Skip to content

A guide to shitty web designs (please don’t do this)

“Things used to be better in the past.” Sounds familiar? While it may be a simple sign of nostalgia, sometimes… it’s just true.
Website designs have improved in many ways over the last couple of decades. For instance, see a blast from the past here if you want to hurt your eyes with some ancient designs that are still online. Although they aren’t the worst (those have been taken down ^^). But not all changes are good, and modern websites tend to increasingly have some UX flaws that barely occurred, if at all, in the past.

Here’s a list of 8 of such annoyances. It’s not a “top 8”, it’s just things I wrote down as I was encountering those flaws. They’re not sorted, not exhaustive, and you’ll see they mostly revolve around login procedures for some reason.

1) The hidden login form

Some websites place an extreme focus on the sign-up form, and neglect/hide/bury the login form. Combined with a tendency to make sign up forms as simple/short as possible, it makes it very easy to get mixed up. These days, I regularly fill sign up forms by accident, when what I meant was to log in. Simply because some stupid UX designer put a 2-field registration form right where you would expect a log in form. And then the form tells me “this account already exists”. Yes, I know, I was trying to log in.
I don’t get the logic in their twisted mind: you only register once, you log in many times, why the hell make it longer to log in than to register?! To me, it signals that they desperately need more registrations… Gladly, it’s still rather rare.

2) The 2-step login form

When I started web development, a good practice, on a failed login attempt, was to show a generic error message like “invalid credentials”, giving the user no indication of whether or not the ID they entered was a valid ID in the first place.
I don’t know what the hell happened, but at some point this commonsense practice became an oddity. And then some morons started to design 2-step login forms like: 1) type your e-mail 2) we tell you if it’s a valid ID, and if so now you type your password. I don’t know who started it all, but the first time I saw that was for the… Gmail login. Kudos, Google!

When this was introduced, I remember a bunch of discussion on IT/dev forums, basically all agreeing that this was not just silly, but a security issue. With such a system, typically you can check if e-mail address X@Y.Z is a registered user on site shitdesign.com. Random example: imagine if Pornhub did that? (NB: I just had a look, they don’t*)
Some websites have thought about that. But they tried to be smart: instead of reverting back to the good, old-fashioned way to do a login form, they had the genius idea to keep the 2 steps and add… a CAPTCHA! And not just one, but 2: one after entering your ID, then another one after entering your password. Isn’t that brilliant? What did you say? You can’t believe people can be that stupid? Well, believe me now:

2-step login with a CAPTCHA, step 1 2-step login with a CAPTCHA, step 2

Oh and although it prevents massively checking if a list of e-mails have an account, it doesn’t prevent manually checking a few e-mails.

Apart from this problem, which people who “have nothing to hide” maybe won’t care about (although captchas are never very fun), those 2-step login forms have the very, highly annoying characteristic of making it a pain to use a password manager. RIP credentials autotype! Thanks smart UX designer!

3) Other BS that breaks password managers

Two-step login isn’t the only thing that breaks password managers. Some sites show cute modals and stuff, but sometimes those decorative features use weird JavaScript that makes the login form vanish as soon as it loses focus (say… when you want to switch to your password manager to trigger auto-typing). On the plus side, that’s not a voluntary “feature”, so you can expect it to be fixed, eventually (Namecheap was the example I had in mind for this, but I just checked and they did fix it, hurray). On the downside, there’s little chance that the website operator bothers fixing that if you ask them to, so you’ll probably have to wait for a while for a fix.

Another password manager annoyance comes from most banking sites, who provide a virtual keyboard (well, numpad) that you must use to enter your passcode. No copy-pasting, no auto-typing, you must use their damned numpad. For your safety. From a banking site that generally forces you to use a 6-digit password (but not your birthday, yes we made it just the right size for a birthday but don’t use that). Meh.

4) The non-working “remember me / stay logged in” feature

Not a big annoyance here, but when you have a checkbox, on the login form, that says “stay connected”, then when you check it you do expect to stay connected for “a while”. I.e., at least until you come back to your browser the day after. I’ve seen a few websites, typically financial, where “stay logged in” would still result in your session being terminated the day after, or even just after a few hours. I get that they want to disconnect people “for security reasons”, but then maybe… just drop the “stay logged in” checkbox?

5) The CAPTCHA on the first login attempt

When CAPTCHAs became standard good practice on login forms, in most of the places that use them, you’d be allowed to try to log in a few times (maybe 4 or 5 times) without any CAPTCHA. And only then, after a few failures, you’d get a CAPTCHA. Basically, at that time, the CAPTCHA was a quality-of-life improvement, as it came as a replacement to things like “after 5 failed login attempts, lock the account for a while”.

But eh, this still required counting failed login attempts. Too much work. Eventually, webmasters gave in to laziness: why bother counting failed attempts, when you can just shove a CAPTCHA down the user’s throat every single time? And here we are now, I don’t remember where and when was the last time I saw a site that would allow you to log in without a CAPTCHA on your first attempt (while showing one after a few failures).

6) 2FA with a mandatory phone number

I’ve seen some websites recommending an authenticator app for 2-factor authentication rather than SMS because “SMS is not secure”. It’s true, so fair enough. Yet those sites still forced people to use SMS to set up their 2FA… How rational is that?

6b) Mandatory 2FA

Just… Don’t… Combined with 6) (which applies to absolutely all 2FA implementations I’ve seen so far), it’s nothing more than an excuse to require / collect phone numbers.

7) Mobile-centric design

A punch in the face of PC users. “Yeah, we know you’ve got a better device, but we decided we only care about shit devices and we want you to have the same shitty user experience as mobile users”.
Having a design that works nicely on mobile is nice. But it shouldn’t come at the cost of destroying the user experience on larger clients that are more fit to display web pages. No matter what designers tell you, it’s not possible to have the same experience on a 6″ screen as on a 20″ screen. Until you decide you’ll waste 14″.

8) Not showing the date in blog posts / news articles

Seriously, wtf? When someone posts and article on Reddit, and you can’t figure out if it was published yesterday or 2 years ago.

Footnotes

* They even show a message saying “We have sent you an email with your username and a link in order to reset your password” to any password reset request (no matter if the typed e-mail actually owns an account or not). Which is the proper way to do things.

Posted in web development.

rev="post-4540" No comments

By patheticcockroach – 2019-09-24

How to capture Visual Studio Code in OBS Studio

I messed around a bit with OBS Studio lately, and found it wouldn’t manage to see Visual Studio Code if I tried adding it just like a game (Source => Add => Game Capture).

After a quick search, I found a solution explaining that it’s based on Chrome (nothing new here), and that as such OBS can only see it if hardware acceleration is disabled. That came a bit as a surprise to me, as obviously games use hardware acceleration and can be capture, but why not.
They also said Game Capture would still not work (gah!) and that Display Capture should be used instead. Now that’s a real bummer, because display capture means it needs to be cropped in order to show just the part that I want (notably, not the taskbar), and also it means that you have to be careful about everything that might get on your screen… much less convenient than capturing a specific program.
Indeed Game Capture doesn’t work (I tried). Eventually, I tried using Window Capture and… it worked. It still needs to be resized/cropped a bit if you don’t use a window that matches your target video resolution (unless you don’t mind some blank space), but that’s still way more convenient than Display Capture IMO.

Recap:

  1. Start Visual Studio Code with the --disable-gpu argument (I’d recommend editing your shortcut, no hardware acceleration is theoretically slower, but I didn’t really notice any difference)
  2. In OBS, use Window Capture to target your Visual Studio Code window

Posted in software.

rev="post-4538" 2 comments

By patheticcockroach – 2019-09-19

Removing EasyAntiCheat on Windows

EasyAntiCheat, just like any client-side anti-cheat software, is cancer. It can spy on your whole computer, harvest any file, any stuff in your RAM (password manager much?), and you just shouldn’t install any game that comes with it.

Still, if you do, and if after that you uninstall said game, EasyAntiCheat will remain installed on your computer. Yes, even if you ran the EAC installer/uninstaller manually before removing the game. Namely, a couple of files will remain in C:\Program Files (x86)\EasyAntiCheat, as well as an EasyAntiCheat service.

So in order to get rid of it fully, you’ll have to do a couple of things manually:

  • delete that C:\Program Files (x86)\EasyAntiCheat folder
  • remove the EAC service, by running sc delete EasyAntiCheat in a command prompt (which must be ran as administrator)

There, I believe that’s all you need to clean up. But again, the best move is to not install it at all, if you can.

Posted in privacy, security, software.

rev="post-4536" 7 comments

By patheticcockroach – 2019-08-30

Killing processes in Windows with a batch script

We’ve all had, at least a few times, some random program that would freeze and that for some reason the Windows Task Manager would fail to terminate in a timely manner. It turns out that I have, at the moment, a couple of repeating offenders in that matter. A freeze a few times a year is slightly annoying, but a couple of freezes each week seriously got on my nerves.

So I searched a little, and eventually found a way to kill a program instantly, skipping any pre-exit confirmation. Simply this:

taskkill /F /IM calc.exe

It will kill all processes from executable calc.exe, immediately. If it’s always the same program causing issue, you can just put it in a batch file (.bat) and run it whenever you need. I did that for 2 programs, one of which doesn’t even freeze, but I wanted to skip the long exit process, as an unclean exit causes no issue for this program.

If you want to keep the pre-exit confirmation, lose the /F:

taskkill /IM calc.exe

You can also kill by process ID. It’s nice when you have multiple instances of a program running, and you just want to kill a particular one (for instance just one browser tab that’s gotten out of control). But the drawback is, as process IDs always change, that you can’t make a batch file that you’ll just have to click: you’ll need to look up the process ID every time. The syntax is:

taskkill /PID [process ID]

Source, plus quite a few more examples / ideas: https://www.windows-commandline.com/taskkill-kill-process/

I tried this on Windows 10, but I assume it already works in Windows 7 / 8, and possibly even XP.

Posted in Windows.

rev="post-4535" No comments

By patheticcockroach – 2019-08-29

Linux script to automatically shutdown when load average is low

I’ve been using on-demand machines (similar to AWS EC2 and Google Cloud VM instances) to perform large computations. Those machines are both pay-as-you go and pretty expensive, so you want to terminate them as soon as your computations are done.

I’m sure there’s some fancy way, using tools provided by the cloud machine provider, to automatically shut down a machine that’s idle. But I thought, rather than looking for each vendor-specific, complicated (and likely billable) solution, I’d come up with a bash script. And here it goes:

while :
do
  load5M=$(uptime | awk -F'[a-z]:' '{ print $2}' | cut -d, -f1)
  threshold=0.5
  echo $load5M
  if (( $(echo "$load5M < $threshold" | bc -l) )); then
    sudo shutdown now
    break
  fi
  sleep 5
done

It's an infinite loop, with a 5 seconds pause, which gets the load average over the last 5 minutes, displays it, and if it's lower than the defined threshold of 0.5 (that's half a CPU core), immediately stops the machine. Simple enough, apart from the 2 magic lines needed to get the load average and to do a comparison between 2 floats (I found that surprisingly tougher than comparing 2 integers!)

A little warning though: be sure to test it, to check that your provider doesn't automatically restarts a terminated machine. That's quite unlikely, but it would be a shame ^^

Update 2021-10-04

I recently tried that on Debian, and I had an error about "bc not found", so I had to sudo apt-get install bc.
I'm still getting a weird 0: not found on the same line... And it doesn't work. So, turns out it might be Ubuntu-only somehow (I'm using it on Ubuntu 20.04 LTS, in case the version matters too)

Posted in Linux.

rev="post-4531" 4 comments

By patheticcockroach – 2019-07-16

How to install an old version of a game in Steam

There are multiple guides for this already, but they’re just too insufferably verbose and long. If you need a long version, see one of them, like this one. Otherwise, here is a short version:

Concise step-by-step

  1. Go to steam://nav/console (this opens the steam console)
  2. Run download_depot [appid] [depotid] [manifestid]
    (more details, notably how to find those IDs, at the end of the post)
    NB: the download can be slow, and it won’t show any progress.
  3. Note where the game was downloaded. It will typically be located in [WhereverYouInstalledSteam]\steamapps\content\app_[appid]\depot_[appid]
  4. Find where the current game version is installed (in Steam client, right-click on the game → properties → local files → browse local files)
  5. Replace the current game files with the newly downloaded ones (keep a backup if you want – although re-downloading the latest version is trivial)

Some more details on step 2.

The app ID and depot ID are technically useless since manifest IDs are unique, but Valve decided to make them mandatory anyway. I guess they just want to make sure running commands, while still possible, is as painful as possible.

For instance, to get the June 5, 2019 – 10:55:15 UTC version of “Love Thyself”, you’ll run
download_depot 949060 949061 7335981433319872232
and it will be downloaded into
[WhereverYouInstalledSteam]\steamapps\content\app_949060\depot_949061

The app and depot IDs can be found here: https://steamdb.info/app/949060/depots/
And the manifest IDs can be found here: https://steamdb.info/depot/949061/manifests/

Other example, Postal Redux from 29 May 2018:
download_depot 401680 401681 4007769963011890934
List of depots: https://steamdb.info/app/401680/depots/
List of manifests: https://steamdb.info/depot/401681/manifests/

Update (2020-12-22)

It seems that after a while (and/or after a certain number of newer versions have been published), old manifests are removed. For instance, I tried to download a manifest from a bit more than 2 years ago, which had 5 newer manifests: it wasn’t available anymore.

Update / bonus (2022-05-20): how to install a demo if you own the full game

Open the Steam console (cf the beginning of this post) and type app_install [app ID of the demo]. NB this is not the app ID of the full game, it’s a different one, which is usually rather close and which you can find simply by inspecting the “download demo” link on the game page, or by looking up the demo on SteamDB.

Posted in Uncategorized.

rev="post-4527" No comments

By patheticcockroach – 2019-06-22

How to catch wild pigs

You catch wild pigs by finding a suitable place in the woods and putting corn on the ground. The pigs find it and begin to come every day to eat the free corn. When they are used to coming every day, you put a fence down one side of the place where they are used to coming. When they get used to the fence, they begin to eat the corn again and you put up another side of the fence.

They get used to that and start to eat, again you continue until you have all four sides of the fence up with a gate in the last side. The pigs, who are used to the free corn, start to come through the gate to eat, you slam the gate on them and catch the whole herd.

Suddenly the wild pigs have lost their freedom. They run around and around inside the fence, but they are caught. Soon they go back to eating the free corn. They are so used to it that they have forgotten how to forage in the woods for themselves, so they accept their captivity.

It works on humans too: the government keeps pushing us toward communism/socialism and keeps spreading the free corn out in the form of programs such as supplemental income, tax credit for unearned income, tobacco subsidies, dairy subsidies, payments not to plant crops (CRP), welfare, medicine drugs, etc. while we continually lose our freedoms just a little at a time.

There is no such thing as a free lunch.

Source: http://www.crossroad.to/Victory/stories/wild-pigs.htm, but it’s actually a pretty common story

Posted in Uncategorized.

rev="post-4521" No comments

By patheticcockroach – 2019-06-07

Cutting off work-related digital distractions at work

I recently realized that I wasn’t as productive as I wished I was at work. Sure, the colleagues playing pool at any random time of the day right next to my desk, or the whistling and singing (seriously!) in the open space don’t help, but I noticed I was also distracted by something sneakier: some of my very work tools. Namely, Slack and e-mails.

Slack

Slack’s business consists in empowering users to replace their too numerous short e-mails that span long threads with… a hundredfold more numerous instant messages that fill a screenful of channels. Gee, what an improvement! Even with desktop notifications off and my phone most often in airplane mode, the red icon in the Slack browser tab, and e-mail notification if I ignore it too long, guarantee regular distractions. I eventually resorted to some drastic measures:

  • Leaving some channels where I really wasn’t relevant. Like that channel where designers configured Zeplin to send notifications every time they commit a change
  • Muting chitchat channels like #random or #music
  • Starring as few as possible important channels, and hiding by default all channels except the starred ones and those with unread stuff
  • Limiting notifications to mentions and direct messages (and keywords, but I don’t have any), when I have to have notifications on (when working remotely)

I’m down to 6 starred channels and 4 muted channels out of around 25+. I also starred 3 private messaging channels, with tiny groups of people I regularly exchange with. I didn’t leave that many channels, I’d say about 3 or 4. But even then, Slack is now a lot less distracting. Unread stuff flashes way less often, and whenever I do check updates in those less important channels, as soon as I leave them they disappear again. Out of sight, out of mind.

Note that muted channels will reappear when you have unread messages in them, only they won’t be highlighted (unlike non-muted channels). Now that I think of it, this seems logical, but at first I was a bit surprised by this.

E-mails

That may be a bit trickier depending on your setup and habits. When I last changed my e-mail provider, from the start I added folders and I set up filters so that habitual incoming e-mails end up right where they belong, rather than flood my inbox. Try to do that. But not all at once: every time a new e-mail arrives, see if it’s a regular one that should fall into a folder. By regular, I don’t necessarily mean newsletters: it could also be for instance a contact with whom you exchange regularly.

Since I mentioned newsletters: ditch them. Seriously, if you do just one thing about your e-mails, I think that’s the one, and that’s easy enough. Like the incoming e-mail filter, don’t try to do it all at once, do it as they come. When a newsletter arrives, ask yourself: does it really interest me? Has this newsletter interested me at any time within the last X months? If no, hit that unsubscribe button. If yes, ask yourself if you really need to have that information pushed into your inbox, or if you can just actively consult it in your own time.
Unsubscribing is easier than ever now, as GDPR prompted newsletter managers to make sure unsubscribing is easy. Since I started the draft of this post, I think I unregistered from about 20 newsletters. My e-mail box feels so much quieter now 🙂

A last idea about your e-mails, although that one is hard to reach: try to keep your inbox empty. The previous tips are more important, and kind of a prerequisite, in order not to waste time moving e-mails around. Also, achieving a truly empty inbox might be a bad goal if you focus on it so much that it becomes in itself a distraction. But an empty, or near-empty, or at least an inbox where you can see the bottom of the list without scrolling feels quite relaxing to me. So I do try to keep my inbox to less than a screenful. Even if it means moving some e-mails into a “todo” folder that I process regularly: the inbox is where I land whenever I open my e-mail tab, a little stash out of sight in a todo folder feels better than a crowded inbox.

TL;DR

Slack: leave and mute channels, star the few important channels, hide non-starred channels, tune down (or fully turn off) notifications
E-mails: unsubscribe from newsletters, auto-sort regular incoming e-mails into folders, move the rest manually out of the inbox

Posted in Uncategorized.

rev="post-4517" No comments

By patheticcockroach – 2019-05-28

Using Freenet with OpenJDK (AdoptOpenJDK) on Windows

Java/Oracle recently rolled out a new licensing policy. Frankly, I find it’s a mess and I don’t really understand what is and what isn’t allowed. It seems personal use and development use are both allowed, but still, downloading the SDK now requires creating an Oracle account. That broke the camel’s back. So I looked into alternatives.

AdoptOpenJDK seemed nice. It provides builds that seem regularly updated, for OpenJDK 8, 11 and 12, and it even lets you choose which Java VM you want, between HotSpot and OpenJ9. That JVM choice doesn’t seem to matter that much, from the few benchmarks I found, but still it’s appreciated.

Installation is straightforward, and I was soon able to get this in my console:

> java --version
openjdk 12.0.1 2019-04-16
OpenJDK Runtime Environment AdoptOpenJDK (build 12.0.1+12)
OpenJDK 64-Bit Server VM AdoptOpenJDK (build 12.0.1+12, mixed mode, sharing)

A nice upgrade from Java 8u201.

But, to my surprise, Freenet wasn’t able to find Java (so wasn’t able to run at all). After a brief search, I found that I was missing the registry entries for Java. Maybe I messed up during setup, but anyway it can be fixed quite trivially, by defining the following keys via Regedit (you could also just put this in a .reg file and “run” it):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment]
"CurrentVersion"="12.0.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\12.0.1]
"JavaHome"="C:\\Program Files\\AdoptOpenJDK\\jdk-12.0.1.12-hotspot"

Note that, depending on your version, you’ll want to replace “12.0.1” with whatever you have (and of course, adapt the path too). Although I’m actually not that sure whether the version number matters for real, as long as both occurrences match.

Freenet should now be able to start.

Edit: I tried on another computer, and I tried the “Javasoft (Oracle) registry keys” option during setup. It created some keys automatically, but not the ones needed for Freenet to work: it created keys under HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JDK, which I guess might turn out useful for development, but not under HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment, which is what Freenet needs.

Update (2019-07-31)

I just tried on yet another computer, where I hadn’t run Freenet in a while. Mysteriously, despite setting all this configuration properly, Freenet still wouldn’t start (it was still looking in the old path, I have no idea why… maybe a restart will help). As a last resort, I added the full path to the Java executable, in [Freenet path]/wrapper/wrapper.conf, with the follwoing line (NB: it should already exists, you just need to complete it):

wrapper.java.command=C:\Program Files\AdoptOpenJDK\jdk-12.0.2.10-hotspot\bin\java.exe

Update (2019-11-11)

I don’t know how I didn’t notice that in the first place, maybe it’s because of the “AdoptOpenJDK” name or because they put forward the JDK so much, but they provide both a full JDK and just the JRE alone. So unless you’re planning to do Java development, you can grab just the JRE, which is about 4 times smaller than the JDK. I updated the link in the post, to point to a download page where it’s clearer that you can choose between those 2 options.

Posted in software, Windows.

rev="post-4515" No comments

By patheticcockroach – 2019-05-18

Installing Rust in a custom location on Windows

It’s actually pretty well described in Rust’s documentation. I’m just putting it here because the documentation is large and I appear to have a hard time finding those specific instructions in a timely manner every time I need them.

First, you could grab a GUI installer from there, but Visual Studio Code doesn’t seem to like it much. And I also remember having some issues running rustup in that context.
This is why I rapidly decided to use the “recommended” rustup-init.exe.

Before running said rustup-init.exe:
1) Set the CARGO_HOME environment variable to where you want cargo to be. I picked D:\PROG\PROGRAMMING\Rust\cargo. (NB: for a convenient way to edit environment variables, I recommend Rapid Environment Editor)
2) Set the RUSTUP_HOME environment variable to where you want cargo to be. I picked D:\PROG\PROGRAMMING\Rust\rustup (I’m so creative, I know).
3) If you’re using Rapid Environment Editor, make sure you SAVE (until you do, the environment variables that you created/modified/deleted/etc are NOT actually changed)
4) Make sure you start a new console to run rustup-init.exe. If you use a console that was already running before you added the environment variables, that console won’t have them. If by any chance you are using ConEmu, you need to close and reopen the whole ConEmu: just opening a new tab won’t do, if ConEmu was already running before you add the variables. I insist on this point, because rustup-init.exe will give you NO warning/notification as to where the install will be performed, until it’s all over. So if you’re not careful, you’ll end up with Rust installed in its default location before you can say “God fucking dammit”.

Now, you can (finally) run rustup-init.exe. Make sure to pick option 2) if you want to install the GNU/GCC version rather than the default MSVC, or if you want nightly rather than the default stable. I’m not a fan of using nightly, because it contains features that could get removed at any time, but sadly big frameworks like Rocket require it.

Posted in programming, Windows.

rev="post-4509" 1 comment

By patheticcockroach – 2019-04-21