Cowboy Programmer

I'm Removing My ChargeAmps Halo: A Critical Review

2026-02-13T00:21:00+01:00

If you are looking to install an EV charger at home, or if you are considering the ChargeAmps Halo, read this review first.

I recently bought a house that came equipped with a ChargeAmps Halo charger and an Enegic (now Perific) current load balancer. On paper, it sounded like a decent setup. In reality, it has been a masterclass in how not to design smart home hardware.

After months of frustration, support calls, and failed attempts to get basic functionality working reliably, I have decided to pay an electrician to rip the entire system out. Here is why you should probably avoid ChargeAmps.

ChargeAmps Halo Cloud Dependency for Basic Safety

The fragility of this system became apparent on my very first night in the house. I plugged in the car, expecting the 11kW capabilities that the charger claims and that my car can accept. Instead, I was getting a meager 5.2kW (approx 6-8A).

After phoning support, I learned the absurd truth: The ChargeAmps Halo defaults to a safety mode of 6A if it doesn’t have an active connection to the cloud.

This revealed a critical flaw in the architecture: total dependence on WiFi and the Cloud.

The same sad fact is true of the Enegic load balancer which measures the house consumption, but it doesn’t talk to the charger directly via a local network or cable. Instead: 1. It sends data to the internet (Cloud). 2. ChargeAmps cloud processes it. 3. The cloud sends a command back down to the Halo charger to adjust the current.

To even get the system to attempt a full charge, I had to relocate one of my WiFi access points specifically to provide coverage to the garage—a placement that worsened availability inside the house.

The “Partner” Ecosystem Problem

With the WiFi infrastructure finally in place, the next hurdle was administrative. Managing these devices requires phoning support—not just once, but multiple times. I had to contact both Enegic and ChargeAmps just to get accounts set up so I could even see my own hardware and enable them to communicate with each other.

But “seeing” is about all you can do. ChargeAmps has a philosophy where “admin” access is restricted to “partners” (i.e., the installation electricians). As an end-user and the owner of the hardware, you are treated as a guest system. You can only change parameters within the partner-defined boundaries.

This became a critical issue because I bought the house with the charger already installed. I don’t have a partner. I am just a guy with a charger I ostensibly own but cannot fully control.

Even getting basic data out of the device required begging. I had to contact support yet again just to obtain an API key, solely so I could visualize the charger stats in Home Assistant. It felt less like owning hardware and more like requesting permission to view my own usage data.

The Enegic Load Balancer That Couldn’t Balance

Once I had the WiFi fixed and the accounts linked, I expected smooth sailing. I drive over 100km a day and in the Swedish winter, I need to charge about 30kWh overnight to be ready for the next day.

Instead, I often woke up to a car that wasn’t fully charged. The culprit was the load balancer logic.

The load balancer was reacting to power spikes caused by the house heating system. Instead of gracefully lowering the current, it would frequently panic and stop the charging session entirely.

Thinking I had a capacity problem, I paid an electrician to upgrade my main breaker from 20A to 25A. All other things being equal, this gave me 5A of additional headroom. Since the minimum charging current is usually 6A, having 5A of pure buffer should have made it nearly impossible for the system to need to pause the charge.

After the upgrade, I logged into the Perific/Enegic interface and updated the settings to reflect the new 25A capacity. It made absolutely no difference. See the following graph for the power usage of the charger. At first glance the power seems good because the spikes are close to 10kW but the constant drops means the charger pauses all the time which drops the mean power to around 2kW.

I once again awoke to a pathetic 63% charge level. In frustration, I even tried configuring it with an absurd 250A capacity, hoping to force the algorithm to “max out.” The result? It throttled down to 2kW. I cannot explain it, and neither could the manual. The logic is simply fundamentally broken; it refused to utilize the clear overhead I had purchased. See the following graph of the maximum current used on any phase during the morning when no car is charging. The spikes in the graph are the electric radiators pulsing on and off to in response to their thermostats (set at 19C). The graphs shows very short spikes to 14A - meaning there should be a full 11A safely available at all times!

The 6A Limbo

So, the load balancer was useless. I decided to bypass it entirely. My plan was to run the charger at a constant current and handle any necessary limiting via the car settings or Home Assistant.

I contacted ChargeAmps support (yet again) and managed to convince an agent to set my “offline current” to 16A (max). This theoretically allows the charger to deliver full power even if I physically disconnected the load balancer.

In practice? No change.

Despite the support agent’s efforts, the hardware logic seems to override this setting. Whenever the load balancer isn’t dictating terms, the charger defaults back to its “safety mode” of 6A.

If your internet goes down? 6A. If their server has a hiccup? 6A. If you disconnect the malfunctioning load balancer? 6A.

For now, I am forced to live with this. 6A on three phases at 400V is around 4.1kW, meaning I can recharge my daily usage in about 7 hours. It is absolutely ridiculous to be throttled like this on an 11kW capable charger, but I can still get to work and back.

The OCPP Mirage on ChargeAmps

“But wait,” I thought, “The spec sheet says it supports OCPP 1.6J.”

Open Charge Point Protocol (OCPP) is the standard that allows chargers to talk to any management system. Theoretically, I should be able to disconnect it from the ChargeAmps proprietary cloud and connect it to Home Assistant or a local OCPP server to handle the logic myself.

Determined to make this work, I tested against three different OCPP implementations: 1. lbbrhzn/ocpp: The charger indicated it was ready, initiated a transaction, but then immediately went into a SuspendedEVSE state and never actually started flowing current. Remote start commands were ignored. 2. SteVe: The exact same behavior. Handshake, transaction start, then suspension. No charging. 3. Powerfill.app: This cloud-based option couldn’t even establish a connection, possibly due to SSL implementation issues on the charger side.

The verdict? The charger connects and handshakes, but refuses to charge.

Despite the marketing claims, the OCPP implementation seems non-functional.

Conclusion: Tear It Out

I accept the principle that certified electricians should handle high-voltage installations. However, I do not accept being locked out of the software configuration for hardware I legally own.

Consider my breaker box. I am not allowed to rewire it myself, but that does not mean there is a manufacturer’s padlock on it preventing me from resetting a fuse. What happens if my preferred electrician isn’t a “ChargeAmps Partner”? I am effectively held hostage by their partner network.

I am done fighting with it. I am hiring an electrician to remove this “smart” e-waste. I plan to replace it with a charger that has smart features as an optional extra, and where WiFi is not a requirement for basic functionality.

If you value reliability and control, pick a charger that supports local networking and open protocols natively, and Avoid ChargeAmps.

Tips for importing CSVs in GnuCash

2025-01-15T00:00:00+00:00

Condensing some information so that others can benefit from my experience with importing CSVs into GnuCash.

Having several banks means some difficulty in getting a proper overview of your finances. Hence, I use GnuCash to import all transactions and get a good overview of my finances.

Getting the data into GnuCash is quite tedious though. Banks don’t typically provide API access. So every once in a while, I log on to each bank, one by one, and download exported transactions. Sometimes, these are provided as CSVs. Sometimes, they are provided as Excel (.xlsx) files. Sometimes, the UI will say it’s an Excel file but what you end up downloading is a CSV file.

No matter. Pandas can handle both. Pandas is awesome. You should use it. But I digress.

Recommendations

Pre-format your data. Do not take your CSV straight from your bank to GnuCash. Massage the data a bit first.
When possible, use multi-split CSV files. This will save you a lot of time and swearing instead of relying on GnuCash’s bayesian matching algorithm.
Generate as few CSV files as possible for import into GnuCash. Also a time saver.

Pre-formatting

You should generate two files, one for single transactions, one for multi-split transactions.

Single transactions specify a single account for the transaction, while multi-split transactions specify multiple accounts associated with the transaction.

GnuCash requires the entire file to be multi-split or not multi-split. You can’t mix and match in a single file.

Single transactions

You want to format your data so that it corresponds to how GnuCash wants it. These are the minimum columns that you’ll want to have in your CSV:

Account, the account name in GnuCash to import the transaction into
Date, in yyyy-mm-dd format
Description, the text that describes the transaction
Amount, the amount of the transaction

These columns will let you smoothly import transactions into GnuCash.

Multi-split transactions

Use these columns to import multi-split transactions:

TransactionId, a unique identifier for the transaction
Account, the account name in GnuCash to import the transaction into
Date, in yyyy-mm-dd format
Description, the text that describes the transaction
Amount, the amount of the transaction
Value, the amount of the transaction in the original currency (I’ll explain why this is important later)
Commodity/Currency, the currency or commodity of the transaction
Price/Rate, the exchange rate used for the transaction

Why use multi-split transactions?

Several reasons:

A certain description is always a certain kind of Expense
You are transferring money between your own accounts, like between Savings accounts
You are buying/selling stocks
Your are convering between currencies are part of the transaction

It all boils down to: you know where the money came from and where it is going. Let’s just get that into the CSV.

Use transactionIds to match multi-split transactions

Multi-split transactions are just several transactions listed in the same file. GnuCash will group these transactions based on them having the same TransactionId.

So related transactions must share the same TransactionId.

The simplest case if for two transactions to be related. One is the debit, one is the credit.

But it is easy to extend this to more. Consider a mortgage payment. Three transactions will be involved:

TX1: Money leaving your bank account
TX2: Paying the interest
TX3: Paying down the principal

All three transactions will have the same TransactionId. The Values (not necessarily amounts) will also sum to zero.

What is Value and what is Amount?

We have to consider a currency exchange for this to make sense.

TX1: 100 USD leaves account A
TX2: 90 EUR arrives in account B

In this case the transactions will look like this:

TransactionId	Account	Amount	Value	Commodity	Price
123	Assets:AccountA	-100	-100	CURRENCY:USD	1
123	Assets:AccountB	90	100	CURRENCY:EUR	100/90

What tripped me up was that the price is always expressed as the source currency divided by the destination currency. Which seems opposite to me…

The Amount is the amount in the account currency. The Value is the amount in the “source” currency.

So as you can see, Amount doesn’t necessarily sum to zero, but Value should always do so.

Show me some code

I keep it simple, and work with Dicts. Because Pandas can handle lists of dicts to generate a dataframe which it can then write to a CSV.

Given you’ve parsed your raw CSV, you can create a transaction with:

def make_single_transaction(
    transaction_id: str,
    account: str,
    date: str,
    description: str,
    amount: float,
    commodity: str | None = None,
    balance: float | None = None,
    **kwargs,
) -> dict[str, str | float | None]:
    return {
        "TransactionId": transaction_id,
        "Account": account,
        "Date": date,
        "Description": description,
        "Amount": amount,
        "Value": amount,
        "Commodity/Currency": commodity,
        "Price/Rate": 1,
        "Balance": balance,
        **kwargs,
    }

Similarly for multi-split transactions, not much different:

def make_multisplit_transaction(
    transaction_id: str,
    account: str,
    date: str,
    description: str,
    amount: float,
    value: float,
    commodity: str | None,
    price: float | None = None,
    balance: float | None = None,
) -> dict[str, str | float | None]:
    price = price if price is not None else 1

    return {
        "TransactionId": transaction_id,
        "Account": account,
        "Date": date,
        "Description": description,
        "Amount": amount,
        "Value": value,
        "Commodity/Currency": commodity,
        "Price/Rate": 1 if price is None else price,
        "Balance": balance,
    }

You can generate a transaction ID by combining the account name and all columns in your raw CSV row to get a reasonably unique identifier. I like to generate UUIDs from this because it looks nicer.

import uuid

transaction_id = uuid.uuid5(uuid.NAMESPACE_DNS, f"{account}{date}{description}{amount}")

If you have more columns which makes the row more unique, stick em in there. If you have a balance column, that should hopefully change for each transaction.

Now if you have a transaction, and you know where the money is going, you can use this function to generate a matching transaction:

def make_matching_transaction(
    transaction: dict[str, str | float | None],
    transfer_account: str,
    amount: float | None = None,
) -> dict[str, str | float | None]:
    return make_multisplit_transaction(
        transaction_id=transaction["TransactionId"],
        account=transfer_account,
        date=transaction["Date"],
        description=transaction["Description"],
        amount= amount if amount is not None else -transaction["Amount"],
        value=amount if amount is not None else -transaction["Value"],
        commodity=transaction["Commodity/Currency"],
        price=transaction["Price/Rate"],
    )

Use it like this:

tx1 = make_single_transaction(
    transaction_id=transaction_id,
    account="Assets:Bank:Card",
    date=date,
    description=description,
    amount=amount,
)

tx2 = make_matching_transaction(
    transaction=tx1,
    transfer_account="Expenses:Groceries",
)

And here is a utility function to generate a currency exchange:

def make_currency_exchange_transaction(
    transaction_id: str,
    src_account: str,
    dest_account: str,
    date: str,
    description: str,
    src_amount: float,
    dest_amount: float,
    src_currency: str,
    src_balance: float | None = None,
    dest_balance: float | None = None,
) -> list[dict[str, str | float | None]]:
    if src_amount > 0:
        raise ValueError("src_amount should be negative")
    if dest_amount < 0:
        raise ValueError("dest_amount should be positive")

    src = make_multisplit_transaction(
        transaction_id=transaction_id,
        account=src_account,
        date=date,
        description=description,
        amount=src_amount,
        value=src_amount,
        price=1,
        commodity=src_currency,
        balance=src_balance,
    )

    dest = make_multisplit_transaction(
        transaction_id=transaction_id,
        account=dest_account,
        date=date,
        description=description,
        amount=dest_amount,
        value=-src_amount,
        price=abs(dest_amount) / abs(src_amount),
        commodity=src_currency,
        balance=dest_balance,
    )

    return [src, dest]

And writing to file a simple matter of:

import pandas as pd


def write_to_file(self, list_of_txns: list[dict], output_dir: str):
    if len(list_of_txns) > 0:
        output_file = os.path.join(output_dir, f"gnucash_txns.csv")
        with open(output_file, "w") as f:
            df = pd.DataFrame(list_of_txns)
            df.to_csv(f, index=False)

The biggest update to Feeder so far

2021-06-09T21:43:00+02:00

Just a placeholder so far. Needed a known blog to test a few things with.

Images
- Red dot
Text formatting
Headers
Lists
Videos
Audio

Images

And at long last animated in the reader itself!

Base64 encoded inline data image

Text formatting

A link to Gitlab.

Some inline code formatting.

And then

A code block
with some lines
of code should be scrollable if
one very very long line with many  sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss

A table!

Table 1.
This table demonstrates the table rendering capabilities of Feeder's Reader view. This caption is by the spec allowed to contain most objects, except other tables. See flow content.
Name	Number	Money
First and Last name	What number human are you?	How much money have you collected?
No Comment	Early!	Sad
Bob	66	$3
Alice	999	$999999
:O	OMG Col span 2
WHAAAT. Triple span?!
Firefox special zero span means to the end!

And this is a table with an image in it

Should be a debian logo above

And this is a link with an image inside

Here is a blockquote with a nested quote in it:

Once upon a time

A dev coded compose it was written:

@Composable fun FunctionFuns()

And there was code

Here comes some headers

Header 1

Header 2

Header 3

Header 4

Header 5

Header 6

Lists

Here are some lists

Bullet
Point
List

and

Numbered
List
Here

Videos

Here’s an embedded youtube video

Here’s an HTML5 video

Your browser does not support the video tag.

Audio

Your browser does not support HTML5 audio playback.

How to setup Transmission-daemon over a Wireguard VPN

2019-09-01T23:21:00+02:00

Quick post to immortilize the configuration to get transmission-daemon working with a wireguard tunnel.

If you don’t have a wireguard tunnel, head to https://mullvad.net/en/ and get one.

Transmission config

First, the transmission config is really simple:

#/etc/transmission-daemon/settings.json
{
  [...]

  "bind-address-ipv4": "X.X.X.X",
  "bind-address-ipv6": "xxxx:xxxx:xxxx:xxxx::xxxx",
  "peer-port": 24328,
  "rpc-bind-address": "0.0.0.0",

  [...]
}

I also run the daemon using the following service for good measure:

# /etc/systemd/system/transmission-daemon.service
[Unit]
Description=Transmission BitTorrent Daemon Under VPN
After=network-online.target
After=wg-quick@wgtorrents.service
Requires=wg-quick@wgtorrents.service

[Service]
User=debian-transmission
ExecStart=/usr/bin/transmission-daemon -f --log-error --bind-address-ipv4 X.X.X.X --bind-address-ipv6 xxxx:xxxx:xxxx:xxxx::xxxx --rpc-bind-address 0.0.0.0

[Install]
WantedBy=multi-user.target

Wireguard config

All the magic happens in the PostUp rule where a routing rule is added for any traffic originating from the wireguard IP addresses.

#/etc/wireguard/wgtorrents.conf
[Interface]
PrivateKey=
Address=X.X.X.X/32,xxxx:xxxx:xxxx:xxxx::xxxx/128
# Inhibit default table creation
Table=off
# But do create a default route for the specific ip addresses
PostUp = systemd-resolve -i %i --set-dns=193.138.218.74 --set-domain=~.; ip rule add from X.X.X.X table 42; ip route add default dev %i table 42; ip -6 rule add from xxxx:xxxx:xxxx:xxxx::xxxx table 42
PostDown = ip rule del from X.X.X.X table 42; ip -6 rule del from xxxx:xxxx:xxxx:xxxx::xxxx table 42

[Peer]
PersistentKeepalive=25
PublicKey=m4jnogFbACz7LByjo++8z5+1WV0BuR1T7E1OWA+n8h0=
Endpoint=se4-wireguard.mullvad.net:51820
AllowedIPs=0.0.0.0/0,::/0

Enable it all by doing

systemctl enable --now wg-quick@wgtorrents.timer
systemctl enable --now transmission-daemon.service

A comparison between fixed and variable interest rates

2018-03-05T23:00:00+02:00

The data I am using is originally from SwedBank and all data and code is available at GitLab. The data contains interest rates at 5 years fixed term, 2 years fixed term, and 3 months fixed term (also called variable rate in Sweden) for those dates when any rate was changed. The first rates are from 1989-11-01 and the last are from 2018-02-12. Example of the data:

	5y	2y	3m
Date
1989-11-22	13.50	13.50	12.75
1991-01-14	14.00	14.75	15.25
1993-01-13	12.75	13.00	13.75
1994-11-21	11.75	11.50	9.75
1996-03-12	9.85	8.95	9.10
2005-09-09	3.55	2.97	3.15
2005-10-03	3.69	3.09	3.15
2007-12-21	5.36	5.25	5.15
2008-01-24	5.13	4.94	5.15
2009-03-20	4.26	2.83	2.20

To make the calculations more convenient I assume that loans are only fixed the first day of the month. Example:

	5y	2y	3m
Date
1990-06-01	14.50	14.50	13.95
1992-03-01	12.50	13.00	14.75
1993-06-01	10.75	10.50	11.50
1998-02-01	6.70	6.40	5.80
2001-09-01	6.55	5.95	5.90
2004-11-01	4.85	3.90	3.65
2009-05-01	4.15	2.73	1.97
2010-08-01	3.99	2.90	2.17
2011-05-01	5.29	4.39	3.88
2011-11-01	4.59	4.14	4.35

If we graph the interest rates we get:

You can see a clear peak in the variable rate when the riksbank set the repo rate at 500% (mortgages “only” reached 24%). You can also see that during the early nineties the variable rate was higher than the fixed rates during relatively long periods. But to compare the actual cost over the fixed term we have to compare average rates.

For example, let us compare the actual average rates from the first of July 1991 during 5 years for variable rate (11.96%) and 5 years fixed term (12.25%). Even though with variable rate you’d have had a rate of 24% during a quarter you’d still pay less in total over the 5 years.

If the same calculation is made for every month you can see how much you would have earned/lost depending on when you started your fixed term. Since 5 years is not evenly divisible by 2 years, the 2 years fixed term refers to what the average rate would have been during the first 5 of the 6 years.

It’s quite clear that variable rate has nearly always been the most profitable alternative. At three seperate occasions it would have been more profitable to pick a 5 year fixed term: at the of 1989, the beginning of 1997, and in the middle of 2005. I won’t comment on the 2 years fixed term since it’s not a fair comparison to only look at 5 out of 6 years.

If we compare 2 years fixed term with variable rate:

Also here the most profitable choice is generally the variable rate however during times of rising interest rates getting a fixed 2 year term has been the better choice on several occasions. An important difference to the 5 years term is that you’re not locked in for long when the rates finally go down again (and you’re able to switch to variable rate).

If we compare all terms during 10 years:

Here it is clear that the variable rate is the most profitable.

Even though it has been possible at certain occasions (29 years and only 3 short occasions!) to get a fixed term for 5 years and pay less overall than with variable rate, I think it’s far too improbable that one is able to do it at the right time. You’re almost guaranteed to be paying more in the end.

Getting a fixed term for 2 years is more probable to be profitable, but even here it is more probable not to be.

Reduce the size of images even further by reducing number of colors with Gimp

2016-10-21T00:27:00+02:00

In Gimp you go to Image in the top menu bar and select Mode followed by Indexed. Now you see a popup where you can select the number of colors for a generated optimum palette.

You’ll have to experiment a little because it will depend on your image.

I used this approach to shrink the size of the cover image in the_zopfli post from a 37KB (JPG) to just 15KB (PNG, all PNG sizes listed include Zopfli compression btw).

Straight JPG to PNG conversion: 124KB

First off, I exported the JPG file as a PNG file. This PNG file had a whopping 124KB! Clearly there was some bloat being stored.

256 colors: 40KB

Reducing from RGB to only 256 colors has no visible effect to my eyes.

128 colors: 34KB

Still no difference.

64 colors: 25KB

You can start to see some artifacting in the shadow behind the text.

32 colors: 15KB

In my opinion this is the sweet spot. The shadow artifacting is barely noticable but the size is significantly reduced.

16 colors: 11KB

Clear artifacting in the text shadow and the yellow (fire?) in the background has developed an outline.

8 colors: 7.3KB

The broom has shifted in color from a clear brown to almost grey. Text shadow is just a grey blob at this point. Even clearer outline developed on the yellow background.

4 colors: 4.3KB

Interestingly enough, I think 4 colors looks better than 8 colors. The outline in the background has disappeared because there’s not enough color spectrum to render it. The broom is now black and filled areas tend to get a white separator to the outlines.

2 colors: 2.4KB

Well, at least the silhouette is well defined at this point I guess.

Don't start service on installation of Debian package

2016-10-19T00:00:00+02:00

A clear difference between Debian/Ubuntu and for example Red Hat/Fedora is that packages which include system services will enable and start those services at install time in Debian/Ubuntu whereas they will not start automatically in Red Hat/Fedora.

Sometimes it would be very convenient if the service would not start automatically, for example if you need to configure the service before starting it for the first time.

To prevent the automatic start of system services at install time in Debian, just set the RUNLEVEL environment variable like so:

RUNLEVEL=1 apt install -y PKG_NAME

Then you are free to configure your system before you start the service for real:

systemctl enable PKG_NAME
systemctl start PKG_NAME

Rebooting on wrong password

2016-09-28T22:57:21+02:00

Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-on state. And so your encrypted hard drive doesn’t increase your security at all since it’s currently unlocked.

In my mind, it’s a slight improvement if the computer somehow can shutdown if someone is trying to gain access to it. That way, the hard drive is no longer accessible and the number of possible attack vectors go down drastically. And so, if you type the wrong password 3 times on my laptop, it shuts down.

This is accomplished by using PAM, and its ability to invoke an arbitrary script as part of the login flow via pam_exec.so. The script itself looks like this:

#!/bin/bash
# Do not add -eu, you need to allow empty variables here!

# To be used with PAM. Look in /etc/pam.d for the script that your
# screensaver etc uses. Typically it references common-account and common-auth.
#
# In common-auth, add this as the first line
#auth       optional     pam_exec.so debug /path/to/wrongpassword.sh
#
# In common-account, add this as the first line
#account    required     pam_exec.so debug /path/to/wrongpassword.sh
#

COUNTFILE="/var/log/failed_login_count"

# Make sure file exists
if [ ! -f "${COUNFILE}" ];then
  touch "${COUNTFILE}"
  chmod 777 "${COUNTFILE}"
fi

# Read value in it
COUNT=$(cat "${COUNTFILE}")
# Increment it
COUNT=$((COUNT+1))
echo "${COUNT}" > "${COUNTFILE}"

# if authentication
if [ "${PAM_TYPE}" == "auth" ]; then
  # The count will be at 4 after 3 wrong tries
  if [ "${COUNT}" -ge 4 ]; then
    # Shutdown in 1 min
    #/usr/bin/shutdown --no-wall -h +1
    # This is a hack because the line above gives a segfault in logind
    echo "0" > "${COUNTFILE}"
    systemctl poweroff
  fi
# If authentication succeeded, and we are now in account phase
elif [ "${PAM_TYPE}" == "account" ]; then
  echo "0" > "${COUNTFILE}"
  # Cancel shutdown which was just issued
  shutdown -c
fi

exit 0

On my Debian system, PAM ends up looking at /etc/pam.d/common-auth and /etc/pam.d/common-account. These are invoked in different parts of the authentication flow. In common-auth, add this as the first line:

auth optional pam_exec.so debug /path/to/wrongpassword.sh

And then in common-account, add this as the first line:

account required pam_exec.so debug /path/to/wrongpassword.sh

You can try it immediately if it works. Lock your screen, and type the wrong password 4 times. If it works, your computer should shut down.

WARNING: DO NOT ENABLE ON SERVERS

This is NOT something you want to do on any machine. Most notably, it’s probably a huge mistake to copy this verbatim on a machine which accepts remote connections. In that case, you essentially enable anyone to DOS you by entering the wrong password via SSH or similarly. So don’t do this if you allow remote connections to your machine (which shouldn’t be a thing on a laptop).

Compress all the images!

2016-08-26T13:17:40+02:00

Update 2016-11-22: Made the Makefile compatible with BSD sed (MacOS)

One advantage that static sites, such as those built by Hugo, provide is fast loading times. Because there is no processing to be done, no server side rendering, no database lookups, loading times are just as fast as you can serve the files that make up the page. This means that bandwidth becomes the primary bottleneck, which incidentally is one of the factors used by Google to calculate your search ranking. See also Pagespeed Insights.

Compressing images

Because the largest pieces of a page typically consist of images, it stands to reason that if we can make the images smaller, we can make the page load faster. Luckily there exists methods that can compress images losslessly. That means that the quality stays exactly the same, the page only loads faster. That seemed like a no-brainer to me so I compressed all the images on the site using PNGout as advised by Jeff Atwood. I mean, who doesn’t like free bandwidth?

A new algorithm called Zopfli (open sourced by Google, also mentioned by Jeff) claims even better results than PNGout though. Results on this site’s images confirm those claims. Running the tool on images already compressed by PNGout gives output such as this:

./zopflipng --prefix="zopfli_" static/images/2014/Dec/Screenshot-from-2014-12-29-13-28-29.png
Optimizing static/images/2014/Dec/Screenshot-from-2014-12-29-13-28-29.png
Input size: 89420 (87K)
Result size: 90361 (88K). Percentage of original: 101.052%
Preserving original PNG since it was smaller

./zopflipng --prefix="zopfli_" static/images/2014/Jun/Jenkins_install_git.png
Optimizing static/images/2014/Jun/Jenkins_install_git.png
Input size: 189406 (184K)
Result size: 166362 (162K). Percentage of original: 87.834%
Result is smaller

./zopflipng --prefix="zopfli_" static/images/2014/Jun/jenkins_batch.png
Optimizing static/images/2014/Jun/jenkins_batch.png
Input size: 21933 (21K)
Result size: 16255 (15K). Percentage of original: 74.112%
Result is smaller

./zopflipng --prefix="zopfli_" static/images/2014/Jun/jenkins_build_step.png
Optimizing static/images/2014/Jun/jenkins_build_step.png
Input size: 8184 (7K)
Result size: 6809 (6K). Percentage of original: 83.199%
Result is smaller

./zopflipng --prefix="zopfli_" static/images/2014/Jun/jenkins_config_git.png
Optimizing static/images/2014/Jun/jenkins_config_git.png
Input size: 57897 (56K)
Result size: 47164 (46K). Percentage of original: 81.462%
Result is smaller

The first result in the example output shows a case where Zopfli would actually have made the file bigger (because it was already compressed by PNGout, remember). This is nothing you have to worry about because it’s actually smart enough that it simply copies the original file in that case.

Comparing to both before any compression, and PNGout, yielded the following results:

	Mean relative size
Before	1.00
PNGout	0.84
ZopfliPNG	0.77

Box plot of results on all images:

Source files: before.csv, pngout.csv, zopfli.csv

And this is with the default arguments. It is possible squeeze yet a couple of more bytes out of this if you’re willing to wait longer.

Automate it with Make

Another joy of using a simple static site is that it is possible to compose regular tools to do useful things. Tools like Make. And we can use Make to build the site, as well as compressing images which have not already been compressed. You could do it manually for each new image that you add of course but be honest, you know that you’re gonna forget to do it at some point. So let’s automate it instead!

This is the Makefile that I use to build this site with, note that public depends on $(PNG_SENTINELS), so I literally can’t forget to compress any new images added:

.PHONY: help build server server-with-drafts clean zopfli

PNG_SENTINELS:= $(shell find . -path ./public -prune -o -name '*.png' -print | sed 's|\(.\+/\)\(.\+.png\)|\1.\2.zopfli|g')

help: ## Print this help text
	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'

server: ## Run hugo server
	hugo server

server-with-drafts: ## Run hugo server and include drafts
	hugo server -D

build: public ## Build site (will also compress images using zopfli)

zopfli: $(PNG_SENTINELS) ## Compress new images using zopfli

clean: ## Remove the built directory
	@rm -rf public

public: $(PNG_SENTINELS)
	@rm -rf public
	hugo

# Zopfli sentinel rule, assumes zopflipng binary is in the same folder
.%.png.zopfli: %.png
	./zopflipng --prefix="zopfli_" $<
	@mv $(dir $<)zopfli_$(notdir $<) $<
	@touch $@

For best performance, run make with parallel jobs (change 4 to your number CPUs): make -j4 zopfli.

To know which files have already been compressed without actually running Zopfli on it again (which takes a while), sentinel files are created with this pattern: ..zopfli. Thus, the next time around, zopfli is only invoked for files which have not already been compressed, making it a one-time operation. And when everything has already been compressed, you’ll just get this:

make: Nothing to be done for 'zopfli'.

Migrating from Ghost to Hugo

2016-07-25T23:55:38+02:00

So I recently migrated this site from Ghost to Hugo after reading a nice article about the Hugo in Linux Voice #20 (funnily enough, the same issue also features an article about Ghost). I originally made the switch to Ghost from Jekyll back in 2014 or so mainly because I could not find a good theme to use. Ghost also seemed to have a lot of cool features and it’s fun to try new things.

I think it’s safe to say that I am hardly a prolific blogger. I mainly write about stuff which I personally cannot find on the web which I think should exist, because I will likely need it myself sometime in the future. So it’s hardly a surprise that I am not in the target audience for Ghost.

Things about Ghost which annoy me

It’s written in NodeJS — people who think JS is a good server language also tend to think that it’s a good idea to depend on just about any package, and download it in every single build. Which becomes really funny sometimes.
Poor selection of themes — this is subjective of course, but it seems to me that the free options don’t have much in terms of diversity. Heck, they even call it a marketplace which rubs me the wrong way.
Themes end up being quite reliant on JS if you want necessary features like syntax highlighting on code snippets — I often browse with JS disabled and should be able to view my own site.
Markdown parser treats newlines as significant — meaning you can’t have properly aligned paragraphs in your editor.

That last point irritates me deeply but it’s not as bad as the next point.

You can effectively lock an account by entering the wrong password 3 times.

This requires some explanation. So Ghost, targeting teams of bloggers really, naturally have an account system much like Wordpress. Now, as I was surveying the security status of other services I am running, I was wondering how Ghost handled someone trying to brute force your account and decided to simply try it out. Type the wrong password once too many, and this happens:

It doesn’t lock it for a single IP address (I tried from several), it locks the entire account. Effectively, someone can just set up a script to try an account indefinitely simply with the intention to block someone from logging in.

The log doesn’t even show login attempts, so there is no way to implement sensible blocking strategies using something like fail2ban.

The whole thing left a bad taste my mouth so it was a very suitable timing to read an article on Hugo.

Things about Hugo which excite me

Markdown parser treats newlines correctly
It’s a static site generator and not a service — this meant 100MB (10%) of RAM became available on my server and there is no account to hack (or block).
Supports everything of Ghost (that I am aware of).
The simplicity of Hugo makes it quite painless to do useful things compared to ignored feature requests for the same in Ghost.
Can do server side syntax highlighting using Pygments.
Some really nice themes are available, and they are all free.

Migrating all data from Ghost

Migrating from Ghost also turned about to be really painless. There were several scripts around for exactly this but they all turned out to be written in odd languages, and did not actually migrate all the metadata in Ghost. So I wrote my own in Python with these killer features:

Migrates tags.
Migrates dates.
Migrates drafts as drafts.
Creates aliases in your posts which makes sure that old permalinks will still work!
Migrates cover pictures as banner images, just select a theme which support them.
Rewrites all relative links so they all still work (this includes images).
Code blocks with language definitions like ```language-java are changed to ```java.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
'''
A simple program which migrates an exported Ghost blog to Hugo.
It assumes your blog is using the hugo-icarus theme, but should
work for any theme. The script will migrate your posts, including
tags and banner images. Furthermore, it will make sure that
all your old post urls will keep working by adding aliases to them.

The only thing you need to do yourself is copying the `images/`
directory in your ghost directory to `static/images/` in your hugo
directory. That way, all images will work. The script will rewrite
all urls linking to `/content/images` to just `/images`.
'''

import argparse
import json
from datetime import date
from os import path
from collections import defaultdict
import re

_post = '''
+++
date = "{date}"
draft = {draft}
title = """{title}"""
slug = "{slug}"
tags = {tags}
banner = "{banner}"
aliases = {aliases}
+++

{markdown}
'''


def migrate(filepath, hugodir):
    '''
    Parse the Ghost json file and write post files
    '''
    with open(filepath, "r") as fp:
        ghost = json.load(fp)

    data = ghost['db'][0]['data']

    tags = {}
    for tag in data["tags"]:
        tags[tag["id"]] = tag["name"]

    posttags = defaultdict(list)

    for posttag in data["posts_tags"]:
        posttags[posttag["post_id"]].append(tags[posttag["tag_id"]])

    for post in data['posts']:
        draft = "true" if post["status"] == "draft" else "false"
        ts = int(post["created_at"]) / 1000

        banner = "" if post["image"] is None else post["image"]
        # /content/ should not be part of uri anymore
        banner = re.sub("^.*/content[s]?/", "/", banner)

        target = path.join(hugodir, "content/post",
                           "{}.md".format(post["slug"]))

        aliases = ["/{}/".format(post["slug"])]

        print("Migrating '{}' to {}".format(post["title"],
                                          target))

        hugopost = _post.format(markdown=post["markdown"],
                                title=post["title"],
                                draft=draft,
                                slug=post["slug"],
                                date=date.fromtimestamp(ts).isoformat(),
                                tags=posttags[post["id"]],
                                banner=banner,
                                aliases=aliases)

        # this is no longer relevant
        hugopost = hugopost.replace("```language-", "```")
        # /content/ should not be part of uri anymore
        hugopost = hugopost.replace("/content/", "/")
        hugopost = re.sub("^.*/content[s]?/", "/", hugopost)

        with open(target, 'w') as fp:
            print(hugopost, file=fp)


def main():
    parser = argparse.ArgumentParser(
        description="Migrate an exported Ghost blog to Hugo")
    req = parser.add_argument_group(title="required arguments")
    req.add_argument("-f", "--file", help="JSON file exported from Ghost",
                     required=True)
    req.add_argument("-d", "--dir", help="Directory (root) of Hugo site",
                     required=True)

    args = parser.parse_args()

    migrate(args.file, args.dir)


if __name__ == "__main__":
    main()

Next post, I might write about what changes I made to the theme, and some nifty Nginx tricks you can use to stay compatible with old links.

Set refresh rate of screen from script

2016-05-18T00:00:00+00:00

Getting a great new 100 Hz Ultra Wide monitor does not come without its share of tweaking. So it turns out that the refresh you set on your monitor in Nvidia settings (as explained in a previous post does not apply to all the display ports. They apparently count as different screens with different settings or something.

So, here’s a handy script which you can add to your window manager’s autostart applications to set the refresh rate and resolution of your screen, regardless of which actual port you use:

#!/bin/bash -eu
RES="3440x1440"
RR="100"

# Do for every output, so that it doesn't matter where you plug in
# your monitor.
for output in $(xrandr | grep "DP-" | sed -e "s/\(DP-.\).*/\1/"); do
  echo "Trying to set mode on $output"
  if xrandr --output "$output" --mode "$RES" -r "$RR"; then
    echo "Success: $RES $RR Hz set on $output"
  fi
done

It iterates over all the display ports on your graphics card, so it doesn’t matter where you plug your monitor in.

In XFCE, you’d add this script to Application Autostart:

Fixing the up button in Python shell history

2016-04-02T00:00:00+00:00

In case your python/ipython shell doesn’t have a working history, e.g. pressing ↑ only prints some nonsensical ^[[A, then you are missing either the readline or ncurses library.

Ipython is more descriptive that something is wrong, but if you’re in the habit of mostly using python as a quick calculator, you might never notice:

If you’re using Miniconda then just do:

conda install ncurses readline

And ↑ should work:

Nvidia G-Sync and Linux

2016-03-05T00:00:00+00:00

After getting a fancy new monitor with G-Sync support, I was eager to try it out in my Linux gaming setup. While Nvidia fully supports G-Sync in their Linux drivers, it turns out that other components of the system can get in the way. As explained by a post on the Nvidia forums:

For G-SYNC to work, the application has to be able to flip and the symptoms you’re describing here sound like it’s not able to flip in your configuration. There are a variety of reasons why flipping might not be working, but the most likely culprits here are either the compositor getting in the way, or the game not being completely full-screen. The full-screen requirement includes the game being completely unoccluded, so if your window manager is drawing something on top of the game, even just by one pixel, it will prevent flipping. Full-screen also means that it has to cover the entire X screen, which includes both monitors if you have them both enabled.

Can you please try a different window manager / desktop environment to see if the behavior changes?

Since only a minority of PC-gamers are actually on Linux, and only a minority of those actually have G-Sync capable monitors, Googling for assistance was… challenging. So, for any other Linux gamers out there, here is a short guide on how to enable G-Sync and verify that it works. Some of the steps are XFCE specific, as this is my window manager of choice on my gaming PC. If you are using a different window manager, you’ll have to look through your options to find the equivalent settings.

Nvidia settings

Sync to VBlank: Optional
Allow Flipping: Required
Allow G-SYNC: Required
Enable G-SYNC Visual Indicator: Optional

The only two required settings are flipping and G-Sync, the others are optional. Enabling Sync to VBlank (VSync) in combination with G-Sync only prevents the GPU from generating an FPS beyond your monitor’s max refresh rate (which you can’t see anyway). It is turned off below the max refresh rate when G-Sync is enabled.

The visual indicator is useful here to see that G-Sync is working. If all goes well, you should see a green “G-SYNC” text in the corner when running a game.

Disable compositor

As mentioned in the forum post, a compositor will prevent G-Sync from activating because essentially something is rendering above the game. The same reason prevents G-Sync from working in Window mode (unlike Windows, where G-Sync does not require fullscreen).

For XFCE, go to Window Manager Tweaks under Settings

Then under the Compositor tab, make sure the compositor is disabled

In addition, depending on your setup, make sure you don’t have things like Compton or Compiz enabled.

Start a game in fullscreen

As mentioned, you must run the game in fullscreen mode. G-Sync does not work with window mode in Linux.

I did notice that there are games which do not enable G-Sync. One example is “Cities: Skylines”. So make sure to try several games if you don’t see the G-Sync logo.

A good candidate here is Dota 2 since it is free to play. Dota 2 running in “Desktop-Friendly Fullscreen” does enable G-Sync. As does Portal 2 and XCOM 2.

Encrypt a BTRFS RAID5-array in-place

2014-12-28T00:00:00+00:00

When I decided I needed more disk space for media and virtual machine (VM) images, I decided to throw some more money at the problem and get three 3TB hard drives and run BTRFS in RAID5. It’s still somewhat experimental, but has proven very solid for me.

RAID5 means that one drive can completely fail, but all the data is still intact. All one has to do is insert a new drive and the drive will be reconstructed. While RAID5 protects against a complete drive failure, it does nothing to prevent a single bit to be flipped to due cosmic rays or electricity spikes.

BTRFS is a new filesystem for Linux which does what ZFS does for BSD. The two important features which it offers over previous systems is: copy-on-write (COW), and bitrot protection. See, when running RAID with BTRFS, if a single bit is flipped, BTRFS will detect it when you try to read the file and correct it (if running in RAID so there’s redundancy). COW means you can take snapshots of the entire drive instantly without using extra space. Space will only be required when stuff change and diverge from your snapshots.

See Arstechnica for why BTRFS is da shit for your next drive or system.

What I did not do at the time was encrypt the drives. Linux Voice #11 had a very nice article on encryption so I thought I’d set it up. And because I’m using RAID5, it is actually possible for me to encrypt my drives using dm-crypt/LUKS in-place, while the whole shebang is mounted, readable and usable :)

Some initial mistakes meant I had to actually reboot the system, so I thought I’d write down how to do it correctly. So to summarize, the goal is to convert three disks to three encrypted disks. BTRFS will be moved from using the drives directly, to using the LUKS-mapped.

Unmount the raid system (time 1 second)

Sadly, we need to unmount the volume to be able to “remove” the drive. This needs to be done so the system can understand that the drive has “vanished”. It will only stay unmounted for about a minute though.

sudo umount /path/to/vol

This is assuming you have configured your fstab with all the details. For example, with something like this (ALWAYS USE UUID!!)

# BTRFS Systems
UUID="ac21dd50-e6ee-4a9e-abcd-459cba0e6913" /mnt/btrfs  btrfs   defaults       0        0

Note that no modification of the fstab will be necessary if you have used UUID.

Encrypt one of the drives (time 10 seconds)

Pick one of the drives to encrypt. Here it’s /dev/sdc:

sudo cryptsetup luksFormat -v /dev/sdc

Open the encrypted drive (time 30 seconds)

To use it, we have to open the drive. You can pick any name you want:

sudo cryptsetup luksOpen /dev/sdc DRIVENAME

To make this happen on boot, find the new UUID of /dev/sdc with blkid:

sudo blkid

So for me, the drive has a the following UUID: f5d3974c-529e-4574-bbfa-7f3e6db05c65. Add the following line to /etc/crypttab with your desired drive name and your UUID (without any quotes):

DRIVENAME   UUID=your-uuid-without-quotes   none    luks

Now the system will ask for your password on boot.

Add the encrypted drive to the raid (time 20 seconds)

First we have to remount the raid system. This will fail because there is a missing drive, unless we add the option degraded.

sudo mount -o degraded /path/to/vol

There will be some complaints about missing drives and such, which is exactly what we expect. Now, just add the new drive:

sudo btrfs device add /dev/mapper/DRIVENAME /path/to/vol

Remove the missing drive (time 14 hours)

The final step is to remove the old drive. We can use the special name missing to remove it:

sudo btrfs device delete missing /path/to/vol

This can take a really long time, and by long I mean ~15 hours if you have a terrabyte of data. But, you can still use the drive during this process so just be patient.

For me it took 14 hours 34 minutes. The reason for the delay is because the delete command will force the system to rebuild the missing drive on your new encrypted volume.

Next drive, rinse and repeat

Just unmount the raid, encrypt the drive, add it back and delete the missing. Repeat for all drives in your array. Once the last drive is done, unmount the array and remount it without the -o degraded option. Now you have an encrypted RAID array.

Making an RSS reader app

2014-08-28T00:00:00+00:00

So I’ve been busy building my own RSS reader for the last few weeks. My motivation to make this app is because I got angry at gReader for displaying fullscreen-ads. The source is available on GitHub.

I started with an idea of targeting Android-L, but because it’s only in preview any app targeting L will be completely incompatible with earler versions. Hence I was forced to refrain from using the new RecyclerView which I really liked. In general I’ve been stealing as much code as possible from the Google-IO app.

It’s early still, but here are two screenshots of current progress:

To parse RSS feeds I have forked Simplistic-RSS by ShirwaM. To display images I am using Picasso by Square (awesome library). I don’t have any intention of uploading this app to the Play store at this time, at least not until I feel that it is fairly stable and feature complete. I am building it all for myself as this is the only kind of app which I actually use everyday. I figure I can talk about the difficulties that I encounter and how to solve them. So today’s topic will be:

Displaying formatted text with images

RSS feeds generally have stories formatted in HTML. For example, see the RSS feed of this blog. This is good because it means all we need to do is decode it and display it. You could use a WebView, but that would be unacceptably ugly and disgusting for an app of mine. A nicer solution is to use a normal TextView. You can actually format HTML easily and display it with:

textview.setText(android.text.Html.fromHtml(htmlString));

This simple act gets you most of the way. Here’s what a story looks like with this:

Notice that in the first image, the image is missing and you don’t see that there is a list in the beginning. In the second image, the source code has no special formatting and it’s hard to tell when it starts or stops.

fromHtml is great, but it is missing functionality to handle some tags. Lucky for us, it is possible to hand it some tagHandlers for those cases. Because I am downloading images, I do the formatting in a background thread using a Loader. To this end I created the ImageTextLoader. What it does instead is:

android.text.Html.fromHtml(text, imageHandler, TagHandler);

Where the imageHandler is really simple (notice that I use Picasso to get the image from the network):

imgThing = new Html.ImageGetter() {
    /**
     * This methos is called when the HTML parser encounters an
     * <img> tag.  The source argument is the
     * string from the "src" attribute; the return value should be
     * a Drawable representation of the image or null
     * for a generic replacement image.  Make sure you call
     * setBounds() on your Drawable if it doesn't already have
     * its bounds set.
     *
     * @param source
     */
    @Override
    public Drawable getDrawable(final String source) {
      Drawable d = null;
      try {
        final Bitmap b = Picasso.with(appContext).load(source).get();
        // Get original size
        int w = b.getWidth();
        int h = b.getHeight();
        // Shrink if big
        if (w > maxSize.x || h > maxSize.y) {
          Point newSize = scaleImage(w, h);
          w = newSize.x;
          h = newSize.y;
        }
        // Need to return a drawable
        d = new BitmapDrawable(appContext.getResources(), b);
        d.setBounds(0, 0, w, h);
      } catch (IOException e) {
        Log.e("JONAS", "" + e.getMessage());
      }
      return d;
    }
  };

The tag handler contains a bit more code, and I won’t paste all of it here. The tags which are handled can be seen in handleTag:

public void handleTag(final boolean opening, final String tag,
                      final Editable output, final XMLReader xmlReader) {
  if (tag.equalsIgnoreCase("ul")) {
    handleUl(output, opening);
  } else if (tag.equalsIgnoreCase("ol")) {
    handleOl(output, opening);
  } else if (tag.equalsIgnoreCase("li")) {
    handleLi(output, opening);
  } else if (tag.equalsIgnoreCase("img")) {
    handleImgEnd(output);
  } else if (tag.equalsIgnoreCase("code")) {
    handleCode(output, opening);
  } else if (tag.equalsIgnoreCase("pre")) {
    handlePre(output, opening);
  }
}

Note that fromHtml only notifies your handler about img-tags when they have ended, so I use that to insert a newline after each image. I would have liked to use it to get the configured size of the image, but that will have to wait for another day. For code-tags, I reduce the size of the text and make it Monospace:

// Source code
private void handleCode(final Editable text,
                        final boolean start) {
  // Should be monospace
  if (start) {
    start(text, new Monospace());
    start(text, new RelativeSize());
  } else {
    end(text, Monospace.class,
        new TypefaceSpan("monospace"));
    end(text, RelativeSize.class,
        new RelativeSizeSpan(0.8f));
  }
}

The start and end methods were simply stolen straight from android.Html.

Result

Here’s the result using the added tagHandlers:

Handling clicks on links

Thankfully I had already solved the issue of clickable spans in NoNonsense Notes. See [ReaderFragment]() for this:

// Catch clicks on links
mBodyTextView.setOnTouchListener(new View.OnTouchListener() {
    @Override
    public boolean onTouch(final View v,
                           final MotionEvent event) {
      TextView widget = (TextView) v;
      Object text = widget.getText();
      if (text instanceof Spanned) {
        Spanned buffer = (Spanned) text;
        
        int action = event.getAction();
        
        if (action == MotionEvent.ACTION_UP ||
            action == MotionEvent.ACTION_DOWN) {
          int x = (int) event.getX();
          int y = (int) event.getY();
          
          x -= widget.getTotalPaddingLeft();
          y -= widget.getTotalPaddingTop();
          
          x += widget.getScrollX();
          y += widget.getScrollY();
          
          Layout layout = widget.getLayout();
          int line = layout.getLineForVertical(y);
          int off = layout.getOffsetForHorizontal(line, x);
          
          ClickableSpan[] link =
              buffer.getSpans(off, off, ClickableSpan.class);
          
          // Cant click to the right of a span,
          // if the line ends with the span!
          if (x > layout.getLineRight(line)) {
            // Don't call the span
          } else if (link.length != 0) {
            link[0].onClick(widget);
            return true;
          }
        }
      }
      return false;
    }
  });

Thus clicking on links in the TextView will open them in the browser. You could do whatever you want instead of calling link[0].onClick() however.

That’s it for today. I’ll write more about other pieces of the app soon. Things like how the database is structured or how to use ExpandableListView.