Open source is not consent for experiments — You can do whatever you want with the code you download. But once you’re writing instead of reading, you need to be a good participant.
Kusari
You Can’t Fix Issues if You Can’t Find Them — Organizations often struggle to identify vulnerabilities and risks hidden within the layers of dependencies. Address it by using a holistic approach to software security.
Finding software licenses with GUAC — Need to find the software in your dependency graph where the declared license doesn’t match the detected license? GUAC can do that!
Sometime in August, I saw a post on Facebook about a fundraiser for the American Heart Association. The goal was to bike for 100 miles in the month of September and get donations. “What the heck? Why not?” I said to myself in a fit of committing myself to things I don’t have the capacity for. It’s on brand, you have to give me that much.
Keep in mind, I haven’t biked 100 miles in the last decade. There was a time when I commuted to work on my bike a couple of times a week. I was much younger then. But what the heck, there’s no reason I couldn’t do this. Plus, my doctor wants me to lose a few pounds, anyway.
The ride
The hardest part, I knew, would be finding the time to ride. It’s a busy time with kids’ activities and whatnot, so I had to get the miles in where I could. I got off to a strong start on Labor Day weekend, and used Sundays to good effect, generally. I snuck in some midday and evening rides when I could.
Here’s a thing you might not know: Indiana isn’t all flat. The area I live now is far flatter than where I grew up, but it’s not without some hills. The Wabash River, over the millennia, has carved some contours into the elevation map. As an unfortunate result, most of the interesting places to ride are downhill from my house. I used the bike rack at first, but after I’d done a few rides, I got up the nerve to tackle the hill. As you might have guessed, I survived, but it wasn’t always pleasant. On one ride, I went all the way up the trail through Happy Hollow Park (and then back down Happy Hollow Road, which was fun). Only later did I think “oh yeah, I still need to get back up to my house.” My heart rate hit the low 180s, but I got home without walking the bike.
I also met my (admittedly modest) fundraising goal. I tried to goad people into donating more by saying I’d add an extra mile for every $10 over the goal before I reach the 100 mark. But I was chicken and didn’t make that offer until I was almost there.
The joy
The exercise was good, as was the fundraising. But the best part was just the joy of being out and about. I’m unabashedly a fan of Greater Lafayette, and I tried to plan my routes in such a way that I could enjoy some of what makes it My City. Some of the places I enjoyed:
Sometimes I rode solo, which gave me some rare alone time. Sometimes I rode with my wife. Sometimes I rode with my youngest kid. Sometimes my two youngest kids and my wife and I all rode around the neighborhood together.
I don’t know if I’ll want to put myself through the stress of trying to make sure I can meet my goal again, but it definitely got me more active and wanting to spend more time on my bike.
Use care in examples and placeholders — Placeholder configs for services that the user will interact with should be intentionally broken to protect users and innocent bystanders.
Combinatorial releases won’t help — The general software release workflow looks like something Gutenberg would recognize from 1440 because it actually works pretty well.
What does it mean to pretend to be something else? In one of my favorite books, Mother Night, the character Howard W. Campbell, Junior concludes that “we are what we pretend to be, so we must be careful what we pretend to be.” Viet Thanh Nguyen’s narrator in The Sympathizer reaches no conclusions, but he struggles with the thought throughout the story.
I saw — or imagined — a lot of parallels between Mother Night and The Sympathizer, which no doubt predisposed me to liking the latter. Both books take the form of the protagonist recounting his exploits for a captor, mixing self-reflection with facts. Both take place in a war setting, which characters having authentic connections to the people they’re trying to deceive.
But just because the themes rhyme, The Sympathizer is its own work. If nothing else, it’s a rare work that looks at the Vietnam War from the North Vietnamese perspective. It’s also a really enjoyable book in its own right. The fact that the narrator cannot answer the questions he asks himself gives the reader something to think about long after the book is done.
I loved this book to the point that I stayed up far too late to finish it. I’m looking forward to reading the sequel that I just found out existed.
What have I been writing when I haven’t been writing here?
Stuff I wrote
Duck Alignment Academy
Incentives power open source — A company making requests of a project has to explain the incentives in a way the project members will care, not in a way the company cares.
Should you care about GitHub stars? — If GitHub stars give you dopamine, then care about them. Don’t try to draw any conclusions from stars, just bask in their glory.
Bug fixes only matter if they get to the user — Any bug that blocks a release from getting to users is worthy of an immediate fix release. This is true even if the bug is minor by itself.
License changes are API changes — Making a license change affects how people interact with your project. You need to treat license changes as if they were changes to your API.
Getting started is just the start — You’ll need to continually refine processes as you go. That’s easier if you think beyond just what you need at the start.
What have I been writing when I haven’t been writing here?
Stuff I wrote
Duck Alignment Academy
Fork yes: embrace forks of your project — If you’ve done what you can to make your community a great place to contribute, then you can feel free to embrace any forks that happen.
Keep your bug tracker unified — When your bug tracking is scattered across different platforms, you make it harder for your users to file reports.
Semantic versioning in large projects — SemVer can work for large projects, but it’s not a fit for every case. Whatever you pick, document it clearly.
Grow by delegating — Don’t hoard responsibility. Give new contributors a sense of ownership so that they’ll stick around your community.
Don’t try to be too formal in policy writing — Don’t emulate legal language when writing policies for your community. The simpler the language, the easier everyone will understand.
Companies: fund work that isn’t new development — Failing to invest in your upstream projects presents a large business risk. Communities, like gardens, are more productive when tended to.
On Christmas morning, I put my Canon EOS T1i DSLR camera on the tripod to take a family picture. But it didn’t work: “Err05”. The built-in flash didn’t open, so the camera refused to…camera. It had done that at Thanksgiving, too, so I’d used manual settings and some additional lighting to make it work. This time, changing the ISO from automatic was enough to convince the camera to take a picture, but I didn’t want to keep fighting it. Search results suggested that it could be dirt in the flash housing. Makes sense: I took the camera to the beach this summer and we all know that sand is coarse and rough and irritating, and it gets everywhere.
I found a great YouTube video that went through the process of removing the housing and cleaning the flash. Just from loosening the screw a bit, the flash popped up when it was supposed to. But I figured “since I’m here, I might as well keep going and make sure I have everything cleaned out.” That was my mistake.
When it came time to reassemble everything, I couldn’t figure out how the spring fit. The guy in the video just said to put it back and his fingers blocked my view. I couldn’t find anything else, except for a few forum posts that were impossible for me to decipher. I spent what felt like an hour trying different things and growing increasingly frustrated. But at one point I turned the camera just right and I figured it out.
Replacing the spring
The circle shows the slit where the short end of the spring goes.
It turns out there’s a slit on the interior part of the housing where you can slide the short end of the spring. It will hold there firmly after you bend the long part back to install the screw.
Pulling back the long end of the spring to get the screw in place.The screw and spring replaced
One the screw is back in (note that the head is smaller than the coil of the spring), you can hook the long end under the tab on the forward part of the housing.
I hope this helps anyone who stumbles across this post in a fit of desperation. The YouTube video is very helpful otherwise, so I won’t repeat the rest. I’ve only tried these instructions on one model of camera, because that’s the only one I have, but it should be the same for similar models.
New project repo basics — Before you start writing any code, what do you fill a new repo with? I’ve created a sample repository with some really basic examples.
It’s okay for your project to end — Open source projects don’t last forever, and that’s okay. The end of a project can be a sign of success, or at least partial success.
Where have I been writing when I haven’t been writing here?
Stuff I wrote
Duck Alignment Academy
Do release-blocking bugs have to be new? — If a bug existed in previous releases, should it block the upcoming release? There’s a case for “yes” and a case for “no”.
Keeping your bug tracker simple — Don’t try to make the perfect system from the beginning. Start with the basics. Solve problems after they become problems.
Use your tools, but write like you — We live in a time when we’re awash in tools (often free) that aid writing. You miss out when you don’t take advantage of these tools.
Are bug reporters contributors? — Whether they’re made by a contributor or not, bug reports are valuable contributions to your project. Treat them that way.
Chat is not documentation — Chat is somewhat ephemeral. When you try to use it as a long-term resource — even if you have years of logs — it gets rough.
MVP applies to teams, too — It’s hard to contain your enthusiasm when starting something new, but you have to pace yourself. Otherwise, the enthusiasm goes nowhere.