I decided only to list games that I played for the first time in 2023. But of course I also played classics like CS:GO, Satisfactory, Stronghold Crusader HD, Company of Heroes 1 & 2, and The Witcher 3: Wild Hunt.

Going medieval [Early Access]

This is a game that I actually picked up by and for myself in late December 2023.

This is the first “colony-sim” type game that I played. Instead of giving direct commands to individuals or groups on the map, you create personal schedules and priorities for each inhabitant of your small settlement. Then the inhabitants ideally act according to those priorities, while also being influenced by their personalities or health.

I was always intrigued by this concept, that often also involves complex cause-effect sequences (eg. “Unexpected nudity and vomit-covered cats: how Dwarf Fortress tells some of gaming’s most bizarre stories”). But I was also worried about the barrier-to-entry, so I never tried Dwarf Fortress or Rimworld.

Going medieval makes it relatively easy to get started with this type of game. You guide 3 people in their attempt to build a sustainable and defendable settlement in a medieval world that has fallen into chaos because of the Black Death. I played on medium difficulty, and even as a total colony-sim noob I managed.

I have played only 10 hours of this game until now, so I haven’t seen all of it yet ¹- but I do enjoy it. It has relaxing phases of just watching your people do their thing, micromanaged combat with robbers, and the constant dread of the next winter in the background.

Going medieval Website

Mindustry

Mindustry is a mixture between tower-defense and factory builder - and it’s open-source. I played this on a LAN party in early December.

Factory-complexity-wise Mindustry is more comparable to Satisfactory than to Factorio - but because of the ever-impending next wave of attackers that’s probably a good thing. This is especially fun in multi-player, as you can split the work between tower-defense constructors, resource extraction specialists, and factory builders.

But watch out, a lone enemy that has broken through your tower defenses could just decide to destroy a critical supply line, which might render all of your frontline defenses useless!

A great game, and it’s awesome that it is open-source! I initially downloaded the game for free, but decided to buy it on steam after 8 hours of fun.

Mindustry Website

Sunkenland [Early Access]

Another LAN party discovery. It’s a survival base building game in a water-world setting.

It is still early access, but while there are some rough edges around inventory management and vehicle mechanics, it offers a absolutely respectable amount of content at this stage.

In the past years, we also played a lot of Raft, which obviously is more polished and has a great story, but also feels more unique and has a clear design language, which I miss in Sunkenland. But Sunkenland feels less restrictive and might also find it’s own design language later - and they haven’t even begun working on the story yet, so you can’t really hold that against the game.

Overall, a surprisingly solid game for an Early Access title (we played this in early December 2023).

Sunkenland website

1.6, Source, GO, … 2!

This makes sense, when you play too much Counter-Strike, I promise!

I played this game since 1.6, when I mostly played for fun at unofficial school LAN parties with friends. When I think “1.6”, I think “mouse” maps: maps that place you in giant bathrooms or living rooms from the perspective of a mouse or toy soldier. And while I may have taken short breaks from CS:S’s fy_iceworld map to rescue a virtual hostage or two on cs_italy, it wasn’t until Counter Strike: Global Offensive, released in 2012, that I learned to love the competitive game mode.

And over the last 10 years, I played CS:GO reasonably consistently. At the start with friends from by bachelor class, later also alone, and now with the infamous *LadU* (Lappen an der Uni, roughly “Lowbobs from University”) clan. Because of certain individuals we would exclusively play de_nuke - which I do believe is the most interesting and complex official map the game has to offer, but… I’d like to play on other maps. :D

Anyway, 11 years after the release of the last Counter-Strike game, 2023 was the year of Counter-Strike … 2. No “Galactic Offensive” or “Condition One”, simply “2”.

Let’s start with the good stuff:

1. We are finally playing maps other than Nuke, because of the new Premier mode, which more closely resembles the way that pro teams are deciding which maps to play on: By alternatingly banning maps from the available map pool until one maps remains. This is a pretty nice change, which makes playing more exciting.

2. I also do like the new smoke dynamics and the ability to interrupt smoke walls through HE-grenades.

3. The game stays true to its competitive shooter roots.

Now to the less good changes:

1. Gun-game is gone. This game mode, in which you would get a new weapon for each kill, was great as a quick warm-up before the actual competitive 5v5 game. Valve, please fix.

2. I need a new laptop. My private laptop is a from 2015, and while it was a pretty high-end gaming laptop back then, I only get about 60-90 FPS out of it in CS2 on average. Should I sit in a water pond surrounded by smoke grenades, this might drop down to 30. I can kind of play around it by relying on game sense instead of sick flicks, but 2024 is going to be the year of a new laptop for me ².

This isn’t necessarily a bad thing - I have been putting of playing a lot of higher-end graphical games that I otherwise would have liked to play in the last years, specifically Cyberpunk 2033. So CS2 is simply the final nail in the coffin.

Overall I’m pretty happy about CS2. They stayed true to the series, and in my opinion could have even added another feature or two. But maybe that will come once the dust2 of the release has settled.

Or, am I the only one? Because that is how I felt when I was looking for an easy to use online tool to generate one-off, static podcast RSS feeds. There are lots of commercial podcast hosting providers, Wordpress plugins, and entire open source projects providing everything an aspiring new podcaster needs. Stuff that we could only dream of, when we were hand-stitching the RSS feed for our Geekasmus podcast back in 2009!

But I don’t want to host yet another podcast. ² I just have a couple files, that in my humble opinion should be offered in form of a podcast feed, too.

Introducing: Rebelfeeds

So, instead of doing the reasonable thing of hand-stitching my one-off RSS feed, or, probably more 2023-style, asking a large language model to do it for me in a short web chat, I built the generator I wanted: Rebelfeeds.

Rebelfeeds is a, currently not very pretty, static, client-side web application, that allows you to generate RSS podcast feeds based on the information you enter in a form.

The first section is about the general metadata of the feed: Title, original authors, maybe the category and a short description. The middle section is the episode list: You can dynamically add any number of episodes, by linking to their audio-files and entering a title. The third section is where it is all coming together: It displays your data in a valid XML RSS podcast feed.

What you do with that feed is on you: Rebelfeeds doesn’t provide hosting for these files. So to be able to point your podcatcher to a valid URL that serves your newly created RSS feed, you need to upload it somewhere. A random pastebin service should do the trick, as long as your podcatcher isn’t too picky about the Content-Type of your RSS feed.

The name rebelfeeds comes from the fact that these feeds are not like the other feeds. They are not necessarily created by the original authors, but by people who just couldn’t accept that this content was not accessible as a real podcast. Rebels, creating the free and open internet that we always wanted. And because the RSS feeds are simply linking to the original files, no copyright is infringed.

These feeds are not the ideal solution of course: Many of them will be one-off feeds, created for individuals and never updated. But there is nothing that prevents anyone from updating an existing feed with new episodes. Ideally the original authors would create these feeds themselves. But maybe a rebelfeed as an example can help them with that decision by showing the great possibilities of RSS.

Limitations and Workarounds

Building this application as a static web app comes with some limitations, in the form of cross-origin resource restrictions. These restrictions are important, because they stop websites from accessing your data on other websites.

Serving permissive CORS (Cross-Origin Resource Sharing) headers is a way for a server to allow specific or any other websites client-side code to access this content. But for that you need the cooperation of the file hosting server owners, which we don’t necessary have in our case.

Luckily the audio HTML element allows playing files hosted on other origins. However, it doesn’t allow the client-side javascript code access to information like the filesize and mimetype of the audio file, for privacy reasons. Both of which are required for episode-items of podcast feeds. But: it does allow us to get the duration of the audio file.

So to give a reasonable guess of the mime-type, I look at the file ending (don’t do this server-side kids!), and for another guestimate of the file size, I multiply the audio duration by the average bitrate of those files (or by what I think they might be). The results are… mixed. But it’s the closest thing I can come up with right now.

Luckily I can also add the actual duration of the episode as an optional attribute to the RSS feed, so that at least the durations should be shown correctly, even if the filesizes are way off.

Side track: Side projects with svelte

The old side project rule applies: It’s not about the destination, it’s about the frameworks we learned along the way.

For this side project I chose the svelte frontend framework. I am not a frontend developer anymore. I used to be one, but then they changed what frontend development was, and then I wasn’t anymore. More and more levels of abstraction, loads of dependencies, not really my thing. As a professional, I need to be able to find my way around a React+Redux app, but it doesn’t spark joy, at least for me.

But I’ve been following svelte from afar, mainly because it was different: No virtual DOM, no separation of concerns, just a bunch of javascript, HTML, and CSS living in the moment. That always sounded more up my alley. sveltes concept of having behavior, markup, and style of one component all in one simple file resonated with me ever since I first read about it.

But I never tried it for myself, so a couple days ago I ran npm create svelte@latest rebelfeeds for the first time.

It was surprisingly easy to get started. Once I figured out that the error messages for HTTP 500 Internal Server Error messages of the vite development server can be found in the browser console (???!) I was a happy camper. sveltekit mostly gets out of the way, so much so that I wasn’t sure if I actually still have a client-side static web app in the end, because it seamlessly serves some server-side rendered content, too. But by adding a static adapter and prerender=true I finally got my static builds.

At times I had to look up how to do pretty basic things in javascript, and I’m far from sure that my solutions always are the right way to do things. Did I split my component in reasonable ways? Is this how you should handle state across components? Probably not. But it works.

I intend to keep working on this project for some more time, to add some features and do at least something design-wise. Whether or not rebelfeeds deserves its own domain, we will see. I’ll keep you updated.

But when the microphone stopped working altogether, it was time to say goodbye to my first second ever headset. Time to say goodbye to my Sennheiser PC150.

I got them probably around 2006, when I was 14 years old. I’m 31 now. When I tried this headset model for the first time I was at my friend Lasse’s house: He had just gotten them for his birthday (?), and they blew me away. Music had never sounded this good to me before, ever.

Previously I had mainly listened to the radio in my parents car, or to totally legally downloaded 32 kbit/s mp3 files (nobody had the time and space for more!), through shitty mp3-player earbuds. But with these headphones you could feel the bass! Incredible!

Of course they quickly ended up on my wishlist for the next Christmas (or was it my birthday? Who knows). I specified them as exactly as humanly-possible. This is because 2006-me still vividly remembered how I had previously wished for a DVD of “The Hitchhiker’s Guide to the Galaxy”, having the 2005 movie in mind, but in a now hilarious and back then terrible twist ended up with a collectors edition of the 1981 BBC TV series, with like, hand-puppets and stuff. Worst Christmas ever. Anyway, even though for me the headphones seemed outrageously expensive for computer equipment (apparently between 57 and 70 Euros in 2003 money in Germany), I got them.

And I have used them ever since. They survived hundreds of hours of me coding PHP social networks with my friends in high school. They moved with me to Stuttgart and Bristol for my bachelor degree. The followed me to Copenhagen for my master degree and first non-student job. And they stayed with me for countless (actually, pretty exactly 2,248) hours of playing CS:GO with my friends and enemies.

When the time had come, I didn’t even know the model name anymore – the one that had been so incredibly important in 2006. The headset itself did not have anything but the Sennheiser name printed on it, so I actually just spent the first 20 minutes of working on this article scrolling through image results for “sennheiser open headset 2006-ish”.

Finally I found this review from 2004 (last updated in 2011) by “Dan’s Data”, comparing the Sennheiser PC 140 and 150. It concludes that “As for the rest of the PC150s’ sound… it’s OK.”, which 14 year old me would hard disagree to, as it had clearly the best sound ever heard by human ears. Computerbase.de has some more pictures and reviews in German from 2005. And it turns out that I wasn’t even alone in my loyalty to this beautiful product, as in 2021 user “WebBeat84” asked (again, in German) the computerbase.de forum which alternatives there are for his trusty open, on-ear, gaming headset. There are also some long-time fans in the Amazon.com reviews.

But, alas, I needed a successor. I wanted to replicate my arguably perfect buying-decision from 2006. But the issue is that you can often only identify the “buy it for life” products years after they have been discontinued, and even the company behind them might have changed, too.

To give me the best chance for a repetition of the coup, I went with the pretty expensive beyerdynamics MMX 300. They are not the same type of headset at all, being over-ear and closed, but they come with easily changeable and very sturdy cables, good sound and microphone quality ¹, and no batteries or other potentially short-lived components. While I could wear the PC150 for hours on end, basically forgetting that I had them on, this is not possible with my new headset. Yes, my ear is getting hot. The inline control buttons on the cable are a little high, at least for me, and could be 10 centimeters lower for easier access, but that is a minor thing. I do like the metal-frame and the more adjustable microphone arm. Let’s see how it hold up in the test of time. I’ll keep you updated.

The Sennheiser PC150 will always have its place in my memory, even if I forget the model name. For this article I wore them for the last time, and, as usual, forgot about them within minutes. <3

The situation

After selecting a different GPU driver ¹, my system crashed to a black screen with a blinking cursor and eventually I hard-rebooted my system. GRUB worked, I could decrypt the SSD, but then nothing would happen, just a Ubuntu/Lenovo loading screen. No user selection and login screen. … and 50 minutes to fix it before the next meeting. Great.

My solution

GRUB was still working, and I could get into the GRUB menu by pressing the ESC key repeatedly during the boot process. Probably because of one ESC key press to many, the GRUB menu was only displayed for a split second, before I was dropped into the GRUB console. But the command normal, followed by more ESC key presses, brought me back to the GRUB menu. [thx AskUbuntu]

In Recovery Mode, the first step after the decryption of the disk is to enable networking, so that we can download and install the additional drivers that Ubuntu actually recommends. Activating the networking requires the Ubuntu Recovery Mode to write to the disk, which is read-only by default at the start - just say yes to that. After networking is enabled, select the root console and run the commands apt update and ubuntu-drivers autoinstall.

That’s it. That’s what worked for me. Afterwards I was able to boot into normal Ubuntu again.

And made my meeting.

The indieweb - a web of good intentions

The indieweb describes the web of personal blogs, homepages about special interests made with love, and handcrafted personal web presences. You know, the stuff you think about when you think of the internet of the early to mid 2000s. Questionable use of HTML-styling, actual people behind every page, the only metric of engagement being a visitor counter that proudly presents a different randomly generated number on every page load. No corporations, no dark patterns, just people living in the moment.

Well… that’s the idea. Before I get all nostalgic again (>.>): The golden age of the personal internet was not all that golden all the time: Websites would disappear overnight, even internal links would 404, and on at least 10% of the websites I visited I wasn’t sure if the owner was still alive.

I remember that I once thought that the coolest thing about Facebook was that the profiles are looked alike and the information you needed (the relationship status of your highschool classmates of course), was always in the same place. Finally we had overcome individually designed profile pages and blinking “under construction” gifs! But even I was feeling that something had gone the wrong way when Google discontinued their RSS reader product. Believe it or not I wrote a blogpost about it back then. Yesterday, while checking the HTTP server logs, I came across it again, read it, and, while I was ready to be embarrassed for my 21 year-old self, it is surprisingly non-cringe. ¹

Anyway, my view on the beauty of Facebook has changed. We all make mistakes.
Nowadays I yearn for more personal websites, with their own domains and full control over the design (not that I am particularly expressive design-wise on here). And many some other people think the same. With a mixture of nostalgia, discontent and defiance against the major social media platforms, and an unshakable optimism for the small-/indieweb, these people are building the internet that they want to see.

Ok, convinced, so, where is this indieweb?

First – that’s great!

When you are reading these lines, you are actually already on the indieweb. Look up, it has it’s own domain (nowadays even with HTTPS, something that only banking websites had back in the day) and I am a person. And while I could host anything on here, I just write my little blog using the static blog engine hugo. And by writing these words about the software I use for blogging, I have actually just fulfilled the third requirement for an indie weblog.

But for real, I understand that finding these little gems is hard. With a busy working day, nobody has the time they had when they were 14 to aimlessly type in random domains and hope that they would resolve. Even Google results are not getting better with SEO gaming and web-scraped spam websites filling up the first result pages. And because it prefers well-known domains, small blog have a harder time standing out.

But we do have the technology: Specialized search engines are indexing personal websites, like searchmysite.net and marginalia.nu, help surface the internets’ (good) weirdness. I use them mainly for my own amusement instead of quests for information, but hey, maybe I should try that more often.

But the website that gets me back into the indieweb the fastest and most consistently, is indieblog.page – and it does this in two ways.

The most consistent is indieblogs daily RSS feed. Once per day a randomly chosen recent blogpost from one of the currently 3,442 blogs in their directory is added to this feed. I see them pop-up in my RSS feed reader, and surprisingly often it is something interesting, fun, or just plain human, which is kind of beautiful. Really, the fact that a human being with little to no ulterior motive wrote it can make a blogpost about someones new knitting project or a personal review of the year 2022 surprisingly wholesome.

The second, and a bit more ad-hoc, way, is it’s “Open Random Blog Post” button. The button is also on the landing page of the website, but I actually added it as a bookmark to the bookmarks toolbar that Firefox shows on an empty new tab. It’s simply a bookmark of https://indieblog.page/random. Whenever I notice that I am caught in a loop of opening the same 4 news websites within minutes just to notice that there is nothing new happening, I click this button as kind of a emergency exit for the corporate news net. And bam, I read about somebody hacking their bluetooth-toothbrush or how to get a computers hardware ID. And those are just my last two button clicks.

How to participate?

As you see, the indieweb has an undeniably techie-leaning slant. That’s not particularly surprising, given that there is talk about domain names, webhosting, and RSS syndication (really simple!).

But at https://indieweb.org/Getting_Started you can find very to follow steps for every skill level - you don’t have to be a web developer and blog about your blogging tech stack to be part of the indieweb! And if you start your blog because of this post, let me know! I’d be your first RSS subscriber for sure!

Many small homes

It’s not the first time that Reddit makes (negative) headlines either – in the last years several terrible, inhumane, and often right-wing subreddits have given the platform a bad name. Most of them were eventually closed by Reddit, but not before it was dragged kicking and screaming into doing the right thing.

But I still felt at home on Reddit. Because on the platform there wasn’t one community, but a collection of many different smaller communities, each with its own rules, culture, and quirks. Some of them terrible, sure, but if you found yours (which, thanks to Reddit’s subpar search, was not easy), you could have a great time there, while being largely insulated from the bad ones.

The old internet

Reddit also felt like part of the “old internet”. ¹ Especially when you were using the original design under old.reddit.com and third-party mobile applications – little empty space, small font, no rounded corners.

The distinct cultures and (CSS-) styles of the different subreddit would remind me of the many forums – the ones that probably often got replaced by just those subreddits.

And while I would eventually recognize a handful of users who were very active in my go-to subreddits, I would rarely even read the usernames of posters or commenters. The content mattered, not the person. This would also be the case for moderators, who could mark their comments as “this comment I wrote with my mod-hat on” to indicate their status when it was necessary - otherwise they just be another unmarked username commenting. No profile pictures (at least for me), for the longest time no following-functionality for individual users, no requirement of attaching an email address to an account, and certainly no real name policy.

This made for interesting discussions, as it didn’t matter who you were discussing with. While of course everyone still wanted to get their point across, nobody tried to amass followers and “build their brand”, like it often happens on Twitter.

I also never had issues with any “power-hungry” mods. Quite the opposite, I would like to give a shout-out to the mods of /r/de for keeping this place sane also during crazier times, like the Syrian civil war and the resulting humanitarian crisis or the Covid-pandemic. ²

One for everything

On Reddit you could find a community about nearly everything.

• Creating art through procedural generation? /r/proceduralgeneration/ (they even had monthly challenges in the olden days! I got the “Jack-o-Lantern” flair for this)
• You like to watch dads happy-crying? /r/happycryingdads
• Videos of your favorite bands first gig? /r/preformances
• Want memes centered around members of the German parliament playing counter-strike? /r/csbundestag
• Need more incredibly cheesy Science Fiction book covers in your life? /r/badscificovers

One niche community I couldn’t find was one about my volunteering hobby: Maritime Search and Rescue. There was a subreddit for Search and Rescue, but it was largely about searching for lost hikers in mountainous terrain.

So I created /r/maritimeSAR in 2017. After 1 year it had 6 subscribers. After 2 years it had 50. In the end, it had 632 – mostly lurkers. But even though I was (nearly) the only person posting links to interesting videos and articles about mostly volunteer-based maritime search and rescue organizations, I did it gladly. I personally celebrated every single upvote. It wasn’t much, but it was honest work, all while the larger platform carried on and usually was out of the way. But that was about to change.

I didn’t give up just like that. I participated in the “subreddit blackout” from June 12th to 14th. But I wasn’t hopeful. We were merely guests on this platform. The only way to win was to be ready lose your community. And most redditors weren’t ready to do that.

Time to say goodbye?

But at least for my own subreddit, I didn’t feel good about posting new things anymore. I didn’t want to contribute to the bottom line of a company that has lost its way for free. Sure, the writing might have been on the wall for longer, and some might even say that it was silly to build a community on a closed platform from the start. But I felt for a long time that Reddit “was different”. Now it is different in that it follows the burning wreck that is Twitter more eagerly than any of the other closed platforms. wtf.

I won’t download reddits terrible mobile app. I might still browse through some non-yet-replaced subreddit from time to time using old.Reddit.com.

But I have already started a new community about maritime Search and Rescue on a lemmy instance. It’s small, I am the only one posting anything, but I am used to that.

It will be incredibly hard to rebuild all of these big and small communities elsewhere. But I was able to replace Twitter with Mastodon last year. Today I am only occasionally linked to Twitter by news articles or blog posts, and all my daily microblogging scrolling and posting happens on Mastodon.

So I hope that lemmy or kbin can help me miss Reddit less and less. But I am more sad than I was about Twitter going down the drain. I spent a lot of time on Reddit, and I learned many interesting and weird things, and generally had a lot of fun. Let’s see what the fediverse can do for me, and what I can do for the fediverse.

Software development is a pretty young profession compared to many other professions, that are equally integral to our everyday life. It can have a big impact, and even though we (officially?) have moved away from the whole “move fast and break things” motto, it still very much breaks. Things, but thankfully mostly just itself.

Other industries are older and more regulated. That comes with some interesting learnings and side effects, which we can and should learn from.

Written in blood

Very tactile and visual industries to learn from are civil engineering, the railroad- and the aviation industry. If things go wrong here, you usually have a pretty good idea of what could happen even as a layman - be it a collapsing bridge, a derailing train or a rapidly descending aircraft.

Regulations in these areas are written in blood, and I’m personally not sure if I could stomach writing code that controls an airliner. If I had to, it would be at a glacial speed for sure.

Looking at these industries I see one big commonality in their regulations. Of course you cannot build an aircraft hull with the same requirements that a single-family house wall needs. But all these industries have independent investigation bodies to examine the root causes of catastrophes - and ideally also of near misses. And these investigations should result in a public report, with concrete change requirements for the involved organizations and often recommendations for improved regulations.

My favorite “incident-report-based” media

I usually don’t read the original reports myself. They are long, detailed and technical in areas that I am not an expert in. But there are experts out there, who create blog posts, podcasts, or videos about the incidents with the help of those reports. They make them available to the wider public, including me, and I really appreciate that.

Podcast: Causality

The Causality Podcast by John Chidgey looks at incidents, their root causes, and how they could be prevented, from a wide array of industries. If you only have time for one of my recommendations, this one is probably the way to go.

John is an electrical, instrumentation and control systems engineer and software developer and feels comfortable covering incidents from chemical plants to aircraft, from offshore oil platforms to rollercoasters – and that’s just what I can remember off the top of my head. The types of incidents vary widely, but he usually covers the technical measures that could have prevented the event AND maybe most importantly the organizational failures that allowed for or even provoked “human errors”. While I was young/studying I often thought I was smart and logical by focusing on the technical aspects, but after working for some time I understood more and more how much “soft” factors like organizational culture, incentives and structure, play a role in nearly every “technical” decision, at least in the background. This podcast is definitely aware of that.

But, despite all organizational factors that might contribute to a wrong engineering decision or a fatal oversight: In the end, it is the engineer/developer who decided to implement and “sign off” on it. And so many episodes end with a plea for engineers to push back on these decisions, also if it might seem bad for business in the short term. This professional self-respect and acknowledgment of your responsibility as an engineer is something that we in software development still need to embrace more.

Causality is the podcast I find myself skipping back in most often, sometimes repeatedly, because you really need to concentrate to keep up with the technical information presented via audio. An example of this would be the episode on the Hyatt Regency walkway collapse – even though the crucial image is also in the chapter art.

Episodes that stuck in my mind especially:

• Causality 35: San Bruno
• Causality 41: Florida International University
• Causality 26: Bhopal

Videos: Mentour Pilot

The Mentour Pilot YouTube channel covers aviation accidents or near misses. Presented by commercial airliner pilot Petter Hörnfeldt these videos are based on the often excellent aviation incident investigation reports. While the actual flights are re-enacted as closely as possible in an airplane simulator, the root causes behind the incident are explained. As in Causality, the root causes are more often than not a combination of different factors (cp. “Swiss Cheese Model”). Technical decisions by the aeronautical engineers, organizational shortcomings, bad training of ground crew or pilots, or operator fatigue - seldom is it just a single cause, which the excellent investigation reports also reflect by listing tens of recommendations for airplane manufacturers, air traffic controllers, airlines and regulatory bodies.

Mentour pilot looks at these incidents naturally a bit more from the operator’s perspective compared to Causality.

I often find myself fascinated not by technical solutions, but by the focus on “Crew Resource Management” (CRM). CRM is a set of techniques and procedures, and I think also a state of mind, that tries to protect against “human errors” taking into account psychological and sociological research. Concrete examples of good CRM would be to

• encourage anyone, no matter their standing in a social hierarchy or position, to speak up when they feel uneasy about a situation or think they observed a pilot error
• keep conversation topics during the “non-sterile” phases of the flight light
• communicate clearly when executing certain actions or taking over control
• good, proactive workload management

In my view, CRM shines at the tactical level. In software development this could be during the incident handling of an outage or even during the investigation of an active security incident. Working in an IT security company I can definitely see how this can apply to our SOC and our incident response teams.

I also took a lot of things from this for my volunteer work as a lifeboat helm – especially in bad weather you want all available crew resources focused on the task at hand and want everyone to feel comfortable speaking up immediately when they see something. At the same time you need to make time-critical decisions and communicate them.

Further shout outs

I also want to give a shout out to one-off talks and some other “incident investigation report”-based media.

(Not just) for the train enthusiasts there is Max S’ blog based on train accident investigation reports. With an impressive weekly cadence, he describes train accidents and their root causes in detail. As he covers accidents happening between 1882 and 2021 you really get to appreciate modern safety standards and technology.

“Who Destroyed Three Mile Island?” by Nickolas Means at the “The Lead Developer 2018” conference in Austin is an interesting talk, covering also how to look at an incident after the fact to really understand it, and in the end – spoiler alert – also covers CRM (without naming it).

Another recommendation would be Brick Immortar. I mainly watch them for their maritime incident videos, based on the U.S. NTSB (National Transportation Safety Board) or Coast Guard investigation reports.

Closing thoughts

Keep an open mind. Of course, you can become a better software developer by reading blogs about programming – but you shouldn’t stop there. There are opportunities to learn something that you can apply to your professional work everywhere. And it makes for more interesting conversations.

Note: The app I’m using here is only available for Android. But even if you use iOS this is still a nice article imho. :)

What is OpenStreetMap again?

OpenStreetMap is comparable to Wikipedia in its goals and methods. It aims to be a crowd-sourced map of the entire world, open and free to use. If you have ever used Apple Maps, played Microsoft Flight simulator ¹, or checked out a point of interest on Facebook, you probably interacted with data from OpenStreetMap. Data that more than 10 million mostly volunteers have contributed over the last 19 years.

The reason why these huge companies can and are relying on OpenStreetMap for at least parts of their world-mapping needs is that the data is licensed under the Open Data Commons Open Database License (ODbL). In short, you are free to share and adapt the database, and build products/projects on it, as long as you attribute the contributors, share your adopted version under the same license, and always (also) offer a version of the database without DRM, if you are distributing it.

Ok, why should I contribute?

Without OpenStreetMap, it would be hard or even impossible to create any small projects that need a relatively detailed map of the world.

You can see this from a capitalist/market perspective: It allows small companies/cooperatives to create great new products, which could never see the light of day without OpenStreetMap breaking down the very high barrier to entry in this market - the barrier of having access to map data. This is especially important, as the big tech companies try to hold down, copy, or simply buy any potential future competitors.

From the societal perspective, it also helps small, non-commercial projects, to cross the same barrier. Projects like OpenTracks, with which you can track your runs, cycle tours, kayak trips or similar activities, without the invasive metric-slurping analytics packages that many other sport trackers come with. There are many other applications, from special use-case routing apps to research and education.

But what it opened my eyes for, is navigation for people with disabilities. Traffic lights, bus stops, and pedestrian crossing all have features that ideally help visually impaired people to use and navigate them, like buzzers and tactile pavings. Of course, I noticed them before here and there, but when mapping in your local area, you really notice where they are, and, maybe more importantly, where they are missing.

And then there is the routing information for wheelchair users or other people who struggle with steps/stairs. Ramps next to steps, the height of curbs, general wheelchair accessibility of buildings: All of these things can and should be mapped.

Still not convinced…

Sure, these are all high and lofty reasons to contribute, but what about me? What do I get out of it?

Fun. Contributing to OpenStreetMap is really fun.

You’ll get outside, you will see your home with different eyes, and you might even get to know hot singles cool mappers in your area.

You will see your edit count go up, see what kind of tasks you solved and where, and get sparkly awards like “Lifesaver” 🧑‍🚒, “Cyclist” 🚴, or “Postman” 📯.

On top of that, you will get these little moments of pride whenever you’ll see the “Copyright © OpenStreetMap Contributors”. And you do see it a lot: On the in-flight entertainment screen, your local bus display, or a random website. I’m doing my part! (even if it’s just a tiny tiny contribution)

Alright, so how do I do this?

1. Download StreetComplete

The easiest way to get started is to download the app StreetComplete on Android.

You will see the map of your local area with little location pins on it. Each pin comes with an icon, that symbolizes the type of the “quest”. Each quest is basically a question about a real-world something - from small things like post boxes and traffic lights (“nodes” in the OSM database), to long things like bicycle paths and streets (“ways”), to large things like entire parking lots and parks (“areas”).

Each of these things can have different attributes in the OpenStreetMap database. A pedestrian path can for example have the attribute “lit”, which can be set to “yes” or “no”, to indicate whether there is lighting at night. ²

If this information is missing, you come in: Clicking on the pin, you will be asked a question - like in this example: “Is this way lit”? Then it is as simple as clicking on yes or no, depending on whether you see lanterns, and that’s it.

2. Create an openstreetmap.org account

Now, at this moment the information you just added is stored locally on your phone. To be able to contribute it to OpenStreetMap, you need an account. In StreetComplete, simply click on the Hamburger menu in the top right (☰), tap on “Profile” and “Login”. You will be redirected to the official openstreetmap.org website, where you can either create a new account or log in with a number of different identity providers.

Note: Keep in mind that this account can likely be connected to your actual identity by a motivated actor. When contributing using StreetComplete you are inevitably publishing your (past) locations, and if you do that over some time, patterns might emerge (your home, your workplace, your school, your travels) that could be used to figure out who you are.

Afterwards your StreetComplete app will ask for your permission to act in your name, to be able to upload your answers, which you have to grant.

3. That’s it

Really. That’s it. (Article continues below)

Now get out there (#dataMotion), and solve fun quests like:

How many bikes can be parked here? What is the width of this street? (Good: Augmented Reality! - Bad: Might get run over.) Do these steps have a handrail? Are these opening hours of this restaurant still correct? What type of building is this?

It’s like Pokémon Go, but for the greater good! (and, of course, for Pokémon Go, which uses OpenStreetMap data, too)

And beyond…

StreetComplete was my entry into the world of OpenStreetMap. I knew about the project for a long time but always thought that it was a complicated beast, guarded by strict administrators that would thoroughly review and probably reject my fumbled contributions.

But with StreetComplete you really can’t do anything wrong, as long as you can reliably tell if a picnic table is protected from rain or not.

And over time I started to contribute to OpenStreetMap using other methods, too: The so-called iD editor, which is the default web editor on openstreetmap.org, has a slightly higher learning curve but still comes with helpful hints and auto-completions.

Let’s say you are using StreetComplete, and are looking forward to entering information about some post box, just to find out that it is not mapped yet?! Inconceivable! That’s when you open iD editor, complete the short tutorial in 5 minutes, just to add the missing something, and suddenly they got you. I might go over my favorite ways of contributing other than StreetComplete in another blog post.

Have fun out there mapping!

But I am also a hobby software developer. And for some time I forgot about the freedoms that the latter gives you. This is the story of how I rediscovered some of the little joys of writing software creating something.

The professional programmer’s mindset

When writing code in a professional setting, there are things to focus on beyond artistic expression, artisanal satisfaction, and the pride a craftsperson.

While the software specifications have to be met, you also have to think about how your code will fare in the inevitable code review. Don’t get me wrong, I think code review is great, and, together with version control and unit testing, one of the few qualities that make me comfortable calling our profession software engineering instead of software development/programming/coding/scripting. But while code review does increase the code quality, it also makes you more conservative in your approaches.
Similarly, I think code style enforcement (linting, or full-on code formatters) are great for collaboration on code. I do enjoy how they can bring order into the mangled code mess that I just wrote with the press of a button, but they are not exactly… personal or fun.
Finally, there is the bus factor, or, more positively, the lottery factor, or, more probable, the job change factor: What happens to this code, once the person who wrote it is, for whatever reason, no longer around? I think about this more than it might be healthy. “What will the the person who has to look at this code once I am gone think of me?”

All of these things should be on your mind when writing code in a professional setting. But I had them weighing on my shoulders even when writing code just for fun. Am I just too professional? /s

The revelation, or, how would I do this?

At the start of this year, a good colleague of mine sent me a link to a blog post by Tom Forbes titled “I scanned every package on PyPi and found 57 live AWS keys”. This is obviously relevant to my interest, so I immediately started thinking about how I would design such a system, while my cursor was on its way to click the link.

Think about how you would design such a system and compare!

I came up with a pretty standard solution, at least for me:

• Python as my language of choice
• A cronjob to query the Python Package Index (PyPI) API
• Some job queue, maybe redis, to fetch packages, and to analyze them
• PostgreSQL to keep track of scanned versions and findings

Nothing too crazy, because we don’t need to store the actual packages. Right?

But reading Tom’s blog post made me see that solution in another light. Because his (idealized) solution consists conceptually of these three lines of bash:

1
2
3

git clone https://github.com/orf/pypi-data.git
fd -t f --min-depth=2 . 'release_data/' | parallel --xargs jq 'to_entries[] | .value.urls[].url' > all_urls.txt
cat all_urls.txt | parallel -I@ "wget @ -O downloads/@ && rg --json -z --multiline $chonky_regex downloads/@" > matches.txt

The script that ended up running on his laptop for 27 hours is more complex, but I still think it’s impressive how simple this is.

This script might not be the most fault resistant and “web-scale” solution. But damn is it understandable (and thereby hopefully maintainable). It fits into “human memory”, nay, I want to say, “human registers”, in its entirety. We don’t even need any abstractions that help us conceptualize what is happening, like a “job to download a package” could be. It’s all there, and relatively readable if you are remotely familiar with the command line. The hardest part about this is the Regular Expression, which admittedly was outsourced as $chonky_regex. And while it is indeed a chonky boi, I have seen way, waay worse.

Write it for yourself

This article got me thinking.

“It’s 10 PM - do you know where your IAM credentials are?”

No, not about my AWS keys or where they currently hang out, but how I tackle my private hobby code:
I seldom write unit tests for my private code that is not intended for public consumption. But more often than I care to admit I do structure it with an imaginary code reviewer in mind. Or a future open-source code contributor who is shaking their head in disgust over my bad abstraction or silly data structure. BUT YOU CAN KEEP SHAKING YOUR HEAD, YOU DON’T EVEN EXIST, STUPID THEORETICAL FUTURE CONTRIBUTOR!

Tackling this won’t succeed overnight, but I am working on it.

I want to build smaller, less reusable solutions, that don’t have to run forever and be fault tolerant to a fault. It’s all about small, ugly, funny, tricky, interesting code instead!

Writing this last paragraph made me think that my one way out of this professional (not to write enterprise-y) mindset were traditionally code challenges: Be it code golfing like js1k or very time-based “competitions”, like the National Novel Generation Month (NaNoGenMo). Maybe that was one of the reasons I enjoyed them so much!

Embrace the bash

Another takeaway for me was to embrace shell scripting more. I do know my way around the console, but seldomly venture outside the beaten paths or solved more complex tasks in it: I do know my cd, grep and |, but even just xargs was always kinda sus. More often than not I would resort to higher programming languages and mostly copy/pasted and adopted shell scripting solutions I found on the interwebs. But that way, I never remembered them to eventually coming up with them by myself from scratch.

But shell scripting is definitely a super power that I would like to get better at. I am fascinated by the Unix philosophy of writing small, simple programs that can consume the output of other small, simple programs, to form one mighty solution to a problem.

My most recent little hobby project is the RDAP bot which I already wrote about in my last blog post. It is currently consisting out of 14 lines of bash and stores its state in plain files on the filesystem. It doesn’t have the full functionality that I want it to have, and 14 lines already feel way too complex compared to the 3 lines you saw above, but it is a start! I came across jq, diff, and || before of course, but this was the first time I got a deeper understanding of their capabilities and limitations. The one thing I dislike about shell scripting is that I always feel like I am halfway into a command injection vulnerability. But I hope that gets better with more experience.

Let’s go and write some tiny software.

RDAP is a nice and simple RESTful API protocol that allows you to query the registrant information from the responsible registries/registrars. In theory every registry should run a RDAP server that can be queried for information about the objects (e.g. domains) it is responsible for. In case of e.g. thin registries, which don’t necessarily have all the data for their registered domains, as they were registered through sub-registrars, they can also point to the RDAP endpoint of the respective sub-registrars. The problem was to initially figure out which RDAP server was responsible for which object in the first place.

This was solved by RFC 9224 “Finding the Authoritative Registration Data Access Protocol (RDAP) Service”. In short, the IANA (Internet Assigned Numbers Authority) is hosting a bunch of files that point you to the right RDAP server for e.g. a specific TLD (or an IP, ASN, etc.).

Unfortunately not every registry has declared and is hosting an authoritative RDAP service. While gTLD registries (like .plumbing or .lamer) are required to provide such a service, the old ccTLD registries (like .de or .uk) are not. And some of the registries that do have declared it put it behind ridiculously low rate-limits. ¹ The Wix.com RDAP endpoint returned a “HTTP 429 Too many requests” response on literally my first ever request-attempt to them.

But, at the time of writing, 80.49% of all TLDs have an authoritative RDAP service declared. I know that, because I built a little Mastodon Bot called @stateofRDAP@botsin.space @stateofRDAP@social.haukeluebbers.de which currently monitors the DNS RDAP bootstrap file and posts about changes to it. So, if you are on Mastodon and are as excited as I am about RDAP, feel free to follow the little fellow.

Currently it just monitors the DNS RDAP boostrap file, and it just handles TLDs being added or removed, but in the future I also want to have it handle changes of RDAP endpoints (e.g. when another registry is taking over responsibility for a TLD) or potentially the other RDAP bootstrap files, depending on the noise levels.

Edit 2026-02-14: The botsin.space instance was gracefully shut down on December 16th 2024 by its owner Cass - after the first annoucement I migrated my RDAP bot to my own gotosocial instance and it is now available under https://social.haukeluebbers.de/@stateofrdap. It went pretty well. Currently we are at 83.29% RDAP coverage.