
With only one class and part time work. I found myself with large amounts of free time. A couple of friends stayed in town as well, so I became closer friends with a group of people. We all had work and classes, so it was basically a relaxing summer of drinking, movie nights and soccer.
Junior year was starting and my roommate and myself decided to renew for another year.
**Junior - dang, we are halfway done**
So naturally with a new year, but same apartment I had to upgrade something. It was time to upgrade the desk area. A new glass desk and monitor left me with a sort of L shaped desk setup.
This time xbox 360 modding slid out of the picture. My main focus now was Android, Apktool and building sweet PHP powered websites utilizing popular video game APIs.
School this year was going to be tough. It was the year of CALC 2, Physics 2 and a bunch of Computer Science classes. CALC 2 and Physics 2 were going to take all my focus I could get.
Of course though, I had different ideas. After two years of hanging out with amazing people, I tried my luck with a girl I felt I had a connection with and had known since my first day in Fayetteville. It worked. I started my Junior year off no longer single.
This year was going to be crazy. I had a girlfriend, work, intense classes, soccer, Ingress and random things like hobby programming and gaming.
It was amazing. School wasn't great, but I wasn't an A student in High school so why would college be any different? Exam grades were never stellar and I relied on the various homework and quiz grades to hold a grade in a class.
Gaming took a small chunk of my time, because the Xbox One (The 3rd iteration of the Microsoft console) had just been released. After owning an original Xbox & Xbox 360\. I felt I had to get an Xbox One on day one (release day). An Xbox became a key part of communication between my old friends. We all had xboxes across the states we were in and we could get online and chat while gaming to hear about our different lives and stories.
Dating was new to me, but great times were had. My girlfriend and I visited some cool Fayetteville areas from peaks to parks to ponds. We ate some fancy dinners at some sweet places and attended a great deal of parties. We even went to the Lake of the Ozarks with some friends to enjoy some drinking and tanning. Back in Fayetteville, our schedules were close enough that we spent time on campus and off every day.
Winter approached for the 3rd time and things were going good. I had a part time job, pretty amazing girlfriend and was still in school. My girlfriend introduced me to a ton more friends (since I wasn't exactly the most social person) and these guys were great friends as well. They also lived near my girlfriend close to campus, so I was really only going home to sleep. Most of my days were spent on campus and at their respective apartments.
So here is myself as I walk through campus to those apartments.
Winter was ending and my roommate had a huge announcement. He was getting married! It also meant that he was moving in with his girlfriend. This meant I was losing my roommate and thus the two person apartment we lived in. All my friends already had roommates so I decided to bite the bullet and live alone. I moved to the opposite side of town (still about 10 minutes from campus), but saved a good deal of money on rent.
Months passed and it was time to attend his wedding. Myself and the girlfriend traveled to my roommates home town and attended a wedding. It was odd seeing someone of my own age getting married, as it reinforced how old I was getting. However, that didn't detract from the awesome ceremony and reception that followed. It was pretty fun to dress up in a suit with the girlfriend in a fancy dress.
Here is my awkward stare into my phone as myself and the groomsmen were getting ready.
Though, things took a slide in an unfortunate direction in the upcoming months. I couldn't balance everything I was doing. I missed the hobby programming I did and programming took time away from the girlfriend. Hanging with the girlfriend took time away from school, work and my old gaming friends. I had simply too much on my plate to balance. There was a funny quote I heard before starting College.
> You can pick 2 things in college. Enough Sleep, Social Life or Good Grades.
Except my list was a bit more complicated than that. I couldn't balance everything I had and unfortunately I put the time towards things that probably should have been abandoned. (cough Ingress).
Another wedding was approaching. This time it was my cousin in Chicago! Another trip was planned and my girlfriend was going to join me. I had already met her family and she met mine earlier, but this was a big step to meet my entire extended family. With my lack of focus in our relationship due to prioritizing other things, I found myself single again before my cousin's wedding.
This sucked and really sucked because I lived alone and had my first serious breakup. I had no one to talk with and basically left my mind to wander. I went through the motions at school, simply doing the bare minimum of work to pass. I would head straight home and play Ingress, program a variety of things and play video games. This kept my mind off things and allowed time to slowly heal myself.
This year came to an end and I learned I couldn't graduate in time. I would be a semester late due to falling CALC2 once and not taking the recommendation of 16-17 hours per semester. The life of a Computer Scientist in the Engineering department was going to consume another semester for me.
So I started my Senior year knowing I wouldn't graduate in time which frankly sucked as well.
**Senior - don't worry, I'm not out of here yet.**
Like every year. I did an upgrade to my system. Since I moved earlier in the year I found out I could position my desks better. I upgraded a tiny 17" monitor to a 23.5" one on the far left of my setup.
This year the rage was still Apktool & my custom PHP projects - Leafapp, ReachStuff, Trunkapp & more. I was programming so much that I hit 2000 commits across my projects in one year. These large amounts of online commits and community presence was more a side effect of spending time in my room post breakup. I was happy again, but still just a guy living alone.
There is a lot to be said for human to human interaction. I realized that a few days in the summer I never spoke a word outloud. The mornings would be a run outside before starting an 8 hour remote work shift programming. With the evening consisting of my online class, hobby programming or some movie. Never which I needed to speak.
I missed human interaction and I'm not talking about some mushy cuddling interaction. Just some flat out conversation. I had lost a lot of my socializing after the breakup with my girlfriend. I had my friends over the Xbox Live microphone, but that is digital much like a phone call. There is a big difference between a phone call and talking to someone face to face.
So I started socializing with friends again. We were in some of the same classes so it was easy to ask them what they were doing that night and I started hanging out. After going overkill in hobby programming, it was easy to stay away from the apartment and stay out grabbing dinner with friends and drinking.
My friends lived on Dixon St. (the bar street of Fayetteville). So we could pregame at his place playing some Nintendo 64 or casting stuff via Chromecast, hit the bars and walk home intoxicated. We'd then grab a short amount of sleep and go to class hungover as hell the next day.
Apparently kids had been doing this since Sophomore year. Boy I was missing out. It was really fun drinking, hitting bars, grabbing food at some insane hour at like 2/3am and going to class to debrief with friends on the night before. This continued for a few months and I looked forward to every night that we were going to hit the bars.
One drunk night I won't forget - I ran into the ex girlfriend at a bar. I'm not sure why we stopped talking, maybe because it's awkward to transition from dating to friends again, but alas we made eye contact and honed in on each other.
A few drinks in the body already made everything easier. We exchanged conversation and time flew up, basically catching up on the previous months. We were buying drinks for each other and the bars were already closing. The night had flown by and I lost track of the friends I went out with. She went home and I went home to debrief with my friends at their place.
My drunk brain was processing a multitude of things a second asking itself too many questions. This was the first time I had seen her or talked to her in months. Morning approached and the friends and I wandered to class.
I heard from the ex girlfriend over text later that day. Just checking how I was feeling. This wasn't good for me. I spun myself into a programming overkill trying to forget the great times we had since we broke up. I obviously had to move on, but then I had to run into her and hop bars which didn't aid that cause.
I was back to programming insane hours and declining invites to socialize. Ingress had some interesting things to develop and the cat and mouse game of Apktool was never ending. Bungie had launched Destiny, which came with a sweet and powerful API. There were tons of things to program and I was clocking too many commits a day spending far too much time in front of screens.
I needed an escape and programming was it. Ingress also helped fill that void. I started attending anomalies that occurred every few months. These took the place of my frequent computer upgrades. Since the hotel and gas money was enough for a college student to spend. I even got a sweatshirt with my online name. (cough nerd)
So here was a kid programming too much, doing okay in school, working part time and playing Ingress across the midwest. I was a pretty happy camper. The real life socializing in Ingress kept me from being a hermit and playing soccer almost 4 times a week paired with a run on the off days kept me from just sitting and gaining weight.
So here came the 4th winter in Fayetteville. However, this was different, because I wasn't spending it in Fayetteville. My family choose to celebrate Christmas with family in Florida. So once my exams ended, I was off to the warmth in Florida.
The bright vibrant colors of the pictures in Florida always surprise me. Maybe it's because my apartment is the definition of stale neutral colors. So another picture to brighten it up in here.
So back to the cold I went. Senior year ended with a bang because of a majority of my friends were graduating. Graduation parties were sweet and exams/homework was pretty light because all the classes were full of graduates.
Thankfully, [Apktool](https://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com) was my Capstone Senior project. I got to patch bugs and work on that while in class vs working on some throwaway project that I wouldn't touch a day after class ended. Apktool didn't win any awards which made me sad. I figured it was just a tad bit too complicated to understand for the judges.
So this year ended and a partial summer began. Some graduates' jobs weren't starting for like 5-6 weeks so they had time to stick around. You can imagine with no school and a job starting later that the only thing to do is party and have fun.
I however, had 9 hours of summer classes to contend with so my chances to party was limited.
**Senior part 2 - yes i'm late**
Most of my friends have graduated, so only a few of us remain for this final semester. I don't know anyone in my classes with the exception of one. It feels like I'm a freshman again. Except I'm not. I just don't know anyone. I can already tell this last semester is going to be boring.
This year, due to graduating at winter, I didn't upgrade anything with my computer nor move. I stayed in the same apartment with the same computer setup. Apktool became my true focus, with work and random hobby PHP projects taking up spurts of time.
Class wise, I was taking classes to simply get my elective credits. Only 3 hours of my final semester (Combinatorics) was an actual class that I needed to pass. The others were simply whatever class I could find that was relatively easy and fit into my schedule.
This took a lot of my already small drive for school away. Seeing how only 3 out of 12 hours was a class I needed, 9 hours of free electives felt like a complete waste of time to do nothing more than meet some guidelines for my graduation.
I pushed on though, balancing a small amount of school, work, soccer, Ingress and socializing. Depending on how I felt, Thursday and Saturdays became the nights to hit the bars. Since I no longer had friends who lived on Dixon, our ways home resorted to either sober drivers or Uber. One of which cost a good deal of money.
A new indoor soccer building opened up, so I played in two leagues there. Thursdays and Sundays became soccer night, which put a damper on my Thursday night drinking. However, the occasional 3 day weekend allowed for a good bar hop with friends who visited, because they couldn't resist coming back to their college town.
I took Ingress to an even further level, organizing communities and people. Planning fields and attending events as far as 7 hours away. I just had enough time now that 9 hours of my classes were a complete joke.
I was back to having fun and enjoying everything. It wasn't as perfect as some of my college experiences, but I was living and enjoying it.
December snuck up on me and I realized I was graduating. Everything from the day to get my cap and gown and day to walk snuck up. I was myself during the ceremony and gave the camera a good ole double thumbs up. I got a good amount of laughs and applause which I will never forget.
So 4.5 years of my life are over and some told me it would be the best times of my life so far. I had fun and learned a ton, but I might have done things a bit differently if I had a 2nd chance.
Woo Pig Sooie! \[/end\]
### Apktool v2.0.3 Released
URL: https://connortumbleson.com/2015/12/31/apktool-v2-0-3-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.0.3 has been released! This release fixes a multitude of bugs along with including a fix for apks that have a sparse resource table and updating smali to `2.1.0`.
Additionally, v2.0.3 will emit a warning if using [SmaliDebugging](http://ibotpeaches.github.io/Apktool/documentation/?ref=connortumbleson.com#smali-debugging). For more information on this matter, please view the bug report [here](https://github.com/iBotPeaches/Apktool/issues/1061?ref=connortumbleson.com).
This release had 36 commits by 4 people.
- Connor Tumbleson (iBotPeaches) - 33 commits
- rover12421 - 1 commit
- CzBiX - 1 commit
- Zou Junhua (zoujunhua86) - 1 commit
# Changes since 2.0.2
- smali project changes from `2.0.8` to `2.1.0` \- [here](https://github.com/JesusFreke/smali/compare/613c493e9698812c0531acf073bc7ca9e4538eac...398630dde5a2370ead0f3ca43c59d896e6fdab60?ref=connortumbleson.com)
- Move `smali` to git submodule for easier updates.
- \[[#1053](https://github.com/iBotPeaches/Apktool/issues/1053?ref=connortumbleson.com)\] Fixed issue with too long command due to large amount of uncompressed files.
- \[[#1060](https://github.com/iBotPeaches/Apktool/issues/1060?ref=connortumbleson.com)\] Fixed bad casting issue between `ResStringValue` and `ResAttr`.
- \[[#957](https://github.com/iBotPeaches/Apktool/issues/957?ref=connortumbleson.com), [#1063](https://github.com/iBotPeaches/Apktool/issues/1063?ref=connortumbleson.com)\] Fixed bad casting issue between `ResStyleValue` and `ResAttr`.
- Prevent greedy additional `.dex` finder from pulling `.dex` files outside of apk root.
- \[[#1056](https://github.com/iBotPeaches/Apktool/issues/1056?ref=connortumbleson.com)\] Fixed issue with echo in helper scripts.
- \[[#1072](https://github.com/iBotPeaches/Apktool/issues/1072?ref=connortumbleson.com)\] Fixed issue with `mnc1` qualifier.
- \[[#1084](https://github.com/iBotPeaches/Apktool/pull/1084?ref=connortumbleson.com)\] Fixed issue with apks that have a 28 byte `ResConfig` size. (Thanks rover)
- \[[#1099](https://github.com/iBotPeaches/Apktool/issues/1099?ref=connortumbleson.com)\] Cleaned up code base to match AOSP naming.
- \[[#964](https://github.com/iBotPeaches/Apktool/issues/964?ref=connortumbleson.com), [#1031](https://github.com/iBotPeaches/Apktool/issues/1031?ref=connortumbleson.com)\] Fixed issue with APKs that had sparse ResourceTable.
- Added support for `DATA_NULL_EMPTY`
- Added support for API23 `mnc` values. They are no longer zero padded.
- \[[#767](https://github.com/iBotPeaches/Apktool/issues/767?ref=connortumbleson.com)\] Fixed issue where large int values in `AndroidManifest.xml` were truncated due to overflow. (Thanks gio73 and MarcMil)
- \[[#1014](https://github.com/iBotPeaches/Apktool/issues/1014?ref=connortumbleson.com)\] Added decode support for Dexguard Enterprise applications.
- Simply creates dummy key value names to prevent duplicate resource error.
## Notes
If this is your first `v2.x` release. Please read the [migration instructions](http://ibotpeaches.github.io/Apktool/documentation/?ref=connortumbleson.com#v1-5-x-v2-0-0).
# Download
- [Apktool 2.0.3](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.0.3.jar?ref=connortumbleson.com) \- md5 `b03ef2020833e12a4a06621bcef0984a`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Threads](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Fun with the Destiny API, Laravel, Hangups Bot and more
URL: https://connortumbleson.com/2015/10/29/fun-with-hangout-bots/
Last updated: 2021-01-18T21:54:49.000Z
Google Hangouts has become the source of 90% of my online real time communication. I have a variety of groups ranging from work, hobby, gaming and school related hangouts. For a few of these groups, I noticed the addition of a "bot" could increase our efficiency with basic tasks.
This is where I met the open source project: [hangoutsbot](https://github.com/hangoutsbot/hangoutsbot?ref=connortumbleson.com) which utilizes [hangups](https://github.com/tdryer/hangups?ref=connortumbleson.com). This amazing project has a large collection of plugins with the ability to write your own.
For one hangout, it had become common to "roll-call" and count off for attending events. Most conversations would go something like this.
> *Me - Okay, who is coming tonight? I'll start 1*
> *Another - 2*
You get the point. Quickly though, this conversation is lost and those checking in on the chat may completely missed the event, especially if a few hundred messages had passed.
We needed a system that handled RSVPs, but within a hangout. Forcing a user to go to a website and sign up, defeated the purpose and ease of use that doing a roll call in a hangout provided.
So first I needed to update our [website](https://connortumbleson.com/panda-love-project/) to support a calendar. We found fullcalendar.io, which had amazing support in terms of functionality. We basically load the calendar, and provide it a URL for events. The calendar than sends out an AJAX request for events of that month, which Laravel handles from there.
```language-php
public function getEvents(Request $request)
{
$events = GameEvent::whereBetween('start', [$request->get('start'), $request->get('end')])->get();
return $events->toJson();
}
```
We grab all events between the start/end date, so the calendar only populates events in that time frame. Our column names match what fullcalendar.io is requiring. A simple `date`, `title`, and `url` column. We actually leverage Laravel's mutators to create a `url` column, as we don't have a column for that.
So Laravel dumps this back to front-end.
```language-json
[{"id":9,"title":"Kings Fall","type":"Raid","start":"2015-09-29 04:00:00","created_at":"2015-09-27 20:05:11","updated_at":"2015-09-27 20:05:11","max_players":6,"alert_5":0,"alert_15":0,"url":"http:\/\/pandalove.club\/calendar\/event\/9","backgroundColor":"#5BBD72"}]
```
Which full-calendar.io loads easily
```language-javascript
$('#calendar').fullCalendar({
firstDay: 1,
events: "{{ URL::action('CalendarController@getEvents') }}"
});
```
Then we are left with this dynamic calendar.
So now we have a working calendar, where events are populated from our own data source. Now we needed to extend this to allow people to "signup" for those events.
This is where some creativity needed to happen. We need a solid bit of information for this sign up. If a user signs up, we need to know
1. Who they are.
2. What character they are.
3. They are authenticated and allowed to sign up for these events.
###### Step 1 - Google+ Authentication
Once again, Laravel saves the day - taking the complication out of this process. Simply using the [Socialite](https://github.com/laravel/socialite?ref=connortumbleson.com) package allowed us to make our entire login/register function as easy as this.
```language-php
private function redirectToProvider()
{
return \Socialite::with('google')->redirect();
}
private function handleProviderCallback()
{
$user = \Socialite::with('google')->user();
\Event::fire(new GoogleLoggedIn($user));
}
```
So a brand new user clicking sign in, is redirected to a familiar page.
This prompt grants us permission to view `name`, `email`, `avatar`, and `google_id`. With these fields we can create a user, uniquely identified by `google_id` and `email`.
###### Step 2 - Linking a Google+ Account with a Destiny Account
So now our group has authenticated with our site, but our site has zero knowledge of who owns which Destiny account. Yes, this would be relatively easy to hard code, but I did not want to take that route. Asking for the user's password to authenticate on their behalf was out of the question.
A common practice I learned for verification was to provide the client with a group of random numbers and ask them to enter them in a profile location on their Destiny account. Therefore, I can leverage the API to view the profile of the account they are verifying and check if the random digits I requested are there. You get the picture, if digits are found I can safely say they own that account.
So now we have a Google account linked with a Destiny account. So the binding for `$user->destiny` is working perfectly. The Destiny API doesn't require any per account API keys, so just knowing which account belongs to
###### Step 3 - Figuring out the characters a Destiny account has
So if a user is RSVPing to an event. We need to know which character they want to be. At this point through validation, we know if they are applying to an event that they have a Google account & linked Destiny account.
This blog is more of the overall picture, so I will skip the details on building off the API to obtain characters. After this work, I'm left with a relation on my `User` model of their Destiny characters.
```language-php
public function characters()
{
return $this->hasMany('Onyx\Destiny\Objects\Character');
}
```
So now easy as pie. I can run `$user->characters` and have a collection of their characters (min: 1, max: 3). Though we have hit another "worry" point. Currently anyone with a Google account and Destiny account can signup and RSVP to our events.
###### Step 4 - Isolating sign ups to our group only
So this turned out easier than I thought. During our API pull of their profile (Where we validated the random characters) we can see what "clans/groups" that user is a part of. So we simply look for our `clan_id` and throw a boolean flag so our `User` model knows it is a fellow clan member.
Our proof of concept (without hangouts) was working great. Users could sign up with a Google account, validate ownership of their Destiny account and load their characters in order to sign up for an event.
However, we hadn't even touched our Hangouts chat yet.
###### Step 5 - Bringing this functionality to chat
So now we have a bot sitting in our hangouts. First I needed to get comfortable in how the bot could obtain information via commands. So I wrote a quick `/bot xur` command to test the waters.
```language-python
def xur(bot, event, *args):
"""get xur data"""
r = urllib.request.urlopen("http://pandalove.club/api/v1/xur/")
parsed = json.loads(r.read().decode('utf-8'))
bot.send_html_to_conversation(event.conv_id, parsed['message'])
```
This simply opens up a `GET` request to our website and returns `json`. So after some tweaking of the returned information. We end up with this.
Which was pretty fun to make. Any time this video game character arrives on Friday 4am CST, I can issue `/bot xur` when I wake up and be presented with the items.
###### Step 6 - Applying this functionality to the real problem
So now we need `/bot rsvp` to function, but the problem at hand is we need to know
1. What Event they are RSVPing to
2. Who this person is
3. What character they want
Figuring out problem #1 was rather easy. Just require the ID of the event to be a parameter. So `/bot rsvp 5` would RSVP you to the event with `id` of 5\. However, we are just sending text to the server, so we have no idea "who" is sending this text. Once again, hangups bot to the rescue.
I noticed the `event` parameter that all functions are required to have. Investigating this variable led me to `event.user_id.chat_id`. Which is the Google ID of the person who sent the message. If you remember from Step 1, we have this information, so the bot can use this to validate people.
The problem was now how to validate characters. There was no easy way for the command to say "let me play on \_\_\_ character". So I got a bit creative.
Running `/bot rsvp 5` without the 4th parameter, would return another message explaining what your 4th parameter should be. You can see from the example below, how this played out.
This was absolutely amazing. Our system was working perfectly, so we added some functionality.
1. `/bot events` \- to list upcoming events
2. `/bot event id` \- to list that event id information
3. `/bot update` \- Updates your profile and destiny information
4. `/bot light` \- Provides light information (Destiny term) on your character.
5. `/bot grimoire` \- Provides grimoire information (Destiny term) on your character.
After a few weeks, there was a common feature request. "*Can we get alerted before an event starts? Like a reminder.*"
###### Step 7 - Pushing messages to the bot.
After a few days of discussion. We agreed to add a 15 and 5 minute reminder prior to an event. The problem was our bot knew nothing about these events. This functionality was server side on our Laravel install.
Laravel with a simple schedule command running every 5 minutes could detect when an event was 15/5 minutes away from starting, but we needed a way to push a message to the hangout.
Off to the docs of hangupsbot, and I found the [API Plugin](https://github.com/hangoutsbot/hangoutsbot/wiki/API-Plugin?ref=connortumbleson.com). This clever plugin added a listener to the bot, then you could `POST` requests to that URL and the bot would react on that command.
Guzzle made that too easy.
```language-php
$url = env('BOT_HOST') . ":" . env('BOT_PORT');
$response = $this->guzzle->request('POST', $url, [
'json' => [
'key' => env('BOT_APIKEY'),
'sendto' => $sendto,
'content' => $content
]
]);
```
This was one of our more interesting improvements. The bot would now message us privately on Google Hangouts triggering a notification to remind us of the event we signed up for.
###### Step 8 - End: Identifying those in an Event
Now we had an opportunity to extend again. A new feature request was "*I want to know who is online before I sign on*". So off to Google and I find [xboxapi.com](https://xboxapi.com/?ref=connortumbleson.com). An unofficial service for making Xbox API calls.
They had an interesting endpoint
- `/v2/{xuid}/presence` \- This is the current presence information for a specified `XUID`
So an additional library was created using this endpoint. All we needed was the `XUID` of the gamertag and the API would return the "online status" of that `XUID`.
```language-php
$url = sprintf(XboxConstants::$getPresenceUrl, $account->xuid);
$requests[$account->seo] = $client->getAsync($url, [
'headers' => ['X-AUTH' => env('XBOXAPI_KEY')]
]);
```
We would iterate through our accounts and get their "online status" on Xbox. The image below shows this in action.
---
Our website, bot and more grew rapidly throughout this process. This turned out to be a constantly evolving fun project, using multiple technologies together.
### Apktool v2.0.2 Released
URL: https://connortumbleson.com/2015/10/12/apktool-v2-0-2-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.0.2 has been released! This release contains support for Android Marshmallow (`API 23`) and includes the updated [smali](https://github.com/JesusFreke/smali?ref=connortumbleson.com) project version `2.0.8`.
This release had 22 commits by the following 5 people
- Connor Tumbleson (iBotPeaches) - 14 commits
- Ben Gruver (JesusFreke) - 5 commits
- Peirre-Hugues Husson (phhusson) - 1 commit
- Andrew Grieve (agrieve) - 1 commit
- Alex Light (allight) - 1 commit
This release follows Semantic Versioning, so there are no incompatibilities with the previous `2.0.1` release.
# Changes since 2.0.1
- \[[#1005](https://github.com/iBotPeaches/Apktool/issues/1005?ref=connortumbleson.com)\] Fixed issues with apks that used `.9.xml` files which improperly triggered 9patch decoder.
- \[[#1020](https://github.com/iBotPeaches/Apktool/pull/1020?ref=connortumbleson.com)\] Fixed issues with compressing resources that shouldn't be. (Thanks agrieve)
- \[[#1023](https://github.com/iBotPeaches/Apktool/issues/1023?ref=connortumbleson.com)\] Fixed issue with reference attributes being decoded improperly. (Thanks phhusson)
- \[[#928](https://github.com/iBotPeaches/Apktool/issues/928?ref=connortumbleson.com)\] Fixed issue with version qualifiers being added on build.
- \[[#999](https://github.com/iBotPeaches/Apktool/issues/928?ref=connortumbleson.com)\] Added support for Android Marshmallow.
- Updated smali/baksmali to `2.0.8`.
- `libc++` statically included in `aapt` binary to prevent the need to install it. Thanks a ton to Dees Troy of TWRP for helping with this.
**Please make sure to follow these [migration instructions](http://ibotpeaches.github.io/Apktool/documentation/?ref=connortumbleson.com#v2-0-1-v2-0-2) from `v2.0.1` to `v2.0.2`.**
## Notes
If this is your first `v2.x` release. Please read the [migration instructions](http://ibotpeaches.github.io/Apktool/documentation/?ref=connortumbleson.com#v1-5-x-v2-0-0).
# Download
- [Apktool 2.0.2](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.0.2.jar?ref=connortumbleson.com) \- md5 `2c25fd4270d6aff37c5165342991bce6`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
## Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Threads](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Destiny - Temporary Restriction
URL: https://connortumbleson.com/2015/08/01/destiny-temporary-restriction/
Last updated: 2021-01-20T13:28:09.000Z
I am a console gamer in my free time, a bit of gaming daily helps balance my brain with all the programming and school work I do. My game of choice is Destiny on the Xbox One, and lately Destiny had been filled with those who abused networking bringing intentional lag to games to have an advantage over others.
> Bans for network manipulation are being issued in the Crucible. More details tomorrow in the Weekly Update.
>
> — Bungie (@Bungie) [July 30, 2015](https://twitter.com/Bungie/status/626563494545072128?ref=connortumbleson.com)
So this tweet above was very exciting for me to hear, as about 1 in every 10 games has some sort of network abuser making the experience quite poor. So tomorrow arrived and we got these bit of details in the weekly update.
> We’re committed to protecting Destiny against cheaters. Enjoy your game. Just play it fair. That’s all we ask. Short of your own commitment to honor, we’ll taken action ourselves. It’s not a thing we enjoy doing – and certainly something we’ll never quantify or describe in agonizing detail. The damned shall remain anonymous – their nefarious actions a mystery.
> We know you want justice. We’ve seen the chatter. We’ve read the reports. Yesterday and today, our Security Response Team has restricted access to the Crucible by the worst offenders among us all.
> We started with a look at the most notorious cheaters that had been reported by other players. After a cross-reference against our own player-data, we gave the Banhammer a mighty swing. Contained in its blast radius were hundreds of people who have manipulated network traffic. If you don’t know what that means, we love you. Never change.
> Cheating will not be tolerated, Guardians. The Destiny Community is a part of this process. Your finest weapons in the fight against cheaters are the reporting tools built right into the game. Submit a report when and where you detect shenanigans. Shaming your offenders in a video might feel good, but it doesn’t factor into our process for passing down a guilty verdict – and it might get you in trouble with the moderators of your favorite Guardian clubhouse! Issue a report. We’re watching and monitoring.
> Now get out there and seek out a fair fight, assuming you still have the privilege to do so.
I think you know where this is going. I jump on my xbox to enjoy a lag free experience and am joined with this message.
I simply don't believe the message shown to me. I restart my xbox and try again. Same message. I have been "Temporarily Restricted" and I have no idea why. So off to [bungie.net/bans](http://bungie.net/bans?ref=connortumbleson.com) we go.
> Q: **An in-game message says that my account has been restricted or banned. What does that mean?**
> If you were directed to this page by an in-game message your account will no longer be able to play Destiny or portions thereof.
> If the message you received referenced a temporary account restriction, your account status will eventually be restored.
I'm not going to copy and paste the ban page, but will cover a couple of main points.
> **Q: Where do I go to dispute the status of my Destiny account? How do I get a restriction overturned?**
> Account restrictions are temporary, but will not be overturned or undone before they expire. If actions were taken against your account, then it was with reason.
> There are no options to dispute or overturn account restrictions or bans. There will be no responses to any communication from this process.
So that's just peachy. There is no dispute process or reason for **why** I'm banned or **how** long.
I'm part of a clan of amazing people, which is the only reason I still play this game. I load up our team website [roster](http://pandalove.club/roster?ref=connortumbleson.com) page and check everyone. For some strange reason, only I was banned out of 9 others who all, like me, play completely fair.
I only play with my clan, so I'm quite stunned how I caught a ban solo among our group.
So now I want to get this overturned, because obviously I did not engage in any cheating of any kind. Bungie has no phone number, no email support and no route to dispute (like mentioned above).
So I made my first mistake. Posting on the Help Forums on Bungie.net. I posted a short topic linking to my game history on various stat sites showing my innocence. I was met immediately with an army of replies.
> *Don't mind me, I'm just counting how many ban threads I've seen today. Count so far: 16*
> *It's so beautiful!*
> *TOOOOOOOOOOOOOO BAD!!!! Keep crying*
> *Hi! Im here to collect the tears of cheaters for the new bungie bounty! Make sure they're extra salty!*
> *I'm collecting a lot of mutes today. Thank you for making yourself known.*
> *The last laughs on u scrub lol*
> *Buh-bye!*
> *You deserved it.*
> *Just contact bungie they will sort it out*
> *Then you were with someone who was... and guilty by association... LOVE IT!*
Then a few more rational comments
> *No evidence I can find that you cheated. Sympathies dude. You play with a range of other people though, perhaps one of your teammates lag switched and now you're caught in the ban-hammer blast radius.*
> *Although he did not kick people from any games, that does not eliminate all possibility of cheating. I played against people who were clearly lag switching and never got kicked. The player would be at the other end of the map and suddenly the two orbs we were camping would be revived and he would not have moved. I am not saying OP did this, but just wanted to remind everyone that cheating isn't just limited to kicking.*
> *But in all seriousness im pretty sure if you were reported enough times you got a crucible restriction*
Then finally an official response
> So there are Account Restrictions and Bans in Destiny - these are two separate entities. Account Restrictions are temporary, while Bans are permanent. Bungie does not dispute or overturn either of them.
> All the details you need can be found at their official policy here.
> [https://www.bungie.net/7\_Destiny-Account-Restrictions-and-Banning-Policies/en/Help/Article/11929](https://www.bungie.net/7%5FDestiny-Account-Restrictions-and-Banning-Policies/en/Help/Article/11929?ref=connortumbleson.com)
So that's absolutely great. Lets go over these comments.
First, we have a subset of users that for some reason enjoy reading the Help forums on Bungie and interjecting opinions that help no one at hand here. Just spitting nonsense and laughing at the suspension of myself. I'm not quite sure why they get entertainment or fun from this, but it is apparent in all the other threads so they must like doing it.
Second, we have a few rational replies. Brave people who ignore the previous comments and examine my game history and find nothing amiss. Unfortunately they do not work for Bungie and personally can't help my cause. However, the responses are greatly appreciated as it drowns out some of the negative behavior.
Finally, we have the official reply. Which as you see, just tells me to go back to the ban page that [http://bungie.net/bans](http://bungie.net/bans?ref=connortumbleson.com) links to. So here I am, banned from a game for something I didn't do without an appeal option.
After a few hours of ignoring the internet. A new Bungie tweet comes out, because the Help forums are littered with hundreds of topics saying the same thing I was.
> .[@TheLegendBlue](https://twitter.com/TheLegendBlue?ref=connortumbleson.com) That's not true. This week's restrictions are temporary and isolated to Crucible activity. Never too late to fight fair.
>
> — Bungie (@Bungie) [July 31, 2015](https://twitter.com/Bungie/status/627159587972608000?ref=connortumbleson.com)
Which is what I already know. I'm temporarily banned for an unknown amount of time. So a bit upset, I take a visit to the Help forums -- my second mistake.
This Help forum in general has a new post every few seconds, with the same general topic being. "I'm banned, but dunno why". I personally refuse to believe that every banned person is innocent, because you can find proof online of users buying equipment with the intent to cheat and asking how it works with the same username that they are using on Bungie.
However, since I'm innocent I can't truly determine if anyone else is lying or not. I don't know them, much like they don't know me. However, they are belittled much like me by an army of users just spamming mean comments to people they don't know. Sounds like the internet right?
So off to the EULA I go, hoping to find something that gives me grounds to appeal / obtain a reason for a suspension, but instead I find this.
> Bungie reserves the right, in its sole discretion, to terminate your access to any or all Bungie Services and the related services or any portion thereof at any time, without notice.
Well this sucks. So here I sit, a mere 35 hours after being suspended for an unknown amount of time for something I didn't do.
What really upsets me, is I'm not a random user of Bungie. I'm part of the development community group, which started before the game launched, obtaining API keys and access to the Bungie API. I even wrote a site powered by the Bungie API, you can read my blog about that [here](https://connortumbleson.com/panda-love-project/). I've exchanged multiple messages with the API team and helped track down fields that weren't properly calculated or displayed.
Yet, I'm temporarily suspended and sit here looking at this screen (Everything locked and prohibited from doing).
Who knows when I'll be unbanned or if I'll even purchase the next DLC of this game after being suspended for something I didn't do.
Rant over. Thanks for reading.
EDIT: I was unbanned at Noon (12) on August 7\. So 7.5\~ day ban.
### Apktool v2.0.1 Released
URL: https://connortumbleson.com/2015/07/15/apktool-2-0-1-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.0.1 has been released! Took longer than I hoped due to small edge case bugs, but it has been released. This release also contains the updated [smali](https://code.google.com/p/smali/?ref=connortumbleson.com) `2.0.6` release.
This release had 44 commits by the following 6 people
- Ben Gruver (JesusFreke) - 24 commits
- Connor Tumbleson (iBotPeaches) - 16 commits
- Matt Mastracci (mmastrac) - 1 commit
- Rover12421 - 1 commit
- Jiří Hruška (yirkha) - 1 commit
- iam - 1 commit
This release follows Semantic Versioning, so there are no incompatibilities with the previous `2.0.0` release.
### Changes since 2.0.0
- \[[#928](https://github.com/iBotPeaches/Apktool/issues/928?ref=connortumbleson.com)\] Fixed version qualifier like `v4` from being ignored during decode.
- \[[#927](https://github.com/iBotPeaches/Apktool/issues/927?ref=connortumbleson.com)\] Fixed windows helper script from appending current directory into `$PATH`. (Thanks Tercete)
- \[[#936](https://github.com/iBotPeaches/Apktool/issues/936?ref=connortumbleson.com)\] Fixed frameworks that were Shared Libraries from affecting the `apktool.yml` file.
- \[[#913](https://github.com/iBotPeaches/Apktool/issues/913?ref=connortumbleson.com)\] Fixed apks that were crashing on internal attributes.
- \[[#921](https://github.com/iBotPeaches/Apktool/issues/921?ref=connortumbleson.com)\] Fixed `ResFileValue(s)` being casted to `ResScalarValues`.
- \[[#924](https://github.com/iBotPeaches/Apktool/issues/924?ref=connortumbleson.com)\] Fixed reading `ResConfigFlags` twice.
- \[[#990](https://github.com/iBotPeaches/Apktool/issues/990?ref=connortumbleson.com)\] Expose raw index used for resource lookups. (Thanks mmastrac)
- Correctly add `libs` and `lib` folders on `[b]uild`
### Notes
If this your first `v2.x` release. Please read the [migration instructions](http://ibotpeaches.github.io/Apktool/documentation/?ref=connortumbleson.com#v1-5-x-v2-0-0).
### Download
- [Apktool 2.0.1](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.0.1.jar?ref=connortumbleson.com) \- md5 `468139c57d4243539416ae10be97723a`
- Rename to `apktool.jar` and follow the [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
#### Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Apktool v2.0.0 Released
URL: https://connortumbleson.com/2015/04/20/apktool-v2-0-0-released/
Last updated: 2018-08-22T01:19:24.000Z
Apktool v2.0.0 has been released! The `2.x` release was started on May 19, 2013\. Almost 2 years later it has finally been released. Now, we have had beta releases and release candidates for awhile so we didn't have a blackout of apktool for 23 months.
This release had 49 commits by the following 6 people
- Connor Tumbleson (iBotPeaches) - 41 commits
- Greg Leach (simtel12) - 3 commits
- Rover12421 - 2 commits
- thuxnder - 1 commit
- Jeremy Hornberger (jhornber) - 1 commit
- Furniel - 1 commit
With the release of `v2.0.0`. Apktool will adopt [Semantic Versioning](http://semver.org/?ref=connortumbleson.com).
#### Changes since RC4
- Android 5.1 Support
- New Apktool [website](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com) since Googlecode is [shutting down](http://google-opensource.blogspot.com/2015/03/farewell-to-google-code.html?ref=connortumbleson.com).
- \[[#658](https://github.com/iBotPeaches/Apktool/pull/105?ref=connortumbleson.com)\] - Fixed issue with double escaping of `&` and `<`. (Thanks jhornber)
- \[[#840](https://github.com/iBotPeaches/Apktool/issues/870?ref=connortumbleson.com)\] - Add support for `BCP-47` tags.
- \[[#878](https://github.com/iBotPeaches/Apktool/issues/878?ref=connortumbleson.com)\] - Fixed issue with unknown files not respecting compression method. (Thanks simtel12)
- \[[#890](https://github.com/iBotPeaches/Apktool/issues/890?ref=connortumbleson.com)\] - Fixed issue with apktool branding apks with `platformBuildName`.
- \[[#904](https://github.com/iBotPeaches/Apktool/issues/904?ref=connortumbleson.com)\] - Fixed issue with multiple dex files skipped when using `-s`.
- \[[#636](https://github.com/iBotPeaches/Apktool/issues/636?ref=connortumbleson.com)\] - Fixed issue with `@string` references in `` attributes.
- Increased performance. (Thanks thuxnder & rover12421)
- Fixed issue decoding `.spi` files as 9 patch images. (Thanks Furniel)
#### Notes
If this is your first `v2.x` release. Read the migration instructions [here](http://ibotpeaches.github.io/Apktool/documentation/?ref=connortumbleson.com#v1-5-x-v2-0-0).
Android 5.1 support was added, so please delete the file at `$HOME/apktool/framework/1.apk` before trying `2.0.0`. A change in the internal framework requires this file to be deleted.
#### Download
- [Apktool 2.0.0](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.0.0.jar?ref=connortumbleson.com) \- md5 `9b324375e115acd09932d73e25fc741b`
- Rename to `apktool.jar` and follow [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
#### Links
- [Project Site](http://ibotpeaches.github.io/Apktool/?ref=connortumbleson.com)
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Apktool: Fixing Bug 761
URL: https://connortumbleson.com/2015/04/10/apktool-fixing-bug-761/
Last updated: 2018-08-22T01:19:24.000Z
*This is my second technical blog exploring the steps taken to add support for BCP47 to Apktool.*
The February 16th daily of Cyanogenmod had an interesting error. The decode went alright, but spat out a common directory error on rebuild.
```language-bash
$ apktool d Settings.apk
I: Using Apktool 2.0.0-RC4 on Settings.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: 1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values / XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
$ apktool b Settings
I: Using Apktool 2.0.0-RC4
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
invalid resource directory name: Settings\res\values-?@-rES
```
These "invalid resource directory name" errors are thrown by `aapt`. You can see in `tools/aapt/AaptAssets.cpp` in `slurpResourceTree()`.
```language-c
bool b = group.initFromDirName(entry->d_name, &resType);
if (!b) {
fprintf(stderr, "invalid resource directory name: %s %s\n", srcDir.string(),
entry->d_name);
err = -1;
continue;
}
```
So apktool produced a qualifier that `aapt` rejected. Obviously looking at the folder of `values-?@-rES`. There is something wrong there. (`?@`) is not a qualifier, so something went amiss. Thankfully with qualifier errors we can leverage `aapt` to identify the qualifiers that were suppose to be there.
```language-bash
aapt d configurations Settings.apk | grep ES
ast-ES
gl-ES
gl-ES-nokeys
eu-ES
eu-ES-nokeys
```
Now the problem is the first qualifier of `ast-ES`. The language and region qualifier are bound by the two letter [ISO 639-1](http://www.loc.gov/standards/iso639-2/php/code%5Flist.php?ref=connortumbleson.com) (language) followed by a two letter [ISO 3166-1-alpha-2](http://www.iso.org/iso/en/prods-services/iso3166ma/02iso-3166-code-lists/list-en1.html?ref=connortumbleson.com) (region). Both language and region have a maximum of 2 characters, yet I'm looking at a 3 character language above.
My first step was to figured out what `ast` was. `ES` is `Spain`, but I had never seen a 3 letter language before. Since Cyanogenmod utilizes CrowdIn. I went to their page and checked out all languages beginning with an A.
There it was, plain as day. `Asturian` was added to Cyanogenmod, yet it had a 3 letter qualifier when every other language had 2\. My Cyanogenmod device handled these apks fine, but apktool failed. Somehow I missed a qualifier change during the Lollipop update.
I usually visit the [ResourceTypes](http://developer.android.com/guide/topics/resources/providing-resources.html?ref=connortumbleson.com#ResourceTypes) page to find changes to qualifiers. As of this blog post (4/10/2015) there is no mention of what we will soon figure out to be the addition of the BCP47 qualifier and a clever 3 letter packed byte trick.
When the documentation fails, my secondary choice is examining the `platform_frameworks_base` commit history. The file that controls the qualifier(s) is `platform_frameworks_base/include/androidfw/ResourceTypes.h`. So I examined the history involving that file.
It didn't take long.
The commit message for the first commit, answered the question.
> AssetManager support for 3 letter lang/country codes.
- 3 letter codes are packed into the existing 32 bit locale
field in ResTable\_config
- We introduce new fields for script / variant information.
but wait. Re-read that. "**3 letter codes are packed into the existing 32 bit locale field**". 32 bits = 4 bytes. 4 bytes = 4 characters. How in the right mind can you get (`ast-ES`) in 4 bytes. 5 characters cannot fit in 4 bytes. What kind of magic is going on here.
Thankfully, AOSP added some comments.
```language-c
union {
struct {
// This field can take three different forms:
// - \0\0 means "any".
//
// - Two 7 bit ascii values interpreted as ISO-639-1 language
// codes ('fr', 'en' etc. etc.). The high bit for both bytes is
// zero.
//
// - A single 16 bit little endian packed value representing an
// ISO-639-2 3 letter language code. This will be of the form:
//
// {1, t, t, t, t, t, s, s, s, s, s, f, f, f, f, f}
//
// bit[0, 4] = first letter of the language code
// bit[5, 9] = second letter of the language code
// bit[10, 14] = third letter of the language code.
// bit[15] = 1 always
//
// For backwards compatibility, languages that have unambiguous
// two letter codes are represented in that format.
//
// The layout is always bigendian irrespective of the runtime
// architecture.
char language[2];
// This field can take three different forms:
// - \0\0 means "any".
//
// - Two 7 bit ascii values interpreted as 2 letter region
// codes ('US', 'GB' etc.). The high bit for both bytes is zero.
//
// - An UN M.49 3 digit region code. For simplicity, these are packed
// in the same manner as the language codes, though we should need
// only 10 bits to represent them, instead of the 15.
//
// The layout is always bigendian irrespective of the runtime
// architecture.
char country[2];
};
uint32_t locale;
};
```
This is what we wanted.
```language-c
// - A single 16 bit little endian packed value representing an
// ISO-639-2 3 letter language code. This will be of the form:
//
// {1, t, t, t, t, t, s, s, s, s, s, f, f, f, f, f}
//
// bit[0, 4] = first letter of the language code
// bit[5, 9] = second letter of the language code
// bit[10, 14] = third letter of the language code.
// bit[15] = 1 always
//
```
As you can see. They managed to pack 3 letters into 2 bytes (16 bits). It appears the high bit (`bit 15`) is thrown when utilizing this 3 letter qualifier. That leaves 5 bits per letter for a total of 16 bits (`1 + 3(5) = 16`)
So lets work through this with `ast` trying to replicate the byte combination used. Using an `ASCII` table.
- a = 61
- s = 73
- t = 74
Already I spot a problem. If you aren't familiar with binary each digit in binary represents a power. The below picture should explain it better than I can.
The first digit is 2^0, then 2^1, etc.
However that is 8 bits. As mentioned above, we only have 5 bits to represent these characters.
This changes our image to this.
Except what is the max of a 5 bit binary string? Well `1+2+4+8+16 = 31` or binary `11111`. Shown above we have `61`, `73` and `74`. We cannot represent those digits with 5 bits. We have a problem.
Examining the [commit](https://github.com/iBotPeaches/platform%5Fframeworks%5Fbase/commit/48620f1d1b03e1cb4e0dce4999e0a4c2daf3a1b2?ref=connortumbleson.com) that introduced this change I find the `packLanguageOrRegion` method which appears to handle the character to byte conversion.
```language-c
void packLanguageOrRegion(const char in[3], const char base, char out[2]) {
if (in[2] == 0) {
out[0] = in[0];
out[1] = in[1];
} else {
uint8_t first = (in[0] - base) & 0x00ef;
uint8_t second = (in[1] - base) & 0x00ef;
uint8_t third = (in[2] - base) & 0x00ef;
out[0] = (0x80 | (third << 2) | (second >> 3));
out[1] = ((second << 5) | first);
}
}
```
It seems AOSP subtracts some `char base` from the bytes before bit shifting them into position. So I figured out what calls this method.
```language-c
packLanguageOrRegion(language, 'a', this->language);
packLanguageOrRegion(region, '0', this->country);
```
From this it appears any packed language has `a` subtracted from it while any region has `0` subtracted from it. Could it be this simple? The `a` ASCII value is `61`. So lets subtract `61` from our previous values.
- a = `61 - 61 = 0`
- s = `73 - 61 = 12`
- t = `74 - 61 = 13`
Thus
- a = `0`
- s = `12`
- t = `13`
Each of these digits can be packed into 5 bits.
- a = `00000`
- s = `01100`
- t = `01101`
So at least we know and understand how 3 letters are fitting into 2 bytes. This base value is substracted from the characters and then added on later so they can fit in 5 bits. Quite an interesting method.
So lets get started on working on a patch. It appears the decoding for language and region has been changed to this `unpackLanguageOrRegion` function instead of just reading the `chars` directly from the stream.
Below the `c++` version.
```language-c
size_t unpackLanguageOrRegion(const char in[2], const char base, char out[4]) {
if (in[0] & 0x80) {
// The high bit is "1", which means this is a packed three letter
// language code.
// The smallest 5 bits of the second char are the first alphabet.
const uint8_t first = in[1] & 0x1f;
// The last three bits of the second char and the first two bits
// of the first char are the second alphabet.
const uint8_t second = ((in[1] & 0xe0) >> 5) + ((in[0] & 0x03) << 3);
// Bits 3 to 7 (inclusive) of the first char are the third alphabet.
const uint8_t third = (in[0] & 0x7c) >> 2;
out[0] = first + base;
out[1] = second + base;
out[2] = third + base;
out[3] = 0;
return 3;
}
```
So a fairly easy port to `java`.
```language-java
private char[] unpackLanguageOrRegion(byte in0, byte in1, char base) throws AndrolibException {
// check high bit, if so we have a packed 3 letter code
if (((in0 >> 7) & 1) == 1) {
int first = in1 & 0x1F;
int second = ((in1 & 0xE0) >> 5) + ((in0 & 0x03) << 3);
int third = (in0 & 0x7C) >> 2;
// since this function handles languages & regions, we add the value(s) to the base char
// which is usually 'a' or '0' depending on language or region.
return new char[] { (char) (first + base), (char) (second + base), (char) (third + base) };
}
return new char[] { (char) in0, (char) in1 };
}
```
At this point we correctly had `char[]`'s that represented 3 character languages. However, we didn't have the correct locales being printed. A bit of hackery checking the length of language and region allowed an adaption to `getLocaleString()`. This was able to handle the 3 letter packed language.
I then decoded the original apk and checked the `/res` folder.
```language-bash
$ apktool d Settings.apk
I: Using Apktool 2.0.0-dc02ab-SNAPSHOT on Settings.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: 1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
$ cd Settings/res
$ ls -l | grep ast
drwxrwxr-x 2 ibotpeaches ibotpeaches 4096 Feb 25 17:01 values-ast-rES
```
Yay! We correctly decoded a 3 letter language.
Though I knew my work was not yet finished, because I spied a qualifier change while looking at the previous commits.
Hiding without Android documentation in the `ResourceTypes.h` file was this addition.
```language-c
// The ISO-15924 short name for the script corresponding to this
// configuration. (eg. Hant, Latn, etc.). Interpreted in conjunction with
// the locale field
char localeScript[4];
// A single BCP-47 variant subtag. Will vary in length between 5 and 8
// chars. Interpreted in conjunction with the locale field.
char localeVariant[8];
```
Wow. They added 12 bytes to the `ResConfig` header. Usually we see `2 byte` additions every few versions, but AOSP added `12 bytes` on Lollipop.
This was the first mention of `BCP-47` I saw. This stands for `Best Current Practice`. Though researching `BCP-47` in the scope of Android was very difficult.
Documentation was next to none and my only hits were from the AOSP commits, bug tracker and unit tests. It appears they wanted to "soft" launch this change as I cannot find any proof of its existence in any Android developer documentation. The unit tests proved to be exactly what I needed.
This showed qualifiers such as
- `values-b+eng`
- `values-b+eng+Latn`
- `values-b+en+US+POSIX`
- `values-b+eng+419`
It appears the pattern of `-b+` signals a `BCP` tag. So basically if `script` or `variant` was not equal to `null` than I knew it was a `BCP` tag. Which was an easy addition to our `ARSCDecoder.java` and `ConfigFlags.java`.
```language-java
char[] localeScript = {'\00'};
char[] localeVariant = {'\00'};
if (size >= 48) {
localeScript = this.readScriptOrVariantChar(4).toCharArray();
localeVariant = this.readScriptOrVariantChar(8).toCharArray();
}
```
`size` corresponds to the size of the header. Prior to this change it was `36`. `36 + 12 = 48`. This helps Apktool from breaking on older apks by only reading data if it is there.
Quite a complicated pattern of language, region, script and variant. Since after you had the variables populated, in what order did the locales can get written? Was it script before variant or vice versa? There were a couple edge cases to handle, which made this a boring fix. No documentation. Just trying to replicate the unit-tests in AOSP and making sure Apktool could handle those.
Once applications start utilizing this unknown `BCP-47` feature, a bug or two might be discovered. Until there is some real world results, I'm not quite sure if I handled support for every combination of language, region, script and variants.
Though, the main concern is that the 3 letter language had been [fixed](https://github.com/iBotPeaches/Apktool/pull/100/files?ref=connortumbleson.com) and merged into master.
**Timeline**
- February 17 - Bug reported by laura.almeida.lannister
- February 17 - I start investigating it, because all new Cyanogenmod builds are breaking
- February 19 - Commit reaches [Github](https://github.com/iBotPeaches/Apktool/commit/d40710005f1db36f322302aded4540672b84c17d?ref=connortumbleson.com)
- February 21 - Commit [finalized](https://github.com/iBotPeaches/Apktool/commit/dc02abcf5123ae7bddc23c0d76ac3f8b924799a6?ref=connortumbleson.com)
- February 25 - Merged into [master](https://github.com/iBotPeaches/Apktool/pull/100?ref=connortumbleson.com)
- April 10 - Blogged about it
### Apktool: Fixing Bug 713
URL: https://connortumbleson.com/2015/02/16/fixing-apktool-bug713/
Last updated: 2018-08-22T01:19:23.000Z
*This is my first technical blog exploring the path of fixing one of Apktool's more complicated bugs*
Around December of 2014, Lollipop builds of LG started being leaked to the public. I got a bug report, shortly after, saying that decoding had stopped working in Apktool. Already having previously [patched](https://github.com/iBotPeaches/Apktool/pull/97/files?ref=connortumbleson.com) Lollipop support I was quite confused in what had broken.
So lets step in and see what the problem is.
```language-bash
$apktool if lge-res.apk -t bug713
I: Framework installed to: /home/ibotpeaches/apktool/framework/0-bug713.apk
$apktool if framework-res.apk -t bug713
I: Framework installed to: /home/ibotpeaches/apktool/framework/1-bug713.apk
```
Then lets do the decode.
```language-bash
$apktool d UnifiedEULA.apk -t bug713
I: Using Apktool 2.0.0-RC3 on UnifiedEULA.apk
I: Loading resource table
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/ibotpeaches/apktool/framework/1-bug713.apk
W: Could not decode attr value, using undecoded value instead: ns=android, name=label, value=0x7f080000
W: Could not decode attr value, using undecoded value instead: ns=android, name=icon, value=0x7f02000c
W: Could not decode attr value, using undecoded value instead: ns=android, name=label, value=0x7f08001e
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
Exception in thread "main" brut.androlib.err.UndefinedResObject: resource spec: 0x7f080000
```
Wait what? Why did `lge-res.apk` install as `0-bug713.apk`? The leading integer represents the packageId, and I haven't ever seen a valid packageId of 0 before. Generally Android uses 1 for `framework-res.apk` and 2-9 for other framework files. So we have spotted our first error in that `lge-res.apk` is installing incorrectly.
Secondly, `UnifiedEULA.apk` is failing to decode with a few resources. If we examine the first resource `0x7f080000`. We can pull that resourceId apart to understand it.
- `0x7f` \= `packageId`
- `0x08` \= `typeId`
- `0x0000` \= `entryId`
So a packageId of `0x7f` represents a local package. This means the resource table we are looking for is present in this APK (`UnifiedEULA`). So why didn't it find it? Lets double check using aapt (Android Asset Packaging Tool) to make sure this resource is in fact here.
```language-bash
$aapt d resources UnifiedEULA.apk | grep '0x7f080000'
spec resource 0x7f080000 com.lge.eula:string/app_name: flags=0x00000004
resource 0x7f080000 com.lge.eula:string/app_name: t=0x03 d=0x00000060 (s=0x0008 r=0x00)
```
So yes, the resource we are looking for is infact in this APK. This points to a fault in the decoding process of Apktool.
**So why is lge-res installing as pkgId 0?**
Lets go back to our trustworthy aapt and see what it has to say.
```language-bash
$aapt d resources lge-res.apk | more
Package Groups (1)
Package Group 0 id=0x02 packageCount=1 name=com.lge
Package 0 id=0x00 name=com.lge
```
Uh what. How come aapt is reporting the packageId as `0x02` but Apktool is identifying it as `0x00`?
Lets take a peek into the source of Apktool and see if a mistake is occurring.
Well thats not good. Reading the `int` directly from the stream reports as `0` as well. So lets take a look at a hex dump of the `resources.arsc` file.
As you can see the int (4 bytes prior to highlighted packageName) is `0`. So this means we have a change in AOSP that has changed the basic storage of packageIds.
I started to look at the release documents of Lollipop but found nothing that had anything to do with packageIds. So off to the repository I go. I generally look in `platform_frameworks_base` and the subfolder `tools/aapt`. This gave me about \~100 commits to look through between Kitkat and now.
I started skimming the commit messages and spotted "[Shared library resource support](https://github.com/android/platform%5Fframeworks%5Fbase/commit/de898ff42912bd7ca1bfb099cd439562496765a4?ref=connortumbleson.com)". This sounded like something related and sure enough the commit message confirmed.
```language-git
Shared libraries can now export resources for applications to use.
Exporting resources works the same way the framework exports
resources, by defining the public symbols in res/values/public.xml.
Building a shared library requires aapt to be invoked with the
--shared-lib option. Shared libraries will be assigned a package
ID of 0x00 at build-time. At runtime, all loaded shared libraries
will be assigned a new package ID.
Currently, shared libraries should not import other shared libraries,
as those dependencies will not be loaded at runtime.
At runtime, reflection is used to update the package ID of resource
symbols in the shared library's R class file. The package name of
the R class file is assumed to be the same as the shared library's
package name declared in its manifest. This will be customizable in
a future commit.
See /tests/SharedLibrary/ for examples of a shared library and its
client.
Bug:12724178
Change-Id: I60c0cb8ab87849f8f8a1a13431562fe8603020a7
```
So incase you missed it. Check out the 3rd paragraph.
> Building a shared library requires aapt to be invoked with the
> `--shared-lib` option. **Shared libraries will be assigned a package**
> **ID of 0x00 at build-time**. At runtime, all loaded shared libraries will be assigned a new package ID.
So we have found our culprit. This APK is using this new method of shared library resources. Thus, its packageId is set at runtime instead of buildtime.
The problem still remains though that our APKs can't decode unless they know the packageId of the resources. If you remember from above though, aapt had correctly determined the packageId of `0x02`. How did it do that?
We take a look at the `libs/androidfw/ResourceTypes.cpp` file.
```language-git
ResTable::ResTable()
- : mError(NO_INIT)
+ : mError(NO_INIT), mNextPackageId(2)
```
As you can see from the diff report. The packageId is literally just hardcoded as 2.
So I patched Apktool quite abruptly with.
```language-java
if (id == 0) {
// This means we are dealing with a Library Package, we should just temporarily
// set the packageId to the next available id . This will be set at runtime regardless, but
// for Apktool's use we need a non-zero packageId.
// AOSP indicates 0x02 is next, as 0x01 is system and 0x7F is private.
id = 2;
}
```
Would it be that simple? Lets try again.
```language-bash
$apktool if lge-res.apk -t bug713
I: Framework installed to: /home/ibotpeaches/apktool/framework/2-bug713.apk
```
Good good. We have a correct packageId now. Lets try the decode again. I'll save you the stacktrace and just tell you. It failed, with the same error as before.
So why aren't resources being decoded? In Apktool we have two sets that hold all the resources decoded.
```language-java
private final Set mMainPackages = new LinkedHashSet();
private final Set mFramePackages = new LinkedHashSet();
```
with each `ResPackage` containing a Map of resources indexed by the resourceId.
```language-java
private final Map mResSpecs = new LinkedHashMap();
```
Each `ResResSpec` contains
```language-java
public ResResSpec(ResID id, String name, ResPackage pkg, ResType type) {
this.mId = id;
this.mName = name;
this.mPackage = pkg;
this.mType = type;
}
```
So I set a breakpoint during this failure and was astounded. The `mMainPackages` count for `mResSpecs` was at 0\. We had 0 `ResResSpecs`. So decoding was failing badly. Badly enough that not even a single resource was decoded.
So I went as far back into the Apktool procedure where `mResSpecs` was populated. Back in the process of Apktool, during decoding of the `ResPackage`, we read the `ResTypes` which in turn reads the configs (`readConfigs`), which in turn reads the resources (`readEntry`) of that configuration.
```language-java
while (mHeader.type == Header.TYPE_TYPE) {
readType();
}
```
So why was this check (shown above) failing? `Header.TYPE_TYPE` was `0x0202`, and `mHeader.type` was `0x0203` and Apktool has no support for whatever that was corresponding to.
It appears we have something new, so back to the source (`include/androidfw/ResourceTypes.h`) we go.
```language-git
- RES_TABLE_TYPE_SPEC_TYPE = 0x0202
+ RES_TABLE_TYPE_SPEC_TYPE = 0x0202,
+ RES_TABLE_LIBRARY_TYPE = 0x0203
```
We have found the new type and its called `LIBRARY_TYPE`. This type is before `TYPE_SPEC_TYPE` in the current APK. So Apktool is failing because it has no support for these. So referencing the linked commit above I found these additional structs.
```language-cpp
/**
* A package-id to package name mapping for any shared libraries used
* in this resource table. The package-id's encoded in this resource
* table may be different than the id's assigned at runtime. We must
* be able to translate the package-id's based on the package name.
*/
struct ResTable_lib_header
{
struct ResChunk_header header;
// The number of shared libraries linked in this resource table.
uint32_t count;
};
/**
* A shared library package-id to package name entry.
*/
struct ResTable_lib_entry
{
// The package-id this shared library was assigned at build time.
// We use a uint32 to keep the structure aligned on a uint32 boundary.
uint32_t packageId;
// The package name of the shared library. \0 terminated.
char16_t packageName[128];
};
```
So in short. If we encounter a chunk with a value of `0x0203` or `TYPE_LIBRARY` in the header, we then need to iterate over `count` and read the `packageId` & `packageName` for each count. Adding a quick patch into the `brut.apktool/apktool-lib/src/main/java/brut/androlib/res/decoder/ARSCDecoder.java` file.
We add the following function.
```language-java
private void readLibraryType() throws AndrolibException, IOException {
checkChunkType(Header.TYPE_LIBRARY);
int libraryCount = mIn.readInt();
int packageId;
String packageName;
for (int i = 0; i < libraryCount; i++) {
packageId = mIn.readInt();
packageName = mIn.readNullEndedString(128, true);
LOGGER.info(String.format("Decoding Shared Library (%s), pkgId: %d", packageName, packageId));
}
}
```
With the check added in `readPackage()` we are left with this new functionality.
```language-git
mPkg = new ResPackage(mResTable, id, name);
nextChunk();
+ while (mHeader.type == Header.TYPE_LIBRARY) {
+ readLibraryType();
+ }
while (mHeader.type == Header.TYPE_TYPE) {
readType();
}
```
This full commit may be found [here](https://github.com/iBotPeaches/Apktool/commit/e9d21f84af8522ef797a4016b0266f394b9a5650?ref=connortumbleson.com). So we now are going to check for `TYPE_LIBRARY` and `TYPE_TYPE` respectively. Time to test again with our previously broken `UnifiedEULA.apk`.
```language-bash
$apktool d UnifiedEULA.apk -t bug713
I: Using Apktool 2.0.0-RC3 on UnifiedEULA.apk
I: Loading resource table...
I: Decoding Shared Library (com.lge), pkgId: 2
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/ibotpeaches/apktool/framework/1-bug713.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
$
```
Now lets check if the shared resource is correctly referenced during rebuild.
```language-bash
$ apktool b UnifiedEULA
I: Using Apktool 2.0.0-RC3
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
I: Building apk file...
$
```
It built! So we correctly found the undocumented feature of "shared library resources" and added preliminary support for it.
That was the journey of fixing bug 713 of Apktool. While writing about it was quite easy, there was lots of delays in the original patch while I looked for commits, source, etc.
Thanks for the read and hope you liked my first technical writeup. Comments/critiques good or bad are appreciated!.
### Apktool 2.0.0 RC4 Released
URL: https://connortumbleson.com/2015/02/12/apktool-2-0-0-rc4-released/
Last updated: 2018-08-22T01:19:23.000Z
Apktool 2.0.0 RC4 has been released. I was going to tag this version as 2.0 Gold, but since RC3 introduced a completely written aapt that caused a plethora of errors. I've decided to hold another release candidate.
This released contained 47 commits by 6 people. 27 of the commits belonging to the updated [smali](https://code.google.com/p/smali/?ref=connortumbleson.com) release. Notable in this release is the fix that aapt introduced with implictly adding qualifiers. This caused resource directories to change from `drawable-hdpi` to `drawable-hdpi-v11` as an example. This in theory shouldn't of broken anything, but bug reports proved otherwise.
Since Apktool isn't your "first" tool to build an APK. I determined it was best to just skip this step of adding qualifiers. 0xD34D from Cyanogen [helped](https://github.com/iBotPeaches/platform%5Fframeworks%5Fbase/commit/61afcc3c116b52c8d9aabea2b7f3fce185027f0f?ref=connortumbleson.com) me figure that out.
#### Changes since RC3
- Updated to smali/baksmali 2.0.5
- \[[#685](https://code.google.com/p/android-apktool/issues/detail?id=685&ref=connortumbleson.com)\] - Fixed select invalid attrs from Lollipop APKs
- \[[#713](https://code.google.com/p/android-apktool/issues/detail?id=713&ref=connortumbleson.com)\] - Added support for APKs that utilized Shared Resources
- \[[#329](https://code.google.com/p/android-apktool/issues/detail?id=329&ref=connortumbleson.com)\] - Fixed issue identifying strings that were named liked filepaths as `ResFiles`
- \[[#590](https://code.google.com/p/android-apktool/issues/detail?id=590&ref=connortumbleson.com)\] - Fixed isolated issue with segfaulting apks
- \[[#545](https://code.google.com/p/android-apktool/issues/detail?id=545&ref=connortumbleson.com)\] - Fixed issue with undefined attributes
- \[[#702](https://code.google.com/p/android-apktool/issues/detail?id=702&ref=connortumbleson.com)\] - Fixed invalid treating of `MNC_ZERO` which caused duplicate resources
- \[[#744](https://code.google.com/p/android-apktool/issues/detail?id=744&ref=connortumbleson.com)\] - Fixed ugly warnings of "Cleaning up unclosed ZipFile...."
- \[[#757](https://code.google.com/p/android-apktool/issues/detail?id=757&ref=connortumbleson.com)\] - Fixed downloading gradle over http, instead of https
- \[[#402](https://code.google.com/p/android-apktool/issues/detail?id=402&ref=connortumbleson.com)\] - Fixed issue with framework storage when user has no access to `$HOME`
#### Notes
There was no framework update in RC4, but if RC4 is your first version please delete the file at `$HOME/apktool/framework/1.apk` before trying RC4.
### Download
- [Apktool 2.0.0 RC4](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.0.0rc4.jar?ref=connortumbleson.com) \- md5 `672f12efc5ffee79f3670f36cd6bbb64`
- Rename to `apktool.jar` and follow [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
#### Links
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Apktool 2.0.0 RC3 Released
URL: https://connortumbleson.com/2014/11/27/apktool-rc3-released/
Last updated: 2018-08-22T01:19:23.000Z
Apktool RC3 has been released. This version brings Lollipop support, support for QMGs and merged a patch provided by JEB (The Android Decompiler). After 8 betas and 3 release candidates, I want RC3 to be our last one prior to gold. I'm hoping for our next version to be 2.0.0, assuming no major errors crop up.
#### Changes since RC2
- [#447](https://code.google.com/p/android-apktool/issues/detail?id=447&ref=connortumbleson.com) \- Fixed bad cast of ResStringValue to ResAtr by handling ResStringValue correctly (Thanks whydoubt)
- [#688](https://code.google.com/p/android-apktool/issues/detail?id=688&ref=connortumbleson.com) \- Fixed issue with large windows and linux aapt binaries.
- [#689](https://code.google.com/p/android-apktool/issues/detail?id=689&ref=connortumbleson.com) \- Fixed issue with hard coding extension as PNG.
- [#653](https://code.google.com/p/android-apktool/issues/detail?id=653&ref=connortumbleson.com) \- Added Android Lollipop support.
- [#706](https://code.google.com/p/android-apktool/issues/detail?id=706&ref=connortumbleson.com) \- Added support for `TYPE_DYNAMIC_REFERENCE`.
#### Notes
Please delete the file at `$HOME/apktool/framework/1.apk` before trying RC3\. A change in the internal framework requires this file to be deleted.
This is the first public version with Lollipop support, it is possible I missed something. If something isn't right, feel free to submit a bug via the links below.
### Download
- [Apktool 2.0.0 RC3](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.0.0rc3.jar?ref=connortumbleson.com) \- md5 `27b6525f60bf6017066416447566feb2`
- Rename to `apktool.jar` and follow [Instruction Guide](http://ibotpeaches.github.io/Apktool/install/?ref=connortumbleson.com) if you need help.
#### Links
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [Bug Tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com)
- [XDA Thread](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
### Apktool 2.0.0 RC2 Released
URL: https://connortumbleson.com/2014/10/05/apktool-2-0-0-rc2-released/
Last updated: 2018-08-22T01:19:23.000Z
Apktool 2.0.0 RC2 has been released with tons of fixes and slight codebase cleanup. We have chosen to embrace Java 7 as our required version. First reason is that AOSP now requires it for the lastest Android.
> The master branch of Android in the Android Open Source Project (AOSP) requires Java 7\. On Ubuntu, use OpenJDK.
[https://source.android.com/source/initializing.html](https://source.android.com/source/initializing.html?ref=connortumbleson.com)
Secondly, Java7 was released on July 28, 2011\. If we aren't requiring it 3 years later, then we might as well never update Java. Finally, the added benefits of `try-with-resources` and `nio.2` really helped clean up the codebase. With all these reasons 2.0 now requires Java 7.
### Changes since Beta 9
- Added support for APKs with multiple dex files
- [#601](https://code.google.com/p/android-apktool/issues/detail?id=601&ref=connortumbleson.com) \- Made Stringblock thread safe - aluedeke
- [#238](https://code.google.com/p/android-apktool/issues/detail?id=238&ref=connortumbleson.com) \- Fixed truncated UTF-16 strings
- [#196](https://code.google.com/p/android-apktool/issues/detail?id=196&ref=connortumbleson.com) \- Fixed style crash due to malformed styles
- [#603](https://code.google.com/p/android-apktool/issues/detail?id=603&ref=connortumbleson.com) \- Fixed unknown files that are prefixed with standard file names from being ignored
- [#606](https://code.google.com/p/android-apktool/issues/detail?id=606&ref=connortumbleson.com) \- Fixed unknown files being ignored when `-r` was used
- [#609](https://code.google.com/p/android-apktool/issues/detail?id=609&ref=connortumbleson.com) \- Fixed renamed manifests with (`android`, `com.htc`, `miui`)
- [#626](https://code.google.com/p/android-apktool/issues/detail?id=626&ref=connortumbleson.com) \- Fixed unknown files breaking with non ascii characters
- [#630](https://code.google.com/p/android-apktool/issues/detail?id=630&ref=connortumbleson.com) \- Fixed renamed manifests with (`com.lge`)
- [#409](https://code.google.com/p/android-apktool/issues/detail?id=409&ref=connortumbleson.com) \- Fixed `arrays.xml` items being typed incorrectly
- [#512](https://code.google.com/p/android-apktool/issues/detail?id=512&ref=connortumbleson.com) \- Fixed `AndroidManifest.xml`having `null` key & value attributes
- [#677](https://code.google.com/p/android-apktool/issues/detail?id=677&ref=connortumbleson.com) \- Fixed ignoring `formatted` attributes in `arrays.xml`
- [#675](https://code.google.com/p/android-apktool/issues/detail?id=675&ref=connortumbleson.com) \- Fixed multiple overlapping catches error - JesusFreke
- [#684](https://code.google.com/p/android-apktool/issues/detail?id=684&ref=connortumbleson.com) \- Fixed issue with multiple `ResPackages` in one ARSC file
- [#682](https://code.google.com/p/android-apktool/issues/detail?id=682&ref=connortumbleson.com) \- Fixed renamed manifests with (`yi`)
- [#664](https://code.google.com/p/android-apktool/issues/detail?id=664&ref=connortumbleson.com) \- Fixed issue with apks with large `StringPools` failing to decode
### Notes
[The issue tracker](https://github.com/iBotPeaches/Apktool/issues?ref=connortumbleson.com) with issues tagged as `v2.0` in the milestone category are on the list to be fixed before the official `2.0.0` gold release. While RC2 isn't gold, it has the stability you would expect from an official release. It just lacks the completed list of bug I want in `2.0.0`.
I'm also cross posting this release onto XDA-Developers in order to broaden the users who test. Mainly to test cross platform use with the new embedded aapt executable. Since asking users to control the aapt binary caused about 60% of the problems/bugs. 2.0 resolves this by bundling the aapt binary.
### Faqs
**Q:** \- Where is Apktool RC1?
**A:** \- I made the release, but never blogged / posted about it. Not really sure what happened there.
**Q:** \- How come Bug [#526](https://code.google.com/p/android-apktool/issues/detail?id=526&ref=connortumbleson.com) & [#534](https://code.google.com/p/android-apktool/issues/detail?id=534&ref=connortumbleson.com) are not fixed yet?
**A:** \- Some bugs take me days of research before I even can attempt to code a solution. These two bugs I haven't even found a good solution yet.
**Q:** \- Why are releases so slow?
**A:** \- Apktool is open source. You are free to submit pull requests.
**Q:** \- Why Bitbucket downloads?
**A:** \- Free + download counter = perfect. Github and GoogleCode no longer have download functionality which leaves Bitbucket.
### Download
- [Apktool 2.0.0 RC2](https://bitbucket.org/iBotPeaches/apktool/downloads/apktool%5F2.0.0rc2.jar?ref=connortumbleson.com) \- md5 `26d9e2ccb6db83bbe9f0d64e4d6fa814`
- rename to `apktool.jar` and follow [Instruction Guide](https://code.google.com/p/android-apktool/wiki/Install?ref=connortumbleson.com) if you need help installing
#### Links
- [Github](https://github.com/iBotPeaches/Apktool?ref=connortumbleson.com)
- [XDA Thread](http://forum.xda-developers.com/showthread.php?t=1755243&ref=connortumbleson.com)
- [Migration from 1.5.x instructions](https://code.google.com/p/android-apktool/wiki/MigrationInstructions?ref=connortumbleson.com)
- [Freenode #apktool](http://webchat.freenode.net/?channels=apktool&ref=connortumbleson.com)
### Move over WordPress, Hello Ghost
URL: https://connortumbleson.com/2014/09/21/move-over-wordpress-hello-ghost/
Last updated: 2018-08-22T01:19:23.000Z
Today I executed a plan that was put into motion months ago. I first stumbled upon [Ghost](https://ghost.org/?ref=connortumbleson.com) in a Kickstarter campaign. It caught my eye because WordPress continues to evolve when I just wanted a clean and simple blog. It has become so big and cluttered admin wise that it has to be defined as a CMS now instead of blog engine.
Ghost solved that problem for me. However, Ghost was very young months ago and I could not get myself to convert that early on. After version 0.5 [was released](http://blog.ghost.org/ghost-0-5/?ref=connortumbleson.com) and my name was present in the list of contributors I felt the time was ready to convert. Time passed until I had a free weekend and I began the conversion from WordPress to Ghost.
Instantly I loved what I was dealing with. No more messy PHP files cluttered with a mix of logic and frontend markup. A clean separation of a theme exists in Ghost. These simple express wrapper files exist so I could customize my theme with just a tiny bit of effort.
This is day one of the conversion. You are now looking at a Ghost blog. Welcome to my new home.
If you find a bug with my new Ghost blog. Feel free to leave a comment.
_Includes the latest 500 public posts. Use `/sitemap.xml` for the complete archive of public content._