Technology
Past Tense

We are reaching and surpassing dates in real-life that were formerly part of our science fiction. The screenshot which leads off this post is from part 1 of Past Tense, a time travel episode from Star Trek: Deep Space Nine. Given what the episode is about, it is even sadder that barely two months before the date in the screenshot the U.S. Supreme Court ruled that bans against sleeping outside do not violate the Eighth Amendment.
Migrating My WordPress Database from a Lightsail Instance to a Standalone Database
Last year, I moved this blog off of a EC2 instance running a too-old version of PHP to a Lightsail instance. I had to restart that instance in order to retrieve the images associated with all the prior posts so they looked exactly as they did before, but the end result was the same blog at a lower monthly cost. Since then, I installed and configured the WP Offload Media Lite plug-in to push all those images to an S3 bucket. Today I decided to move the Wordpress database off the Lightsail instance to a standalone database.
Accomplishing this move required cobbling together instructions from Bitnami and AWS (and filling in any gaps with educated guesses). Here are the steps I took to get everything moved over, in the order I took them.
- Export the application database from the Lightsail instance. As of this writing, the Bitnami WordPress image still keeps database credentials in a bitnami_credentials file, so using that with the mysqldump command generated the file I would need to import to the new database (backup.sql).
- Download backup.sql to my local machine. Connecting to my Lightsail instance with sftp and my SSH key followed by "get backup.sql" pulled the file down.
- Download MySQL Workbench. Looking at these import instructions, I realized I didn't have it installed.
- Create a Lightsail database. On the advice of co-workers who also do this with their side projects, I used us-east-2 as the region to setup in. I specified the database name to match the one in the backup.sql file to make things easier later when it was time to update wp_config.php.
- Enable data import mode. By default, data import mode is disabled and public mode is disabled. So I turned on data import mode and was puzzled for a second when I couldn't connect to the database in order to import from backup.sql.
- Enable public mode. With public mode disabled, and my backup.sql file (and tools to import it) not already available in a us-east-2 hosted instance or other resource, I couldn't load the backup data. Once I enabled public mode, I was able to use MySQL Workbench to connect and upload the data.
- Disable public mode.
- Update wp_config.php to use new database credentials.
To confirm that the post you're reading now was written to the new database, I turned on the general query log functionality on the database instance to ensure that the server was writing to it. Having confirmed that, I turned off the general query log.
The additional cost of a standalone Lightsail database is worth it for the week's worth of database backups you get with zero additional effort. Migrating to a newer WordPress instance in the future should be easier as well, now that both the database and media for the site are off-instance. The next step I need to take is upgrading from the lite version of WP Offload Media to the full one. This should offload all the media so I can safely remove it locally.
Flipboard Renewing Its Relevance With the Fediverse
Flipboard is jumping into the fediverse with both feet, according to a piece from The Verge. While the fediverse isn't where I saw the piece first (that would be on Threads), when Flipboard first announced it was experimenting with Mastodon some months back, it was the first time I'd thought about Flipboard in years (much less used it). Since The Verge piece first ran December 18th, it's been updated with links to both their Flipboard account, and their Mastodon account.
If you're not familiar with Flipboard, their key organizing principle is the magazine. Articles you read from any number of sources can be "flipped" into a magazine you create, along with any commentary you may want to provide. As in other social media networks, you can follow other members and be followed by them. You can comment on shared articles and other Flipboard members can respond. Another interesting feature (which I never took advantage of myself) is Invite contributors. I presume this feature allows multiple Flipboard members to contribute articles to the same magazine. This might be how The Verge handles its own presence on Flipboard.

Unrelated to the whole fediverse pivot, reviewing the features of Flipboard makes me wonder if they ever actively pursued the sorts of people who write newsletters. From what I've seen of Substack, I haven't seen anything it does as a service that Flipboard doesn't do as well or better--and they probably have a much larger number of monthly active users.
The key difference I've found so far between the mobile app experience and the web experience of Flipboard is that you can only flip articles into Mastodon via the mobile app.

Another thing Flipboard has changed since I last looked at what they were doing with Mastodon is allow you to add any Mastodon profile URL to your Flipboard profile and display a verified link on your profile page. I've already set that up and now my profile looks like this:

This is the sort of attention and interest that Tumblr could have generated had they moved more aggressively in exploring integration with the fediverse via ActivityPub. Tumblr is a first-class citizen on IFTTT, an awesome site for creating workflows and automations between a whole host of different services. I have a number of automations (IFTTT calls them applets) that use Tumblr as a destination and a "fedified" Tumblr would have let me automate a lot of posting without having to change a thing. Flipboard simply isn't set up for that--not without workarounds or hacks (though IFTTT appears to have one that uses Pocket as an intermediary that I plan to try).
If this post has piqued your curiosity about Flipboard's foray into the fediverse, I encourage you to check out Flipboard for yourself. Follow me there, comment on pieces I've flipped, create your own magazine(s), get the Flipboard mobile app and flip good pieces into Mastodon.
(Tech) Education Should Be Free (and Rigorous)
Free tech education is the reality being created by Quincy Larson, the founder of FreeCodeCamp. I've been seeing their posts on Twitter for years, but didn't dive deeper until I heard Larson interviewed recently on Hanselminutes. The 30-minute interview was enough to convince me to add Larson's organization to the short list of non-profits I support on a monthly basis. One of the distinctions I appreciated most in the interview was the one made between gate-keeping and rigor. Especially in the context of certifications (in an industry with an ever-growing number of them), making certifications valuable is a challenge that FreeCodeCamp solves by making them challenging to get. Having pursued a number of certifications over the course of my tech career (earning a Certified Scrum Master cert a couple of times, the AWS Certified Solution Architect Associate, and an internal certification at work for secure coding), I've seen some differences in how the organizations behind each certification attempt to strike that balance.
- Certified Scrum Master. Relative to cloud certifications for AWS, Azure, or Google Cloud, CSM certification is much easier. Two days in an instructor-led training course, followed by a certification exam and you have a certification that's good for 2 years. I don't recall what my employers paid for the courses to get me certified each time, but these days you can spend anywhere from $500-$1100 per person for the 2-3 day class and exam. I think the minimum score to pass is 80%, and one of my classmates the last time I certified got 100% (I missed out on that by a single question). In short, less rigorous (and far less gate-keeping).
- Certified AWS Solution Architect Associate. I spent months preparing for to take this certification exam. Just the associate-level exam itself costs $150. The self-study course and practice exams I took (both from Udemy) normally cost $210 combined, though there are plenty of other options both online and instructor-led (I expect the latter would cost significantly more per student than instructor-led training for other certifications. Achieving the minimum score to pass (usually around 70%) is far from certain, given the sheer amount of material to retain and the high level of rigor of the questions. I ended up scoring around 80% but I really had to sweat for it. Much more rigorous, but rather low on gate-keeping as well because of the relatively low cost of self-study and practice exams (and the ability to do hands-on practice with the AWS Free Tier with a personal AWS account).
The key value of rigor is that the process of preparing to take a certification exam should meaningfully apply to actually doing the work the certification is intended to represent. My experience of pursuing AWS certification is that the learning did (and does) apply to design discussions. It's given me valuable depth of understanding necessary to push my teams to fully explore different services for building features. One of my direct reports used the knowledge gained from certification to build equivalent functionality out of AWS services approved for use inside our organization to approximate the functionality of an AWS service currently not approved for use (in order to integrate with a third-party vendor we were working with).
When I talk to people in different fields where certifications are available, I get the distinct sense that there are varying degrees of gate-keeping involved (a practice that tech companies are certainly no strangers to). My wife has said this often regarding HR certifications offered by SHRM. She's been an HR director for over 20 years (without that certification) but hasn't been able to pass the certification exam (despite having a master's degree in HR management).
When considering whether or not to pursue a certification, it's definitely a good idea to look at them from the additional perspective of whether they are gate-keeping--or providing rigor--not just if they will help you advance your career. If you can, find out from people who've actually earned the certification whether they feel like it helped make them better at their job. Some certifications are must-haves regardless of their rigor or utility, either because your employer requires them or because eligibility to pursue certain contracts requires them (particularly in the federal contracting space).
GenXJamerican.com Moves to Amazon Lightsail, A Follow-Up
One change I missed after migrating to Lightsail, was ensuring that all the posts with images in them were displaying those images on the new site the way they were on the old. A scroll backward through previous posts revealed the problem quickly enough, but life is busy so it took awhile until I had enough time fix it. The steps I expected I would need to take to resolve the missing images issue were roughly the following:
- Start up the old EC2 instance
- Download the old images
- Upload the old images to the new instance on Lightsail
Because I only stopped the previous EC2 instance instead of terminating it, I was able to re-start it. To download the old images, I'd have to find them first. Having self-hosted WordPress for awhile, I knew the images would be in subfolders under wp-content/uploads, so the only real question remaining was where exactly the old Bitnami image rooted the install. Once I "sshed" into the instance, that location turned out to be ~/stack/apps/wordpress/htdocs/wp-content/uploads. Images were further organized by year and month of blog posts. To simplify the downloading of old images, I had to knock the rust off my usage of the tar command. Once I'd compressed all those years of images into a few archive files it was time to get them off the machine. I used this Medium post to figure out the right syntax for my scp commands.
Once the archive files were on my local machine, I needed to get them onto the Lightsail instance (and expand them into its uploads folder). But just as I did compressing and pulling the files down from the EC2 instance, I had to figure out where they were in the new Bitnami image. As it turned out, the path was slightly different in the Lightsail image: ~/stack/wordpress/wp-content/uploads. Once I uploaded the files with scp, I had to figure out how to move them into the years and months structure that would match my existing blog posts. Using the in-brower terminal, I was reminded that the tar command wouldn't let me expand the files into an existing folder structure, so I created an uploads-old folder and expanded them there. Then I had to figure out how to recursively copy the files there into uploads. It took a few tries but the command that ultimately got me the result I wanted was this:
sudo cp -R ./uploads-old/<year>/* ./<year>
Now, every post with images has them back again.
GenXJamerican.com Moves to Amazon Lightsail
Before last year ended, I moved this blog off its EC2 instance running a too-old version of PHP to an Amazon Lightsail instance in a new region. The original rationale for hosting on EC2 was to have a project and a reason to do things in AWS other than whatever a certification course might teach. But having finally earned that AWS Certified Solution Architect Associate certification last spring (and paid more in hosting fees than a blog as small as this really merits), the switch to a simpler user experience and lower cost for hosting was overdue.
Lightsail made it simple to launch a single self-contained instance running the latest version of WordPress. The real work was getting that new instance to look like the old one. Getting my posts moved over wasn't hard, since I make a regular habit of using Tools > Export > All Content from the dashboard to ensure I have a WordPress-compatible copy of my posts available. The theme I use however (Tropicana) recommends far more plugins than I remember when I first chose it. The Site Health widget nags you about using a persistent object cache, so I tried getting the W3 Total Cache plugin working. I kept seeing an error about FTP permissions that I couldn't resolve so I got rid of the plugin and Site Health said the server response time was ok without it. Another plugin I got rid of was AMP. Something about how I had AMP configured was seemed to prevent the header image from loading properly. With AMP gone, everything worked as before. Akismet Anti-Spam and JetPack are probably the most important plugins of any WordPress install so I made sure to get those configured and running as soon as possible.
The last change I needed to make was the SSL certificate. The Lightsail blueprint for WordPress (the official image from Bitnami and Automattic) has a script which automatically generates certs using Let's Encrypt. When the script didn't work the first time (because I'd neglected to update my domain's A record first), I went back and made that change then shut down the (now) old EC2 instance.
GenXJamerican 2.0 still needs some more changes. I used to have a separate blog just for photos, years ago when one of my best friends was hosting WordPress instances. The Social Slider Feed plugin lets you pull in content from Instagram and other social media sites, so I've added those to a Photos page. Once I figure out the photo gallery plugin, that should be the next update. I'll also be looking into the ActivityPub and WebFinger plugins as part of my growing interest in Mastodon.
Linux on the Desktop: Google Pixelbook Edition
Tell Me About Yourself--Engineering Leader Edition
The following tweet starts an excellent thread of questions that I’m taking as a starting point for this post looking back over the past 5 years with my current company: twitter.com/lilykonin…
When was the last time you promoted someone on your team? How did it happen? My organization works in a way that promotion decisions are actually approved (or rejected) at a much higher level than mine. But I’ve advocated successfully for promotion for two of my direct reports, both during the pandemic.
The first was a recent college graduate who spent the 18 months of his professional career on my team. While I wasn’t his manager for the entirety of that time, I encouraged him to work on communication across various channels (Slack, email, documentation, pull request comments, etc). I did what I could to put opportunities in front of him to grow and showcase his skills. What he did on his own (in addition to pursuing a master’s degree in computer science on the side) was earn AWS certifications. He passed 4(!) in a single calendar year. So when it came time to year-end reviews, there were a lot of accomplishments to point to as well as positive feedback from people outside our team from their experiences of working with him. He was the first direct report I had who earned the highest possible year-end rating: exceptional, and the first promotion (to senior engineer). He’s still with the company today, and received another promotion (to principal engineer) in the same cycle I received a promotion to senior manager.
The second promotion was for someone who had been with the company longer than I had. From what I was told she had been submitted for promotion once or twice before but had not been selected for promotion. She was (and is) one of those engineers who leads much more by example than by talking. Having observed over the years that the review process tends to overindex on software engineers that present well, I became the person in meetings who consistently pushed people to consider written communication as well as presentations in judging the quality of an engineer’s communication. I also recommended she take the technical writing courses offered by Google. These steps, plus highlighting her numerous critical contributions to the team’s success during another year-end review cycle appear to have been enough to get her promoted to principal engineer.
Why did the last person in this role leave? It’s been long enough that I don’t actually recall why the previous leader of the team moved on. I presume they found an opportunity with another company.
How do you nurture psychological safety in your team? Regular one-on-ones (I follow a weekly cadence for these) has been important to nurturing psychological safety. Because I joined the team to lead it after work-from-home began, Zoom meetings were really the only avenue available to build the rapport necessary for my team to trust me. I also started a technical book club with the team, with the intention of giving my team exposure to software design and implementation principles outside the scope of our current work, along with providing opportunities for each member of the team to lead discussions and explore ideas. It seems to have had the additional benefit of building everyone’s comfort level with, and trust in, each other along with all the other things I’d intended it for (including ideas originating from book club showing up as production enhancements to our software).
When was the last time you supported a direct report’s growth, even if it meant leaving your team or company? In my previous department, I had staffing responsibilities for two teams for awhile: one composed entirely of contractors in addition to my own team. In helping a scrum master friend of mine diagnose the causes of the contractor team struggling to be productive, I concluded that the main issue wasn’t technical expertise but the lack of a leader to help remove impediments and connect them with others in the organization who could help their tasks move forward. I proposed this as a leadership opportunity for one of my direct reports and got buy-in from higher-level management. He was so successful in the stretch opportunity I created, he got promoted after leaving my team. Not long after that, he left our organization to join Amazon as an engineering team lead in Seattle. He’s currently a principal software engineering manager with Microsoft in Atlanta.
Can I speak to some women on the team to hear more about their experience? Two of the engineers on my current team are women. If all goes well, another one of them will be promoted to principal engineer by virtue of her performance over the past 18 months. While it will likely mean losing her to another team, her getting promoted and gaining new opportunities that my team’s scope doesn’t provide is more important to me. I see it as another opportunity to build up another engineer in her place.
2FA/MFA Revisited
Seven(!) years ago, I wrote a bit about security breaches and how two-factor authentication mitigates that risk. Today is as good a day as any to revisit the subject because of this:
In the years since I wrote that post, the availability of multi-factor authentication as an option for securing access to websites and other online systems has only grown. Face ID came out with the iPhone X and expanded to other parts of Apple's hardware lineup, and YubiKeys have become far more prevalent in usage. The previous iteration of this blog didn't have MFA protecting admin access, but the current one does. The websites that give me access to my brokerage account and various retirement accounts are now all protected by some form of MFA. The issue highlighted in the tweet above is specific to using SMS as the second factor for gaining access to your Twitter account. The service responsible for sending the code you type in to verify that you're the legitimate accountholder was turned off. So for those users who only had Text message as their Two-factor authentication option, they might not have been able to get back into their account as a result.
In my case, I wasn't impacted because I'd actually turned Text message off as a second factor in favor of two other options: Authentication app, and Security key. Authentication app options include Google Authenticator, Microsoft Authenticator, Authy, Symantec VIP, and many others. Once installed on your mobile phone, they all work in a similar way: they generate a random sequence of 6-8 numbers every 30 seconds. If you've set up an online account to require such a number for access, you must provide it (along with your username and password) before the 30 seconds expires to gain access. Security key eliminates the stand-alone app requirement in favor of plugging a physical key (like the Yubikey 5Ci which I use) into whatever laptop or mobile phone where you're trying to access an account and touching it to generate a code that give you access.
MFA options in descending order of difficulty for hackers to breach:
- Security key
- Authentication app
- SMS
To be clear--SMS as a second factor is much better than nothing. But if you don't also secure the account you have with your cellphone provider with MFA and/or a PIN, a determined attacker could take over your account and redirect the SMS message to a device they control. An authentication app is much more secure, but as I discovered to my chagrin when researching this post, not impenetrable. The security key option is the only one of the three that requires physical access to you (and/or your stuff) in order to steal the thing necessary to get access to your accounts. For that reason, I've been switching my online accounts to use the security key option wherever it's available.
The advice from seven years ago to use a password manager still holds. 1Password remains my preferred option for this. They've added support for MFA to their product, which is an option worth considering for less-technical users who don't want to use a stand-alone authentication app or a security key.
The most detailed piece on the potential consequences of not using MFA remains this Wired piece from a decade or so ago. This is the sort of thing that what I've shared in the previous paragraphs is intended to help more people avoid.
Two Tales of Tech Recruiting
[embed][twitter.com/jstTECHch...](https://twitter.com/jstTECHcharge/status/1487209360883339264)[/embed]
In an industry that has had (and continues to have) persistent problems when it comes to how it hires and treats black people within its ranks, few things are worse than a black woman announcing on social media that she short-changed a candidate of $45,000 because "I personally don't have the bandwidth to give lessons on salary negotiation".
I've worked with both contract recruiters and full-time recruiters in 10 years as a manager staffing software engineering positions on multiple teams and none of them low-balled any candidate I chose to extend an offer because I intended to keep those folks for as long as I could. The alternative--losing good people to companies that can poach them simply by offering more money--meant not just losing their skills, and having fewer people to divide the same amount of work between, but my employer incurring costs trying to backfill the open position. Especially in a market where the competition for talented people is more and more challenging, the last way any company should start a relationship with a new employee is by undervaluing them from the moment they join.
A position I only filled a couple of weeks ago had been open for two solid months before that. Rather than risk losing a good candidate over $10,000, I requested an exception to offer a larger signing bonus. With the exception granted, we made a best and final offer that he accepted. The onboarding process is going smoothly, and since we're paying him what he's actually worth based on the geography we're in and what our competitors are offering, he will be harder to poach with just money.
Fortunately, there are good examples of recruiters doing well by the people they recruit.
Unlike the first Johnson, this one probably built a significant amount of goodwill and trust--not just between herself and the candidate, but between the candidate and the company she will be working for. In an industry where software engineers are encouraged to switch jobs every couple of years, this company has a good chance of growing this junior software engineer into a senior software engineer--perhaps even a engineering leader--because a recruiter put their best foot forward.
As is sometimes the case on Twitter in cases like this, someone tagged the company Mercedes S. Johnson is recruiting on behalf of--and someone responded requesting a DM with more information. The tweet that actually led me to this whole story was about doxxing and how Ms. Johnson shouldn't lose her job over the post. I've written about at-will employment and cancel culture before, and people have definitely lost their jobs for less than what this woman bragged on Twitter about doing. As of this writing, she was still defending her action.
If you work in tech recruiting and the opportunity presents itself, choose to be a Briana instead of a Mercedes. Both the companies you hire for and the candidates you recruit for them will thank you.
Thoughts on Diversity in Tech
Excerpt of Prepared Remarks
New MacBook Pro
The untimely death of the mid-2015 MacBook Pro that had been my primary machine the past few years meant I forking over for another laptop. Given the hassles that resulted from buying that machine from somewhere other than Apple or MicroCenter, I didn't take any chances with its replacement.
A refurbished version of this laptop (where I wrote this post) cost a little over $400 less than retail. I'm still in the process of setting things up the way I like them, but one new thing I learned was that Apple is still shipping their laptops with an ancient version of bash.
Having used bash since my freshman year of college (way back in 1992), I have no interest in learning zsh (the new default shell for macOS). So right after I installed Homebrew, I followed the instructions in this handy article to install the latest version of bash and make it my default shell.
There's still plenty of other work to do in order to get laptop the way I want it. Data recovery hasn't been difficult because of using a few different solutions to back up my data:
- Carbon Copy Cloner
- Backblaze
- Time Machine
I've partitioned a Seagate 4TB external drive with 1TB for a clone of the internal drive and the rest for Time Machine backups. So far this has meant that recovering documents and re-installing software has pretty much been a drag-and-drop affair (with a bit of hunting around for license information that I'd missed putting into 1Password).
I wasn't a fan of the Touch Bar initially, even after having access to one since my employer issued me a MacBook Pro with one when I joined them in 2017. But one app that tries to make it useful is Pock. Having access to the Dock from Touch Bar means not having to use screen real estate to display it and means not having to mouse down to launch applications.
Because of Apple's insistence of USB-C everything, that work includes buying more gear. The next purchase after the laptop itself was a USB-C dock. I could have gone the Thunderbolt dock route instead, but that would be quite a bit more money than I wanted or needed to spend.
Even without the accessories that will make it easier to use on my desk in my home office, it's a very nice laptop. Marco is right about the keyboard. I'll get over the USB-C everything eventually.
Great Customer Service Smoothes Out Bad Self-Service
Success at switching to a truly bundled Disney+ and Hulu experience (both with no ads) from the janky status quo where both services were billed separately and Hulu had ads but Disney+ didn't required the great customer service experience I had earlier today. In prior months, I'd made the mistake of following the instructions provided as the self-service approach to accomplishing this, and failed miserably. I switched from annual billing to monthly on Disney+ and tried to switch to the Premium Duo multiple times over multiple months, only to be redirected to Hulu and be blocked from signing up for what I wanted.
Today I tried the chat option (with a live human being) and finally got the bundle I wanted--and a refund for the price differential between the new bundle and what I'd been paying. It ultimately took being manually unsubscribed from both Disney+ and Hulu, which the customer service rep accomplished by reaching out to whatever department and systems she needed to, in the span of about 20 minutes. Definitely a 5-star customer service experience--unfortunately made necessary by terrible self-service options.
Plenty of companies almost certainly believe that they will be able to use ChatGPT (or something like it) to replace the people that do this work. But at least initially (and probably for quite awhile after that) the fully-automated customer service experience is likely to be worse (if not much worse) than the experience of customer service from people. I'm very skeptical of the idea that an AI chatbot would have driven the same outcome from a customer service interaction as a person did in this case. And this is in a low-stakes situation like streaming services (some number of which will very likely end up on my budget chopping block in 2024). High-stakes customer service situations will not have the same tolerance for mistakes, as shown in the FTC's 5-year ban on Rite-Aid using facial recognition for surveillance. These are the sorts of mistakes warned about in the documentary Coded Bias years ago, but I have no doubt that other companies will make the same mistakes Rite-Aid did.
In an episode of Hanselminutes I listened to recently, the host (Scott Hanselman) used a comparison of how AI could be used between the Iron Man suit and Ultron. I hope using AI to augment human capabilities (like the Iron Man suit) is the destination we get back to, after the current pursuit of replacing humans entirely (like Ultron) fails. Customer service experiences that led by people but augmented by technology will be better for people on both sides of the customer service equation and better for brands.