I kept revisiting this thought experiment because it applies to life in general. Your life is a startup; it can crash and burn. So I repurposed it into a recipe for how to live.

All you need to do is ask yourself a similar question: in my life, what would fail if left on autopilot?

Boiling the frog (you are the frog)

Major failure modes in life come from boiling the frog: you don’t notice the problem until it’s too late. Imagine what your life looks like 10 years out. Some areas will be fine, but others area will suffer. If you were to change nothing, where does your life go?

Some things in life feel like a big deal right now but aren’t actually important. Conversely, the real priorities can be a big deal later while barely being noticeable in the moment. But you should focus on them now.

Why do important life domains rarely feel like a big deal in the present? Because they either compound, or they expire.

Compounding Domains

• Finances: Money can snowball in either direction. Crippling debt can keep you trapped for the rest of your life, while smart financial habits allow you to retire early. You don’t want to be the recently-laid-off 60-year-old with a mortgage and no savings.

• Physical health: Muscle growth peaks at a relatively early age and slows down. The same happens with agility. Your physical fitness influences your longevity, and improving your fitness becomes harder when you’re old or unhealthy. The best way to be healthy when you’re old is to be healthy when you’re young.

• Friendship: Quality friendships are key to wellbeing. But friendships atrophy and drift apart because people are too “busy,” and people complain that it’s hard to make friends as adults.

Expiring Domains

• Dating and marriage: Dating gets harder as you age. On average, people become less attractive and more set in their ways. Fertility goes down, and it becomes harder to meet people. Yet who you partner with is arguably the most important decision of your life.

• Travel and experiences: You may not have the ability to travel later in life. This may be due to physical health, energy levels, or from other life obligations. So do it while you can. Money is fungible; experiences less so.

• Geographic optionality: Avoid putting down roots until you’re confident you want to stay somewhere for the long term. Homeownership is often treated like a checkbox rather than a choice. Far too often, people never move (or stay in their hometown), which closes off many opportunities.

None of these feel urgent in the moment, but they are. By the time it’s obvious, the ship has already sailed. That’s why it’s important to be vigilant of these failure modes while they don’t feel like a big deal.

What should you be doing right now?

1. Identify parts of your life that are operating on autopilot. Which ones are projected to fail? The parts of life that fail on autopilot are where your attention is most needed.

2. Select the highest priority part of your life that’s on track to fail. You can only really fix one or two things at a time. When prioritizing, ask: What will expire soon? What will compound the most? What will be hard to reverse?

3. Focus your attention on the most important “autopilot failure mode,” and intervene until you’re happy with its trajectory.

4. Systematize that part of your life (i.e. build good habits) so it won’t regress the moment you divert your attention elsewhere.

5. Repeat the process.

Another way to describe this is to “find the ticking time bomb and defuse it.” Most lives don’t fail in the conventional sense. They just pass by until options quietly disappear. So your job is to notice what won’t fix itself and act before it’s too late.

It’s not for day traders or people trying to gamble. It’s not for people struggling to live below their means. There are plenty of resources for you, but this is not the correct place to look. You’ll need a fair chunk of cash to implement the contents of this blog post. If this ain’t you, stop reading!

Here’s the situation I see way too frequently:

• You’re a (relatively) high earner who lives well below your means.

• You’re probably sitting on a pile of cash in a high-yield savings account, and you probably have a concentrated position on a single company’s stock (i.e. your employer).

• While you’re not in financial trouble, the lack of a strategy makes you nervous about the future. You want a simple, idiot-proof, low-maintenance strategy that just works.

Fortunately, it’s not that hard.

The strategy

1. Calculate and save up an emergency fund (3-6 months of expenses). Keep that in a high-yield savings account.

2. Pay off any remaining debts.

3. Figure out if you’ll need a lump sum of cash in the future (e.g. to buy a house).

4. Max out your tax-advantaged retirement accounts (e.g. 401k, HSA, mega-backdoor Roth).

5. Chuck any surplus cash into a taxable investment account.

6. Go touch grass.

Hopefully the first three steps should be simple enough. Usually it’s the investment part that trips people up. (“Where do I put my money? What do I buy?”)

What do I do? Where do I put my money?

Prioritize contributing to retirement accounts because of the tax benefits. Understand how much money you need for spending and how much you have to spare for investing. Then it’s time to click some buttons.

401(k)

The first place you’ll want to put invest is into a 401(k). Max it out. You’ll probably get employer matching. It’s free money.

You should aim to max out your 401(k) every year. That’s around $24k of contributions per year at the time of writing. Any contributions to the 401(k) must come out of your paycheck, and you typically configure the contribution amount/percentage via your brokerage.

How you spread out your contributions is up to you. What matters is that you max out the account by end of year. Personally I try to max things out as quickly as possible: at the start of the year, I hold on to some cash and then contribute 100% of my paycheck until the retirement accounts are maxed out.

“Should I contribute to a pre-tax 401(k) or Roth?” I’ll be honest, it really doesn’t matter. Flip a coin. Or if you’re too lazy to flip a coin, just pick Roth. The difference in the long run is minuscule and situationally dependent. The math needed to figure out what’s optimal for you isn’t worth the time, in my opinion.

Mega Backdoor Roth IRA

Maxed out your 401(k)? Great job! If your employers supports the mega backdoor Roth IRA and you still have money from your paycheck that you don’t plan to use, you can continue to contribute parts of your paycheck up to the IRS limits.

I’ve written about the mega backdoor Roth IRA previously, so I won’t harp on it too much here. Just make sure it’s actually offered by your employer, and make sure you have the money to spare. As of the time of writing, it’s an additional $35k of contributions after maxing out your 401(k).

Unlike the 401(k), contributing to a mega backdoor Roth isn’t for everyone. There’s no employer matching, and the limit you can contribute is quite high. Do not max out a mega backdoor Roth IRA if you expect you’ll need that $35k within a few years.

HSA

It’s a bit less obvious, but a Health Savings Account (HSA) is a tax-advantaged investment account. I recommend young and healthy people opt for an HSA if possible. You can contribute money from your paycheck into your HSA. Your employer probably contributes money into your HSA as well.

With your HSA money, you can spend it on medical expenses, but you can also invest the money. If possible, max out your annual HSA contributions, and set it to auto-invest. Even if you don’t expect to get sick, it’s a great avenue for future medical expenses. And transferring an HSA to your children doesn’t get taxed, so you can really stick it to Uncle Sam.

A side note on HSAs: if you have medical expenses, prefer to pay with “normal” money rather than withdrawing from your HSA. You should be careful about taking money out of a tax-advantaged investment account. You won’t get an opportunity to put it back in.

Taxable accounts

You’ve maxed out your 401(k), the mega backdoor Roth, and your HSA. And you still want to invest more? You absolute stud! Maybe you can just Venmo me the extra money instead.

On a more serious note, you don’t want to hold surplus funds as cash for too long. Open up a brokerage account. Any will do. I recommend a large brokerage with a shit UI. The shittier the UI, the less tempted you are to fuck around. Brokerages with nice UIs encourage you to constantly look at your money, which is a recipe for doing something stupid and ruining years of compounding.

Vanguard, Fidelity, and Schwab all work great. If you already have an employer account with a broker, it’s easy to open up a personal account with them too. (For example, Google employees might prefer a Schwab account, since that’s where their stock goes.) Interactive Brokers also works, but its UI is too shit, even for me. Avoid Robinhood; its UI is too nice. M1 Finance is fine (because of their auto-rebalancing features), but be careful since their UI is nice. Most importantly, use my referral codes so I can afford guac on my Chipotle burritos.

Investing: what do I actually buy?

Investing is important. If used correctly, money compounds. When it comes time to retire, you want to live off your compounding nest egg. Compounding takes time, so try to invest as much as you can as early as you can.

The two greatest mistakes in investing is (a) taking too much risk and (b) not taking enough risk. Understand your personal risk tolerance. The Bogleheads and Reddit /r/personalfinance wikis are great starting points for further reading.

Here’s what you do:

1. Pick a low-cost, diversified index fund (or funds).

2. Put your investment cash into said fund(s).

3. Periodically deposit more funds into the portfolio and rebalance as necessary.

What’s in Andrew’s portfolio?

In Skin in the Game, Nassim Taleb made a great quote about investing advice. “Don’t tell me what you think, tell me what you have in your portfolio.” Here’s what I have in my portfolio:

I hold IVV/EFA/DMBF with a 50/50/50 allocation. Three positions. That’s it. All equally weighted. My taxable portfolio is 1.5x leveraged (hence it’s not a 33/33/33 allocation). For every two dollars I have, I borrow one dollar on margin. Do not take leverage if you don’t know what you’re doing. Taking leverage can fuck you and kill decades of progress. You can get by just fine without leverage.

For my tax-advantaged portfolios, it’s a lot simpler. I just go 100% in the S&P 500. No leverage. It’s all auto-invested. My two investment accounts are my 401(k) and my HSA. In my 401(k), the portfolio is completely in Vanguard’s S&P 500 proxy. In my HSA, the portfolio is completely VIIIX, which is some other S&P 500 proxy. The exact fund doesn’t matter: VOO, IVV, or some other S&P 500 proxy will all have 99.9% correlation. These were not deliberate strategic decisions on my part; I just picked whatever S&P 500 proxy was available.

Why do I do what I do?

• I have a stake in both domestic index funds and international index funds. Having exposure to both domestic and international equities obviates the need for bonds.

• I have a stake in a managed futures strategy as a hedge in situations where equities perform poorly.

• I leverage 1.5x such that I magnify returns without suffering from volatility drag.

• For my retirement accounts, my position is much simpler because retirement accounts can’t take leverage. (Also I have a financial advisor managing my taxable account, and I’m too lazy to do anything fancier for my retirement accounts.)

Don’t blindly copy me. I’ll give you suggestions in the next section. If none of this made sense to you, don’t stress out.

Recommended example portfolios

In my examples, I’ll use VOO to represent the S&P 500 (i.e. domestic) index and VXUS to represent the international index. There are many funds that track the same index, so when you buy for yourself, you don’t need those exact ticker symbols.

I present to you the 1-fund portfolio and the 2-fund portfolio:

• The 1-fund portfolio: 100% in VOO

  • So simple! You literally can’t go wrong with this. The S&P 500 is already super diverse.

  • In your retirement accounts, you can opt to go for a target retirement date fund as well. It doesn’t really matter.

• The 2-fund portfolio: 50/50 in VOO and VXUS; equally weighted

  • This is good if you want international exposure.

  • This is also good if you want to scratch that itch with having more than 1 position in your portfolio.

  • Why have a 50/50 allocation instead of 60/40 or something else? Because 50/50 is simple. People will debate all day about whether to hold more domestic or international equities. Don’t waste your time, and instead go for a “good enough” portfolio.

Did you expect something more complicated? I sure hope not. These are set-it-and-forget-it portfolios that will make you a very happy camper over a long time horizon.

It’s hard to go wrong since you’re sufficiently diversified. Diversification is the only free lunch in investing. Do not take leverage. If you find this blog post informative, you’re not ready to handle leverage. Your goal is the match the index, not beat it. The best strategy to match the index is to buy the index.

Maintenance

Investments into retirement accounts should be fully automated. Contributions will come straight out of your paycheck. You may need to adjust contributions once a year, since IRS limits change and health insurance policies change.

For personal investment accounts, try not to mess with it too frequently. (Every month or quarter is perfectly fine.) Ideally you rebalance around the same time you get a cash infusion (e.g. every other paycheck). When rebalancing, buy positions in your portfolio that are underweight; try to avoid selling overweight positions. Most brokerages have some form of auto-investing that will track a target portfolio allocation. So ideally, you’ll have to do very little manual decision-making in general.

If a part of your compensation is in company stock, sell the stock as soon as it vests and reinvest the proceeds. Some companies offer auto-sell programs so you only need to handle reinvesting the cash. I know of many people who are hesitant to sell company stock. It’s a rabbit-hole of a debate, and I won’t go to deep into it. If you had the cash, would you buy back the stock? If not, then you should diversify. Furthermore, you organically incur concentration risk with your employer, even without the additional concentration risk from holding too much of a single stock.

At this point, everything should be automated and diversified. Great! Pat yourself on the back. Now we proceed to the most important step: STOP THINKING ABOUT INVESTING and go touch grass. Money is a means to an end. You’ve set yourself up for success. Now go live a good life.

1. I used Antigravity to set up a website with interactive demos.

2. I used OpenClaw to manage my self-hosted services.

3. I used Claude Code to organize my BJJ notes.

Each of these were done within a day. I did minimal typing, and it was mostly free. Here are my experiences.

ClickFix.fyi - Antigravity

At work, I’m working on mitigation of the ClickFix scam. While there are various news articles about ClickFix, there’s no centralized informational site about it actually is. So I vibe coded an informational site in a day or so.

It’s called ClickFix.fyi. Curious about what ClickFix is? Well now you can visit the site!

By nature of it being work-relevant, I used Google Antigravity. It’s great. You just tell it what to do. I wanted a static site, so it made a site using Astro. I don’t know Astro, but it doesn’t matter. I just told it what to do; I didn’t even review the code. It was awesome. It can even generate images and interactive demos.

At the time, I was on the free tier. I used Claude models first, but the quota burned out almost immediately. Not surprising, I guess. But the Gemini quota was surprisingly generous for a free tier. You can work through an entire project without having to worry about running out of quota. (Though the caveat is that once you run out of quota, you’re kind of fucked because you have to wait a week. On paid plans it’s a lot better.)

VM Management - OpenClaw

Coding is great and all, but what happens when you give AI real power? OpenClaw has been all the hotness recently, so I wanted to test it out.

The first step? Get a free VM. Oracle Cloud has a free tier that’s quite generous. You can get a 4-core machine with 24GB RAM on their free tier. The only caveat is that it’s an ARM machine. But honestly that doesn’t matter. I like self-hosting random shit by myself, so having a free beefy machine is great.

With OpenClaw, the real limiting factor is the model itself. It doesn’t require much compute otherwise. So if you self-host a model, you’d better have a lot of GPU compute. It’s better to pay $20 for a Claude ChatGPT subscription. Then you can run OpenClaw on a toaster. (You shouldn’t be buying a Mac Mini unless you have a specific reason. The correct way to go is to have the Gateway on a VM and add your local Mac as a node.) I set a Telegram bot for my OpenClaw instance, and then it was easy to chat on the go. And all of this was (mostly) free.

And goddamn, it was quite nerve wracking. While setting up, I asked the bot about OpenClaw configs. I was expecting answers and links to documentation. Instead it directly modified its own configs. Eventually I gave it access to my GitHub so it could back up its own data. And it did all of that with minimal prompting from me. So far it’s been doing a great job, even though it’s scary, since OpenClaw can basically pwn my GitHub if it goes rogue. While the blast radius is still limited, I lack the proper failsafes, yet I’m also eager to expand its access so it can do more.

Obsidian BJJ Notes - Claude Code

As a Google shill, I’ve been using Gemini CLI at work. But I paid for Claude, and I wanted to try out Claude Code and get value out of my subscription. But Antigravity was good enough for my coding projects; I didn’t have any other project out of the blue to work on. Then it dawned on me that I didn’t need to use Claude Code for code.

I have an Obsidian vault for all of my notes. It’s all markdown files. The vault contains my journal and also random notes. Of those notes, I have a folder for BJJ. Historically I’ve kept raw notes around every class. Those raw notes have never really been synthesized into anything deeper than that. For those who do BJJ, you’ll know that positions in BJJ resemble a flowchart: you transition into different positions depending on what happens. Obsidian is great for back-linking: a page can link to another page quite easily; it matches the graph-like nature of BJJ.

It’s quite nice. Claude asked how I’d like the notes organized, and we had a relatively nice back and forth. Then it took my raw notes and put everything into its own page. At this point I feel like Claude is the real BJJ expert here. All I had to do is go to sleep and let the AI cook.

I will note that volume (not complexity) might be the bottleneck for AI. I ran out of Claude quota (on a paid plan) and had to wait five hours before resuming the job. The organization of the positions isn’t inherently complex; it’s just a lot of work, and it’s a lot of notes.

Conclusion

So what did I learn from all of this?

• AI is pretty good at this point. As you get more comfortable, you should give it more agentic/destructive permissions. Don’t just use it for coding.

• Using AI doesn’t necessarily save you time. If things aren’t sufficiently clear, it will fuck up.

  • This is especially bad if you have the “stare-and-wait” workflow, where you sit there like a ding-dong and as the AI does something. That doesn’t save you any time; if you do that, you’re better off manually coding. The important part is that you give the AI the info it needs and then you leave to do something else.

• Laziness is a virtue, so long as you outsource the work that doesn’t require your judgment. For a lot of this work, I could have done it myself (albeit slower). So it’s perfect for AI. But for other things that I didn’t know (e.g. Astro), I didn’t learn shit, and I wouldn’t be able to maintain the website without the help of AI.

• Quota (for both free and paid tiers) is scarce but pretty reasonable, in my opinion. The value you get from paying is far greater than the monetary cost. Lots of people have subscription fatigue and aversion to paying for software, but that’s a mistake. You should index on the value you get from your expenses.

• Regarding security, I need to have a better plan. It’s not a bad idea to give AI more intrusive permissions. Being a chicken gets you nowhere. But there is the real threat model of an AI going rogue or making an honest mistake and fucking everything up. For example, in my case, the biggest risk is that Claude nukes all of my GitHub repositories. Not the end of the world, but it’s still pretty bad. Realistically, I don’t want to revoke those permissions, but I do need a reliable failsafe. In my situation, I suppose it should be some form of killswitch to disable the VM hosting my OpenClaw gateway.

I was in San Francisco for the summer interning at Dropbox. Dropbox has quite the drinking culture: every other weekend, the entire intern cohort would squeeze into a tiny apartment, stock the place up with beers, and play drinking games all night long. The world would get fuzzier as I became progressively more inebriated, but I enjoyed the process since I was having so much fun.

It was an abrupt introduction to alcohol. I recall my last day in SF that summer: the morning of my flight, I stumbled my way to the airport hungover and half lucid. I have no clue how I got back home in one piece.

After graduating college and moving to the Bay Area, I drank infrequently, but whenever a social event had alcohol in the picture, I had a bad habit of drinking too much. There’s a joke that one drink is just right, two drinks is too many, and three drinks is not enough. That embodies how I handle my limits.

I’d take a shot of tequila, feel nothing, and pound a few extra shots since “nothing was happening.” Some time would pass and as I became less lucid, I’d utter a few regrettable remarks and forget how the rest of the night went.

You have to cut me some slack. I was an impressionable person in my early 20s. I wanted to fit in and have fun, and alcohol seemed like an easy way to socially blend in.

Then COVID hit. I left the Bay Area and I had a bunch of time alone to reflect on how I wanted to live my life.

Why did I quit?

The fact that I didn’t know my limits was bad enough, but I would come to realize that the act of drinking was already pretty bad. Bad enough that I concluded that this needed to stop.

I was slowly killing myself…

I’ve blacked out more times than I’d care to admit. If you think about it, being drunk is quite terrifying. Parts of your brain turn off. You lose control of your thoughts, despite trying your hardest to stay lucid. It’s as if you’re thinking someone else’s thoughts. It’s how I imagine dying feels; it’s totally different from falling asleep.

I realized that every time I got drunk, I was slowly killing myself. It’s scary when you can’t recognize or trust your own mind.

…for literally no good reason.

The stupid part is that I never even enjoyed drinking. I only did so at social events when alcohol was freely available. The tech industry in Silicon Valley has a drinking culture, so it’s actively tolerated, if not encouraged.

I drank to fit in and trick myself into having fun. But the truth is that I wasn’t having fun. By drinking for social validation, I was living someone else’s life. It wasn’t a real choice of mine, and deep down I didn’t want to live my life pretending to be someone else.

How did I stop?

It was pretty easy, actually. I made a declaration to myself to pause all drinking for 5 years. After that duration passed, I’d give myself permission to reevaluate. At the beginning, it was remarkably easy to enforce, since it happened during the COVID lockdowns.

Otherwise, I employed a few identity/mindset shifts:

• I can have fun and fit in without alcohol. Alcohol doesn’t make you braver; it makes you stupider. Alcohol doesn’t build social status; it reduces your social awareness.

• It’s more important to be high-agency and make my own independent decisions, rather than “going with the flow.”

• I want to prove to myself that I can say no to people. If you only go on autopilot, you’re nothing more than an NPC.

• I don’t want to destroy my body and my mind. That prospect is scarier than any perceived benefits of alcohol.

With the proper mindset, it became easy to just stop drinking. Whenever I was at a bar, I’d just have a mocktail. At parties, I’d simply socialize while sober. For me, this was all mental.

Miscellaneous thoughts

• My life is better, and my mind is definitely clearer. Avoiding alcohol is arguably just as important as writing, when it comes to being a clear thinker.

• Quitting alcohol has definitely tested (and validated) my ability to resist social pressure and take ownership of my choices.

• You can definitely have fun without alcohol. If anything, it’s quite amusing being the one sober person in a room full of drunk people.

• People are remarkably respectful of my choice not to drink. For that I am grateful.

• Scott Galloway has an interesting perspective around society’s shift away from alcohol. His claims that the pendulum has swung too far against alcohol (“the worst thing that’s happened to young people is the anti-alcohol movement”) and pushes for people to drink more and make more “bad decisions.” Otherwise the loneliness epidemic persists, and young people aren’t pushed to take social risks. As a chronic over-thinker, I believe he does have a point. Is the trade-off worth it? For now, I’m still a teetotaler, but I do need to take this into consideration.

• 2024

• 2023

Ever since I’ve begun writing these year-in-review blog posts, there’s been a looming pressure to one-up the previous years. 2025 felt like a relatively tame year in comparison to the past two years, and I’ve made my peace with it. The first half of the year felt like a blur, but it did get better in the second half. And throughout 2025, a fair bit happened:

• I got my blue belt in BJJ and competed for the first time.

• I gave me first external conference talk.

• I spent a month in Asia, and I visited Taiwan and Japan for the first time.

Overview of the year

I started the year feeling aimless. In 2024, I had moved and switched jobs, so I felt I should take a bit of a breather. But when you don’t have a goal, you’re usually quite passive with your time.

It felt like the first half of the year went to various one-off social events. I barely remember them, and I have little to show for it. Fortunately, external goals and obligations with a strict deadline (e.g. preparing for a BJJ competition and travel) forced me to snap out of it. Then the year started to pick up.

Brazilian Jiu-Jitsu

Around May, I decided to sign up for a BJJ competition. I trained for a while, but I never competed before. Nor was I comfortable fighting under pressure. So it was about time to give it a try.

I started increasing the time I spent on the mats and reduced my focus on other areas of life. Around two weeks before my competition, I dislocated my toe in training. It wasn’t bad enough to change any plans, but I did literally end up limping my way into the competition.

There’s a night-and-day difference between competing in BJJ and normal sparring. Someone is going at you 100% unhinged. Your adrenaline goes through the roof, and your field of vision decreases. And after a match, you find yourself completely gassed out. But you learn a lot. You notice what works and what breaks down when you’re under pressure.

I competed a second time shortly afterwards. That one forced me to deal with loss. It’s a rare and interesting emotion you feel when you drive an hour to some random sports center, lose in a single-elimination bracket, get handed a participation trophy, and stand on a podium to get your picture taken while wearing said participation trophy.

Later in the year, I got promoted to a blue belt. Honestly nothing changed, except the color of the belt.

BJJ really is a lot of fun. I enjoy it a lot, and you should try it out if you haven’t already. Next year, I plan to begin training Judo in tandem with BJJ, as I’d like to learn how to grapple while standing.

Career

It was a turbulent year at Google. My manager left early in the year, then layoffs happened, then Privacy Sandbox became defunct, and then came a giant reorg that dragged on for months. I’ve been at startups before, I’m used to volatility at work. It’s just unexpected for a company of this size. But Google’s stock price has performed well this year, so I’m happy.

On a less tongue-in-cheek note, things are picking back up at work. The reorg has been settling in a reasonable manner.

Halfway through the year, Meta “acquired” a 50% stake in Scale AI for around $15 billion. As a result of the deal, shareholders were paid a one-time dividend. It was a pretty neat experience shared between me and my former coworkers. Startups rarely have an exit, and Meta acquisition was certainly unexpected.

In the back of my head, I’ve had a desire to give conference talks. After coming back from Defcon this year, I was inspired to actually do it. After preparing proposals and slides, I spoke at 3 different conferences this year. Speaking is a lot of work: you do a bunch of preparation that culminates in an hour-long presentation. But it’s fun and I glad I did it. It’s a nice way to share my work outside of the workplace.

So how would I summarize this year career-wise? Pretty good, albeit unexpectedly adventurous.

Travel

Compared to previous years, I didn’t travel much. Or rather, I had fewer trips. I definitely had my longest trip abroad this year.

In August, I went to Defcon in Las Vegas. That’s been an annual tradition for a while now. Though this year, there was a speaker who gave a talk on Privacy Sandbox: it was cool to see someone external talk about my project at work.

For most of November, I was abroad in Asia. I was going to a conference in Kobe, Japan. But since I was already in Asia, why not stay for a while?

I started in Kobe, where I was mostly working. The rest of the month was a long vacation: I went to Taipei, Beijing, and Tokyo. It was my first time going to Taiwan and Japan, and I’m glad I fit so much into a single trip. A month in Asia is a long time, so I can’t really describe the details in a blog post. Needless to say, it was ton of fun, and I’m glad to be back home after being away for so long.

What’s next?

The big lesson I want to take into 2026 is to avoid aimlessness. You must always have a goal in mind and something to work towards. It’s better to have a bad goal (and later switch to a better goal) than to not have any goals at all. Why? There’s no pressure to change when you’re aimless, and a lot of time can fly by before you “wake up.”

So how do I want to go about 2026? The theme is to be dialed in. Tyler Cowen pioneered the idea of having a personal production function. Most people are consumers, not producers. I’d like to be the latter.

• For example, I didn’t publish any blog posts (besides my annual reviews) this year. I’d like to change that. One blog post a month seems like a reasonable minimum.

• I should be more aware of what’s going on in the industry outside of work. That means being an active member in external communities and opportunistically speaking at more conferences.

• It’s important to have some side project to tinker on at all times, no matter how silly. For instance, I’m currently learning how to clone apartment keys. It doesn’t have to be ambitious, it just needs to exist.

• And of course, I’d like to start learning Judo and be consistent with it.

Happy new year!

Miscellaneous learnings

On human nature

• People don’t know what they want, and they’re quite receptive to what you want. So be clear with what you want, and go for it. (Corollary: the squeaky wheel gets the grease. I mean this in a positive way. People are usually happy to help you.)

• I’m quite likable as a person. At least in the long term. Though I don’t give the best first impressions, since I’m robotic. The solution to this seems to be to just own it and be clear if I’m joking around/being sarcastic. (People are bad at recognizing sarcasm.)

• Be approachable. Approach people. Most people are chicken, so you should minimize friction for them.

• I used to say that courage is the limiting resource, not intelligence. Though I still stand by that statement, I think it’s actually agency that matters. Courage is more of a means to cultivating agency. Be as high-agency as possible.

On progress

• What has taught me the most and the fastest is doing reps, reps, reps.

• There truly is no perfect time to start. Excessive waiting doesn’t beget any benefits. The first half of the year was less interesting than the second half because I was just waiting around. (Note that this is not the same as “precrastination.” Quickly workshopping solutions in your head is a useful skill.)

• Do not be aimless. Have a bad goal is better than having no goal. You must be in the driver’s seat of your life, or else you’ll be dragged around, and time will just pass you by. Your attention is precious and limited.

On mortality

• My life is pretty good. Like really freaking good. So when things don’t go my way, I shouldn’t be all that sad when putting everything into perspective.

• When managing finances, there are three states of being: rich, broke, and dead. Your life expectancy plays a huge role into how much you can and should spend.

• Most things are just a means to an end, and you probably think otherwise because of your ego. Go to work and make money; your career isn’t a reflection of your value as a human. Apologize to others if you’re wrong; avoiding a moment of embarrassment isn’t worth a lifetime of regret.

On human relationships

• There will be times that tempt you into exhibiting toxic behavior. Resist the urge; do not be toxic. Ever. On the flip side, you must have zero tolerance for toxic behavior from others.

• Deal with interpersonal issues as soon as possible, even if they feel too small to be worth talking about. If problems grow and fester, it’ll be too late. Better to nip it in the bud.

• And the biggest learning of the year: accept people for who they are. Just because you don’t vibe with someone doesn’t mean you’re broken or they’re broken. It doesn’t mean anyone did something wrong. Different people want different things, and you don’t have to change people. So you must learn to accept others (including yourself) for who they are, not what you want them to be. Then it becomes easier to appreciate the hidden beauty within everyone.

Links to my previous year-in-review blog posts:

• 2024

• 2023

"All models are wrong, some models are useful."

- some autistic statistician, probably

I like to receive advice. Hearing others’ perspectives expands my own thinking, and it's a helpful tool. What's not to love? But after listening to enough advice, you realize that not all advice is created equal. Even "good" advice shared with the best of intentions can send you down the wrong path.

When receiving advice, it's risky to listen blindly. The quality of your filtering mechanism decides the impact that advice has on your life. I would go so far as to say that the act of receiving advice well may be equally as difficult as giving good advice.

Pitfalls with “good” advice

If I were to compress all problems with advice into a phrase, it would be that context matters and incentives matter. Advice is not universally true, and true advice is not universally useful.

Advice is context dependent

What works for others may not work for you. People tend to share what worked for them and what they think is true. Unfortunately that guarantees nothing.

Take for example, the common advice to "just be yourself." It's not universally true and can even be destructive. Self-conscious people might benefit from being themselves, but delusional people will not. The receiver matters.

• Corollary: Advice is vulnerable to the XY problem. If you give advice, are you addressing the core issue or some different-but-related problem?

• Corollary: Smart people can give stupid advice. Don’t assume smart people are infallible. Nobody knows your personal situation as well as you do.

• Corollary: Confidently-given advice warrants skepticism. Confidence is either backed up by evidence or delusion. Unless someone else knows the nuances of your life well, assume the latter.

Advice needs skin in the game

Incentives matter. Consider the following pieces of advice, and notice what's wrong with them:

• "You should buy my online course." (Ulterior motive)

• "Hurry up, get married, and have kids. Time is ticking!" (Projection)

• "Don't stress out, you're perfect. The other person is wrong." (Walking on eggshells)

Why doesn’t everybody give brutally honest advice? Because all advice givers play a meta game of some sort. Exploring why they say something is just as important as hearing what they say.

• Corollary: Follow your own advice. It's easy to tell other people to do stuff. Beware hypocrites.

• Corollary: The only real advice is to think for yourself. You’re the only person with your own best interests in mind. Everything you hear passes through your own internal filtering mechanism. It’s your last line of defense.

The 3 axes of advice

Advice tends to fall along 3 different spectrums:

• How it makes you feel.

• How correct it is.

• How useful it is.

It's worth paying attention to where a piece of advice falls on each of these spectrums. Otherwise, you may improperly weigh advice. It's easy to conflate advice that makes you feel good with advice that's correct, for instance.

Feel-good

Some people just know how to say all the right words. Two different people might tell you the same thing, and only one of them can make it land. But whether something makes you feel good or not doesn't determine its validity.

Contrast these two statements:

1. "You're unhealthy and need to lose weight."

2. "Don't worry, the perfect one is out there waiting for you."

The rude piece of advice may be true, while the one that sounds good is completely meaningless!

Correct

Advice that is "more correct" may be worse than advice that's directionally correct (or even wrong). The receiver may suffer from information overload or misinterpret the advice.

Here are two approaches to weight-loss advice:

1. "Make sure to keep your daily caloric intake slightly below your TDEE."

2. "Stop drinking soda."

I zoned out halfway through reading the first bullet point.

Useful

Arguably, this is the only trait around advice that matters. Whether advice is useful has painfully little to do with whether it sounds good or is true.

For example:

1. "Follow your talent; don't follow your passion."

2. "Just keep going to the gym, and it'll cure your anxiety."

I'm not sure if these statements feel good. I don't even know if they're correct. But they’ve sure been helpful.

Receiving and giving better advice

As a receiver:

1. Focus first on whether the advice is useful. Disregard everything else.

2. Hear what everyone has to say, but don’t necessarily adopt their advice.

As a giver:

1. Prioritize making the advice useful. You do want to help, right?

2. Then prioritize making the advice feel good. It’ll increase the chance that others listen to you. “Tough love” is seldom persuasive.

3. Remember you don’t have to give advice in the first place if it’s not going to be a net positive.

But feel free to ignore everything I said. This is just my advice.

For me, the overarching theme of 2024 was building infrastructure and reducing life volatility. While that sounds a lot like "settling down," I'd argue I'm going for the opposite: you can only do so many things at a time. If the rest of your life isn't in order, how do you expect to hit ambitious goals? The less random stuff you have to worry about in life, the easier it is to focus on what matters.

Anyway, enough yapping. Here are some highlights from 2024:

• I moved to Crystal City.

• I returned to Google after being away for 5 years.

• I started hosting parties for the tech community in Washington DC.

Recap of the year

Coming from last year's review, on the top of my mind was the need to leave the suburbs, make a notable career shift, and maintain the trajectory from the previous year. It's not much, but each of these was a major project.

Here was my thought process: where I live and where I work can be the two most volatile life variables. What if I could move to a place where I'd never want to leave, and what if I could have my work be less hectic than a tech startup? Then those two variables could effectively run on autopilot. I could focus on everything else.

(As per usual, I'm not going to publish many of the spicier details. But you're always welcome to ask me about them in private.)

Moving

Early in the year, I decided it was time to leave...to go to Manhattan. If I were to move to a city, what better place than New York? It didn't sit quite right with me, but I dismissed it as a matter of expanding my comfort zone.

By a stroke of luck, I had a friend with an apartment in Murray Hill that would be vacant for a few months. I took up his offer to stay there. The plan was to do a month-long NYC trial period and begin touring apartments. Less than an hour after arriving in the city, I realized I didn't want to move to NYC. You see, I don't believe in sunk costs. As a DMV-raised kid, I'm a bit of a clean freak. The place is too filthy. Seeing the average resident on the street was depressing: they just look so dead inside. I was having a bad day, yet I was the happiest person in Manhattan. Three days after arriving, I left the city. Longest month of my life.

The biggest learning from the trip was that I needed "boots on the ground" as soon as possible. I learn fast and can make quick decisions once I gather real experiences. The next candidate for where I'd live was Washington DC/Northern Virginia. So I immediately started going on apartment tours. No time for theorizing.

One day I was having dinner with a bunch of friends at Amazon in Crystal City, and we went on a walk after eating. We passed by a building under construction. It has signs saying that it was leasing, and that piqued my interest. The next day, I toured the place, and I realized that I'd found my HQ2.

Over the next couple of months, I'd move to Crystal City. Staying within the DMV was convenient, as I had plenty of friends to help with the move (and even do the interior design of the place). The place is lovely.

Work

Most of the second quarter of the year was dedicated to interviewing around. I figured it was time to leave Stairwell and return to Big Tech. When I had left Google the first time around, I believed that a person was either a startup guy or a big company guy. My belief is now that everybody has a certain number of "startup tokens" in their life that gets consumed for each startup they work at. I had already burned many such tokens, so it was time for a change of pace. And thus began the LeetCode grind.

The job market in tech has evolved in the past few years. From interviewing around, I've noticed many differences:

• Though the job market isn't what it used to be in the late 2010's, it's not that bad for senior folks. I didn't have much trouble gathering interest and landing interviews. However, I've that's not the case for new grads. I feel bad for them, because I'm not sure what I'd do if I were in their shoes.

• The interviewing "meta" has evolved for the better, in my opinion. Companies now openly say they give "LeetCode-styled" interview questions rather than saying some bullshit about coding questions being around fundamentals. The openness actually means interviewers end up asking better questions.

• Nowadays, FAANG companies require candidates to go through team matching before receiving an offer. Back in the day, it was the other way around. I find it pretty reasonable. But that creates the scenario where candidates who passed the technical interviews can be stuck in "team matching limbo" for an indefinite period of time.

• Despite the changes from COVID, remote work is not sticking as much as people expected. And generally, companies are trying to pull workers back to the tech hubs. However, it seems like hybrid has become the default for tech work.

All things considered, I didn't apply to too many places. My criteria was simple: go to a FAANG or FAANG-adjacent tech company that was either remote or had a DC office. It wasn't all sunshine and rainbows: I tend to obsess over problems and fixate on worst-case scenarios. For instance, I temporarily developed a bit of a LeetCode "addiction" that impacted my physical health. And at times, I'd randomly worry about the prospect of having to break my lease.

Though everything panned out perfectly in the end. I returned to Google in their DC office. It was almost 5 years on the dot since I'd originally left. Readjusting to Google was pretty easy. I'm having a great time.

Travel

Travel was relatively light this year. The first half of the year was completely dedicated to moving and interviewing. It's probably better that way: I'm not the biggest fan of traveling, as it breaks a lot of good habits you form from your normal routine.

Besides various trips to NYC and the Bay Area, I took my annual Defcon trip, and I did an Asia trip where I visited China and then went to Thailand for the first time:

• This Defcon, I went as a member of the press. How? I'm a journalist for this blog!

• In China, I went to Beijing, Wuxi, and Shanghai. They all have very different vibes.

• I visited Chiang Mai and Bangkok in Thailand. Like with China, the cities all have different vibes. I also saw live Muay Thai for the first time.

Hobbies and Projects

When it comes to hobbies, this year felt overshadowed by last year. There wasn't anything wrong; 2023 was just such a good year that it was hard to compete with. I started so many new things last year, so this year was mostly continuing what I started. I continued to do improv, albeit less due to other life changes. I got my fourth stripe in BJJ and went on a hiatus due to moving.

Something new that happened was the creation of DC Tech Parties. Washington DC doesn't have the same tech community that SF or NYC have, so I figured there was an opportunity to construct a social center of gravity. So a few DC friends and I began party hosting. As with all new endeavors, you expect it to be a dumpster fire. But instead, we ended up having multiple events with hundreds of people.

On the piano front, I'm building a new repertoire. When I resumed playing last year, I focused on relearning pieces I had previously played. However, I no longer need a teacher; I can self-teach pretty much any song. It's quite liberating: I can teach myself all of the bangers. Earlier in the year, I taught myself Liebestraum No. 3 by Liszt, and after that, I learned Fantaisie-Impromptu by Chopin. Liebestraum is in a good-enough state (video below). While I've learned the entirety of Fantasie-Impromptu, it's not performance-ready quite yet.

What's next?

Well this is embarrassing. I haven't thought that far. The end of the year was filled with one-off social events (including ones that I hosted), so it's pretty easy to get lost in the weeds. It'll be easier to mull things over in January.

I have two initial thoughts that don't offer much closure, unfortunately. First, my life baseline is pretty good, so it's pretty hard to complain. Maybe I should just enjoy the moment. Second, a lot of things require maintenance (BJJ, hosting, etc.) so I can't arbitrarily drop the good things I have in pursuit of shiny new conquests.

This is all a fancy way of saying that I have no clue what I'm doing.

Miscellaneous learnings

• Showing up is literally half the battle. Showing up again is the other half. (This is especially important for me, since almost nothing in life seems to go well on the first try.)

• Respect your social battery. I'm an introvert who can trick people into think I'm extroverted. But if I burn out my social battery, I'll end up paying with my health.

• I'm actually neurotic as fuck whenever I experience cognitive dissonance. I suspect that's the case for most seemingly "emotionless" people.

• Fear of rejection is worse than rejection. I'm pretty good at taking rejection, but I'm bad at putting myself at risk of rejection. Besides, my life is objectively too good to be sad about rejection.

• Rumination is waste of time. You should be focused on the present or the future. Though rumination isn't the same as reflection or introspection. When examining the past, it must be in service of organizing your thoughts or forming a strategy for the future.

• Power dynamics and market forces apply to most things. Changing your environment can flip those dynamics. For example, my thought process while apartment-hunting differed wildly by location. While in Manhattan, I kept asking myself "what can I tolerate?" But in NoVA, I got to be picky: there were too many good options.

• Direct strategies usually beat out indirect ones. Boots on the ground. You learn much faster by trying something out, failing, and iterating. On the other hand, making grand plans tend to be a waste of time, since they usually get flushed down the toilet in lieu of real world data.

• Never drink the Kool-Aid. This isn't a new learning, and I've included it again because I struggle to follow this.

• Investing money into your external appearance is worth it. This not just limited to clothing and can include aspects such as your living situation.

• Improv and party hosting are life changing. I'm happier. It's easier to talk to people. It's easier to make other people happy. It took me a year to realize this, and I'm including it because it's such a big deal.

It's been about a year since I published my laptop setup guide. Since then, I've tweaked a few more settings and provisioned a few more laptops.

Native Settings

Everything here is modified within the System Settings app.

• Change your laptop's hostname to something unique. A templated name like yourname-mbp is bound to have namespace collisions.

• Within the Keyboard section...

  • Customize the modifier keys (Keyboard Shortcuts > Modifier Keys). I remap the caps lock key to escape.

  • Go to Text Replacements... and remove all entries.

• Within the Control Center, set Automatically hide and show the menu bar to Never.

• Within the Lock Screen section, set Require password after sceen saver begins or display is turned off to Immediately. This locks the laptop immediately if the lid closes.

• Within the Appearance section...

  • Set Show scroll bars to Always .

  • Set Click on the scroll bar to to Jump to the spot that's clicked.

• Within the Desktop & Dock settings, set windows to minimize using the scale effect.

• Customize the hot corners. Remove the quick note from the bottom right, and add the notification center to the top right. That way, if you're not using a trackpad, you can still easily pull up notifications.

Finder

There are a bunch of finder settings. I loosely follow the steps outlined in this video. Just give it a watch and follow along.

For reference, this is what my finder window looks like after it's been set up. You can compare to mine as reference.

Apps

Most of the apps in the previous blog post have stayed the same. However, I have added some extras. I personally pay for all of them, but they have free versions that work great too.

• Dropzone 4 to have a place on the menu bar to send items or do quick actions.

• Coconut Battery to monitor battery health.

• AlDente to regulate battery charge.

• UnnaturalScrollWheels to have proper trackpad and mouse scrolling at the same time.

• Bartender 5 to organize the menu bar.

And that's it. You now have a perfectly functional MacBook!

The title's a mouthful. Let me explain:

1. I want remote access to a Python kernel with GPU acceleration.

2. Renting GPU compute is expensive. (I'm just casually tinkering around.)

3. I have a physical GPU at home, BUT it's on a Windows desktop.

So the question is how do I expose a GPU-powered Jupyter Notebook to a remote machine?

• The notebook must have GPU acceleration available.

• The notebook must be remotely accessible.

• My desktop must not get pwned.

• Ideally the Windows host experiences minimal changes or side effects.

After some tinkering, I ended up with an arrangement that checks all the boxes. The Windows machine hosts a Linux environment via WSL. The Linux environment installs Tailscale, so my other machines can reach it. Then the Linux environment acts as a normal notebook server.

Here's how I set it up.

Choosing the Host (WSL)

We start with a standard Windows host machine. On Windows, we also have the option to use WSL or a virtual machine.

• Virtual machines do not support GPU passthrough (while the host is also using the GPU). This is a non-starter.

• Windows is a yucky operating system. Let's prefer to avoid it.

• Dual booting Linux is a possibility, but the Windows host would not be able to operate at the same time.

• WSL supports GPU passthrough, but the networking aspect is complicated. However, all of this is solved by Tailscale. This is the preferred route.

Installing Ubuntu (or any other distro) for WSL is pretty straightforward. Once you're on your Linux "machine," you can verify that it does indeed have GPU access.

❯ uname -r
5.15.146.1-microsoft-standard-WSL2
❯ nvidia-smi -L
GPU 0: NVIDIA GeForce GTX 1070

Installing Tailscale

For those unfamiliar with Tailscale, the simplest way I can describe is as a VPN that just works. You can reach any machine in the network, even if it's behind a NAT. That way, you don't arbitrarily expose your machine to the public Internet.

Installing Tailscale in WSL comes with a few caveats though. WSL does not come with Systemd enabled, so many services will not work. Tailscale requires a daemon, for example. (We'll also want other services, such as SSH.) Fortunately, enabling Systemd is as simple as modifying a config file. In /etc/wsl.conf, set the configuration as such:

❯ sudo cat /etc/wsl.conf
[boot]
systemd=true

Now you can install Tailscale. You'll also want to install additional dependencies:

• SSH for remote access (and port forwarding) to the machine

• Tmux to keep the WSL instance and Jupyter server running in the background

# Install SSH server and tmux.
sudo apt install openssh-server tmux

# Enable SSH.
sudo systemctl enable ssh
sudo system status ssh

# Install Tailscale and join the tailnet.
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

You'll want to configure SSH and Tailscale as necessary. After all of this, don't forget to reboot the WSL instance.

Starting a Jupyter Server

With all the dependencies set up, you can set up Jupyter Lab in your WSL instance. It's a matter of installing a single PyPI package:

pip install jupyterlab

Python should come out of the box in the Ubuntu WSL distribution. You may want to install other packages, but that can be done later within the notebook itself.

You can now start a Jupyter server. Most flags aren't critical despite the documentation, but you will need to make sure the server is protected by a token, or else Colab won't be able to connect to it. Additionally, you'll need to set the IP address the server listens on. By default it'll listen on localhost, which prevents remote access.

• If you have the server listen on 0.0.0.0, it will accept connections from any origin. Usually this is bad security practice, but since the WSL instance is not publicly accessible, it's the end of the world.

• Alternatively, you can set it to $(tailscale ip -4). That forces the incoming connection to come from within the tailnet. The downside to this approach is that you'll have to run port forwarding for Colab even if you're on the Windows host OS. (This is described in more detail later.)

With all the nuances out of the way, here's the command you can copy and paste. Be sure to run it within a tmux session.

# A few notes:
#
# 1) Do this within a tmux session. You can detach from it later.
# 2) You can alternatively hardcode "0.0.0.0" for the --ip flag.
# 3) You can unset --IdentityProvider.token, but don't leave it blank.
#
jupyter lab \
  --no-browser \
  --ip="$(tailscale ip -4)" \
  --IdentityProvider.token="image_some_custom_password_here"

Once the server is active, you can detach from the tmux session. Be sure to keep the session alive, so the notebook server (and Tailscale connection) do not disappear.

Connecting to Jupyter Lab

Now we switch gears and move to another computer. Before doing so, take a note of the tailnet IP (tailscale ip -4) or hostname of the WSL instance.

From any remote machine, as long as its part of the tailnet, it can simply access Jupyter Lab. Just visit http://wsl-tailscale-hostname-or-ip:8888/lab. Pretty simple!

Connecting to Colab

Warning: Don't do this for any arbitrary Colab notebook running untrusted code. Remember that you're giving it remote code execution privileges on your machine.

Using the Jupyter server as a Colab backend is a bit more involved. Colab only supports localhost as a local runtime host for some reason. So we'll have to port forward. (That's why SSH was a requirement when setting up WSL. Also, if you're on the Windows host, you can skip this step if the server is listening on 0.0.0.0.) In a terminal on your remote machine, forward the port for the notebook server:

ssh wsl-tailscale-hostname-or-ip -L 8888:localhost:8888

Within a Colab notebook, select the option to Connect to a local runtime and then put the local URL with the forwarded port. You'll also need the auth token from earlier.

If the connection is successful, you should be able to interact with the kernel from your Jupyter server. Now's a good time to install any additional PyPI packages that you'd want, since a fresh WSL environment will not have much by default. Otherwise, it's identical to hosted runtimes, except you can keep the kernel alive indefinitely.

That's it! You're done! You can now use your own GPU on Colab from any remote machine.

2023 was the best year I've had in a while. It's not even comparable when looking at the amount of objective change I've gone through. Over the span of 12 months, here are some notable life changes:

• I began improv/standup comedy and performed on stage multiple times.

• I took up Brazilian Jiu-Jitsu and can fight without panicking.

• I resumed playing the piano after a decade long hiatus.

• I began hosting local mixer parties.

• I visited China for the first time in 20 years.

• I snowboarded my first black trail.

Most of the credit goes to the fact that I was intentionally leaving my comfort zone. If you stay in your comfort zone, you won't grow. It's not what you want in the long term. Therefore, you must always seek to remain right outside the cusp of your comfort zone at all times. It's like progressive overload applied outside of the weight room. It doesn't have to be much, nor does it have to be done in a specific way. Just don't live life on autopilot.

Recap of the year

Late in 2022, I resolved to stop being a tech bro maximalist. I'm a good software engineer. My career was never a problem. It's not my failure mode. But looking ahead, I'd still be living a pretty shit life.

After leaving the Bay Area, it's easy to see that people who are a bit too into tech can be a bit...boring. I didn't want to be like that. If work is your personality, that's no fun. Why not try to be more interesting?

So that was the theme of 2023. Reject tech bro maximalism. Keep yourself outside of your comfort zone however possible. Optimize for being a more interesting person.

(Since this is a public blog post, a lot of the spicier details and events are omitted. They're pretty important. While I'd like to say I'm an open book, but I'm not going arbitrarily broadcast everything into the public. So if you'd like to hear more, hit me up in private.)

BJJ

In 2022, I fell down a bit of a UFC rabbit hole. It's a fascinating question: what's the "meta" of human unarmed combat? Turns out it's a combination of striking and grappling (which makes up modern MMA). Not all martial arts are created equal.

So I started Muay Thai in late 2022 to explore the fighting rabbit hole. Since I didn't want brain damage, I quit Muay Thai and started Brazilian Jiu-Jitsu in early 2023. Muay Thai is a form of striking, while BJJ is a form of grappling. Instead of getting punched in the face, I can get choked out instead.

I really enjoy BJJ. It's something I've kept up throughout the year and up to the present. It really does change you. I recall going to the gym at 7 am and being pinned to the ground for minutes on end. It gets hard to breathe. You feel like you're literally being squashed. At the end of class, your ears are ringing and you feel like throwing up. And the next day, you rinse and repeat.

But the change has been priceless. There's a level of peace that you earn. You know your day literally can't get worse. You know that in case shit really goes down, you can remain calm.

Comedy

Back in 2018, when I was at Google, there was a program where you could have 1:1 time with a random director for career advice. The chat wasn't useful. But I remember the director mentioning if I should try out an improv class, which caused me to get a mini panic attack from the very thought of trying such a class.

Five years later, I take my first improv class. It really isn't that bad. In fact, it's the most fun I've had as adult in a good while. Rarely do we get the opportunity to just play around. I recommend every adult try out an improv class at least once. It's not like you're performing or acting. A beginner class has you playing some simple games in private. It's a ton of fun.

I'm the type of person to overthink. I'm quite introspective and tend to be in my head too much. Improv actively punishes that behavior. You have to be living in the moment. Thinking and doing nothing is worse than doing something stupid. It's carried over into my life as a whole. Take conversations, for example. Not everything you say has to be insightful. It's better to keep the flow going.

Improv went so well that I decided to continue that journey and tried doing standup comedy. Standup and improv are pretty different, even though they're cut from the same cloth. When doing standup comedy, you have to write a lot. You need to rehearse your performance. For improv, the less you prepare, the better.

After writing a few bits and bombing a few open mics, I ended up doing a few performances as well. Here are a few neat observations about standup comedy:

• It's one of the most honest forms of communication: you can't really hide laughter, nor can you fake laughter. So it's clear if you're funny or not.

• Comedy writing has a clear purpose: control the audience's emotion. It's not like some work presentation where you're supposed to convey useful information. If anything, the audience losing brain cells is a sign of success.

• Even though you're supposed to be "funny," that does not mean you don't take the craft seriously. Open mics are for A/B testing your jokes. You need to kill your ego and notice if your material sucks. I've seen plenty of delusional comedians who think they're funny and don't improve.

Throughout the year, I did more improv and standup classes. At my core, I'm an introvert. But I've become pretty damn good at pretending to be extroverted.

(If you want to see videos of me performing, hit me up.)

Snowboarding

This season, I began snowboarding. The previous season, I tried skiing, but it wasn't for me. I didn't grow up as an athletic kid, so the self-preservation instinct made skiing difficult. I was too afraid of falling to learn.

Instead, I decided to give snowboarding a shot. Why? Because there was a higher learning curve. The first few days of snowboarding suck, but once it "clicks," it becomes a lot better. If you can do a green trail, you can survive a black trail. Whereas with skiing, moving up in skill will be a constant battle.

My plan was to bite the bullet and grind out the early learning stages of snowboarding. It was an investment of sorts: I have a few bad days at the beginning, and then I'll be fine afterward. It paid off. For my first few days at the slopes, my focus was on improving rather than having fun. Once I was able to do S-turns, then I really began to enjoy snowboarding. There's something to be said about sacrificing fun for intentional improvement: in the long term, you maximize your fun.

Piano

You've probably heard the stereotypes: the immigrant parents make their kid learn piano. The kid grinds outs the piano for 12 or so years throughout his childhood. He gets pretty good, but he grows to hate the piano. Once college comes, he quits and doesn't touch the instrument ever again.

That was me about a decade ago. I've always felt it to be a shame that I threw away such a talent. Learning the piano ate up a bunch of time and money. Halfway through 2023, I bought a keyboard and started practicing independently. It's pretty nice; I haven't forgotten all that much. But this time it's on my terms: I'm playing for my own enjoyment.

Other hobbies

So far I've only described the hits when it comes to trying out new hobbies. Early 2023 was definitely more of an exploration phase where I tried out multiple things. Not everything stuck. For example, I tried other things like woodworking, volunteering, and I got my concealed carry license. None of those were super interesting, so I wasn't consistent with them. It seems like my "trinity" of hobbies are BJJ, comedy, and piano. And maybe snowboarding during the winter. This may change in the future, but they've stuck for the time being.

It seems that I've done a good strategy for figuring out what I like: try out everything, do more of what sticks. People tend to have natural affinities towards different activities. A good test seems to be to ask what you'd enjoy doing alone. Some activities you'd do if a friend does. For other activities, you're the one dragging your friends. And once they quit, you're still happy doing it by yourself.

Hosting cocktail parties

The first ~2 years after Covid were a waste. I left the Bay Area and returned to the DMV, and most of my time was spent journaling. Otherwise I have very little to show for it. It feels bad grappling with the fact that you've thrown away years of your life.

I had since moved to my own place, so it was time to touch grass and bring people together. By pure coincidence I stumbled upon a book about hosting cocktail parties while listening to a podcast. I agreed many of the book's theses, so I started to implement them.

Throughout the year, I hosted multiple mixer-styled cocktail parties. You know how you have multiple friend groups that don't know each other? They're all invited to the same event. Throw in some name tags, icebreakers, and alcohol, and you've got yourself a party.

A few pro tips when it comes to hosting parties:

• Yes, you SHOULD intermingle your various friend groups. Being a connector is good for the world.

• People are both nice and lonely. Usually they appreciate that you think of them, and they're happy to support you. Stop thinking otherwise.

• No offense, but most people are lazy bums. So you have to be the change you wish to see in the world. Waiting doesn't work.

• Before a party, make sure the food, drinks, and seating are all uniformly distributed across the room. People tend to gravitate towards the food or seats, so you don't want people to crowd towards (or avoid) any singular area.

• When hosting parties, only a few things really matter (e.g. marketing and name tags). Otherwise, let the people self organize and have fun. They're adults, and you should treat them as such.

As a self-proclaimed shy introvert, I've become surprisingly good at making new friends and talking to random people. Most things in life are learnable skills, and hosting lots of events is starting to make people think that I'm a social butterfly.

Travel

I don't get the romanticization of travel. Personally, I'm a bit of a homebody. The biggest value I get from traveling is the reminder that the world moves on, regardless of whether or not you keep up. Throughout 2023, I left my home base a total of 5 times:

1. Early in the year, I took a vacation to Amsterdam and London. That was cool, I guess.

2. Shortly afterward, I visited the Bay Area for work (and snowboarding).

3. A few months later, there was a work offsite in Vegas. I normally go to Vegas annually for DEF CON, so it wasn't that novel.

4. Pretty much right after that offsite, I returned to Vegas for DEF CON 31. I'm in Las Vegas way too much...

5. Towards the end of the year, I took a trip to China. That was the interesting one. It was the first time I'd been to the country in 20 years.

It might be a stretch to say that the China trip was life changing, but it really did give me an appreciation of the culture. Two decades ago, it was a third world country. Over the years, it's modernized. The cities are arguably nicer than America's major cities.

Chinese and American culture are wildly different from each other. I don't think most Americans understand how the Chinese think (and vice versa). American was created because the people value freedom and independence: that makes them good at innovation. China was built up from centuries of war: the people will happily conform to a powerful government in return for the promise of prosperity. That makes China good at copying what works and scaling it up.

Their "app ecosystem" is a pretty neat case study: the WeChat and Alipay duopoly shows how a single app can do everything for you. It's pretty convenient. I suspect Instagram, Twitter, or Apple should race to become the WeChat of America. All of them need to get their peer-to-peer payments story down first. That makes the app practically useful. And Threads should have been a tab in the Instagram app. Since it's its own app, nobody's using it anymore.

Work

Ah yes, work. While life was happening, Stairwell was going through its own adventures.

I'm going to be vague with this. We lost some good people. We lost some bad people. We also gained some good people. It was a turbulent year. And now the company is in its best shape since I joined.

Now's actually a really good time to join. If you're interested in working at a security startup (and you're competent), hit me up.

What's next?

If you received a holiday card from me, you'd know that this blog post was written pretty late. As of the time of writing (late-ish January), I just got back from travel, so I haven't had time to think too deeply about what I hope to accomplish in 2024.

They're not well-fleshed out, but here are a few thoughts:

• Everything that I began in 2023, I should continue into 2024. It shouldn't be a one-and-done deal. Keep up the trajectory.

• Ever since I started sparring in BJJ, I've been neglecting the weight room. I currently weigh 140 pounds. Back in SF I was sustainably in the 160's and was an absolute unit. I need to recover my strength and muscle.

• Stairwell's in a state where success is guaranteed, now I can think about growing instead of putting out fires. My career role model is Kelsey Hightower; emulating his journey would be amazing.

• I may be moving to a city next year. There's only so much you can do in the Maryland suburbs. I feel like I've pulled most of the levers that I can.

To be honest, I'm a bit worried that it's all downhill from here. What can I accomplish in 2024 that would make it an equal or better year than 2023? I do feel some pressure in this regard, and I don't have a game plan for that.

On that note, let's wrap up this blog post with random wisdom that I gathered throughout the year.

Miscellaneous learnings

These are in no particular order. Some of these might be repeated.

On the self

• You must intentionally leave your comfort zone or else you won't grow. At all times, you should be living right outside the cusp of your comfort zone.

• Most worthwhile results come in the long term, but honestly you can see pretty cool results over the span of a year.

• Your ego tends to be the biggest blocker to happiness. Get rejected a lot: you'll realize it's not a big deal. Get your ass kicked: it'll end your physical insecurities. Humiliate yourself on stage: you'll learn how big your balls truly are.

• Don't be afraid to delegate. You can only do so much as an individual. If I want to keep moving forward, I'll need some help. Most of my friends are supportive: I should take them up on their offers to help.

• Without sounding like too much of a douchebag, I move past the change curve really fast. It might be because I'm intentional about being outside my comfort zone. But I can work past things in a month or two, when it would take other people years.

On socializing

• The point of human conversation is to give the other person good vibes. It is not to conduct high-bandwidth information transfer.

• You don't need to understand everything to make use of it. Not everything needs a rigorous definition. For example, I don't know what exactly "good vibes" or being funny entails. Yet I'll know it when I see it.

• The best way to get your message across is to be funny and tell stories. Humans struggle to pay attention, let alone retain information.

• Overthinking is the best way to ruin a conversation. Just say what's on your mind. Don't be afraid to attempt to joke around or sound stupid. Usually, these are of low consequence and high upside.

• Being a connector is both the easiest and the best way to create social value. Humans are lonely and love it that you're thinking of them. Bringing people together will generate a lot of happiness in the world.

• When meeting new people, be sure to exchange contact information before parting ways. (Both phone number AND Instagram.) You may regret not doing so.

• If people aren't interested in talking, respect them. Don't try to win them over. Read the room. Move on.

• Don't procrastinate on organizing social events. When things depend on other people, time is of the essence. Don't be the blocker, and give people ample buffer time.

On human nature

• Random people tend to like it when you talk to them. So talk to as many people as possible. Just find some random excuse to talk. Or don't. Either works. Again, humans are lonely and actually would love to make a new friend.

• Friendships are formed by frequent, casual, ad hoc interactions. So scheduling a monthly calendar event to catch up isn't effective. It kills the vibe. Not everybody may be in the mood to talk. It's better to randomly call or text. Or randomly invite them to events like dinner on the same day.

• Women tend to have a higher baseline of social awareness than men. So the issue with most men is that they might be too dense (i.e. insufficient social awareness). On the other hand, the failure mode for women is that they become "divas" (i.e. they're way too particular about their social sensitivities).

On conflict

• Do not shy away from conflict, especially if you're intimidated. Not everything is black and white, but some things are. There are some people who are too stupid to see nuance. Don't entertain such stupidity.

• Learning how to fight gives you outsized benefits to your confidence and calmness. Your body language even changes. It makes all the difference knowing that you have a backup plan if all hell breaks loose.

My whole system of life is keeping at it. The task of life is not to see clearly in the distance but to do the task at hand.

- Charlie Munger

The Problem

Let's talk about planning and prioritization.

• People who trust big, fancy Gantt charts are destined to be disappointed. Why? Because anything beyond the short-term is too volatile for rigid planning to be useful.

• If you're unwilling or unable to quickly change the plans as needed, that means you're not adaptable. Eventually, you'll end up working on the wrong thing. Arguably, that's worse than doing nothing!

• An inability to account for (and adapt to) real-life volatility is a sign of bad planning. A plan that assumes a perfect world is a bad plan.

The Solution

Well, that's just fantastic. Should we scrap all our plans and yolo it? Not quite. Enter the "distributed Pez dispenser" model of planning. It's basically gradient descent:

1. Gather everything you may want to work on in the foreseeable future.

2. Put it in a fuzzy priority queue. This is our "distributed Pez dispenser."

3. Pop from the top of this Pez dispenser. The "next" item to work should be clear. It's the most important thing at the given moment. So focus on that. Do it well.

4. Add to, consume from, or rebuild the Pez dispenser as circumstances shift.

Properties of the Pez Dispenser

The rest of the contents of the Pez dispenser should be a "gray box." That means you don't really know its exact contents, but you should have a rough idea. A "rough idea" means you have two things:

• A north star of what must be done.

• A general sense of what may change.

You don't need to over-index on anything beyond what's next, because it's subject to change. Actually, it's unlikely that it won't change, given the volatility of real life. Notice how this model accounts for such volatility while allowing us to make incremental progress. The next step should always be clear, and you should never be married to anything after that.

This concept applies to life in general as well. Plans change, but that doesn't mean you don't make plans. Rather, avoid rigid plans. Have adjustable plans, and execute the current step well. Then rinse and repeat.

In June 2023, Apple released the 15-inch version of the MacBook Air. I was due for a laptop upgrade, and it was the perfect form factor. It's surprising that they never had a "non-pro" laptop with a large screen size.

I was inspired by Swyx's ritual of documenting his Mac setup, so I decided to do the same. This is how I set up a fresh MacBook.

Native Settings

Upon creating an account on a new Apple laptop, you'll want to log in to your Apple account. Afterward, you'll have free rein over your machine.

• Go to System Settings, set the trackpad sensitivity to its maximum value, and make trackpad taps register as clicks. I'm so used to this workflow nowadays that anything else feels so slow and will drive me insane.

• Go to the control center settings to configure the menu bar. You'll want to show sound levels and battery percentage: both are super useful. On the other hand, hide the spotlight icon.

• For the "Internet Accounts," I use Google for all my contacts. Sign in with Google and then sync only contacts.

• Hide the Dock and remove any hide delay. You can make the Dock automatically hide in System Settings, but you'll need to use the command line to remove the Dock's hide delay. The command to do so is below:

defaults write com.apple.dock autohide-time-modifier -int 0; killall Dock

Tier 1 Downloads

Configuring the native laptop settings allows you to operate the laptop without going insane. So far we haven't downloaded anything yet. The next items we download are "prerequisites" for doing almost anything, so we set them up first.

• Download Google Chrome and sign in with your Google Account. I have Chrome sync everything, so most of the legwork is done automatically.

• Download and sign in to 1Password. It's necessary to authenticate with almost every single account I use. (I only memorize the credentials necessary to bootstrap my way to accessing 1Password.)

• Enable the SSH agent in 1Password. That allows you to use SSH keys stored in the password manager. Do not generate a new SSH key on the local machine.

• Download iTerm2. The Native terminal sucks. This allows us to peacefully operate on the command line. I know there are other modern terminals, but this one works well for me.

Command Line

My Developer Setup (with Vim, Tmux, and Zsh)

The details around my command line setup.

Fortunately, I've automated the vast majority of my command line setup in a git repository. As a result, I won't talk too much about the details. But you can read the blog post if you're interested. (It's a bit outdated though.)

All you need to do is run a one-line command:

curl https://raw.githubusercontent.com/MrPickles/dotfiles/refs/heads/master/scripts/dotfiles.sh | bash

The dotfiles setup script will not set up Homebrew, since that requires a new terminal session. You will need to do that manually.

With Homebrew installed, you'll want to install several other packages. I have them in a script, but they're subject to change. Afterward, open up Neovim, and it will install a few other packages (like fzf) automatically.

Finally, import the existing iTerm settings. It'll set up the font and colors. You'll still need to install the recommended font for Powerlevel10k.

Tier 2 Downloads

The next few downloads are pretty core to operating my machine. They're not mandatory, which is why I don't install them immediately.

• Alfred: You'll want to disable Spotlight indexing and remove the default Spotlight shortcut. Then you can let Alfred use that shortcut.

• BetterTouchTool: Even if you don't have custom keyboard shortcuts, the drag-to-window-snap functionality is great on its own.

• Cleanshot X: Make sure it replaces any existing screenshot shortcuts. It's better than the native screenshot tool.

• Tailscale: Once you connect your new machine to the Tailnet, it allows you to be part of a network with your other machines without the hassle of setting up a VPN.

Tier 3 Downloads

The remaining downloads don't inhibit the normal operation of the machine itself. I do consider these the minimal set of programs that I use on a consistent basis, so I install them all immediately after wrapping up my tier 2 downloads.

They're listed in alphabetical order:

• AdGuard: This blocks ads that uBlock Origin misses.

• Cron: Notion's calendar app.

• Discord: For chatting with gaming communities.

• Dropbox: Syncs my files.

• KeepingYouAwake: Keeps the laptop awake.

• Keybase: For basic crypto operations.

• Obsidian: All my notes are here.

• Signal: My preferred chat app.

• Slack: For work-related communications.

• Spark: An email client. Be sure to get Spark 2. Spark 3 sucks.

• Spotify: For listening to music.

• Streaks: My habit tracker.

• Todoist: My to-do list.

• WhatsApp: For chatting with Android users and people living in third-world countries (same thing).

• WeChat: For chatting with Chinese relatives.

Wrapping Up

• Be sure to log in to various accounts as necessary. This includes both websites on the browser and the recently downloaded apps.

• Register any license keys as necessary. Most apps have a trial period, so there's plenty of time to do this. I store all of my license keys in 1Password.

• Clean up the apps on the Dock, if you haven't already.

• Be sure to revoke any old machine credentials as necessary. For example, you might want to remove old machines from Tailscale and Keybase.

Cool! You're done. Enjoy the new laptop. 🙃

Ski season is coming up. Unless you prepare beforehand, you won't be in a state where you can actually do any skiing or snowboarding. Here are my recommendations for people getting started.

Required Gear

Skiing is expensive. You'll need a fair amount of equipment. Fortunately, a lot of this consists of fixed costs. So grab out your credit card and pull up Amazon. Most of the gear can be found pretty easily with a "<item name> snowboarding" query on Amazon. You don't need to be creative; usually, the first result works great.

You probably already have these

• Winter jacket: Just a generic winter jacket.

• Gloves or mittens: Make these that these are waterproof. The cloth-based gloves aren't waterproof, nor will they do an effective job of keeping your hands warm.

Buy these

• Thermals or long johns: These don't have to be skin-tight. Your goal is to wear more layers in order to provide additional insulation.

• Long winter socks: These should go up to the calves (at least) and should be higher than your ski shoes/snowboarding boots.

• Snow pants: These will be pretty stretchy since you'll be fitting them over your ski shoes/snowboarding boots. So don't be surprised if they feel a bit large at first.

• Ski goggles: This one's self-explanatory. They should be large enough to fit over glasses, but I still recommend my myopic friends wear contact lenses.

• Helmet: The proper helmets will have a strap in the back to attach your goggles. For the best protection, I recommend getting a helmet that's MIPS certified. They will be a lot more expensive than normal helmets, but I guess you decide how much your brain cells are worth. (Though if you're only going to be on the bunny slopes, it may not be a big deal.)

• Gaiter or balaclava: Also known as a "ski mask," these are key for blocking your face from wind and debris. Plus it insulates your head. You may also want one of these if you plan to rob a bank.

• [Snowboarding only] Butt pads: When snowboarding, expect to fall on your ass a lot. So I recommend getting some armor to prevent you from hurting your butt. (Unless you're into that kind of stuff.)

• [Snowboarding only] Knee pads: In a similar vein, expect to fall forward as well. Your knees will take repeated punishment, so having some armor there is a game-changer.

• [Snowboarding only] Wrist guards: Also when falling forward, humans will reflexively put their hands out to "break" the fall. This is the worst thing you can do. If you fall forward, hug yourself and try to land on your forearms. You want to distribute the force over your body. Otherwise, that's how you break your wrists. But in such a case, wrist guards may save you a lot of misery. (Note that I personally don't use wrist guards. They tend not to fit well with gloves.)

Rent these

The renting portion is relatively self-explanatory. If going on a day trip, rent the actual equipment:

• Skis, poles, and ski shoes

• Snowboard and snowboarding boots

Expect to pay $50-100 to rent the gear for a day. Some resorts may provide a helmet as part of the rental bundle. I'd advise against buying the main equipment for the first few seasons, as you haven't formed a preference for what specific types of skis/snowboards you like.

If you forget to buy some of the recommended items, the resort will likely have them for sale or rent. But be aware that the prices will be marked up a lot. So save your money and do a better job of preparing.

In general, depending on how many days you plan to go to the resort, it may make sense to rent at a local shop, rather than renting from the resort. Pricing will be better, but there will also be an expectation of a longer-term rental. You'll have to do the math yourself for those situations. For day trips, don't waste your time; just rent from the resort.

Other Considerations

Resort logistics

• Ski resorts local to the DMV area include Liberty and Whitetail. These can be around an hour's drive and easily fit into a day trip.

• Expect to pay around $200 per day. That's around $100 for a day pass and $100 for rental equipment. You may incur other expenses throughout the day, such as paying for food and lessons.

• If you end up going for multiple days in a season, it's far more economical to buy a season pass. The last time I did the math, the break-even point was around 10 trips or so.

• I recommend setting up all of these logistics as early as possible since walk-in passes/rentals aren't guaranteed (and prices go up over time).

Skiing vs snowboarding

Do you go skiing or snowboarding? They all have their pros and cons. Though if you've done neither and only plan to spend one day, I recommend you go skiing.

Before skiing or snowboarding, consider watching some tutorial videos (skiing, snowboarding) so you aren't taken completely by surprise. You can also take lessons, I've found that trial-and-error after watching tutorials tends to be more effective.

EDIT: I found a better tutorial for skiing. Watch this one instead.

Additional supplies

• Bringing your own food is optional since there are cafes at the resort. Though it's not a bad idea to have snacks and water in the car.

• Consider bringing sunscreen. Though it's not the end of the world if you're covered up.

• Ski helmets will have ear flaps to insulate your ears, so it's possible to safely wear Airpods and listen to music while going down the slopes. But if you're reading this blog post, maybe you should focus on staying alive instead.

Last week at Defcon 30, some friends and I attempted the Recon Village CTF. While spending most of Friday grinding out a CTF in a hotel room wasn't my original plan, it turned out to be a lot of fun.

After a rather late night, we ended up solving most of the challenges and got first place in the competition. This is the write-up for the CTF's challenges.

CTF Challenges

💡 Some of these OSINT challenges involve real people. As a result, parts of this write-up will be censored to protect their privacy. This blog post is for educational purposes only, and we do not endorse the usage of these tactics to research private individuals. Please don't dox people or otherwise be a creep.

Jerlean's 54th Birthday

Jerlean was in Vegas for their 54th birthday recently. Which hotel did they stay at?

Our natural instinct was to start Googling for someone named Jerlean, but Google didn't return anything relevant. We then tried to find Jerlean on Facebook, but that didn't bear fruit either. Turns out Instagram was the key.

By querying "vegas birthday" on Instagram and scrolling down, you'll eventually bump into the following picture:

It's an ad with no textual references to Jerlean, but you can glean all of the data from the photo. If you notice the post's location, you'll see that this was posted in New York-New York.

Spammy Email Domain

On 11 August, what was the primary email domain from which spam was reported as coming from 185.129.62.62 and 107.189.28.253 (two bot IPs)?

To figure out the domains associated with the IP addresses, we looked up the addresses in a forum spam database. The first IP address had a fair bit of activity on August 11.

If you look at the emails sent on that date, you'll notice that the most common domain seems to be hiroyuki4010.yoshito33.inwebmail.fun.

Wedding in Costa Rica

Wanting to remain anonymous online, discreetly named 'Phonenumber' from Costa Rica has a friend who works for Facebook. When did his friend get married?

Since we were searching for a person and his friends, we turned to Facebook. By querying for people named Phonenumber, you'll find an account that's based in Costa Rica.

Next, we look through this person's friends list to see if there are any friends who work at Facebook. There happen to be two people. One of them isn't in a relationship, but the other person is married. If you check out this person's "about" page, you'll see the date when he got married.

Missing Person Report

You're investigating a missing person who went missing following a party in 2019. While working through case notes you've come across the following NTIyMyBTb3V0aCBCcmFlc3dvb2QgQm91bGV2YXJkLCBIb3VzdG9u What date was the pool party?

The payload NTIyMyBTb3V0aCBCcmFlc3dvb2QgQm91bGV2YXJkLCBIb3VzdG9u attached to the CTF question is base64 encoded. If you decode it, you end up with an address in Houston, Texas. Googling the address combined with "party" and "2019" will yield a single search result in the form of a Pastebin: https://pastebin.com/BNwRBAX4

The paste contains an email detailing plans for a pool party that will happen "this Saturday." The email was sent on April 18, 2019, so you can infer that the pool party itself was held on April 20, 2019.

Party Co-host

This is a follow-up to the previous question.

There are two hosts of the party, one is Vanessa. What is the last name of the other host?

If you re-read the email from the Pastebin, you'll notice a few bits of information:

1. The party was held in Houston, Texas.

2. The email addresses and names of the recipients are public.

3. The hosts are named Vanessa and Meghana.

Searching for the hosts directly on Facebook doesn't yield too many results. However, by looking up some of the email recipients (especially those with uncommon names), you'll eventually find people based in Texas. Looking through their friends list will allow you to find Vanessa. Looking through Vanessa's friends list will allow you to find Meghana.

As a reminder, these are real people. Please respect their privacy.

Maiden Name

Callum lives in Scarborough, Toronto and works with kids. What's his wife's maiden name?

Googling up Callum with his location and profession will lead to his LinkedIn page and reveal his last name. Looking up his full name and location on Facebook will lead to his Facebook page, which also contains the profile of his wife.

However, his wife changed her last name, and her maiden name isn't in her profile. But those who are observant will notice that the Facebook URL does not update unless manually changed. Callum's wife's URL contains her maiden name.

Password Breach

This is a follow-up to the previous question.

Callum's password has been breached in connection with his primary email. What is it?

Despite finding Callum's social media profiles, we weren't able to find his email address. As a result, we enumerated potential emails. (Using Gmail to autocomplete was helpful in filtering out potential and valid emails.) It turns out that his email used the common firstname.lastname@gmail.com format.

Then, Googling the email address along with terms like "password" led to a Pastebin that contained a password dump for emails. Callum's password was included in the paste: https://pastebin.com/1LeMmy4X

Open Source

The next few challenges are all based on CryptoRama, a fictional company.

Hi, I'm Eva Hesington. Remember me from last year? I am the founder of CryptoRama. Thanks to your support we have been able to scale the business a lot. I cannot thank the open source community enough. Using Open source tools and platforms, our business has grown and our tech department is now running strong. We could not have done it without these Open Source tools and community. You can visit our website to find out more.

This one had us stumped for a while, as Cryptorama was an actual company. We went down a few rabbit holes to no avail before querying Cryptorama with Eva Hesington's name included. That led to a single search result to a different Cryptorama: https://cryptorama.cloud/

If you checked the source of the website, you'd find the flag. It's embedded in a comment within main.min.js.

Secret Sharing

We at CryptoRama are very concerned about sharing sensitive information with the outside world and even on the inside. We use secret sharing services. But looks like someone has been manipulating our secrets application and hindering our progress. Can you please check?

The challenge mentions a secret sharing service but does not share any more details. So we need to find what service it's referring to. By looking at the certificate transparency logs for the CryptoRama website, we that there are a few valid subdomains. One of them is https://secrets.cryptorama.cloud/.

When examining the website, we see that it's running SnapPass, a secret-sharing app maintained by Pinterest. Users can write a secret to the app, and the app will generate a URL to view the secret. After the secret is viewed once, it will disappear forever.

There don't seem to be any CVEs associated with SnapPass, so perhaps the site is running a patched version with broken crypto. When looking among the forks of the repo, we see that there's a fork that's created by CryptoRama. And it also has a patch that changes the URL generation. Here's a summary of the patch:

1. The encryption key is now the base64 encoded version of a hardcoded secret 6ardCD6XQ49FLrxY6fd7pB3DeeNmzn8Y. With the base64 encoding, the string will be NmFyZENENlhRNDlGTHJ4WTZmZDdwQjNEZWVObXpuOFk=.

2. The secret URL has a prefix of RV (from the Redis prefix).

3. The secret URL additionally takes in the current timestamp.

Overall, the format of the secret URL looks like this:

Although we have an algorithm to generate the secret URLs, it still takes two parameters: a UUID and the timestamp. For both, it's unfeasible to guess or brute force. Therefore, we need another way to make use of the URLs. Our next step is to find a source for the UUIDs and timestamps.

Looking around CryptoRama's Github profile, we find that it has a second repository called Progress Tracker. Every minute or so, the repo updates with a new commit that changes a hash in README.md.

Notice that the hash in the file is the same format as a UUID. Also notice that every commit has an associated timestamp. If we take those two pieces of data, we have enough information to generate a URL in the SnapPass instance. From trial and error, it seems like the URL expects the timestamp to be of minute precision. If we plug in the converted timestamp and the hash, we get a valid URL.

Every commit in the repository creates a secret that contains the flag. Since it's a one-time use URL, that's why the repository keeps adding new secrets every minute.

Public Server Backup

We lost access to one of our servers. Thankfully we had backups. All you have to do is find a piece (backup) of our server and make it whole by attaching it to another server. If you do this, you will have attained nirvana! Start looking at our website again.

Going back to the Cryptorama website, we notice the picture of Eva. It has a very interesting URL:

Searching for her name on Gitlab yields an account with a single repository containing her personal website. However, more interesting is a file called account.txt that contains details of her AWS account ID and mentions an EC2 instance.

Since we've learned that she has an EC2 machine and we know her AWS account ID, the next step would be to see if there's any way to find details of her EC2 instance.

AWS allows you to snapshot EC2 instances onto EBS, and it's possible to have those snapshots be public. Since we know the account ID, we have the ability to find all of the public snapshots for the account. To do so, we enumerate through the AWS regions and use the command line to print out public EBS snapshots:

Most of the regions yield nothing, but in us-west-1, there's a single public snapshot:

We want to inspect the contents of the snapshot. In order to do so, we need to copy the snapshot over to our own account and then create our own EC2 instance that's based on the snapshot.

Once the image is in your account, you can create an EC2 instance, SSH into the machine, and view the flag.

Asset Management

Our junior developer Henry Lopez cannot find his assets. Can you help him please? His credentials are given below: Username: henry.lopez Password: sHTA$H@&sBjPG5

It seems like Cryptorama has an assets server. When we looked at the certificate transparency logs, we saw that https://assets.cryptorama.cloud/ was a valid subdomain. Logging in with Henry's credentials leads us to the asset management page.

From poking around the app, we learn that there's very little data to be found. We also see that the site is running v5.4.3 of Snipe-IT. If you search for CVEs that are present in the running version of the app, you'll find CVE-2022-1511. It's an access control bug that was fixed in the following patch of Snipe-IT.

Because of the bug, users without proper permissions can access restricted resources. The resources don't show up as links in the app's sidebar, but they can just go to the URL directly. The proof of concept shows a normal user visiting the /hardware/requested endpoint, even though there are no permissions. By doing the same and visiting https://assets.cryptorama.cloud/hardware/requested, we can find the flag.

Control Panel RCE

Now that Henry has his assets, time to try out an application he created. https://control-panel.cryptorama.cloud/

If you visit the website, you'll find a pretty unassuming app. It contains two buttons, one that shows the current working directory, and one that prints the current timestamp.

If you inspect the network requests that happen from clicking the buttons, you'll notice that there's a request to /cmd that with form data. The payload has a single key, filename , and the value is either first or second depending on which button you clicked.

We then try to break the form by sending a request without the filename key. It causes the request to fail, because of a BadRequestKeyError. From looking at the ensuing HTML, we learn that...

• It's running a development build of Flask (since there's a stack trace).

• The /cmd endpoint requires a value for filename.

Scrolling down the stack trace, you'll find a snippet of the actual application code.

From reading the code, it seems to be...

1. Reading the value at filename.

2. Constructing a URL based on that value.

3. Sending an HTTP request to get the contents of that URL.

4. Running the contents of the HTTP request via eval.

5. Sending the return value of the eval as part of the HTTP response.

Though the snippet only covers the logic for local files, we suspected that there must be similar logic for remote files. We have no control of the local file content, but if we hosted our own files and had the server download those, we could in theory do arbitrary code execution.

The fastest way I think of to host files on the public Internet was to run a simple HTTP server and expose it via ngrok. So I created a directory with some test files and spun up an ngrok tunnel.

Then if you include the entire URL of your remote file as the value in the filename key, the server will execute the arbitrary code that you wrote. Listing the contents of the directory showed that there was a file called flag.txt. Then you could command the server to print out the contents of the flag.

Doug's Golfing Experience

Can you locate this field on the outskirts of London in the image attached below. Once you do, what date did Doug leave a review for this place?

This picture seems to have been taken from a plane. The field is also quite distinct, which makes it easy to confirm whether you've found the correct location.

If you've ever flown in a plane before, you'll notice that the picture was taken at a relatively low altitude. A low altitude means that the plane is either landing or departing, which also implies that the plane is close to the airport. The field itself appears to be a golf course. If you search for golf courses near London airports on Google Maps, you'll eventually find a place called Hounslow Golf Park next to Heathrow Airport.

Taking a look at the golf park's website confirms that it's the same field from the photo. Scrolling through the reviews, you'll find a review from Doug that was posted on July 16th.

Meet the Team

Behind every CTF, there are names and faces that made it all a reality. Thanks to the organizers at Recon Village for creating the challenges in this CTF. It's also important to remember that solving this CTF was a team effort. Here are your alligator hunters:

• Chris Rodriguez

• Christian Johnson

• Jeremy Krach

• Andrew Liu (me)

Hope you enjoyed reading this write-up! If you have any questions or feedback, feel free to reach out and share your thoughts.

So you're looking to join a startup. That's great! Startups can offer the most fulfilling years of your career.

At the same time, you need to be careful. It's worlds apart from working at a large, traditional company. Victory isn't assured, and you incur significantly more risk. I'm not trying to peddle some disaster scenario. In a relatively short period, the recent market downturn has caused a fair share of massive layoffs and company failures.

Only when the tide goes out do you discover who's been swimming naked.

Despite those layoffs, good companies will still survive and thrive in the long run. So whether or not to join a startup isn't the issue. What matters is that you make an informed decision. I've compiled a collection of questions I think everybody should ask before joining any startup.

When starting out

• What are you building? How far along are you? How long have you been doing it?

• How do you (plan to) make money? Who are your customers?

• Who are your investors? What were the terms of your funding?

• Who are the founders? Do they have any sort of track record?

Your goal when talking to a new startup is to understand the basic context. That means understanding the business model and whether the work will be interesting. Understanding the startup's age and progress will give you some insight into its velocity, which I'd argue is the most important trait of the company.

This is also the opportunity to gather some light, anecdotal intel about the company. Understanding who invested in the company can give you some signal about the rough quality of the company. Typically, top-tier VCs will not invest in obvious duds. Knowing a founder's track record can also be useful. For example, Domm Holland, the former CEO of Fast, left his previous startup with a trail of legal issues behind him. Employees who joined the company before it failed would have noticed several red flags if they looked into the issue.

When interviewing

• Who will I be working with? Are they good?

• How did you find this company? Why did you join?

• How did the company compare to your expectations?

• What don't you like about your job?

Interviews go both ways. Someone may be interviewing you, but you're also assessing your interviewer. During an interview, you're talking to potential teammates. Do your due diligence and assess whether these are people you'd enjoy working with.

I recommend knowing whether your hypothetical teammates are competent, sane, and happy with their jobs. It'll foreshadow whether you'll remain sane and happy with your future job.

Before getting an offer

• What's your burn rate? What will be your burn rate in 6 months?

• How much runway do you have?

• What's your revenue? (Current numbers, NOT projected.)

• When do you expect to become profitable?

At this point, assuming interviews have gone well, you're looking to understand a company's financial fundamentals. Do not accept hand-wavy answers for any of these questions. Every company needs to know basic math.

The burn rate of a company is roughly how much it spends, while its runway represents how long it'll be before the company runs out of money. In my opinion, a healthy company should have at least 2 years of runway. Otherwise, it may risk having to accept unfavorable terms in its next funding round (or just failing outright). There was recently a leaked presentation from Sequoia about adapting to the future, given the current state of the economy. The days of "growth at all cost" or blind hyper-growth have fallen out of favor. Startups having solid fundamentals will matter a lot more moving forward.

After getting an offer

• How many outstanding shares are there?

• What's the strike price (or fair market value) per share? What were the historical strike prices?

• What's the preferred price per share?

• How does the company plan to liquidate its shares?

• Do you have early exercise?

• What's the exercise window if I leave?

If you're working at a startup, you're likely being paid in stock options. So you pay money to buy shares of a company and bet that the price of those shares will go up. That's not easy to measure, so you must make sure you understand how equity compensation works.

Working with stock options can have tax implications, so you may have to make a strategy even if a company is doing well. Early exercise can reduce your taxes (at the expense of upfront cash). If you don't want to exercise any options yet, be sure to know when those options expire. It's usually 90 days after you leave a company, but it can vary. When I was at Scale, if you worked there for at least two years, they had a clause that extended that exercise window to five years after your last day.

Talking to the CEO

• What's the biggest existential threat to your company?

• Who controls the company's board seats? What conditions would cause the board to fire you?

• What's the worst-case scenario that you project happening to the business? What's your contingency plan in such a case?

• What's your vision for the company? Under what conditions would you sacrifice that vision?

Before you join a startup, you should have at least one conversation with the CEO. And it's not the time to make small talk. You must ask the tough questions. This is the person who's steering the ship, and the person who's probably thought the most about the company's destiny. Like with the questions about company financials, if you get hand-wavy answers, run away. You do not want to be working for this person.

The question about the worst-case scenario is partially a test to see how well-prepared the CEO is. Leaders should be ready for pretty dire situations. Sometimes these situations can require hard decisions. If a company's burn rate becomes too high, make sure the CEO has considered doing a layoff to cut costs. If runway becomes a problem, the CEO should be willing to take a down round to keep the company alive. Is this a person who will make unpopular decisions for the company's best interest, or is this someone who engages in wishful thinking? It's your job to find out.

Talking to former employees

• How long did you work at the company?

• Why did you leave? What could have made you stay?

• What were some good things about the company?

To avoid "drinking the Kool-Aid," I recommend talking to at least one person who has left the startup. You get an example where things didn't work out, and you can talk to someone with no incentive for you to join the company. It's an opportunity to hear an opposing viewpoint and uncover red flags.

Be sure to understand how much the former employee actually knows about the company and whether this person was fired. (People may not always be upfront about that information.) Ironically, if this is a person you wouldn't work with, a company firing that person may be a green flag.

Thanks for reading! Please share this if you have friends who are looking at startups.

As far as I can tell, every issue tracker and to-do list app known to man supports some feature that lets you prioritize your tasks.

You typically tag everything as high, medium, or low priority. Other apps may refer to them as "P0's" or "P1's," though they all use the same bucketing system. Sounds good on paper. I enjoy understanding my priorities just as much as the next person does. But what happens in practice? Personally, I experience a two-part problem.

1. Everything gets labeled as a high priority.

2. You get confused about what's actually important.

Dividing your priorities into buckets can backfire. If everything has a high priority, the system's meaningless. It's like giving each task a participation trophy.

Having real priorities means that no two things are equally important. By prioritizing one thing, you must explicitly deprioritize something else.

Simple ordering solves this easily

"But everything is important!" you might rebut in protest. I totally agree. Multiple things can be important, but that doesn't mean they're equally important. You can plan to buy both milk and eggs, but if the grocery store were rationing supplies, you'd eventually pick one over the other.

Here's what I recommend doing instead:

• Stack rank everything in order of their relative priority.

• No two items can be equally ranked.

• You're done. It's that simple. Start completing those tasks!

Ranking tasks in an ordered list works so well because humans can intuitively sort items once we've given them some measurable values. Once you ban equal priorities, you're suddenly forced to make real decisions.

For those who still feel the need to divide tasks into buckets, you should still rank everything first. After ranking everything, then draw cut-off boundaries between your "high priority" and "medium priority" tasks. That way, you gain some notion of absolute importance without forgetting your relative prioritization. Though it's just a cherry on top. Stack ranking is enough.

During my time as an undergrad student, I saw Google as a dream job for software engineers. It felt like the place you'd ultimately want to end up--your career's final frontier. A generous helping of my classmates held identical beliefs. After graduating, I happily joined Google, and life was great. Yet a few years later, I couldn't help but feel the itch to leave the place for a smaller company.

I'm not unique in this regard. When comparing the relative tenures of ex-Googlers (or Xooglers), there seems to be a bimodal distribution of how long people tend to stick around. The people in the first cluster volunteer to leave the mothership after two years or so. It’s a fair chunk of time, but not long by most measures. Those who stay longer compose the other majority. These folks tend to be lifers--they stick around at Google for most of their careers.

Both groups share a common struggle. Not everybody leaves Google, but once in a while, someone considers doing so. At that moment, they must answer the same question: is leaving worth it?

Reasons to Leave (and Reasons to Stay)

After leaving Google, I’ve worked at progressively smaller startups. Depending on your viewing angle, the difference between startups and a big tech company can either appear invisible or differ like night and day. Thus, it’s easier to dissect the individual motivations that encourage people to leave.

This list covers concrete differences (and similarities) between Google and startups, but by no means is it exhaustive. Assigning weights to each of these reasons is left as an exercise for the reader, but I’ll share how these fit into my own cost-benefit analysis.

Learning Rate

The learning rate at Google seems to fall off a cliff after your first year or so at the company. The work tends to be rather specialized and the average engineering velocity flows like dried molasses. I've met a handful of senior software engineers at the company who couldn't build a CRUD app to save their lives. While they’re smart and talented people, the nature of the job rarely provides opportunities to learn how to ship products end-to-end. If you feel frustrated with your growth rate and want to know "how the whole system works," joining a startup could be a solution. I wanted to optimize for learning early in my career, so this was the biggest catalyst in my decision to join a startup.

Moving the Needle

No matter how well or poorly you do, Google will be successful. Any team outside of ads has comparatively little impact on the company’s bottom line. Teams within ads have comparatively small projects in order to keep Google’s moneymaker stable. Depending on the size of a startup, your performance may directly impact its success. This can be an exciting prospect or too much pressure. Adjust your career path accordingly.

Work-Life Balance

Google has done an impressive job establishing a culture of work-life balance among its populace. It's a fantastic place to raise a family. The trade-off is that going above and beyond in your work has diminishing returns on your career trajectory. Work twice as hard as the next engineer? Expect to be promoted one cycle earlier. The game theory at Google rewards conformity. Your optimal strategy is to perform normally and enjoy your evening after clocking out at 5 pm. It's perfectly fine behavior, but it's not for everybody.

The stereotype that all startups have a bad work-life balance isn’t true. Some startups can be chill, while others grind hard. I’ve experienced both. Since your mileage may vary, be sure to ask questions when interviewing.

Burnout

Contrary to popular belief, I think burnout has little to do with how much one works. It aligns more with whether you feel a sense of purpose in your work. Hence the likelihood of burnout has less to do with company size and more with the quality of management. Within Google, I recommend finding teams with good managers and a low probability of being lost in a re-org. (Core infrastructure teams seem to be ideal.) For startups, look for companies with high levels of focus. A clear mission fosters a strong sense of purpose.

Promotions

I’m aware of groups of frustrated Googlers "stuck" at their level. Don't waste your time at a startup if you're promotion hunting. Google doesn't recognize the legitimacy of startup titles (assuming your startup even has a leveling system). Your best bet is to interview at Facebook and get slotted at a higher level. In the long run, staying at large companies with standardized engineering levels will get you promoted the fastest. However, going to a startup can afford you unique opportunities like bigger projects and management. Sometimes having the equivalent opportunity at Google would require years of tenure.

Compensation

Startups will not match Google in compensation. However, in recent years, good startups have been inching closer to the base salaries you see at large companies. (The size and stage of a startup also impact its levels of cash compensation.) We’ll discuss equity compensation in the following section, but note that startup equity may not be liquid for several years.

Perks

It's hard to beat Google perks. I still hold fond memories of ordering matcha lattes from a barista when I strolled into the office every morning. I'd be done with the drink before reaching my desk. Sad to say, but I haven't received free barista-made coffee for years now. There were many other nice-to-haves that are easy to forget. For instance, being able to hop into any remote office to use a free gym was lovely. If you join a startup, all of it is gone. Stay at Google if you can’t give up the perks.

Interesting People

You'll meet more interesting people in the startup world. While I was an intern at Dropbox (back when it was a startup), I befriended a handful of full-time engineers. As I finished college, they would go on to more-or-less pollinate Silicon Valley. Some of them became early engineers at unicorns, like Figma and Airtable. Many of the folks I worked with at Scale AI would go on to found their own companies or become VCs.

The alumni network at Google has been comparatively dry. Most of the folks I've met at Google are still there. When giving career advice, Patrick McKenzie advises caution against startups. One justification is that your startup network will struggle to find a job for you, while your megacorp network will be ripe with opportunity. Anecdotally, I've observed the opposite.

You're Afraid of Uncertainty, Not Risk

It's not fun to admit that humans are emotional beings, especially when others see you as a smart or rational person. But more often than not, when contemplating a career change, people get scared off “because it’s too risky.”

It’s easy to distress over the idea of falling behind in one's career. Imagining your peers being richer and farther along in their careers evokes waves of envy. Some scenarios sound absurd, so why do we imagine them? Humans have poor intuition for measuring risk, so we end up using certainty as a proxy for risk.

Although they look similar, risk and uncertainty are different beasts. Risk brings exposure to legitimate danger or loss. Uncertainty hints at a lack of confidence over future outcomes. The engineer who has worked diverse jobs may lead a career with low certainty, but it’s not fair to catastrophize the degree of risk. She may have built up a healthy resume and an army of employers eager to hire her back. Inversely, someone working on the same thing his entire life can have risk, despite high levels of certainty. The moment his company cancels the wrong project, he may find that his career is put on pause.

So whenever someone feels squeamish about the prospect of post-startup destitution, I advise separating out legitimate risks and perceived risks. For example, being unemployable isn’t a real risk. You can always find a new job if your current company isn’t doing well. If you made it into Google before, you can probably get back into Google again. A startup failing is a legitimate risk, but your career will be fine. Working at a startup can yield worse (or better) outcomes, but resist exaggerating its magnitude. (Don't underestimate the value of having Google on your resume either. I had to set my LinkedIn location to North Korea in order to suppress the barrage of recruiter solicitations.)

When planning amidst uncertainty, Reid Hoffman's ABZ planning framework can prove a useful tool. You stack a layer of backup plans that allows you to adapt to changing or unforeseen circumstances. If something goes wrong, you can fall back to your next contingency plan. For most established software engineers, the "plan Z" can be to return to a previous company. Not bad for a worst-case scenario.

You Probably Won't Get Rich by Working at a Startup (and That's Okay)

You can expect around three-quarters of all startup equity packages to be worthless. The remaining quarter roughly breaks even with Google's stock package. Once in a blue moon, someone gets a life-changing amount of money. Those odds look gloomy, right?

Unfortunately, most startups fail outright. Those that don't may still stagnate or fail to become a big success. Since startup equity packages usually consist of options, it means that you're betting that the startup will multiply in value. You effectively work for the “right” to buy startup shares while the share price is low. I can think of at least five example scenarios of what happens to those options:

1. The startup fails: Your options are literally worthless.

2. The startup retains its value: Your options are still worthless. (It costs money to exercise those options, so you make zero profit.)

3. The startup goes through mild growth: You make some profit from your options, but it's a rounding error compared to your salary.

4. The startup multiplies its valuation: You break even with your equity package from Google.

5. The startup pops off and multiplies its valuation by a lot: You're making exponentially more money than at other places.

You might notice that these returns follow a power-law distribution. The best startups are worth more than all the lower-tier startups combined. The average startup sucks. A startup that does better than its peers will do exponentially better.

If the odds are so slim, then why bother with a startup? If you're just here for the money, don't bother. The expected value for your compensation is lower at a startup. Folks genuinely interested in startups shouldn't be too discouraged though. So far, we've only looked at averages. Averages matter when you're picking at random, but your career is too important to leave things to chance. You need to look for startups that you believe will succeed. We're here to take calculated risks, not wild guesses.

The first thing you do when inspecting the pool of startups is to ignore the ones that are obviously doomed to fail. Think back to your days of interviewing other candidates. How many of them received offers? I recall that it was higher than the 0.2% acceptance rate reported by Google. We didn’t observe such a small acceptance rate because the vast majority of candidates who applied to Google got filtered out immediately. These are the people who haven't written a single line of code, and it's easy to detect. So the next time you meet a wantrepreneur who hasn't done any work, run away. They're contributing to the statistic, but you don't have to.

Look for startups with VC funding. Before venture capital firms invest in a company, they go through a process of due diligence, which includes assessing the company's business plan, team, and financials. You should do the same before joining any startup, but you can piggyback off the work of VCs. Talking to startups funded by reputable VCs reduces your search space. (You'll at least meet companies with convincing pitch decks.) My recommendation would be to make friends with VCs. It's a great way to get connected to portfolio companies and discover companies under the radar. VC funding isn't a silver bullet, though. Like with startups, the returns of venture capital firms follow a power-law distribution, and funded startups still fail. Hence the quality of the VC firm matters a lot.

You can also join larger startups, depending on your appetite for risk. By the time a company raises its Series C, its equity package feels more like a deferred compensation plan than a big bet. Unicorns on the verge of an IPO can still double or triple in valuation by the time they go public. It's not a bad return on investment for the amount of work you put in.

As a final note, joining a startup that doesn't pan out isn't the end of the world. The game only ends once you throw in the towel.

Miscellaneous Advice

• Consider whether switching teams makes more sense than switching companies. Leave Google if there's something missing from the company.

• Google taught me the best practices for a software engineer. Scale taught me how to ship quickly products end-to-end. It's hard to get both skillsets in a single place. Figure out what you're looking for.

• If you're young and career-oriented, take more risks. You have fewer life obligations and more chances to catch a big break.

• Never drink the Kool-Aid, no matter where you end up. Every company will try to present itself in the best light. Be sure you ask the hard questions and resist any pressures to make a hasty decision. Do what's right for you.

• Are you struggling to find good startups? To get started, look at companies you respect. Which VC firms funded their early rounds? Try to connect with people from those firms. Their portfolio companies might be worth investigating too.

• Always think for yourself. My values and experiences differ from yours, so what worked for me may not work for you.

• Never blindly obey anyone's advice. The people matter more than the company itself. Search for good people. I try to surround myself with people smarter and more talented than me. Hopefully, it'll rub off on me one day.

Many thanks to Cat Wu and Brian Isganitis for your feedback on earlier drafts of this blog post.

If you're a software engineer thinking about moving from a big tech company to a startup, feel free to reach out to me. I'd love to help out with your decision-making process.

Whether you're an industry veteran or a new coder, you should probably invest more time configuring your development environment. When you're staring at the same screen day after day, polishing that screen becomes one of the highest leverage tasks you can pick up in the long run.

In this blog post, I share what I've done to customize my development environment.

Why should you care?

While customization is a personal choice, I still believe every developer should toy around with configurations at least once. It pays dividends in a couple of ways:

• You work faster when you're familiar with the tools at your disposal.

• You enjoy your work more if you're working in a comfortable environment.

• Configurations force you to dig through some abstractions and understand the tools you're using.

(These are true from personal anecdote, at least.)

My development environment revolves around a zsh / vim / tmux setup. Most of my choices were made to optimize for speed and portability. Everything happens in the terminal, so there's minimal context switching. Certain tools I use (like Vim) have a learning curve, meaning you'll struggle to pick it up at first. But once you've achieved a certain level of competence, you become very productive. Everything works in any POSIX environment, meaning that I can clone a repository and have a working environment in a single command.

The Terminal and Oh-My-Zsh (~/.zshrc)

On POSIX-based machines, I use Zsh as my default shell. (If I ever need to do development on a Windows machine, I install the Windows Subsystem for Linux. Then I set my shell to Zsh.)

While most terminals default to Bash, Zsh stands out due to its exceptional plugin support. That makes Zsh a preferable choice if you intend on customizing your shell. There's a rather popular Zsh framework called Oh-My-Zsh that I use. It allows you to track things like the status of your git repository and Python virtual environment out of the box. You're also able to change themes at will, meaning you can get a pretty terminal with minimal effort. My Zsh theme of choice is called powerlevel10k. It allows me to have a terminal that looks like the screenshot below.

For my terminal color scheme, I use Solarized Dark. It's been sold as an "objectively better" color scheme since the color contrast was designed to be easier on the eyes. To my knowledge, no other color scheme makes any claims of objective superiority. Since I didn't have strong opinions on the color of my terminal background, I picked Solarized Dark. If its claim is true, then I've chosen the "best" color scheme. If not, I suffer no penalty. Either way, I'm no worse off than before.

Alternatives to Popular CLI Tools

Some of the core commands you run daily might have been written before you were born. While that generally implies that these are reliable tools, it also means they're old and there exist modern alternatives. I've included a table of my favorites below:

For the most part, all you need to do is to install the replacement command and then alias it to your original command. It becomes a drop-in replacement, and your life becomes better without any additional effort.

alias ls="exa"
alias cat="bat"
# and so on...

Fuzzy Finder

One of the most underappreciated tools in the developer's arsenal is fuzzy searching. You type in approximately what you're looking for, and you get reasonable results. The specific tool I use for fuzzy searching is called fzf. It's a general-purpose command-line fuzzy finder, so you can use it in conjunction with most shell operations. It's hard to explain without going into specifics, so I'll share a few ways I use fzf.

Suppose I'm looking for active Chrome processes on a machine. I might list processes and pipe them into grep (or rg). The problem here is that I have to know exactly what to search for immediately. If we pipe it into fzf instead, we can arbitrarily type search queries without having to reload the command.

ps aux | grep Chrome # grep is case sensitive
ps aux | rg chrome # For grep/ripgrep, we get a static result.

ps aux | fzf # With fzf, we can comb through results on demand!

Fuzzy searching isn't just for piping other commands. If working in a large git repository and want to open up a file in Vim, it's a pain to type in the specific file. Tab completion helps, but you still need to type in a majority of the path. Fortunately, fzf comes with a few keyboard shortcuts. I can type vim <ctrl-t> and fzf will show me a list of candidate files to open. I type in the approximate path to the file, and it can locate what I want with minimal effort on my end. There are similar keyboard shortcuts for shell history search and directory search. I just type in approximately what I want, and fzf does the rest.

Text Editing (~/.vimrc)

I don't use IDEs or "modern" text editors when coding. Instead, I use Neovim as my preferred text editor. (It's a drop-in replacement for Vim with a few added benefits.) There two are reasons why it stands out above any alternatives: it's fast and it's portable. Notice how those are the exact features I'm looking for!

Vim has been infamous for its keyboard shortcuts. If you know how to operate the text editor, your hands never need to leave the keyboard. You can also create macros within the text editor, meaning it's possible to automate any repetitive typing tasks. Vim is also a lightweight program. It starts up in milliseconds and can support files that are too large for "modern" text editors to even open. Everything just works. Since Vim runs within the terminal, it's possible to have the same experience across machines, even if you're developing over SSH. Just make sure the program has been installed and you're done.

While many consider Vim an "old" text editor, it can support modern features such as plugins and language servers. For package management, I use vim-plug to install general Vim plugins. For language server support, I use coc.nvim. That way, if I need autocompletion or jump-to-definition for a language, I just need to type in a single command to install a new language server. Vim works well with fzf too. If I want to open a new file, I can hit <ctrl-p> and open a fzf buffer. It allows me to find arbitrary files without knowing their paths or closing my editor.

Tmux (~/.tmux.conf)

If you're a terminal-centric developer (like me), it makes sense to use a terminal multiplexer like tmux. A terminal multiplexer allows you to split a terminal into multiple panes or create virtual tabs with new terminals. If you develop on a remote machine, terminal multiplexers become even more useful. You only need one SSH connection to maintain multiple terminals. Your tmux session also lives independently of your SSH connection. If you choose to log off, you don't lose your work. Just detach from tmux and reattach whenever you want to resume your work.

Version Control (~/.dotfiles)

To wrap everything neatly in a bow, I keep all of my dotfile configurations under version control. There's a single git repository that holds all of my configuration files. Any local config file is just a symlink to a corresponding file within the git repository. If you're looking to get started, copying my dotfiles is a great way to get your feet wet.

Since we have everything under version control, it's simple to track incremental changes over time. Additionally, I'm free to make experimental changes without fear of regressions. Version control also trivializes migrating the configs to a new machine. All you need to do is to clone the git repository and run a setup script that creates symlinks to the files within the repository.

For my dotfiles, I've created the following one-liner that does all the repository cloning and setup. I run the command, wait a few seconds, and the new machine turns into a familiar environment. And that's it. You're done.

# This command is literally all you need to get started...
curl -L andrew.cloud/dotfiles.sh | sh

Final Thoughts

And that's all I have to share. Tinkering with configs has made me pickier, but it has also turned me into a better developer. We tend to have too much tolerance for default tooling, and that slows us down in the long run. A few years ago, I started to wonder why we didn't focus more on our development environments.

I hope reading this makes you question it as well.

Several weeks ago, Replit partnered with 1729 to host a challenge to write a Discord bot. I won the grand prize by building an AI-powered chatbot.

balajis.com

Learn to Make a Discord Bot with Replit

By Replit…

Read more

5 years ago

The winning bot leveraged GPT-3 to intelligently chat with people and write React code on the fly. How does all of this work? Let's explore how it happened!

Introducing Cloudy 👋

For the 1729 challenge, I wrote a Discord bot named "Cloudy - The Hacker's Assistant". The bot provided various utilities for online communities, including:

• Intelligent conversational chat (with memory) 💬

• React component code generation 💻

• Ethereum blockchain querying 💱

• On-demand maps for Among Us 🕹️

To get a taste of Cloudy in action, check out the demo video.

Underneath the Hood 🎛️

When designing Cloudy, my mental model split the bot into a few distinct sections. Specifically, there were three core layers:

1. The infrastructure behind Discord bots. 🏗️

2. Interacting with machine learning APIs. 🤖

3. Deploying your bot. 🚀

All Discord bots need a certain degree of scaffolding before you get started. Cloudy leverages machine learning APIs to power its conversational chat and code generation. There's also a matter of shipping the bot so it can actually help out real users.

Once you understand all three layers, you should be able to build your own version of Cloudy. If at any time you're confused, feel free to refer to Cloudy's source code.

Setting up a Generic Discord Bot ️🏗️

All Discord bots share common properties that every developer should understand. These are also mandatory for getting started.

Creating an Application

You'll need to set up a Discord application as the first course of action. The application grants you API access and a bot account to use. There already exist step-by-step instructions for creating an application.

The process of setting up an application is more involved when it comes to permissions. If you lack the proper permissions, your bot may fail to work. Therefore, it's good to know what you want your bot to do before actually inviting it to any Discord servers.

At the very least, a bot will need the bot scope. Bots that can take commands will also need the applications.commands scope. The necessary bot permissions vary depending on the specific functionality of the bot. These should be reasonably straightforward. For example, Cloudy uses three permissions:

• Send Messages

• Embed Links

• Add Reactions

Client Libraries

Before diving too deep into the weeds, it's good to clarify what a Discord bot actually is.

Discord exposes numerous APIs to fetch updates within a Discord server. Many of these take the form of webhooks, such that developers get real-time updates. Discord's API also allows developers to post on behalf of applications.

Thus a Discord bot is a program that polls Discord's servers and posts updates as necessary. It's pretty straightforward if you think about it.

Many client libraries abstract away the Discord APIs pretty well. Instead of dealing with API calls, developers just handle event-driven logic. They only need to program what happens when there's a relevant update from Discord. Cloudy was written using one of these libraries. Pick your favorite programming language, and you'll probably find a decent client library. After that, getting started with a running bot becomes simple.

Slash Commands

Client libraries should suffice for most use cases (such as chatbots). However, most don't support sending commands to bots. After years of complaints, Discord eventually added first-class support for real bot commands. These are known as slash commands.

Slash commands work well for specific user-triggered actions, such as modifying settings. For example, Cloudy exposes commands to change its chat mode and fetch Among Us maps. For almost everything else, it can handle things when it receives messages.

Note that slash commands are a somewhat recent feature. Thus most client libraries lack support for the feature. Cloudy uses an extension library to support slash commands. However, you should note that these extensions may not exist for all languages.

With all pieces of infrastructure in place, these will roughly be the steps you take:

1. Create a Discord application.

2. Set proper permissions for your bot.

3. Choose a client library and initialize your repository.

4. Find an extension library that supports slash commands.

5. Build out the business logic for your bot.

At this point, you should have the scaffolding that all Discord bots contain. The next step is to build out the actual logic for the bot, which will diverge, depending on what you want. In the next section, we'll discuss how Cloudy leverages OpenAI for intelligent conversations.

Working with Machine Learning APIs 🤖

Cloudy's main feature offers realistic conversational chat. The responses themselves are generated by GPT-3, a text-based machine learning model. Under the hood, OpenAI handles a lot of the leg work. But you have to set things up properly or else the results become meaningless. Garbage in, garbage out.

The end-to-end lifecycle of a conversation with Cloudy looks something like this:

1. The user sends a message on Discord.

2. Cloudy the message from Discord's servers.

3. Cloudy generates a special prompt for GPT-3 and sends it to OpenAI.

4. OpenAI has GPT-3 generate a prediction and sends the results to Cloudy.

5. Cloudy converts the prediction into a chat response and sends it to Discord.

However, a high-level overview isn't enough to answer a few core questions:

• What is GPT-3 and how does one access it?

• How does one pass relevant data to GPT-3?

These have more nuanced answers that deserve to be covered in detail.

Setting Up the OpenAI API

To generate realistic chat responses, Cloudy uses a machine learning model called GPT-3. GPT-3 is the latest in a family of language prediction models created by OpenAI. For these language models, callers can pass in some text as an initial prompt. The model then generates text to complete the prompt.

For instance, GPT-3 can receive a snippet of text as its input, such as the example below.

Once upon a time there was...

It will then generate text that deems to be the most probable continuation of what it received. (The continuation length and other terminating conditions can be parameterized.) The output from the example may look something like the following sentence.

Once upon a time there was a sleeping cat. His name was Fluffy.

Unfortunately GPT-3 isn't open-source, unlike its predecessors. It's only available as a closed (and paid) API. To get access to the API, you'll need to join their waitlist. Despite the hurdles with accessing the model, GPT-3 is the best there is in terms of text completion. Once you have access to the OpenAI API, invoking GPT-3 is simple. Pass it a prompt and the model generates text.

Using GPT-3 in a Real App

Having a powerful machine learning model is great, but it's meaningless until we put it to work. In practice, that means converting your app data into a prompt that GPT-3 understands. It also entails transforming GPT-3's output into something useful for your app.

For Cloudy's chat feature, we build a starter prompt using previous chat data. From GPT-3's perspective, it's predicting what Cloudy would say, given a chat log.

Upon receiving a message, Cloudy constructs a "chat log" from all previous messages in a Discord channel. The previous messages serve to build a history that serves as "memory." We then prepend a text snippet with basic contexts, such as Cloudy's name and purpose. That way, the completion engine has foundational knowledge about the bot.

Cloudy's preprocessing generates a prompt that resembles the (incomplete) transcript of a play:

The following is a conversation with an AI assistant. The assistant's name is Cloudy. The assistant is helpful, creative, clever, and very friendly.

Human: <Something the user previously said over Discord>
AI: <Cloudy's previous response to the user's message>

<Imagine more Human/AI chat history here in the same format.>

Human: <The message Cloudy just received over Discord>
AI:

GPT-3 will then infer what belongs in the last message after the AI: token. Assuming that the previous conversations have been coherent, the AI should be able to generate a convincing response.

The same concepts apply beyond conversational chat. Cloudy also generates React code, given a natural language description. It may seem like an unrelated feature, but things change once you peel away the abstraction. In reality, it's a matter of GPT-3 pattern-matching against examples of code generation.

To generate code, we need to construct a prompt that resembles our previous chat log. This time, the prompt omits user messages and bot responses. Instead, it contains previous examples of descriptions and code snippets. The penultimate line should contain the user's description of the react component. The prompt concludes with a token indicating that there should be code.

description: a red button that says stop
code: <button style={{color: 'white', backgroundColor: 'red'}}>Stop</button>

description: a blue box that contains 3 yellow circles with red borders
code: <div style={{backgroundColor: 'blue', padding: 20}}>
  <div style={{backgroundColor: 'yellow', borderWidth: 1, border: '5px solid red', borderRadius: '50%', padding: 20, width: 100, height: 100}}></div>
  <div style={{backgroundColor: 'yellow', borderWidth: 1, border: '5px solid red', borderRadius: '50%', padding: 20, width: 100, height: 100}}></div>
  <div style={{backgroundColor: 'yellow', borderWidth: 1, border: '5px solid red', borderRadius: '50%', padding: 20, width: 100, height: 100}}></div>
</div>

description: (This is the placeholder for the user-provided input.)
code:

The model should recognize the pattern and realize that React code should come next.

With all the GPT-3 interactions demystified, there are two things left to do. The bot must post-process the model's output and send the results back to Discord. From the user's perspective, it appears as if Cloudy is talking to them or writing code. What they don't see is that Cloudy's busy building a prompt and guessing what should come next.

Deploying Your Bot 🚀

We have the scaffolding for a Discord bot, and we know it works with OpenAI. Now it's time to ship it! After all, the code is meaningless unless people use it.

Running in Production

Fortunately, it's pretty simple to deploy a Discord bot. All you need is a machine that will keep your bot running. Note that Discord bots don't receive incoming requests. Thus we avoid most of the complexities associated with traditional servers.

There are several free options available if you want to host a Discord bot. For Cloudy, I personally used Replit to develop and host everything. While working on the bot, I could run the code to see my changes in real-time. It could also keep the bot alive when I was away. Ever since its inception, Cloudy has constantly been running on Replit.

Inviting the Bot

There's one final step before we can get the bot in the hands of our users. Someone has to invite the bot to their Discord server. If you've set up permissions correctly, this should be the easiest step. Grab the invite link from your application page, and share it with the world!

Note: As of my writing this, I have run out of OpenAI API credits. As a result, Cloudy cannot converse or generate code for time being. (All other features still work fine.) While I appreciate the overwhelming usage and support, API access isn't cheap! 😅

Tying it All Together

We've covered the infrastructure behind Discord bots and how to get started. We've also learned how to understand and interact with machine learning APIs. To wrap things up, we deployed our code to production. Now it's time to enjoy the fruits of our labor!

Here's the REPL for Cloudy. You're free to browse and run the code at your leisure. For best results, consider forking the project and gathering your own API keys.

Happy coding!

Wow, you actually read this far? Good job! Nobody has that kind of attention span these days! 🙈

Back in elementary school, my teachers would use the Food Pyramid to describe how to eat healthy. Younger readers may not be familiar with the Food Pyramid, but that might be a hidden blessing. Its recommendations were somewhat arbitrary. Throughout the years, the United States would continue to revise its dietary recommendations. However, Americans (and people in the rest of the world) continued to grow more obese.

With nutrition, our society suffers from too much instruction and not enough understanding. When we're told to "eat this" or that "this is unhealthy," it makes us outsource our thinking. What's worse is when the recommendations begin to contradict each other. Then it's outright confusing. Instead, it's better to know how your body actually interprets food. We can then derive an action plan from first principles. Most people see nutrition as a black box. You can change that.

This post contains three main sections:

1. A History of the Food Pyramids 📜

2. Nutritional Building Blocks 🧱

3. Actionable Eating 🥦

A History of the Food Pyramids 📜

(This entire section is a history lesson and can be skipped. If you're only interested in the fundamentals of nutrition, skip to the next section.)

For several decades, the United States government has been giving dietary advice. It's a typical case of good intentions being spoiled by bad results (and lobbyists). Let's take a look.

Food Pyramid (1992 - 2005) ⚠️

The United States Department of Agriculture (USDA) came out with the first iteration of the Food Pyramid back in 1992. At the time, the recommendations revolved around the concept of food groups. Specifically, there are 6 different categories:

• Grains

• Fruits

• Vegetables

• Dairy

• Meats, Beans, Eggs, and Nuts

• Fats, Oils and Sweets

For each food group, the USDA recommended a certain number of servings to consume per day. Grains were at the bottom of the pyramid and composed the bulk of the recommended diet. Oils and sweets lived at the top and were supposed to be consumed "sparingly."

While the Food Pyramid created a guideline about how to eat, it was rife with problems.

1. The food categories did not align with science.

2. Serving recommendations were both poorly-defined and inaccurate.

3. Lobbying played a crucial role in the final design.

Food Categories

I suspect the food group for grains was supposed to be a way of representing carbohydrates. But in that scenario, starchy foods such as potatoes should belong in the group.

Fruits and vegetables tend to be nutritionally similar, so there's no need for two groups. On the other hand, fats should not be in its own group, since all foods contain some amount of fat. These are some of the many grouping issues present in the Pyramid.

Serving Sizes

The concept of a "serving" isn't particularly helpful. The size of a serving can be arbitrary, meaning there's no standardized measure. Also the idea to consume fats "sparingly" can be dangerous. Humans need to consume some degree of fat, so preaching that "fat is bad" is an oversimplification. Meanwhile, having vegetarian or dairy-free diets can be perfectly fine.

Lobbying

When digging into the specifics of the Food Pyramid, observers can notice hints of lobbyist influence. For example, dairy products don't warrant their own food group. The dairy industry would think differently. (People who remember the Food Pyramid may also remember the "Got Milk?" campaign. The dairy industry has money to burn.)

It's also odd that cereal made its way into the grain group. Nutritionally, it ought to belong in the "Sweets" group. But cereal companies wouldn't be too happy if the government recommended limiting cereal intake.

It's funny in some sense. When you look at the Food Pyramid, it's split not by what's healthy. Rather, you see who paid the most to have their product shown on the menu.

MyPyramid (2005 - 2011) 🪜

After a long decade, the USDA decided that the Food Pyramid was problematic and needed a facelift. In 2005, they replaced the Food Pyramid with MyPyramid. While MyPyramid still had problems, to its credit, it was a slight improvement. There were two notable changes:

• There was a new "group" representing physical activity.

• Serving sizes were replaced with legitimate measurements (e.g. cups and ounces).

Unfortunately, MyPyramid still carried the same lobbyist influences from its predecessor. The main food groups were largely the same. MyPyramid also drew criticism for being too complicated and confusing. Compared to its predecessor, MyPyramid had a short lifespan and was taken down after 6 years.

MyPlate (2011 - present) 🍽️

MyPlate replaced MyPyramid in 2011 after criticism of the latter being too confusing. It is the current USDA recommendation.

Instead of listing out food quantities, MyPlate describes the ratio of food types. Unfortunately, it suffers from oversimplification. The absolute quantity of food still matters, and the food groups still don't make sense. (Notice how dairy has stubbornly persisted across all USDA recommendations.)

To be fair to the USDA, getting nutritional guidance right isn't easy. But as long as the USDA suffers from the influence of food industries, don't expect reliable information. I don't see MyPlate lasting for too long before it's replaced by a new set of recommendations.

Nutritional Building Blocks 🧱

(This section is a bit of a chemistry lesson. If you're only interested in actionable advice or have PTSD from your high school orgo classes, skip to the next section.)

Consuming food serves two main purposes:

1. Provide energy for activity (and to live).

2. Provide materials to grow and repair the body.

Notice that physical or mental pleasure is not one of the purposes of eating. It may be one of the derived side effects, but don't confuse it with the legitimate biological purposes.

With nutrients, it's helpful to view things through the lens of chemistry. Humans digest foods into certain chemical compounds that can used in the future. These chemical compounds are known as nutrients. The body can later trigger chemical reactions using nutrients as reactants or catalysts. These chemical reactions tend to either generate energy or construct cells.

We can examine nutrients through three fundamental components:

1. Macronutrients 🍲

2. Calories 🍭

3. Micronutrients 💊

Macronutrients 🍲

Macronutrients comprise the chemical compounds that generate energy for the human body. These also tend to be the compounds that humans need the most. As such, macronutrients are typically measured in grams.

There are three core macronutrients:

• Carbohydrates 🍞

• Proteins 🍗

• Fats 🥑

When the body breaks down macronutrients, it receives energy from the compounds. Residual compounds from these macronutrients may also used for other vital purposes. It's worth noting that the body cannot naturally produce most of these compounds, meaning you need to have a reasonably balanced diet to live.

Carbohydrates 🍞

Carbohydrates constitute the primary source of energy in the body. They comprise a family chemical compounds that include monosaccharides and polysaccharides. You may know these as sugars and starches. Besides energy production, the body also needs carbohydrates to support the immune system.

Carbohydrates can be divided into simple or complex carbs. Simple carbs tend to be sugars, while complex carbs can be found in foods such as brown rice or bread. The body uses simple carbs for energy, meaning simple carbs are easy to digest. It will break down complex carbs into simple carbs over time.

Proteins 🍗

Proteins are compounds made of amino acids. Besides being an energy source, the amino acids play a role in constructing the body. High sources of protein tend to be meats, eggs, and legumes.

Note that the body cannot naturally produce certain necessary amino acids. Therefore you must consume protein to live. Meats and eggs already contain all necessary amino acids. Vegans need a more varied diet (e.g. wheat and legumes) in order to cover all necessary amino acids.

Fats 🥑

Fats are compounds made up of fatty acids. Fatty acids sustain the health of cell membranes, and thus help sustain skin and hair health. Like with the other macronutrients, fats can also be used as an energy source.

Among the fatty acids, there are subcategories based upon the molecular structure of the compounds.

• Unsaturated Fat 🐟

• Saturated Fat 🥩

• Trans Fat 🍟

Unsaturated fats contain at least one bent double bond between its carbon atoms. In practice, it means that these compounds cannot clump together tightly. These are the "healthy" fats and are in foods like fish, nuts, and avocados.

Saturated fats replace the carbon double bonds with single bonds to hydrogen atoms. The compound thus has a shape that allows it to be packed very densely. The dense packing of saturated fats in turn allows the build-up of bad cholesterol. Enough bad cholesterol will clog your arteries. You should try to limit consumption of saturated fats.

Trans fats occur commonly in foods made with hydrogenated oil. On a molecular level, trans fats are unsaturated fats whose shape gets transformed. There are no health benefits to trans fats whatsoever. As a result, the United States banned creation of artificial trans fats in 2018. Avoid consuming trans fats if possible.

Other "Macros"

There are other nutrients whose status as a macronutrient is debatable. The core macronutrients provide energy and are necessary in large quantities. On the other hand, these three compounds do not fit both requirements:

• Ethanol 🍷

• Water 💧

• Fiber 🥕

Humans can metabolize ethanol, also known as drinking alcohol. However, it only provides energy and no other benefits. Thus you're literally consuming "empty calories."

Water does not provide any energy. Instead it acts as a catalyst for internal human reactions. Some consider it a macronutrient since humans need a large quantity of water to survive.

Fiber is a type of carbohydrate that cannot be digested (and doesn't provide energy). Instead, it aids with digestion. Fiber can be typically found in foods with complex carbohydrates.

Calories 🍭

When you consume food, you can also think in terms of how much energy the food provides. Energy consumption and expenditure determines weight gain or loss.

Nutrition is normally measured in kilocalories. Kilocalories can also be called Calories (with a capital "C"). To remove ambiguity, I will refer to it as a kilocalorie when necessary. A kilocalorie is equivalent to 1000 calories (with a lowercase "c") and 4184 joules. A calorie represents the energy needed to raise one gram of water by one degree Celsius.

Each compound you consume has a fixed amount of energy per unit mass. Therefore, you can derive your total Calorie consumption by counting macros. (In general, I recommend examining your macros first and then deriving Calories.) The amount of energy per gram of each nutrient is below.

Calories in and calories out will directly affect your bodyweight. If you consume a surplus of energy, you will gain weight. Otherwise, a deficit of energy means that your body taps into its reserves and loses weight.

Weight control is a relatively simple equation. However, don't treat calories as the most important metric. For factors like organ health and body composition, macronutrients matter as well. As an example, suppose you consume a limited number of Calories. All of those Calories come from foods with high saturated fat. You will not become physically fat. However, don't be surprised if your arteries clog due to high cholesterol.

Micronutrients 💊

Besides macronutrients, the human body also requires other compounds in relatively small amounts. These are the micronutrients, and they tend to be measured in milligrams. Due to their small quantities, they are not sources of energy. Instead, micronutrients usually act as catalysts for vital bodily reactions (such as bone growth).

There are two variants of micronutrients:

• Vitamins 🍊

• Minerals 🧲

Vitamins are organic compounds while minerals are inorganic. That's about the only main difference between the variants. In general, a balanced diet should cover all the necessary micronutrients.

Actionable Eating 🥦

Every human is different, so there's no one formula for eating. There are a few common traits we all share, however. The human body resembles a system striving to keep equilibrium. Thus any changes you make must stay consistent. Doing a diet may have some results in the short term, but as soon as you revert to old habits, your body follows suit. Your body will converge to match your actions.

To start off, set your desired trajectory. Your strategy should reflect your goals. It wouldn't make sense to tell a person trying to lose weight to have the same diet as a person trying to gain muscle. Notice that there are plenty of valid reasons to plan out how you eat:

• You'd like to lose weight.

• You'd like to lower your bodyfat percentage.

• You'd like to get stronger or gain muscle.

• You want to maximize your lifespan.

Figure out what you want first.

Running the Numbers

Human bodies vary a lot, so your caloric and nutritional needs may not be the same as mine. You'll need to establish some sort of baseline for yourself first. The two main baselines are basal metabolic rate (BMR) and total daily energy expenditure (TDEE).

Your BMR represents how many Calories the body burns just by living. Males and people with larger bodyweights will have a larger BMR. Your TDEE approximates how many total Calories you spend daily based on your BMR and activity level. (Generally, TDEE is more useful than BMR.) So if the number of Calories you eat in a day matches your TDEE, you should maintain the same weight. There are many TDEE calculators on the Internet. Pick your favorite and determine your TDEE.

With your TDEE in hand, add or subtract 100-200 calories, depending on if you're looking to gain or lose weight. Having a larger difference may cause unwanted side effects (such as muscle loss or fat gain). Note that over time, you'll want to periodically recalculate your TDEE. It will change if your weight changes. You now have your daily target Calories.

Next up, you'll want to calculate your macronutrient targets. It's best to start with protein. Aim to consume 0.7-0.8 grams of protein per pound of bodyweight. (You should also be able to derive your daily Calories from protein.) Around half of your daily Calories should come from carbohydrates. The remaining Calories in your "budget" will go towards fats. If you're looking to lose fat, it may be worth reducing your carbohydrate ratio and replacing it with protein.

At this point, you should know how many grams (and Calories) of each macronutrient to consume each day. Find the foods that will bring you to that target and enjoy! Prefer complex carbs over simple carbs and try to limit saturated fats.

Miscellaneous Questions

Below are some related topics that did not fit particularly well in any of the prior sections.

How do I find foods that will hit my macronutrient targets?

It may be helpful to think of eating foods as a system of equations. You cannot control the macronutrient ratio of foods, but you can how much you eat. A serving size on a nutrition label is arbitrary; you should decide the portion that's right for you.

Usually, the "cleaner" the food, the simpler it is in terms of macronutrient balance. They also tend not to have too much saturated fats or simple carbs. For example, wheat bread contains mostly carbs while chicken breast is mostly protein. Something like fried chicken will have weird ratios (and high saturated fat), making your calculations much harder.

What if I feel too hungry or too full?

Empty calories keep you hungry, forming a vicious cycle. Usually, cleaner foods should a lower number of Calories per unit volume. Therefore, it's easier to feel satiated if you're eating a high volume of clean foods.

Consider doing the opposite if you're feeling too full. Consuming liquids (e.g. a protein shake) also tends to prevent people from feeling full.

Do I really need to count calories? Isn't this overkill?

The proper answer is that it depends on your goals. If you're looking to win a bodybuilding competition, you should probably track numbers. If you generally want to get into better shape, it's not necessary at all. You should be able to learn to approximate things quite well without wasting much time. It's harder if you're eating at a restaurant, but don't worry too much. Your systematic habits will determine long term results.