Jonathan Flower

I am Jonathan Flower and this is what I am into.

[jonathanflower]

How to Handle Upgrades with Service Workers with CRA3 and Typescript

I am using Create React App v3 and Typescript.  I have enabled offline support with the service worker and configured the manifest.json.  Chrome supports installing this progressive web application as a Desktop app.  It is very neat.  

The biggest challenge has been gracefully handling updates to the app.  The default behavior for the Service Worker is to wait until all the tabs of the web application have been closed before updating to a new version of the web app. What I found is that user’s got into the habit of logging out and logging back in. This ruined the offline support and we had user’s complaining about not being able to work well in a poor internet environment since they waited to login until they entered the poor internet environment.  

Looking through a plethora of resources and examples, I really struggled to find a solid example that included Typescript.  The examples did not work well because Typescript does not include typings for the service worker skipWaiting() function.  

 serviceWorker.register({    onUpdate: registration => {          toastr.warning('Installing Update', 'Please wait...', {      ...constants.toastrWarning,      timeOut: 6000    });    setTimeout(() => {      window.location.reload();    }, 6000);   

 if (registration && registration.waiting) {        registration.waiting.postMessage({ type: 'SKIP_WAITING' });      }      console.log('New content is available; refreshing.');    }  });

[jonathanflower]

The Business Model Canvas

Video Explaining the Concept

definition: a business model describes the rationale of how an organization creates, delivers, and captures value.  

The Business Model Canvas Excersize

Answer these questions

Customer Segment

a strong understanding of specific customer's needs demands a conscious decision about which segments to serve and which to ignore.

Value Proposition

creates value for a customer segment though a district mix of elements catering to that segment's needs.

Channels

reaches customer segments to deliver a value proposition.  There are 5 phases:

raise awareness

help customers evaluate

allow customers to purchase

deliver the value proposition

provide customer support

more info: http://www.businessmodelgeneration.com/canvas

PDF of the canvas: https://canvanizer.com/downloads/business_model_canvas_poster.pdf

[jonathanflower]

The Hedgehog Concept

The essence of a Hedgehog Concept is to attain piercing clarity about how to produce the best long-term results, and then exercising the relentless discipline to say, "No thank you" to opportunities that fail the hedgehog test. When we examined the Hedgehog Concepts of the good-to-great companies, we found they reflected deep understanding of three intersecting circles: 1) What can we be the best in the world at? (And equally important—what can we not be the best at?) 2) What is the economic denominator that best drives our economic engine (profit or cash flow per “x”)?  3) And what are our core people deeply passionate about?

http://www.jimcollins.com/article_topics/articles/good-to-great.html

Walgreens hedgehog concept is to run the best, most convenient drug stores with high profit per customer visit.Wells Fargo hedgehog concept is to run a bank like a business, with a focus on the western United States, and consistently increase profit per employee.

[jonathanflower]

Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!

Vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission. The flaw potentially…

This is bad. the Zoom app apparently allows anyone to view your camera and perform a DDOS attack.  Even after uninstalling.   Pretty disappointed that they have such a huge security issue and then more disappointed that they did not fix it after it was reported to them 90 days ago.   I used this uninstall script to properly uninstall Zoom.  https://github.com/ryanfb/deZoom

[jonathanflower]

How To Setup a Private Nano Node Test Network

1. Generate a seed for your genesis account. This will be the originating account that has all of the allocated Nano at the beginning.

./nano_node --key_create

2. With that seed, generate an Open block using any method you choose...I used the debug_bootstrap_generate command of the nano_node executable which takes a key and generates a series of blocks (you really only need the Genesis block that it creates, if you are creating an empty testnet).

./nano_node --debug_bootstrap_generate --key={private key}

3. In nano/secure/common.cpp replace the live_genesis_data variable (or test, or beta) with your new Genesis block 4. In nano/node/nodeconfig.cpp alter the nano_live_network (or test, or beta) case to use your own preconfigured representatives and your own preconfigured peers. 5. Run make again: 

make

6. run:

./nano_node --daemon --data_path ./data

7. in `/data/config.json` set `rpc_enable` and `enable_control` to `true` 8. re-run 

./nano_node --daemon --data_path ./data

9. Create a wallet on that node (at this point I switched over to using Postman to execute these RPC requests)

{ "action": "wallet_create" }

10. Wallet add key (using the Genesis key):

{ "action": "wallet_add", "wallet": "WALLET_ID_FROM_LAST_STEP", "key": "YOUR_GENESIS_KEY" }

11. Confirm the balance of your wallet now has the full Genesis amount:

{ "action": "wallet_balance_total", "wallet": "WALLET_ID" }

12. Create another account

{ "action": "account_create",    "wallet": "WALLET_ID"}

13. Send funds from your wallet to your new account:

{ "action": "send", "wallet": "9C884A427C058B7873DC153D46082DF26534A97C42C1FCFB68C682EF57926BFF", "source": "xrb_1progxxzsrx1g91fh8kc8q7ux3g58dnop3i1jenbnom78gzhsk5uwih9gnsh", "destination": "xrb_3q56eog9bhmbbuckwbcz8f47ezadu4i3yogowsamfg14f1xzdkidq75h97sn", "amount": "1000000" }

14. You should be able to take it from here. Create a receive block ect...

[jonathanflower]

Face unlock can easily be defeated with a photo on many popular phones, study finds — Mashable

Face recognition is not very secure on so many phones.

This is concerning. Please be aware.

[jonathanflower]

Upgrading to macOS Mojave

Doing an erase and install of Mac OS Mojave today.  Why erase and install?  Because having too much crap on my Mac is distracting and slows the machine down.  So every year or two I wipe the slate clean.  Here is how I do it:

Backup to my TimeMachine drive and verify it by Option clicking the icon in the menu bar.

Create a bootable backup with SuperDuper (including rebooting into that backup to verify success)

Download the macOS Mojave installer and DiskMaker X

Create a Thumb drive with DiskMaker X.

Boot into the macOS installer by holding down the option key and selecting it.

Open Disk Utility and erase my internal hard drive - I choose APFS Case-Sensitive.

Quit that then choose the option to install macOS.

Follow the prompts to install software.

Copy only the files I really need from one of my backups to my laptop

Copy my old user folder to a large archive hard drive I use to store my home folders from years past

Erase my main TimeMachine backup that lives in my TimeCapsule and restart a fresh backup.

Install software

Install Homebrew and Node

Install my favorite node packages: `npm install -g ionic cordova node-gyp`

Install command line tools for build Android projects

Java JDK

create a “bin” folder inside your home folder

Install the command line tools for Android SDK under “get just the command line tools” here

Move the contents to your “bin” folder

Open Terminal and type `nano ~/.bash_profile`

Update your bash profile to look like this while replacing your own user folder export PATH=/Users/jfhome/bin/tools:$PATH export PATH=/Users/jfhome/bin/platform-tools:$PATH export PATH=/Users/jfhome/bin/build-tools/25.0.0:$PATH

Now we can install the additional Android SDK goodness crap by running `android` and using the GUI, or just run: `android update sdk –all –no-ui –filter platform-tool,android-23,android-24,build-tools-25.0.0,extra`

Put zip align in the right spot:  copy `/bin/build-tools/25.0.0/zipalign` to `/bin/tools`

[jonathanflower]

Updated my upgrade guide for Mojave

[jonathanflower]

How to Fix Corrupted Video Files

Summary

There are some great free programs to help recover corrupted video files, granted you are brave enough to get your hands dirty with some command line utilities.

Windows, Linux, and Mac users: Free tool written in perl: bookkojot/mp4fixer

Another good tool for Windows users:  Free tool called “recover_mp4”: Download recover_mp4 1.92.

The Story and How To

Recently ran into an issue with some corrupted video files after filming with a Canon 5D Mark II.  The video files were large files, but would not play in Final Cut X, Quicktime, VLC ...ect.

I suspect the video files were not closed properly and thus were missing the header information.  The video stream was there, but the players did not know how to play it.  

I did some research on software to help me repair the videos and found several paid programs ranging from $80 - $200 as well as services I could send the videos too and have them recover them for likely even higher price points.  I paid $50 for EaseUS because it went on sale, but it did not work for me.  EaseUS appears to be more targeted at recovering files from damaged drives, not repairing corrupted files.  Eventually I figured out how to recover the files for free.  I am writing this post because there are great free tools out there and Google search is flooded with expensive recovery programs who have a budget to spend on SEO marketing. 

Windows, Linux, and Mac users: here is a similar tool written in perl: bookkojot/mp4fixer

perl fixer.pl ref.MOV corrupted.MOV repaired

put the audio and video back together: ffmpeg.exe -r 30 -i repaired.h264 -i repaired.wav -vcodec copy -acodec copy result.mov

Windows users: Download the “recover_mp4” tool here: Download recover_mp4 1.92.

analyze a similar working video by running: recover_mp4_to_h264.exe “your-working-reference-video.MP4” --analyze

export the repaired video and audio: recover_mp4_to_h264.exe corrupted.MP4 repaired,h264 repaired.aac

recover_mp4 tells you the FFmpeg command to run when you run the --analyze command.  It will be something like this and it’s purpose is to put the audio and video back together and into a proper video container: : ffmpeg.exe -r 30 -i repaired.h264 -i repaired.wav -vcodec copy -acodec copy result.mov

Paid program demos that appear to work for me:

Restore.Media | We repair corrupted video and audio files online

Video Repair Tool

Additional tips:

An Easy way to install FFmpeg on a Mac: `brew install ffmpeg`

I recovered videos I recorded on a Canon 5D Mark II, and this ended up running this mp4fixer and ffmpeg command for each video:

perl fixer.pl ref.MOV corrupted.MOV repaired && ffmpeg -r 23.98 -i repaired.h264 -f s16le -ar 48000 -ac 2 -I repaired-out-audio.raw -aspect 16:9 -c:v copy -c:a copy repaired.MOV

more info: 

https://stackoverflow.com/questions/23202611/repairing-a-corrupt-mp4-video-file

[jonathanflower]

Crypto currency miners are requesting the equivalent of nearly 120,000 homes worth of electricity in a single county in Washington. This is a problem.

[jonathanflower]

Hackers emptied Ethereum wallets by breaking the basic infrastructure of the internet

At midnight ET last night, MyEtherWallet users fell victim to a combination of DNS and BGP attacks, hacking into ethereum wallets by breaking the basic infrastructure of the internet.

Hackers broke the internet today.  I wasn’t aware of this vulnerability until today.  Hopefully this will spur DNS server operators to support DNSSEC.  One thing we can do today is run something that at least encrypts DNS between us and the DNS server:  https://www.opendns.com/about/innovations/dnscrypt/. Installed the Mac client today, pointed it to OpenDNS and it seems to be running great.

[jonathanflower]

Cross Platform Google OAuth2

It was way more challenging than we expected in order to implement Google’s OAuth on the various platforms involved in one of our projects.  We needed to implement OAuth on a .NET server, .NET MVC web app, Reactjs, Chrome Books, and iOS.  Each one required a unique library and flow.  

.NET server

download the library here:  https://www.nuget.org/packages?q=Google.Apis.oauth2&prerelease=true&sortOrder=relevance

general guide: https://developers.google.com/api-client-library/dotnet/guide/aaa_oauth

how to exchange a authentication code from a web app and get a refresh token:  https://developers.google.com/identity/sign-in/web/server-side-flow

Chrome App

Use the chrome.identity library:  https://developer.chrome.com/apps/app_identity

In the chrome.identity library you can use identity.getAuthToken to get an access token, or you can use the identity.launchWebAuthFlow to get a authentication code you can then send to your API and get a refresh token.  See my StackOverflow answer here:  https://stackoverflow.com/questions/42562115/access-code-for-google-oauth2-in-chrome-app-invalid-credentials/49696037#49696037

Reactjs Web App

https://github.com/anthonyjgrove/react-google-login

iOS Cordova App

https://github.com/EddyVerbruggen/cordova-plugin-googleplus

.NET MVC

We were not able to get the .NET MVC tutorials to work, and ended up using the js library.  Followed this guide: https://developers.google.com/identity/sign-in/web/sign-in, then this one in order to get the refresh token:  https://developers.google.com/identity/sign-in/web/server-side-flow

[jonathanflower]

Nano Coin and No Mining

Developed a crypto crush on Nano coin over the weekend.  Here is what impresses me:   Rather than have the nodes verify every transaction, only have them step in when there is a conflict.  Require the user initiating a transaction to verify two previous transactions.  Individual user’s computers are incentivized to be honest, because the 2 transactions where most likely not their own transactions.  Nodes are incentivized to be honest because their ability to resolve a conflict is weighted by how much of the coin the owner of that node owns.  Why would you “hack” a coin that you own 51% of?   The result of implementing all this is almost instant transfers and no mining.  

I am trying to find someone talking about how or why this form of security is inferior to the mining based coins, but haven’t found a whole lot.  There are some weaknesses with iOTA , but I can’t find any similar concerns about Nano and their block lattice.   More info:  https://hackernoon.com/iota-vs-raiblocks-413679bb4c3e Great video intro:  https://nano.org/en

[jonathanflower]

Be Careful out There Crypto Traders

There is a lot of misinformation out there.  A couple examples:

Litecoin Cash

Forbes article touting what a great investment opportunity this is:  https://www.forbes.com/sites/cbovaird/2018/02/20/litecoin-reaches-1-month-high-after-hard-fork/#3e8345c46659

CoinDesk article pointing out that Litecoin Cash is a scam:  https://www.coindesk.com/no-buying-litecoin-cash-isnt-buying-bitcoin-cash/

The reality is that anyone can fork these coins.  All of these are open source software projects.  If I wanted, I can create a fork of any of the coins and call it _______ Cash and hopefully fool a lot of people into buying it.  

Coinbase and Duplicate Credit Card Charges

Even after Visa announced that the issue was not Coinbase, people are still freaking out. What happened: https://techcrunch.com/2018/02/16/visa-coinbase-not-at-fault/ Freeking out tweets:  https://mobile.twitter.com/coinbase/status/964652218832928768

this one is my favorite:  https://mobile.twitter.com/makeuslaugh/with_replies they just tweet about Coinbase stealing money over and over again.  Same exact message.  Probably a bot someone setup because they have a vested interest in seeing Coinbase fail.

[jonathanflower]

How to store crypto

One of the principles of the blockchain is that it is trestless.  Meaning there is no one central authority for us to trust.  We are able to trust the blockchain because the process of verification is distributed and open.  The system requires several mining computers to verify each transaction.  Over the last few months I have been searching for a good way to store my crypto currency.  There are several Mac programs, iOS apps, and cold storage wallets.  At first I leaned towards iOS apps since my iPhone itself is encrypted and protected by my passcode/fingerprint.  However, there is no way for me to verify that an iOS app has not been modified maliciously before an update was submitted to Apple.  The best way to verify that an application has not been modified is to employ the very technology that makes cryptocurrency possible, cryptography.  We can run the downloaded program through a hash function and verify that the hash matches what it is supposed to be.  The only hardware wallet I can find today that supports this is Trezor:  https://github.com/trezor/trezor-mcu/blob/master/README.md

[jonathanflower]

A Developer’s Alternative to CrashPlan

Backups are incredibly important after you have a hard drive crash.  The challenge is convincing family and friends to start backing up before they go though a tragic learning event.  One of the hurdles is the cost.  They might figure they paid around $1,000 for their computer and expect it to last around 5 years.  That comes out to $200 a year, and so $50 a year, or a 4th the cost of the computer for a backup service seems expensive.  As a service provider myself I can understand the risk, overhead, and equipment costs these backup services have.  That is why CrashPlan was so great.  Purchase my parent’s a hard drive for $150, then use CrashPlan for free.  6 people in my family can backup to this one hard drive.  If we all did a backup service for 5 years that would be $1,500 instead of $150.  Wow.  

I did a lot of searching for a consumer friendly solution similar to CrashPlan, but I could not find anything.  There are no open source solutions with good enough reviews to warrant even trying out.  What I settled on was using an open source file service with a paid backup program.  Minio Server basically turns one of my Macs into an AWS S3 service.  Arq Backup has a simple interface for backing up and supports backing up to a verity of services, including a self hosted S3 type storage.  Arq has some advantages over CrashPlan, namely it is a native application, not a Java application.  Arq also has a Windows version.  Arq costs $50 a person.  So for myself and my father, who have multiple computers, it does not get too expensive.  We will end up purchasing 6 licenses or $300.  That makes this solution for 5 years come out to $450.  Still a lot better than $1,500.  The kicker is that you basically need to already be comfortable setting up your own cloud service. 

Here is how to setup your own with open source Minio server and a one time paid backup application Arq Backup on a Mac

Setting up Minio on a Mac.  

First install Minio Server

brew install minio/stable/minio

start it with

brew services start minio/stable/minio

There is probably a better way to get to this file, but open:

/usr/local/Cellar/minio/{Bunch of numbers}/homebrew.mxcl.minio.plist

I modified line 15 to point to an external hard drive.  

     changed:

   <string>/usr/local/var/minio</string>

     to: 

<string>/Volumes/sjoy backup/minio</string>

Then restart Monio

brew services restart minio/stable/minio

Find the Minio keys by opening the log file here:  

/usr/local/var/log/minio/output.log

Note the keys in a safe place (1Password)

Now you should be able to see the Minio web interface at http://localhost:9000

Setup Port Forwarding and DNS

I am not going to go into detail, but in order to make this publicly accessible you will need to setup port forwarding on your router.  Then either purchase a static IP from your ISP or use a service like https://dyn.com/dns/

Download and install Arq Backup:

https://www.arqbackup.com/download/

Open Arq Preferences and choose Destinations

Add an s3 compatible destination.

Put in the hostname and keys.

Start backing up.

Once the backup is finished, test out recovering a file.

Done.

Sources:

best way to run a service at login:  use OSX's native process launcher and manager, launchd

https://stackoverflow.com/questions/6442364/running-script-upon-login-mac/13372744#13372744

A great way to do that is Homebrew 

https://github.com/Homebrew/homebrew-services

https://minio.io

Arq Backup: https://www.arqbackup.com

[jonathanflower]

[jonathanflower]

Men without chests

C.S. Lewis wrote:

In battle it is not syllogisms (logical arguments) that will keep the reluctant nerves and muscles to their post in the third hour of the bombardment.

In a sort of ghastly simplicity we remove the organ and demand the function. We make men without chests and expect of them virtue and enterprise.

Ref: http://www.cslewisinstitute.org/Men_without_Chests