codahale.com٭blog

sfearthquakes = Twitter + Earthquakes

So, we’ve had some earthquakes in the SF Bay Area recently. Nothing big, but certainly big enough to prompt hundreds of Twitter users to chip in about the last earthquake.

So what did I do?

I went and wrote a Twitter bot to scrape the USGS website and post the results to Twitter.

Voila: sfearthquakes.

The best part? It’s hosted in Texas, so when the big one hits, it’ll still be able to chip in.

bcrypt-ruby: Secure Password Hashing

The Problem

So you remember how Reddit got a backup copy of their database stolen? Do you also remember how, since they stored users’ passwords as plain text, the hacker also got a big list of people’s email addresses and their passwords?

That’s bad. How can you avoid that?

Using bcrypt-ruby

Check out my new gem: bcrypt-ruby.

To install:

sudo gem install bcrypt-ruby

(make sure you have a C compiler and OpenSSL)

To use:

require 'bcrypt'

my_password = BCrypt::Password.create("my password") #=> "$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa"

my_password.version              #=> "2a"
my_password.cost                 #=> 10
my_password == "my password"     #=> true
my_password == "not my password" #=> false

my_password = BCrypt::Password.new("$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa")
my_password == "my password"     #=> true
my_password == "not my password" #=> false

What’s bcrypt?

bcrypt() is the password hashing algorithm used by OpenBSD.

It’s awesome because:

• Developed by The OpenBSD Project specifically for hashing passwords. They don’t screw around with security.
• Salts are automatically generated and managed for you.
• It’s orders of magnitude harder to crack than MD5, SHA2, and other standard hash algorithms.
• It has a cost parameter which allows you to ratchet up the computational expense of checking a password — it can be low for low security situations or high for high security situations.

So don’t get caught with your pants down — be professional.

Send As IM = Adium + Quicksilver

I am now officially in the process of making everything I do Quicksilver-friendly. This round: Adium. The Adium plugin for Quicksilver has been dead since ß36, which means we have to click on things to send IMs. Until now.

The upshot? Cmd+Space, period, “Contact name: Message”, tab, S, enter.

First, The Script

using terms from application "Quicksilver"
  on process text im_text
    repeat with im_delimiter_position from 1 to (length of im_text)
      if character im_delimiter_position of im_text = ":" then exit repeat
    end repeat
    set im_contact_name to characters 1 thru (im_delimiter_position - 1) of im_text as string
    set im_message to characters (im_delimiter_position + 2) thru (length of im_text) of im_text as string
    tell application "Adium"
      send (first contact whose (online is true and (display name starts with im_contact_name or UID starts with im_contact_name))) message im_message
    end tell
    return nothing
  end process text
end using terms from

Second, Installing It

Paste the script into Script Editor and save it in ~/Library/Application Support/Quicksilver/Actions as Send As IM.scpt.

Restart Quicksilver (Cmd+Ctrl+Q).

Third, Using It

Open up Quicksilver (either Ctrl+Space or Cmd+Space), and hit period. Type your message in the following format: “Contact name: message body.” (e.g., “Bob: Hey man, what’s up?”). Hit tab when you’re done. Type out as much of “Send As IM” as you need to select the Send As IM action. Hit enter. Done!

Send As IM finds the first online contact on your buddy list whose display name or screen name starts with what you entered as the contact name. If you’re not already chatting with them, it’ll open up a new chat window and send your message. If you’re already chatting with them, it’ll use the existing window.

Ok… now what else do I use the mouse for?

Tweet = Twitter + Quicksilver

I’m not entirely sure why, but I signed up again for Twitter this morning. Now that it’s not just Tony sending me text messages at 2am about chocolate cake, I can see why people like it. I’ve also been spending some serious time getting geeky with Quicksilver, so I decided to hack together a script to make the two play nicely together.

The upshot? Cmd+Space, period, type your message, tab, tw, enter.

First, The Script

using terms from application "Quicksilver"
  on process text tweet
    tell application "Keychain Scripting"
      set twitter_key to first Internet key of current keychain whose server is "twitter.com"
      set twitter_login to quoted form of (account of twitter_key & ":" & password of twitter_key)
    end tell
    set twitter_status to quoted form of ("source=qucs&status=" & tweet)
    set results to do shell script "curl --user " & twitter_login & " --data-binary " & twitter_status & " http://twitter.com/statuses/update.json"
    -- display dialog results
    return nothing
  end process text
end using terms from

Copy this to the clipboard.

Second, Installing It

Paste the script into Script Editor and save it in ~/Library/Application Support/Quicksilver/Actions as Tweet.scpt.

Restart Quicksilver (Cmd+Ctrl+Q).

Third, Configuring It

If you’re not already using Twitterrific, open Keychain Access and add a new password with the following data:

• Keychain Item Name: http://twitter.com
• Account Name: Your email address
• Password: Your Twitter password

If you’re already using Twitterrific, this password will already be in your Keychain. So just sit tight.

Fourth, Using It

Open up Quicksilver (either Ctrl+Space or Cmd+Space), and hit period. Type out your message, and hit tab when you’re done. Type out as much of the word “Tweet” as you need to select the Tweet action. Hit enter. There, it’s sent.

There is no error checking, so if you’ve got the wrong login info, or if Twitter is down, you’ll never know about it. I guess I’m an optimist. Also, it’s Twitter!

Enjoy!

Update: 1/16/07 Added escaping for the status so that special POSIX characters in your tweet don’t freak out the Bash shell.

Update: 1/20/07 Switched over to --data-binary from -F so that messages which started with @ can be posted.

Update: 1/21/07 Just realized that Quicksilver picks up the script as an action if you put it in the Actions folder, making everything way easier and way less complicated. Yay!

Update: 9/2/08 Mike Keen writes in to say: 

I have been enjoying your Quicksilver/Twitter script. I contacted twitter and added “Quıcĸsıɩⅴεʀ” as a source, so now when people Tweet using your script, it will say “from Quıcĸsıɩⅴεʀ” on Twitter with a link to your blog post. Just change line 3 to:

set twitter_status to quoted form of ("source=qucs&status=" & tweet)

and use the -d CURL option instead of -F

It works like a charm!

I’ve updated the script with his changes. Thanks, Mike!

This is what I think about sometimes

• hanky-panky
• herky-jerky
• heebie-jeebies
• hotsy-totsy
• hocus-pocus
• hurly-burly
• higglety-pigglety
• hobson-jobson
• holus-bolus
• hubble-bubble
• hugger-mugger
• hurry-scurry
• helter-skelter
• harum-scarum
• hurdy-gurdy
• hamper-scamper
• handy-dandy
• helter-skelter
• hodge-podge
• hokey-pokey
• holy-moley
• hoochie-cootchie

Thank you, The English Language, for occasionally weirding me out. Linguists, chip in: what the hell?

(On a totally unrelated note, I’ve fixed everyone’s problems with fixtures in Rails tests. Once I’m sure I’ve got it down, you’ll see it here.)