Chameth.com - posts like how-i-get-things-done but not migrating-from-github-to-forgejo, tracking-pbs-without-the-dark-patterns, why-you-should-be-using-https

Monthly Meanderings: January 2026

2026-02-01T00:00:00Z

Welcome to the second edition of my monthly meanderings. For a bit of context, you can check out the introduction to the first edition.

Website updates

It’s been a pretty busy month for chameth.com. Three blog posts: The Meaning of Life — an entry into the IndieWeb carnival where I mostly review a book on Stoicism — Surge Protectors: Marketing vs Reality which is a dump of a research rabbit hole I fell into, and An Interesting Tailscale + Docker Gotcha which documents a fun problem I encountered.

I’ve also made a new films section, which is basically my Letterboxd data but free range instead of cooped up in a silo. I imported my 200-odd reviews, and for the last few I wrote the review on my site and then copied it over to Letterboxd. That’s what the IndieWeb folks call POSSE: publish on your own site, syndicate elsewhere. I like the idea that my website is the canonical source of truth for all the public things I generate. I want to expand this to some other areas in the future: music, video games, board games, etc.

I made most of the film components into “shortcodes”, so I can drop them into arbitrary pages or posts, like so:

Watched films ranked

Every film I’ve watched since I started logging, ranked.

Obviously super subjective, and subject to change often and arbitrarily.

264 films

Finally, I added a new widget to the bottom of most pages: a “nod” button. It’s effectively a “like” or “kudos” button but deliberately does not track how many times it’s been pressed, has no social network connotations, and won’t flood my inbox or hit rate limits if it gets spammed. If you click the button, it simply sends a message to a private IRC channel that says “Someone nodded at $URL”. I’ll probably write a bit more about it in a blog post in the future.

Other projects

I only have one small non-chameth.com update: a new project called pigeonhole which provides a really basic web service that lets you leave messages in a named cubby, and retrieve them at a later date. I’m using it to automate adding things to my Obsidian notes from my Apple Watch. There’s lots of reasons why that isn’t as simple as it sounds. I went through a bunch of iterations to try and make it work before just writing code to fix it.

I wanted to do this because I’m trying to replace Todoist with just having tasks in Obsidian. I already used Obsidian for longer form notes, but I’ve now also started using it for drafting blog posts (I’m typing this in Obsidian right now!), and trying to keep more useful day-to-day notes. I’ll probably write a blog post with more details once I’ve figured everything out.

Finally, I’ve been moving a bunch of projects to a private Forgejo instance, with the ultimate goal of having all of my projects live there. I’m going to mirror the contents out to GitHub and maybe other places, but Forgejo will be the single source of truth, and where all the workflows/dependency wrangling/etc happens. I’ve got Renovate configured to do dependency bumps, and I’m very much liking the whole setup so far. I’m saying it a lot but again: I’ll blog about it in more detail when it’s a bit further along.

Entertainment

I mentioned last month that I was playing Hogwarts: Legacy. I finished that off, and have been struggling to find something to scratch the same itch. I’ve tried a whole bunch of open world games, and basically none of them work for me. They have cumbersome control schemes (yay console ports), really awkward or sluggish movement, and so on. I think I’m just too fussy, but if I’m going to sink dozens of hours into a game it shouldn’t feel annoying or like a chore!

I did play through Thank Goodness You’re Here, which is delightfully funny but sadly only took 3.6 hours to finish with 100% of the achievements. Still highly recommend picking it up, especially when it’s on sale for under ‘10 bob’. I’ve also started playing through Control, and I’m enjoying the ambience. There’s an insanely sharp difficulty spike for the first boss, though, which nearly made me put it down.

In other entertainment, I’ve been playing a load of turn-based games on Board Game Arena , and I’ve watched a bunch of films after barely watching any last month. Here’s another of those shortcodes to show them off:

Around the web

Remotely unlocking an encrypted hard disk

A fun post documenting using Tailscale in a very weird way to solve a relatable problem. Very much my cup of tea.

I charged $18,000 for a static HTML page

This one’s actually from 2019, but it’s the first time I’ve come across it, and it’s a fun story. As a contractor, deciding what to bill for and what not to can be a bit messy. Downtime between meetings? The ten minutes in the shower you spent thinking through a bug? It’s a lot more clear cut if the client wants you to sit in an office, twiddling your thumbs, though.

Oxide RFD: Using LLMs at Oxide

A wonderfully well thought out piece about using LLMs in a respectful, sensible manner. I’d been thinking about writing something similar, but it wouldn’t have been anywhere near as well crafted as this. While I basically agree with it all, the part about LLM-generated text really resonates:

LLM-generated prose undermines a social contract of sorts: absent LLMs, it is presumed that of the reader and the writer, it is the writer that has undertaken the greater intellectual exertion.

Your app subscription is now my weekend project

Roberto points out that monthly SaaS subscriptions start looking even less appealing when you can just prompt an alternative into existence. I talked a bit about using LLMs for one-person software before, and it becomes even more appealing when the alternative is paying monthly for a service that keeps shoe-horning in features you don’t want, making you agree to share data with 329 “trusted partners”, and/or repeatedly ratcheting up the price.

Ekul’s Internet Space

I love the aesthetics of this personal site, and the data tracking that goes along with it. I’m also slightly aghast at the amount of Monster consumed! Makes me want to track more things and expose them on my own site.

Securing all the things with 1Password

2025-11-26T00:00:00Z

For many years I’ve been a keen user of Bitwarden. Recently I’ve had a lot of small paper-cut problems. The browser extension was redesigned and just doesn’t quite work how I expect any more. The prompt to save new login info misfired more than it worked. The mobile app stopped background refreshing properly. No one issue was enough to make me want to leave Bitwarden, but it definitely wasn’t sparking joy. Then there were rumblings about a price increase. I don’t think they’ve announced anything, but the numbers I saw were a jump from $10/year to $24/year. A nearly 2.5x price increase for a tool that was actively getting worse over time did not seem like a good deal to me¹.

I spent a while looking at alternatives, but there were very few that met my needs. Nordpass is highly praised but doesn’t support saving TOTP codes on personal plans². All the nice open-source/self-hosted solutions fall down when you want reliable synchronisation to an iOS device (which is fair enough). Proton Pass looked like it had all the features, but the pricing was asinine. Different pages showed different prices, the prices were introductory rates that jumped up on renewal, but that was hidden away in small print, etc. Yuck. The prices are also pretty high. More or less the same as 1Password, which I’d been discounting due to the cost, until now…

After eliminating basically every other option, I took a serious look at 1Password. It seemed to tick all the right boxes, I’d often heard good things about it, and it wouldn’t actually be much more expensive than Bitwarden if they went ahead with the rumoured price increase. I started a trial to give it a test.

Initial impressions

1Password is — as you’d expect for something that originated as a Mac app — very pretty. But it’s also highly functional. The looks don’t get in the way, they’re nice extras on top. When it’s locked, you get a large version of the 1Password logo, which is a front-on view of the barrel of a lock, next to the password input. When you authenticate, the barrel turns as though you’d put a key in and rotated it, and then the background splits in two and opens like a vault door. Does a password manager need to do that? No. Does it make me a little bit happy every time I see it? Yes. Look at it, it’s amazing!

The design philosophy carries through the rest of the app. Despite using Bitwarden daily, I often clicked on the wrong thing when I wanted to do anything other than autofill; in about a month of using 1Password I don’t think I’ve ever misclicked or been confused about the UI. The browser extension just feels snappier than Bitwarden, too. I’m not sure if it’s actually faster or if the design just makes it feel that way.

Functionality-wise, 1Password does everything Bitwarden did for me but slightly better. Bitwarden kicked you to its web interface for some operations (like checking compromised passwords); 1Password has that all built into the app. Instead of editing entries in a fiddly little browser popup, 1Password just summons forth the desktop app and you edit it there. It does a good job of detecting QR codes for TOTPs and offering to save them. I think the only small complaint I have is that the browser extension doesn’t have an autofill keybind. You can rig that up via the desktop app, but it feels like 1Password leans towards you using the UI it adds on login forms. To be fair, that UI works really well, and is very useful when you have multiple accounts on a site. My muscle memory for autofilling is strong, though.

Diving deeper

At this point I’d decided to switch fully to 1Password, so I started digging into what else it could do. The “Watchtower” feature combines a bunch of reporting about passwords (weak, breached, reused, and so on), but also lists sites where 1Password knows you can use passkeys or 2FA and don’t have them set up. I’d previously disabled passkey support in Bitwarden because it just appeared one day and got in the way of me trying to use a YubiKey, but decided to give them a go with 1Password. “Passkeys” is basically just a marketing term for FIDO2’s WebAuthn with automatic discovery bolted on top. The big problem is how you synchronise or export them. It’s all well and good letting your iPhone create a passkey when the Amazon app arbitrarily prompts it to, but what happens when you log in on a different device, or swap to Android, or whatever? Having 1Password deal with them fixes that³.

The passkey flow is very smooth: 1Password pops up an account selector, with obvious options to create a new account or pass the request through to another device like a YubiKey. It’s smart enough to guess the right account most times, even when you’ve got 17 different Google accounts for $reasons. Using them is equally simple: it just shows a popup and you tap to confirm you want to use the passkey. The Watchtower functionality made it really easy to go through and add passkeys everywhere that supports them. The thing I really appreciate is that they make the data that powers it public. It’s obviously partially a marketing thing for them, but it’s also a useful resource they could have kept proprietary.

Passkeys are a bit basic, though. 1Password has many more fun offerings. There’s an entire developer section with various goodies. At first I thought “that’s nice but I won’t use it”, but now I’m using basically everything it offers. The first thing to draw me in was the CLI. It’s pretty straightforward, but like the browser extensions it can nicely integrate with the desktop app so you unlock them all at once, deal with auth prompts in the GUI, and so forth. I have a couple of command-line tools that need passwords (e.g. for dealing with encrypted backups); now instead of prompting for the passwords, they shell out to op read and I authorise it via a popup in the 1Password app. Simple, but a nice quality of life improvement.

Next up there’s a beta feature called “Environments”. This lets you define groups of environment variables within 1Password, and have them exported automatically to certain destinations. At the minute it supports exporting to the AWS SecretsManager, and local .env files. When making a local file it actually makes a named pipe, so the credentials aren’t just sitting on disk (and won’t end up accidentally committed to anything). When the 1Password vault is locked, anything trying to read from the file will cause an authentication popup, much like with the CLI tool. I used to have the mentality that if something could read arbitrary files on disk, it was basically “game over” from a security point of view. Recent events made me realise there’s some value in defence-in-depth there, though, and 1Password provides a nice solution.

Fingerprints + Linux = Sadness

One feature of 1Password had me feeling a bit left out. Instead of entering your vault password to unlock it every time, you can have it invoke the system authentication library. On an iPhone this uses Face ID, on a Mac it can invoke Touch ID, and on Linux it uses Polkit. In the default configuration, Polkit just asks for your local user password, which is not much of an improvement. A fingerprint scanner seemed like the obvious solution here: it’s both a lot more convenient than typing a long password, and provides some assurance that it’s actually me doing the action⁴. Unfortunately, fingerprint readers on Linux seem to be a bit of a sorry affair.

Don’t get me wrong: there’s support. libfprint has a big list of supported devices, but I found it almost impossible to actually find a device I could buy that had one of the listed sensors. Most of them seem to be exclusively built into laptops. A lot of the cheaper devices just use whatever sensor they can get their hands on, so it’s pot luck if you receive a version that will work with libfprint or one that won’t. There’s also not a lot of information beyond that published by libfprint. I guess it makes sense: external fingerprint readers just aren’t a thing most people care about. While that makes me feel all special, it’s somewhat prohibitive to getting an actual working solution.

I’d given up on finding an answer to this when I stumbled upon an article by Scott Laird. He uses a YubiKey Bio to do it, via pam_u2f. The Bio isn’t actually a fingerprint reader: it just has an on-board reader to secure the credentials. The OS doesn’t get involved in the process. But because it can provide a fingerprint-secured U2F key, and pam_u2f can require that key to perform system operations, you basically get the same result. Maybe it’s actually even better than using a “real” fingerprint reader, as the data is secured on the hardware device…

The YubiKey Bio was a bit more pricey than I really wanted, coming in at around £90, but it felt like a worthy investment to add a bit of security and avoid typing a password dozens of times a day. The setup was simple: the official app that you use to enrol fingerprints is packaged in the Arch User Repository, and it worked perfectly. I already had pam_u2f set up as I used a (non-Bio) YubiKey to gate access to sudo, so I just generated a new key on the Bio, updated my config to use that, and added it to the Polkit policy. Now when I need to unlock 1Password or authenticate something, it prompts me to scan my fingerprint. Perfect!

Biometric all the things \o/

One of the other things Scott mentioned in that article was SSH keys. I’d seen 1Password supports acting as an SSH agent, but didn’t really see why I’d want it to. I used a resident key on my old YubiKey, so I didn’t have much to gain from a security point of view. Scott’s article made me realise I could have some big convenience gains, though. Currently every time I need to use the key, I enter a PIN and then physically touch it. I don’t mind this for the most part, but it turns out git-lfs does something like four different requests every time you do a git operation, none of which reuse the same SSH connection for some reason. That gets painful when each request involves a PIN and a touch. I also liked the idea of using pam_rssh for sudo authentication, but didn’t want to have to do the PIN-and-touch dance every time I used it.

You can probably see where this is going: I generated an SSH key in 1Password, and then… spent literal hours disabling all the other SSH agents that were running on my system, and trying to figure out where SSH_AUTH_SOCK was being populated. I didn’t manage to figure that out in the end⁵, and ended up just overriding it to point at 1Password’s agent socket. I added the new key to GitHub, and did the usual ssh git@github.com test, and it worked perfectly. 1Password prompts to allow access to the key, showing the process requesting access, and authorising it requires a fingerprint read:

can haz ssh key?

I’m not sure why Kitty doesn’t get an icon in the prompt; other applications do. You can expand the details section to see the key fingerprint being requested, as well as the exact process name and PID requesting the key. With the proof of concept done, I generated a couple more keys: one for normal SSH, and one for gaining root access using pam_rssh. Using different keys ensures I get prompted for them separately, and means a malicious app couldn’t sneakily ask for a Git key but actually pivot to SSH into a server. Not sure that’s ever likely to be a problem, but it’s basically no additional work for a bit more defence-in-depth, so why not?

I also took a moment to configure pam_u2f for both lightdm and xfce4-screensaver, so I can now log in and unlock my PC with my fingerprint. It’s not quite as smooth as Touch ID on a Mac, but it’s pretty close.

As an aside: this is not the first time I’ve been in this situation. Both Spotify and Todoist have focused on features I don’t want or need (including, but not limited to, pretty much everything branded “AI”), and then hiked the price up afterwards. It’s not quite standard enshittification, but it’s clear that our incentives no longer align properly. ↩︎
Or didn’t, at the time I looked. It now says “All plans” on the website but the docs only exist for business accounts, and there doesn’t seem to be any announcement explaining the change. ↩︎
Having Bitwarden deal with them would also have fixed that, but it got in my way instead of helping me, so… ↩︎
or it’s not me, but I’ll be busy dealing with the presumably-undesired removal of one of my digits, so probably won’t care about whatever is happening on the computer. ↩︎
Although I’m pretty sure the answer starts and ends with “systemd, somehow”. ↩︎

Escaping Spotify the hard way

2025-07-25T00:00:00Z

I realised my media consumption was too close to this for comfort.

For the longest time I used Spotify for all my music needs. And I listen to a lot of music: sometimes actively, but mostly passively as background noise. I cancelled my premium subscription last December, and stopped using the service entirely. Why? There’s a bunch of reasons.

Let’s talk about the money first. Spotify launched at £9.99/month, and stayed that way for over a decade. Then in 2023 it went up to £10.99/month. That’s probably fair: the economy was in the toilet, and they haven’t changed their price in so long. Then in 2024 they upped it again to £11.99/month. Hmm. The service they were providing me didn’t improve in that time. I didn’t want audiobooks in my music player, I didn’t want an AI DJ that spouted inane comments at me. Paying them more money to do things I didn’t want seemed silly, and the money that actually goes to the artists is both so small and gets split in such a convoluted way that it’s not worth even thinking about.

My bigger concern was how uninvolved I became in choosing what to listen to. I leaned hard on their algorithmic playlists like “Discover Weekly” instead of manually curating playlists. But they ended up developing this weird feedback loop where it kept playing a country band¹ that I didn’t particularly like, but also didn’t dislike enough to skip. That acted as positive reinforcement, and they kept coming up everywhere. There were definitely ways to solve that by changing how I used Spotify, but the realisation that I was basically just consuming whatever was fed to me made me want to try something completely different. So I decided to go back to buying music instead. Which is where things got… complicated.

Getting some MP3s will be easy, right?

I figured with the money I was no longer giving to Spotify, I could just buy an album or two a month and slowly build up a nice music collection. I already had some music kicking around from before the streaming era, so there would at least be some variety in my listening while I got started. Where to buy music from, though?

Amazon used to do DRM-free music, but as far as I can tell it all got folded up into their own streaming service. Some smaller bands are on Bandcamp, but you won’t be able to grab Taylor Swift’s latest album from there. Qobuz have a good catalogue, but some of the stuff is pricey². It’d be cheaper to buy CDs and rip them like it was 1998 again.

I finally stumbled across an unlikely answer: the iTunes store³. This is still somehow separate from the behemoth of Apple Music, and if you fire up the iTunes software you can indeed buy reasonably priced, DRM free music. For comparison, 1989 (Taylor’s Version)⁴ is £12.89 (plus delivery) on CD from Taylor’s official website, £16.79 in CD quality from Qobuz, and £12.99 from iTunes.

Now, I use Linux, so using iTunes isn’t exactly easy. I ended up running a virtual machine with Windows on it. Every time I wanted to buy an album, I’d boot the VM, open iTunes, search for the album, press the buy button, enter my password, wait for it to download, copy all the files to a shared drive, and then back on Linux copy those files into my music directory. Smooth, right? But it worked. Earlier in the year I switched computers, though, and didn’t want to bother with the VM rigamarole. Spoiler alert: I didn’t make things any simpler.

Do you guys not have phones?

I tried a lot of things to avoid setting up a Windows VM again. I’m pretty sure I went through most of the 7 stages of grief in the process. I tried to get Apple Music to work, because that was obviously where all their development was focused, but you can’t actually buy music there (at least not on any version I could run on Linux). I tried running iTunes under Wine, but it just wouldn’t work. I looked into third-party clients, but unsurprisingly they didn’t go anywhere near payment flows.

I eventually realised that I have an Apple device in my pocket. After a bit of searching, it turns out there is actually still an iTunes app for iOS⁵. I bought an album⁶ to see if I could exfiltrate it. I connected my phone to the computer, paired it with idevicepair and then mounted the storage using ifuse⁷. Looking around, I could see a bunch of m4a files, and I could play them. Success!

Except… the file names were random hex strings, and they had no metadata. Yuck. I grabbed a copy of MusicBrainz Picard and had it sort out the mess. I stuck with this process for a while, but matching albums in Picard was sometimes a pain. MusicBrainz does a great job of figuring out what the tracks are, but it struggles to tie those back to a single edition of an album. I wasn’t aware how many subtly different versions of albums there were until I had to manually find the one iTunes had given me. Not fun. Eventually I got so fed up with this that I did something about it.

Plists all the way down

Armed with an instance of Claude Code, I set out to see if I could write some Go code to import the files properly. There were plists in the directory with the m4a files, and I know enough to know that they’re where all the juicy metadata lives on iOS. Maybe we can parse them and do something useful?

There’s a nice plist parser written in Go already, so I got Claude to write a program to dump the contents of one of the many plist files in the directory. Inside was all the metadata for one of the tracks. Yay! Just one small problem: there’s no way to link the plist file to the audio file. There’s one plist file that has a real name, though: StorePurchasesInfo.plist. I had Claude translate it to JSON and found that it contained a data field with a bunch of binary data. Huh.

I thought this was probably a dead end, but stuck the base64’d data into CyberChef and fiddled around a bit to get a hexdump of the binary. Six characters jumped out at me: bplist. I went back to Claude and suggested this might be a plist-in-a-plist scenario. Claude then got very confused because it couldn’t understand where the base64 was coming from⁸. After some LLM-induced suffering, I eventually got the contents of the inner-plist, and for each track it had a list of the audio file, the metadata, and the album art. Yay!

With the data figured out, it was fairly simple to get Claude to write code to parse everything and link them together, and after that move the files into their correct place in my library. I also had it take the metadata from the track’s plist file and write it into tags on the m4a so my media player didn’t have to understand Apple nonsense. I looked around for a Go library to do this, but couldn’t find one supporting m4a files, so ended up just shelling out to exiftool.

As a bonus, I made the tool automatically make a temporary directory and use ifuse to mount the phone, then unmount it when it’s finished. So now all I have to do is plug my phone in, and run import-music on the command line⁹. It’s a very nice quality-of-life upgrade that I probably wouldn’t have bothered with if I didn’t have Claude Code to speed the process up¹⁰.

Sometimes I actually play music too

With all this talk about buying and sorting music, I almost forgot about the most important bit: listening! I use Tauon, and it looks like this:

Tauon, showing off a wide range of different music in my library.

I tried a bunch of different music players, but Tauon hits the sweet spot of being simple enough to use but capable enough in the right places. I particularly like the playlist generators. My “Music” playlist just auto-imports all music in my “Music” folder, then I have a “Classical” playlist with a generator of s"Music" g"classical" auto. That makes it use the “Music” playlist as a source, filter on tracks that have “classical” in their genre, and automatically update when the base playlist changes¹¹. The “Disliked” playlist does the same but filters on rating: s"Music" a rat=0.5 auto. That takes all tracks (a) from the Music playlist, then filters it down to only those that have a rating of 0.5 out of 5¹². Finally, the “Normal” playlist imports everything from “Music” that’s not in one of the others. It sounds a bit clunky, but it works well in practice and I like the way it works.

Tauon in general just seems to work the way I’d expect it to, which is refreshing. You can just start typing anywhere to search for a track, hit enter, and it starts playing. It has keyboard shortcuts for other operations, and standard features like reporting to last.fm and other sites.

Tauon also supports transcoding and copying tracks to a music player or a phone. I use this to sync my main playlist to my phone. I’ll give you a minute to just bask in the glory of the rube goldberg machine I’ve created to move music from my phone, to my computer, and ultimately back to my phone. This does actually serve a purpose, though: it lets me control which tracks are on my phone. I don’t have to deal with excluding genres or tracks I dislike on the phone in addition to the computer. In the future I might opt to just sync a subset of my tracks to keep the storage size down. I’m telling you it makes sense! Stop looking at me like that!

Paying Attention Pays Off

I mentioned one of my aims for getting away from Spotify was to feel less like I was just consuming whatever’s in front of me. The corollary to that is how do you discover new music without an algorithm to feed it to you? I’ve ended up subscribing to a few blogs, paying more attention to music-related news, and being more aware of songs on the radio and from other sources.

When I find a song I like these days, I tend to listen to a few other tracks on the album (via YouTube, normally, as it’s the least friction) and decide if I want to buy it. When I do, I sit down and listen to the whole thing in order. It’s a radically different experience to just hearing a song now and then. There are themes and connections between tracks that you just miss if you listen to songs at random. Of course, you could do that on Spotify, but I don’t think it really lent itself to it.

My favourite example of this is my rediscovery of Linkin Park¹³. I’m of the age where they were around as I was growing up. I knew a couple of their big hits but younger-me wasn’t that into rock¹⁴, so I didn’t pay them much attention. Then I caught Up From the Bottom on the radio, and from there ended up buying and listening to all of From Zero. It’s an amazing album. The Emptiness Machine has become my favourite song: not only is it a great tune, performed well, it’s also a fantastic introduction to a new era for the band and to Emily Armstrong as the new vocalist. The rest of the album then builds on it to show off what they can do.

I’ve since gone back and reconnected with a lot of Linkin Park’s older albums, too. And from there discovered a lot of other rock bands I really like. Could this have happened with Spotify? Maybe, but it seems unlikely. It had me in a country-band-I-can’t-remember filter bubble, it seems pretty unlikely it’d drop some Linkin Park on me out of nowhere. And the passivity that came along with it would have meant that I probably wouldn’t have paid enough attention when I heard it from elsewhere.

Would I recommend that everyone runs out and cancels their Spotify subscriptions? Eh, probably not. If it works for you, that’s fine. Discovering recursive plists is fun for me, but I appreciate it’s not everyone’s cup of tea. What I would recommend is being a bit more deliberate in your choice of music. Don’t just tune in to a random playlist, or let the ‘DJ’ decide what to play. Find something, and actually listen to it. Then recommend it to me. I want more music!

I can’t even remember the name of the band, that’s how much I was into them. ↩︎
And they’re annoyingly deceptive about it. All the prices are “From £x”, where x is the discounted price you’d get if you paid them £15/month. ↩︎
I’d link to it, but… there isn’t a website. That’s not how things were done in the 1990s, silly. ↩︎
I don’t know why I’m so hung up on Taylor Swift in this post. ↩︎
Again, unrelated to the Apple Music app. ↩︎
It probably wasn’t a Taylor Swift album. Maybe. ↩︎
The Arch wiki has a useful page on this (of course). ↩︎
We were translating the plists to JSON, and if you serialise a byte array to JSON in Go it ends up as a base64-encoded string. Claude was then adamant it needed to base64 decode the binary plist. It did not. ↩︎
I just had the sudden realisation that I can probably automate running the import-music tool whenever I plug my phone in using systemd… ↩︎
I feel like I say that a lot lately. ↩︎
I like classical music, but it’s a mood, and I’m often not in that mood. ↩︎
I basically use this to filter out those introduction/bridge tracks on albums that are just talking and not singing. ↩︎
Surprise! My library isn’t actually just Taylor Swift songs. ↩︎
Younger-me was a dumbass, in some ways. ↩︎

An app can be a ready meal

2025-06-11T00:00:00Z

It’s not a home-cooked meal, but it does the job sometimes.

Three years ago I read “an app can be a home-cooked meal” by Robin Sloan. It’s a great article about how Robin cooked up an app for his family to replace a commercial one that died. It’s been stuck in my head ever since. It’s only recently that I’ve actually done anything like Robin described, though. Part of the reason was my brain got too hung up on the family aspect: in my head, a home-cooked meal is one where your family or friends all gather around to eat it with you (in much the same way as Robin’s app is used in the article). It took me an embarrassingly long time to realise that you can apply all the same arguments to an app built just for you. And it doesn’t even have to be difficult. In fact, it can be more like a ready meal¹ than a family dinner.

Why not open source?

I love open source software. Almost everything I use day-to-day is open source, and most things I write for myself I release as open source. I believe that should be the default stance for most software. So why would you want to make something and keep it just for yourself?

Even if an open source project garners no users whatsoever, there’s still some pressure for it to meet certain standards²: if it needs configuring, then there needs to be a mechanism for people to do that; the code needs to be of a reasonable quality — my open source projects are linked from my CV, potential clients might be looking at them — and there needs to be at least some attempt at documentation or showing other people how to use it. There’s “building in public” and then there’s “inviting the whole world to poke around your drawer of shame”.

The way I usually work on things that are mostly for me is I hack them together, and then I gradually force myself to fix them up into a state where I consider them acceptable for release. That stage isn’t fun, and sometimes it adds more complexity than the whole original project. I’m not saying open source isn’t worth it — far from it! — but there is definitely a balance to be struck between the utility of making something open source and the amount of effort it takes.

For example, I mentioned previously that I wrote a home automation system. Hidden within that is a ~40 line function that determines whether a fan should be turned on to keep a room cool. The logic is entirely unique to the devices on my network and my requirements. To try to put it into a form that would be useful to anyone but me would take exponentially more effort. I’d basically be re-inventing Home Assistant, and I explicitly started that project because I didn’t need that kind of complexity. For a while I had this nagging feeling that I should find a way to open source it. Then I had my³ “lightbulb” moment: I could just not.

Writing something entirely for yourself, without planning on open sourcing it is surprisingly liberating: you don’t need to worry about documenting things; you can change anything and everything at will without having to worry about migration paths or whether it’ll break anyone’s workflow; you don’t have to configure things, you can just code them how you want. Hell, you can hard-code API keys right in the source code. Who cares!

The microwave revolution

XKCD 1205

One of the other problems with making software just for yourself is that often the time investment just isn’t worth it. If I spend a day automating something that normally takes me five minutes, it’s going to take an awful long time to “break even” on that time spent. If you’re open sourcing something then there are ancillary benefits that may tip those scales: you might help other people, have something to show off, etc. But if it’s just for you, then XKCD 1205 is a harsh mistress.

Recently, though, a new tool has emerged that tips the balance: LLM assistants. I’ve talked about my experience before. I’m definitely not comfortable letting an LLM run roughshod over my published code, even if it can help write some of it, but for private code? Why not! For a trivial example: I have a USB key with an Arch Linux ISO on it, in case I need to troubleshoot or reinstall my PC. Every so often I’ll update the ISO to the latest version. It probably takes 5 minutes to do, so it’s probably only worth 25-50 minutes to optimise it. Can I write, test, and debug a script to do it myself in that time? Probably not. Can I get an LLM to generate some code to do it for me, and then spend 10 minutes reviewing it⁴? Easily.

To continue with the strained metaphor: LLMs are like the microwave that nukes your ready meal. Pop in a prompt, let it use a load of power for a while, and out pops your app. You can even do it on your phone while sat on a sofa⁵. That changes the time equation even more: you can just squeeze in a prompt whenever something comes to mind.

This also goes back to the open source issue: I don’t feel comfortable publishing something created by an LLM with minimal intervention on my part. If I can prompt an LLM to do something, so can anyone else. We don’t need more slop out there, and I don’t want there to be any confusion about what I’ve written and what I’ve just prompted into existence. But for personal projects that will never see the light of day it’s perfect.

What I’ve made

Besides the home automation controller, I’ve built a constellation of smaller tools: a script to arrange windows on my monitors how I want them⁶, one to help me verify that my backups are working and can be restored, one to create the files/folders for a new blog post, and some other odds and ends. They’re all pretty small, and pretty specific to my setup.

My biggest just-for-me project is a web app that I started to help me aggregate film recommendations. It’s since morphed into a general personal data aggregation service: it deals with data from GitHub, Todoist, Letterboxd, TMDB, Healthkit, and others. It also lets me make re-orderable lists, store recipes, and more. Parts of this could definitely be open sourced, and I might carve them out at some point, but it’s mostly a glorious hodge-podge of things specific to me. Having all these services in one place lets me make quick and dirty automations, for example: when I create a Todoist note on my phone or watch, I often forget to set the due date, so it doesn’t show up in the “Today” view. It was literally a few lines of code to plumb things together so any inbox task without a due date gets set to today automatically.

If I was trying to write these things in a way that would be useful to other people, or — for some of the features — without the aid of an LLM, I just wouldn’t be bothered. It’d take too much time for questionable benefit. But there’s a kind of joy in just being able to hack things together that work just well enough for you. A ready meal will never compete with a home-cooked meal, but sometimes it perfectly hits the spot.

Image credits	Creator	Licence	Source
Spaghetti carbonara	Wikimedia user Geni	CC BY-SA 4.0	Wikimedia
XKCD 1205	Randall Munroe	CC BY-NC 2.5	XKCD

or a “TV dinner”, if you’re North-American-ly inclined. ↩︎
Self-imposed pressure, for sure, but brains are going to do brain things. ↩︎
very obvious in retrospect ↩︎
Reviewing LLM-generated code that shells out to dd to write to the root of a storage drive is perhaps the most intensely I’ve ever reviewed any code to date. I really didn’t want to write a blog post about how an LLM blatted my hard drive! ↩︎
Phones are terrible input devices for code, but they’re just about passable for typing English. ↩︎
I basically want a tiling window manager, but without all the effort and weirdness of a tiling window manager. ↩︎

Home Automation Without the Megacorps

2025-05-21T00:00:00Z

I first experimented with home automation in 2016, by picking up a Samsung “SmartThings” hub. It was terrible. The UI to configure things was slow and clunky, firmware updates were applied whether you wanted them or not, and everything stopped working if their cloud services stopped. You were also locked into whatever integrations they deigned to support, of course. After that broke for the umpteenth time I scaled back and for years the closest I got to home automation was a couple of Hue bulbs.

Recently I’ve been building it out again, though. This time using off-the-shelf components that interop using Zigbee, open-source software, and some code I wrote myself. It’s great; it runs entirely locally and has had basically zero downtime. The Zigbee ecosystem lets me integrate all sorts of things without having to spend lots of money on “smart” alternatives. I think I’ve spent less on this incarnation than I did on the original SmartThings hub all those years ago (even without adjusting for inflation!).

My current setup

I run everything on a Raspberry Pi 4, with a Sonoff USB Zigbee adapter based on the CC2652P chipset¹. Interfacing with the Zigbee stack is handled by zigbee2mqtt (z2m for short), an open-source project that basically bridges your devices to an MQTT broker². When a device reports some data, it will send a new message over MQTT; when you want to make a device do something you just post a message back. It’s incredibly lightweight, but supports a huge array of devices out of the box. And as it’s just using MQTT, it’s trivial to integrate with other software or build on top of.

I know a lot of people building out this kind of home automation use Home Assistant, but I don’t get on with it terribly well. It felt incredibly sluggish, and the entire project is just a bit… much. I want a binary or package or docker image I can just run, not an entire operating system. That’s not how computers are meant to work! In contrast, z2m is simple to set up, super light weight and responsive.

Anyway. z2m exposes Zigbee devices over MQTT, so I wrote some code in Go to connect to the MQTT broker, and listen to the messages. It’s grown a bit beyond this now, and I’m skipping some boring bits like error handling and JSON parsing, but at first I had something like:

for {
    message, topic, err := c.ReadSlices()
    
    if string(topic) == "zigbee2mqtt/desk-button" {
        if strings.Contains(message, "single") {
            c.Publish(nil, []byte("{\"state\": \"TOGGLE\"}"), "zigbee2mqtt/room-lights/set")
        }
    }
}

I think I actually made this harder to read by trying to simplify it here, but hopefully you can follow that it was relatively straight forward to listen for a particular action to happen (in this case me “single”-pressing on the device called “desk-button”) and then make another device do something in response (toggling the state of the “room-lights” device).

So what actually are these devices? At present in z2m I have the following:

Some generic buttons
An air quality sensor (USB powered), and a separate temperature sensor (battery powered)
A light switch
Some 240V relay modules, that I use to turn non-smart devices on and off
Some USB relay modules, for the same purpose
Some “smart” plugs that I mostly use to monitor power usage
A motorised blind roller

I think all of these are either Tuya or Moes branded, and were all sourced from AliExpress. You can get the same things from Amazon or elsewhere, but they tend to be 3-4x more expensive for the same product.

One of the cool things about Zigbee devices is that the powered ones work together to create a mesh network, so you don’t have to worry about network repeaters or signal strength like you do with Wi-Fi networks. z2m even makes a map showing the connections:

The network map produced by z2m. You can see how all the powered devices form a mesh that the lower power ones can connect to.

Some interesting automations

A Zigbee relay spliced into the power cable for the fan

So what do I actually do with all of this? Some of it is just what I’ll call “laziness automation”: I want to be able to turn on the lights without getting up and walking to the light switch. So there’s a Zigbee button on my desk that does it. Then there are some less manual automations: my blinds are automatically closed at sunset³, for example. It feels a bit trivial, but it’s surprisingly nice just not to have to think about that at all.

Another nice quality of life automation is the light I have above my monitor. It’s USB powered, and I now have it going through a Zigbee USB relay that lets it be toggled on and off. Then I have a small agent running on my desktop that turns the light on when the computer is unlocked, and off when it locks or shuts down. I keep meaning to make a “film mode” that detects when I’m watching a film, and turning all the lights and blinds down, but I haven’t got around to it yet.

The most complex automation is probably for a window fan. It’s not smart in any way, so I cut the power cable and inserted a Zigbee relay. The whole thing is housed in a little project box to keep it secure. The relay basically acts as a switch: the live wire leading to the fan runs to the “normally open”⁴ contact, while the upstream power goes to “common”. When the relay is told to turn the fan on, the two get connected and the fan gets power. Oh, it’s also not actually a window fan, but I designed and 3D printed some adapters so that it sits right in the window.

So now we have a window fan that can be turned off and on automatically. But I don’t want to have to press a button to do that. I’m lazy, remember? Instead, I made it so that the Go code constantly monitors the temperature reported by the air quality sensor, and queries the free OpenWeatherMap API to get the rough temperature outside. It can then turn the fan on if the room is too hot, and outside is cool enough to make a difference (there’s no point in blowing hotter air in!).

A graph of room temperature, showing the effect of the fan being turned on and off

I don’t want it to do that all the time though. The room doesn’t need to be cooled if I’m not around. There are various Zigbee presence sensors you can get, but the cheaper ones seem to be of dubious quality. Instead, I wrote some code to guess whether I’m present. It uses the state of the monitor light as a proxy for “is the computer in use”, and then makes some guesses based on the last time the computer was used and the current time (if I turn the computer off at midnight it probably means I’m going to sleep; if I turn it off at 2pm it probably means I’m going out somewhere).

You can see in the graph that the fan has a decent impact on temperature. I coded it to cool the room to 19 degrees, but then not turn on again until it was above 20. This prevents it flip-flopping on and off constantly. You can clearly see the pattern in the graph, as it actively cools and then slowly the room warms back up. This arrangement is much better than being woken up at 5am because it’s painfully cold. Trust me.

Bonuses: metrics and 3D printer

One of the things my custom Go code does is collate all the various stats reported by the Zigbee devices, and inserts them into a VictoriaMetrics database. I originally hosted this on the Pi itself, and it performed fine, but I’ve since moved it onto a server so that I can use it for some other things as well.

I set up Grafana to point to VM, and can create dashboards showing power usage, what devices are turned on when, and a bunch of environmental conditions. This also makes it easy to spot how good the data coming from the devices are. For example, the air quality sensor reports a figure for the amount of Carbon Dioxide in the air, as well as the amount of Volatile Organic Compounds (VOCs). The graphs are basically identical, but on a different scale. It turns out this particular device has no actual way of detecting CO₂, so it just “calculates” it from the VOCs figure. Useful to know if you want to actually use that data.

Recently I came across a go library for interacting with Bambu Lab printers, so I’ve also hooked that into my automation. It exports metrics about the printer, so I now have a way of seeing what’s going on when I’m not physically present⁵. I even added a HTTP endpoint (exposed over Tailscale) that shows pictures from the built-in camera.

On the automation front, I’ve made it automatically turn off the printer’s light when it finishes a print, and also added push notifications via PushOver whenever the state changes. No longer will I be sat in another room blissfully unaware it ran out of filament seconds after I walked out the door!

Was it worth it?

These days you could probably just buy some kind of ‘smart home’ hub that works well enough, and do most of what I’ve done with a lot less effort and no coding. I’m still of the opinion that for something so essentially local, it should itself be managed entirely locally. I don’t trust companies like Google or Amazon not to kill their products, or change or remove an API I rely on.

Obviously the “Not Invented Here” approach of coding everything yourself doesn’t suit everyone, but as someone who enjoys coding and enjoys having things work just so it works very well for me.

It turns out the chipset is important. I initially used a similar Sonoff dongle that used a CC2531 chipset, and its performance wasn’t great. It often failed to pair with new devices, and dropped links to existing ones. The zigbee2mqtt docs do explicitly advise against the CC2531 chips for that reason. At the time they recommended CC2652Ps, so that’s what I went with. If you’re starting new I’d go with whatever their latest recommendation was. ↩︎
MQTT is basically a network protocol for publishing and subscribing to arbitrary messages. A broker is the thing that sits in the middle and routes the messages. I use Mosquitto but any will do. ↩︎
They originally also re-opened at sunrise but that was a terrible mistake. Who knew the sun rose so early?! ↩︎
“open” meaning “there’s a gap so it doesn’t work” not “open for business”. This confusion in terminology also extends to drawbridges. ↩︎
I use the printer in LAN mode, which means there’s no way to monitor it from a phone, even if you’re connected to the same network still. ↩︎