What programming/technical projects have you been working on?

Anyone here familiar with symbolic execution techniques that I can chat with privately? As my profile indicates, I'm a PhD student, and I've been looking at this space for a related application.

I put my website online using Hugo and Github Pages, as suggested in another topic. I suppose this is not something that even register as a "project" for the highly technical Tildes crowds, but it was enough of a challenge for me. Fighting anxiety may have been harder than the technical parts though. I'm using the Beautiful Hugo theme, which I edited mostly by looking at the files and commenting out stuff without really understanding them, as well as some overriden files. Even made it bilingual. It is nice but I'd like to create my own theme in the future. Hugo docs are pretty thin so I had to supplement them with multiple tutorials.

Next step, custom domain.

This week I finally got fed up enough to take youtube-dl and package it into a usable app where I can just enter a URL, it downloads the video, and starts playing it for me. I have it working on my Mac, and I can AirPlay from that to my AppleTV, but I'd rather just have the app on my AppleTV. Unfortunately, youtube-dl is written in Python and the AppleTV doesn't ship with Python installed. I know that I can embed it, but I'm not sure I'm up for the painful journey of trying to build an embeddable version. I have a strong dislike of the way most open source projects need to be built.

I spent a lot of time trying to 3D print a push button that would work based on air pressure, using a pressure sensor circuit I already had working using a rubber bulb.

Printing something that's both airtight and flexible isn't easy. I made one prototype that works and a lot of failures. It did give me a lot of practice printing with flex materials, though.

I finished the newsletter functionality for my hobby project https://linklonk.com (announcement post).

The email delivery is done through a free SendGrid account that allows up to 100 email per day. This is more than enough with the few active users we have. The SendGrid's api library was easy to use from Golang (the language the server is implemented in).

I needed to render html of the email messages on the server side. This is not something I had to do for the main web ui because there I use JSON to send data to an Angular-based client. To render the emails I used Golang's templating package html/template. It was quite nice.

One of the interesting challenges was to get the message delivered at the time the user configured. When the user configures that they want their email to be delivered at 10:00am every Tuesday it means that it should be at that time in the user's local time zone (America/New_York). Usually the times on the server side are usually expressed in UTC. But here we need to store the user's selected time ("10:00") and the local time-zone (America/New_York) and calculate when is the next Tuesday 10:00am in America/New_York. The reason we cannot convert it to UTC is because:

1. America/New_York does not have a constant offset from UTC because of daylight saving.
2. When it is Tuesday in UTC, it could be still Monday in a different time-zone, and vice versa. So the next day of the week calculation needs to be done in the user's local time zone.

On the web-version the users can upvote/downvote items so the system can adjust the signal-to-noise ratio of the feeds and other users that voted on that item. I wanted the same functionality to be available in the email. I did it by including this question under each item "Was this worth your time? Yes | No" The links go to https://linklonk.com/api/rateFromEmail?uid=<item id>&collectionId=<collection id>&token=k2nDwff0SQ69OBThn6kr_t1Ozxk:1625280261281&user=<user uid from firebase>
Where the token parameter is used to authenticate the action. The token is generated using https://github.com/golang/net/blob/master/xsrftoken/xsrf.go - a library that is used to generate tokens that help protect from XSRF attacks. The second part of the token (1625280261281) is the timestamp when the token was generated. The first part (k2nDwff0SQ69OBThn6kr_t1Ozxk) is a hash of the user id, the item id, the collection id (ie, does it go into your upvotes or downvotes), the time and the secret key that is only known to the server. This token helps verify that the token was generated for this specific action by the server (since no one else knows the secret key). And the server can limit how long a token is valid for because the token includes a tamper-proof timestamp.

I have a few concerns with this implementation:

• On the one hand the upvote/downvote and the email unsubscribe links (which is authenticated with a similar token) work in one click without the user having to be logged into linklonk.com on the device they are viewing the email on. On the other hand, if you forward this email to someone else then they will be able to vote on your behalf (only on the items included in the email). I wonder which side has more weight. It's probably not a big deal since the recommendations are personalized and are not very suitable for forwarding to other people.
• Do automatic systems try to fetch links in an email? For example, to scan for malware. If so, my server would get artificial votes.