Sandeep Shetty's Blog

The Hyderabadi Biryani Problem

2020-12-13T08:14:00.001+05:30

Everyone says Hyderabadi Biryani is amazing but if you say you didn't like the Hyderabadi Biryani you tried, they will ask you which restaurant you tried it at and then the inevitable answer will be "Oh, that one isn't good, you should try it at XYZ Biryani House" and so on till infinity. There is ALWAYS a restaurant where the biryani is better than the one you didn't like.

Stumbled upon another security hole at a well know Indian company's website that is leaking their customer's sensitive personal information

2020-10-03T08:42:00.015+05:30

I've stumbled upon another security hole at a well know Indian company's website that is leaking their customer's sensitive information.

Just like the Myntra security hole that I found a long time ago (which resulted in them setting up their Responsible Disclosure Policy), this hole too is just something I stumbled upon while using their website regularly. I didn't have to do anything special that a regular user wouldn't do and there is no "hack" involved. It simply seems to be a case of bad implementation or a bug that anyone with a decent technical background can easily recognize and take advantage of.

My Myntra report was in Dec 2013 and in the 7 years since, nothing much has changed with Indian companies taking security seriously or even setting up a basic responsible disclosure policy 😔.

For now I've sent an email to security@ their website address which thankfully didn't bounce and I've also messaged them on a few of their social accounts. Will wait for them to respond and give them time to fix it before publishing more details.

Update (Oct 5, 2020): emails to security@ their website bounced after 24 hrs 😔

Pic source: https://www.needpix.com/photo/download/929205/key-hole-eye-by-looking-spy-spying-on-watch-burglary-burglar-privacy-policy

Skinners are my new favorite minimalist footwear

2019-09-24T03:58:00.002+05:30

8 years (March 2011) and 5 pairs (2 Classics, 1 Sprint, 1 KSO and 1 KSO EVO) of Vibram Five Fingers (VFF), 5 years (August 2014) and 4 pairs (1 Sensori Venture, 1 Amuri Venture, 1 Amuri Cloud, 1 Amuri Z-Trek) of Xero Shoes, and 2 years and 2 pairs for Skinners later, Skinners are my new favorite minimalist footwear. Here's why.

Skinners on a trek passing through streams, slippery and sharp rocks, pebbles, gravel and the works.

Even though I got my first pair of Skinners back in July 2017 (I was one of the original backers of their Kickstarter back in June 2017) I didn't use them much primarily because, as a long time VFF user, my toes felt very constrained in them (like in a regular shoe). I ended up using it as a backup shoe (in case the VFFs and Xeros give up on me, which they have) for my travels because it's super compact and easy to pack. So they were stored away ready to be used in case of emergencies, which basically meant I didn't use them much.

A couple of months ago, when the nylon lace on my Xero Venture tore during a trek, I had to use my Skinners and really loved it. The trek was during the rains, with slippery and sharp rocks, pebbles, gravel and the works, and I really loved how Skinners felt. Having tried that same trek earlier, completely barefoot (only for a short distance and ended up with bruises on my feet), I really appreciated the minimal yet right amount of protection the Skinners provided. I was hooked.

I needed the same feel as Skinners and started looking around again to see if I could find alternatives that wouldn't constrain my toes and stumbled upon suggestions to try Skinners one-size bigger than your normal shoe size (especially if you have wide feet, which mine are and have become even more wider after I gave up on regular footwear). So I decided to give it a shot and ordered another pair of Skinners, this time, one-size bigger than my normal shoe size.

Having used them through most of the monsoon season here in Mumbai and for a variety of purposes including trekking, I can now say Skinner are my new favorite minimalist footwear.

While the reasons why you would like one over the other will be different for everyone, here are my reasons for why I prefer them over VFFs and Xeros:

Skinners have the most minimalist sole of the lot offering more connection and feedback from the ground.
I prefer minimalist footwear that cover my feet because it keeps my feet clean which is important to me because otherwise they get dry and crack when exposed to dust and the elements. Both VFFs and Skinners satisfy this criteria. When it comes to small puddles, I think Skinners do a better job as the water-resistant sole wraps around till the top and offers more protection (I used to get water seeping in on the VFFs where the sole meets the upper).

The wrap around water-resistant sole is perfect for small puddles.

Wraparound footwear also feels more minimal to me in the sense that I can use my feet naturally without having multiple elements of the footwear get in the way like they do with the Xeros (had a few close calls while driving because the soles would get in the way and get stuck sometimes on pedal or mat).
Except for my first few pair of Vibram Five Fingers (Classic, Sprint and the orignal KSO) each of which lasted me over 4 years, my experience with the newer VFFs (especially the KSO EVO) hasn't been very good when it comes to durability. I've had a similar experience with Xeros. Since Skinners don't have glues or seams it looks like they'll last longer as there are no parts that can fall apart. The sole can still get worn out and the upper can possibly tear but I'll have to see how they hold up.

The hole that the lace goes through, torn on my first Xero.

Skinner are super compact and easy to carry along while traveling as a second shoe for emergencies, multi-sport (to slip into after bouldering or skateboarding) or the gym.
Skinners are the easiest to get into and out of.

A note about repairability: This is important to me because I would rather pay a premium for a pair that lasts me a long time than pay less and have to change my shoes very often resulting in more waste at the landfill. The one thing the Xeros have going for them is that you can easily repair them at least when it comes to the laces. With the VFFs I couldn't find anyone in Mumbai to glue the soles properly when they come off and have lost 3 of them to bad repair work (glue that made them very stiff and painful to wear). Hopefully the glue-less and seamless design of Skinners means they might last longer.

Replacing the torn lace with a paracord I picked up from Amazon.

Good as new!

I recently also got the Vivobarefoot Primus Lite II BIO to try out (so your can look forward to a review of those) but I don't see myself wearing them for a while till I wear out the Skinners.

A word of caution: I wouldn't recommend Skinners as your daily-everything shoe if you're just starting out transitioning to minimalist shoes and would suggest easing into them slowly.

Native apps can't be trusted

2016-11-25T18:00:00.001+05:30

The one thing the web has gotten right to some extent (thanks to the beauty of REST/HTTP) at least compared to desktop and native apps, is how it can uniformly show users if they are using a secure connection to a trusted source. The browser does this by clearly and consistently giving various hints (see Fig 1 and Fig 2 below):

Fig 1. Firefox indicating that you are securely connected to GitHub.

Fig 2. Chrome indicating that you are securely connected to GitHub.

There is no reliable, trustworthy and consistent way for non-technical users to do this on desktop and native apps.

This is how you add funds to your Paytm wallet from within the Uber app (see Fig 3 below):

Fig 3. Page to add funds to your Paytm wallet from within the Uber app.

Notice the following in Fig 3:

Since I opened this from within the Uber app and this "page" is running "inside" the Uber app, I have no way to verify if what I'm seeing is in fact a page severed by Paytm or a spoofed page that Uber is presenting to me.
Even if I were to trust Uber here, there is no way for me to tell if this is happening over a secure connection.
Say I'm willing to accept that this is in fact a page served securely by Paytm, I have no way to know if Uber has injected their own code to intercept everything I enter on that page.
And now the really ridiculous bits (circled in red in Fig 3 above): The text that reads "Your payment details are secured via 128 Bit encryption by Verisign" and the various logos that are displayed at the bottom of the page are something I have to take at face value. These are also app-specific and not consistent.

Also, note that I (as a non-technical end-user) have no way of knowing if all communication the Uber app is doing with it's servers is over a secure channel. I just have to "trust" that they are doing the right thing. Of course, as a technical user I could intercept the traffic on my phone and see how it's been sent, but that is exactly the point: You have to jump through a lot of hoops to "verify" what is happening.

The current state of affairs for security on native apps is absolutely ridiculous and it's crazy that we all put up with it.

Full Disclosure: I work at Zeta (at the time of writing this blog post), but the views expressed here are my own and not of my employer.

What native apps get wrong over web apps

2016-11-25T04:24:00.001+05:30

They need to be installed. This in itself is a big drawback.
They need to be separately developed for each target platform. Unlike the desktop app days where Windows was almost ubiquitous, with mobile you have to support 2 platforms.
They can get outdated if users don't upgrade. We are doomed to repeat the same mistakes we made with desktop apps.
Deployment is blocked on a black box not in your control (aka the app store approval process). Kiss continuous deployment goodbye.
They have no trustworthy way to indicate to users that secure channels are being used to communicate secure information (unlike the address bar in web apps that clearly shows if the connection is secure and to the right place). If you think about it, there is a beauty to REST/HTTP that makes this possible.
Each app needs to reinvent the wheel and ship infra that could have been shared, e.g., local data store, caching, etc.

Security breach at Myntra.com exposes customer's personal information, order history and more

2013-12-07T07:24:00.000+05:30

Update (added on 3 Dec 2013): Based on my feedback Myntra.com has now setup [email protected] for reporting security issues and a Responsible Disclosure Policy page. Kudos to them for taking the first step towards a better responsible disclosure process and setting an example for other Indian companies.

Last week a bug on Myntra.com let anyone with an account take over random customer accounts and highlighted the lack of responsible disclosure processes among Indian companies.

On 28th November (2013), Myntra.com held a 3-hour (8-11pm) invite only Winter Sale event where a few select customers got an additional 31% off on all orders above a certain amount.

I was one of those customers and decide to login to my Myntra account to see the coupon, except I had forgotten my Myntra account password. So I went ahead and put in my email address and clicked on the forgot password link. As expected I got an email with instructions, to click on a link to set a new password. What happened next was very scary.

I clicked on the link and landed on the page on Myntra.com to set a new password but instead of my email address I saw someone else's email address pre-filled in the form. Curious to see what would happen, I went ahead and put in a new password and lo and behold, Myntra.com had let me take over another customer's account.

To see if this was repeatable, I went through the forgot password flow again and just like before it had another random customer's email address pre-filled in the form and let me take over that customer's account.

HOLY SHIT. Myntra.com just let me take over two customer accounts. No fancy hacks, just a scary little bug that presented other Myntra customer accounts to me on a platter.

So the first thing I did was see if I could find anything on Myntra.com about responsible disclosure or a security contact but found nothing. So I sent an email to [email protected] and it promptly bounced with the message "The email account that you tried to reach is over quota".

Next I got in touch with them on Twitter and 13 hours later someone got in touch with me, 16 hours later I was speaking to a Tech Lead from Myntra.com and 9 days later I have confirmation from them that they have fixed the bug and put measures into place to ensure this doesn't happen again.

Note (added on 8 Dec 2013): The bug was fixed on the same day I reported it and the 9 days mentioned above includes time they took to monitor the fix and the Tech Lead at Myntra.com and me having issues around coordinating the final confirmation phone call.

I don't know how long this bug was live and how many customers accounts were affected but if your account was one of the affected ones, it means someone had COMPLETE access to your account, your personal details like your address and phone number, your order history, your myntra credit points, your saved payment details, your wishlist and your shopping cart.

Apart from the privacy concerns, the biggest threat that you need to protect yourself from, with a security breach like this is that it opens you up to Social Engineering Attacks where anyone with this privileged information can pretend to be from Myntra.com and use it for malicious purposes.

While a lot of people reading this will focus on Myntra, I think it's important to focus on what this incident can teach us about the lack of Responsible Disclosure processes among Indian companies.

If you run an online service (and especially an ecommerce one) you MUST have a responsible disclosure process in place. The Open Web Application Security Project (OWASP) has a good primer on managing your security issue disclosure process. At a very basic level you should atleast have a security@ email address configured. Having a dedicated page for responsible disclosure on your website is an added bonus.

Here are some examples of good responsible disclosure pages to get you started:

Lastly, I think it's important for companies to be transparent and honest about security/data breaches. Hiding details about breaches from your customers makes them vulnerable to all kinds of attacks. Security/Data breaches happen all the time. The only way customers can protect themselves is by being informed.

Indieweb Mention Test

2013-06-11T00:22:00.004+05:30

This is a non-specific mention of http://www.sandeep.io/39.

Indieweb Repost Test

2013-06-11T00:17:00.002+05:30

Check out http://www.sandeep.io/39.

Indieweb Like Test

2013-06-10T06:34:00.002+05:30

I like http://www.sandeep.io/39.

Really Simple Social Blogging

2013-06-09T01:25:00.001+05:30

A proposal to implement a decentralized Tumblr/Facebook/Twitter like social blogging platform using simple things like WebMention and Microformats. This is based on some experiments I'm doing with Converspace on sandeep.io and was inspired by The First Federated #Indieweb Comment Thread.

Based on usage, it looks like I primarily do 4 things on sandeep.io:

Post original content. This could be text (both short and long form), links, photos, videos, quotes, etc. (http://www.sandeep.io/19)
Repost content from others I find interesting. (http://www.sandeep.io/36)
Comment on content from others. (http://www.sandeep.io/32)
Like content from others. (http://www.sandeep.io/33)

Turns out this is also broadly what you do on Tumblr, Twitter and Facebook:

Tumblr: blog, reblog, comment and like.
Twitter: tweet, retweet, reply and favorite.
Facebook: update status, share, comment and like.

So I set out to see how this could be done in a decentralized way across the #indieweb. A couple of experiments later, I think I have a simple solution for achieving this, using nothing more than simple things like WebMention and Microformats.

The "social" part of this is letting others know that you have done one of those 4 things listed above and especially the person whose content you've reposted, liked or commented on.

This is where WebMention comes. It's a simple way to let any URL on the web know that you've linked to it on your site. The problem however is communicating the context in which the URL was mentioned:

Was it just mentioned in passing along with other content?
Was it's content reposted?
Was it liked?
Was it linked to by someone commenting on it?

Taking a cue from the the experimental u-in-reply-to microformat, I'm using the following experimental classnames for links within h-entry:

u-mention

I'm actually not using this because if a link within an h-entry does not have any of the classes below it is assumed to be a simple mention.

u-repost (http://pin13.net/mf2/?url=http://www.sandeep.io/36)
u-in-reply-to (http://pin13.net/mf2/?url=http://www.sandeep.io/32)
u-like (http://pin13.net/mf2/?url=http://www.sandeep.io/33)

A target URL that receives a WebMention can retrieve the source URLs HTML content and look for the above Microformat classnames to figure out the context in which it was mentioned along with an h-card/p-author entry to figure out the person involved.

The target can then show:

Total number of likes along with the details of the people that liked it.
Total number of reposts along with the details of the people that reposted it.
Total number of mentions along with the URLs of the sites that mentioned it.
Comments along with the details of the people that commented on it.

See this in action here: Indieweb Federated "Likes".

An important part that is missing from the above is letting other people easily follow you and get updates when you post something on your site. A microformats based feed reader should solve that. Following someone also gives you the opportunity to send a WebMention to the profile URL of the person you followed which in turn allows that person to show a Follower count (using u-follow maybe) along with the details of the followers. I've yet to explore this but will be posting more details when I get to it and dogfood it.

Wishlist: A microformats search engine that crawls the web looking for microformats, especially h-card so I can search for people just like I can on silo social networks.

Here are some additional experimental classnames I'm considering but not yet using:

u-quote to be used when you quote text from a URL verbatim.
u-follow to be used when you follow/subscribe to a URL (usually a person)

Todo

A way to undo WebMentions (e.g., unlike) by deleting the source URL and sending a WebMention for which the target would receive a 404 in turn deleting the original WebMention.
I'm also hoping to extend WebMention to allow for private access to URLs to only the people that were sent a WebMention.

Updates

08 June, 2013

Added h-card search wishlist.

09 June, 2013

Added attribution to the @eschnou's indieweb comment thread that was the first instance I know of that combined something like WebMention (Pingback) and Microformats to figure out context. It went beyond the simple rel="in-reply-to" suggestion made in WebMention and read h-cards.
Added note about sending WebMentions to user profile URLs. (rememberd to add this thanks to this tweet by @benwerd)
Added note about private access. (rememberd to add this thanks to this tweet by @benwerd)
Added list of other experimental classnames I'm considering.

10 June 2013

Created the Todo section and added note about undoing WebMentions.

Extracting machine tags (aka triple tags) from a string

2013-06-07T05:17:00.002+05:30

Here's some working code to extract machine tags (aka triple tags) from a string. Possibly one of the ugliest regular expressions I've ever written.

References

Spec:

Regexes I found elsewhere:

Regex syntax I used:

unrolling-the-loop technique for quoted string with escaping:

Negative lookahead as an alternative to using backreferences within character classes.

Does polling scale better than push?

2013-06-06T14:53:00.002+05:30

For the sake of simplicity, given 10000 subscribers, 1 publisher and assuming resource required for serving 1 pull request is roughly equal to resource required for sending 1 push:

A hub that is pulled from every minute has to serve number of subscribers x 1440 requests per day, i.e., 10000 subscribers x 1440 requests per day irrespective of the number of updates.
A hub that pushes has to send (number of subscribers x number of updates) per publisher pushes per day i.e., 10000 subscribers x number of updates x 1 publisher pushes per day, i.e., 10000 subscribers x number of updates pushes per day.
So that's 10000 x 1440 for pull and 10000 x number of updates for push.
Therefore, if number of updates per day is greater than 1440, a hub that pushes will require more resources than ones that is pulled from.
More importantly, a hub that is pulled from will not require additional resources if the number of updates per day increases.

Would love to hear what you think (in the comments) especially if you think this might not be the case.

Notes

This assumes that >= 1 min latency is ok for your specific use-case.
Resource required for serving 1 pull request might not be equal to resource required for sending 1 push. Here are my notes for why, I would love to hear yours:

Given constant number of subscribers and publishers, a pull based system will experience a uniform load throughout while a push based system will experience load in bursts.
Push potentially uses less bandwidth though Pull can take advantage of caching.
Push has the overhead of subscribers not being available, keeping track of such subscribers and retrying several times.

Proof by induction doesn't work because with push not every subscriber is subscribed to every publisher.

See PushHubPullSub

This was inspired by my notes on Push vs Pull on the IndieWebCamp wiki.

PushHubPullSub

2013-06-06T04:25:00.003+05:30

publishers Push updates to a Hub and updates are Pulled by Subscribers from the hub.

PuSH (PubSubHubbub) is a good way to solve the publishers and hubs problems (offloading work and polling lots of sites respectively). The idea with PushHubPullSub is to simplify subscribers by having them poll the hub.

See Does polling scale better than push?

Update: Moved the Does polling scale better than push section to a blog post of it's own.

This was inspired by my notes on Push vs Pull on the IndieWebCamp wiki.

RecentChanges, a simple alternative to ActivityStreams

2013-05-31T12:15:00.000+05:30

For updates watch: https://github.com/converspace/recentchanges

Some thoughts on representing updates to a site inspired by wiki style RecentChanges:

Every resource (URL) has a RecentChanges endpoint.

The RecentChanges endpoint at each level of the (URL) hierarchy aggregates all RecentChanges under it.

The RecentChanges endpoint of the site aggregates site-wide RecentChanges.

RecentChanges only requires/uses 4 verbs: Post, Respond, Update, Delete. (open to renaming these but the idea is that 4 verbs are enough)

Examples:

Sandeep Shetty posted Foobar. (new post)

Sandeep Shetty updated Foobar. (edited an existing post)

AnonymousOnPurpose responded to Foobar. (commented on a post - could even be a response to a specific comment)

Sandeep Shetty deleted Foobar. (deleted a post)

Thinking About Metadata

2013-05-06T05:45:00.000+05:30

Some of my thoughts on tagging and metadata in Converspace:

Syntax over Interface: I prefer (from a user experience perspective) how tagging (and other meta-data like mentions, etc.) evolved on Twitter to be just syntax and became part of the content (without being obtrusive) with no special interface elements dedicated to them. This allows for the same interface to serve people that don't need them, and the ones that do. Invisible to the users that don't need it but yet, always there for people that need it.
Visible Metadata: My preference for tags being part of the content has the advantage of them being always visible (moves/hangs with the content). However, it also has the disadvantage of not being able to cleanly do things like private tags (like how Pinboard does with tags that start with a period. e.g., .secret_tag). One obvious advantage of private tags is that you can do stuff like what Selective Tweets does with the #fb tag, but without having a visible public tag: like this IFTTT receipe that crossposts Pinboard bookmarks to Twitter that have the .twitter private tag. For the specific use case of publishing workflows, I'm considering using (something I'm calling) local action tags (tags that start with &, e.g., &action_tag) that are ephemeral and consumed by the publishing workflow and not saved as part of the content. Action tags obviously cannot be interspersed with the content and will have to be added at the end. Still need to figure out how this will work when the publishing workflow is also adding machine tags at the end.

Update (after sleeping over it): Won't be implementing actions tags (as described above) because of it's limited scope (especially when it comes to allowing third-parties to participate in the publishing workflow) ~~and I'm on the fence about Machine/Triple tags~~.

Update (May 07, 2013):

Auto-tagging: Allow for the publishing workflow to automatically add tags (including Machine/Triple tags). This is hard when you don't have a separate tags property and only have one blob of text (content). For example, it might not make sense to add tags at the end of single-line post when it is missing an ending punctuation mark. To allow for auto-tagging, I came up with a syntax for trailing tags. Trailing tags are preceded by a blank line, starts with two spaces, followed by space-separated tags, followed by the end-of-string. e.g., "\n\n #additional_tag1 #additional_tag2". Trailing tags can be added at the end of content if they do not exist or tags can be appended to existing ones. I chose this syntax for the following reasons:

When viewing the Markdown, trailing tags appear slightly indented, which visually separates them from the rest of the content.
AFAIK, it doesn't conflict with existing Markdown syntax. This makes it invisible when rendered by processors that don't support it.

Update (June 05, 2013):

Machine tags are invisible metadata: Machines tags provide context for "machines" and should be syndicated but not displayed.

See also:

Webmention action

2013-04-29T05:24:00.002+05:30

Exicted to see all the action around webmention, a modern alternative to the pingback protocol I drafted.

http://tantek.com/2013/113/b1/first-federated-indieweb-comment-thread
http://aaronparecki.com/articles/2013/03/31/1/a-response-to-replies-i-received-on-my-post-an-open-challenge-to-app-net
Client library for sending webmention and pingback notifications: https://github.com/aaronpk/mention-client
pingback.me, a service to convert Pingbacks to WebMentions
http://indiewebcamp.com/comment
http://indiewebcamp.com/webmention
http://lists.w3.org/Archives/Public/public-rww/2013Apr/0078.html

Grains vs Milk

2013-04-07T02:55:00.000+05:30

"It's also important to consider the big picture when judging the suitability of various foods. It helps to tell stories about the food we eat, to think about narratives. Grains aren't just little morsels of protein, carbs, and fiber bred for our enjoyment. They are baby plant eggs. Those macronutrients are there to sustain the seed's growth and those micronutrients are there to protect it. They are the plant's lifeline to immortality. They are literally shaped by the hand of evolution to survive and ravage the digestive tract of the poor sap that swallows them and discourage further consumption. Grain is only food because we deemed it so. Dairy? Dairy is objectively, absolutely food. Its fat, protein, and carbs are there to be consumed, albeit by young cows, sheep, and goats. It's meant to spur growth, to pack on muscle and fat and weight. And yeah, eating dairy protein causes an insulin spike, but that can be useful if you know what you're doing." -- http://www.marksdailyapple.com/dairy-insulin/

Habit Domino, the simplest habit-forming/habit-tracking android app that could possibly work

2013-03-10T05:10:00.000+05:30

What started out as an audacious idea inspired by a death in the family, to build a game-like habit-forming/habit-tracking android app (codenamed World of Doers), got refined into the simplest habit-forming/habit-tracking app that could possibly work.

The basic premise of Habit Domino is that once you've committed to forming a habit, the simple act of recording the routine and visiting the app once a day, has a sort of domino effect, driven by awareness and emotion, that gets you to complete the routine consistently till it turns into a habit.

No Graphs. No Reminders. Just commit to forming the habit and visit the app once a day.

Just Enough

2013-03-10T04:37:00.000+05:30

There is a point at which a solution is just enough to solve a problem. Anything less and it won't solve the problem and anything more will only add marginally utility.

This is especially important because customers usually assign a certain value to a solution and therefore, are willing to pay a certain amount for it. Adding more features doesn't necessarily mean they'll pay more. Strive instead to refine your ideas by removing stuff till you're left with just enough to solve the problem at hand.

Ambition is the side-effect of a finite (limited) mind

2013-03-10T03:35:00.000+05:30

Since we have a finite (limited) mind we cannot possibly "see" things in their entirety. So we aggregate and summarize. Instead of seeing the journey that is someone's life, we focus on the destinations they're reached. It's little wonder then that we aspire to reach destinations instead of paying attention to the journey and price we pay to get to our destinations.

This post was inspired by Clayton Christensen's How Will You Measure Your Life? TEDxBoston talk from 2010 :

Fiction

2013-01-24T02:52:00.001+05:30

All memory is fiction. Facts are just part of the plot.

Explore

2013-01-24T02:51:00.002+05:30

Almost all good things in life are stumbled upon (found), not reached. Explore.

Finishing

2013-01-24T02:35:00.001+05:30

With yet another person in the family passing away, I find myself in that, by now, familiar zone of reflecting on all the things I haven't finished, that I want to, before I die. I imagine being told that I have 2 months to live. What would I do? What would I finish?

This state is very similar to the days leading up to a long vacation. The time when you're the most productive because you want to finish things so that you can get them out of the way and enjoy your vacation without worries.

I want to feel this way all the time. I want to always be ~~dying~~ finishing.

No Risk

2013-01-24T02:21:00.001+05:30

Taking risks won't seem daunting if you don't think in terms of right or wrong. Make a choice and execute full-on.

Password Free Database

2012-10-29T13:23:00.001+05:30

Got around to implementing Mozilla Persona for Converspace. It has its flaws but not having to store user passwords in the db is a big win!