There is a lot of discussion about the B.A.A. making allowances for the 118th, relaxing the standards or raising the entry cap. I’ll address this later. Until an official announcement is made, we’re playing by the usual rules, except that there are several thousand runners—those who weren’t able to finish the 117th when the finish line shut down—who will be offered automatic entry, thus beginning to fill the field before registration even opens.

If you already have your BQ, that makes things easier. If you don’t have a BQ, you’ll need to chase one (and if you do have one, you may still want a better time; I’ll get to that later too).

Chances to chase standards are pretty sparse right now. The reason is pretty simple: in most of the country, it’s already too hot to run a fast marathon, and if it isn’t, it will be soon. Entry is scheduled to open in September, so there may be a chance to run a BQ in September (the actual opening date hasn’t been announced yet), but October is almost certainly too late.

It sounds like relatively few people are trying to jump in marathons right away, which is sound; it may be possible to finish a marathon on a month’s training, but running a BQ is not that easy for most.

If you can be ready within six or eight weeks and can travel anywhere, some options open up. There’s Grandma’s in Minnesota, if that hasn’t filled; that’s in mid-June. Likewise the Mayor’s Midnight Sun Marathon in Anchorage, Alaska. There are plenty of races on the calendar but many of them are e.g. trail marathons, actually known for being challenging due to heat, or otherwie tough qualifiers. (There should be extra points for anyone who gets a BQ at the Johnny Miles Marathon.)

Even if you’ve got a BQ under your belt already, the increased demand for the 118th may pose a challenge. It’s been a few years since a BQ meant your entry was assured; more recently, faster is better. Essentially, the faster your BQ, the earlier you get to register, and the more likely your registration will be successful. Therefore, there are BQs, good BQs (5-10 minutes faster than cutoff) and really good BQs (10+ minutes faster than cutoff).

If you’ve got a really good BQ, you’re probably in. If you’ve got a good one, I wouldn’t make promises, but you’re probably OK. If you don’t have a good BQ, you might want to think about improving it. For that, you’ll want to look deep into the summer, even into early September, with the idea of getting into great shape in the summer and hitting one out of the park as close to the registration opening date as you can. You could do worse than to look at Clarence DeMar for this one. (Someone needs to come up with a circuit of races named for Boston champions.)

Finally, pay attention and be ready to change plans if things come up which help you. I’ve already heard of one pop-up marathon scheduled for late summer expressly to give people a shot at qualifying; odds are there will be more. Look for one with a speedy, certified course (I can’t emphasize this point enough), chip timing, and an early-morning start (or other accommodations for heat). It may even be a good idea to have a Plan A and a Plan B.

Now, about the BAA: One thing they understand is that while they own the Boston Marathon on paper, in practice it’s a sort of public trust. They are going to do whatever they can for the 118th, and I expect they are exploring the option of a one-time raising of the entry cap. (The idea of a lottery, the way they ran it in 1996, has been floated as well, but in my opinion that’s not going to go over well if they can’t first allow in all the BQs who wish to run, so if I wanted to run I would be looking for a BQ before I put my hopes in a lottery.)

The hangup is that the field limit is not set arbitrarily by the BAA; it’s a limit more or less imposed on them by the towns the course passes through, principally Hopkinton, which has to support the starting area. Hopkinton becomes the running community’s public urinal for a few hours every April and bears it with remarkable good grace, but they have much less open space now than they did in 1996. Staging 30,000 or 40,000 runners through that town, if it’s allowed to happen, will take a lot of time and patience.

If the cap is lifted for the 118th, we will all owe the towns, especially Hopkinton, a greater-than-usual debt of gratitude. So watch where you relieve yourself, please, and where you toss that empty gel packet. (I am still finding empty gel packets on the Natick roadsides a month after the race.)

The BAA is still clearing up the mess from the 117th, and they have a half-marathon to think about in October. I would not expect an announcement about the 118th until late June at the earliest, and July or August is more likely. Stay tuned, and if you want to run, start staking out that really good BQ.

Read that sentence again, because I did. Rephrase it: “If your umbrella is closed, you will get wet when it rains.” When I read obfuscation like that, I get suspicious immediately. All caps PLEASE CALL IMMEDIATELY in the next block of the letter really raises my hackles, just because I get ornery when I feel like I’m being herded.

Sure enough, despite including the make, model (Honda) and year of one of our cars, this mailing had nothing to do with Honda, and probably not with any other manufacturer. In fine print at the bottom, “Vehicle Protection Center is an independent nationwide company marketing vehicle service contract on behalf of leading third party administrators.” Which means nothing. Third sentence of that paragraph: “Vehicle Protection Center is not affiliated with any auto dealer or manufacturer.”

Here’s the thing: I never had any intention of purchasing an extended warranty. I turned it down when we bought the vehicle. Our history is of driving cars for years—decades, now—beyond their warrantees, and if they break, we pay for it. (Revolutionary, I know.) So I looked these folks up online. Sure enough, I don’t have to scroll too far down in the search results to find a page titled “Don’t be fooled by this vehicle extended warranty mailer from Vehicle Protection Center”.

This mailer is sleazy, and I’m posting this not because I think my regular readers would be fooled, but because I want that link above to come up closer to the top of search results.

The problem is this: sites get hacked, and databases get compromised. Encrypting the connection (your SSL certificate, the https in the address bar, and all that) just protects the customer’s communication with your server. It’s nice that they’ve stopped crackers from harvesting passwords one by one as their users provide them, but what’s the point if a successful compromise of the server means everyone’s passwords are available to the cracker?

The first thing you need to know (if not understand) is that there are certain functions which are one-way; that is, the input cannot be determined by the output. Some of these are called hash functions. If you run a sufficiently strong hash function on a password, it is not possible to determine the password from the hash. (The output of a hash function is sometimes called a hash.) (Hash functions are like padlocks: some are stronger than others. But even a weak lock is better than none at all.)

“But wait,” the inexperienced webmaster says, “how can I tell if my user is providing the correct password when they return to the site?”

Well, think about it. They’ve stored a hash produced by running a hash function on their password. Why not run the same hash function on the password provided at login time and see if the resulting hash is the same as the one in the database? Problem solved.

(N.B. You might also want to read up on “salt.”)

Therefore, I should announce that this morning he presented for tagging his first mouse of the season. (Mouse hunting season in most of the states he’s lived in runs from September 1 to August 31.) This is his first mouse of his second decade of hunting.

I was thinking about his record today, and unless I’m forgetting some, of the six places we’ve lived with him, he’s caught mice in three, and in a fourth he caught three bats(!) which I count as mice with wings. He also caught a mouse once while visiting A’s parents, so I make his total somewhere around eight non-flying mice and three flying mice.

I have a hunch he’s not done in this house, either.

An example: a recent piece on the probability of electoral ties compares the odds of nine swing states all producing equal vote totals for the top two candidates with the odds of some fairly unlikely events, including being struck by a bale of cocaine dropped from an airplane, a tornado, and a meteorite strike. (Along the way we learn that a typical location in Florida “…experiences an average 1.4 picotornados per second … a Florida resident suffers an average of 0.64 femtodeaths per second from meteorite impacts … the average person in Florida is struck by an average of 29 zeptobales of cocaine per second” and the average income of a typical acre of Florida land derived from falling bales of cocaine.)

So if you like the absurdum part of reductio ad absurdum, you’ll like What If?

If you haven’t glazed over yourself by now, bear with me.

(Aside: All of this stuff has been generated by a culture of companies, mostly but not exclusively on the West Coast, building tools for their own use and then publishing the good stuff—whatever’s not central to their real business—free, open-source, for everyone else’s benefit. It’s pretty awesome and I try to contribute my own tweaks back when I can.)

If you haven’t used Ruby but are familiar with software, Rake is just make in Ruby. rakep reads an Assetfile which is the equivalent of Rakefile in Rake or Makefile in make. I hadn’t seen the syntax before but I could sort of suss out what was going on.

I’ve been using git post-commit hooks to generate a one-line Javascript file which contains a “version string” that’s just the hash of the most-recent git commit. Displaying this string in the application helps me tell if I’m looking at the most-recent version of the code, or an older build. However, if someone else doesn’t have my hooks installed, that file isn’t generated, and their application won’t load. I needed a better way.

First I looked at Flame.js, a widget library for Ember which I’ve contributed to several times over the last few months. Flame generates a version constant by generating a temporary version.js file in ERb, Ruby’s built-in template language, using Ruby to send git describe --always --dirty --tags to the shell and planting that in a temporary .js file. Flame, however, uses its own Rake tasks to build its distribution versions, and runs Sprockets over all the input files to handle Sass, and rakep uses neither Sprockets nor Sass, (at least not explicitly). I couldn’t just borrow stuff from their Rakefile, nor could I drop an .erb file into my code directory and expect it to Just Work.

I looked at the filters that were included, and discovered that Yehuda Katz’s rake-pipeline-web-filters library (which was already in use - Katz is a core team coder for Ember) includes a Tilt filter. Tilt is a sort of “send me anything and I’ll decode it” filter, and it will handle ERb. So I explicitly required Tilt in my Assetfile, and added this block before encoding of Javascript began:

  match 'lib/version.js.erb' do
    filter WebFilters::TiltFilter do |input|
      input.sub(/.js.erb/, '.js')
    end
  end

What that wound up doing was taking my version.js.erb file and generating a temporary version.js file which was then included along with the rest of the files as though it had been there all along. It’s not in with my regular code, so it doesn’t get committed to git itself, but it’s included in all the build files. And because the Assetfile is part of the project itself, anyone who builds the project (and has included all the requisite gems, has the right versions of Ruby, etc. etc. which they probably do if they’re building this) will get the appropriate version string in the application.

It’s a little thing, but I’m sort of proud of it. I could probably make that first line match 'lib/*.js.erb' and have it work on any .erb file in the directory, but it’s not needed so I won’t bother.

One of the girls’ treasured toys is a small stack of musical greeting cards. This is the variety which play a song when opened—a small ROM and a tiny PCB connected to an equally tiny speaker with two cheap wires—sold by Hallmark at about $5 a pop. The first two came at their birthday and play “Winnie the Pooh” tunes. They got such a great reception their grandparents found two others, one of which plays a banjo tune and the other the finale of Tchaikovsky’s “1812 Overture”.

They’re taking a beating; all four have been folded, spindled, and mutilated in ways the post office could only manage with machinery. They’re fundamentally three-panel cards, with the third folded over the second to form an envelope for the electronics, and most have had that concealing panel pulled loose so the guts are exposed. (One of them had the third panel removed completely.) But one of the Pooh cards actually had one of the wires from the PCB to the speaker come loose this week, rendering it mute.

So yes, Daddy broke out the soldering iron and re-soldered a wire on a $5 greeting card.

This morning I discovered the reason: the cord for the base unit runs under the crib and plugs into an outlet in the wall the crib sits against. The plug had been pulled out just enough to shut off the base unit.

I’m pretty sure it wasn’t intentionally unplugged, but it reminded me of all the questions I would see in security forums about how to limit kids’ internet access. The conventional wisdom was that when the kids were smart enough to get around your filter, you should just shut it down rather than escalate. Now I’m wondering if it’s time to turn off the baby monitors now that at least one of the girls is capable of shutting hers off on her own, or if I should just plug it in to a socket she can’t reach from the crib.

As I suggested two years ago, found money has been way down since we moved. So much so that last year I didn’t bother to count the bin. This year’s tally represents two years and is still the lowest since I started: $17.47.

• Four dollar bills. I don’t remember where I found these, but they were all together, new and crisp and very tightly folded together.
• 21 quarters ($5.25), 50 dimes, 23 nickels, 207 pennies. Needless to say this is the lowest counts of all of these since I started keeping track.
• 0.32 CDN (not included in the total), including three dimes. Given that the two-year span included over a week spent in Moncton, this is unsurprising.
• 5 centavos from Argentina. No idea where this came from.
• One very unidentified slug with two deep parallel (but off-center) grooves in one otherwise-blank side, and a baseball batter on the other side. Probably a token from some kind of arcade.

I’m still collecting, but I must admit the numbers here are discouraging.

My favorite example in recent years has been the fake word “performant”. This word is used as an adjective applied to something which performs well, i.e. runs quickly or efficiently. But it’s not a word; it’s just jargon, most often used either by people who want to sound knowledgeable or people who simply don’t know any better. In fact, because it usually forces the sentence into a less active form (“The framework is performant” rather than “The framework performs well”) it actually makes the point weaker.

If you want to say something performs well, say it, don’t obscure it with silly jargon.

Here are two clues:

• If you’re going to say, “When you say X, you’re not kidding!” make sure I actually said X.
• Don’t say “Your site may have single handedly saved our sanity!” when I’ve only posted nine times in a year.

I’m not going to mention their name because their site looks like the site of a small, struggling start-up. But future marketers, you’re on notice.

sed: illegal option — r

The initial web search told me that the issue was that the BSD-style sed that comes standard in Mac OS X (Snow Leopard, in my case) doesn’t provide the same options as Gnu sed. One suggestion was using ports or Homebrew to install gsed instead, but for complicated reasons neither is a valid option for me. (Thumbnail: I uninstalled port to try Homebrew, but my Homebrew installation is broken.)

Then I found this offhand SuperUser comment which solved my problem:

Use -E instead of -r on OS X.

Now you know, aren’t you glad?

ETA: Looks good so far.