Chameth.com - posts not modern-css-is-fun, monthly-meanderings-2026-01

The Case of the Unchanging Config

2026-04-09T00:00:00Z

Last week I was attempting to make it so I could share pictures on IRC directly from my client. This sounds simple, but it involves a bouncer¹ that proxies the request to a standalone image hosting service that I had to modify to be compatible. At one point my testing loop was:

Make a change to the hosting service
Commit it
Tag a new release
Wait for it to build
Update the version I’m running on my server
Reconfigure the bouncer to pass the new parameter or change the URL or whatever
Try uploading a photo from my phone
Realise I’ve overlooked something and go back to step one

I could have set up a local copy of everything and tested it sensibly. I should have set up a local copy of everything and tested it sensibly. But it seemed like such a trivial change, and setting up the whole environment seemed like such a pain. After the third or so iteration of failure I was pretty annoyed with myself, computers, and basically everything.

My biggest annoyance was that my bouncer would not pick up the new URL from the config when I changed it. It’s meant to reload the config when it receives a SIGHUP, and it claimed to in the logs, but I could clearly see it was still hitting the old URL. Restarting the bouncer to update the config is a pain, as it disconnects me from all the IRC networks, and has to reconnect to them all, reauthenticate, etc. It also mildly spams everyone who shares a channel with me².

When I finally got everything working I had a look at the bouncer source, and thought I’d spotted the issue. I raised a bug report, ending in this remark:

It looks like the config is reloaded properly, but the handler for uploads is created once at startup and has its own copy of the uploader, so effectively snapshots the config to whatever it is at startup:

fileUploadHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    cfg := srv.Config()
    h := fileupload.Handler{
        Uploader:    cfg.FileUploader,
        DB:          db,
        Auth:        cfg.Auth,
        HTTPOrigins: cfg.HTTPOrigins,
    }
    h.ServeHTTP(w, r)
})

I’m not quite sure what I thought I saw there, but that’s not right. I want to call it a hallucination, but that feels like a very overloaded word these days. I guess I was just seeing what I wanted to see, and that was a good excuse to stop investigating. Still, even if I misidentified the cause, the bug was still present, right? … Right?

The Science of Deduction

When the developer got back and said he couldn’t reproduce my issue, I went back to my install and immediately reproduced it. With a calmer head, I figured it was probably something with my particular set up. First thing to check: am I actually running the version I think I am?

Unfortunately the bouncer doesn’t actually seem to expose the version anywhere that I can see. It’s not in the logs, it doesn’t have a -version flag, and none of the IRC-based status commands seem to include it. But I know it’s a Go app, and I know Go embeds the version information. go version -m <binary> will dump it all out, but the binary is inside a Docker image, and the Docker image is one of my nice, minimal, artisanal ones so doesn’t ship a go binary. No problem, docker compose cp bouncer:/bnc ./bnc yoinks the binary out of the container, and then dumping the version shows that, yes, I am running the version I thought I was. Hmm.

The next tool I reached for in my toolbox was strace. Maybe it’s not actually reading the file for some reason? I immediately executed strace -p <pid> -e trace=openat,open,read,pread64 -f without having to look any part of that up. Yep. Definitely. Then I edited the config, HUP’d the bouncer, and saw that it was… reading the config file. As it’s meant to. By default strace truncates strings to 32 bytes, so I couldn’t actually see the line I’d changed. Some more definitely-not-RTFMing later, and rerunning it with an extra -s 65536 let me see the full config. Surprise! The config hadn’t changed!

To confirm my findings, I used docker compose cp again, this time yoinking the config file from inside the container. The inside config file was definitely different to the outside config file. What? My hypothesis at this point was “something something Docker nonsense”. I mount the config as read-only, and was wondering if that meant that Docker was doing something weird instead of just bind mounting it. A quick trip to /proc/<pid>/mounts showed that it was, in fact, not doing anything weird, and was just bind mounting it.

If the file is bind mounted, then surely it’s the same file? I ran stat on the file on the host, noted the inode number, then pondered how to actually run stat on the file inside the container, given the aforementioned awkwardly minimal image. The solution was easy: access it via /proc/<pid>/root/. I could’ve saved myself a bunch of docker compose cp if I’d thought about that earlier. Oh well. The inode of that file was different. What?

The answer was DNS. It’s always DNS. Oh, sorry, force of habit. I meant the answer was vim. I was editing the config in vim, and when it saves files, by default, it writes the new content to a temporary file and does an atomic rename. That’s normally a good thing: it prevents corruption if the write fails midway through³. In this case, though, that means the new file has a new inode. Bind mounting a file binds to the inode, so the container just keeps clutching onto the original config from when it was started, blissfully unaware that the party has relocated down the street.

This problem is likely to happen whenever you bind mount a file into a container. When I mentioned this to a friend, he immediately responded “oh yeah, never do that”, and went on to describe the horrible hacks he’s had to add to Ansible to sidestep the issue. The nicer solution is to just bind mount an entire directory if you can, as then it doesn’t matter what happens to the files within it. I really like having the config files sat alongside the Docker compose files, though; having to create a directory just to work around some bind mount weirdness upsets me.

Now I knew what the problem was, I found there was an issue raised against Docker twelve years ago⁴. The first response was “that’s expected”, and I fully agree with the author: “respectfully, that might be expected by you, but it was not expected by me”!⁵ As a result of the issue they added a nice note to the docs:

Note: Many tools used to edit files including vi and sed --in-place may result in an inode change. Since Docker v1.1.0, this will produce an error such as “sed: cannot rename ./sedKdJ9Dy: Device or resource busy”. In the case where you want to edit the mounted file, it is often easiest to instead mount the parent directory.

But in the intervening twelve years, both the note and the functionality described have gone missing. Ho-hum.

I found it interesting how I’ve only just hit this problem, given how long I’ve used Docker. But I realised that almost everything I run I’m happy to just restart. Cattle, not pets, and so on. My IRC bouncer is one of the few exceptions to that. The only other thing I regularly hot reloaded was Centauri, my reverse proxy, but that had a whole config directory mounted because it was shared between containers, so nicely sidestepped the foot-gun.

So lesson learnt: check for weird bind mount issues before raising issues about config hot reloading. It’ll join the esteemed company of “maybe the drive is full and causing completely unrelated problems?”, “perhaps everything is dog slow because the kernel ran out of entropy?”, and “did systemd sneakily take over that functionality while you weren’t looking?” in the troubleshooting checklist.

An IRC bouncer is basically an always-on proxy. It connects to the IRC networks for you, then your clients connect to your bouncer. The bouncer can then send incoming messages to all your different clients, cache them when you’re offline and replay them later, and lots of other nice things people take for granted in their chat apps these days. ↩︎
Join/part/quit spam is part of IRC, and clients have ways of handling it, but I still feel bad about doing it excessively. ↩︎
You can disable this in vim by setting backupcopy=yes. Good luck redoing all the debugging if you ever accidentally remove that from your vimrc, though! ↩︎
Which is weird, because Docker can’t possibly be that old. That would make me much older than I’m prepared to accept. ↩︎
If you read the thread they didn’t actually mean to sound so dismissive, but it’s still pretty funny. “Yes, it’s expected that the foot-gun causes your foot to hurt. Duh. What did you expect?” ↩︎

The longest way to represent a date

2026-03-14T00:00:00Z

The other day, someone on IRC posed this question: “What is the longest way to represent a date using any means possible that isn’t just repeated filler?”

Some people jumped for writing the date out in languages that had longer translations. My immediate reaction was instead to suggest an obnoxious string-based representation of a unix timestamp: “one second after one second after one second after … midnight on January 1st 1970”. It’s very repetitive, but it’s not filler: taking out any of the repetitions would change the value. Effectively it’s a successor function for unix timestamps, writ long. Some quick napkin maths suggests the full string representation would be around 30GiB¹.

An obvious approach to make it bigger is to make it more precise. If we do the same sort of successor function for milliseconds it’d be a bit over 1000x longer². It actually ends up being just over 35TiB³.

There’s no reason to stop there, though. You can step down to microseconds, nanoseconds, and so on… or… we can just skip right to the end. How about: “one oscillation of the caesium-133 hyperfine transition frequency after one oscillation of the caesium-133 hyperfine transition frequency after … midnight on January 1st 1970”? There are over 9 billion of those every second, and the phrasing is wordy. That comes out to almost 1ZiB⁴. If we pooled all the data storage on the planet together we could save a couple hundred of these timestamps.

One final step, then: why use the unix epoch when we could use the universe’s own⁵? We’re something around 4×10^17 seconds past the big bang, so… hold on, I need to look up some units… that’d be over 200,000 yobibytes⁶. There’s not actually a standard prefix for that order of magnitude, according to Wikipedia. I think it should be 200 robibytes. Does anyone have a contact at the IEC?

That is a big number. Is it impossibly big? If we wanted to track our current time, we’d need to write around 600GiB/s⁷ to disk. That’s a bit more than we can manage at the minute, but isn’t completely outrageous. What about storage? Apparently hard drives require around a million atoms to store a bit of data. There’s some research showing it’s possible to use as few as 12, but I don’t think it’s anything that can be used at scale anytime soon⁸. So just for the direct data storage, not counting all the other infrastructure you need for a disk drive to work we’d need around 10^36 atoms. If we sourced our atoms for our local paperclip maximiser we’d need around 200 trillion paperclips. For just one timestamp.

On the plus side, this timestamp format would compress wonderfully.

17 bytes of repetition * 1773528583 seconds ~= 3×10^10. ↩︎
There’d be a thousand times more repetitions, and each one would have the extra five bytes from the “milli” prefix. ↩︎
22 bytes of repetition * 1773528583000 milliseconds ~= 3×10^13. ↩︎
72 bytes of repetition * 1773528583 seconds * 9192631770 oscillations per second ~= 1×10^21. ↩︎
Other than it being impractical, not known to a decent accuracy, and the myriad other problems, of course. ↩︎
72 bytes of repetition * 4×10^17 seconds * 9192631770 oscillations per second ~= 3×10^29. ↩︎
72 bytes of repetition * 9192631770 oscillations per second ~= 6×10^11. ↩︎
Not that we could scale conventional drives up this much, either. ↩︎

An interesting Tailscale + Docker gotcha

2026-01-29T00:00:00Z

As I’ve written about before, I use Tailscale for a lot of things. I thought I had it set up in a reasonably secure manner, but I recently noticed a problem.

I use Tailscale’s ACLs to limit what each node can access, based on the tags I apply to it. So an app node can’t access anything via Tailscale, while an integration or server node can access things tagged with either app or integration. This is expressed pretty simply in the Tailscale ACL JSON:

{
	"tagOwners": {
		// Servers that can be SSH'd into
		"tag:server": [],
		// Applications that are exposed on tailscale but never connect out
		"tag:app": [],
		// Things which talk to other services over tailscale (connecting to apps etc)
		"tag:integration": [],
	},
	"grants": [
		{
			// Users can access everything
			"src": ["autogroup:member"],
			"dst": ["*"],
			"ip":  ["*"],
		},
		{
			// Servers and integrations can access integrations and apps
			"src": ["tag:server", "tag:integration"],
			"dst": ["tag:integration", "tag:app"],
			"ip":  ["*"],
		},
	],
}

Over the past week I’ve been setting up a private Forgejo instance behind Tailscale, complete with an actions runner that runs things using a docker-in-docker container. I didn’t want the runner knowing anything about Tailscale, so I had it configured to speak to Forgejo direct over HTTP (forgejo:3000) instead of using full Tailscale HTTPS URL that I use when accessing it (http://git.example-net.ts.net/)¹.

Everything was going fine, until I forgot to do that translation… and it worked. My Forgejo action runners could access anything on my tailnet. I run several things on Tailscale that just have authentication turned off, on the basis that only authorised devices can access them. Things like the admin interface for this website. I definitely didn’t intend for any workflow I run on my git server to have access to edit my website!

This wasn’t just limited to Forgejo, either. Any docker container I was running could access the tailnet. In hindsight it’s fairly obvious why: the host is running Tailscale, connected as a node tagged with my server tag. That creates a tailscale0 interface, and automagically sets up iptables rules to route Tailscale traffic over the interface. Docker also automagically sets up iptables rules to bridge traffic, and apparently these two sets of rules interact in such a way that traffic from Docker containers is allowed to route via the tailscale0 interface.

I say it’s fairly obvious in hindsight — there’s no reason why Docker would special case any particular host interface after all — but it still feels pretty surprising. Because both bits of software inject their own iptables rules, I never really had a good mental model for how they interact. The host Tailscale node was a completely separate building block to Docker. It would be a pain to use either of them if they didn’t do these rules, but it’s also one of the reasons I don’t really like “magical” things².

There are lots of ways to fix this, but none of them feel particularly great. You can configure both Tailscale and Docker to not automatically fiddle with iptables and handle the rules yourself, but I really hate dealing with iptables³. As a stopgap I did hold my nose and add some iptables rules to drop traffic to the tailscale0 interface if it originated from the IP ranges that Docker was configured to use:

iptables -I DOCKER-USER -s 192.168.0.0/16 -o tailscale0 -j DROP
iptables -I DOCKER-USER -s 172.17.0.0/12 -o tailscale0 -j DROP

The DOCKER-USER chain is a nice little escape hatch; it comes before the main auto-generated DOCKER chain, and Docker leaves the rules in it alone.

So I added these rules, and felt pretty good about myself, and then… everything started breaking in weird ways. After some debugging I realised the problem was DNS⁴. The server’s DNS resolver is 100.100.100.100, a special Tailscale address. This is so that it can resolve tailnet hostnames via MagicDNS (and so I don’t have to configure my custom DNS servers manually on each device; Tailscale does it for me). My new iptables rules inadvertently dropped all the DNS packets coming from docker containers. D’oh.

Obviously the solution here is to double down and add MORE iptables rules:

iptables -I DOCKER-USER -s 192.168.0.0/16 -d 100.100.100.100 -o tailscale0 -j ACCEPT
iptables -I DOCKER-USER -s 172.17.0.0/12 -d 100.100.100.100 -o tailscale0 -j ACCEPT

This got DNS working again, but it all feels a bit gross. Not least because to actually make these persist you need to use iptables-save, and then you also get all the rules that both Docker and Tailscale have inserted. I came across a script to filter out the Docker ones, but… yuck⁵.

I realised a cleaner idea might just be to lock down what server tagged nodes could access within Tailscale itself. That way I can avoid touching iptables at all. It’s handy to be able to curl services from the host when debugging, but it’s not really necessary. So I removed that access, and… stuff broke again. I’m using my Forgejo instance as a registry for some of the docker images I run, so the docker daemon needs to be able to reach it. I ended up making a new tag for infrastructure, which can be accessed from server devices. This does still allow all the docker containers to reach Forgejo, but I already have it set up with appropriate access controls and public/private repository splits. Forgejo is a service designed to run publicly, so this seems a reasonable trade-off for convenience. I used the tests feature of Tailscale’s ACL config to make sure I’d got the rules right:

{
	"tests": [
		{
			// Servers can only access infrastructure
			"src":   "tag:server",
			"proto": "tcp",
			"allow": [
				"tag:infrastructure:8080",
			],
			"deny": [
				"100.84.16.43:8080",
				"me@example.com:8080",
				"tag:server:8080",
				"tag:app:8080",
				"tag:integration:8080",
			],
		},
	],
}

The whole situation still feels a bit messy. If I ever get around to switching to nftables I might loop back and manually craft some rules for routing traffic, instead of leaving Tailscale and Docker to do their own thing.

I discovered later on that logging into the container registry at forgejo:3000 actually issued a redirect to https://git.example-net.ts.net/ so this was all basically for naught… ↩︎
I didn’t use Tailscale’s MagicDNS for a long time just because the word “magic” put me off. Only when I eventually got around to learning how it worked, and seeing that it wasn’t really that magical under the hood, did I change my mind. ↩︎
nftables seems far better in lots of ways, but I can’t really be bothered migrating. Maybe next time I reimage the server for whatever reason… ↩︎
It’s always DNS… ↩︎
Again, nftables would almost certainly help here. It actually has (gasp) configuration files. But again, I really didn’t want to spend the time migrating. ↩︎

Surge protectors: marketing vs reality

2026-01-24T00:00:00Z

A while back I went down a deep rabbit hole looking into surge protectors, and what all the different numbers mean, and how that affects things in case of a voltage spike. Then I didn’t really do anything with the information, other than bore a few friends, and look around in despair at all the shockingly bad products out there. Time to fix that!

I’m coming at this from the angle of a computer user in a country with very good electrical regulations. If you’re protecting something else, or live somewhere that doesn’t believe in grounding things, your mileage may vary.

Building a better mental model

I think when most of us think of surge protectors, we think of an extension lead with some magical property that stops surges and protects everything plugged into them. It’s a bit like the shield on the USS Enterprise. If we put the shields up in time, they’ll stop everything thrown at them, until at some point they’re overloaded and stop working. Only then will we have problems. There’s even a little LED that goes out when she cannae take it any more, cap’n.

Of course, if that was actually the case, I wouldn’t be writing a blog post. Surge protectors are more like the crumple zone on a car. If you hit something, the crumple zone will absorb some of the impact, but you can quite easily still get injured. If the impact is big enough then the crumple zone will bleed some energy, but you’re still going to have a very bad time. My point here is that it’s not a perfect shield, can be overcome with a single excessive impact, and doesn’t magically recharge back to full strength.

The numbers, Mason! What do they mean?

To understand what protection these things really offer, we need to look at a couple of numbers. Unfortunately, they’re not the numbers that are displayed in the marketing. Sometimes they’re not even on the spec sheet. Most of the time they’re on the actual device, and if they’re not then it’s safe to just assume things are bad.

The most important number is the let-through voltage, U_p. It may also be called the clamping voltage, the voltage protection rating, or the VPR. This is the voltage that will be let through, before the surge protector does anything¹. We use 230V mains, with a +10%/-6% tolerance. So we shouldn’t be seeing anything above 253V. If you were designing a surge protector, you’d want it to engage a little above this, right? Maybe call it 300V so it doesn’t cut in prematurely? If you have a surge protector nearby, I invite you to try and find its U_p value. If you don’t have one, you can follow along with mine:

A not-very-good surge protector. Please take a moment to consider how difficult it was to make this text readable.

Yes, that’s 1,500 Volts. Up until that point the surge protector does nothing. Your computer’s power supply just has to deal with it. That’s not even the highest I’ve seen, either. It’s just the closest I had to hand.

So what are the other numbers? U_c is the maximum continuous operating voltage. That’s probably fine — in the worst case it’ll slowly degrade over time if the mains rides the 253V edge — but at the same time, would you not spec it for 275V or more given that? For the most part, we don’t really care about this, though. If the surge protector has the right kind of plug on it, then it’s probably got a U_c in the right ballpark.

Then we have U_oc, which is the open circuit voltage. This is one of the numbers that might end up on the marketing, because it can be big! This is the surge voltage that the device can sustain without failing itself. So for this surge protector, it won’t do anything for surges up to 1.5kV, between 1.5kV and 4kV it will clamp the voltage, and above 4kV it might fail in some manner. That failure could be failing open and leaving your computer to deal with the rest of the surge (the little LED would go out, though!).

The number not on the device that’s on all the marketing materials is the “Joule rating”. That’s how much energy the thing can absorb before it fails. That can be gradually drained by small surges over time, or by a big one. Something in the realm of 1kJ seems to be a “good” value, but what does it actually mean? Say we had a surge of 1.5kV, our 1kJ of protection would cover 0.66 Amp seconds. Surges are typically very short; let’s say one lasts 2µs. That energy budget would allow for 333kA of current to be handled! That’s an order of magnitude more than a lightning strike! Amazing! Except… There’s also a maximum surge current rating, and I guarantee it’s less than that. The actual number on the Joule rating is basically useless given all the other constraints, but the bigger the number the more hardy the protector will be, in general.

Oh, one more thing on that Joule rating. Sometimes surge protectors will have multiple different protection devices inside, especially when they protect other connectors like coax or telephone cables. Sometimes the Joule rating will just be the sum of all the individual protectors, so is even more useless. Yay marketing.

How much abuse can a PSU take, anyway?

OK, so it turns out surge protectors are… underwhelming, shall we say? If there’s a surge, your computer is going to be involved. So what can PSUs actually deal with?

Turns out modern PSUs have surge protection built-in, along with all sorts of other “why is the electricity not electricitying right?” safeguards. I can’t find a single manufacturer that actually puts any numbers to that, though.

If you were to open one up and look inside, you’d see something like this:

I spy with my little eye… something beginning with MOV!

That little thing hidden in heatshrink is a MOV, or Metal Oxide Varistor. Also known as a Zinc-Oxide Non-liner Resistor, or ZNR, as it’s labelled in the picture. It’s basically a resistor that varies its resistance based on the voltage. So it can have a high resistance at low voltages, and then after, say, 300V it could start dropping off. Can you guess what component is inside basically all consumer surge protectors? Yeah, these things! So, as mentioned, I don’t have numbers to back this up but I’m going to go out on a limb and say that the MOV in a £130 PSU can probably handle at least the same as the MOVs in a £7 surge protector.

It’s hard to imagine a situation where there’s a surge that would have destroyed the PSU that would be mitigated by an external surge protector. It’s probably either going to take both of them out, or they’ll both survive. No Enterprise shields here, I’m afraid.

So is it not worth having a surge protector at all? Not quite. MOVs degrade with use, so if a surge protector handles some smaller surges, or takes bites out of bigger ones, it might prolong the life of the PSU. Maybe that’s worth it, especially if you find one of the (increasingly rare) ones with a decently low clamping voltage.

Addendum: covered equipment warranties and magic smoke

A bunch of surge protectors come with a warranty for downstream equipment. That sounds like a great deal, right? Even if there’s a huge surge that the protector can’t handle, at least you can replace the equipment? Alas, no. These warranties only cover if the surge protector doesn’t operate within its specifications. If you go over the max voltage, or the max current, or the max energy and all your equipment blows up, then the surge protector is merely working as designed. It’s meant to fail in those circumstances, and at that point all bets are off. No warranty money for you.

The other thing to bear in mind is that — in the UK at least — significant power surges aren’t common at all. If you travel with your computer then you’re more likely to come across dodgy electrics that can fry your computer than you are to hit a power surge. I’ve been to a lot of LAN events and have never heard of a surge protector popping and saving a computer; on the other hand I have seen an entire row of computers release their magic smoke because the electrician hadn’t connected the three-phase supply properly. There’s absolutely no protection to be had from that!

Photo credit: thanks to Greg for supplying the picture of the PSU so I didn’t have to take my computer apart.

Well, actually, it does a tiny bit before U_p because it’s not a binary switch, and life is messy. It won’t do much of anything before U_p. ↩︎

The meaning of life

2026-01-18T00:00:00Z

Now that’s a grandiose title for a blog post! Blame Jeremiah Lee, who selected it as the theme for January’s IndieWeb Carnival. I’ve not taken part in this before, but it’s basically a shared writing prompt. One person selects a theme, other people write about it on their own sites, and then the host does a round-up linking to all the various responses. I’ve come across it a few times before, but the topics have never really engaged me; they don’t feel like the sort of thing I’d write about. But… why not?

A Guide to the Good Life

The thing that actually tipped the scales for this particular topic was a book I was reading: A Guide to the Good Life by William B. Irvine. It’s basically a modern introduction to Stoicism. Not only is there a strong overlap between that and the meaning of life, one particular idea resonated with me:

In ancient Greece, when schools of philosophy were still prominent features of the cultural landscape, there were any number of schools to which parents could send their children. Suppose we could travel back in time to 300 bc and take a thinking person’s walking tour of Athens. We could begin our tour in the Agora, where Socrates a century earlier had philosophized with the citizens of Athens. On the northern side of the Agora we would see the Stoa Poikile, or Painted Porch, and holding forth there might be Zeno of Citium, the founder of the Stoic school of philosophy. This “porch” was actually a colonnade decorated with murals.

The idea that you could just wander around a city and come across people giving their considered opinions on philosophy is… something. Do we have any actual equivalent of that in the modern ages? Obviously you do get people espousing their views on the street, but they tend to either be proselytising or grinding a particular axe. And even if there was a modern day Socrates talking in Speaker’s Corner, would anyone actually stop to listen? We do have books, and speaking engagements, and so on, but they feel a lot more impersonal, and in a lot of cases motivated by money or politics or some other agenda. The philosophers of ancient Greek and Rome seemed to actually practice what they preached; as well as talking in public, and instructing in their schools, they’d write letters helping and advising people, or debating points of philosophy.

Some of that behaviour exists in academia, I’m sure, but it’s not really accessible to the person on the street in the way that it once was. But we do have personal websites and blogs. People just exchanging ideas, speaking out in public, with (generally) no expectation of reward or recognition for it. Is the “IndieWeb” the modern Agora? Probably not, but maybe it gives us some aspects of it that we otherwise wouldn’t have?

The Stoic approach to life

The Stoics believed in living a virtuous life; living as we were designed to live, in accordance with nature. A lot of those terms might be a bit loaded to the modern ear, and “designed to live” is awfully vague. I think this quote expands on it pretty well, though:

And for what function were people designed? To answer this question, the Stoics thought, we need only examine ourselves. On doing this, we will discover that we have certain instincts, as do all animals. We experience hunger; this is nature’s way of getting us to nourish ourselves. We also experience lust; this is nature’s way of getting us to reproduce. But we differ from other animals in one important respect: We have the ability to reason. From this we can conclude, Zeno would assert, that we were designed to be reasonable.

And if we use our reason, we will further conclude that we were designed to do certain things, that we have certain duties. Most significantly, since nature intended us to be social creatures, we have duties to our fellow men. We should, for example, honor our parents, be agreeable to our friends, and be concerned with the interests of our countrymen.

It all seems eminently reasonable. But in a world of fake news, social media, culture wars, and everything else, our ability to reason often seems forgotten. Hell, even being agreeable seems like it’s out of vogue at the moment. Would the Stoics despair if you transported one of them to the present day? Probably not. One of the other tenets they held was, well, being stoic. There was a concept of tranquility:

Stoic tranquility was a psychological state marked by the absence of negative emotions, such as grief, anger, and anxiety, and the presence of positive emotions, such as joy.

To get to this magical state, you need a form of detachment. Not in the sense of being completely passive and impartial as you float through life; that’s not how we’re “designed to life”. But in the sense of not letting outside events influence your inner state. When someone says something horrible, they don’t have the power to actually make you feel bad; that’s something you do. And I fully accept that it’s very easy to say that, and very hard to actually practice it.

This is actually a concept shared with many other religions and philosophies. Buddhism has the idea of Nekkhamma, Jainism and Hinduism have Vairāgya, and so on. Even if you don’t put any stock at all into religious teachings, it’s interesting that this concept comes up again and again.

If you’re like me, you probably have thoughts on all this. Sure, anxiety-free, anger-free life is probably nice, but how does that relate to the meaning of life and, anyway, shouldn’t you be angry about some things? The Stoics (particularly the Roman ones, who tended to not be so into physics and ethics) believed that this tranquility made it easier to focus on being virtuous. That makes sense to me; if we manage to get off the hedonistic treadmill of wanting shiny new things, of hoping people like our posts, and so on, then there’s surely more time in life for other pursuits. As for anger, I think the point is you don’t let the emotions drive your behaviour. There’s a difference between getting angry at what someone is saying and punching them in the face, and hearing someone, calmly and rationally assessing matters, and then punching them in the face. Maybe it’s best for society to punch certain people in the face. The Stoics were certainly not pacifists. Marcus Aurelius is one of the most well known, and he was Emperor of Rome. He’s hailed as one of the few good emperors, but you can bet he had an awful lot of blood on his hands even so.

Putting it into practice

It’s all well and good going on about not letting things bother you, but it’s very much easier said than done. The book introduces the concept of “negative visualisation”: imagining the negative things that could happen in your life, and thus starting to accept them. It also helps you to appreciate things that you do have, that you otherwise taken for granted. I’m sure everyone’s imagined what would happen if you lost your home, or your job, or so on… but what if you didn’t have your favourite mug? A particular tool? A certain piece of art?

I’ve heard of gratitude journals before. I’ve even tried keeping one for a while. There’s science showing it’s beneficial for mental health. But I always faded off after a short while. Once you tick off the big things: friends, family, food, etc, it feels like a stretch. Negative visualisation feels like a much better approach to me. I’m about to eat an apple; at the end of the day I’m not going to think back and write about an apple in a gratitude journal. But I can think briefly, in the moment, about not having the apple. Do I need to prepare myself for an apple-less life? Not really. But do I now appreciate the apple a little bit more, and take it for granted a little bit less? Yes. Does that make me a bit more tranquil? A bit less likely to wish I had something tastier than an apple? Also yes.

This process dovetails into the concept of impermanence, another concept found in Buddhism and elsewhere. Each apple could be the last one you ever have. If you knew that in advance, how would it change your approach? You’d probably savour it a bit more, appreciate it a bit more, and most of all not take it for granted. There’s a lot of pithy sayings about treating each day as if it’s your last, but at that level they’re a lot more nebulous than helpful; appreciating an apple, though? That’s something I can do.

It seems at first glance that thinking about negatives should be depressing or anxiety inducing. There are only so many reasons that this could be my last apple, and most of them involve something pretty unideal happening to me. But I don’t think it’s actually that glum. You don’t dwell on the negative, instead you use it to inspire a positive. And the alternative is to just sleepwalk through the process, not really paying attention, not gaining any enjoyment from it.

Bringing it back

Thanks for sticking with me on that tangent. You’ll be glad to know I’ve finished eating my apple now. The topic for this post was meant to be “the meaning of life”, not “thoughts on eating apples” or “living a Stoic life”, so allow me to try to tie it all together and pretend that I had a plan.

Life has no inherent meaning, it’s just a biological process. But that doesn’t mean we can’t seek to have a meaningful existence. The Stoics believed that involved being reasonable, and one of the approaches to give the reasoning room to happen is to strive towards an inner state of tranquility.

Obviously the Stoic approach isn’t the only one. And I’m not sure I did their philosophies any justice in my writing here. If it sparked your interest, though, I highly recommend picking up the book. If not, other approaches to life are available…

Be excellent to each other… and party on, dudes.