HTTP/2 on nginx on Debian

I run my web site off a Debian server on GCE. I like tinkering with the configuration. I hear that HTTP 2 is the new hot thing, and that’s going to mean supporting ALPN which means upgrading to OpenSSL 1.0.2 and nginx 1.9.5 or newer. But they isn’t supported in Debian 8.

I used apt pinning to bring in versions of nginx and OpenSSL from testing into my jessie server. I first added sources for testing by creating a file /etc/apt/sources.list.d/testing.list:

deb testing main non-free contrib

Then I configured my pin priorities by creating /etc/apt/preferences with:

Package: *
Pin: release a=stable
Pin-Priority: 700

Package: *
Pin: release a=testing
Pin-Priority: 650

Package: *
Pin: release a=unstable
Pin-Priority: 600

After an apt-get update I could install the version of nginx from testing, bringing in the appropriate version of OpenSSL: apt-get -t=testing install nginx-full

Then it was just a matter of changing:

listen 443 ssl;


listen 443 ssl http2;

wherever I wanted it.

Now it looks like I’m serving over HTTP/2. Not that it makes a whole lot of obvious difference yet.

Writing ES6 without a transpiler

I like modern JS features. I’ve been using some like const and let for a long time in specific contexts like Gecko chrome (when I worked on Flock & Songbird). Recently I’ve been playing with the features that have been standardized as ES6.

I tried a bunch of different build-system and transpiler approaches but I found them all unsatisfying. Even with automatic transpilation on save, even with source maps, I felt that I was missing too much of the edit/reload cycle that makes web JS programming such a pleasure. Even with low latency I couldn’t take advantage of things like being able to edit my source code inside the Chrome developer tools debugger.

Luckily stable Chrome supports a lot of ES6. Just restricting myself to that quite large subset gives me a great set of features to work with, without losing the development flow I like. Every six weeks I get more features to play with as a new Chrome release launches. When I want to deploy to older browsers I can transpile (Closure Compiler is great) and polyfill, but it’s part of the release / deployment flow rather than obstructing development.

So what am I using? Mostly:

  • Classes
  • Arrow functions
  • let and const
  • New collection types – Map, Set, etc

It’s pretty nice.

Australia Days

Cape Leveque
Photo credit: Finn Pröpper

I really like Australia. I was born there, I grew up there, my parents brothers and sisters all live there. I don’t have a single national identity, but ‘Australian’ is the one I put above the others. It’s a physically beautiful and inspiring country. At their best its people are generous, open, welcoming, relaxed and funny. At its strongest Australian nationalism is self-critical. The story of the first European settlers arriving as British criminals  and founding a free nation is inspiring.

On the other hand, our country was founded on the lie of terra nullius which continues to pervert many Australians’ understanding of their country. Indigenous Australians suffer incarceration and ill health at rates that are hard to comprehend, relative to the prosperous, free image we have of ourselves. Explicit genocide, dispossession, unequal treatment and paternalism has been replaced by active neglect and disrespect. Stan Gran’s speech is a must-watch:

Australia’s attitude to immigration has been troubled for a long time. A set of White Australia policies restricted non-European immigration persisted into the 1960s. Even then, non-English Europeans, especially Catholics were looked down on and politically and economically marginalized. During the Second World War, unlike the United States, we interned not only Japanese Australians, but Australians of Italian and German descent – as I like to say, “our racism was colourblind”. Subsequent waves of Southern European, East Asian, and now South Asian and Middle Eastern immigrants are attacked verbally by politicians and physically by thugs.

Finally in the treatment of asylum seekers by Australia since the 1990s has been a stain on our reputation and our moral standing. Governments of all parties have imprisoned men, women and children, in awful conditions, exposing them to horrible abuse – simply for arriving in Australia after escaping persecution – but without their paperwork in order. It’s a continuation and escalation of our history of xenophobic immigration policies.

So January 26th doesn’t get me that excited, but it does make me reflect. I’m glad my employer decided to use our home page the occasion to highlight the historic oppression of our indigenous brothers and sisters. In four months time there will be National Sorry Day, a national day of atonement and reconciliation. That recognizes where we’ve come from, how far we have to go to achieve the standards we set ourselves. That celebrates the aspects of Australian culture that I most identify with.

Brief first impressions of Rust

I had a little play with Rust this week. I’d been meaning to for a long time, but the arrival of 1.0 motivated me to spend a few hours playing around with the tools and the tutorial. I haven’t actually written anything myself yet – I’m sure I’ll have some different, perhaps more valid thoughts after I do that. I’ll probably write a web server – that’s been my go-to hello world program for the past 20 years or so.

But just working through the first couple of chapters of the excellent free, online Rust Book I’ve come away with some impressions. For better or worse I’m comparing Rust to Go and to a lesser extent to C and C++.

Something that Go promised was good tooling and strong opinions on source code organization. I like to tooling just fine, but the source code organization bugs me – I don’t like having all my code and the code I depend on under a single directory. Rust’s source code organization is much more appealing to me – a top level directory with a configuration file Cargo.toml and then a src/ directory with my code. Dependencies are downloaded and stashed somewhere (who cares? I don’t).

Even playing around with the simple examples in the book I was missing “go fmt” and “goimports”. I haven’t gone deep enough into Rust to know if there’s an equivalent that everyone else is using or if the community has the (incorrect) opinion that source code formatting is a lifestyle choice. One of the most charming things about Go and Python are standardized source code formatting. In my team at work we’re using clang-format to (mostly) enforce a consistent style to Objective-C.

For the actual code itself there’s a steep learning curve that I’m still at the bottom of, staring up. I know that the whole point of Rust is a type system that is powerful enough to allow programmers to express complexities of thread safety and resource ownership, but that means that it’s really complicated. I like that it’s explicit and designed to be easily parsed. I like that there’s type inference so I don’t have to type the confusing names of these types all the time. I still have a lot of learning to do.

After my brief time with Rust I’m excited that we have a language that is expressive enough to provide memory and concurrency safety while remaining explicit and predictable. I just hope that I and others are able to become comfortable with the syntactic line noise to use it effectively, and that we find the right problems so we can use it appropriately.


Dan McKinley wrote a great blog post about choosing boring technology. It’s worth reading, but the tl;dr is that by adopting new and exciting technology you introduce additional risk and instability, which limits your ability to innovate on your product. I agree with pretty much everything he said.

There’s another dimension to the boredom question though. I think it’s both a cause and effect of what Dan’s talking about. I call it Ian’s Rule Of Bored Programmers:

A smart programmer tasked with solving a simple problem will make the problem more complicated until it becomes interesting.

I’ve observed this time and time again both in companies and in the open source world. To me the classic open source example is the GNU C Library. The team developing the glibc library, led for many years by Ulrich Drepper are intelligent and experienced, but they working on a library that for the most part is wrappers around syscalls, plus printf and malloc implementations. Almost every user of their library is using the Linux kernel. Instead of a simple, stable library we’ve ended up with a complex, always changing source of innovation and bugs.

At companies that only hire experienced programmers I’ve watched experienced developers faced with a simple but important problem add complexity to the solution to keep their attention. In some cases it takes the form of adopting or developing new languages, databases or other technology (like Dan writes about). In other cases developers chose to solve an abstract problem class rather than the specific concrete problem at hand, which ironically often ends being more brittle and inflexible than a solution specific to the problem would have been.

There doesn’t seem to be an obvious solution to this. Sometime simple problems are important enough that we want someone with experience to tackle it. For myself I just try to check in with myself to make sure I’m not adding complexity where it doesn’t belong.

The Problem With Democracy

The problem with democracy is that the people of a country lose the right to consider themselves independent of government policies. If a government does or says awful things then the people of the democracy have to bear responsibility.

Citizens of totalitarian regimes can’t really be held responsible for what their governments do. I don’t consider the Chinese people as a whole responsible for the repression of Uyghurs or Ai Weiwei. I don’t hold the Saudi people responsible for the domestic repression of religious minorities or for their government’s support for the coup in Egypt.

Australians have elected governments that lock up asylum seekers in private prisons in Australia and in our poor neighbors. The conditions are awful, there is endemic violence (including sexual violence) against the asylum seekers. It’s an embarrassment, but more than that it’s a national shame – a stain on our character as a people.

Israelis just reelected Likud and Benjamin Netanyahu, right after he declared his opposition to ending the occupation and expressed deeply racist concerns about the idea that non-Jewish Israeli citizens actually voting in the election. Not all Israelis voted for him, but as a democracy, Israel as a whole carries the responsibility for his words and actions.

By being the citizen of a democracy we are taking on responsibility for the actions of our government, whether we are in the majority or not. We have the responsibility to speak up and advocate for what is just and right and true. But we can’t escape our shared responsibility for our nations’ crimes and mistakes.

The Kevin Bacon of Music

Who is the most connected musician? Mathematics had Paul Erd?s, film has Kevin Bacon, but who is the center of the musical world. At some point I flippantly suggested Brian Eno because of this long career as a producer. Rich Trott brought this up again recently when linking to his awesome Music Routes site.

Rich has now published the data that backs Music Routes. This let me write some code to calculate who the most connected musician is. The criteria I chose was to find the artist with the lowest average distance from all other musicians in the largest network of connected musicians. I started researching shortest path algorithms and quickly discovered that the Floyd-Warshall algorithm will give me the shortest path between all nodes in a graph in only O(n³). And scipy has an implementation.

I ended up with an IPython notebook to calculate the most connected artist. Rich’s data includes 10479 people on 4835 tracks. He admits that it ultimately reflects his tastes because he has entered most (perhaps all) of the data himself, but that’s still a serious number of data points. The Floyd-Warshall was the slowest part of the calculation. I left it running over night and once it was complete saved off the results in case I ever wanted to run this again.

The result? The artist in the largest group of connected artists (10065) with the shortest average distance from each other artist in the network was Jim Keltner, a session drummer with an average distance of 3.226. He’s followed closely by Paul McCartney (3.239), Bob Dylan’ (3.322) and Elvis Costello (3.333).

This is an alright result, but it really feels kind of like “small data”. I downloaded the database dump with 3.6M artists on 5.3M releases. I need to work out how to run an all-pairs shortest-path algorithm for that without needing terabytes of RAM.


Streaming royalties: taking over, but what are the details

So TechCrunch posted that Kobalt, a company who collects digital music publishing revenue for artists has announced that Spotify revenue has overtaken iTunes revenue by 13% in Europe. That’s interesting, not surprising given the trends but is missing answers to a few key questions:

  • What are the overall revenues – does this represent an overall drop in incomes with iTunes revenue dropping quicker than Spotify revenue grows, or are artists incomes holding steady?
  • How does the buy vs stream ratio look across the spectrum of music popularity? Pop vs long tail?

TC of course failed to link to Kobalt’s blog post. Here it is. It doesn’t contain much more content.

Malaysian Chicken Curry

I really miss Indonesian, Singaporean and Malaysian food. It basically doesn’t exist in the Bay Area. I started reading Bee’s Rasa Malaysia blog for recipes. I think I originally found it looking for a rendang recipe but subscribed. It’s actually a little disappointing because it’s largely Thai or Chinese recipes, and too many competitions and not enough recipes. But last week there was a Malaysian chicken curry recipe, so I made that.


I used some special Malaysian curry powder that my dad brought from Australia, but the recipe was basically the same as Bee’s.

  • 2 tbsp vegetable oil
  • 1/2 onion, diced
  • 1 oz / 26 g Malaysian curry powder
  • 1.5 lb chicken breast, chopped into 1 – 1.5 inch pieces
  • 3 cups water
  • 1 tomato, cut into wedges
  • 2 small potatoes, peeled and cut into wedges
  • 4 hard boiled eggs
  • 1/2 – 2/3 cup coconut milk
  • salt
  • steamed rice to serve
  1. Heat the oil until hot, add the onions and fry until fragrant.
  2. Add the curry powder, stir for 30 seconds.
  3. Add the chicken, stir well for 1 minute.
  4. Add the water and bring to a boil.
  5. Lower to a simmer and add the tomato, potatoes and eggs.
  6. Cover and simmer for 30-45 mins – until the chicken is cooked and tender.
  7. Add the coconut milk and salt to taste. Simmer for another 5 minutes.
  8. Serve with rice.

This quite liquid, not thick like a Thai or Indian curry. It soaks into steamed rice wonderfully.