Image credit: Michael Zeiler, greatamericaneclipse.com.

My son’s condition was diagnosed in-utero, when we were still living in Virginia. I immediately began thinking ahead, trying to figure out what insurance to buy before we arrived in South Carolina. We checked with the hospital, and asked if ▩▩▩▩▩▩ would be good insurance to carry. They said yes. I immediately bought the best and most expensive plan available.

Fast forward several weeks. We had arrived in South Carolina, and the time had come to make our first prenatal appointment with the hospital. Shortly after making that appointment, we got a call informing us that our insurance would not be accepted. It wouldn’t even be processed at out-of-network rates. I was shocked.

How could this be? Since I am a self-employed software developer, I bought health insurance out-of-pocket, not through an employer sponsored plan. What I did not realize was that, for this particular insurance company, the hospital accepts only employer sponsored insurance plans. Apparently the individual plans that are sold to self-employed individuals are a completely different product.

So, months earlier when we contacted the hospital to ask if ▩▩▩▩▩▩ would be accepted, whoever answered ‘yes’ was apparently unaware of this caveat. Likewise, I was unaware that I should have probed further.

Takeaway

If something catastrophic happens, your local hospital may not be equipped to handle it. You may be forced to go to the nearest major medical center for care.

So if you’re self-employed and are preparing to buy health insurance, ask if the nearest major medical center is covered by the plan. Are they sure? Call back and ask again. Get it in writing. Okay now call the medical center and see if they agree.

Google is right to attack Apple on this front. My mother has a 16G iPhone, no desktop computer, and no broadband at her home. This is our procedure for getting pictures off her iPhone.

1. She brings an iPhone cable to work whenever she can.
2. Her photos & video are uploaded to iCloud Photo Library over her work’s WiFi.
3. I manually download them and put them in her Dropbox.
4. I delete them from her iCloud Photo Library, and they disappear from her phone.

Talk about jumping through hoops.

I collaborated with Dr. Hugh Harvey to build this Chrome extension. It changes words and phrases on news articles about the UK’s NHS budget crisis to highlight the issue of drastic underfunding.

Some backstory from the description,

The NHS is undergoing the largest chronic underfunding period in its 70 year history. The Department of Health (and thus the media) tend to blame this on hospitals and staff, as if it were their fault. In reality there simply isn’t enough money provided by the Treasury to provide the services that are needed, with staff overstretched, waiting lists increasing and patient care suffering in quality.

As a US citizen, I don’t really have any skin in this game. But from my experience doctors, nurses, and other healthcare workers on the “front lines” do their level best, with the resources available, to provide the best care to as many patients as possible.

We got an indoor Nest Cam last year as a baby monitor. It worked great until it completely stopped working.

Anyway, the problem I see with Nest cam Outdoor is that power is delivered via an outdoor electrical socket. It seems like someone could easily disable it by walking along the wall, face turned opposite the camera, and simply unplugging it.

My grandfather built houses 50 years ago that are still standing, still homes to families.

What of my work will remain in 50 years?

— Matt Morris (@boxel) October 24, 2015

A few months ago, I was lamenting the impermanence of our work. As software developers, will anything remain long after we’re gone?

I’m taking a cue from Manton and have setup a complete mirror of this website at mmorris.github.com. I’ve decided to not enable a CNAME record to enable a custom domain for it, because when the domain registration lapses a year after my death, it would stop working. The repository would remain, but it wouldn’t be browsable.

I wrote a quick and dirty script to automate the process. This script is run by a cron job every night, keeping the mirror up to date.

I’d guess that over 90% of the work I’ve done is private, either for employers or contract work for clients, so I can’t archive it all here. But I’m going to try to update and add more of my personal projects. This even includes non-software projects like the cherry bookshelf I built for my wife after we got married, and the picnic table I’m currently building in our backyard.

The greater Memphis area is peppered with houses and other buildings that my grandfather built throughout his life. I can still go and see and touch things that he built. Given the nature of the career I chose, this is the best I can do.

Most snippets (but not all) are also mirrored to my Twitter account. I haven’t got image crossposting working yet, so following the snippets feed is still the best way to follow me.

the breezy @verizon guy then asks me whether I’m ok with being recorded. I tell him I am, because I am also recording the call.

There’s a pause. Then breezy @verizon guy tells me Verizon DOES NOT ALLOW THEIR REPS TO BE RECORDED so he has to hang up.

So I ask breezy @verizon guy “how can that possibly be true? You JUST told me the call was being recorded?!?” And he says…

“Well, yes, but @verizon does not allow its representatives to be recorded by customers.” So @poniewozik and @consumerist over to you

(Source)

Interesting. I’ve never tried informing a customer service rep that I’m recording the call.

In most states, if you want to record your own phone call, it’s not required to inform the other parties.¹ On the other hand, the Verizon rep is within their right to end the call for whatever reason. But I think it’s bad corporate policy, and will get them some bad press.

I record every single call that I have with any business, without exception. If my phone rings and I am not in a position to record, I do not answer. I will call back.

The rules for recording phone calls are very simple. Most states have a 1-party consent law, which means that one end of the phone call has to be informed of the recording. If you’re initiating the recording yourself, then one party is already informed. Federal law is also “1-party”.

Now, eleven states require the consent of all parties. These states are California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. But if you are in a one-party consent state, you should not have to worry about calls with persons these states, because federal law should take president in those situations.²

Read this guide from the Digital Media Law Project for more info.

Footnotes

1,2. Disclaimer: I am not an attorney. Under no circumstance should anything I say be construed as legal advice.

Two years later, it seemed like things were going great. But then we suddenly learned that App.net would be laying off its full-time employees and would receive no new features.

Most people jumped ship at that point, and I haven’t really used it since. But I have nearly two years of posts there. It’d be a shame if the App.net servers go dark one day and I haven’t archived my posts.

So that’s what I did. Since I now host my microblog on this site, I decided to just import them here. All post text, date, and images are preserved. Eg.

Is now a snippet here:

All 1200+ of my app.net posts are now available here as snippets. There are still some broken images from apps like Favd, and hopefully I’ll fix those before App.net breathes its last.

Update: I fixed all the Favd images.

Update: I downloaded my Twitter archive and imported all of my tweets to this site.

Sears Roebuck promised that “a man of average abilities could assemble a Sears kit home in about 90 days.” No detail was overlooked, as both manual and blueprints instructed homeowner as to the correct spacing of the 750 pounds of nails.

I almost wish I could try one of these just to see if I am a “man of average abilities.”

Another possibility: Could app submission volume be decreasing?

I can’t think of any one thing that I do that uses significant data. We just have two iPhones and a few computers doing normal things. (Online backups should considered a normal thing that everyone does.)

It’s clear that 1TB has to be the new minimum cap.

/~mjm9

• 1998 – 2000
  This page is wonderfully bad. All it’s missing is an “under construction” animated gif. And WTF was I thinking when I collected these “ very useful or interesting links.” Ponderous.
• August 2001
  I think I built this page by hand with html and css. If you click around you’ll see I was into fencing at this time.
• December 2001
  A friend helped me build this version using Dreamweaver. Each cell of the navigation menu was an image, but they don’t all show up here. I probably have a copy of the original code on a Zip Drive somewhere.
• May 2004
  This is the only remaining evidence that I wrote my own blogging engine in PHP. The project lived at a different URL which was not scraped by archive.org.
• August 2004
  Looks like I tried Blogger for the first time. Wow, I’d totally forgotten that I’d written about my trips to Italy and Mexico.

matthew-morris.com

• November 2006
  This one was built with iWeb and lived on shared hosting somewhere.

mattmorr.is and matt.ph

• 2012 Onward
  I used Octopress, etc., on these domains. I’ve done scripted migrations from one platform to the other, but it looks like some of my old posts are missing.

1. Ability to post from various iOS apps. (Check out Blogo)
2. Wider selection of themes
3. Support for link posts
4. Greater customizability

Oh and the migration took about 5 years and went WordPress → Octopress → Jekyll → Tumblr → Ghost → WordPress. Time is a flat circle.

(Warning: These links may auto-play.)

#390: We Set Up An Offshore Company In A Tax Haven

#403: What Can We Do With Our Shell Companies?

At this stage, I don’t want any appliance in my home that isn’t fully functional without an internet connection.

My kindle was packed for moving for a few months, during which time it missed a critical software update. As a result, it can no longer connect to Amazon to download new books or software updates.

Late last year, I was beginning to feel overwhelmed. We’d just moved to a new city, started new jobs, bought a new house, had a new baby. Then the baby needed open-heart surgery and we spent a month in the hospital. Oh, and we had to deal with a health insurance company that has fought us every step of the way. I won’t say which one of those last two was more stressfull.

During this time, I began to understand how much time and attention I gave to Twitter. Even if I just wanted to keep up with all the Apple developer news, it was exhausting. Not to mention all the simultaneous conversations, the “um actuallys”, the shouting and unkindness. Even though I was simply a bystander in 99% of it, it began to feel like a heavy weight around my shoulders. And I needed this energy to focus on my family’s situation.

So, I haven’t posted to Twitter since late last year. I stopped reading my timeline. Then I took Tweetbot off my phone. It feels like there were a thousand voices in my head, and now they’ve vanished. It feels… peaceful. I have regained a little focus and a little sanity.

I’m going to dust of my RSS reader and consume news that way. I still want to post microblog-style updates, but I think I’ll just do them on this website. It’s likely that no one will read them, and that’s okay.

If you @-mention me on Twitter, I’ll see it eventually and will reply. Take care and be well.

Workers with facial hair were less likely to be colonized with Staph- ylococcus aureus (41.2% vs 52.6%, P 1⁄4 0.02) and meticillin-resistant coagulase-negative staphylococci (2.0% vs 7.0%, P 1⁄4 0.01).

And,

Overall, colonization is similar in male healthcare workers with and without facial hair; however, certain bacterial species were more prevalent in workers without facial hair.

I’m starting to see spam arrive at the unique email address I used at Patreon. Their customer information was compromised last year when they put a debug version of their website on the open Internet.

I attended a middle school that housed all of 7th and 8th grade within a single open classroom. It was a large, cavernous room that held almost two dozen classes only separated by a 4ft high wall. Hundreds of students were within earshot of each other. In the picture above, take a look at the ceiling lights and you can get a sense of how far back it goes.

As far as I can tell, these open classrooms1 started taking off in the 70s and were dying off by the early 90s. I wonder what choices led to this design. Was it based on some educational theory or was it just cost effective? Either way, why did it go out of fashion? Were there lessons learned that can be applied to today’s debate about open office plans?

Thanks to Dr. Hugh Harvey for his generous assistance in getting this printed. Read more about it on his blog.

When your child undergoes a serious surgery or is seriously ill, stress comes at you from all directions. Will she be able to lead a normal live? Will anything go wrong during the surgery? Will my insurance company pay for all of this?

But what if the only hospital that can help you is several hours away? Imagine having to unexpectedly feed and house a family of five for such a long period of time. Hotel and restaurant expenses add up quickly. Sometimes families are faced with a choice: endure financial hardship, or split up the family for months at a time.

The Ronald McDonald House is a charity whose mission is to provide some relief in this situation. If your child is hospitalized away from your home town, they will provide you with a room, two comfortable beds, and two or more meals each day. This is a tremendous relief for families dealing with a whirlwind of stress, worry, and pain.

We were fortunate that there is a Ronald McDonald House in Charleston, where we have now stayed for a total of two months. It’s a warm and welcoming place, a home-away from home where we can take a break from the hospital bedside, take a break from the stress, and find a little peace.

If you have any end-of-year giving left to do, please consider donating to the Ronald McDonald House. I’m not sure that we could have survived the past few months without them.

The doctors say that we’ll have to be very careful during the winter flu season. Most kids can weather RSV or a common virus with no problem. But we’re told that Sebastian has limited “pulmonary reserve” and any winter illness might send him back to the hospital. So, they’ve advised us to take him out in public as little as possible, and he absolutely cannot attend daycare.

In light of all this, I’ve decided to take a year off from consulting to keep my son at home. After his next open-heart surgery, we should be able to treat him like a normal kid, but for now we have to be a little careful.

I know I’m a little late to the party with respect to the GIF movement, but I thought I’d share the workflow that I cooked up this afternoon.

On iOS, I grabbed GIFwrapped and started building a small GIF collection. GIFWrapped lets you search for GIFs and then lets you save them to your Dropbox under /Apps/GIFWrapped. Nifty.

On OS X, I wanted to be able to use that same collection Dropbox and share links in Slack and on Twitter. To get the raw file URLs from Dropbox, you have to put them in Dropbox/Public. So, I moved the GIF files into in Dropbox/Public/Gifs and created a symlink to it inside Dropbox/Apps/GIFwrapped. (Luckily GIFwrapped recursively searches its folder for GIF files)

Next, I needed a way to quickly search for a gif and grab the Dropbox URL. I made this quick Automator workflow that does the following.

1. Prompts for a search string.
2. Does a Spotlight search inside the Gifs folder.
3. Displays a list of GIFs matching the search.
4. Copies the Dropbox URL to the pasteboard after you’ve chosen.
5. Displays a notification so that you know the URL is ready.

I bound the workflow to a keyboard shortcut and now I can deploy GIFs at a moment’s notice. If you’d like to give it a try, grab the automator workflow and give it a try. You’ll just need to modify the dropbox_url in the AppleScript and make sure that the various paths are correct for your system.

All in all, I haven’t missed the cell plan too much. I am covered by WiFi 95% of the time, and rarely miss cellular. I’m covered at home, and almost everywhere I go on a weekly basis. This includes my local grocery store, Sam’s Club, the public library, our church, and my kids’ favorite playground. I have Comcast business internet connection, so when there’s no free public WiFi to be found, I can use my credentials to hop on one of the various “xfinity” WiFi nodes around town.

I use FaceTime Audio whenever possible for calling friends and family. If I need to make or receive a “real” phone call, I use my Google Voice number with the Hangouts app. Incoming calls appear as a push notification which I swipe to jump straight into the call. And these days, asynchronous messages such as texts and email have cut way back on the amount of calls I make.

Though, there a few many downsides to this system that I must mention. I can’t ask Siri to make a call using Hangouts.app. If I’m listening to a podcast and my phone is in my pocket, I can’t answer Hangout calls using the earbud’s “clicker.” I can’t make calls directly from Contacts.app. If I have Do Not Disturb enabled, my VIP contacts can’t reach me by calling my Google Voice number. For me, this means that when my wife is working a night shift, I can’t use DND and expect to receive a call from her.

Also, the incoming call notifications in Hangouts.app don’t show the caller’s name even if I have her in my contacts. This means that I have had to begin remembering everyone’s phone number if I want to screen calls. Party like it’s 1995.

Here are a few items I’d like to see in iOS to make things a little easier to live without a cell plan:

1. Siri API for 3rd party apps. Specifically, I want to be able to say something like, “Call my wife using Google Hangouts.”
2. VIP and Do Not Disturb integration. If my wife, a VIP, calls me in a VoIP app, I would like to receive the notificaiton even if I have Do Not Disturb enabled.
3. The ability to jump from Contacts.app to any other VoIP app.

   Update: When my wife became pregnant, she convinced me to get a SIM so that I would be reachable at all times. I bought a Ting SIM, and simply keep cellular data turned off iPhone-wide. Shameless referral link. This costs only $6/month, and gives me the option of receiving an emergency call from my wife at any time.

   TL;DR: I use WiFi, even for phone calls, and carry a Ting SIM for emergency situations.

   ]]> https://mattmorris.org/2015/08/08/soco-and-the-bull-street-redevelopment/ Sat, 08 Aug 2015 15:46:01 +0000 http://104.236.129.96/?p=73 Continue reading "SOCO and the Bull Street Redevelopment"]]> Every weekday, I work at SOCO, a fantastic coworking space. It’s a great space for working, with high ceilings, wooden floors, and great natural light. And it has a great “vibe” because it’s always full of great people working hard at what they do.

   SOCO will soon be expanding to other locations, one of which is a soon-to-be restored historic building in the heart of the former S.C. State Hospital campus. Yesterday, we got a little tour of our new offices. There’s quite a bit of work to be done, but I can’t wait to see what they do with these old buildings.

   Here’s the full album. I wish I had brought a “real” camera.

   

   ]]> https://mattmorris.org/2015/08/05/gestation-complication/ Wed, 05 Aug 2015 15:52:38 +0000 http://104.236.129.96/?p=77 Continue reading "Gestation Complication"]]>

   I wrote a simple complication for the Apple Watch that tracks gestational age, remaining time to full term, and due date. I keep a close eye on these metrics since we have yet to have a baby reach term.

   The source code is available here. It uses Objective-C because, as of this writing, complications written in Swift work only in the simulator.

   ]]> https://mattmorris.org/2015/07/24/update-on-the-baby/ Fri, 24 Jul 2015 16:07:48 +0000 http://104.236.129.96/?p=81 Continue reading "Update on the Baby"]]> Shortly before moving to South Carolina last month, our unborn son was diagnosed with Tetralogy of Fallot with Pulmonary Atresia. In order to survive, he will require two open-heart surgeries shortly after birth, a number of weeks in the ICU, and then additional procedures throughout his life. Additionally, he is at risk for a chromosomal abnormality known as DiGeorge syndrome.

   The situation is complicated by the fact that my wife experiences preterm labor with every pregnancy, including this one. If a baby is born early enough, she will need intensive care in a neonatal ICU in order to thrive.

   Our son’s due date is September 17th, but last month my wife started having strong, regular contractions every 3 minutes. She was admitted to the local hospital and then quickly sent by ambulance to The Medical University of South Carolina, two hours away. We spent the weekend in the hospital, and thankfully they were able to stop the contractions.

   We’re over the initial shock now and feel very hopeful about his outlook. And see that wavy spot on his head? That’s hair.

   

   ]]> https://mattmorris.org/2015/03/05/im-going-to-be-a-dad-again/ Thu, 05 Mar 2015 17:56:26 +0000 http://104.236.129.96/?p=88

   I’m thrilled to announce that my wife and I are expecting our third child. We’re due later this fall.

   ]]> https://mattmorris.org/2015/02/01/hipstamail-privacy-policy/ Sun, 01 Feb 2015 17:54:10 +0000 http://104.236.129.96/?p=86 Yesterday I wrote a short privacy policy for HipstaMail. I would welcome any comments or suggestions that you may have. There’s a comment form at the bottom of the page.
   ]]> https://mattmorris.org/2014/11/05/my-next-project-is-an-ios-mail-client/ Wed, 05 Nov 2014 17:56:50 +0000 http://104.236.129.96/?p=91 Continue reading "My Next Project Is an iOS Mail Client"]]> I’ve been working on a mail client for iOS. Though, it’s not the kind you’re thinking of. My next app, Hipstamail, lets you write a letter and send it through the US Mail. You type the letter in a vintage typewriter font, enter payment information, tap send, and I’ll mail your letter for you.

   Why on earth did I build this? Well, I have a family member that is in a particular situation. Due to her job, my sister cannot receive or send email, text messages, or phone calls. She can only receive physical letters in the mail, and can only send me a letter every month or so. Can you guess what her “job” is? 1

   Anyway, I’ve been pretty horrible at remembering to write her on a regular basis. Apparently keeping envelopes and stamps in the house is too much for me to handle. So, how great would it be to to have the ability to jot off a quick message and send it to her from my iPhone?

   Anyway, that’s what I have built. I have no reason to believe it will be a huge success, but who knows, maybe there’s someone else out there that might find it useful. Initially, my goal is just for the project to be cashflow positive. 2

   Whenever I start a new side project, I take the opportunity to force myself to learn something new. This time, I built the backend from scratch and wrote the server application in Go and PostgreSQL. Credit cards are processed by Stripe, and letters are sent by Lob. It’s also my first time making serious use of Auto Layout.

   I plan to start betas by the end of November, and release the app by the end of 2014. If you’re interesting in trying out the beta3, say hello.

   ]]> https://mattmorris.org/2014/10/27/the-story-of-how-i-broke-my-leg/ Mon, 27 Oct 2014 17:59:20 +0000 http://104.236.129.96/?p=93 Continue reading "The Story of How I Broke My Leg"]]> In high school, I ran middle distance for the school track team. I competed in the 800m dash and the 4x800m relay. As I remember it, my training routine consisted of 1hr road runs three days a week, and interval training on the track two or three days a week.

   One weekend, I got it into my head that it would be really cool to run around town. By that I mean, literally all the way around town. Early one Sunday I set out from my house and headed east toward the highway. I went up, then hooked west back toward the high school. I stopped by my friends house and chatted a while, had a drink of water, then set out to continue my run.

   I continued around town, avoiding the busy streets, and passing through all the interesting neighborhoods and byroads. By the time I returned home, I was totally exhausted. I was dizzy and weak. I drank gatorade and lay flat on the floor for a long while.

   The next morning, I had a bad ache in my left shin. I recognized this to be a stress fracture, which I had been diagnosed with, and recovered from, in the past.

   Fast forward to the following Tuesday. Our team was competing in a large regional track meet with a dozen or so other schools. I was the anchor in the 4x800m relay. My leg still ached badly, so I tightly wrapped it in a bandage, and tried to shake off the pain with some warm-up sprints and edgy 90s alternative rock.

   The race begins. Our first three runners were very good, and when the baton came to me we were in 1st or 2nd place (as best I can recall). I set out around the first lap, and easily maintained our position. Right as I began the 2nd lap, something started to feel strange. I had an odd sensation in my left leg, and heard a strange grinding noise. It sounded like my track spikes had started to break off or come loose. I assumed this was the case, and I kicked extra hard around the first turn.

   Just as I left the first turn, it happened. My tibia snapped right out from under me, and I fell flat on my face. In that moment, I had such a level of adrenaline and endorphins, that I didn’t feel anything at all. I tried to stand up, but my broken leg just buckled beneath me and I fell once again.

   Still confused, I began to try to stand again. Before I could, a teammate had made it to me and explained what had happened. I sat in shock as all the other runners passed me.

   As I limped to my car, a parent who was sitting in the audience called out to get my attention. He said that he could hear the bone break from where he was sitting in the bleachers. Still riding the endorphin high, I drove myself to the ER and had my leg set in a cast.

   ]]> https://mattmorris.org/2014/09/27/scraping-passwords-from-in-app-browsers/ Sat, 27 Sep 2014 18:01:18 +0000 http://104.236.129.96/?p=95 Continue reading "Scraping Passwords from In-App Browsers"]]> Last night I saw Craig Hockenberry‘s excellent post that explains a method that an iOS app can use to capture anything you type into an in-app browser.

   Almost three years ago, I reported another way to eavesdrop on users’ keystrokes in an embedded browser (radar 10447976). It’s a much more rudimentary attack than Craig’s, but nevertheless it’s a means for this information to be harvested.

   Here is a dead simple sample project that illustrates the attack. There are two factors that come into play.

   1. In a password field, each character is shown to the user for a brief moment.
   2. Apps are allowed to do a screen-grab of their own window.

   Here is a screenshot of the sample app. The twitter login page is loaded into a WebView.

   

   As you can see, the most recent character in my password is displayed as I type. Now, combine this with a fast firing timer that continually takes screengrabs of the web view, and voilà, you have the whole password. I was able to easily capture my entire Twitter password.

   Now, you still have to piece the keystrokes together out of the screenshots, so it’s not the most elegant attack, but in the end you still have the information.

   When I reported this to Apple in 2011, they replied and said that they didn’t see how this is a security issue. I guess I can understand, since it’s pretty roundabout. Still, it would be nice if web views were bulletproof and completely trustworthy.

   I agree with Craig that web views are great for quick and dirty views of webpages that aren’t asking for sensitive information. Be wary of entering sensitive passwords into any app, even if it’s showing you a webpage that isn’t technically phishing.

   ]]> https://mattmorris.org/2014/09/14/iphone-remote-control/ Sun, 14 Sep 2014 18:03:27 +0000 http://104.236.129.96/?p=99 This video shows some work I did back in the iOS 6 era. It demonstrates full remote control of an unjailbroken iPhone. I used undocumented private APIs and other trickery to achieve this. Note that it even allows control of the physical buttons.

   No, this was never shipped to the App Store.

   ]]> https://mattmorris.org/2014/09/11/password-less-user-authentication/ Thu, 11 Sep 2014 12:33:00 +0000 http://matt.ph/?p=251 Continue reading "Password-Less User Authentication"]]> I’m what you might call a client-side iOS programmer, but for my latest project I’ve decided to roll my own backend. I’ve been thinking about the authentication flow will be needed. I don’t want users to remember usernames/passwords, and I don’t really want to have to keep track of them.

   Currently, for development, the backend just checks for a single unique token that the client must send with all requests. (Assume that I’m using SSL Pinning to ensure that I’m not connecting to a man in the middle.) This is okay when the app is just on my phone, but I can’t very well ship the app with the token embedded. Even if it’s obfuscated, there’s no guaranteed way to prevent someone from unearthing the token and making rogue API requests. And by rogue API request, I mean any API request that’s not a result of normal use of the app.

   It really wouldn’t be the end of the world if this happened. The only consequences I can think of is my database filling up with junk, or maybe someone could try to brute force their way into getting some semi-sensitive data out of the API.

   So anyway, I’d like to have some per-user, or per-device, token that I can use to authenticate API requests. I’m thinking of trying the following password-less approach:

   • User is prompted to enter an email to sign up for an account. At this time, a unique token is generated and sent to the API along with the email address. Token is stored in the keychain on the device.
   • User is prompted to check his email to continue. Offer a button to open Mail.app, GMail.app, or another mail app that’s been detected.
   • Meanwhile, at the backend, an email is generated with a unique URL and sent to the user. Tapping this link will whitelist the token generated in (1), and kick the user back into the app.
   • From now on, whenever the app becomes active, it queries the API to test if the token is whitelisted. If a good token is not found in the keychain, then the app can go through the flow again to generate one. And this would give me a mechanism for blocking a token or email address that is acting suspiciously.

   So this would let the app authenticate with the API without the need for a password. The downside is that the user will have to go through this flow on every new device. Perhaps I could store the token in iCloud to avoid that problem.

   Questions:

   • Is this a horrible idea? Could I somehow achieve this with OAuth?
   • Does it matter if the token is generated client-side or server-side?
   https://mattmorris.org/2014/08/27/worth-it/ Wed, 27 Aug 2014 12:35:44 +0000 http://matt.ph/?p=253 Continue reading "Worth It"]]> It’s 8pm. The kids are asleep, and I just sat down at my desk to begin my day’s “work.” But I am so physically and mentally exhausted that instead I’m going to write this post and then go to sleep.

   Where did my energy go? Well, today I cooked three meals for four people, taught “preschool” for two hours, took the kids for their annual doctor’s checkup, washed and put away two loads of laundry, played kickball in the street with the neighborhood kids, cleaned the kitchen three times, read stories for half the afternoon, bath time, bed time, Lego time, nap time, dinner time…

   Being a stay-at-home parent is hard work. I have to actually listen to my kids and stay engaged. I have to put away my phone and interact with them. If I can’t keep up, challenging and stimulating them with new activities and experiences, then they get bored and ask to watch TV.

   Today I calmly and quickly diffused a tantrum that, only two months ago, would have probably thrown me for a loop. I might even have gotten mad and raised my voice. Instead, I now have the mental and emotional energy to do better.

   Oh, and it’s been several days since the kids have even asked to watch TV.

   So what’s my response when asked about my decision to quit my job and become a full-time dad?

   “Worth It.”

   ]]> https://mattmorris.org/2014/08/25/ancient-photo-from-my-first-job/ Mon, 25 Aug 2014 12:44:44 +0000 http://matt.ph/?p=255 Last night I was prepping my Aperture library for the upcoming move to Yosemite. I ran across this photo from my first Job.

   

   I was in Amsterdam at Vrije Universiteit, helping install this PET/SPECT camera. I wrote the gantry control software and the UI pictured on that screen.

   ]]> https://mattmorris.org/2014/08/23/a-new-chapter/ Sat, 23 Aug 2014 18:04:22 +0000 http://104.236.129.96/?p=102 Continue reading "A New Chapter"]]> A few weeks ago I announced that I have departed Bomgar to work on my own projects and to spend more time with my family.

   It was my privilege to work with the great team at Bomgar for almost 7 years. The job was challenging and rewarding, and I’m very proud of what we accomplished. Leaving is very bittersweet.

   However, I’m excited about the future. I have a new product in the works that will launch on iPhone, iPad, and OS X, and I’m already writing a work estimate for what could be my first contract as a freelancer.

   Most importantly, I believe that providing my children with a full-time parent will yield benefits in every corner of our lives for years to come. I expect to look back on this period of our lives and say with certitude that it was all worth it.

   ]]> https://mattmorris.org/2014/08/18/cass-scenic-railroad/ Mon, 18 Aug 2014 12:45:47 +0000 http://matt.ph/?p=258 Continue reading "Cass Scenic Railroad"]]> Last weekend I took my family to Cass Railroad to ride some steam engines.

   

   Cass is a small town in the mountains of West Virginia. Formerly a company logging town, Cass offers a chance for a relaxing weekend getaway. And free from the burdens of broadband and cellular reception, you can be sure that your enjoyment of the trains will never be interrupted by blips and boops from your smartphone.

   If you have a young child that loves trains, I highly recommend it.

   

   ]]> https://mattmorris.org/2014/08/01/building-a-web-backend-from-scratch/ Fri, 01 Aug 2014 13:33:56 +0000 http://matt.ph/?p=263 Continue reading "Building a Web Backend from Scratch"]]> I built the backend for my last project on Heroku using Sinatra. It was great; I got to learn about Ruby and a new web framework and it was a very stable and fast API.

   I’ve been thinking about what to use for my next project when I saw Marco’s Web Hosting for App Developers and the ensuing discussions among developers on Twitter. After giving it some thought I came to the conclusion that I could probably learn alot by self-hosting the backend myself. Maybe I can even build something as stable and reliable as what I built on Heroku?

   Rebuild, Rebuild, Rebuild

   I made the decision up-front to script the entire process of building the server. This way, in the event of a network outage at Linode or in the unlikely event that my app comes under heavy load, I can add new servers in a matter of minutes.

   My current scripts do the following:

   • Setup SSH keys and disable SSH password authentication
   • Setup firewall, leaving only ports for my application open.
   • Install git, postgres, golang, and other software used by my application.
   • Configure postgres and golang
   • Checkout the application code from my repository
   • Configure it so that it automatically starts when the system reboots.

   Did I miss anything?

   Another thing that I do to make sure that my scripts are always in working order is to rebuild the server every time I make a substantial change to the script. Also, I completely rebuild the server every evening I sit down to work on it. This leaves me feeling pretty confident that I can quickly recover from a serious outage.

   Now, you might have noticed that I mentioned golang above. I’d originally planned to use Flask, but as I already have some experience with Python, I chose Golang so that I can learn something new. The dowside of this will be that Go isn’t as widely used, and I will be navigating uncharted water without the usual wealth of online sample code and SO Q&A. Still, my early impressions of Martini + Golang are very positive. I’m hopeful that I can get everything working withough too much headache.

   Next:

   I need to setup automatic database backups. I’ll probably use a cron job that automatically sends raw backups to Amazon S3. Also, I’d like to support HTTPS for all API calls. Since I’m just building a web API for my own app, I can just be my own Certificate Authority and issue my own SSL certificates and keys. Any problem with that?

   Have any comments or suggestions? Let me know.

   ]]> https://mattmorris.org/2014/02/02/charting-dividend-reinvestment/ Sun, 02 Feb 2014 18:06:29 +0000 http://104.236.129.96/?p=104 Continue reading "Charting Dividend Reinvestment"]]> I recently wanted to see a graph of a particular stock assuming dividend reinvestment. This seems like it would be a common thing to do, but neither Google nor Yahoo’s finance sites appear to have the capability. After a bit of searching, I found a way to do it.

   

   So here, I’ve plotted $AAPL over the past two years with and without dividend reinvestment. Note that $AAPL first paid a divident in Augustof 2012, so it’s logical that the graph begins to diverge shortly after that. Currently the difference in return is about 4.3% over the two years.1

   You can fiddle with this graph yourself. Or, starting from scratch, do the following:

   1. Create a chart for AAPL
   2. Set the range (above I used 2 years)
   3. Set “Type” to Thin Line (optional)
   4. In both the Overlays and Indicators sections, click “Clear All”
   5. Under Indicators, create a Price/Performance indicator with parameter _AAPL and set “Position” to “Behind Price”.
   6. Click “Update”Interestingly, stockcharts.com appears to assume dividend reinvestment by default, while Google Finance and Yahoo Finance do not.
   ]]> https://mattmorris.org/2013/07/21/working-from-home/ Sun, 21 Jul 2013 13:37:19 +0000 http://matt.ph/?p=266 Continue reading "Working From Home"]]> For the past five years, I have worked in a traditional office. A few weeks ago, I moved a thousand miles across the country and became a telecommuter. Several months before the move, I started gathering material to try to help me prepare for the new work situation. Here are a few I found useful.
   • Home Work is an excellent podcast examines the ins and outs of telecommuting and freelancing. I’m not a freelancer, so I cherry picked the episodes that seemed most relevant to me. If you’re currently an office worker but think you might like to try working from home, check out Episode 27 – Telecommuting Basics and Episode 55 – Telecommuting.
   • The Beginner’s Guide to Working from Home is a recent article that has several good tips for a new home worker.
   • Working From Home covers many of the pitfalls and challenges associated with working from home, and offers several tips on how to make it work.

   Here’s my core advice to anyone about to start telecommuting for the first time. Give some proactive thought and planning to your home office setup, your work/life schedule and boundaries, and your effectiveness as a communicator. Also, try to be aware of what distractions are most problematic for you and take steps to minimize them.

   ]]> https://mattmorris.org/2012/07/29/interception/ Sun, 29 Jul 2012 17:00:10 +0000 http://matt.ph/?p=206 Continue reading "Interception"]]> Late last week, I finally got around to setting up Twitter as an account on Mountain Lion. I was disappointed to see that clicking a Twitter notification launches the default web browser and not Twitter.app or any other client. I do not enjoy using Twitter’s web interface, so I wrote a simple application that forwards these clicks to a native Twitter application of your choice.

   Quick Start

   If this sounds like something that you would find useful, download the beta and give it a try. The application is a single dialog that asks for your preferred Twitter client. Click ‘Okay’ and you’re all set. There should be no need to run the app again unless you want to switch to a different client.

   

   Disclaimer

   This software should be considered very “beta.” If things get weird and you find you can’t open http URLs anymore or something like that, just delete the .app and http://www.twitter.com/boxel.

   How It Works

   Interception registers itself as the default handler the URLs that are invoked when you click on a Twitter notification. If it notices a Twitter URL is being loaded by Launch Services, it catches the request and forwards it to the native twitter client you have chosen. All other URLs are silently passed as-is to the default web browser. A previous version of Interception set itself as the default http URL handler for the system, but this is no longer necessary.

   Known Issues and Next Steps

   Interception currently supports only the following Twitter clients:

   – Tweetbot for Mac
   – Twitter.app
   – Tweet Deck
   – Hibari

   Currently Interception is just hard-coded with the bundle identifiers for each of these apps. In a future version, I might add a “Choose App” button which would let the user. If your favorite native Twitter client is not one of these four, please let me know.

   Also, Twitter mentions and direct messages should land the user on different views inside the targeted Twitter app. I began to wire this up, but it seems that the Tweetbot for Mac public alpha is not yet honoring the Tweetbot URL Scheme, so I put that functionality on hold for all clients. Tweetbot is awesome, and this will be the next feature I add.

   I have created a project over on Github where I will host the code. I have not posted it yet for two reasons. First, I did this in a bit of a hurry and I would like to clean up the code before I throw it out into the wild. Second, if our local Cocoaheads chapter gets going in the next month or two, I might like to present the project at a meeting and then release the source code and slides all at the same time.

   Wrap-Up

   Download It Here. Feedback is welcome.

   I realize that if you’re favorite Twitter client is in the Mac App Store, it can use push notifications in Mountain Lion, in which case Interception won’t really be that useful. I’ve really been enoying Tweetbot for Mac, but it’s currently in alpha and doesn’t yet support remote push notifications. This application grew out of a script I wrote because I wanted to be able to launch Tweetbot from a notification even if Tweetbot wasn’t already running.

   Incidentally, I’ve lost track of how many times I typed “Inception” while writing this post.

   ]]> https://mattmorris.org/2012/07/14/my-experience-with-lasik/ Sat, 14 Jul 2012 18:09:01 +0000 http://104.236.129.96/?p=107 Continue reading "My Experience with LASIK"]]> Two months ago, in preparation for LASIK eye surgery, I searched the internet for accounts of people’s experiences with the procedure. I found a wide variety of results, most of which were positive. Since I didn’t find anything from the point of view of a professional programmer, I will leave my account here.

   The Facts

   Pre-surgery, I was highly myopic with a prescription of -8.75 in both eyes.
   Pre-surgery, my vision was correctable to 20/15 (better than 20/20)
   Date of surgery: May 30th, 2012 @ 7:30am
   Post-surgery prescription, measured the day after surgery:
   I’m told that –.25 is effectively 20/20.

   My Daily Routine

   I believe that how you use your eyes every day is an important factor to consider when thinking about LASIK. For someone in a career that requires almost constant use of a computer, having clear and reliable vision is very important. To give a clearer picture of my results and whether or not you can draw any conclusions from my impressions, here is a rough outline of my typical day.

   • Awake at 5:45
   • Leave house by 6:45
   • 40+ minute commute
   • At work: 8+ hours of programming
   • Workout during lunch
   • 40+ minute commute
   • Dinner + family time.
   • Once kids are asleep: 4+ hours of programming on personal projects.

   (Note: This is the fullest possible schedule. I can’t pull this off every day.)

   During the pre-surgery interviews with the surgeon, I explained that I am a professional programmer and asked if I could be expected to return to work the next day. Answer: yes.

   The Surgery

   The surgery itself was not a big deal. It was a little uncomfortable at one point when a suction device is attached to the eye, but that didn’t last long. When I first got up from the opterating table, everything appeared as if I were underwater. This was, in fact, because there is actually fluid in the eye that drains away over the next 24-48 hours.

   Recovery, Day 0

   After the surgery, I was driven home by a family member. There was no pain, but my vision was cloudy and I would have been unable to drive. My two boys were at home with a babysitter. Once home, I attempted to close my eyes and rest, at the recommendation of the surgeon.

   Later that day there was more discomfort, but my vision was already beginning to clear. I cooked the boys dinner and got them ready for bed with no problem.

   Once they were asleep in bed, I sat down at the computer to check my email and maybe try to work on some of my apps. I was barely able to read email.Needless to say, I was a little concerned, since I was scheduled to return to work the next day. But I decided not to worry about it for the time being, hoping that 8 hours of sleep would give my eyes time to rest and recover.

   Recovery, Day 1: Halos

   The next day I realized that I was seeing the dreaded “halo” effect that I had read about online. Around every light source, I saw a very noticeable ring of light. It turns out that this didn’t really bother me when I was doing most “normal” activities. Computer screens, however, turned out to be a problem. They emit light, and when reading text on screen, each character produced its own halo, and every halo overlapped with the ones adjacent to it. This created an unbearable blurring effect that made it very difficult to read on-screen text.

   In fact, I went in for a 24 hour followup that day. My prescription was measured using a autorefractor, and my vision was determined to be very close to 20/20. However, I was almost completely unable to read the letters on the eye chart. The eye chart appeared to be an LCD backlit display, and this was producing haloing effects around the letters.

   I did manage to get to work that day. However, it was frustrating because I had to place the screens mere inches from my face and increase the font in Xcode to rediculous sizes. It was so large that I suspected people could read my code from the hallway by my office.

   Recovery, Week 1

   The halo effect persisted well into the first week. It was still difficult to read a computer screen, but I found that if I used the lubricant eye drops recommended by the doctor, it helped a great deal. Yes, the drops temporarily cleared my vision. I found that if I used the drops every 45 minutes or so, I could code the whole day without getting too frustrated.

   One Month Later

   At times I still have to use the lubricant eye drops in order to use a computer, but my vision has gradually improved to the point that I sometimes go several hours without having to do so.

   I’ve been asked several times how satisfied I am with the procedure. I think that if I had any type of job that doesn’t require reading code on a screen for 10+ hours a day, I would be 99% satisfied. As this is not the case, I would probably say that I am 85% satisfied.

   To this date, I still feel that my vision continues to improve. If you’ve recently had LASIK and are concerned because your vision is still blurry, your eyes may still be healing. Try not to worry.

   Tips

   Close your eyes and rest as much as possible on the first day. I think I tried to do too much that first day and I wonder if it slowed my recovery.
   If you experience halos and have trouble reading a computer screen, try the lubricant eye drops.
   Use them frequently, even if the dryness doesn’t bother you.
   Try to schedule a short vacation from work beginning the day of your surgery. If this is not possible, try to schedule the surgery right before a 3-day weekend. Reading a computer screen as part of a demanding job was stressful during these first days, but driving, cooking, playing with the kids, etc. was not a problem at all. Drive to the coast and get some rest.

   Fun Fact

   Radial Keratotomy, a predecessor to the LASIK procedure, was discovered by accident after a young boy fell off his bycicle and broke his glasses. Some time after the doctor had removed the shards of glass from his eye, his visual acuity had improved. [source]

   ]]> https://mattmorris.org/2012/07/03/cocoaheads-jackson-ms/ Tue, 03 Jul 2012 16:52:08 +0000 http://matt.ph/?p=203 Some other local Mac/iOS developers and I are currently trying to gague interest in a local Cocoaheads chapter. Meetings will most likely be in the Ridgeland/Madison area. If you would be interested, please reach out via Twitter or one of my other contact methods.
   ]]> https://mattmorris.org/2004/08/27/gmail/ Fri, 27 Aug 2004 20:18:21 +0000 http://matt.ph/?p=1876 If anyone wants a Gmail invitation, just let me know.
   ]]> https://mattmorris.org/2004/08/18/mexico-and-back/ Wed, 18 Aug 2004 16:35:02 +0000 http://matt.ph/?p=201 Continue reading "Mexico and Back"]]> Well, Lesley and I are back from Mexco City, and we had a great time. Mexico is a very colorful country with an interesting history. We stayed in Hostal Moneda which is just two blocks from the cathedral in El Centro Histórico. This month, there happened to be a market set up in the area around the cathedral, and the street to our hostal was closed. On my first day there, I saw six guys punching and kicking a guy as he lay in the street. Well, that sort of put me on edge for a while, so to relax I went to a family run restaurant nearby and had some chicken with Mole sauce: a traditional dish.

   Lesley arrived the next day and I picked her up from the airport. We went back to the hotstal and looked around the area a bit more. That night we went to a really shnazzy authentic restaurant just a few blocks north of the Cathedral.

   The next day was her friend’s consecration. We took a cab to La Universidad de Anáhuac and, after convincing the guards to let us in, walked up to the church. The chapel overlooks a large cliff with a valley at the bottom. There were many trees and you could see for miles; a breathtaking view.

   Slowly people started to file in. Lesley and I conversed with a legionarian for about 30 min. His name was Hernán, I think. He went to the seminary at age 11. We shared some personal stories about our lives and talked about Mexico and the cerimony that was about to take place. Once inside I noticed the crucifix. It was very realistic, and was a bit distracting at first. I counted 45 priests as they entered, and there were even more seminarians and consecrated. The mass was beautiful, especially the homily, most of which I understood thanks to the celebrant’s calm, clear diction.

   First, those who had already taken their promises/vows made a renewal. Then, Lesley’s friend Evan and the other young men went up to the altar one by one to make a promise of obedience, poverty, and chastity. It was a very powerful moment.

   We spent the rest of the day with Evan and his family. Ron, our consecrated tour-guide, took us to a nice place for some eats, and we chatted away the afternoon. (I had Chiles en Nogada, a wonderful Mexican delicacy!)

   The rest of the trip we spent with Evan and his family, seeing the sights of Mexico City. Monday we went to the Bascilica at Our Lady of Guadalupe. The following day we went to the old presidential palace and the museum in the downtown area. There is some beautiful art and many fascinating pieces of Mexican history to be seen there.

   Well, it’s good to be back home I guess. I’m sure there will be more adventures to come.

   ]]>