Categories
Security What I’m Up To

Notes on OpenZiti Quickstart for an upcoming Ziti TV episode

For the curious, here are my notes for an upcoming Ziti TV episode where we’ll be talking about what’s in the OpenZiti Quickstart.

OpenZiti Quickstart is a single command (ziti edge quickstart) that launches a complete, working OpenZiti network a few seconds. It does a lot behind the scenes, by

  • creating a fresh certificate authority hierarchy,
  • initializing a controller database,
  • creating and enrolling a router identity,
  • bootstrapping an admin user,
  • and starting both the controller and router as a single running process.

It does all this with sensible default policies already in place, which means identities can immediately connect through the router to any service.

As its name implies, the Quickstart is meant to get an OpenZiti zero trust network up and running is very short order, and it’s meant for demos, local development, and learning the platform. It has everything a production deployment would spread across multiple processes, machines, and days of setup, but it’s packed into a single instance that you can tear down and re-run whenever you want.

Simply put, it’s the fastest path from zero to a working network you can actually build against.

As for the question of why I go with handwritten notes: it’s easier to add diagrams, and I end up understanding and retaining things better.

Categories
Tools What I’m Up To

“Retake the Lake” is now in the Chrome Web Store and easier to install!

My Chrome extension, Retake the Lake is now in the Chrome Web Store, which means it’s easier than ever to put it in your Chrome desktop browser!

I’ve made it easy to find with this URL:

globalnerdy.com/retakethelake

Now, all you have to do is go to the Retake the Lake page in the Chrome Web Store and click the Add to Chrome button:

You’ll see the “This extension is not trusted by Enhanced Safe Browsing” warning:

Click the Continue to install button.

This warning appears because this is my first Chrome extension, and Chrome doesn’t yet have enough developer history or reputation data about me to verify Retake the Lake.

Retake the Lake doesn’t use or sell any of your private data. It simply updates the contents of web pages and Google Maps to restore the correct name of Lake Ontario.

This pop-up will appear:

Click the Add extension button.

And in a second or two, you’ll see this near the upper right of your screen:

Congratulations! You now have Retake the Lake!

Once again, you can get Retake the Lake here:

globalnerdy.com/retakethelake

What is Retake the Lake?

Retake the Lake corrects “Lake America” to the proper “Lake Ontario” on Chrome desktop browsers.

(Unfortunately, the mobile versions of Chrome don’t support extensions.)

  1. On regular web pages, it rewrites “Lake Ontario” back to the proper, correct, and non-idiotic “Lake Ontario.”
  2. On Google Maps, it floats a clickable badge over the lake with a short explanation of where the real name comes from.

You can read more about how I made it here.

And remember…

Categories
Current Events What I’m Up To

Waiting for Google to approve “Retake the Lake”…or not

I’ve just submitted my Chrome extension, Retake the Lake, to the Chrome Web Store for approval. If approved, it will become really easy to add it to Chrome on your desktop.

In yesterday’s post on Retake the Lake, I described the extension, which does these two important things:

  1. On regular web pages, it rewrites “Lake America” back to the proper, correct, and non-idiotic “Lake Ontario.”
  2. On Google Maps, it floats a clickable badge over the lake with a short explanation of where the real name comes from.

You can install Retake the Lake right now, but the process is a little more involved. If approved for the Chrome Web Store, installing it will take a click or two at most.

Why might Retake the Lake not get approved?

Screenshot of Ars Technica article titled “Google Maps renames ‘Lake Ontario’ to ‘Lake America’ even faster than US government”.
Corporate bootlicking at its finest.

Google, who make Chrome, also make Google Maps, which is currently taking criticism for displaying Lake Ontario by the incorrect name. They make take a dim view of an extension that exists to correct their mistake.

Also, there’s this:

Photo of Sergey Brin with Gerelyn Gilbert-Soto. Text reads “Sergey Brin Move to the Right, With a ‘MAGA Girlfriend’ by His Side.”
On the bright side, they’re saving two other people.

Get Retake the Lake!

Do you want to try out Retake the Lake? Follow these steps:

  1. Download this .zip file, retake-the-lake-v1.0.1.zip, into a folder that you’re not going to delete (such as your Documents folder).
  2. Unzip the file to reveal the retake-the-lake folder.
  3. Open a new tab in Chrome and go to chrome://extensions.
  4. Turn on Developer mode by setting the Developer mode switch near the upper right corner of the screen to the “on” position.
    Chrome extensions screen, with arrow indicating that you should turn on Developer mode.
  5. Click the Load unpacked button near the upper left corner of the screen and select the retake-the-lake folder.
    Chrome extensions screen, with arrow indicating you should click the “Load unpacked” button and select the “retake-the-lake” folder.
  6. Use it!
Categories
Good Causes Programming What I’m Up To

Retake the Lake: A Chrome browser plug-in that corrects “Lake America” to “Lake Ontario”

I opened Google Maps on Sunday and scrolled northward to the old hometown of Toronto to see if the news reports were actually true. Unfortunately, it was. The big blue blob between Toronto and Rochester was incorrectly labelled Lake America.

Randy Jackson saying “That’s gonna be a NO from me, dawg.”

The U.S. changed the name in its own GNIS database in August following an executive order from the most petty of presidents. Google, which ties place names to each country’s official source, dutifully (and boot-licking-ly) started showing the new one to users with US IP addresses. If you’re in Canada and you view Lake Ontario in Google Maps, you’ll still see its proper name. Everyone outside the US sees both.

I’m in Tampa, which is in Florida (“the America of America”), so I got the new, incorrect name.

So I did what any reasonable person with VS Code, programming skills and a history of hacktivism would do. I wrote a Chrome extension.

It’s called Retake the Lake, it’s on GitHub, and building it turned out to be a much better story than I’d expected. There’s a genuinely interesting programming wall smack-dab in the middle of it.

What Retake the Lake does

Retake the Lake corrects “Lake America” to the proper “Lake Ontario” on Chrome desktop browsers. Unfortunately, the mobile versions of Chrome don’t support extensions.

  1. On regular web pages, it rewrites “Lake America” back to the proper, correct, and non-idiotic “Lake Ontario.”
  2. On Google Maps, it floats a clickable badge over the lake with a short explanation of where the real name comes from.

Get Retake the Lake!

Retake the Lake is now available in the Chromw Web Store, and I made this easy-to-remember shortcut for it:

globalnerdy.com/retakethelake

Technical notes

Part one: Replacing text is easy, right?

In theory, it is: You traverse the DOM, find text nodes, run a regex, and Bob’s your uncle. I’ve written this a hundred times, and if you’re a reader of this blog, you probably have too.

But it didn’t work on Google Maps’ search results, and I remembered why this is never as easy as it looks. Maps bolds your query inside the suggestion, so the markup is:

Lake <b>America</b>

In the example above, there’s no text node containing “Lake America.” There’s a node containing Lake and a different node inside a <b> containing America. A per-node replacer will completely miss it.

The fix is to stop thinking in nodes and start thinking in runs. Gather up adjacent text nodes that share a block-level ancestor, glue them into one string, run the match on that, then redistribute the result back across the original nodes. The end result is that the whole replacement lands in the first node the match touches, and the later ones give up their share.

The “block-level ancestor” part is key. Without it you’d happily join these two paragraphs:

<p>Visit the Lake</p>
<p>America is big</p>

…and produce something nobody asked for.

A bonus bug I nearly shipped

Early on, my rules were a list, applied in order:

["Lake America", "Lake Ontario"]
["Lake Ontario", "Lake Joey"] // don't ask

Run those sequentially on the same string and watch what happens: “Lake America” becomes “Lake Ontario” which the next rule immediately turns into “Lake Joey” (my original plan was to do the Trump thing and simply rename the lake after me). The rename cascades straight through the thing you were renaming it to.

The fix is to compile every rule into a single alternation regex and do exactly one pass, so each matched span is consumed once and never re-examined. Order stops mattering. It’s the kind of bug that’s obvious in hindsight and invisible while you’re in the zone.

Part two: The wall

And now, Google Maps.

You cannot change the label on the map. Not with this extension, not with any extension, not with a clever hack you’re about to suggest in the comments.

Google renders the basemap with WebGL vector tiles. That label’s not text. It’s also not isn’t a DOM node, nor is it alt attribute, and it isn’t a 2D canvas fillText() call you could monkey-patch. It’s glyph geometry uploaded to your GPU and painted as textured quads. By the time it reaches your eyeballs it has exactly as much “text” in it as the water underneath it; in other words: none. It’s all pixels.

Forcing raster tiles doesn’t work, either. Those are server-rendered PNGs with the label already baked in.

So updating the map label isn’t an option. That left me with everything around the map label: the sidebar heading, search results, autocomplete, the browser tab title, and aria-label text on the controls. Those are all DOM, and the rewriter fixes all of them.

This takes me to the badge.

How do you draw on a map you can’t read?

Without the ability to edit Lake Ontario’s label, I went for the next-best thing: putting something next to it. That brings about this fun question: How do you position an overlay on a map you can’t query?

You can’t ask Maps where the lake is. There’s no DOM to inspect and no API surface pointed at the renderer.

Fortunately, Google puts the answer in the URL:

/maps/@43.70,-77.90,8z

The first number after /maps/@ is the latitude of the centre of Lake Ontario. The number after that is the longtiude of that cenre. And finally, the last number, which is immediately followed with a z is the zoom level. Center latitude, center longitude, zoom. That’s everything you need, because Web Mercator is just simple math:

const world = 256 * Math.pow(2, zoom);
x = world * (lng + 180) / 360;
y = world * (0.5 - Math.log(Math.tan(Math.PI/4 + lat/2)) / (2*Math.PI));

Project the lake’s center, project the view’s center, subtract, and add the difference to the middle of the viewport, and that’s where the badge goes.

Project the lake’s bounding box the same way and you also know whether it’s on screen at all, so the badge only appears when there’s actually a Lake Ontario to point at. The badge also clamps to the visible edge when you’re zoomed into one end.

Reality rears its ugly head in two places, and both became features:

  1. Maps only rewrites the URL after a gesture settles. So during a drag or zoom, my position data is stale and the badge would slide across the water a beat behind your cursor. The solution was to hide the badhe during the drag. It reappears  about 350ms after the user stops fiddling with the map.
  2. Tilted and satellite views break the math. Those URLs carry a camera altitude (,1500m) or a tilt angle (,45t) instead of a plain zoom, and flat Mercator no longer describes what’s onscreen. The badge refuses to draw. It’s better to show nothing that to confidently point at the wrong lake.

The same trick, incidentally, works for anything geographic. Point the config at different coordinates and the badge follows.

The one-character bug that ate an element

Let me leave you with my favorite mistake of the whole build.

While restyling the badge, I edited the opening tag and lost a single >:

<div class="pin" id="pin" role="button"
aria-label="Note about this lake"
<span class="mark">i</span><span>Lake Ontario</span>
</div>

The badge still rendered. But the little white circular i chip vanished, replaced by a naked lowercase letter.

Here’s why, and it’s delightful. Without the closing bracket, the parser never leaves the tag. It keeps reading attributes — and <span is a perfectly acceptable attribute name as far as the HTML parser is concerned. So is class="mark". The tag finally closes on the > that was supposed to end the span’s opening tag. The span is eaten into the div’s attribute list and never becomes an element at all, so the CSS rule styling it matches nothing.

Inspect the element and you can see the crime scene: a stray <span sitting in the attribute list like it belongs there.

HTML’s error recovery is so determined to give you something that it will quietly digest an entire element rather than admit you made a typo.

Get the source code

Do you want to see the source code for Retake the Lake? It’s on Github at github.com/AccordionGuy/retake-the-lake. It’s MIT licensed.

Pull requests are welcome, especially if you’d like to add the other four Great Lakes to the config before Orange Julius Caesar gets any more ideas.

And remember…

Categories
Security What I’m Up To

A new “back of the envelope” drawing for NetFoundry’s new “Reachability Watch”!

Here’s my latest “back of the envelope” drawing, which I drew as a companion for a new NetFoundry series called Reachability Watch.

Published fortnightly, Reachability Watch covers the volume of new network-exploitable CVEs, the handful that clear a CVSS 8.6 bar, whatever KEV actually caused damage that period, and a running tally so the trend line becomes visible over time.

The drawing features this edition’s highlighted KEV. More formally known as CVE-2026-72898, it’s what I call “BYOK: bring Your Own Key,” because that’s essentially what the exploit does. You hand Metabase’s password-reset endpoint an extra user-id key it never asked for, nobody strips it, and it rides all the way into the SQL query.

Read it here:
https://netfoundry.io/reachability-watch/reachability-watch-cve-kev-tracker-2026-08-14/

Categories
Music What I’m Up To

My new synth arrived: The M-VAVE FM-1

Murphy’s Law strikes: Just before I’m about to leave for the weekly Tuesday happy hour for beer with the neighbors, the synth I ordered arrives. And a day early, too (this is beginning to sound like one of those “My steak is too juicy and my lobster too buttery” kind of complaints)!

The synth in question is pictured above: an FM-1 desktop synth made by a company called M-VAVE. For a mere US$79, it emulates the Yamaha DX7, the most 1980s of all the 1980s synths…

…but now in a package that’s slightly smaller than a VHS cassette.

I’ll post a review later, but since I have to run, I’ll post this guy’s review instead:

 

Categories
Editorial What I’m Up To

Global Nerdy is 20 years old today!

The stats

Since that I posted that first article on August 16, 2006 to Global Nerdy, it’s been…

  • 20 years
  • 2 blogging platforms (Blogware, then WordPress)
  • 11 million pageviews
  • Almost 5,000 articles (this one will be number 4,989)
  • 2 cities/countries:
    • Toronto, Ontario, Canada 2006 – 2014
    • Tampa, Florida, U.S.A. 2014 – present

…and of course, one helluva blogging adventure!

The name

I didn’t come up with the name; at least not directly. It was generated by a program I wrote, The Duke of URL, which demonstrated the “namespinner” API made by Tucows, where I was working as their developer advocate. You enter some keywords into the app, and it presented you with a list of suitable and available domain names.

One of the available domain names it presented was globalnerdy.com. The name was a little ridiculous; it sounded like the sort of thing made by whoever comes up with names for Japanese role-playing videogames. But it was kind of catchy and I decided to go with it.

The eras

To close (I’d love to write more, but today’s a busy day for me), some photos from this blog throughout the years…

A collage of the people from Toronto’s BarCamp/DemoCamp scene in the 2000s.
Developer dim sum lunch with Libin Pan and Reg Braithwaite.
With Amber Mac and Leo Laporte at a developer event in Toronto’s Liberty Village.
Onstage at the evening keynote at RailsConf 2006.
Danny O’Brien, Cory Doctorow, and me at Cory’s wedding.
On my second week on the job at Microsoft with Jeff “Coding Horror” Atwood.
Richard M. Stallman is clearly attracted to me because he’s playing with his hair.
With “Junior” my puppet friend from my short-lived children’s show. See the video below!

The world’s only Windows Phone-branded accordion!
Photo: Joey deVilla and Steve Ballmer, who is wearing a Canadian flag hat
Steve Ballmer ran up to my table and borrowed my hat at the Canadian Windows 7 launch.
Visiting some of my professors! First, Dr. Michael Levison, who ran the Computer Science department at Crazy Go Nuts University…
…and Dr. Robin Dawes, from whom I learned a lot about algorithms and data structures.
Ah, the Windows Phone days…

"I Want to Believe" poster from "The X-Files", with the flying saucer replaced by a giant Windows Phone

 

Going to BarCamp Tampa changed my life; that’s where I met Anitra!
Photo: From left to right, Joey deVilla (with accordion), Lyssa Adkins, Alistair Cockburn, and Anitra Pavka smile at an Agile Social party at Copper Shaker, St. Petersburg, Florida, December 17, 2018.
With Lyssa Adkins, Alistair Cockburn, and Anitra at Alistair’s birthday.
Anitra and I have co-presented a number of talks.
Cyber school during the pandemic was a wild experience!
I began the 2020s at Auth0…
Meeting Steve Wozniak at the first Civo Navigate.
For a little bit, I was the AI go-to guy on local Tampa news.
Presenting at BSides Tampa!

Joey de Villa’s NetFoundry business card
…and now I’m at NetFoundry!