Just because you’re paranoid doesn’t mean everyone isn’t out to get you.

Running the twin gauntlets of npm and --dangerously-skip-permissions gives you a lot to be paranoid about.

It seems like every other week someone manages to compromise a popular npm package and tries to steal all my precious NFT apes, and it’s just a matter of time until someone prompt-injects my yolo-mode vibecoding session.

I’ve been thinking about this problem in one form or another for years - mostly through a “compromised package” lens, but more recently with coding agents as well. How do you keep your development environment secure, while still reaping the productivity benefits of open source and AI?

The solution is to separate the things you don’t trust from the things you care about. You shouldn’t trust npm packages or coding agents. You should care about your API keys, user data, and (if you’re that way inclined) your apes.

Assume the environment you’re developing software in might be compromised, because you’ve exposed it to things you don’t trust. Then make sure that the things you care about exist in an environment that’s well separated from the potentially compromised development environment.

In an enterprise setting, you might achieve this with some fancy pattern like Privileged Access Workstations (PAWs), or by doing your dev work on virtualised desktop infrastructure (VDI). Those patterns come with big drawbacks though - PAWs require ~double the hardware, VDIs have setup costs and inevitably seem to have terrible user experience (UX).

Dev containers provide a lighter weight option that’s more accessible to solo developers and smaller companies. A bit of discipline is required (which is always bad where security is concerned), but I think they hit a nice sweet spot between security and convenience.

What’s a dev container?

A development container (or dev container for short) allows you to use a container as a full-featured development environment – https://containers.dev/

It’s a container with the development tooling you need installed (things like language runtimes, linters, language servers), and your source code mounted in. You can connect an editor (e.g. VSCode or IntelliJ) running on your host machine to a dev container running in docker locally, or in a remote environment.

There are a few nice things about this.

Firstly, you avoid most of the annoying UX issues of a virtualised desktop environment, because your editor is still running on the same machine with the keyboard and mouse plugged into it.

Secondly, and more relevant to my concerns above, it isolates the development environment from the host machine. This means that a malicious npm package installed in the dev container has dramatically less scope to cause trouble than it would running on the host environment - so long as the things you care about haven’t made their way into your dev container.

Coming up with a secure workflow using dev containers does mean you need to think about what you care about, and carefully separate it from the things you don’t trust.

Securing the things you care about with dev containers

If you’re relying on dev containers for security, you need to make sure you actually separate your dev environments from the things you care about. It’s no help being in a dev container if you use the AWS CLI to administer your cloud environment in the same container you just npm installed some untrustworthy package from the internet.

Things you want to keep out of the container you’re doing dev work in:

• API keys and credentials
• User data (particularly PII, or anything sensitive)
• Private or commercially sensitive source code

You can still use dev containers to administer systems from the CLI, if you want, but you should make sure you don’t run anything you don’t trust in those containers.

As mentioned above, one of the untrustworthy things you might want to do in your dev container is run a coding agent. If you’re using a remote model (e.g. claude code), this results in a circular problem - as soon as you authenticate your coding agent to its API, you’ve given it something you care about (API credentials), so you have to at least worry that a prompt injection or hallucination-squatting npm package (i.e. a malicious package with a name likely to be hallucinated by an LLM) might steal those credentials. I don’t think there’s a way around this - --dangerously-skip-permissions still does what it says on the tin, sadly. At least isolating the agent from your host OS and any other secrets that it doesn’t fundamentally need is better than nothing though.

Gotchas and caveats

Dev containers aren’t designed with security as their primary use case, so it is probably possible for a motivated and skilled adversary to cause problems outside of the container. There’s the security of the container runtime itself (say, docker), which I’m not qualified to judge.

If you’re connecting your IDE (say VSCode) to the container, that opens up more attack surface that you have to worry about. Often, IDEs will do clever things like forward your host machine’s ssh session into the container, often without warning you that they’re doing it, so you might expose something you care about (being able to ssh into things and pull / push from git remotes) without even realizing it.

Also I’m just a bloke on the internet - probably don’t take security advice from some random guy’s blog.

All that said, I think dev containers are a good step up from just running everything on your host OS, which is still what a lot of developers do. Usability is really okay, and the isolation is a lot better than nothing.

Prelude

drop table if exists relationships;
create table relationships(
  id serial,
  source uuid,
  target uuid default gen_random_uuid(),
  relationship text
);

drop table if exists characters;
create table characters(
  id uuid default gen_random_uuid() unique,
  type text,
  name text
);

As I was going to St Ives

with
  narrator as (
    insert into characters (name, type)
    values ('Narrator', 'Narrator')
    returning id
  ),
  journey as (
    insert into relationships(source, relationship)
    select narrator.id, 'Going to'
    from narrator
    returning target
  ),
  st_ives as (
    insert into characters (id, name, type)
    select journey.target, 'St Ives', 'Place'
    from journey
    returning id
  ),

I met a man

  meeting as (
    insert into relationships(source, relationship)
    select narrator.id, 'Met'
    from narrator
    returning target
  ),
  man as (
    insert into characters(id, name, type)
    select meeting.target, 'Man', 'Man'
    from meeting
    returning id
  ),

with seven wives,

  marriages as (
    insert into relationships(source, relationship)
    select man.id, 'Wife'
    from man, generate_series(1, 7)
    returning target
  ),
  wives as (
    insert into characters(id, name, type)
    select marriages.target, 'Wife ' || row_number() over (), 'Wife'
    from marriages
    returning id
  ),

Each wife had seven sacks,

  sack_owners as (
    insert into relationships(source, relationship)
    select wives.id, 'Owns'
    from wives, generate_series(1, 7)
    returning target
  ),
  sacks as (
    insert into characters(id, name, type)
    select sack_owners.target, 'Sack ' || row_number() over (), 'Sack'
    from sack_owners
    returning id
  ),

Each sack had seven cats,

  cat_sacks as (
    insert into relationships(source, relationship)
    select sacks.id, 'Contains'
    from sacks, generate_series(1, 7)
    returning target
  ),
  cats as (
    insert into characters(id, name, type)
    select cat_sacks.target, 'Cat ' || row_number() over (), 'Cat'
    from cat_sacks
    returning id
  ),

Each cat had seven kits:

  kit_cats as (
    insert into relationships(source, relationship)
    select cats.id, 'Parent'
    from cats, generate_series(1, 7)
    returning target
  )
insert into characters(id, name, type)
select kit_cats.target, 'Kit ' || row_number() over (), 'Kit'
from kit_cats;

Kits, cats, sacks, and wives, How many were there going to St Ives?

select count(*)
from relationships
join characters place
  on relationships.target = place.id
  and relationship = 'Going to'
  and place.name='St Ives'
join characters on relationships.source = characters.id
where characters.type in ('Kit', 'Cat', 'Sack', 'Wife');

-- +-----+
-- |count|
-- +-----+
-- |0    |
-- +-----+

select type, count(*)
from characters
where type != 'Place'
group by rollup (type)
order by count(*), type;

-- +--------+-----+
-- |type    |count|
-- +--------+-----+
-- |Man     |1    |
-- |Narrator|1    |
-- |Wife    |7    |
-- |Sack    |49   |
-- |Cat     |343  |
-- |Kit     |2401 |
-- |null    |2802 |
-- +--------+-----+

Let’s say we’ve got some graph-like data, such as a social network.

We can represent this generically with two tables:

create table nodes (
  id serial primary key,
  name text,
  details jsonb
);

create table edges (
  id serial primary key,
  type text,
  from_id integer references nodes(id),
  to_id integer references nodes(id),
  details jsonb
);

And we can insert some data (using lord of the rings characters) like this:

insert into nodes (name, details) values
  ('Frodo Baggins', '{"species": "Hobbit"}'), -- 1
  ('Bilbo Baggins', '{"species": "Hobbit"}'), -- 2
  ('Samwise Gamgee', '{"species": "Hobbit"}'), -- 3
  ('Hamfast Gamgee', '{"species": "Hobbit"}'), -- 4
  ('Gandalf', '{"species": "Wizard"}'), -- 5
  ('Aragorn', '{"species": "Human"}'), -- 6
  ('Arathorn', '{"species": "Human"}'), -- 7
  ('Legolas', '{"species": "Elf"}'), -- 8
  ('Thranduil', '{"species": "Elf"}'), -- 9
  ('Gimli', '{"species": "Dwarf"}'), -- 10
  ('Gloin', '{"species": "Dwarf"}'); -- 11

-- Parents
insert into edges (type, from_id, to_id, details) values
  ('parent', 2, 1, '{}'),
  ('parent', 4, 3, '{}'),
  ('parent', 7, 6, '{}'),
  ('parent', 9, 8, '{}'),
  ('parent', 11, 10, '{}');

Simple queries - finding parents and children

We can find someone’s parents by joining the edges table to the nodes table.

Hardcoding the child id (3) to find Samwise’s parents:

select parent.name from nodes child
join edges on edges.to_id = child.id
join nodes parent on edges.from_id = parent.id
where child.id = 3;

If we didn’t know Samwise’s id, we could find him by name first using a CTE:

with child as (select id from nodes where name = 'Samwise Gamgee')
select parent.name from child
join edges on edges.to_id = child.id
join nodes parent on edges.from_id = parent.id;

More complex queries - friends of friends

Not all of our characters knew each other directly. The friendship graph is a bit more complex:

insert into edges (type, from_id, to_id, details) values
  -- Everyone in the fellowship is friends with everyone else
  ('friend', 1, 3, '{}'), -- Frodo and Sam
  ('friend', 1, 5, '{}'), -- Frodo and Gandalf
  ('friend', 1, 6, '{}'), -- Frodo and Aragorn
  ('friend', 1, 8, '{}'), -- Frodo and Legolas
  ('friend', 1, 10, '{}'), -- Frodo and Gimli
  ('friend', 3, 1, '{}'), -- Sam and Frodo
  ('friend', 3, 5, '{}'), -- Sam and Gandalf
  ('friend', 3, 6, '{}'), -- Sam and Aragorn
  ('friend', 3, 8, '{}'), -- Sam and Legolas
  ('friend', 3, 10, '{}'), -- Sam and Gimli
  ('friend', 5, 1, '{}'), -- Gandalf and Frodo
  ('friend', 5, 3, '{}'), -- Gandalf and Sam
  ('friend', 5, 6, '{}'), -- Gandalf and Aragorn
  ('friend', 5, 8, '{}'), -- Gandalf and Legolas
  ('friend', 5, 10, '{}'), -- Gandalf and Gimli
  ('friend', 6, 1, '{}'), -- Aragorn and Frodo
  ('friend', 6, 3, '{}'), -- Aragorn and Sam
  ('friend', 6, 5, '{}'), -- Aragorn and Gandalf
  ('friend', 6, 8, '{}'), -- Aragorn and Legolas
  ('friend', 6, 10, '{}'), -- Aragorn and Gimli
  ('friend', 8, 1, '{}'), -- Legolas and Frodo
  ('friend', 8, 3, '{}'), -- Legolas and Sam
  ('friend', 8, 5, '{}'), -- Legolas and Gandalf
  ('friend', 8, 6, '{}'), -- Legolas and Aragorn
  ('friend', 8, 10, '{}'), -- Legolas and Gimli
  ('friend', 10, 1, '{}'), -- Gimli and Frodo
  ('friend', 10, 3, '{}'), -- Gimli and Sam
  ('friend', 10, 5, '{}'), -- Gimli and Gandalf
  ('friend', 10, 6, '{}'), -- Gimli and Aragorn
  ('friend', 10, 8, '{}'), -- Gimli and Legolas
  -- Bilbo was friends with Hamfast and Gandalf
  ('friend', 2, 4, '{}'), -- Bilbo and Hamfast
  ('friend', 2, 5, '{}'), -- Bilbo and Gandalf
  -- And vice versa
  ('friend', 4, 2, '{}'), -- Hamfast and Bilbo
  ('friend', 5, 2, '{}'), -- Gandalf and Bilbo
  -- Gandalf was friends with Bilbo, Hamfast and Thranduil, but for the sake of
  -- argument let's say he didn't know Gloin or Arathorn
  ('friend', 5, 2, '{}'), -- Gandalf and Bilbo
  ('friend', 5, 4, '{}'), -- Gandalf and Hamfast
  ('friend', 5, 9, '{}'), -- Gandalf and Thranduil
  -- And vice versa
  ('friend', 2, 5, '{}'), -- Bilbo and Gandalf
  ('friend', 4, 5, '{}'), -- Hamfast and Gandalf
  ('friend', 9, 5, '{}'); -- Thranduil and Gandalf

We could follow two friendship links using CTEs like before. Let’s say friends of friends of Samwise:

with samwise as (select id from nodes where name = 'Samwise Gamgee'),
samwise_friends as (
  select distinct edges.to_id from edges
  join samwise on edges.from_id = samwise.id and edges.type = 'friend'
),
friends_of_friends as (
  select distinct edges.to_id from edges
  join samwise_friends on edges.from_id = samwise_friends.to_id and edges.type = 'friend'
)
select name from friends_of_friends join nodes on nodes.id = friends_of_friends.to_id;

This returns almost everyone, except for Arathorn and Gloin who we’ve decided weren’t friends with anyone Samwise knew (even though they probably knew Gandalf, in reality).

If we don’t mind building up arbitrarily long chains of CTEs, we can follow any number of edges using this technique.

It would be kind of nice to be able to pass in the root node and the edge paths as parameters though, rather than dynamically building up the CTEs.

Parameterised recursive CTEs

Let’s say we want to find the parents of the friends-of-friends of Samwise.

We could do this naively by building up a CTE for each level of friendship:

with samwise as (select id from nodes where name = 'Samwise Gamgee'),
samwise_friends as (
  select distinct edges.to_id from edges
  join samwise on edges.from_id = samwise.id and edges.type = 'friend'
),
friends_of_friends as (
  select distinct edges.to_id from edges
  join samwise_friends on edges.from_id = samwise_friends.to_id and edges.type = 'friend'
),
friends_of_friends_parents as (
  select distinct edges.from_id from edges
  join friends_of_friends on edges.to_id = friends_of_friends.to_id and edges.type = 'parent'
)
select name from friends_of_friends_parents join nodes on nodes.id = friends_of_friends_parents.from_id;

But this quickly becomes unwieldy. Instead, let’s pull the variable bits out, and use a recursive CTE:

with recursive 
root(id) as (select id from nodes where name = 'Samwise Gamgee'),
paths(path) as (values ('{friend,friend,parent}'::text[])),
results(id) as (
  select root.id, 1 as path_index from root
union
  select edges.from_id, path_index + 1 as path_index from results
  join edges on edges.to_id = results.id
  join paths on edges.type = paths.path[path_index]
)
select * from results
join nodes on nodes.id = results.id
join paths on cardinality(paths.path) + 1 = results.path_index;

This can then be parameterised, so we can create this as a prepared statement and call it lots of times with different root nodes and paths.

with recursive 
root(id) as (select id from nodes where name = ?),
paths(path) as (values (?::text[])),
results(id) as (
  select root.id, 1 as path_index from root
union
  select edges.from_id, path_index + 1 as path_index from results
  join edges on edges.to_id = results.id
  join paths on edges.type = paths.path[path_index]
)
select * from results
join nodes on nodes.id = results.id
join paths on cardinality(paths.path) + 1 = results.path_index;

If we wanted every node along the path, instead of just the end node, we could remove the join to paths in the final line.

Conclusion

This is one way of representing graph-like data in Postgresql, and querying it in a flexible way.

I’d be very interested in hearing about other techniques or improvements.

Update 2025

As of Rails 7.2 ActiveRecord has support for recursive CTEs built in (thanks to ClearlyClaire).

It would still be a bit of a faff to construct the exact SQL from the postgres docs using Arel (as this blog post does), but roughly you could do:

class T < ActiveRecord::Base
  def self.table_name = "t"
end

ActiveRecord::Base.connection.execute(
  T.with_recursive(
    Arel.sql("t(n)") => [
      Arel.sql("VALUES (1)"),
      Arel.sql("SELECT n+1 FROM t WHERE n < 100")
    ]
  ).to_sql
)

The example from the changelog is probably better:

Post.with_recursive(
  post_and_replies: [
    Post.where(id: 42),
    Post.joins('JOIN post_and_replies ON posts.in_reply_to_id = post_and_replies.id'),
  ]
)

Generates the following SQL:

WITH RECURSIVE "post_and_replies" AS (
  (SELECT "posts".* FROM "posts" WHERE "posts"."id" = 42)
  UNION ALL
  (SELECT "posts".* FROM "posts" JOIN post_and_replies ON posts.in_reply_to_id = post_and_replies.id)
)
SELECT "posts".* FROM "posts"

Original post

ActiveRecord is the Object Relational Mapper (ORM) in Rails which lets you interact with the database.

A lot of the time, you don’t have to think about SQL all that much - you write queries like:

User.where(name: 'Richard', occupation: 'Code Monkey').order(created_at: :desc)

… and ActiveRecord turns them to SQL invisibly when it goes to the database to fetch the results.

Occasionally though, we want to write a some SQL that isn’t well supported in ActiveRecord, or is quite separate from the models we have in the database.

Recursive CTEs in Postgresql

The Postgresql docs on Recursive Queries give the following example of a SQL query that sums the integers from 1 through 100:

WITH RECURSIVE t(n) AS (
    VALUES (1)
  UNION ALL
    SELECT n+1 FROM t WHERE n < 100
)
SELECT sum(n) FROM t;

How would we express this in ActiveRecord? It doesn’t refer to any tables in the database, and it uses a few bits of SQL which ActiveRecord hasn’t got great support for (WITH RECURSIVE, VALUES(1), UNION ALL).

ActiveRecord includes a lower-level library called Arel, which allows us to manipulate the Abstract Syntax Tree more directly.

This includes the Arel.sql() method, which marks arbitrary strings as SQL statements. So the easiest thing to do would be to just wrap the whole SQL string with Arel.sql() and be done with it. That doesn’t compose well with the rest of ActiveRecord though - it would be nice if we could mix and match bits of custom SQL with ActiveRecord queries.

Recursive CTEs in ActiveRecord / Arel

We can use Arel to construct the syntax tree for the SQL in Postgresql’s docs.

First, we create a “table” reference called “t” - note that this isn’t actually creating a table (and in fact there is no table in the database called “t” at all), it’s just a way to refer to a table-like thing called “t”, like the one we have in WITH RECURSIVE t(n).

cte_table = Arel::Table.new(:t)

Next up we need the base case, which in SQL is VALUES (1). The best way I can work out to do this is:

base_case = Arel::Nodes::ValuesList.new([[1]])

Then we need the recursive case, SELECT n+1 FROM t WHERE n < 100 in SQL. We can refer to the n column on the t table reference using cte_table[:n], leading to:

recursive_case = cte_table
    .project(cte_table[:n] + 1)
    .where(cte_table[:n].lt(100))

Now we can create the CTE, which names itself t(n), and is a UNION ALL between the base case and the recursive case:

cte_definition = Arel::Nodes::Cte.new(
  Arel.sql("t(n)"),
  Arel::Nodes::UnionAll.new(base_case, recursive_case),
)

(Note that we had to use Arel.sql() here - this isn’t very elegant, but I couldn’t work out a way to get it to emit t(n) without wrapping it in quotes like "t(n)" which doesn’t work).

Finally, we can put this all together with the SELECT sum(n) FROM t clause and we have the full CTE:

cte = cte_table.project(cte_table[:n].sum).with(:recursive, cte_definition)

Calling cte.to_sql gives us (almost) the exact SQL we wanted:

WITH RECURSIVE t(n) AS ( VALUES (1) UNION ALL (SELECT ("t"."n" + 1) FROM "t" WHERE "t"."n" < 100) ) SELECT SUM("t"."n") FROM "t"

And running this against a Postgresql database with ActiveRecord:

ActiveRecord::Base.connection.execute(cte.to_sql)

Gives the answer - {"sum"=>5050}

All in all, a very convoluted way to do the equivalent of (1..100).sum.

(Or the more efficient (100 * (1 + 100)) / 2 - thanks Carl Friedrich Gauss!)

Closing thoughts

The main reason to go to all this trouble is to be able to compose bits of ActiveRecord with less well-supported SQL features, which can occasionally have big performance advantages. Recursive CTEs can be very useful for traversing tree and graph structures without having to make multiple calls to the database, which in some situations can lead to big speed ups.

I’m not sure how stable the Arel library is - it’s possible it’s only really intended to be used inside ActiveRecord, so this approach could be a bit of a maintenance headache with ActiveRecord upgrades.

Prior art / Credits

I worked a lot of this out by following other people’s blog posts. In particular:

• 6 Useful Arel Techniques for Composing Queries
• The definitive guide to Arel, the SQL manager for Ruby
• Arel, part II: Common table expressions - rails

… none of them quite made it clear how to implement the case in the docs though, so here we are with another blog post.

An homage to Aphyr’s Typing the technical interview

Criss shows you into a meeting room.

Hoodie clad, and resembling no animal in particular, he seems familiar. Though you’re confident you haven’t met. The room too, though this is your first visit.

“How’re you doing?” he asks

A difficult question to begin with, to explain what inner workings drive your actions. Perhaps the question is rhetorical?

“How indeed”, you smile.

“… umm, great. Okay, shall we get into it?”

You nod, reassuringly.

“Right. So we’re going to do a little programming puzzle, so I can understand how you solve problems. Don’t worry if you’re not able to complete the exercise, the main thing is for me to get a feel for how you think and communicate.”

Worry? You struggle to recall the feeling. Perhaps in your youth, wintering in Svalbard amongst the bears. Before you understood the seiðr.

“The problem is called N-Queens” Criss continues, “and it’s fairly simple. Given an NxN chessboard, you need to find a way to place N queens on that board safely. Try to keep your code concise.”

The trickle of déjà vu you were feeling becomes a flood. You have met Criss before. In this room, solving this puzzle. But the memory won’t recall. Perhaps, in a past life? But he’s far too young for that.

Pause a moment to compose yourself.

“Can I use any language?” you repeat.

“Well… we’re mostly a TypeScript shop. And we’ve had some … unfortunate experiences with people using other languages. A candidate used Haskell once, and I did struggle a little bit to follow along. It wasn’t particularly concise.”

Ahhhhh. Vidrun has been here. That explains the déjà vu. You have shared much.

“TypeScript then”, you agree. Criss looks reassured. His doom is already set.

“We’ll need to start with a few runes”, you say.

Criss chips in immediately. “Runes, like in Go? Didn’t we just agree to use TypeScript?”

“Oh, no, not those kinds of runes. Runes, shadows of meaning. Symbolic. Unique.”

Inhale, inscribe.

const ᚾ = Symbol()
const ᛊ = Symbol()
const ᛚ = Symbol()
const ᛞ = Symbol()

“TypeScript is duck typed, you see. And one duck must not be confused for another.”

“You mean it’s structurally typed? Unlike something nominally typed like Java, or Haskell?”

“Yes, exactly”, you respond. Perhaps Criss is following after all. “Here, I’ll show you.”

Summon the void itself, and bind it with the essence of ᚾ. Need, nothingness, the frustrated longing to become.

type Nil = typeof ᚾ

“Hold on, don’t we already have null and undefined? Why are we defining our own type for Nil?”

“The built in types come with too much baggage - null, undefined, falsey values. Better to start from a clean beginning.”

Smiling contentedly at the memory of Vidrun, complete the linked list.

type Cons<x, xs> = [x, xs]

You hear Criss’ breath catch. Quickly, before he can escape.

“Let’s do booleans, to represent threat and safety”

Truth, fire, a sun. Bound with ᛊ.
Lies, falsehood, the depths of a lake. Bound with ᛚ.

type True = typeof ᛊ
type False = typeof ᛚ

“And some simple logic”

type Not<b1> = b1 extends True ? False : b1 extends False ? True : never
type Or<b1, b2> = b1 extends True ? True : b2 extends True ? True : False

“… but why …” Criss begins, but doesn’t finish. Don’t worry. Continue.

Is there any truth? You sometimes wonder.

type AnyTrue<list> = list extends Cons<infer x, infer xs>
    ? x extends True
        ? True
        : AnyTrue<xs>
    : False

“We’ll need to represent the coordinates of our queens, so we’ll need numbers too.”

Start by ensnaring zero. ᛞ, the day rune. Use a zero day and carry the zero.

type Zero = typeof ᛞ

“Now we can define the rest of the natural numbers, building on zero.”

type S<n> = [n]

type One   = S<Zero>
type Two   = S<One>
type Three = S<Two>
type Four  = S<Three>
type Five  = S<Four>
type Six   = S<Five>
type Seven = S<Six>
type Eight = S<Seven>

Criss is completely grey now. His breath begins to cloud, as the chill in the air intensifies. He knows what’s coming.

“We’ll need to be able to do a couple of operations on our numbers. Equality, difference.”

“Important concepts in a company like this.”, you add. Noting the distinct lack of the latter over the tundra of the open plan office.

type Equals<a, b> = a extends S<infer a_>
    ? b extends S<infer b_>
        ? Equals<a_, b_>
        : False
    : b extends Zero
        ? True
        : False

type AbsDiff<a, b> = a extends S<infer a_>
    ? b extends S<infer b_>
        ? AbsDiff<a_, b_>
        : a
    : b extends S<any>
        ? b
        : Zero

“And for convenience, let’s have a function to create a range from zero to n.”

type RangeFromZeroTo<n, xs = Nil> = n extends S<infer n_>
    ? RangeFromZeroTo<n_, Cons<n, xs>>
    : Cons<Zero, xs>

“Criss! Criss, we’re ready now. It’s okay, we’re ready now.”

He’s mumbling something under his breath. “not again. not again.”

Define a queen. Any queen of your clan would need more depth than just x and y, but keep it simple.

type Queen<x, y> = [x, y]

Create a row of queens. Too threatening to be on the same row, at the same time, in the same universe. They will have to be divided across the multiverse. This too has happened, in the history of your kind.

type RowOfQueens<cols, row> = cols extends Cons<infer col, infer cols_>
    ? Cons<Queen<row, col>, RowOfQueens<cols_, row>>
    : cols

“A queen threatens another if she is in the same row, column, or diagonal.”

type Threatens<a, b> = a extends Queen<infer ax, infer ay>
    ? b extends Queen<infer bx, infer by>
        ? Or<
            Or<Equals<ax, bx>, Equals<ay, by>>,
            Equals<AbsDiff<ax, bx>, AbsDiff<ay, by>>
        >
        : never : never

“never… never…” whimpers Criss. You’re not sure if this is a question about the code, but explain:

“Threatens shouldn’t be called with anything that isn’t a Queen. We’re using never to represent the exception where it’s called with the wrong types.”

You’ve swam upon the devil’s lake, but never, never, never, never. You’ll never make the same mistake. No, never, never, never.

“We’re going to work our way down the rows of the chess board, placing queens wherever possible. Given a list of already placed queens, which ones would threaten a new queen?”

type ThreateningQueens<placedQueens, queen> =
    placedQueens extends Cons<infer placedQueen, infer placedQueens_>
        ? Cons<
            Threatens<placedQueen, queen>,
            ThreateningQueens<placedQueens_, queen>
        >
        : Nil

“A queen is safe only if none of the other queens are threatening her.”

type Safe<placedQueens, queen> =
    Not<AnyTrue<ThreateningQueens<placedQueens, queen>>>

“Now taking a list of possible queens, which ones would be safe from the queens already on the board?”

type FilterSafeQueens<candidates, placedQueens> =
    candidates extends Cons<infer q, infer qs>
        ? Safe<placedQueens, q> extends True
            ? Cons<q, FilterSafeQueens<qs, placedQueens>>
            : FilterSafeQueens<qs, placedQueens>
        : Nil

“As we work down the board, we only need to consider the positions in the next row where a queen would be safe.”

type Next<row, placedQueens = Nil> =
    FilterSafeQueens<RowOfQueens<RangeFromZeroTo<N>, row>, placedQueens>

“Criss, are you ready?”

His eyelashes are coated with frost, framing a beautiful pair of eyes. Beautiful, but devoid of focus.

“A pair of mutually recursive functions to find the solution.”

Two lovers, they waltz. Not every step forwards, but backtracking, spinning, gently alighting on the answer at just the right moment.

type SolveNextRow<row, placedQueens> =
    Solve<Next<S<row>, placedQueens>, S<row>, placedQueens>

type Solve<candidates, row, placedQueens> = Equals<row, N> extends True
    ? candidates extends Cons<infer x, any>
        ? Cons<x, placedQueens>
        : Nil
    : candidates extends Cons<infer x, infer xs>
        ? SolveNextRow<row, Cons<x, placedQueens>> extends Nil
            ? Solve<xs, row, placedQueens>
            : SolveNextRow<row, Cons<x, placedQueens>>
        : Nil

“Criss” you say gently “the solution”

// We get one queen for free at Zero, so:
type N = Seven
type Solution = Solve<Next<Zero>, Zero, Nil>

A mouse flits across the Solution, and the language server renders:

Cons<
  Queen<S<S<S<S<S<S<S<unique symbol>>>>>>>, Three>,
  Cons<
    Queen<S<S<S<S<S<S<unique symbol>>>>>>, One>,
    Cons<
      Queen<S<S<S<S<S<unique symbol>>>>>, Six>,
      Cons<
        Queen<S<S<S<S<unique symbol>>>>, Two>,
        Cons<
          Queen<S<S<S<unique symbol>>>, Five>,
          Cons<
            Queen<S<S<unique symbol>>, Seven>,
            Cons<
              Queen<S<unique symbol>, Four>,
              Cons<
                Queen<unique symbol, unique symbol>, unique symbol>
              >
            >
          >
        >
      >
    >
  >

“Our chessboard is one indexed, not zero indexed, so that’s queens at a1, b5, c8, d6, e3, f7, g2, and h4. Does that work Criss?”

You sketch the solution on the whiteboard.

As warmth begins to return to the room, Criss starts to recover.

“Okay, that looks like a correct solution, but the code is quite hard to follow, and it’s not very concise.” he asserts, wrongly.

“Oh it’s mostly just TypeScript boilerplate. I think you’ll find once it’s compiled down to JavaScript it’s perfectly concise.” you reassure him.

Invoke the compiler

$ tsc *.ts --lib esnext --outFile /dev/stdout 
var ᚾ = Symbol();
var ᛊ = Symbol();
var ᛚ = Symbol();
var ᛞ = Symbol();

Criss looks like he’s been slapped. You leave him to it and show yourself out.

Links

• Explore the code in the TypeScript Playground
• Discuss this post on Mastodon

Errata

• 2023-03-13 - There was a bug in the base case of the Solve “function”, pointed out by jtinder on Hacker news.
• 2023-03-13 - The solution was missing a trailing Nil, pointed out by @gholk on Mastodon
• 2025-05-23 - An earlier version of this post stopped at a 7x7 chessboard, because of recursion limits in the TypeScript compiler. The new Go implementation of the typescript compiler has a much deeper limit though, and the solution works up to a 10x10 chessboard now. Updated the post to an 8x8 because that’s the classic.

Skip to the solution

We’ve got this fancy application at work - router. Router uses a data structure called a trie to efficiently search a list of strings and find the one that is the longest prefix of some input.

For example, if I searched for /apply-for-a-licence/temporary-event-notice/east-hertfordshire/apply-1, router could very quickly tell me that the longest prefix in its database is /apply-for-a-licence. As this GDS’ blog post from 2013 says, the trie data structure is a natural choice for this task.

But what if we wanted to accomplish the same thing in SQL, in a database which doesn’t come with a trie data structure?

The perils of stackexchange

Obviously the first thing to do is to Google it. For me, the most promising result was this dba.stackexchange.com question, which asks for an “Algorithm for finding the longest prefix”.

The example is a tiny bit more complicated than ours, but it looks similar enough. This looks like it should have a good answer.

When I first found this question there were three answers. The top answer had 22 upvotes and was marked as the best answer, the other two answers had one and zero upvotes each. So obviously the top answer is the place to focus.

But… oh boy is this complicated. The “simple” solution uses DISTINCT ON, a postgres specific extension, and is acknowledged to be very slow without an index. Next we’re into trigram indexes, but whether we use GIST or GIN, the query is still slow - taking around 1 second. The answer goes through a bunch of options - text_pattern_ops, “partial functional indexes”, recursive CTEs, explicitly laid out recursion with UNION ALL, SQL funtions, and finally dynamic SQL.

I know enough SQL to be dangerous, but at this point my eyes glazed over and I started to think that this problem was probably just too hard.

Maybe a relational database is just not the right solution to this problem?

A relational database is always the right solution to the problem

Later on, in the shower (always the best place to get thinking done), the problem popped back into my head.

What if we sorted all the possible prefixes we know about, and then inserted the search key into that table?

If there’s a matching prefix, the prefix would always come immediately before the thing we’re searching for if they’re sorted alphabetically. Something like:

  /apply-first-provisional-driving-licence
  /apply-for-a-digital-tachograph-company-smart-card
  /apply-for-a-digital-tachograph-driver-smart-card
👀/apply-for-a-licence <--- 👀 The longest matching prefix
✨/apply-for-a-licence/temporary-event-notice/east-hertfordshire/apply-1 <--- ✨ The thing we're searching for
  /apply-for-a-patent
  /apply-for-a-thames-accommodation-licence

The default data structure that postgres uses for its indexes is the B-Tree. B-Trees maintain a sorted order, so shouldn’t the database be able to work out an efficient way to do this? So long as we give it the right query?

Initial attempts

Taking a really simple example where we’ve just got one column with all our path prefixes in:

create table routes(path text);
create index routes_index on routes (path);

The first thing I tried was basically the same as the approach I sketched out above - find the item that would appear just before this item in the list:

select path from routes
where '/apply-for-a-licence/temporary-event-notice/east-hertfordshire/apply-1' >= path
order by path desc
limit 1;

/apply-for-a-licence

Which works! “Perfectly”…

It’s also efficient!

explain analyze select path from routes
where '/apply-for-a-licence/temporary-event-notice/east-hertfordshire/apply-1' >= path
order by path desc
limit 1;

Limit (cost=0.28..0.42 rows=1 width=32) (actual time=0.036..0.037 rows=1 loops=1)
-> Index Only Scan Backward using routes_index on routes (cost=0.28..303.96 rows=2267 width=32) (actual time=0.034..0.035 rows=1 loops=1)
Index Cond: (path <= '/apply-for-a-licence/temporary-event-notice/east-hertfordshire/apply-1'::text)
Heap Fetches: 1
Planning Time: 0.329 ms
Execution Time: 0.056 ms

That “Index Only Scan” is what we want to see. Postgres can answer this query using the index only, which is very fast.

Unfortunately, this query will produce confusing / wrong results whenever you search for something which doesn’t have a matching prefix:

select path from routes
where '/aaron-a-aaronson' >= path
order by path desc
limit 1;

/30-hours-free-childcare

wat.

This could be fixed by wrapping the result in a check that it’s really a prefix of the search string, but there’s a better way.

Back to stackexchange

At this point I thought back to the stackexchange question. The people on that forum know a lot more about databases than I do. If it was really this easy to solve this problem, wouldn’t they have already suggested this approach? Perhaps there was some subtlety I hadn’t spotted.

Sure enough, the second answer (which I had ignored because it only had the one upvote) takes exactly this approach.

A string S is a prefix of a string T iff T is between S and SZ where Z is lexicographically larger than any other string (eg 99999999 with enough 9’s to exceed the longest possible phone number in the dataset, or sometimes 0xFF will work). The longest common prefix for any given T is also lexicographically maximal, so a simple group by and max will find it. …

• KWillets answered Sep 6, 2016 at 18:15

Fancier words, but it’s the same idea.

Additionally, they had the bright idea to use between ... and and tack a suffix onto the column being searched to avoid the problem when you search for something which doesn’t have a matching prefix. 9 is a good choice of suffix if you’re dealing with numbers, but we’ve got letters too so I think ~ is a better choice (~ is the last ASCII character when sorted alphabetically).

Repeating the sketch above, this would be something like:

  /apply-first-provisional-driving-licence
  /apply-first-provisional-driving-licence~~~~~~~~
  /apply-for-a-digital-tachograph-company-smart-card
  /apply-for-a-digital-tachograph-company-smart-card~~~~~~~~
  /apply-for-a-digital-tachograph-driver-smart-card
  /apply-for-a-digital-tachograph-driver-smart-card~~~~~~~~
👀/apply-for-a-licence <--- 👀 The longest matching prefix
✨/apply-for-a-licence/temporary-event-notice/east-hertfordshire/apply-1 <--- ✨ The thing we're searching for
👀/apply-for-a-licence~~~~~~~~ <--- 👀 The longest matching prefix, with a bunch of ~s tacked on to the end
  /apply-for-a-patent
  /apply-for-a-patent~~~~~~~~
  /apply-for-a-thames-accommodation-licence
  /apply-for-a-thames-accommodation-licence~~~~~~~~

I’ve given this answer another upvote. I think it’s really elegant (even if the bit about appending a bunch of 9s / ~s is a bit weird). If you’ve got a stackexchange account, you should upvote it too.

The solution

Combining the clever insight from stackexchange with the query I came up with in the shower gives:

select path from routes
where ? between path and path||'~~~~~'
order by path desc
limit 1;

With '/apply-for-a-licence/temporary-event-notice/east-hertfordshire/apply-1' this gives:

/apply-for-a-licence

With '/aaron-a-aaronson' this gives:

[No results]

Which is exactly what we want. And it’s still efficient:

explain analyze select path from routes
where '/aaron-a-aaronson' between path and path||'~~~~~'
order by path desc
limit 1;

Limit (cost=0.28..0.70 rows=1 width=32) (actual time=0.036..0.036 rows=0 loops=1)
-> Index Only Scan Backward using routes_index on routes (cost=0.28..315.29 rows=756 width=32) (actual time=0.035..0.035 rows=0 loops=1)
Index Cond: (path <= '/aaron-a-aaronson'::text)
Filter: ('/aaron-a-aaronson'::text <= (path || '~~~~~'::text))
Rows Removed by Filter: 5
Heap Fetches: 5
Planning Time: 0.305 ms
Execution Time: 0.057 ms

Conclusions

1. Relational databases are brilliant
2. It is possible to efficiently query for a longest prefix in SQL
3. The best answer on stackexchange is sometimes hiding without many upvotes
4. Try not to get intimidated by watching someone go down the rabbit hole on stackexchange

I’ve spent a lot of my career wrangling certificates. They’re used to secure traffic on the web, they’re used in authentication protocols like SAML, they’re used for signing and encrypting various other kinds of document.

Certificates can be represented / disguised in a few different formats, and some of them are easier to spot than others.

Recently I had to find an Adobe Reader Extensions certificate embedded in a PDF document, which pushed my certificate hunting skills to the limit. This is the story of that hunt.

Why are there certificates living in a PDF?

A particularly unpleasant legacy service at work uses PDF forms, which users have to fill in using Adobe Acrobat Reader. The form filling functionality is proprietary - you can only fill in PDF forms in Acrobat if the PDF was signed by a particular key issued by Adobe. Which keys are trusted to sign these PDFs is controlled by embedded certificates.

The certificate we were using was due to expire, so we updated it. I wanted to verify that the PDFs being produced were using the new certificate and not the old one (without waiting for the old one to expire and seeing if everything broke).

Part 1: strings

PDF documents are a combination of ASCII characters and binary data. On the hope that the certificate I was looking for might be encoded in ASCII, I ran the strings command on the PDF.

$ strings file.pdf
%PDF-1.7
41 0 obj
<</Filter/FlateDecode/First 23/Length 137/N 4/Type/ObjStm>>stream
R)i/P
``Zp
...

Unfortunately, there was nothing as obvious as -----BEGIN CERTIFICATE----- (which indicates a PEM formatted certificate). The most promising bit of the file looked like this:

<</Type/Sig/Filter/Adobe.PPKLite/SubFilter/adbe.pkcs7.detached/
... snip ...
Contents<308006092886f70d01010b0500306c
...snip about 12000 characters ...
00000000000000000000000000000000>

It’s not a certificate, but the <</Type/Sig bit suggests it might be a signature, which could well contain the certificate.

So perhaps there are some certificates hiding inside the big Contents<...> string.

Part 2: A fistful of octets

The structure of a certificate is defined by X.509, which is based on ASN.1.

This structure is usually encoded using DER, and sometimes further encoded using PEM.

Which is all pretty confusing.

To find a certificate shaped needle in our haystack of Contents<30800609288... we need to know a bit about what to expect though.

Certificates always begin with an ASN.1 Sequence, which (in hexadecimal format) is represented by the number 30. The next octet (two hexadecimal characters) specifies the length of the sequence.

In DER, length encoding can be “short form” or “long form”.

Certificates are always longer than 127 bits, so the length will always be in long form. Certificates are also always longer than 256 bits, and almost always shorter than 65,536 bits, which means DER needs two octect to specify the sequence length.

This means the next octet will be 82, and that the next two octets will depend on the length of the certificate.

So we know the beginning of the certificate will be 3082.....

This is why PEM certificates always start with MII (which you might have noticed if you work with certificates a lot).

$ xxd -r -p <<< '3082' | base64    
MII=

grepping our haystack for 3082 followed by four hex characters yields a few candidates:

$ grep -a -o '3082....' file.pdf 
308205a4
3082038c
30820222
3082020a
30820609
308203f1
30820122
3082010a
30820198
308206a1
30820489
30820222
3082020a
30820130
3082020c

Encouraging, but we only expect to see three or four certificates (assuming the whole chain is included), so this is too many matches. Can we be more precise?

Part 3: A few octets more

Fortunately, the first bit of the ASN.1 Sequence which makes up a certificate is another, nested ASN.1 sequence. And this one is also (almost) always between 256 and 65,536 bits long. By the same reasoning as above, we can tell that the two octets following the four we already worked out will also be 3082. So the pattern we should look for is 3082....3082:

$ grep -a -o '3082....3082' file.pdf 
308205a43082
308206093082
308206a13082

Now we’re down to just three matching prefixes - could these be the starts of our certificates?

Part 4: The good, the bad, and the ugly

We’ve worked out the starts of our certificates, but we haven’t worked out where they end. Fortunately, openssl is happy to pick up the first certificate it sees and ignore everything after it, so we can actually skip that bit and jump straight to trying to parse the (maybe) certificates.

We’ll need to decode the hexadecimal into binary (using xxd -r -p), and then pass them to openssl (with openssl x509 -inform DER):

Taking the first prefix we found:

$ grep -a -o '308205a43082[0-9a-f]*' file.pdf | xxd -r -p | openssl x509 -inform DER
-----BEGIN CERTIFICATE-----
MIIFpDCCA4ygAwIBAgIQXfEvX1enw+GwAtiTJwzd4TANBgkqhkiG9w0BAQsFADBs
MQswCQYDVQQGEwJVUzEjMCEGA1UEChMaQWRvYmUgU3lzdGVtcyBJbmNvcnBvcmF0
... snip ...
7quYkGyLWtTtZoB5J1b7OYUraMDuqG1s39jMchHjda1GqOwsBWxDqC4HqtdY7TK2
ofZLvqTHvT4=
-----END CERTIFICATE-----

TADA! And indeed this works for the other two prefixes - there are three certificates in this PDF, a root, an intermediate and a leaf.

Conclusion

This general technique of looking for hexadecimal streams matching /3082....3082/ should be a fairly robust way of finding certificates in binary files. It might occasionally trip up if a certificate is very long or very short, and it might find some false positives (particularly if there’s other ASN.1 data in the file).

In our case we were lucky that the bit where the certificate lived was already hex encoded, but it could probably still be spotted in the hexdump of a binary file.

If the certificate were base64 encoded instead of hex encoded, you could use the same trick with the pattern /MI....CC/ (or something like that).

Bonus: PKCS7 and parsing ASN.1 with openssl

After I’d worked all of this out, I realised that the whole Contents<30800609288...> string was itself in ASN.1 format, specifically PKCS #7. This means there are a couple of easier ways to parse it (but which might not work in other files).

The prefix 3080 means “a sequence of indeterminate length” (whereas 3082 means “a sequence of length specified in the next two octets”).

Parsing the whole thing as PKCS #7:

$ grep -a -o 'Contents<[0-9a-f]*' file.pdf | cut -d '<' -f 2 | xxd -r -p | openssl pkcs7 -inform DER -noout -print
PKCS7: 
  type: pkcs7-signedData (1.2.840.113549.1.7.2)
  d.sign: 
    version: 1
    md_algs:
        algorithm: sha1 (1.3.14.3.2.26)
        parameter: NULL
    contents: 
      type: pkcs7-data (1.2.840.113549.1.7.1)
      d.data: <ABSENT>
... snip ...

(This includes the certificate data I was looking for, albeit in a slightly inconvenient format)

Or parsing as ASN.1:

$ grep -a -o 'Contents<[0-9a-f]*' file.pdf | cut -d '<' -f 2 | xxd -r -p | openssl asn1parse -inform DER
    0:d=0  hl=2 l=inf  cons: SEQUENCE          
    2:d=1  hl=2 l=   9 prim: OBJECT            :pkcs7-signedData
   13:d=1  hl=2 l=inf  cons: cont [ 0 ]        
   15:d=2  hl=2 l=inf  cons: SEQUENCE          
   17:d=3  hl=2 l=   1 prim: INTEGER           :01
   20:d=3  hl=2 l=  11 cons: SET               
   22:d=4  hl=2 l=   9 cons: SEQUENCE          
   24:d=5  hl=2 l=   5 prim: OBJECT            :sha1
   31:d=5  hl=2 l=   0 prim: NULL              
   33:d=3  hl=2 l=inf  cons: SEQUENCE   

This is a post on how I manage my email inbox. Should be a strong contender for my most boring blog post.

2021 was not a good year for my relationship with my email inbox.

If you sent me an email, I probably haven’t read it yet. Sorry about that.

• me in weeknote S01E02 (17 Jan 2021)

I get a lot of emails at work - somewhere between 50 and 100 per day.

Most of these emails are automated notifications of one kind or another, of which most can be safely ignored. A few automated notifications are (potentially) important enough that I let them hit my inbox.

Then there are emails sent by actual human beings - calendar invitations, trello and github updates, questions, messages about recruitment campaigns and so on. Some of these just need reading, some of them need quick responses. Occasionally someone sends me an email which requires a bit of work to respond to (maybe I need to do a bit of investigation to answer a question, maybe it just needs a detailed reply).

What tended to happen to me was:

• I would get “on top of my emails” (a state where I was aware of everything in my inbox, and felt I would eventually address them all)
• A few emails would arrive which I didn’t have time to respond to immediately, and I’d leave these as unread to remind me to respond later
• Lots of less important emails would arrive, burying the few big emails that needed my response
• I’d start to feel anxious about the situation
• I’d start to avoid looking at my inbox because it made me feel anxious
• The situation would get much, much worse while I was ignoring it
• Occasionally I would entirely miss a chain of important emails, causing bad things to happen in the real world
• Eventually, I would have a multi-hour email binge and get back into a state where I was “on top of my emails”
• And then the cycle would repeat

This was really a bad situation, to the point where I’m nervous even admitting it. It made me less effective at my job, and it made me feel awful too.

This year I’ve been trying to sort my relationship with email out. I figured I’d share a few techniques I use for managing my inbox. They’re gmail specific, but there will be equivalents in other providers. Most are obvious, but I imagine a few are niche enough that they’ll be new.

Unsubscribe

If I get sent any automated marketing emails, I’ll find the unsubscribe link in the footer and unsubscribe.

If it’s in any way difficult to unsubscribe that email gets marked as spam. If you send marketing emails without unsubscribe links you deserve to have your reputation tarnished.

When I’m a member of a google group that gets a lot of email, I’ll consider whether I need to see every email, or whether switching my subscription to digest, abridged, or no email is better.

Skip the inbox using filters

I get some automated emails which I can’t unsubscribe from, but which are never relevant to me. These are usually sent by systems within my own organization, so it’s not a good idea to try to get these flagged as spam.

Fortunately, gmail lets you create rules to filter your emails. One of the filtering options is to “Skip the Inbox (Archive it)”. Archived emails in gmail aren’t lost, they just don’t show up in the Inbox. So you can still search for these messages, or view them in the “All Mail” view.

Use labels

Gmail lets you create your own labels, which you can then use to label messages in your inbox. The Gmail Help docs explain how to use labels.

I start most of my labels with numbers so they’ll appear in the order I want in the sidebar (they’re ordered alphabetically).

I have labels for things I particularly care about, like 3 - Apprentices, 3 - Recruitment, 4 - Incident. I also have a tree of labels for various kinds of automated notifications - 5 - Automated Notifications/AWS, 5 - Automated Notifications/GitHub, 5 - Automated Notifications/Trello.

The most important label I use is 0 - Needs response. I use this one to stop me from leaving important things lingering in my inbox. Where there are things that are too big for me to respond immediately, I label them as “needs response” and archive them for later.

Label using filters

You can use filters to assign labels to messages.

This is useful for stuff that’s being automatically archived because if you don’t label it, it’ll get lost in the “All Mail” swamp. A lot of my automatically archived email gets one kind or another kind of 5 - Automated Notifications label. Mostly I still never look at this stuff, but when I do it’s useful to have it organised.

Note that you don’t have to Skip the Inbox when using filters. Some of my most useful filters just label stuff as it hits the inbox.

My favourite filter is the one that labels google calendar invitations:

Matches: (invite.ics OR invite.vcs) has:attachment
Do this: Apply label "Calendar Invitation"

Having these labeled in the inbox means I can go through just my calendar invitations. This is a lot less psychologically daunting than general mail, because calendar invitations rarely need more than a couple of seconds’ worth of thought - “am I going to attend this meeting? Yes / No”.

The same is true of Trello and GitHub notifications - I want to look at these, and I know they rarely take more than a few seconds to get through. Even if my inbox is a bit full, if there are a lot of Trello and GitHub notifications I know I can plough through those labels really quickly and see the total unread messages number plummet. Feels good.

Use keyboard shortcuts

Sadly, at some point, I have to actually read the email. This is a process that has to be done manually.

It pays to be as efficient as possible. I want to focus on the emails, and spend as little time as possible clicking buttons in gmail.

There are keyboard shortcuts for Gmail (which have to be enabled in the settings). Software developers famously love shortcut keys. Taking your hands off the keyboard and reaching for the mouse is such a waste of time, and an invitation for repetitive strain injury.

It’s worth mentioning that these keyboard shortcuts can be a little… dangerous. Sometimes I get the interface wrong and start typing a reply outside of the right text area. I can press a dozen different shortcut keys before I work out that I’m not typing a reply. A dozen potentially destructive actions which I have no memory of. Still, it’s totally worth it.

My most used shortcuts are:

• ? - the ever useful help dialog - shows you what all the keyboard shortcuts are
• l - to open the labels dialog. For example l0 will open the labels dialog and search for 0 (which will be my 0 – Needs response label)
• e - to archive an email. Once I’ve handled an email (either responded, or determined it doesn’t need a response), I’ll archive it.
• j/k - older / newer conversation
• } - archive conversation and go to the next newer conversation

I can hammer through emails pretty quickly labelling and archiving as I go. Almost feels like vim.

Archive manually to reach ✨ Inbox Zero ✨

I’m not a strict adherent to the Inbox Zero philosophy, but I do try to reach zero occasionally. I like to archive messages, rather than just reading them and leaving them in the inbox.

Some of the archiving is done automatically by my filters, the rest is done with the e and } keyboard shortcuts.

Track metrics and set service level objectives

The most extreme thing I’ve done to get on top of my emails is to keep metrics on them.

I wrote a prometheus exporter for gmail and used it to hook up my inbox and grafana. Hopefully I’ll find time to write a separate post about this thing.

The metrics integration has enabled me to create a kind of Service Level Objective dashboard for my emails. I aim to manually archive about 30 emails per day, and I track the change in messages in my Inbox over 24 hour and 1 hour periods.

If these numbers go red, I know it’s past time for me to look at my emails again. This screenshot shows that I’m not there yet with my Needs Response label.

This Monday was international women’s day. The theme this year was “choose to challenge”, asking us all “How will you help forge a gender equal world?”

The rest of the week’s news has put this question in horribly sharp focus.

Sarah Everard was the same age as me. She grew up in the same town as me. She studied at the same university as me. She lived in the same part of South London as me. And yet while I have never felt unsafe walking on the streets where I live, she was killed just walking home.

How will you help forge a gender equal world?

Plenty of people have pointed out that expecting women to change their behaviour cannot be the answer. A world where women cannot safely walk home is not a gender equal world. Somehow, we have to address the problem of male violence against women.

I like to think I’m a decent guy, that I’m not part of the problem. I don’t make catcalls. I try to avoid walking behind people at a creepy distance. But even if I’m not directly part of the problem, that doesn’t mean I can’t be part of the solution.

So, I’ll choose to challenge bad behaviour from other men when I see it. I won’t fix society’s problems on my own. But if enough men commit to being better, perhaps we can gradually tip the balance. One day, violent men will no longer be able to hide within a male culture that accepts bad behaviour.

There was a vigil for Sarah last night. We observed it by candlelight on our doorstep with our neighbours.

On Clapham Common the Met Police somehow ended up in a situation where they demonstrated more male violence against women. I can’t understand how this was allowed to happen. It points again to a society wide problem - from the police on the ground and their senior leaders, all the way up to the courts and politicians who chose not to intercede and allow an organised event. Somehow a peaceful vigil was allowed to be criminalised and turned violent, all in the name of public safety.

A sad week, and another wake up call.

I always wondered how my colleagues were able to consistently write weeknotes. How do they work up the enthusiasm?

Now that I’m trying it myself, I’m finding that it’s pretty much just as difficult as I thought. For the last few weeks I just haven’t been able to face it.

It’s been tough, the last few weeks. There’s a fair bit going on at work, and most of it is stuff I don’t enjoy and don’t feel like I’m good at - recruitment, people moves, management, governance and planning. Context switching between all these things makes it feel like I’m not doing any of them well, and that’s demoralising.

Objectively, things are probably not nearly as bad as I think. I’m doing the best job I can in less-than-ideal circumstances. There have been some wins, for sure. A long running campaign to promote four of our developers finally got sorted out, which I should be thrilled about. I’m making good progress on lots of other fronts too. But even the wins feel like I’m collapsing over the finish line with no energy left to celebrate.

So yeah, I’m finding things difficult. I’m going to book some holiday in, and hopefully that will let me reset. I’m encouraging the people I work with to do the same.

But enough about that, what’s been going on in the world?

In the news

President Trump was acquitted. A lawyer wasn’t a cat.

Culture

I’ve been binge watching The Expanse, which is a hard sci-fi drama. It’s really excellent. The first season in particular has some wonderful little details - the way whisky pours in low gravity, or the way birds fly with the occasional lazy flap of their wings. The plot is nicely paced, and doesn’t require too much suspension of disbelief.

Exercise

It got really snowy a few weeks back, and I holed myself up in the house all week. Now that the sun is back, I’ve made it out on a few slightly longer walks, which have felt nice. Still haven’t made it out for a run, but who knows? Maybe one day.

Work

A changing of the guard

There was a major changing of the guard on GOV.UK.

Tim, our long time Head of Technology moved to the cabinet office’s Chief Digital Information Office, resuming his role as a Lead Technical Architect. Tim’s been an incredible support and inspiration to me in my year on GOV.UK, and the programme will sorely miss him.

Himal joined us as Head of Technology and Architecture (the role name subtly altered to reflect its hefty scope). It can’t be easy starting a role like that when everyone’s remote, but from what I can see he’s been doing a stellar job. It’s very exciting to a new perspective and fresh ideas in the most senior technical role on GOV.UK. Welcome Himal!

Talking to our infrastructure providers

We had a couple of video calls with our infrastructure providers (Fastly, our CDN provider, and AWS our infrastructure provider).

I can’t remember how much of what they said is covered by non-disclosure agreements, so this section is going to be a bit boring.

They answered lots of questions, and gave us a bit of a sneak peak at their roadmaps. We made puppy-dog eyes and begged for preview access to some of their shiny new features.

Replatforming Router

The Replatforming team has been thinking about Router for a while. It’s kind of like the front door to GOV.UK. Well, maybe not the front door, because we have a CDN and some load balancers in front of it. Maybe like the door inside a porch. Because we’re changing the infrastructure it sits on, some of the architectural choices made in designing router don’t make sense any more. Karl put together a Request for Comment (RFC) to change the way it reloads its routes, which we’ve been discussing. Bill came up with a way to have multiple Routers sharing the same database, but using different domains. This will let us run independent clusters of apps in the same environment without needing to move databases around.

The team also looked at some of our redundancy plans, to check that we’d be able to use them if we needed them. In some places it looks like we’ve got a bit more redundancy than we really need. I’m preparing another RFC to remove the backup CDN for our backup CDN.

The Exploding Whale of Florence, Oregon

Apropos of nothing, here’s a 1970 news report of the Oregon Highways division disposing of a dead whale:

https://www.youtube.com/watch?v=V6CLumsir34

Roadmapping

GOV.UK published our roadmap publicly for the first time in years - https://www.gov.uk/roadmap.

We’re already thinking about the next iteration of the roadmap - what we’ll do over the next year. I’ve spent quite a bit of time over the last few weeks talking to various teams working around the publishing area of GOV.UK, trying to work out how all our plans fit together, and into the big strategic picture. It’s really great getting a chance to listen to the experts talk about their areas.

Governance

I honestly never thought my life would turn out this way.

I’ve been thinking and writing about “Governance” - how GOV.UK makes decisions that affect its roadmap and its people and teams.

GOV.UK has been through a period where it has had to deliver critical priorities with inflexible deadlines. For good reason, putting formal processes around decision making hasn’t been a priority.

Now that things are calming down (a bit) we’ve got an opportunity to design processes that will let us make these decisions in a calm and considered way, and ensure that everyone who’s affected feels included and informed.

Interviews

I chaired three interviews for an interim site reliability engineer role, and arranged one interview for a developer role (which unfortunately got postponed).

I still need to schedule three more developer interviews.

End of weeknote

👏 well done me. I’m back on the weeknote horse. Hopefully I’ll be able to stick to a weekly cadence.