Category Archives: rants

Tue, 18 Aug 2009

Code Comments

I’m a bit of a minimalist when it comes to commenting my code. This is probably in some ways a bad thing; code that is completely obvious to me in its function may be difficult to understand for others, and I’m often not so great at realizing this on the first pass.

So that leads me to the purpose of code comments:

The purpose of commenting your code is to inform readers of that code what a section of nontrivial or non-obvious code does.

At least, this is my definition. Opinions differ, I’m sure. I might also add to that a clarification: “readers” in this case may include yourself. Code you wrote may even be incomprehensible to you if a decent amount of time has passed.

From this definition you can also infer something else, that I believe it’s unnecessary to comment obvious code. In fact, I’d argue that it’s harmful to comment obvious code, because you’re making it harder to follow, and you’re adding a barrier in front of the reader being easily able to distinguish between trivial and nontrivial code at a glance. You also increase the length of the code fragment, which may make it more difficult to read and understand in its entirety (if you can’t fit the entire fragment on one screen, you’ll have to scroll back and forth to see the entire thing).

However, too often — very often, it turns out — I see things like the following:

/* take a reference */
g_object_ref(object);
/* free string */
g_free(str);

And one of my favorites:

/* set the label text to "Time Left:" */
gtk_label_set_text(GTK_LABEL(label), "Time Left:");

(Yes, I actually have seen something very similar to that, though I don’t remember what the label text was.)

How do these comments actually add anything useful to the file? Every time I see one of these, a little part of me dies inside.

Now, the last one is just silly. Even someone who has never developed using the gtk+ UI toolkit can figure out what that line of code does without the comment. If you can’t, then a code comment there probably isn’t going to be enough to help you overall in any case.

The middle one is equally silly, though it’s understandable that someone might not know that g_free() is the glib equivalent of free(). However, consider your audience: is an extra line of code for a comment really useful here?

The first one is not quite so easy for me to dismiss. It presupposes a few bits of knowledge:

  1. Understanding of what reference-counted memory management is.
  2. Familiarity with the “ref/unref” pair, as opposed to only being exposed to something like the OpenStep “retain/release” (or even the COM/XPCOM “AddRef/Release”) terminology
  3. At least passing knowledge of what a GObject is

Now, for code that makes heavy use of reference counting, I think presupposing #1 is not unreasonable. In this case, it doesn’t matter: the comment as presented will not help you if you don’t know what reference counting is.

Points #2 and #3 depend on your goals and potential audience. If you think that a decent number of readers may not be familiar with the “ref/unref” terminology, “take a reference” is probably enough to generate an “oh, duh!” moment in the reader’s head. As for #3, unless you intend your code to be able to act as a sort of GObject tutorial, that is, something that people aspiring to learn GObject programming might want to read, I think the comment there does not serve people unfamiliar with GObject. Regardless, most GObject-using code will probably be pretty confusing to someone who doesn’t know GObject, so whether or not you should comment g_object_ref() is going to be the least of your worries.

Now, I’m not going to claim that my code commenting is perfect… far from it. I could certainly stand to sprinkle comments a bit more liberally throughout my code. I tend to only comment public API (and then just a description of what the function does, not how it does it), and code fragments that are really nontrivial[1] and potentially hard to understand.

But there has to be a happy medium somewhere. While too-infrequent commenting can certainly make code harder to understand, I’d argue that too-frequent commenting is worse. It’s sorta like “the boy who cried wolf” in the sense that comments draw my eyes to them as a way of saying, “pay attention! This bit here is important!” (or tricky, or whatever). Overuse of comments just makes me start skipping over all of them, useful or otherwise.

[1] It’s worth noting here that this point further reduces my volume of comments. I generally prefer clear code over neat hacks, even if the neat hack represents a reduction in lines of code or a moderate increase in performance. If I write a section of code and then look at it again and see that it looks too complex, I’ll usually try to immediately rewrite it to be simpler.

Leave a Comment

Filed under everything, programming, rants

Wed, 6 Aug 2008

More Firefox 3 SSL Junk

Lately I’ve noticed a flood of Firefox 3-related posts regarding the new SSL error handling on Planet GNOME. It’s a little funny, as I was writing about this myself a little under two months ago.

Chris Blizzard posts in favor of the new arrangement, and points to an interesting post by Johnathan Nightingale explaining Mozilla’s position. Yes, agreed, Jonathan’s post is a good read, but the salient point is that the new UI is just awful from an average non-technical user’s perspective.

The extra clicks and somewhat abnormal flow (e.g. the need to click a button in the dialog to fetch the certificate) make it harder for the user to understand how to successfully add the exception. You might say that some false positives (i.e., users who fail to access a site that they really actually do want to access) is better than a user succumbing to a MITM attack, but I’m not sure I’d agree.

Equally importantly, the error messages make no distinction between the potential severity of the various SSL errors. For example, I’d say a self-signed cert on a site that you’ve never visited before is fairly low-risk. But a self-signed cert on a site that used to have a trusted cert would be a huge red flag. Domain mismatches and expired certs would fall somewhere in between. It’s hard for the average user to make an informed decision on risk/severity if they were to encounter both of these situations because the error messages and dialogs look exactly the same.

Addressing Johnathan’s main point about self-signed certs and level of security: as a highly technical/advanced user, I personally can say that, in the vast majority of instances where I encounter a self-signed cert, I really do just care about the encryption, and I don’t particularly care about the identity verification of the site that a trusted cert could offer. Now, Firefox probably shouldn’t use me as an example as a target user that needs protection, but that’s a data point nonetheless. I don’t care for things like: Bugzilla installations, my blog, accounts at sites like identi.ca, Twitter, Slashdot (they don’t offer SSL at present, but if they did…), etc.

Pretty much the only time I do care are for financial institutions. And guess what? They’ve already decided that SSL as used for identity verification is useless! Most of them (I can only think of one that I use that hasn’t) have already implemented a “security image” system wherein I pick a random image that gets shown to me every time I log in. If a site claiming to be the site I want shows me an image I don’t recognise, I’ll know that the site is a fraud. Is it perfect? Probably not. But it’s orders of magnitude better then what SSL error dialogs offer.

And I guess that’s really it: as much as I hate the phrase, I really think that the SSL error dialogs are “a solution in search of a problem.” In the cases where I care about site spoofing, the sites themselves have already implemented a better solution. In the cases where I don’t care, well… I don’t care.

2 Comments

Filed under everything, rants, security

Mon, 16 Jun 2008

HTTPS is broken and Firefox 3 makes it worse

[Note: this is mainly a long rant. If you're just curious about my possible solutions, scroll to the last few paragraphs.]

I’ve been using the Firefox 3 betas (and now release candidates) for quite a few months now, and overall, I think it’s a great improvement over Firefox 2. My main issues in the past with FF2 have always been with performance and memory usage, and FF3 seems to go very far in addressing both of these (though there’s always still room to improve).

However, there’s one thing I just can’t get over: the SSL error pages. Before I describe FF3′s added annoyance here, let me start by saying one thing: the HTTPS model is broken and much less useful than it could be.

Why?

Because the HTTPS/SSL model tries to simultaneously combine two things: encryption and authentication. When you visit a HTTPS site, you get an end-to-end encrypted connection between your web browser and the web server, obviously. But you also get something else, in theory: assurance that the web server on the other end is actually owned and operated by who it says it is. This is done through a hierarchical certificate signing scheme, wherein the browser knows a few “trusted” root certificate authorities (CAs), and any web server SSL certificate that wants to be considered “trusted” (as far as the browser is concerned) needs to ultimately be signed by one of those root CAs. (In practice, this doesn’t mean each and every web server SSL cert needs to be signed by a root CA, just that every trusted SSL cert needs to be signed by another signing certificate that was signed by a root CA, or by another signing cert that is signed by a root CA somewhere in its ancestry.)

So where’s the flaw? Getting your SSL cert signed by a trusted cert authority costs money. This is fine for banks, but not so fine for some random guy who just wants secure communications with his home server, or webmail, or just a small self-funded website where an encrypted connection makes sense. A semi-solution is self-signed certificates. You can create your own SSL certificate, and your web server will use it, and people who connect to your web server on the HTTPS port will get encryption. But, as far as the browser is concerned, your cert isn’t signed by anyone on its trusted list.

So, the website visitor is usually presented with a confusing dialog box warning that the website they’re visiting shouldn’t be trusted. Visitors who understand all this stuff just roll their eyes, click the “allow” button and go on with their day. People who don’t really understand all this, but just want to visit the site, blindly click “allow” and go on with their day. Some panicky users may freak out, click “cancel,” and not visit the site.

The people in the middle there are the ones in danger. Blindly accepting dialog boxes just to get them out of the way can get you in trouble if the dialog box is actually warning you of something important. In the context of visiting Gentoo’s HTTPS bug tracker website, the warning actually is unimportant: Gentoo is just using a self-signed cert to avoid paying for a “real” cert, and just wants HTTPS for the encryption, not for the authentication. However, in the context of Bank of America’s online banking service (just to pick one), the warning is very important: it likely means that someone has intercepted your communications and is trying to masquerade as BoA’s server so they can steal your bank account credentials. Or it could also mean you typed the URL incorrectly, and someone malicious has registered the typo-hostname in the hopes of snaring someone with careless fingers.

So there’s a problem, definitely. The Firefox 3 developers have chosen to attack this problem by attempting to push people into the panicky-user camp, though they misguidedly believe that they’re actually getting users to try to read the messages and make an “informed” decision (despite the fact that they haven’t given — and really can’t give — enough information to inform most users). The new SSL error pages in Firefox 3 put up a scary, confusing, uninformative message right inside the browser window. The message, at first glance, looks reminiscent of one of the several “connection error” messages, so the first reaction is to look up at the address bar to see if you typed the address correctly, and then wonder why the site is down. Then you go and read the error message. Basically, it says a lot of confusing things — including a semi-raw error enumeration code that is sure to confuse the user even more — with a very short explanation of the real problem: “The certificate is not trusted because it is self signed.” What are the chances that the average user will know what this means? Slim to none.

Then there’s some text about adding an exception, and instead of a button, a URL link (in a small font) that you can click to add an exception. Well, sorta. Clicking the link merely modifies the error page to display another semi-scary message, and then shows two buttons: one with a stupid caption: “Get me out of here!” (don’t get me started on this one), and the other saying “Add Exception…” Ok, fine, so I click “Add Exception…” Now I get a dialog box, and my eyes automatically seek the bottom of the box, assuming the “confirm” button will be there, waiting for me to click. But it’s not. It’s there, but it’s disabled. Huh? So I look up higher, and I see that only two buttons can be clicked: a “Cancel” button (well, duh, obviously that’s not it), and a “Get Certificate” button. Ok, well, I guess I’ll try that one. Now the text in the middle of the box changes to tell me “Certificate is not trusted, because it hasn’t been verified by a recognized authority.” What? I know what all this stuff means, and I have to read it twice to get it. Your average user doesn’t stand a chance. Finally, though, the “confirm” button is active, and they’ve helpfully (wow, they actually did something remotely helpful here!) pre-checked the “Permanently store this exception” check box for me.

So, in total, I have to make four clicks, plus read a bunch of confusing terminology, to get to a website with a self-signed SSL certificate.

This sucks. The UI is absolutely terrible, and the average web user is going to have no idea what’s going on. According to the Firefox developers, one of the goals of these new error pages is to cut down on “dialog box whack-a-mole” where users just blindly click to get the dialog out of the way. I fail to see how this is going to help. Some users will now get even more confused, and not visit the site. For the *extremely* rare case where a malicious site is masquerading as the site they actually want, this is good. But for the much more common case of an innocent site that just wants SSL for the encryption, this is bad. And for most of the users in the “blindly dismiss” bunch, they’ll just get used to blindly dismissing this new page+dialog in record time.

What’s the real solution? Ideally: scrap the current system. There’s no reason why connection encryption needs to be so tightly coupled with authentication/identification. Design a new system, possibly with a new protocol scheme. One scheme should be used for “strong” security, where both the identity of the site and cryptographic strength of the connection are checked. The other scheme will just check the encryption. Users will need to be educated that you never try to connect to your banking site using the less-secure scheme. Sure, user education is always a problem, but it’s a problem we still face with the current non-solutions in place.

Of course, in the real world, we can’t just scrap a protocol that has been in use for over a decade, and expect everyone (web servers, web browsers, the cert-signing industry) to change overnight — or at all.

So I’d advocate dropping all the panic about self-signed certs and, in addition, handling HTTPS sites by keeping more state about them in the browser. For starters, at the simplest level, let’s stop putting up scary messages when we hit a self-signed site. We’re already coloring the address bar differently for HTTPS sites; why not have a different (slightly scary?) color for HTTPS sites that use self-signed certs? There could even be an easily-disableable bubble popup (that doesn’t take focus!) that points out the “problem” and is clickable for more information. Or something like that. At minimum, if you visit your bank site all the time and *don’t* see this warning and color change, you’ll think twice the time you do.

But to make this stronger, the browser can keep state about the HTTPS sites we’ve visited. Odds are, the first time you visit your banking site, it’ll probably be all correct and proper. So the browser notes the cert’s fingerprint, and the fact that it’s signed by a “trusted” authority, and checks it every time you visit the site. If the cert changes, and is now self-signed, the browser can raise a larger red flag: “Hey, this site that you visit all the time that usually has a trusted cert? Well, the cert is now self-signed and this might be someone trying to trick you.”

What about “phishing” attempts that use common misspellings? Well, if the browser knows that I’ve visited https://bankofamerica.com/ in the past, and it had a valid, trusted cert, and now I’ve visited https://bankofamarica.com/, and it not only has a self-signed cert, but has remarkably similar spelling to another site I visit that has a trusted cert, the browser can raise another big red flag. Finding similar spellings is nothing new: there are algorithms to do this that are old and very well-established.

How about phishing attempts that hide the true website URL by using an inline username/password string that looks familiar to the user? Well, we already cover this: Firefox pops up a dialog asking if you really want to connect to the site, presenting the real hostname, and showing the username passed in the URL. So, this new scheme doesn’t harm this case’s solution.

End rant.

1 Comment

Filed under everything, rants, security, software

Sat, 10 Nov 2007

More LGPLv2.1/GPLv3 Crap

Someone calling himself “textshell” left a comment on my previous post that made me think about a few things.

If I release something under “GPL version 2 ONLY” (which is what I usually do), I expect it to stay released under that license.

If I release something under “LGPL version 2.1 ONLY,” I expect it to either stay as the LGPL or be converted to GPL version 2 — and ONLY GPL version 2.

I’m not sure I understand textshell’s rationale here: “If you used LGPL before you seem to have been ok with the code used in commercial software, so why do you want to make sure it’s not usable in GPLv3 software?” Those are two very different things. LGPL allows proprietary software vendors to link with my code, which — for any software I release under the LGPL — I have no problem with. But allowing people to re-release my code under a license I do not fully understand and do not fully agree with (GPLv3) is not ok.

“Compatibility with other licenses” is not the main criterion by which I choose a license for my code. I choose a license that has terms with which I feel comfortable. At this time, I do not feel comfortable with the GPLv3. That may change, but for now, that’s just how it is.

The merits of the various additions in the GPLv3 can be (and have been) debated quite a bit, but I think it’s safe to say that the GPLv3 as a license is more restrictive than the GPLv2. Say I release something under LGPLv2.1, and in my license header, I say “version 2.1 of the license ONLY.” This means that — weirdly enough — no one can relicense my code as LGPLv3 (or even use it with LGPLv3 code as-is), BUT, they can “convert” (aka relicense) the code to GPLv3, and, presumably, they’re allowed to add the “or, at your option, any later version” clause. Now, the GPL is of course more restrictive than the LGPL. The GPLv3 is more restrictive than the GPLv2. I’m not currently comfortable with the restrictions imposed by the GPLv3, and I have no idea if I’ll be comfortable with GPLv4, GPLv5, etc., but the LGPLv2.1 unfortunately appears to have terms that directly contradict my wishes that the code stay as LGPLv2.1/GPLv2.

We don’t know what the GPLv4 will look like. Say through some unlikely twist of fate, Microsoft buys the FSF (currently the only organisation “allowed” to release new versions of the LGPL/GPL). Microsoft then goes and releases GPLv4, which adds a clause that basically says “if you receive GPLv4 code, you may relicense it under a proprietary software license.” In this instance, anyone who has released code under “GPLv2 or later” or “GPLv3 or later” has granted MS (or any other company) the right to make a proprietary fork of their code. It’s this thinking that leads me to release all my code under a license that says “GPL, version 2 ONLY.”

Now, do I really expect MS to somehow acquire the FSF and release an “evil” GPLv4? No, I don’t. But the fact remains that I have no idea what will happen in the future. Trusting an organisation full of people I don’t know to produce future versions of a license that I’m happy with doesn’t sound like a good idea. Indeed, they’ve already released a new version of my license of choice that I don’t fully agree with, so why should I trust them to do so in the future?

If and when I feel comfortable with the GPLv3, I’ll probably re-release all my software under a “GPLv3 ONLY” license. But that’s it for the LGPL — I have no intention of releasing any new code using the LGPL, with the exception of stuff contributed to LGPL libraries (like libxfce4util and libxfcegui4) that are mainly “LGPLv2.1 or later” and are ‘owned’ by other people.

2 Comments

Filed under everything, legal, rants, ruminations

Fri, 9 Nov 2007

If you don’t like GPLv3…

… then it’s best not to use LGPLv2.1 either. According to this footnote of the GPLv3 draft FAQ:

Every version of the LGPL gives you permission to relicense the code under the corresponding version, or any later version, of the GPL.

This is a bit disturbing to me. According to this, if I release software under a license which states “LGPL version 2.1 ONLY,” someone can go and re-release this software as GPLv3. And indeed, section 3 of the LGPLv2.1 states:

You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. [...] (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.)

That’s ridiculous. The license explicitly ignores whether you release under “LGPL version 2.1 or any later version” or “LGPL version 2.1 ONLY.” Amusingly, it looks like, under these terms, if you release LGPL-2.1-only, someone can’t go and re-release as LGPLv3, even though they can re-release as GPLv3. To illustrate the retardedness, here’s my interpretation:

Release under: Can be converted to:
GPLv2 or later GPLv3 or later; GPLv3 only
GPLv2 only nothing else
LGPLv2.1 or later LGPLv3 or later; LGPLv3 only; GPLv2 or later; GPLv2 only; GPLv3 or later; GPLv3 only
LGPLv2.1 only GPLv2 or later; GPLv2 only; GPLv3 or later; GPLv3 only

Is this correct? It seems so horribly wrong.

I need to go through my stuff and make sure I’m not using LGPL for anything, though I suppose I’ll have to leave libxfce4util and libxfcegui4 alone since most of the parts I don’t own are LGPLv2.1-or-later, so it’s probably not worth the effort. And, I’d better be more careful about understanding the licenses I use.

2 Comments

Filed under everything, legal, rants, ruminations

Mon, 8 Oct 2007

My Stuff Hates Me

Yeah, it’s been a while since I’ve posted, most of my posts over the past month being private. But, I feel like ranting semi-publicly, so, here goes.

My car is dying. A few months ago when I had some unrelated work done, my mechanic told me the rotors and axles need to be replaced (not dangerously so, but they’re not in good shape), at a cost of roughly $1000. I decided to put this off. A few weeks ago, my car wouldn’t start. My mechanic found a leak in the head gasket. It’s been band-aided, but who knows how long it will last. That’s at least another $1000, probably more if the head gasket fails while I’m driving it. The car is old, but not exceptionally so: it’s a 1997 Honda Accord which my parents bought used for me in 2000. The mileage was somewhat high when I got it (around 65k miles), and now it’s up to around 140k. While that’s not particularly impressive, it’s not like the car hasn’t been used.

So, I’m looking for a new car (well, not new, used, but only a couple years old, hopefully). While I was initially somewhat opposed to the idea of another Accord, I’m starting to change my mind. I’m looking at a 2004 Accord coupe (my current car is a sedan) on Tuesday, and I have a few more in my list that I need to call.

I’m considering a Honda Civic, but I’m not sure I want one (no good reason). Ditto for Nissans in general. Not really interested in an American car. Toyota is a possibility. Open to European makes, but only if the cars generally have histories of not being in the shop too often (so that leaves out Saab and Volkswagen, among others). I’m buying used to avoid the good old new-car premium and immediate depreciation. I can also get a much nicer car for my money if it’s a couple years old. I’m not willing to spend more than $20k (even with that amount I’ll have to take out a loan), but I’d like to spend less, of course.

I’d like this car to be a bit more “fun” than my previous few cars. Manual transmission, decent engine (V6 preferred, though a high-hp 4 cylinder will do). Gas mileage should be decent, though, to be honest, I don’t mind current gas prices too much, and I’d be ok (but annoyed) even if they doubled. (Well, I do mind current gas prices; I much preferred the $1/gal we were charged just 10 years ago, but I’m saying current prices aren’t much of a financial burden to me.) I’d consider a diesel-fuel car if it met my other requirements. A better-than-standard audio system, bluetooth, and an in-dash GPS would be nice, but aren’t required.

So, that’s that.

In other news, tonight my laptop’s (the 12″ PowerBook G4) hard drive decided it doesn’t like data integrity anymore, so I just ordered a new Seagate 80GB hard drive from newegg. Putting $60 into the machine kinda hurts, as I was hoping to be able to live with it as-is for another 8-12 months until hopefully Apple wises up and starts selling a 12″ MacBook Pro — or even a 13.3″, but I’d prefer the 12″; I have a 13.3″ MacBook from work, and it’s just a little less portable than I’d like it to be. Fortunately, it looks like the drive is still mostly alive; even though it won’t boot anymore (Linux says the root filesystem is hosed), the /home partition appears to be completely intact (just made 2 images of it).

So, don’t expect much work on Xfce (xfconf, mainly) for the rest of the week, as I don’t expect the HD to get here before Weds or Thurs, and then I’ll likely spend the next couple days rebuilding the system (I might be able to recover the root partition, but I’m not sure I’d trust it). Yeah, still running Gentoo, so I gotta wait for shit to compile (though fortunately I can offload 2/3 of that to my HTPC and server in the closet).

Oh, and speaking of stuff breaking… I bought a Samsung SGH-T619 (that’s a cell phone) 4 months ago when I switched carriers from Verizon to T-Mobile. End of August, the external screen breaks. No, not the outer plastic, but the actual LCD screen cracked. I really don’t know how: I set it down on my nightstand to charge before I went to bed, like I do every night, and it was fine. I wake up in the morning, pick up the phone, and the screen is cracked. Go figure. I bought the phone from a company called LetsTalk (online, but I don’t feel like linking to them); I emailed their returns department, not really expecting much, as they only guarantee the product for 30 days. But I at least expected an email back telling me to get stuffed; no, I didn’t even warrant that: I got no response at all. Great customer service, assholes.

I need to give Samsung a call to see if they’re replace/repair it under warranty; I read the terms online, and, surprisingly, they don’t exclude the screen from warranty protection. Assuming they’ll repair it, hopefully I can find an unlocked GSM phone to use while my phone is “in the shop.”

I was debating getting an iPhone given my semi-broken phone. My semi-broken phone was better than free: after activation fees, I got $15 back due to rebates and discounts and whatnot. So I wouldn’t actually be losing anything by buying a new phone. My old iPod Mini is starting to show its age (it’s almost 3 years old): the battery barely lasts 3 hours (even with the backlight disabled), and it’s a bit scratched from use. The battery life makes it somewhat useless on planes (where I find myself quite frequently lately), though it’s ok for bringing to work and plugging into my laptop to listen to music while I work. So, I figured, I could either get a new iPod Touch for $300, or an iPhone for $400. Of course, the T-Mobile contract makes things difficult, as does Apple’s stance toward phone unlockers/modders. This post by Mark Pilgrim kinda did it for me: I’m not going to buy an iPhone. I had a bunch of niggling doubts about my desire to buy one, but it helps to have them in block text right in front of me. I especially like this bit (in this case about the AppleTV):

I don’t understand this continuing obsession with buying things that you need to break before they do what you want… I thought the big draw for Apple hardware was that “It Just Works.” By breaking it, you must know you’re giving up the “Just Works” factor, so what’s left? Rounded corners?

Hell, with things like this, I’m feeling less inclined to even buy a new iPod… ever. Why should I buy from a company that appears to be openly hostile toward allowing me to use their hardware with a non-blessed OS?

Though, to be fair, I like Apple products not solely due to logical reasons. (Hell, I still have no 3D video acceleration on my PowerBook while running Linux, and the 2D accel is virtually nonexistant as well, and yet I still love my little PowerBook.) The hardware is pretty. It’s a status symbol; as much as I’d like to believe I’m immune to status symbols, I’d hate to deceive myself. And I do like MacOS X. I have a MacBook from work that only has OS X on it; I do some Mac development at work (seriously, working with Cocoa and Interface Builder is an absolute joy, even though Xcode’s text editor sucks ass), and I can get by using Citrix to access my mail (sadly we’re a MS/Outlook shop, and I hate Outlook webmail) such that I don’t need to use my WinXP work laptop all that often. I’m not totally pleased by the aesthetics of the MacBook (vs. the MacBook Pro), but I do like it.

And why shouldn’t my laptop look cool by my standards? People buy cars with dual reasons, too: your average car buyer wants something reliable and safe, but also something that conforms to their sense of aesthetics. That’s why there are so many different car designs and you can pick from a variety of colors.

Anyway, that’s the state of my electronics, and then some. I should get to bed; busy day tomorrow.

Leave a Comment

Filed under cars, everything, hardware, phones, rants, ruminations, tech, work