My apartment assigns RFID key fobs for their doors and elevators. It’s a thick piece of plastic the size of a half dollar. There’s only one copy. I have mine attached to a keychain with my car keys and an AirTag, so I need to carry an entire key ring around, even if I’m not driving. As a result, more than half of my pocket space is filled with unnecessary items. That really put a wrench in my desire to be a minimalist.

So I began to wonder:

• Can I clone multiple copies of my apartment key fob?

• Can I have a functioning key in a better form factor?

Identifying the key fob

On the back of the key fob there’s an inscription that reads “M+ 2K.” That was a nice start. If we could identify the protocol the key fob uses, that could reveal how feasible it is to clone the key. (Older and broken protocols may have known flaws that allow you to exfiltrate any secret data without tampering with the physical key itself.)

Due to security reasons, iPhones don’t allow arbitrary NFC reading, so I had to use an Android phone and download an NFC app for that. Otherwise, identifying the protocol was as simple as scanning the key fob.

The app showed that the key fob used an NFC protocol called MIFARE Classic 1K. (NFC is a subset of RFID that uses a high-frequency band.) A quick Google search shows that that protocol is old and totally broken. Cloning the apartment key is feasible. The problem is that neither Android phones nor iPhones break the specific NFC protocol and extract its data, so I needed specialized hardware to make a clone.

Buying hardware

I needed NFC devices that I could use as my clones, and I needed something that would write my key’s data to those devices.

For my NFC writer, I bought a Flipper Zero. It’s a popular Swiss Army Knife for hacking around access control systems, and it has a cool dolphin mascot.

For my clones, I wanted key cards and wearable rings. Key cards could fit flush with credit cards in a wallet, and I could wear a ring without having to store anything in my pockets.

Buying blank key cards was simple enough. They were cheap on Amazon. NFC rings were a different story. The compatible ones were sold in random biohacking specialty shops, and they cost an arm and a leg. To make matters worse, I didn’t know my ring size, so I was reluctant to take my chances. I ended up buying from my friends overseas at AliExpress.

With the hardware in place, I was ready to start cloning.

Extracting NFC data

The Flipper Zero has a straightforward menu to read from an NFC device. However, I did need to install custom firmware so it could break the specific protocol on my apartment key. After that, it was a matter of waiting while it read the data from my key.

Unsurprisingly, most of the data within the key fob was set to default values. After all, it’s an apartment complex, not some secure facility.

Creating the clones

Writing the data was even easier than reading it; it’s almost instantaneous. Although I had cards and rings that could open my door, the form factor mattered a lot with usability.

The key cards work great, but the rings had a disappointing performance. It’s due mostly to the form factor. Rings are too small, and since the electric coil winds around the ring itself, wearing the ring interferes with the signal. I was only able to get the rings to open my door if I wasn’t wearing the ring.

Afterward, I kept using my original key fob whenever I was driving, and I’d use the key card otherwise. The ring was a neat gimmick, but it wasn’t practical, since I had to take it off every time I used it.

In the end, I’m down around $250, all in the name of saving some pocket space. At least I get to write this blog post about it.

Cal Newport’s premise is that knowledge workers are overwhelmed with competing obligations and interruptions. Stress is high and hours are long, but valuable output is low.

To address the trap of modern knowledge work, he presents the concept of slow productivity:

A philosophy for organizing knowledge work efforts in a sustainable and meaningful manner, based on the following three principles:

1. Do fewer things.

2. Work at a natural pace.

3. Obsess over quality.

I would add that the rise of hustle culture, LARPing, and AI slop cannons has not helped. If anything, these developments have glorified the idea of spinning your wheels with nothing to show for it.

I agree that knowledge work needs a reframing. Slow productivity isn’t about being lazy or wasting time. Rather, it’s a way to preserve your focus and energy, so you can go hard on the few things that matter.

For each principle, I’ll summarize Cal Newport’s advice and add my own thoughts.

Principle 1: Do Fewer Things

Strive to reduce your obligations to the point where you can easily imagine accomplishing them with time to spare. Leverage this reduced load to more fully embrace and advance the small number of projects that matter most.

Cal’s Propositions

• Limit how much you attempt to do. Have one main goal per day. Keep at most 3 missions at a time. (The fewer the better.)

• Protect your time. Automate or eliminate menial tasks. Throw money at the problem if you have to. Schedule your time. Do not let other people claim your time for free.

• Maintain a backlog of work and pull from it, rather than allowing new tasks to be thrust upon you. That way you only focus on what’s next on your plate.

Andrew’s Commentary

• Working smart beats working hard. My college days are an example: I spent more time playing League of Legends than I spent studying. But when I studied, I focused hard. Come graduation time, my stress was low, but my grades and career prospects were high.

• Everything has an opportunity cost. Stretching yourself too thin means nothing gets done. This is also the thesis of Essentialism: you should focus harder on fewer things.

• If you don’t prioritize, others will prioritize for you. The Eisenhower Matrix distinguishes between important work and work that’s merely “urgent.” Most incoming requests appear urgent but don’t actually matter. Have the discipline to say no.

• The advice matches the Getting Things Done system. The gist of it is to triage incoming tasks and focus only on what’s next. I use GTD in my own life and automate almost everything with Todoist.

Principle 2: Work at a Natural Pace

Don’t rush your most important work. Allow it instead to unfold along a sustainable timeline, with variations in intensity, in settings conducive to brilliance.

Cal’s Propositions

• Give yourself permission to take longer and miss “deadlines.” Your timelines should be generous enough to be clearly attainable. Most people tend to estimate that a project will take half the time it actually needs.

• Embrace seasonality in your schedule. Knowledge work is cyclical; you need periods of rest. So incorporate sabbaticals, schedule focus blocks, and modulate the intensity throughout your day/week/month/year.

• Curate your environment. Having a working space with good vibes makes a difference. Set rituals to connect and disconnect from work, so you can get in (and out of) a flow state.

Andrew’s Commentary

• “Work like a lion, not like a cow.” Progress is rarely uniform. Bursts of great work can accomplish more than consistent mediocre work. So you’re better off resting and recharging in service of doing your best work.

• Speed can compromise quality and long-term progress. If moving “faster” lowers the quality bar or makes you reckless, you may create more work—or set yourself back—in the long run.

• Unrealistic timelines lose credibility. It’s tempting to set aggressive deadlines to manufacture pressure. It might improve velocity, but if a goal is unrealistic, people stop taking it seriously. Why try hard when it doesn’t change the outcome?

• Procrastination isn’t necessarily bad. In Adam Grant’s TED Talk about the Warby Parker founders, Grant notes that strategic procrastination can buy time for ideas to incubate. The key was that they were quick to start but slow to finish.

Principle 3: Obsess over Quality

Obsess over the quality of what you produce, even if this means missing opportunities in the short term. Leverage the value of these results to gain more and more freedom in your efforts over the long term.

Cal’s Propositions

• Improve your taste. Invest time on the side to learn more about your craft (or the world in general). Similarly, build a community of like-minded individuals. A strong community helps you raise your standards.

• Reject perfectionism. Progress is what matters. Give yourself enough time, but don’t give yourself unlimited time.

• Bet on yourself and have skin in the game. Make your commitments public to maximize accountability. Be open to taking risks (both socially and financially).

Andrew’s Commentary

• Finishing projects is more important than starting them. Starting lots of things without finishing them accomplishes nothing.

• The world is becoming increasingly winner-take-all. Being incrementally better can yield disproportionately better results. As AI slop becomes more abundant, high-quality work becomes more valuable by comparison.

• “Hire people who give a shit.” There is something meaningful about taking pride in your work. Life is too short to wallow in mediocrity. My former boss wrote a blog post around this very topic.

Parting Thoughts

Most people get productivity wrong. “Hustling” or “moving fast” can create the appearance of progress without producing meaningful results. Therefore, it’s better to value output over input.

I don’t think that “slow and steady wins the race.” Rather, being hasty and reckless loses the race. Slowing down is not the same as wasting time, nor is it an endorsement of mediocrity. It happens in service of making better decisions.

Productivity is also a long-term game. Therefore, you must focus on process over outcome. Bias toward action, but be patient with results. Outsized results come from sticking with a sound process long enough for it to compound. Cal Newport himself frames it well:

I work hard almost every day. But those days are rarely hard to get through. The distinction matters.

I Saw the TV Glow

Over the first half of 2026, a disturbing thought started creeping into the back of my mind: I felt like I was waiting to die. Is that all there is to life? You live, you meander around, and then you die. It’s quite sad when you have nothing to look forward to and there’s nothing that makes you excited to jump out of bed. Being asleep feels like you’re dead, and being asleep feels quite cozy. Sometimes it felt like being buried alive.

This all reminded me of an indie film I saw back in 2024 called I Saw the TV Glow. Without spoiling too much, by the end of the movie you see the main character slowly suffer and deteriorate into a shell of his former self because he refuses to make an important life decision.

Being rational about it, my reaction was that waiting to die was…really stupid. Why do I feel this way? How do I change it? I’m sufficiently intelligent, and I’m blessed with the freedom to do whatever I want in life. There’s literally nothing physically stopping me from being happy.

After some introspection and feedback, the leading culprit was my geography. DC is beautiful. DC is clean. My family is local. But is staying the right choice for me?

• I can’t relate to most people in Washington, DC. Don’t get me wrong, there are many people here whom I absolutely adore, but they feel more like exceptions than the rule. I value people with high degrees of metacognition, agency, and intellectual curiosity—genuine people who seek to make the most out of their lives. You can find people like that in DC, but the density is low. It gets demoralizing after a while.

• It was hard to do fun stuff on a whim. DC is relatively walkable, but it’s still not enough. I compare it to a large suburb. The path of least resistance is to stay at home.

• The entropy is too low. During Covid, I moved back to the DMV to be closer to family. Family is important to me. But over time, I considered how it could be a cognitive blind spot. Is being local actually that important? How local is close enough? I could project out the rest of my life if I stayed in the area. I did not like the fact that it was easy to project.

I had tried living in New York City back in 2024, but I ended the trip early after being deterred by the hygiene of the city. I was looking for a nice, peaceful place back then. Over the next two years, my needs evolved. I wanted a bit more excitement, adventure, and energy.

So I figured “fuck it, let’s do an experiment.” And I booked my trip to NYC.

Arriving in the city

On the afternoon of May 28, 2026, I stepped out of Penn Station in Manhattan and hauled my suitcase down 9th Avenue. It was relatively humid that day, so beads of sweat quickly started to form on my head as I made my way into Chelsea. As I was walking, my Airbnb host sent me a welcome text and asked to do a quick FaceTime call. I was already a bit wary of the guy, since he tried to finesse me out of $200 for “cleaning fees” immediately after I booked the place, but I stopped at a quiet spot to take his call. I happened to be in front of an elementary school, so random parents walking their kids would shoot me dirty looks as I stood there awkwardly gripping a suitcase in one hand and an iPhone in the other.

A few blocks later, I arrived at the building where I was supposed to stay. It was a brownstone on a quiet street in Chelsea. I was dying to get some air conditioning, so I wasted no time punching in the door code and getting a roof over my head. Past the front door, I was greeted by a short hallway. And at the end of it was a set of stairs.

Lugging a suitcase up five flights of stairs was worse than the entire walk from Penn Station. The hall was narrow and the stairs formed a spiral, so it was hard not to bump the suitcase into the wall after every other step. After climbing a flight of stairs, you realize how little work you actually accomplished.

Eventually, I made it to my Airbnb. It was a charming studio that I definitely overpaid for. The place was a shithole by Arlington standards, but by NYC standards it was an opulent palace. Despite being objectively small, it felt quite spacious. I suspect it was a mix of the high ceilings and efficient interior design. The place smelled like curry, and the air conditioning kept buzzing. But I didn’t care. I needed to process my thoughts.

As I sat at the desk and stared into my laptop to “process my thoughts,” I began feeling antsy. I’m just looking at a screen and burning rent money. Think Andrew, think. What should I be doing? Simple: reach out to friends and stock the apartment. I gotta get groceries. I gotta cook and eat. (Spoiler alert: Andrew ate out every day in NYC.)

I trekked my way down to the corner bodega. It was literally next door. Amazing. The walk outside was shorter than the walk downstairs. The entire store consisted of two dusty aisles crammed together, and in the corner lay a tiny cat curled up on the floor licking its paw. I passed my overpriced ramen and toilet paper to the cashier and pressed “no tip” after tapping my card. They’re price-gouging me and expecting a tip? Maybe we need a communist grocery store after all. (Or I should have gone to Target.)

By then, only two hours had passed since I had stepped out of Penn Station, and the sun was still bright outside. It was also too early for dinner. So I figured the best thing to do at this point was to walk outside aimlessly.

Normally Andrew is a man on a mission, but today Andrew was a moth drawn to the flame. I didn’t have a destination in mind, so I just walked wherever felt natural. Sometimes that meant following the traffic, and sometimes it meant avoiding the crowds. Four avenues later, I found myself by Madison Square Park. Staring down 23rd Street, you could see the sun begin to set. Look at all these normies taking sunset photos, I thought, as I snapped a photo of the sunset.

Madison Square Park felt like a large adult playground: the interior resembled a well-shaded nature preserve, but you could see the city buildings looming beyond the edges of the park. Energy pervaded the park grounds. People packed the walkways as they paced across the park, yet there were just as many people sitting on the benches and just chilling there. A Shake Shack kiosk stood at the edge of the park and reminded me that I was getting hungry.

I ordered a burger and looked for a place to sit. The tables were all occupied. I wandered over to a secluded park bench and began munching on my burger. This is what being a hobo must feel like, I thought. And there were a lot of attractive, well-dressed hobos eating and sitting on park benches that day. As I scarfed down the remainder of my burger, a gust of wind blew my receipt into the nearby bushes. I considered leaving it for a split second before picking it up. I can’t litter on my first day here; there’s enough shit lining these city streets already. I tossed my trash and resumed my walk.

An extra hour of walking led me fifteen streets north to Bryant Park. An ambient energy radiated from that direction. At this time, it was dark outside, and the buildings were lighting up. An empty stage lit up the center of the park. There must have been a concert there a few hours ago, as volunteers were packing up the chairs. Despite the concert being over, the park was filled with people lounging on the greenery. It put me at ease. Seeing other people enjoying the moment reminded me that I didn’t need to rush.

So I stuck around in Bryant Park for a bit and soaked up the energy.

My last stop of the night was Times Square. It was the only planned part of the walk; you gotta make the pilgrimage on day 1. I expected a crowded tourist trap, and that’s exactly what I got. I pushed my way through a few crowds, watched some breakdancers perform, and pushed my way out of the cesspool. It was a quick foray, but I needed to check that box.

At this point it was legitimately getting late. I tried to avoid people as I made my way back to the Airbnb, but even the off-streets were littered with people. Like jeez, don’t you New Yorkers have work tomorrow? Or I suppose people in this city have lives outside of work. I had never felt this much energy outside on a Thursday night. It was like the city was a living, breathing creature. And somehow, I felt a little bit more alive myself.

Eventually it got quiet as I reached the block of my Airbnb. While walking back, I reflected and tried to make sense of the day. This place is a bit weird, but I’m choosing to be in the middle of this weirdness. I paused before the steps of the brownstone, still lost in thought. Is this what living feels like? Only then was my trance broken as two rats scurried past me into a big bag of trash. Welcome to New York.

(Note for those who read to the end: I originally planned to write multiple vignettes from the month, but the blog post is long enough as-is. I’ll probably share more stories across multiple blog posts.)

Most party etiquette is never stated out loud. People are expected to just “get it.” This post is my attempt to spell out the unspoken rules.

How to be a good party guest

Key observation: Good guests consider the experience of other people in the room, not just their own.

Support the room

• Adopt a “host mentality,” even though you’re a guest. Your goal is to make people feel comfortable and welcome. That’ll make it easier to mingle with people, because you know that you’re helping add value.

• Talk to people you don’t know. Not everybody knows each other. You may be helping someone who’s shy or lonely break out of their shell.

  • It’s natural to assume that everybody else already knows each other. That couldn’t be further from the truth. Usually most people know a tiny subset of the other people in the room.

  • You’re already a second-degree connection with everybody in the room. You both know the host. “How do you know the host?” is a really easy icebreaker.

• Try to show up reasonably on time. On the other hand, don’t overstay your welcome.

  • Hosts appreciate those who show up early, as early birds can help bootstrap a crowd.

  • Staying too late isn’t ideal (especially if you’re not helping out). You basically turn into a liability, and the host eventually has to shepherd you out.

  • If you arrive early, help set up. If you stay late, help clean up.

• Under no circumstances should you make anyone feel uncomfortable. If someone isn’t interested in talking to you, then move on and talk to someone else.

Bringing a +1

• If you know the host, try to bring a +1 that the host doesn’t know. Bringing a great +1 is the greatest favor you can do for the party.

• Unexpected +1’s can put an unwelcome burden on a party, so be careful. The host bears the downside consequences of having bad guests. They’re trusting your judgment when you bring a +1.

  • Bring someone you know and trust. Don’t bring an acquaintance who “ought to get outside more and make some friends.”

• If you don’t know the host, don’t bring a +1 (unless it’s your partner).

• Don’t bring a +2. Or at least ask first.

Pay respects to the host

• Find the host in person and at least thank them for hosting. This is especially important if you don’t know the host well, as it’s your chance to introduce yourself.

• The day after the party, thank the host over text.

• If you can’t make the party, let the host know and thank them for the invite. Never flake. Showing up is half the battle. And if you must flake, be sure to update your RSVP accordingly.

Final thoughts

• If you’ve never hosted before, this is your message to host something! Being a host is the best way to learn how to be a great guest.

• If you’re self conscious about whether you’re a good guest, you’re probably a good guest.

• All of the points above especially apply if you don’t know the host. Most social etiquette is made up of unspoken rules, so this is one big test of social awareness.

How to be a good party host

Key observation: Parties are a repeated game. Good guests attract more good guests. Bad guests drive away good guests. Over time, those effects compound.

Be a super-connector

• Do your rounds. Make sure people feel comfortable. The party is for your guests. Today you are providing value.

• Make it easier for new people to talk to each other.

  • Actively introduce people who don’t know each other, especially if you think they’d get along.

  • Consider making everyone wear name tags or doing introductions/ice breakers.

• Follow up after the party. Thank your guests.

Curate the crowd

• Don’t do open invites.

• Invite people you don’t know well but would like to know better. They don’t have to be your “friends.”

• Don’t feel obligated to invite people, even if…

  • …they were previous guests.

  • …they’re friends with your friends.

  • …they explicitly ask you to be invited.

  • …they didn’t do anything wrong explicitly, but your gut tells you not to.

• Ask people you trust to bring +1’s. (See the +1 etiquette from the previous section.)

• Try to maintain a balanced gender ratio. Skewed ratios can impact perceived safety/comfort, which will also affect future attendance.

Trust in your guests

• Trust in your guests. They’re adults and will figure out how to have a good time. So treat them like adults and don’t feel pressured to micromanage.

• Delegate work. Multiple pairs of hands makes things exponentially easier.

  • The very act of delegating “work” during a party becomes a way to get people to ease in and can be a good excuse for people to mingle.

• Be sure to take care of yourself. Eat and hydrate properly. If you need to take an “introvert break,” then do so! You are doing a service for all the people in the room, so you need to make sure your needs are also being met.

Final thoughts

• The day after hosting a party, be sure to rest and recover. Pay attention to your emotions and take time to reflect.

• Remember that you are doing a service for all the people in the room. Give yourself some credit.

• It’s not the venue or events that matter; it’s the people. The people set the vibe.

I kept revisiting this thought experiment because it applies to life in general. Your life is a startup; it can crash and burn. So I repurposed it into a recipe for how to live.

All you need to do is ask yourself a similar question: in my life, what would fail if left on autopilot?

Boiling the frog (you are the frog)

Major failure modes in life come from boiling the frog: you don’t notice the problem until it’s too late. Imagine what your life looks like 10 years out. Some areas will be fine, but others area will suffer. If you were to change nothing, where does your life go?

Some things in life feel like a big deal right now but aren’t actually important. Conversely, the real priorities can be a big deal later while barely being noticeable in the moment. But you should focus on them now.

Why do important life domains rarely feel like a big deal in the present? Because they either compound, or they expire.

Compounding Domains

• Finances: Money can snowball in either direction. Crippling debt can keep you trapped for the rest of your life, while smart financial habits allow you to retire early. You don’t want to be the recently-laid-off 60-year-old with a mortgage and no savings.

• Physical health: Muscle growth peaks at a relatively early age and slows down. The same happens with agility. Your physical fitness influences your longevity, and improving your fitness becomes harder when you’re old or unhealthy. The best way to be healthy when you’re old is to be healthy when you’re young.

• Friendship: Quality friendships are key to wellbeing. But friendships atrophy and drift apart because people are too “busy,” and people complain that it’s hard to make friends as adults.

Expiring Domains

• Dating and marriage: Dating gets harder as you age. On average, people become less attractive and more set in their ways. Fertility goes down, and it becomes harder to meet people. Yet who you partner with is arguably the most important decision of your life.

• Travel and experiences: You may not have the ability to travel later in life. This may be due to physical health, energy levels, or from other life obligations. So do it while you can. Money is fungible; experiences less so.

• Geographic optionality: Avoid putting down roots until you’re confident you want to stay somewhere for the long term. Homeownership is often treated like a checkbox rather than a choice. Far too often, people never move (or stay in their hometown), which closes off many opportunities.

None of these feel urgent in the moment, but they are. By the time it’s obvious, the ship has already sailed. That’s why it’s important to be vigilant of these failure modes while they don’t feel like a big deal.

What should you be doing right now?

1. Identify parts of your life that are operating on autopilot. Which ones are projected to fail? The parts of life that fail on autopilot are where your attention is most needed.

2. Select the highest priority part of your life that’s on track to fail. You can only really fix one or two things at a time. When prioritizing, ask: What will expire soon? What will compound the most? What will be hard to reverse?

3. Focus your attention on the most important “autopilot failure mode,” and intervene until you’re happy with its trajectory.

4. Systematize that part of your life (i.e. build good habits) so it won’t regress the moment you divert your attention elsewhere.

5. Repeat the process.

Another way to describe this is to “find the ticking time bomb and defuse it.” Most lives don’t fail in the conventional sense. They just pass by until options quietly disappear. So your job is to notice what won’t fix itself and act before it’s too late.

It’s not for day traders or people trying to gamble. It’s not for people struggling to live below their means. There are plenty of resources for you, but this is not the correct place to look. You’ll need a fair chunk of cash to implement the contents of this blog post. If this ain’t you, stop reading!

Here’s the situation I see way too frequently:

• You’re a (relatively) high earner who lives well below your means.

• You’re probably sitting on a pile of cash in a high-yield savings account, and you probably have a concentrated position on a single company’s stock (i.e. your employer).

• While you’re not in financial trouble, the lack of a strategy makes you nervous about the future. You want a simple, idiot-proof, low-maintenance strategy that just works.

Fortunately, it’s not that hard.

The strategy

1. Calculate and save up an emergency fund (3-6 months of expenses). Keep that in a high-yield savings account.

2. Pay off any remaining debts.

3. Figure out if you’ll need a lump sum of cash in the future (e.g. to buy a house).

4. Max out your tax-advantaged retirement accounts (e.g. 401k, HSA, mega-backdoor Roth).

5. Chuck any surplus cash into a taxable investment account.

6. Go touch grass.

Hopefully the first three steps should be simple enough. Usually it’s the investment part that trips people up. (“Where do I put my money? What do I buy?”)

What do I do? Where do I put my money?

Prioritize contributing to retirement accounts because of the tax benefits. Understand how much money you need for spending and how much you have to spare for investing. Then it’s time to click some buttons.

401(k)

The first place you’ll want to put invest is into a 401(k). Max it out. You’ll probably get employer matching. It’s free money.

You should aim to max out your 401(k) every year. That’s around $24k of contributions per year at the time of writing. Any contributions to the 401(k) must come out of your paycheck, and you typically configure the contribution amount/percentage via your brokerage.

How you spread out your contributions is up to you. What matters is that you max out the account by end of year. Personally I try to max things out as quickly as possible: at the start of the year, I hold on to some cash and then contribute 100% of my paycheck until the retirement accounts are maxed out.

“Should I contribute to a pre-tax 401(k) or Roth?” I’ll be honest, it really doesn’t matter. Flip a coin. Or if you’re too lazy to flip a coin, just pick Roth. The difference in the long run is minuscule and situationally dependent. The math needed to figure out what’s optimal for you isn’t worth the time, in my opinion.

Mega Backdoor Roth IRA

Maxed out your 401(k)? Great job! If your employers supports the mega backdoor Roth IRA and you still have money from your paycheck that you don’t plan to use, you can continue to contribute parts of your paycheck up to the IRS limits.

I’ve written about the mega backdoor Roth IRA previously, so I won’t harp on it too much here. Just make sure it’s actually offered by your employer, and make sure you have the money to spare. As of the time of writing, it’s an additional $35k of contributions after maxing out your 401(k).

Unlike the 401(k), contributing to a mega backdoor Roth isn’t for everyone. There’s no employer matching, and the limit you can contribute is quite high. Do not max out a mega backdoor Roth IRA if you expect you’ll need that $35k within a few years.

HSA

It’s a bit less obvious, but a Health Savings Account (HSA) is a tax-advantaged investment account. I recommend young and healthy people opt for an HSA if possible. You can contribute money from your paycheck into your HSA. Your employer probably contributes money into your HSA as well.

With your HSA money, you can spend it on medical expenses, but you can also invest the money. If possible, max out your annual HSA contributions, and set it to auto-invest. Even if you don’t expect to get sick, it’s a great avenue for future medical expenses. And transferring an HSA to your children doesn’t get taxed, so you can really stick it to Uncle Sam.

A side note on HSAs: if you have medical expenses, prefer to pay with “normal” money rather than withdrawing from your HSA. You should be careful about taking money out of a tax-advantaged investment account. You won’t get an opportunity to put it back in.

Taxable accounts

You’ve maxed out your 401(k), the mega backdoor Roth, and your HSA. And you still want to invest more? You absolute stud! Maybe you can just Venmo me the extra money instead.

On a more serious note, you don’t want to hold surplus funds as cash for too long. Open up a brokerage account. Any will do. I recommend a large brokerage with a shit UI. The shittier the UI, the less tempted you are to fuck around. Brokerages with nice UIs encourage you to constantly look at your money, which is a recipe for doing something stupid and ruining years of compounding.

Vanguard, Fidelity, and Schwab all work great. If you already have an employer account with a broker, it’s easy to open up a personal account with them too. (For example, Google employees might prefer a Schwab account, since that’s where their stock goes.) Interactive Brokers also works, but its UI is too shit, even for me. Avoid Robinhood; its UI is too nice. M1 Finance is fine (because of their auto-rebalancing features), but be careful since their UI is nice. Most importantly, use my referral codes so I can afford guac on my Chipotle burritos.

Investing: what do I actually buy?

Investing is important. If used correctly, money compounds. When it comes time to retire, you want to live off your compounding nest egg. Compounding takes time, so try to invest as much as you can as early as you can.

The two greatest mistakes in investing is (a) taking too much risk and (b) not taking enough risk. Understand your personal risk tolerance. The Bogleheads and Reddit /r/personalfinance wikis are great starting points for further reading.

Here’s what you do:

1. Pick a low-cost, diversified index fund (or funds).

2. Put your investment cash into said fund(s).

3. Periodically deposit more funds into the portfolio and rebalance as necessary.

What’s in Andrew’s portfolio?

In Skin in the Game, Nassim Taleb made a great quote about investing advice. “Don’t tell me what you think, tell me what you have in your portfolio.” Here’s what I have in my portfolio:

I hold IVV/EFA/DMBF with a 50/50/50 allocation. Three positions. That’s it. All equally weighted. My taxable portfolio is 1.5x leveraged (hence it’s not a 33/33/33 allocation). For every two dollars I have, I borrow one dollar on margin. Do not take leverage if you don’t know what you’re doing. Taking leverage can fuck you and kill decades of progress. You can get by just fine without leverage.

For my tax-advantaged portfolios, it’s a lot simpler. I just go 100% in the S&P 500. No leverage. It’s all auto-invested. My two investment accounts are my 401(k) and my HSA. In my 401(k), the portfolio is completely in Vanguard’s S&P 500 proxy. In my HSA, the portfolio is completely VIIIX, which is some other S&P 500 proxy. The exact fund doesn’t matter: VOO, IVV, or some other S&P 500 proxy will all have 99.9% correlation. These were not deliberate strategic decisions on my part; I just picked whatever S&P 500 proxy was available.

Why do I do what I do?

• I have a stake in both domestic index funds and international index funds. Having exposure to both domestic and international equities obviates the need for bonds.

• I have a stake in a managed futures strategy as a hedge in situations where equities perform poorly.

• I leverage 1.5x such that I magnify returns without suffering from volatility drag.

• For my retirement accounts, my position is much simpler because retirement accounts can’t take leverage. (Also I have a financial advisor managing my taxable account, and I’m too lazy to do anything fancier for my retirement accounts.)

Don’t blindly copy me. I’ll give you suggestions in the next section. If none of this made sense to you, don’t stress out.

Recommended example portfolios

In my examples, I’ll use VOO to represent the S&P 500 (i.e. domestic) index and VXUS to represent the international index. There are many funds that track the same index, so when you buy for yourself, you don’t need those exact ticker symbols.

I present to you the 1-fund portfolio and the 2-fund portfolio:

• The 1-fund portfolio: 100% in VOO

  • So simple! You literally can’t go wrong with this. The S&P 500 is already super diverse.

  • In your retirement accounts, you can opt to go for a target retirement date fund as well. It doesn’t really matter.

• The 2-fund portfolio: 50/50 in VOO and VXUS; equally weighted

  • This is good if you want international exposure.

  • This is also good if you want to scratch that itch with having more than 1 position in your portfolio.

  • Why have a 50/50 allocation instead of 60/40 or something else? Because 50/50 is simple. People will debate all day about whether to hold more domestic or international equities. Don’t waste your time, and instead go for a “good enough” portfolio.

Did you expect something more complicated? I sure hope not. These are set-it-and-forget-it portfolios that will make you a very happy camper over a long time horizon.

It’s hard to go wrong since you’re sufficiently diversified. Diversification is the only free lunch in investing. Do not take leverage. If you find this blog post informative, you’re not ready to handle leverage. Your goal is the match the index, not beat it. The best strategy to match the index is to buy the index.

Maintenance

Investments into retirement accounts should be fully automated. Contributions will come straight out of your paycheck. You may need to adjust contributions once a year, since IRS limits change and health insurance policies change.

For personal investment accounts, try not to mess with it too frequently. (Every month or quarter is perfectly fine.) Ideally you rebalance around the same time you get a cash infusion (e.g. every other paycheck). When rebalancing, buy positions in your portfolio that are underweight; try to avoid selling overweight positions. Most brokerages have some form of auto-investing that will track a target portfolio allocation. So ideally, you’ll have to do very little manual decision-making in general.

If a part of your compensation is in company stock, sell the stock as soon as it vests and reinvest the proceeds. Some companies offer auto-sell programs so you only need to handle reinvesting the cash. I know of many people who are hesitant to sell company stock. It’s a rabbit-hole of a debate, and I won’t go to deep into it. If you had the cash, would you buy back the stock? If not, then you should diversify. Furthermore, you organically incur concentration risk with your employer, even without the additional concentration risk from holding too much of a single stock.

At this point, everything should be automated and diversified. Great! Pat yourself on the back. Now we proceed to the most important step: STOP THINKING ABOUT INVESTING and go touch grass. Money is a means to an end. You’ve set yourself up for success. Now go live a good life.

1. I used Antigravity to set up a website with interactive demos.

2. I used OpenClaw to manage my self-hosted services.

3. I used Claude Code to organize my BJJ notes.

Each of these were done within a day. I did minimal typing, and it was mostly free. Here are my experiences.

ClickFix.fyi - Antigravity

At work, I’m working on mitigation of the ClickFix scam. While there are various news articles about ClickFix, there’s no centralized informational site about it actually is. So I vibe coded an informational site in a day or so.

It’s called ClickFix.fyi. Curious about what ClickFix is? Well now you can visit the site!

By nature of it being work-relevant, I used Google Antigravity. It’s great. You just tell it what to do. I wanted a static site, so it made a site using Astro. I don’t know Astro, but it doesn’t matter. I just told it what to do; I didn’t even review the code. It was awesome. It can even generate images and interactive demos.

At the time, I was on the free tier. I used Claude models first, but the quota burned out almost immediately. Not surprising, I guess. But the Gemini quota was surprisingly generous for a free tier. You can work through an entire project without having to worry about running out of quota. (Though the caveat is that once you run out of quota, you’re kind of fucked because you have to wait a week. On paid plans it’s a lot better.)

VM Management - OpenClaw

Coding is great and all, but what happens when you give AI real power? OpenClaw has been all the hotness recently, so I wanted to test it out.

The first step? Get a free VM. Oracle Cloud has a free tier that’s quite generous. You can get a 4-core machine with 24GB RAM on their free tier. The only caveat is that it’s an ARM machine. But honestly that doesn’t matter. I like self-hosting random shit by myself, so having a free beefy machine is great.

With OpenClaw, the real limiting factor is the model itself. It doesn’t require much compute otherwise. So if you self-host a model, you’d better have a lot of GPU compute. It’s better to pay $20 for a Claude ChatGPT subscription. Then you can run OpenClaw on a toaster. (You shouldn’t be buying a Mac Mini unless you have a specific reason. The correct way to go is to have the Gateway on a VM and add your local Mac as a node.) I set a Telegram bot for my OpenClaw instance, and then it was easy to chat on the go. And all of this was (mostly) free.

And goddamn, it was quite nerve wracking. While setting up, I asked the bot about OpenClaw configs. I was expecting answers and links to documentation. Instead it directly modified its own configs. Eventually I gave it access to my GitHub so it could back up its own data. And it did all of that with minimal prompting from me. So far it’s been doing a great job, even though it’s scary, since OpenClaw can basically pwn my GitHub if it goes rogue. While the blast radius is still limited, I lack the proper failsafes, yet I’m also eager to expand its access so it can do more.

Obsidian BJJ Notes - Claude Code

As a Google shill, I’ve been using Gemini CLI at work. But I paid for Claude, and I wanted to try out Claude Code and get value out of my subscription. But Antigravity was good enough for my coding projects; I didn’t have any other project out of the blue to work on. Then it dawned on me that I didn’t need to use Claude Code for code.

I have an Obsidian vault for all of my notes. It’s all markdown files. The vault contains my journal and also random notes. Of those notes, I have a folder for BJJ. Historically I’ve kept raw notes around every class. Those raw notes have never really been synthesized into anything deeper than that. For those who do BJJ, you’ll know that positions in BJJ resemble a flowchart: you transition into different positions depending on what happens. Obsidian is great for back-linking: a page can link to another page quite easily; it matches the graph-like nature of BJJ.

It’s quite nice. Claude asked how I’d like the notes organized, and we had a relatively nice back and forth. Then it took my raw notes and put everything into its own page. At this point I feel like Claude is the real BJJ expert here. All I had to do is go to sleep and let the AI cook.

I will note that volume (not complexity) might be the bottleneck for AI. I ran out of Claude quota (on a paid plan) and had to wait five hours before resuming the job. The organization of the positions isn’t inherently complex; it’s just a lot of work, and it’s a lot of notes.

Conclusion

So what did I learn from all of this?

• AI is pretty good at this point. As you get more comfortable, you should give it more agentic/destructive permissions. Don’t just use it for coding.

• Using AI doesn’t necessarily save you time. If things aren’t sufficiently clear, it will fuck up.

  • This is especially bad if you have the “stare-and-wait” workflow, where you sit there like a ding-dong and as the AI does something. That doesn’t save you any time; if you do that, you’re better off manually coding. The important part is that you give the AI the info it needs and then you leave to do something else.

• Laziness is a virtue, so long as you outsource the work that doesn’t require your judgment. For a lot of this work, I could have done it myself (albeit slower). So it’s perfect for AI. But for other things that I didn’t know (e.g. Astro), I didn’t learn shit, and I wouldn’t be able to maintain the website without the help of AI.

• Quota (for both free and paid tiers) is scarce but pretty reasonable, in my opinion. The value you get from paying is far greater than the monetary cost. Lots of people have subscription fatigue and aversion to paying for software, but that’s a mistake. You should index on the value you get from your expenses.

• Regarding security, I need to have a better plan. It’s not a bad idea to give AI more intrusive permissions. Being a chicken gets you nowhere. But there is the real threat model of an AI going rogue or making an honest mistake and fucking everything up. For example, in my case, the biggest risk is that Claude nukes all of my GitHub repositories. Not the end of the world, but it’s still pretty bad. Realistically, I don’t want to revoke those permissions, but I do need a reliable failsafe. In my situation, I suppose it should be some form of killswitch to disable the VM hosting my OpenClaw gateway.

I was in San Francisco for the summer interning at Dropbox. Dropbox has quite the drinking culture: every other weekend, the entire intern cohort would squeeze into a tiny apartment, stock the place up with beers, and play drinking games all night long. The world would get fuzzier as I became progressively more inebriated, but I enjoyed the process since I was having so much fun.

It was an abrupt introduction to alcohol. I recall my last day in SF that summer: the morning of my flight, I stumbled my way to the airport hungover and half lucid. I have no clue how I got back home in one piece.

After graduating college and moving to the Bay Area, I drank infrequently, but whenever a social event had alcohol in the picture, I had a bad habit of drinking too much. There’s a joke that one drink is just right, two drinks is too many, and three drinks is not enough. That embodies how I handle my limits.

I’d take a shot of tequila, feel nothing, and pound a few extra shots since “nothing was happening.” Some time would pass and as I became less lucid, I’d utter a few regrettable remarks and forget how the rest of the night went.

You have to cut me some slack. I was an impressionable person in my early 20s. I wanted to fit in and have fun, and alcohol seemed like an easy way to socially blend in.

Then COVID hit. I left the Bay Area and I had a bunch of time alone to reflect on how I wanted to live my life.

Why did I quit?

The fact that I didn’t know my limits was bad enough, but I would come to realize that the act of drinking was already pretty bad. Bad enough that I concluded that this needed to stop.

I was slowly killing myself…

I’ve blacked out more times than I’d care to admit. If you think about it, being drunk is quite terrifying. Parts of your brain turn off. You lose control of your thoughts, despite trying your hardest to stay lucid. It’s as if you’re thinking someone else’s thoughts. It’s how I imagine dying feels; it’s totally different from falling asleep.

I realized that every time I got drunk, I was slowly killing myself. It’s scary when you can’t recognize or trust your own mind.

…for literally no good reason.

The stupid part is that I never even enjoyed drinking. I only did so at social events when alcohol was freely available. The tech industry in Silicon Valley has a drinking culture, so it’s actively tolerated, if not encouraged.

I drank to fit in and trick myself into having fun. But the truth is that I wasn’t having fun. By drinking for social validation, I was living someone else’s life. It wasn’t a real choice of mine, and deep down I didn’t want to live my life pretending to be someone else.

How did I stop?

It was pretty easy, actually. I made a declaration to myself to pause all drinking for 5 years. After that duration passed, I’d give myself permission to reevaluate. At the beginning, it was remarkably easy to enforce, since it happened during the COVID lockdowns.

Otherwise, I employed a few identity/mindset shifts:

• I can have fun and fit in without alcohol. Alcohol doesn’t make you braver; it makes you stupider. Alcohol doesn’t build social status; it reduces your social awareness.

• It’s more important to be high-agency and make my own independent decisions, rather than “going with the flow.”

• I want to prove to myself that I can say no to people. If you only go on autopilot, you’re nothing more than an NPC.

• I don’t want to destroy my body and my mind. That prospect is scarier than any perceived benefits of alcohol.

With the proper mindset, it became easy to just stop drinking. Whenever I was at a bar, I’d just have a mocktail. At parties, I’d simply socialize while sober. For me, this was all mental.

Miscellaneous thoughts

• My life is better, and my mind is definitely clearer. Avoiding alcohol is arguably just as important as writing, when it comes to being a clear thinker.

• Quitting alcohol has definitely tested (and validated) my ability to resist social pressure and take ownership of my choices.

• You can definitely have fun without alcohol. If anything, it’s quite amusing being the one sober person in a room full of drunk people.

• People are remarkably respectful of my choice not to drink. For that I am grateful.

• Scott Galloway has an interesting perspective around society’s shift away from alcohol. His claims that the pendulum has swung too far against alcohol (“the worst thing that’s happened to young people is the anti-alcohol movement”) and pushes for people to drink more and make more “bad decisions.” Otherwise the loneliness epidemic persists, and young people aren’t pushed to take social risks. As a chronic over-thinker, I believe he does have a point. Is the trade-off worth it? For now, I’m still a teetotaler, but I do need to take this into consideration.

• 2024

• 2023

Ever since I’ve begun writing these year-in-review blog posts, there’s been a looming pressure to one-up the previous years. 2025 felt like a relatively tame year in comparison to the past two years, and I’ve made my peace with it. The first half of the year felt like a blur, but it did get better in the second half. And throughout 2025, a fair bit happened:

• I got my blue belt in BJJ and competed for the first time.

• I gave me first external conference talk.

• I spent a month in Asia, and I visited Taiwan and Japan for the first time.

Overview of the year

I started the year feeling aimless. In 2024, I had moved and switched jobs, so I felt I should take a bit of a breather. But when you don’t have a goal, you’re usually quite passive with your time.

It felt like the first half of the year went to various one-off social events. I barely remember them, and I have little to show for it. Fortunately, external goals and obligations with a strict deadline (e.g. preparing for a BJJ competition and travel) forced me to snap out of it. Then the year started to pick up.

Brazilian Jiu-Jitsu

Around May, I decided to sign up for a BJJ competition. I trained for a while, but I never competed before. Nor was I comfortable fighting under pressure. So it was about time to give it a try.

I started increasing the time I spent on the mats and reduced my focus on other areas of life. Around two weeks before my competition, I dislocated my toe in training. It wasn’t bad enough to change any plans, but I did literally end up limping my way into the competition.

There’s a night-and-day difference between competing in BJJ and normal sparring. Someone is going at you 100% unhinged. Your adrenaline goes through the roof, and your field of vision decreases. And after a match, you find yourself completely gassed out. But you learn a lot. You notice what works and what breaks down when you’re under pressure.

I competed a second time shortly afterwards. That one forced me to deal with loss. It’s a rare and interesting emotion you feel when you drive an hour to some random sports center, lose in a single-elimination bracket, get handed a participation trophy, and stand on a podium to get your picture taken while wearing said participation trophy.

Later in the year, I got promoted to a blue belt. Honestly nothing changed, except the color of the belt.

BJJ really is a lot of fun. I enjoy it a lot, and you should try it out if you haven’t already. Next year, I plan to begin training Judo in tandem with BJJ, as I’d like to learn how to grapple while standing.

Career

It was a turbulent year at Google. My manager left early in the year, then layoffs happened, then Privacy Sandbox became defunct, and then came a giant reorg that dragged on for months. I’ve been at startups before, I’m used to volatility at work. It’s just unexpected for a company of this size. But Google’s stock price has performed well this year, so I’m happy.

On a less tongue-in-cheek note, things are picking back up at work. The reorg has been settling in a reasonable manner.

Halfway through the year, Meta “acquired” a 50% stake in Scale AI for around $15 billion. As a result of the deal, shareholders were paid a one-time dividend. It was a pretty neat experience shared between me and my former coworkers. Startups rarely have an exit, and Meta acquisition was certainly unexpected.

In the back of my head, I’ve had a desire to give conference talks. After coming back from Defcon this year, I was inspired to actually do it. After preparing proposals and slides, I spoke at 3 different conferences this year. Speaking is a lot of work: you do a bunch of preparation that culminates in an hour-long presentation. But it’s fun and I glad I did it. It’s a nice way to share my work outside of the workplace.

So how would I summarize this year career-wise? Pretty good, albeit unexpectedly adventurous.

Travel

Compared to previous years, I didn’t travel much. Or rather, I had fewer trips. I definitely had my longest trip abroad this year.

In August, I went to Defcon in Las Vegas. That’s been an annual tradition for a while now. Though this year, there was a speaker who gave a talk on Privacy Sandbox: it was cool to see someone external talk about my project at work.

For most of November, I was abroad in Asia. I was going to a conference in Kobe, Japan. But since I was already in Asia, why not stay for a while?

I started in Kobe, where I was mostly working. The rest of the month was a long vacation: I went to Taipei, Beijing, and Tokyo. It was my first time going to Taiwan and Japan, and I’m glad I fit so much into a single trip. A month in Asia is a long time, so I can’t really describe the details in a blog post. Needless to say, it was ton of fun, and I’m glad to be back home after being away for so long.

What’s next?

The big lesson I want to take into 2026 is to avoid aimlessness. You must always have a goal in mind and something to work towards. It’s better to have a bad goal (and later switch to a better goal) than to not have any goals at all. Why? There’s no pressure to change when you’re aimless, and a lot of time can fly by before you “wake up.”

So how do I want to go about 2026? The theme is to be dialed in. Tyler Cowen pioneered the idea of having a personal production function. Most people are consumers, not producers. I’d like to be the latter.

• For example, I didn’t publish any blog posts (besides my annual reviews) this year. I’d like to change that. One blog post a month seems like a reasonable minimum.

• I should be more aware of what’s going on in the industry outside of work. That means being an active member in external communities and opportunistically speaking at more conferences.

• It’s important to have some side project to tinker on at all times, no matter how silly. For instance, I’m currently learning how to clone apartment keys. It doesn’t have to be ambitious, it just needs to exist.

• And of course, I’d like to start learning Judo and be consistent with it.

Happy new year!

Miscellaneous learnings

On human nature

• People don’t know what they want, and they’re quite receptive to what you want. So be clear with what you want, and go for it. (Corollary: the squeaky wheel gets the grease. I mean this in a positive way. People are usually happy to help you.)

• I’m quite likable as a person. At least in the long term. Though I don’t give the best first impressions, since I’m robotic. The solution to this seems to be to just own it and be clear if I’m joking around/being sarcastic. (People are bad at recognizing sarcasm.)

• Be approachable. Approach people. Most people are chicken, so you should minimize friction for them.

• I used to say that courage is the limiting resource, not intelligence. Though I still stand by that statement, I think it’s actually agency that matters. Courage is more of a means to cultivating agency. Be as high-agency as possible.

On progress

• What has taught me the most and the fastest is doing reps, reps, reps.

• There truly is no perfect time to start. Excessive waiting doesn’t beget any benefits. The first half of the year was less interesting than the second half because I was just waiting around. (Note that this is not the same as “precrastination.” Quickly workshopping solutions in your head is a useful skill.)

• Do not be aimless. Have a bad goal is better than having no goal. You must be in the driver’s seat of your life, or else you’ll be dragged around, and time will just pass you by. Your attention is precious and limited.

On mortality

• My life is pretty good. Like really freaking good. So when things don’t go my way, I shouldn’t be all that sad when putting everything into perspective.

• When managing finances, there are three states of being: rich, broke, and dead. Your life expectancy plays a huge role into how much you can and should spend.

• Most things are just a means to an end, and you probably think otherwise because of your ego. Go to work and make money; your career isn’t a reflection of your value as a human. Apologize to others if you’re wrong; avoiding a moment of embarrassment isn’t worth a lifetime of regret.

On human relationships

• There will be times that tempt you into exhibiting toxic behavior. Resist the urge; do not be toxic. Ever. On the flip side, you must have zero tolerance for toxic behavior from others.

• Deal with interpersonal issues as soon as possible, even if they feel too small to be worth talking about. If problems grow and fester, it’ll be too late. Better to nip it in the bud.

• And the biggest learning of the year: accept people for who they are. Just because you don’t vibe with someone doesn’t mean you’re broken or they’re broken. It doesn’t mean anyone did something wrong. Different people want different things, and you don’t have to change people. So you must learn to accept others (including yourself) for who they are, not what you want them to be. Then it becomes easier to appreciate the hidden beauty within everyone.

Links to my previous year-in-review blog posts:

• 2024

• 2023

"All models are wrong, some models are useful."

- some autistic statistician, probably

I like to receive advice. Hearing others’ perspectives expands my own thinking, and it's a helpful tool. What's not to love? But after listening to enough advice, you realize that not all advice is created equal. Even "good" advice shared with the best of intentions can send you down the wrong path.

When receiving advice, it's risky to listen blindly. The quality of your filtering mechanism decides the impact that advice has on your life. I would go so far as to say that the act of receiving advice well may be equally as difficult as giving good advice.

Pitfalls with “good” advice

If I were to compress all problems with advice into a phrase, it would be that context matters and incentives matter. Advice is not universally true, and true advice is not universally useful.

Advice is context dependent

What works for others may not work for you. People tend to share what worked for them and what they think is true. Unfortunately that guarantees nothing.

Take for example, the common advice to "just be yourself." It's not universally true and can even be destructive. Self-conscious people might benefit from being themselves, but delusional people will not. The receiver matters.

• Corollary: Advice is vulnerable to the XY problem. If you give advice, are you addressing the core issue or some different-but-related problem?

• Corollary: Smart people can give stupid advice. Don’t assume smart people are infallible. Nobody knows your personal situation as well as you do.

• Corollary: Confidently-given advice warrants skepticism. Confidence is either backed up by evidence or delusion. Unless someone else knows the nuances of your life well, assume the latter.

Advice needs skin in the game

Incentives matter. Consider the following pieces of advice, and notice what's wrong with them:

• "You should buy my online course." (Ulterior motive)

• "Hurry up, get married, and have kids. Time is ticking!" (Projection)

• "Don't stress out, you're perfect. The other person is wrong." (Walking on eggshells)

Why doesn’t everybody give brutally honest advice? Because all advice givers play a meta game of some sort. Exploring why they say something is just as important as hearing what they say.

• Corollary: Follow your own advice. It's easy to tell other people to do stuff. Beware hypocrites.

• Corollary: The only real advice is to think for yourself. You’re the only person with your own best interests in mind. Everything you hear passes through your own internal filtering mechanism. It’s your last line of defense.

The 3 axes of advice

Advice tends to fall along 3 different spectrums:

• How it makes you feel.

• How correct it is.

• How useful it is.

It's worth paying attention to where a piece of advice falls on each of these spectrums. Otherwise, you may improperly weigh advice. It's easy to conflate advice that makes you feel good with advice that's correct, for instance.

Feel-good

Some people just know how to say all the right words. Two different people might tell you the same thing, and only one of them can make it land. But whether something makes you feel good or not doesn't determine its validity.

Contrast these two statements:

1. "You're unhealthy and need to lose weight."

2. "Don't worry, the perfect one is out there waiting for you."

The rude piece of advice may be true, while the one that sounds good is completely meaningless!

Correct

Advice that is "more correct" may be worse than advice that's directionally correct (or even wrong). The receiver may suffer from information overload or misinterpret the advice.

Here are two approaches to weight-loss advice:

1. "Make sure to keep your daily caloric intake slightly below your TDEE."

2. "Stop drinking soda."

I zoned out halfway through reading the first bullet point.

Useful

Arguably, this is the only trait around advice that matters. Whether advice is useful has painfully little to do with whether it sounds good or is true.

For example:

1. "Follow your talent; don't follow your passion."

2. "Just keep going to the gym, and it'll cure your anxiety."

I'm not sure if these statements feel good. I don't even know if they're correct. But they’ve sure been helpful.

Receiving and giving better advice

As a receiver:

1. Focus first on whether the advice is useful. Disregard everything else.

2. Hear what everyone has to say, but don’t necessarily adopt their advice.

As a giver:

1. Prioritize making the advice useful. You do want to help, right?

2. Then prioritize making the advice feel good. It’ll increase the chance that others listen to you. “Tough love” is seldom persuasive.

3. Remember you don’t have to give advice in the first place if it’s not going to be a net positive.

But feel free to ignore everything I said. This is just my advice.

For me, the overarching theme of 2024 was building infrastructure and reducing life volatility. While that sounds a lot like "settling down," I'd argue I'm going for the opposite: you can only do so many things at a time. If the rest of your life isn't in order, how do you expect to hit ambitious goals? The less random stuff you have to worry about in life, the easier it is to focus on what matters.

Anyway, enough yapping. Here are some highlights from 2024:

• I moved to Crystal City.

• I returned to Google after being away for 5 years.

• I started hosting parties for the tech community in Washington DC.

Recap of the year

Coming from last year's review, on the top of my mind was the need to leave the suburbs, make a notable career shift, and maintain the trajectory from the previous year. It's not much, but each of these was a major project.

Here was my thought process: where I live and where I work can be the two most volatile life variables. What if I could move to a place where I'd never want to leave, and what if I could have my work be less hectic than a tech startup? Then those two variables could effectively run on autopilot. I could focus on everything else.

(As per usual, I'm not going to publish many of the spicier details. But you're always welcome to ask me about them in private.)

Moving

Early in the year, I decided it was time to leave...to go to Manhattan. If I were to move to a city, what better place than New York? It didn't sit quite right with me, but I dismissed it as a matter of expanding my comfort zone.

By a stroke of luck, I had a friend with an apartment in Murray Hill that would be vacant for a few months. I took up his offer to stay there. The plan was to do a month-long NYC trial period and begin touring apartments. Less than an hour after arriving in the city, I realized I didn't want to move to NYC. You see, I don't believe in sunk costs. As a DMV-raised kid, I'm a bit of a clean freak. The place is too filthy. Seeing the average resident on the street was depressing: they just look so dead inside. I was having a bad day, yet I was the happiest person in Manhattan. Three days after arriving, I left the city. Longest month of my life.

The biggest learning from the trip was that I needed "boots on the ground" as soon as possible. I learn fast and can make quick decisions once I gather real experiences. The next candidate for where I'd live was Washington DC/Northern Virginia. So I immediately started going on apartment tours. No time for theorizing.

One day I was having dinner with a bunch of friends at Amazon in Crystal City, and we went on a walk after eating. We passed by a building under construction. It has signs saying that it was leasing, and that piqued my interest. The next day, I toured the place, and I realized that I'd found my HQ2.

Over the next couple of months, I'd move to Crystal City. Staying within the DMV was convenient, as I had plenty of friends to help with the move (and even do the interior design of the place). The place is lovely.

Work

Most of the second quarter of the year was dedicated to interviewing around. I figured it was time to leave Stairwell and return to Big Tech. When I had left Google the first time around, I believed that a person was either a startup guy or a big company guy. My belief is now that everybody has a certain number of "startup tokens" in their life that gets consumed for each startup they work at. I had already burned many such tokens, so it was time for a change of pace. And thus began the LeetCode grind.

The job market in tech has evolved in the past few years. From interviewing around, I've noticed many differences:

• Though the job market isn't what it used to be in the late 2010's, it's not that bad for senior folks. I didn't have much trouble gathering interest and landing interviews. However, I've that's not the case for new grads. I feel bad for them, because I'm not sure what I'd do if I were in their shoes.

• The interviewing "meta" has evolved for the better, in my opinion. Companies now openly say they give "LeetCode-styled" interview questions rather than saying some bullshit about coding questions being around fundamentals. The openness actually means interviewers end up asking better questions.

• Nowadays, FAANG companies require candidates to go through team matching before receiving an offer. Back in the day, it was the other way around. I find it pretty reasonable. But that creates the scenario where candidates who passed the technical interviews can be stuck in "team matching limbo" for an indefinite period of time.

• Despite the changes from COVID, remote work is not sticking as much as people expected. And generally, companies are trying to pull workers back to the tech hubs. However, it seems like hybrid has become the default for tech work.

All things considered, I didn't apply to too many places. My criteria was simple: go to a FAANG or FAANG-adjacent tech company that was either remote or had a DC office. It wasn't all sunshine and rainbows: I tend to obsess over problems and fixate on worst-case scenarios. For instance, I temporarily developed a bit of a LeetCode "addiction" that impacted my physical health. And at times, I'd randomly worry about the prospect of having to break my lease.

Though everything panned out perfectly in the end. I returned to Google in their DC office. It was almost 5 years on the dot since I'd originally left. Readjusting to Google was pretty easy. I'm having a great time.

Travel

Travel was relatively light this year. The first half of the year was completely dedicated to moving and interviewing. It's probably better that way: I'm not the biggest fan of traveling, as it breaks a lot of good habits you form from your normal routine.

Besides various trips to NYC and the Bay Area, I took my annual Defcon trip, and I did an Asia trip where I visited China and then went to Thailand for the first time:

• This Defcon, I went as a member of the press. How? I'm a journalist for this blog!

• In China, I went to Beijing, Wuxi, and Shanghai. They all have very different vibes.

• I visited Chiang Mai and Bangkok in Thailand. Like with China, the cities all have different vibes. I also saw live Muay Thai for the first time.

Hobbies and Projects

When it comes to hobbies, this year felt overshadowed by last year. There wasn't anything wrong; 2023 was just such a good year that it was hard to compete with. I started so many new things last year, so this year was mostly continuing what I started. I continued to do improv, albeit less due to other life changes. I got my fourth stripe in BJJ and went on a hiatus due to moving.

Something new that happened was the creation of DC Tech Parties. Washington DC doesn't have the same tech community that SF or NYC have, so I figured there was an opportunity to construct a social center of gravity. So a few DC friends and I began party hosting. As with all new endeavors, you expect it to be a dumpster fire. But instead, we ended up having multiple events with hundreds of people.

On the piano front, I'm building a new repertoire. When I resumed playing last year, I focused on relearning pieces I had previously played. However, I no longer need a teacher; I can self-teach pretty much any song. It's quite liberating: I can teach myself all of the bangers. Earlier in the year, I taught myself Liebestraum No. 3 by Liszt, and after that, I learned Fantaisie-Impromptu by Chopin. Liebestraum is in a good-enough state (video below). While I've learned the entirety of Fantasie-Impromptu, it's not performance-ready quite yet.

What's next?

Well this is embarrassing. I haven't thought that far. The end of the year was filled with one-off social events (including ones that I hosted), so it's pretty easy to get lost in the weeds. It'll be easier to mull things over in January.

I have two initial thoughts that don't offer much closure, unfortunately. First, my life baseline is pretty good, so it's pretty hard to complain. Maybe I should just enjoy the moment. Second, a lot of things require maintenance (BJJ, hosting, etc.) so I can't arbitrarily drop the good things I have in pursuit of shiny new conquests.

This is all a fancy way of saying that I have no clue what I'm doing.

Miscellaneous learnings

• Showing up is literally half the battle. Showing up again is the other half. (This is especially important for me, since almost nothing in life seems to go well on the first try.)

• Respect your social battery. I'm an introvert who can trick people into think I'm extroverted. But if I burn out my social battery, I'll end up paying with my health.

• I'm actually neurotic as fuck whenever I experience cognitive dissonance. I suspect that's the case for most seemingly "emotionless" people.

• Fear of rejection is worse than rejection. I'm pretty good at taking rejection, but I'm bad at putting myself at risk of rejection. Besides, my life is objectively too good to be sad about rejection.

• Rumination is waste of time. You should be focused on the present or the future. Though rumination isn't the same as reflection or introspection. When examining the past, it must be in service of organizing your thoughts or forming a strategy for the future.

• Power dynamics and market forces apply to most things. Changing your environment can flip those dynamics. For example, my thought process while apartment-hunting differed wildly by location. While in Manhattan, I kept asking myself "what can I tolerate?" But in NoVA, I got to be picky: there were too many good options.

• Direct strategies usually beat out indirect ones. Boots on the ground. You learn much faster by trying something out, failing, and iterating. On the other hand, making grand plans tend to be a waste of time, since they usually get flushed down the toilet in lieu of real world data.

• Never drink the Kool-Aid. This isn't a new learning, and I've included it again because I struggle to follow this.

• Investing money into your external appearance is worth it. This not just limited to clothing and can include aspects such as your living situation.

• Improv and party hosting are life changing. I'm happier. It's easier to talk to people. It's easier to make other people happy. It took me a year to realize this, and I'm including it because it's such a big deal.

It's been about a year since I published my laptop setup guide. Since then, I've tweaked a few more settings and provisioned a few more laptops.

Native Settings

Everything here is modified within the System Settings app.

• Change your laptop's hostname to something unique. A templated name like yourname-mbp is bound to have namespace collisions.

• Within the Keyboard section...

  • Customize the modifier keys (Keyboard Shortcuts > Modifier Keys). I remap the caps lock key to escape.

  • Go to Text Replacements... and remove all entries.

• Within the Control Center, set Automatically hide and show the menu bar to Never.

• Within the Lock Screen section, set Require password after sceen saver begins or display is turned off to Immediately. This locks the laptop immediately if the lid closes.

• Within the Appearance section...

  • Set Show scroll bars to Always .

  • Set Click on the scroll bar to to Jump to the spot that's clicked.

• Within the Desktop & Dock settings, set windows to minimize using the scale effect.

• Customize the hot corners. Remove the quick note from the bottom right, and add the notification center to the top right. That way, if you're not using a trackpad, you can still easily pull up notifications.

Finder

There are a bunch of finder settings. I loosely follow the steps outlined in this video. Just give it a watch and follow along.

For reference, this is what my finder window looks like after it's been set up. You can compare to mine as reference.

Apps

Most of the apps in the previous blog post have stayed the same. However, I have added some extras. I personally pay for all of them, but they have free versions that work great too.

• Dropzone 4 to have a place on the menu bar to send items or do quick actions.

• Coconut Battery to monitor battery health.

• AlDente to regulate battery charge.

• UnnaturalScrollWheels to have proper trackpad and mouse scrolling at the same time.

• Bartender 5 to organize the menu bar.

And that's it. You now have a perfectly functional MacBook!

The title's a mouthful. Let me explain:

1. I want remote access to a Python kernel with GPU acceleration.

2. Renting GPU compute is expensive. (I'm just casually tinkering around.)

3. I have a physical GPU at home, BUT it's on a Windows desktop.

So the question is how do I expose a GPU-powered Jupyter Notebook to a remote machine?

• The notebook must have GPU acceleration available.

• The notebook must be remotely accessible.

• My desktop must not get pwned.

• Ideally the Windows host experiences minimal changes or side effects.

After some tinkering, I ended up with an arrangement that checks all the boxes. The Windows machine hosts a Linux environment via WSL. The Linux environment installs Tailscale, so my other machines can reach it. Then the Linux environment acts as a normal notebook server.

Here's how I set it up.

Choosing the Host (WSL)

We start with a standard Windows host machine. On Windows, we also have the option to use WSL or a virtual machine.

• Virtual machines do not support GPU passthrough (while the host is also using the GPU). This is a non-starter.

• Windows is a yucky operating system. Let's prefer to avoid it.

• Dual booting Linux is a possibility, but the Windows host would not be able to operate at the same time.

• WSL supports GPU passthrough, but the networking aspect is complicated. However, all of this is solved by Tailscale. This is the preferred route.

Installing Ubuntu (or any other distro) for WSL is pretty straightforward. Once you're on your Linux "machine," you can verify that it does indeed have GPU access.

❯ uname -r
5.15.146.1-microsoft-standard-WSL2
❯ nvidia-smi -L
GPU 0: NVIDIA GeForce GTX 1070

Installing Tailscale

For those unfamiliar with Tailscale, the simplest way I can describe is as a VPN that just works. You can reach any machine in the network, even if it's behind a NAT. That way, you don't arbitrarily expose your machine to the public Internet.

Installing Tailscale in WSL comes with a few caveats though. WSL does not come with Systemd enabled, so many services will not work. Tailscale requires a daemon, for example. (We'll also want other services, such as SSH.) Fortunately, enabling Systemd is as simple as modifying a config file. In /etc/wsl.conf, set the configuration as such:

❯ sudo cat /etc/wsl.conf
[boot]
systemd=true

Now you can install Tailscale. You'll also want to install additional dependencies:

• SSH for remote access (and port forwarding) to the machine

• Tmux to keep the WSL instance and Jupyter server running in the background

# Install SSH server and tmux.
sudo apt install openssh-server tmux

# Enable SSH.
sudo systemctl enable ssh
sudo system status ssh

# Install Tailscale and join the tailnet.
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

You'll want to configure SSH and Tailscale as necessary. After all of this, don't forget to reboot the WSL instance.

Starting a Jupyter Server

With all the dependencies set up, you can set up Jupyter Lab in your WSL instance. It's a matter of installing a single PyPI package:

pip install jupyterlab

Python should come out of the box in the Ubuntu WSL distribution. You may want to install other packages, but that can be done later within the notebook itself.

You can now start a Jupyter server. Most flags aren't critical despite the documentation, but you will need to make sure the server is protected by a token, or else Colab won't be able to connect to it. Additionally, you'll need to set the IP address the server listens on. By default it'll listen on localhost, which prevents remote access.

• If you have the server listen on 0.0.0.0, it will accept connections from any origin. Usually this is bad security practice, but since the WSL instance is not publicly accessible, it's the end of the world.

• Alternatively, you can set it to $(tailscale ip -4). That forces the incoming connection to come from within the tailnet. The downside to this approach is that you'll have to run port forwarding for Colab even if you're on the Windows host OS. (This is described in more detail later.)

With all the nuances out of the way, here's the command you can copy and paste. Be sure to run it within a tmux session.

# A few notes:
#
# 1) Do this within a tmux session. You can detach from it later.
# 2) You can alternatively hardcode "0.0.0.0" for the --ip flag.
# 3) You can unset --IdentityProvider.token, but don't leave it blank.
#
jupyter lab \
  --no-browser \
  --ip="$(tailscale ip -4)" \
  --IdentityProvider.token="image_some_custom_password_here"

Once the server is active, you can detach from the tmux session. Be sure to keep the session alive, so the notebook server (and Tailscale connection) do not disappear.

Connecting to Jupyter Lab

Now we switch gears and move to another computer. Before doing so, take a note of the tailnet IP (tailscale ip -4) or hostname of the WSL instance.

From any remote machine, as long as its part of the tailnet, it can simply access Jupyter Lab. Just visit http://wsl-tailscale-hostname-or-ip:8888/lab. Pretty simple!

Connecting to Colab

Warning: Don't do this for any arbitrary Colab notebook running untrusted code. Remember that you're giving it remote code execution privileges on your machine.

Using the Jupyter server as a Colab backend is a bit more involved. Colab only supports localhost as a local runtime host for some reason. So we'll have to port forward. (That's why SSH was a requirement when setting up WSL. Also, if you're on the Windows host, you can skip this step if the server is listening on 0.0.0.0.) In a terminal on your remote machine, forward the port for the notebook server:

ssh wsl-tailscale-hostname-or-ip -L 8888:localhost:8888

Within a Colab notebook, select the option to Connect to a local runtime and then put the local URL with the forwarded port. You'll also need the auth token from earlier.

If the connection is successful, you should be able to interact with the kernel from your Jupyter server. Now's a good time to install any additional PyPI packages that you'd want, since a fresh WSL environment will not have much by default. Otherwise, it's identical to hosted runtimes, except you can keep the kernel alive indefinitely.

That's it! You're done! You can now use your own GPU on Colab from any remote machine.

2023 was the best year I've had in a while. It's not even comparable when looking at the amount of objective change I've gone through. Over the span of 12 months, here are some notable life changes:

• I began improv/standup comedy and performed on stage multiple times.

• I took up Brazilian Jiu-Jitsu and can fight without panicking.

• I resumed playing the piano after a decade long hiatus.

• I began hosting local mixer parties.

• I visited China for the first time in 20 years.

• I snowboarded my first black trail.

Most of the credit goes to the fact that I was intentionally leaving my comfort zone. If you stay in your comfort zone, you won't grow. It's not what you want in the long term. Therefore, you must always seek to remain right outside the cusp of your comfort zone at all times. It's like progressive overload applied outside of the weight room. It doesn't have to be much, nor does it have to be done in a specific way. Just don't live life on autopilot.

Recap of the year

Late in 2022, I resolved to stop being a tech bro maximalist. I'm a good software engineer. My career was never a problem. It's not my failure mode. But looking ahead, I'd still be living a pretty shit life.

After leaving the Bay Area, it's easy to see that people who are a bit too into tech can be a bit...boring. I didn't want to be like that. If work is your personality, that's no fun. Why not try to be more interesting?

So that was the theme of 2023. Reject tech bro maximalism. Keep yourself outside of your comfort zone however possible. Optimize for being a more interesting person.

(Since this is a public blog post, a lot of the spicier details and events are omitted. They're pretty important. While I'd like to say I'm an open book, but I'm not going arbitrarily broadcast everything into the public. So if you'd like to hear more, hit me up in private.)

BJJ

In 2022, I fell down a bit of a UFC rabbit hole. It's a fascinating question: what's the "meta" of human unarmed combat? Turns out it's a combination of striking and grappling (which makes up modern MMA). Not all martial arts are created equal.

So I started Muay Thai in late 2022 to explore the fighting rabbit hole. Since I didn't want brain damage, I quit Muay Thai and started Brazilian Jiu-Jitsu in early 2023. Muay Thai is a form of striking, while BJJ is a form of grappling. Instead of getting punched in the face, I can get choked out instead.

I really enjoy BJJ. It's something I've kept up throughout the year and up to the present. It really does change you. I recall going to the gym at 7 am and being pinned to the ground for minutes on end. It gets hard to breathe. You feel like you're literally being squashed. At the end of class, your ears are ringing and you feel like throwing up. And the next day, you rinse and repeat.

But the change has been priceless. There's a level of peace that you earn. You know your day literally can't get worse. You know that in case shit really goes down, you can remain calm.

Comedy

Back in 2018, when I was at Google, there was a program where you could have 1:1 time with a random director for career advice. The chat wasn't useful. But I remember the director mentioning if I should try out an improv class, which caused me to get a mini panic attack from the very thought of trying such a class.

Five years later, I take my first improv class. It really isn't that bad. In fact, it's the most fun I've had as adult in a good while. Rarely do we get the opportunity to just play around. I recommend every adult try out an improv class at least once. It's not like you're performing or acting. A beginner class has you playing some simple games in private. It's a ton of fun.

I'm the type of person to overthink. I'm quite introspective and tend to be in my head too much. Improv actively punishes that behavior. You have to be living in the moment. Thinking and doing nothing is worse than doing something stupid. It's carried over into my life as a whole. Take conversations, for example. Not everything you say has to be insightful. It's better to keep the flow going.

Improv went so well that I decided to continue that journey and tried doing standup comedy. Standup and improv are pretty different, even though they're cut from the same cloth. When doing standup comedy, you have to write a lot. You need to rehearse your performance. For improv, the less you prepare, the better.

After writing a few bits and bombing a few open mics, I ended up doing a few performances as well. Here are a few neat observations about standup comedy:

• It's one of the most honest forms of communication: you can't really hide laughter, nor can you fake laughter. So it's clear if you're funny or not.

• Comedy writing has a clear purpose: control the audience's emotion. It's not like some work presentation where you're supposed to convey useful information. If anything, the audience losing brain cells is a sign of success.

• Even though you're supposed to be "funny," that does not mean you don't take the craft seriously. Open mics are for A/B testing your jokes. You need to kill your ego and notice if your material sucks. I've seen plenty of delusional comedians who think they're funny and don't improve.

Throughout the year, I did more improv and standup classes. At my core, I'm an introvert. But I've become pretty damn good at pretending to be extroverted.

(If you want to see videos of me performing, hit me up.)

Snowboarding

This season, I began snowboarding. The previous season, I tried skiing, but it wasn't for me. I didn't grow up as an athletic kid, so the self-preservation instinct made skiing difficult. I was too afraid of falling to learn.

Instead, I decided to give snowboarding a shot. Why? Because there was a higher learning curve. The first few days of snowboarding suck, but once it "clicks," it becomes a lot better. If you can do a green trail, you can survive a black trail. Whereas with skiing, moving up in skill will be a constant battle.

My plan was to bite the bullet and grind out the early learning stages of snowboarding. It was an investment of sorts: I have a few bad days at the beginning, and then I'll be fine afterward. It paid off. For my first few days at the slopes, my focus was on improving rather than having fun. Once I was able to do S-turns, then I really began to enjoy snowboarding. There's something to be said about sacrificing fun for intentional improvement: in the long term, you maximize your fun.

Piano

You've probably heard the stereotypes: the immigrant parents make their kid learn piano. The kid grinds outs the piano for 12 or so years throughout his childhood. He gets pretty good, but he grows to hate the piano. Once college comes, he quits and doesn't touch the instrument ever again.

That was me about a decade ago. I've always felt it to be a shame that I threw away such a talent. Learning the piano ate up a bunch of time and money. Halfway through 2023, I bought a keyboard and started practicing independently. It's pretty nice; I haven't forgotten all that much. But this time it's on my terms: I'm playing for my own enjoyment.

Other hobbies

So far I've only described the hits when it comes to trying out new hobbies. Early 2023 was definitely more of an exploration phase where I tried out multiple things. Not everything stuck. For example, I tried other things like woodworking, volunteering, and I got my concealed carry license. None of those were super interesting, so I wasn't consistent with them. It seems like my "trinity" of hobbies are BJJ, comedy, and piano. And maybe snowboarding during the winter. This may change in the future, but they've stuck for the time being.

It seems that I've done a good strategy for figuring out what I like: try out everything, do more of what sticks. People tend to have natural affinities towards different activities. A good test seems to be to ask what you'd enjoy doing alone. Some activities you'd do if a friend does. For other activities, you're the one dragging your friends. And once they quit, you're still happy doing it by yourself.

Hosting cocktail parties

The first ~2 years after Covid were a waste. I left the Bay Area and returned to the DMV, and most of my time was spent journaling. Otherwise I have very little to show for it. It feels bad grappling with the fact that you've thrown away years of your life.

I had since moved to my own place, so it was time to touch grass and bring people together. By pure coincidence I stumbled upon a book about hosting cocktail parties while listening to a podcast. I agreed many of the book's theses, so I started to implement them.

Throughout the year, I hosted multiple mixer-styled cocktail parties. You know how you have multiple friend groups that don't know each other? They're all invited to the same event. Throw in some name tags, icebreakers, and alcohol, and you've got yourself a party.

A few pro tips when it comes to hosting parties:

• Yes, you SHOULD intermingle your various friend groups. Being a connector is good for the world.

• People are both nice and lonely. Usually they appreciate that you think of them, and they're happy to support you. Stop thinking otherwise.

• No offense, but most people are lazy bums. So you have to be the change you wish to see in the world. Waiting doesn't work.

• Before a party, make sure the food, drinks, and seating are all uniformly distributed across the room. People tend to gravitate towards the food or seats, so you don't want people to crowd towards (or avoid) any singular area.

• When hosting parties, only a few things really matter (e.g. marketing and name tags). Otherwise, let the people self organize and have fun. They're adults, and you should treat them as such.

As a self-proclaimed shy introvert, I've become surprisingly good at making new friends and talking to random people. Most things in life are learnable skills, and hosting lots of events is starting to make people think that I'm a social butterfly.

Travel

I don't get the romanticization of travel. Personally, I'm a bit of a homebody. The biggest value I get from traveling is the reminder that the world moves on, regardless of whether or not you keep up. Throughout 2023, I left my home base a total of 5 times:

1. Early in the year, I took a vacation to Amsterdam and London. That was cool, I guess.

2. Shortly afterward, I visited the Bay Area for work (and snowboarding).

3. A few months later, there was a work offsite in Vegas. I normally go to Vegas annually for DEF CON, so it wasn't that novel.

4. Pretty much right after that offsite, I returned to Vegas for DEF CON 31. I'm in Las Vegas way too much...

5. Towards the end of the year, I took a trip to China. That was the interesting one. It was the first time I'd been to the country in 20 years.

It might be a stretch to say that the China trip was life changing, but it really did give me an appreciation of the culture. Two decades ago, it was a third world country. Over the years, it's modernized. The cities are arguably nicer than America's major cities.

Chinese and American culture are wildly different from each other. I don't think most Americans understand how the Chinese think (and vice versa). American was created because the people value freedom and independence: that makes them good at innovation. China was built up from centuries of war: the people will happily conform to a powerful government in return for the promise of prosperity. That makes China good at copying what works and scaling it up.

Their "app ecosystem" is a pretty neat case study: the WeChat and Alipay duopoly shows how a single app can do everything for you. It's pretty convenient. I suspect Instagram, Twitter, or Apple should race to become the WeChat of America. All of them need to get their peer-to-peer payments story down first. That makes the app practically useful. And Threads should have been a tab in the Instagram app. Since it's its own app, nobody's using it anymore.

Work

Ah yes, work. While life was happening, Stairwell was going through its own adventures.

I'm going to be vague with this. We lost some good people. We lost some bad people. We also gained some good people. It was a turbulent year. And now the company is in its best shape since I joined.

Now's actually a really good time to join. If you're interested in working at a security startup (and you're competent), hit me up.

What's next?

If you received a holiday card from me, you'd know that this blog post was written pretty late. As of the time of writing (late-ish January), I just got back from travel, so I haven't had time to think too deeply about what I hope to accomplish in 2024.

They're not well-fleshed out, but here are a few thoughts:

• Everything that I began in 2023, I should continue into 2024. It shouldn't be a one-and-done deal. Keep up the trajectory.

• Ever since I started sparring in BJJ, I've been neglecting the weight room. I currently weigh 140 pounds. Back in SF I was sustainably in the 160's and was an absolute unit. I need to recover my strength and muscle.

• Stairwell's in a state where success is guaranteed, now I can think about growing instead of putting out fires. My career role model is Kelsey Hightower; emulating his journey would be amazing.

• I may be moving to a city next year. There's only so much you can do in the Maryland suburbs. I feel like I've pulled most of the levers that I can.

To be honest, I'm a bit worried that it's all downhill from here. What can I accomplish in 2024 that would make it an equal or better year than 2023? I do feel some pressure in this regard, and I don't have a game plan for that.

On that note, let's wrap up this blog post with random wisdom that I gathered throughout the year.

Miscellaneous learnings

These are in no particular order. Some of these might be repeated.

On the self

• You must intentionally leave your comfort zone or else you won't grow. At all times, you should be living right outside the cusp of your comfort zone.

• Most worthwhile results come in the long term, but honestly you can see pretty cool results over the span of a year.

• Your ego tends to be the biggest blocker to happiness. Get rejected a lot: you'll realize it's not a big deal. Get your ass kicked: it'll end your physical insecurities. Humiliate yourself on stage: you'll learn how big your balls truly are.

• Don't be afraid to delegate. You can only do so much as an individual. If I want to keep moving forward, I'll need some help. Most of my friends are supportive: I should take them up on their offers to help.

• Without sounding like too much of a douchebag, I move past the change curve really fast. It might be because I'm intentional about being outside my comfort zone. But I can work past things in a month or two, when it would take other people years.

On socializing

• The point of human conversation is to give the other person good vibes. It is not to conduct high-bandwidth information transfer.

• You don't need to understand everything to make use of it. Not everything needs a rigorous definition. For example, I don't know what exactly "good vibes" or being funny entails. Yet I'll know it when I see it.

• The best way to get your message across is to be funny and tell stories. Humans struggle to pay attention, let alone retain information.

• Overthinking is the best way to ruin a conversation. Just say what's on your mind. Don't be afraid to attempt to joke around or sound stupid. Usually, these are of low consequence and high upside.

• Being a connector is both the easiest and the best way to create social value. Humans are lonely and love it that you're thinking of them. Bringing people together will generate a lot of happiness in the world.

• When meeting new people, be sure to exchange contact information before parting ways. (Both phone number AND Instagram.) You may regret not doing so.

• If people aren't interested in talking, respect them. Don't try to win them over. Read the room. Move on.

• Don't procrastinate on organizing social events. When things depend on other people, time is of the essence. Don't be the blocker, and give people ample buffer time.

On human nature

• Random people tend to like it when you talk to them. So talk to as many people as possible. Just find some random excuse to talk. Or don't. Either works. Again, humans are lonely and actually would love to make a new friend.

• Friendships are formed by frequent, casual, ad hoc interactions. So scheduling a monthly calendar event to catch up isn't effective. It kills the vibe. Not everybody may be in the mood to talk. It's better to randomly call or text. Or randomly invite them to events like dinner on the same day.

• Women tend to have a higher baseline of social awareness than men. So the issue with most men is that they might be too dense (i.e. insufficient social awareness). On the other hand, the failure mode for women is that they become "divas" (i.e. they're way too particular about their social sensitivities).

On conflict

• Do not shy away from conflict, especially if you're intimidated. Not everything is black and white, but some things are. There are some people who are too stupid to see nuance. Don't entertain such stupidity.

• Learning how to fight gives you outsized benefits to your confidence and calmness. Your body language even changes. It makes all the difference knowing that you have a backup plan if all hell breaks loose.

My whole system of life is keeping at it. The task of life is not to see clearly in the distance but to do the task at hand.

- Charlie Munger

The Problem

Let's talk about planning and prioritization.

• People who trust big, fancy Gantt charts are destined to be disappointed. Why? Because anything beyond the short-term is too volatile for rigid planning to be useful.

• If you're unwilling or unable to quickly change the plans as needed, that means you're not adaptable. Eventually, you'll end up working on the wrong thing. Arguably, that's worse than doing nothing!

• An inability to account for (and adapt to) real-life volatility is a sign of bad planning. A plan that assumes a perfect world is a bad plan.

The Solution

Well, that's just fantastic. Should we scrap all our plans and yolo it? Not quite. Enter the "distributed Pez dispenser" model of planning. It's basically gradient descent:

1. Gather everything you may want to work on in the foreseeable future.

2. Put it in a fuzzy priority queue. This is our "distributed Pez dispenser."

3. Pop from the top of this Pez dispenser. The "next" item to work should be clear. It's the most important thing at the given moment. So focus on that. Do it well.

4. Add to, consume from, or rebuild the Pez dispenser as circumstances shift.

Properties of the Pez Dispenser

The rest of the contents of the Pez dispenser should be a "gray box." That means you don't really know its exact contents, but you should have a rough idea. A "rough idea" means you have two things:

• A north star of what must be done.

• A general sense of what may change.

You don't need to over-index on anything beyond what's next, because it's subject to change. Actually, it's unlikely that it won't change, given the volatility of real life. Notice how this model accounts for such volatility while allowing us to make incremental progress. The next step should always be clear, and you should never be married to anything after that.

This concept applies to life in general as well. Plans change, but that doesn't mean you don't make plans. Rather, avoid rigid plans. Have adjustable plans, and execute the current step well. Then rinse and repeat.

In June 2023, Apple released the 15-inch version of the MacBook Air. I was due for a laptop upgrade, and it was the perfect form factor. It's surprising that they never had a "non-pro" laptop with a large screen size.

I was inspired by Swyx's ritual of documenting his Mac setup, so I decided to do the same. This is how I set up a fresh MacBook.

Native Settings

Upon creating an account on a new Apple laptop, you'll want to log in to your Apple account. Afterward, you'll have free rein over your machine.

• Go to System Settings, set the trackpad sensitivity to its maximum value, and make trackpad taps register as clicks. I'm so used to this workflow nowadays that anything else feels so slow and will drive me insane.

• Go to the control center settings to configure the menu bar. You'll want to show sound levels and battery percentage: both are super useful. On the other hand, hide the spotlight icon.

• For the "Internet Accounts," I use Google for all my contacts. Sign in with Google and then sync only contacts.

• Hide the Dock and remove any hide delay. You can make the Dock automatically hide in System Settings, but you'll need to use the command line to remove the Dock's hide delay. The command to do so is below:

defaults write com.apple.dock autohide-time-modifier -int 0; killall Dock

Tier 1 Downloads

Configuring the native laptop settings allows you to operate the laptop without going insane. So far we haven't downloaded anything yet. The next items we download are "prerequisites" for doing almost anything, so we set them up first.

• Download Google Chrome and sign in with your Google Account. I have Chrome sync everything, so most of the legwork is done automatically.

• Download and sign in to 1Password. It's necessary to authenticate with almost every single account I use. (I only memorize the credentials necessary to bootstrap my way to accessing 1Password.)

• Enable the SSH agent in 1Password. That allows you to use SSH keys stored in the password manager. Do not generate a new SSH key on the local machine.

• Download iTerm2. The Native terminal sucks. This allows us to peacefully operate on the command line. I know there are other modern terminals, but this one works well for me.

Command Line

My Developer Setup (with Vim, Tmux, and Zsh)

The details around my command line setup.

Fortunately, I've automated the vast majority of my command line setup in a git repository. As a result, I won't talk too much about the details. But you can read the blog post if you're interested. (It's a bit outdated though.)

All you need to do is run a one-line command:

curl https://raw.githubusercontent.com/MrPickles/dotfiles/refs/heads/master/scripts/dotfiles.sh | bash

The dotfiles setup script will not set up Homebrew, since that requires a new terminal session. You will need to do that manually.

With Homebrew installed, you'll want to install several other packages. I have them in a script, but they're subject to change. Afterward, open up Neovim, and it will install a few other packages (like fzf) automatically.

Finally, import the existing iTerm settings. It'll set up the font and colors. You'll still need to install the recommended font for Powerlevel10k.

Tier 2 Downloads

The next few downloads are pretty core to operating my machine. They're not mandatory, which is why I don't install them immediately.

• Alfred: You'll want to disable Spotlight indexing and remove the default Spotlight shortcut. Then you can let Alfred use that shortcut.

• BetterTouchTool: Even if you don't have custom keyboard shortcuts, the drag-to-window-snap functionality is great on its own.

• Cleanshot X: Make sure it replaces any existing screenshot shortcuts. It's better than the native screenshot tool.

• Tailscale: Once you connect your new machine to the Tailnet, it allows you to be part of a network with your other machines without the hassle of setting up a VPN.

Tier 3 Downloads

The remaining downloads don't inhibit the normal operation of the machine itself. I do consider these the minimal set of programs that I use on a consistent basis, so I install them all immediately after wrapping up my tier 2 downloads.

They're listed in alphabetical order:

• AdGuard: This blocks ads that uBlock Origin misses.

• Cron: Notion's calendar app.

• Discord: For chatting with gaming communities.

• Dropbox: Syncs my files.

• KeepingYouAwake: Keeps the laptop awake.

• Keybase: For basic crypto operations.

• Obsidian: All my notes are here.

• Signal: My preferred chat app.

• Slack: For work-related communications.

• Spark: An email client. Be sure to get Spark 2. Spark 3 sucks.

• Spotify: For listening to music.

• Streaks: My habit tracker.

• Todoist: My to-do list.

• WhatsApp: For chatting with Android users and people living in third-world countries (same thing).

• WeChat: For chatting with Chinese relatives.

Wrapping Up

• Be sure to log in to various accounts as necessary. This includes both websites on the browser and the recently downloaded apps.

• Register any license keys as necessary. Most apps have a trial period, so there's plenty of time to do this. I store all of my license keys in 1Password.

• Clean up the apps on the Dock, if you haven't already.

• Be sure to revoke any old machine credentials as necessary. For example, you might want to remove old machines from Tailscale and Keybase.

Cool! You're done. Enjoy the new laptop. 🙃

Ski season is coming up. Unless you prepare beforehand, you won't be in a state where you can actually do any skiing or snowboarding. Here are my recommendations for people getting started.

Required Gear

Skiing is expensive. You'll need a fair amount of equipment. Fortunately, a lot of this consists of fixed costs. So grab out your credit card and pull up Amazon. Most of the gear can be found pretty easily with a "<item name> snowboarding" query on Amazon. You don't need to be creative; usually, the first result works great.

You probably already have these

• Winter jacket: Just a generic winter jacket.

• Gloves or mittens: Make these that these are waterproof. The cloth-based gloves aren't waterproof, nor will they do an effective job of keeping your hands warm.

Buy these

• Thermals or long johns: These don't have to be skin-tight. Your goal is to wear more layers in order to provide additional insulation.

• Long winter socks: These should go up to the calves (at least) and should be higher than your ski shoes/snowboarding boots.

• Snow pants: These will be pretty stretchy since you'll be fitting them over your ski shoes/snowboarding boots. So don't be surprised if they feel a bit large at first.

• Ski goggles: This one's self-explanatory. They should be large enough to fit over glasses, but I still recommend my myopic friends wear contact lenses.

• Helmet: The proper helmets will have a strap in the back to attach your goggles. For the best protection, I recommend getting a helmet that's MIPS certified. They will be a lot more expensive than normal helmets, but I guess you decide how much your brain cells are worth. (Though if you're only going to be on the bunny slopes, it may not be a big deal.)

• Gaiter or balaclava: Also known as a "ski mask," these are key for blocking your face from wind and debris. Plus it insulates your head. You may also want one of these if you plan to rob a bank.

• [Snowboarding only] Butt pads: When snowboarding, expect to fall on your ass a lot. So I recommend getting some armor to prevent you from hurting your butt. (Unless you're into that kind of stuff.)

• [Snowboarding only] Knee pads: In a similar vein, expect to fall forward as well. Your knees will take repeated punishment, so having some armor there is a game-changer.

• [Snowboarding only] Wrist guards: Also when falling forward, humans will reflexively put their hands out to "break" the fall. This is the worst thing you can do. If you fall forward, hug yourself and try to land on your forearms. You want to distribute the force over your body. Otherwise, that's how you break your wrists. But in such a case, wrist guards may save you a lot of misery. (Note that I personally don't use wrist guards. They tend not to fit well with gloves.)

Rent these

The renting portion is relatively self-explanatory. If going on a day trip, rent the actual equipment:

• Skis, poles, and ski shoes

• Snowboard and snowboarding boots

Expect to pay $50-100 to rent the gear for a day. Some resorts may provide a helmet as part of the rental bundle. I'd advise against buying the main equipment for the first few seasons, as you haven't formed a preference for what specific types of skis/snowboards you like.

If you forget to buy some of the recommended items, the resort will likely have them for sale or rent. But be aware that the prices will be marked up a lot. So save your money and do a better job of preparing.

In general, depending on how many days you plan to go to the resort, it may make sense to rent at a local shop, rather than renting from the resort. Pricing will be better, but there will also be an expectation of a longer-term rental. You'll have to do the math yourself for those situations. For day trips, don't waste your time; just rent from the resort.

Other Considerations

Resort logistics

• Ski resorts local to the DMV area include Liberty and Whitetail. These can be around an hour's drive and easily fit into a day trip.

• Expect to pay around $200 per day. That's around $100 for a day pass and $100 for rental equipment. You may incur other expenses throughout the day, such as paying for food and lessons.

• If you end up going for multiple days in a season, it's far more economical to buy a season pass. The last time I did the math, the break-even point was around 10 trips or so.

• I recommend setting up all of these logistics as early as possible since walk-in passes/rentals aren't guaranteed (and prices go up over time).

Skiing vs snowboarding

Do you go skiing or snowboarding? They all have their pros and cons. Though if you've done neither and only plan to spend one day, I recommend you go skiing.

Before skiing or snowboarding, consider watching some tutorial videos (skiing, snowboarding) so you aren't taken completely by surprise. You can also take lessons, I've found that trial-and-error after watching tutorials tends to be more effective.

EDIT: I found a better tutorial for skiing. Watch this one instead.

Additional supplies

• Bringing your own food is optional since there are cafes at the resort. Though it's not a bad idea to have snacks and water in the car.

• Consider bringing sunscreen. Though it's not the end of the world if you're covered up.

• Ski helmets will have ear flaps to insulate your ears, so it's possible to safely wear Airpods and listen to music while going down the slopes. But if you're reading this blog post, maybe you should focus on staying alive instead.

Last week at Defcon 30, some friends and I attempted the Recon Village CTF. While spending most of Friday grinding out a CTF in a hotel room wasn't my original plan, it turned out to be a lot of fun.

After a rather late night, we ended up solving most of the challenges and got first place in the competition. This is the write-up for the CTF's challenges.

CTF Challenges

💡 Some of these OSINT challenges involve real people. As a result, parts of this write-up will be censored to protect their privacy. This blog post is for educational purposes only, and we do not endorse the usage of these tactics to research private individuals. Please don't dox people or otherwise be a creep.

Jerlean's 54th Birthday

Jerlean was in Vegas for their 54th birthday recently. Which hotel did they stay at?

Our natural instinct was to start Googling for someone named Jerlean, but Google didn't return anything relevant. We then tried to find Jerlean on Facebook, but that didn't bear fruit either. Turns out Instagram was the key.

By querying "vegas birthday" on Instagram and scrolling down, you'll eventually bump into the following picture:

It's an ad with no textual references to Jerlean, but you can glean all of the data from the photo. If you notice the post's location, you'll see that this was posted in New York-New York.

Spammy Email Domain

On 11 August, what was the primary email domain from which spam was reported as coming from 185.129.62.62 and 107.189.28.253 (two bot IPs)?

To figure out the domains associated with the IP addresses, we looked up the addresses in a forum spam database. The first IP address had a fair bit of activity on August 11.

If you look at the emails sent on that date, you'll notice that the most common domain seems to be hiroyuki4010.yoshito33.inwebmail.fun.

Wedding in Costa Rica

Wanting to remain anonymous online, discreetly named 'Phonenumber' from Costa Rica has a friend who works for Facebook. When did his friend get married?

Since we were searching for a person and his friends, we turned to Facebook. By querying for people named Phonenumber, you'll find an account that's based in Costa Rica.

Next, we look through this person's friends list to see if there are any friends who work at Facebook. There happen to be two people. One of them isn't in a relationship, but the other person is married. If you check out this person's "about" page, you'll see the date when he got married.

Missing Person Report

You're investigating a missing person who went missing following a party in 2019. While working through case notes you've come across the following NTIyMyBTb3V0aCBCcmFlc3dvb2QgQm91bGV2YXJkLCBIb3VzdG9u What date was the pool party?

The payload NTIyMyBTb3V0aCBCcmFlc3dvb2QgQm91bGV2YXJkLCBIb3VzdG9u attached to the CTF question is base64 encoded. If you decode it, you end up with an address in Houston, Texas. Googling the address combined with "party" and "2019" will yield a single search result in the form of a Pastebin: https://pastebin.com/BNwRBAX4

The paste contains an email detailing plans for a pool party that will happen "this Saturday." The email was sent on April 18, 2019, so you can infer that the pool party itself was held on April 20, 2019.

Party Co-host

This is a follow-up to the previous question.

There are two hosts of the party, one is Vanessa. What is the last name of the other host?

If you re-read the email from the Pastebin, you'll notice a few bits of information:

1. The party was held in Houston, Texas.

2. The email addresses and names of the recipients are public.

3. The hosts are named Vanessa and Meghana.

Searching for the hosts directly on Facebook doesn't yield too many results. However, by looking up some of the email recipients (especially those with uncommon names), you'll eventually find people based in Texas. Looking through their friends list will allow you to find Vanessa. Looking through Vanessa's friends list will allow you to find Meghana.

As a reminder, these are real people. Please respect their privacy.

Maiden Name

Callum lives in Scarborough, Toronto and works with kids. What's his wife's maiden name?

Googling up Callum with his location and profession will lead to his LinkedIn page and reveal his last name. Looking up his full name and location on Facebook will lead to his Facebook page, which also contains the profile of his wife.

However, his wife changed her last name, and her maiden name isn't in her profile. But those who are observant will notice that the Facebook URL does not update unless manually changed. Callum's wife's URL contains her maiden name.

Password Breach

This is a follow-up to the previous question.

Callum's password has been breached in connection with his primary email. What is it?

Despite finding Callum's social media profiles, we weren't able to find his email address. As a result, we enumerated potential emails. (Using Gmail to autocomplete was helpful in filtering out potential and valid emails.) It turns out that his email used the common firstname.lastname@gmail.com format.

Then, Googling the email address along with terms like "password" led to a Pastebin that contained a password dump for emails. Callum's password was included in the paste: https://pastebin.com/1LeMmy4X

Open Source

The next few challenges are all based on CryptoRama, a fictional company.

Hi, I'm Eva Hesington. Remember me from last year? I am the founder of CryptoRama. Thanks to your support we have been able to scale the business a lot. I cannot thank the open source community enough. Using Open source tools and platforms, our business has grown and our tech department is now running strong. We could not have done it without these Open Source tools and community. You can visit our website to find out more.

This one had us stumped for a while, as Cryptorama was an actual company. We went down a few rabbit holes to no avail before querying Cryptorama with Eva Hesington's name included. That led to a single search result to a different Cryptorama: https://cryptorama.cloud/

If you checked the source of the website, you'd find the flag. It's embedded in a comment within main.min.js.

Secret Sharing

We at CryptoRama are very concerned about sharing sensitive information with the outside world and even on the inside. We use secret sharing services. But looks like someone has been manipulating our secrets application and hindering our progress. Can you please check?

The challenge mentions a secret sharing service but does not share any more details. So we need to find what service it's referring to. By looking at the certificate transparency logs for the CryptoRama website, we that there are a few valid subdomains. One of them is https://secrets.cryptorama.cloud/.

When examining the website, we see that it's running SnapPass, a secret-sharing app maintained by Pinterest. Users can write a secret to the app, and the app will generate a URL to view the secret. After the secret is viewed once, it will disappear forever.

There don't seem to be any CVEs associated with SnapPass, so perhaps the site is running a patched version with broken crypto. When looking among the forks of the repo, we see that there's a fork that's created by CryptoRama. And it also has a patch that changes the URL generation. Here's a summary of the patch:

1. The encryption key is now the base64 encoded version of a hardcoded secret 6ardCD6XQ49FLrxY6fd7pB3DeeNmzn8Y. With the base64 encoding, the string will be NmFyZENENlhRNDlGTHJ4WTZmZDdwQjNEZWVObXpuOFk=.

2. The secret URL has a prefix of RV (from the Redis prefix).

3. The secret URL additionally takes in the current timestamp.

Overall, the format of the secret URL looks like this:

Although we have an algorithm to generate the secret URLs, it still takes two parameters: a UUID and the timestamp. For both, it's unfeasible to guess or brute force. Therefore, we need another way to make use of the URLs. Our next step is to find a source for the UUIDs and timestamps.

Looking around CryptoRama's Github profile, we find that it has a second repository called Progress Tracker. Every minute or so, the repo updates with a new commit that changes a hash in README.md.

Notice that the hash in the file is the same format as a UUID. Also notice that every commit has an associated timestamp. If we take those two pieces of data, we have enough information to generate a URL in the SnapPass instance. From trial and error, it seems like the URL expects the timestamp to be of minute precision. If we plug in the converted timestamp and the hash, we get a valid URL.

Every commit in the repository creates a secret that contains the flag. Since it's a one-time use URL, that's why the repository keeps adding new secrets every minute.

Public Server Backup

We lost access to one of our servers. Thankfully we had backups. All you have to do is find a piece (backup) of our server and make it whole by attaching it to another server. If you do this, you will have attained nirvana! Start looking at our website again.

Going back to the Cryptorama website, we notice the picture of Eva. It has a very interesting URL:

Searching for her name on Gitlab yields an account with a single repository containing her personal website. However, more interesting is a file called account.txt that contains details of her AWS account ID and mentions an EC2 instance.

Since we've learned that she has an EC2 machine and we know her AWS account ID, the next step would be to see if there's any way to find details of her EC2 instance.

AWS allows you to snapshot EC2 instances onto EBS, and it's possible to have those snapshots be public. Since we know the account ID, we have the ability to find all of the public snapshots for the account. To do so, we enumerate through the AWS regions and use the command line to print out public EBS snapshots:

Most of the regions yield nothing, but in us-west-1, there's a single public snapshot:

We want to inspect the contents of the snapshot. In order to do so, we need to copy the snapshot over to our own account and then create our own EC2 instance that's based on the snapshot.

Once the image is in your account, you can create an EC2 instance, SSH into the machine, and view the flag.

Asset Management

Our junior developer Henry Lopez cannot find his assets. Can you help him please? His credentials are given below: Username: henry.lopez Password: sHTA$H@&sBjPG5

It seems like Cryptorama has an assets server. When we looked at the certificate transparency logs, we saw that https://assets.cryptorama.cloud/ was a valid subdomain. Logging in with Henry's credentials leads us to the asset management page.

From poking around the app, we learn that there's very little data to be found. We also see that the site is running v5.4.3 of Snipe-IT. If you search for CVEs that are present in the running version of the app, you'll find CVE-2022-1511. It's an access control bug that was fixed in the following patch of Snipe-IT.

Because of the bug, users without proper permissions can access restricted resources. The resources don't show up as links in the app's sidebar, but they can just go to the URL directly. The proof of concept shows a normal user visiting the /hardware/requested endpoint, even though there are no permissions. By doing the same and visiting https://assets.cryptorama.cloud/hardware/requested, we can find the flag.

Control Panel RCE

Now that Henry has his assets, time to try out an application he created. https://control-panel.cryptorama.cloud/

If you visit the website, you'll find a pretty unassuming app. It contains two buttons, one that shows the current working directory, and one that prints the current timestamp.

If you inspect the network requests that happen from clicking the buttons, you'll notice that there's a request to /cmd that with form data. The payload has a single key, filename , and the value is either first or second depending on which button you clicked.

We then try to break the form by sending a request without the filename key. It causes the request to fail, because of a BadRequestKeyError. From looking at the ensuing HTML, we learn that...

• It's running a development build of Flask (since there's a stack trace).

• The /cmd endpoint requires a value for filename.

Scrolling down the stack trace, you'll find a snippet of the actual application code.

From reading the code, it seems to be...

1. Reading the value at filename.

2. Constructing a URL based on that value.

3. Sending an HTTP request to get the contents of that URL.

4. Running the contents of the HTTP request via eval.

5. Sending the return value of the eval as part of the HTTP response.

Though the snippet only covers the logic for local files, we suspected that there must be similar logic for remote files. We have no control of the local file content, but if we hosted our own files and had the server download those, we could in theory do arbitrary code execution.

The fastest way I think of to host files on the public Internet was to run a simple HTTP server and expose it via ngrok. So I created a directory with some test files and spun up an ngrok tunnel.

Then if you include the entire URL of your remote file as the value in the filename key, the server will execute the arbitrary code that you wrote. Listing the contents of the directory showed that there was a file called flag.txt. Then you could command the server to print out the contents of the flag.

Doug's Golfing Experience

Can you locate this field on the outskirts of London in the image attached below. Once you do, what date did Doug leave a review for this place?

This picture seems to have been taken from a plane. The field is also quite distinct, which makes it easy to confirm whether you've found the correct location.

If you've ever flown in a plane before, you'll notice that the picture was taken at a relatively low altitude. A low altitude means that the plane is either landing or departing, which also implies that the plane is close to the airport. The field itself appears to be a golf course. If you search for golf courses near London airports on Google Maps, you'll eventually find a place called Hounslow Golf Park next to Heathrow Airport.

Taking a look at the golf park's website confirms that it's the same field from the photo. Scrolling through the reviews, you'll find a review from Doug that was posted on July 16th.

Meet the Team

Behind every CTF, there are names and faces that made it all a reality. Thanks to the organizers at Recon Village for creating the challenges in this CTF. It's also important to remember that solving this CTF was a team effort. Here are your alligator hunters:

• Chris Rodriguez

• Christian Johnson

• Jeremy Krach

• Andrew Liu (me)

Hope you enjoyed reading this write-up! If you have any questions or feedback, feel free to reach out and share your thoughts.

So you're looking to join a startup. That's great! Startups can offer the most fulfilling years of your career.

At the same time, you need to be careful. It's worlds apart from working at a large, traditional company. Victory isn't assured, and you incur significantly more risk. I'm not trying to peddle some disaster scenario. In a relatively short period, the recent market downturn has caused a fair share of massive layoffs and company failures.

Only when the tide goes out do you discover who's been swimming naked.

Despite those layoffs, good companies will still survive and thrive in the long run. So whether or not to join a startup isn't the issue. What matters is that you make an informed decision. I've compiled a collection of questions I think everybody should ask before joining any startup.

When starting out

• What are you building? How far along are you? How long have you been doing it?

• How do you (plan to) make money? Who are your customers?

• Who are your investors? What were the terms of your funding?

• Who are the founders? Do they have any sort of track record?

Your goal when talking to a new startup is to understand the basic context. That means understanding the business model and whether the work will be interesting. Understanding the startup's age and progress will give you some insight into its velocity, which I'd argue is the most important trait of the company.

This is also the opportunity to gather some light, anecdotal intel about the company. Understanding who invested in the company can give you some signal about the rough quality of the company. Typically, top-tier VCs will not invest in obvious duds. Knowing a founder's track record can also be useful. For example, Domm Holland, the former CEO of Fast, left his previous startup with a trail of legal issues behind him. Employees who joined the company before it failed would have noticed several red flags if they looked into the issue.

When interviewing

• Who will I be working with? Are they good?

• How did you find this company? Why did you join?

• How did the company compare to your expectations?

• What don't you like about your job?

Interviews go both ways. Someone may be interviewing you, but you're also assessing your interviewer. During an interview, you're talking to potential teammates. Do your due diligence and assess whether these are people you'd enjoy working with.

I recommend knowing whether your hypothetical teammates are competent, sane, and happy with their jobs. It'll foreshadow whether you'll remain sane and happy with your future job.

Before getting an offer

• What's your burn rate? What will be your burn rate in 6 months?

• How much runway do you have?

• What's your revenue? (Current numbers, NOT projected.)

• When do you expect to become profitable?

At this point, assuming interviews have gone well, you're looking to understand a company's financial fundamentals. Do not accept hand-wavy answers for any of these questions. Every company needs to know basic math.

The burn rate of a company is roughly how much it spends, while its runway represents how long it'll be before the company runs out of money. In my opinion, a healthy company should have at least 2 years of runway. Otherwise, it may risk having to accept unfavorable terms in its next funding round (or just failing outright). There was recently a leaked presentation from Sequoia about adapting to the future, given the current state of the economy. The days of "growth at all cost" or blind hyper-growth have fallen out of favor. Startups having solid fundamentals will matter a lot more moving forward.

After getting an offer

• How many outstanding shares are there?

• What's the strike price (or fair market value) per share? What were the historical strike prices?

• What's the preferred price per share?

• How does the company plan to liquidate its shares?

• Do you have early exercise?

• What's the exercise window if I leave?

If you're working at a startup, you're likely being paid in stock options. So you pay money to buy shares of a company and bet that the price of those shares will go up. That's not easy to measure, so you must make sure you understand how equity compensation works.

Working with stock options can have tax implications, so you may have to make a strategy even if a company is doing well. Early exercise can reduce your taxes (at the expense of upfront cash). If you don't want to exercise any options yet, be sure to know when those options expire. It's usually 90 days after you leave a company, but it can vary. When I was at Scale, if you worked there for at least two years, they had a clause that extended that exercise window to five years after your last day.

Talking to the CEO

• What's the biggest existential threat to your company?

• Who controls the company's board seats? What conditions would cause the board to fire you?

• What's the worst-case scenario that you project happening to the business? What's your contingency plan in such a case?

• What's your vision for the company? Under what conditions would you sacrifice that vision?

Before you join a startup, you should have at least one conversation with the CEO. And it's not the time to make small talk. You must ask the tough questions. This is the person who's steering the ship, and the person who's probably thought the most about the company's destiny. Like with the questions about company financials, if you get hand-wavy answers, run away. You do not want to be working for this person.

The question about the worst-case scenario is partially a test to see how well-prepared the CEO is. Leaders should be ready for pretty dire situations. Sometimes these situations can require hard decisions. If a company's burn rate becomes too high, make sure the CEO has considered doing a layoff to cut costs. If runway becomes a problem, the CEO should be willing to take a down round to keep the company alive. Is this a person who will make unpopular decisions for the company's best interest, or is this someone who engages in wishful thinking? It's your job to find out.

Talking to former employees

• How long did you work at the company?

• Why did you leave? What could have made you stay?

• What were some good things about the company?

To avoid "drinking the Kool-Aid," I recommend talking to at least one person who has left the startup. You get an example where things didn't work out, and you can talk to someone with no incentive for you to join the company. It's an opportunity to hear an opposing viewpoint and uncover red flags.

Be sure to understand how much the former employee actually knows about the company and whether this person was fired. (People may not always be upfront about that information.) Ironically, if this is a person you wouldn't work with, a company firing that person may be a green flag.

Thanks for reading! Please share this if you have friends who are looking at startups.

As far as I can tell, every issue tracker and to-do list app known to man supports some feature that lets you prioritize your tasks.

You typically tag everything as high, medium, or low priority. Other apps may refer to them as "P0's" or "P1's," though they all use the same bucketing system. Sounds good on paper. I enjoy understanding my priorities just as much as the next person does. But what happens in practice? Personally, I experience a two-part problem.

1. Everything gets labeled as a high priority.

2. You get confused about what's actually important.

Dividing your priorities into buckets can backfire. If everything has a high priority, the system's meaningless. It's like giving each task a participation trophy.

Having real priorities means that no two things are equally important. By prioritizing one thing, you must explicitly deprioritize something else.

Simple ordering solves this easily

"But everything is important!" you might rebut in protest. I totally agree. Multiple things can be important, but that doesn't mean they're equally important. You can plan to buy both milk and eggs, but if the grocery store were rationing supplies, you'd eventually pick one over the other.

Here's what I recommend doing instead:

• Stack rank everything in order of their relative priority.

• No two items can be equally ranked.

• You're done. It's that simple. Start completing those tasks!

Ranking tasks in an ordered list works so well because humans can intuitively sort items once we've given them some measurable values. Once you ban equal priorities, you're suddenly forced to make real decisions.

For those who still feel the need to divide tasks into buckets, you should still rank everything first. After ranking everything, then draw cut-off boundaries between your "high priority" and "medium priority" tasks. That way, you gain some notion of absolute importance without forgetting your relative prioritization. Though it's just a cherry on top. Stack ranking is enough.