Of course we all get tired at work and nervous during tests. But otherwise imperceptible environmental factors could also be at play.

Ever since I watched this Tom Scott video seven years ago, I’ve been acutely aware of the effects carbon dioxide levels can have on cognition and concentration. If you go outside, you’re likely to measure a nominal CO2 level of 400ppm (much to climate change scientists’ concern !!). But if you take a reading in your bedroom after you’ve been working with the door shut for a few hours, levels can quickly rise to > 2000ppm.

The bad news is that cognitive function has been shown to be inversely correlated to CO2 concentration. At 1400ppm, cognitive function on demanding tasks (like your physics exam, or my software engineering job) can decline by up to 50%.

I wasn’t going to accept the fact that my brain could be slowing down due to invisible particles in the air. So $30 and one Amazon purchase later, I got my hands on a portable CO2 monitor.

This handheld monitor provided great value to my life. Every hour or so, I would check the reading, and if it was over 1000ppm, I’d get up and open a window (or turn on the central HVAC fan).

When I tell people about my interest in “biohacking,” I get the sense that they usually have the wrong idea. The word might conjure images of cyborgs, implants, and brain-machine interfaces. Admittedly, I do have a microchip in my hand, but that’s beside the point. The definition of biohacking that I subscribe to is:

Using technology to enhance the human condition through biological interfaces.

Under this definition, something as simple as buying a CO2 monitor counts as biohacking! You’re improving a biological factor by using technology. Nothing about this is invasive—you’ve just introduced another metric into your life!

Due to the weird reaction the term “biohacking” gets, I’ve started trying to popularize the term human engineering. Bringing a CO2 monitor to work is just as much human engineering as inserting a magnet into your finger is.

Anyways, back to the story. I brought my handheld CO2 monitor to my office. At the beginning of the day, levels started out pretty normal (around 600ppm), but by lunch time, they had risen all the way to 1500ppm. Obviously, this was due to about 15 humans performing respiration; or, alternatively, 500 trillion human cells performing cellular respiration.

Now, I must admit, having the CO2 monitor subjected me to the possibility of the nocebo effect. Watching the number rise potentially had psychological effects that made me actually feel less focused, or at the very least, attribute my tiredness to the CO2 concentration. However, when the solution is as simple as opening up a window, such downsides are miniscule.

This system worked great for a few days, but as a software developer who loves to over-engineer systems, I couldn’t just stop here.

Despite probably costing me time in the long run, I’ve always loved automation! Checking the handheld monitor every few hours was a mental burden and one more thing to distract me. What if I could be automatically alerted when the CO2 levels rose to unacceptable levels?

After a bit of research, I landed on the Netatmo Weather Station, which is a consumer smart home device that constantly monitors your environment for factors like temperature, humidity, air pressure, and of course CO2 concentration. Luckily, this device connected to the Netatmo cloud, which has a convenient developer API! This API meant that I could ingest CO2 data into a simple Python or Node server running on my cloud VM, and send it anywhere I wanted.

The company I was interning for at the time was big into observability, meaning I had to learn how to use a system called Grafana. Grafana was indeed used for Official Company Business to monitor the health of the app, but I had other purposes in mind. I quickly set up some server code to forward data from the Netatmo API to Grafana, and the result was this beautiful graph!

The next step was to create automated alerts. Grafana can be used to ping oncall engineers when request traffic drops below normal levels, so there’s no reason it couldn’t ping me when CO2 levels rose too high!

Alerts, straight to the company Slack channel.

And with that, I had arrived at a pretty good solution. Even after my internship ended, I took the system back to my dorm room to monitor levels at home. I’d like to remark on some next steps I could take to make the system more robust and extensible (as any good software engineer should).

First, to my delight, the smart home world has been moving away from the old model of devices talking to 3rd-party servers. Besides being a privacy risk, commands and data having to go through multiple hops in the cloud is less than ideal. Instead of this, standards like Matter (over Wifi or Thread) have seen great participation from big tech and small manufacturers alike. Matter would allow your Google Home voice-activated speaker to talk to your lights, buttons, and CO2 monitors without any requests leaving your private LAN. Unfortunately, there are no commercial Matter-enabled CO2 monitors yet, but more devices are being added by the day—and you could even make your own using an Arduino Nano Matter!

Second, my Netatmo-to-Grafana forwarding code was pretty hacky. There are more robust solutions such as Home Assistant, used by the top 1% of smart home enthusiasts.

Finally, it would be awesome to make all of this data available to AI agents! This is completely within the realm of possibility given software like the Home Assistant MCP server.

In conclusion, I hope I’ve broadened your sense of what biohacking/human engineering constitute. You can make quite drastic improvements to your life with a little bit of technology. And even if you’re not big into smart home or aren’t the best with code, something as simple as a handheld monitor can make your day-to-day experience so much better.

View my open-source Netatmo + Grafana server repository to build your own monitoring system, or check out my other work at yoonicode.com. Cheers!

You can’t tell whether an image was AI generated. If you disagree, I urge you to play a game to test that hypothesis. If you think you’re still pretty good at spotting AI media when you’re scrolling online, I am going to quietly link you the Wikipedia article on survivorship bias.

Anyways, I’m not here to talk about visually identifying AI works. Even if you’re the top 1% of AI discerners, I would like to ask you to consider what the other 99% believes.

Today, I want to discuss trust in a world where we are unable to tell computer– and human–generated works apart. If you still don’t believe this world is our present world, maybe you will consider our future world instead.

Returning to meatspace

Perhaps the only way for you specifically to know for certain that a work was human-produced is to… watch a human produce it. If you watched your friend take a photo, write a story, or draw a picture, barring sleight-of-hand and other deception, you can believe in the integrity of that media.

This is going to become the only way to verify the humanity of a work. It’s possible for this to be scaled up. Perhaps an exam proctor can verify the integrity of every one of their students’ submissions. But it is unavoidable that this future will involve human oversight, including the time it takes to watch someone produce a work.

If you watch someone make something, you might be able to vouch for that work. Others may be able to take your word for it—or if not your word alone, the word of 3+ people who all witnessed its creation. How do we know whose word to trust, though?

Trust networks

Trust in real life looks like a web. I may trust someone new if two of my closest friends can vouch for them. Depending on who I am, I may also trust someone if fifty of my acquaintances can vouch for them.

If you can’t be there in person to see the creation of a work, your only bet is to hope that someone in your network was there instead: that is, someone to attest that the work is authentic. However, in this new world, trusting someone doesn’t simply mean that you believe that they have no intention to deceive. To trust someone, you also have to make an evaluation on their ability to be deceived; the word of someone tech illiterate isn’t useful when the goal is to tell whether something was made with AI.

Unlike online webs of trust, these networks need to remain small. Crucially, they are limited to meatspace interactions—there is no way to verify the integrity of a work if you’re online. Or even worse, the agent that you could be building trust towards may be an AI chatbot.

Luckily, we have tools to make this process of trust and attestation robust.

The cryptography backing trust

In this possible world, we might start using cryptography to solidify these trusted relationships. Keyrings in protocols like PGP make keeping track of trust networks easy.

As for attestation, this might take the form of public/private key cryptography employing signatures. After I sit down and write a blog post, I would ask my two witnesses (whom still need to be physically present) to sign the digital representation of my work with their public keys, effectively declaring that they watched me produce it.

Attestation can also show up as a matter of public record. This is the sole feat I believe blockchain to be useful for. If my two witnesses post the hash of my written work on a blockchain, they’ve forever and irrevocably attested to its authenticity.

Conclusion

In my humble opinion, all possible futures of our world are ones in which AI-generated works are indistinguishable by human-generated works, whether by human inspection or automated programs. Here I presented the mechanism we will use to verify humanity in one possible future.

When the night’s over, though, the fun quickly turns into “wait, who do I Venmo?” and “why are we missing $20 from the ledger?!.” If you pay a visit to Harkness Hall the next Monday morning, you’ll find that the blackboards are filled with records of Yale’s best and brightest trying and failing to do simple addition.

With my experience with full-stack web development, I knew that this problem could be easily solved. I set out to make the ultimate Yale Poker Club ledger app. But before I could get coding, like any good engineer, I needed to determine the requirements and constraints for this app.

Scoping the Problem

Yale Poker Club is fast-paced. Enter the classroom, grab chips, and ask to be dealt cards. The more time spent fiddling around with a ledger app, the more time spent away from the table—and the bigger the headache I would have providing technical support.

So, I knew that having players download an app was a no-go. This needed to be a mobile-first web app, so players could pull up a simple URL and log their buy-ins. Also, I didn’t want players to have to log in with any SSO provider—the poker club runs on an honor system, so a simple “enter your email address” form would suffice.

That being said, Yale students love trying to break things. Some basic auth schema, disallowing players from meddling with each others’ data, would be necessary.

The App

So, I built Yale Poker Club Ledger! Players could go to the website, select the table they’re sitting at, and buy in.

On the page for the table itself, players have the option to buy in, top up, or buy out. Additionally, to solve the ledger discrepancy problem, players are required to submit a chip photo with their buy-out. That way, in case money is missing at the end of the night, some poor soul (…me) can go in and manually count the chips in every photo.

(Before you ask: yes, I tried to automate chip counting with a multimodal LLM; the technology just isn’t there yet.)

Sending Out Ledgers

Great, now we know exactly how much money each person made! How can we have the losers pay the winners their well-deserved profits?

After manually sending out ledgers for the first few weeks, I had the idea to automate this process even further. Using the AWS Simple Email Service, I was able to dynamically generate HTML emails and blast them to all players at each table.

To enable creating a table of who sends what to whom, I researched various algorithms online. I settled on a widely-known banking algorithm that greedily minimizes the number of transfers necessary. (Which is good, because Venmo seems to block users if they make too many transactions…)

Reducing User Friction

After testing the website for about a month, it seemed to be going swimmingly! We had fewer ledger discrepancies with the help of the chip photos, and banking was automatically settled without any need for blackboard math.

However, I noticed that it was a struggle educating players about the new system. Some weren’t aware that they had to buy in on the ledger. Some didn’t know what URL to go to. And more asked, “wait, which table number is this?”

I’ve always loved hardware that makes user interactions feel magical. It would’ve been easy to provide each table with a QR code… but when’s the last time you went to a restaurant and were happy to scan a code for the menu? I decided to go for something much more delightful: an NFC chip.

So, I bought some NFC stickers! Just like the one in my hand, these let you write any URI to their few kilobytes of onboard memory. Then, when someone touches their phone to the tag (iPhone and Android compatible, by the way), a notification pops up, which you can click to be taken to the specified URI!

But plain NFC tags would be boring. So, I went to the Yale Maker Space and laser-cut some custom dealer chips, embellished with the Yale Poker Club logo.

With the NFC tag fastened to the back with some adhesive, these were ready to go! Now, players could tap the dealer button to be taken to the ledger website.

Hungry for Data

Since the conception of the Yale Poker Club ledger app, 50+ tables have been run and settled using the website. Soon, I realized that this was a treasure trove of data.

Poker players are always looking to increase their edge by learning how their fellow players make decisions and whether they are profitable. In addition, those dedicated to the game love tracking their earnings over time to determine whether they are a winning or losing player.

With a year of historical data, I realized I could create a real-time leaderboard. However, I didn’t want to make this a simple list—I’d had something much more eclectic planned.

There is way too much poker-related jargon, which can easily be offputting to new players. However, some select terms are quite humorous. Players are largely sorted into three categories: “whales” for those who all but give away money; “fish” for those who are inexperienced; and “sharks,” reserved for the best-of-the-best who make every calculated move according to the rules of game theory-optimal play.

So, I made the leaderboard sea-creature themed! Whales at the top; fish in the middle; sharks at the bottom, only if you scroll down. With a call to the Gemini API to generate an alliterative or rhyming nickname for every player, the ocean was now ready to be deployed.

Conclusion

Developing the ledger app was fun, made my experience at the table more pleasant, and helped me get to know some of the super smart people in the club. This is what I do best, after all: identifying a problem and solving it with code.

If you’re interested in poker and you’re a Yale student, reach out to us, and we’ll tell you where to find us!

This is the 🍙 Japanese Language edition, dedicated to my jokes about my favorite target language.

1. Moraic Timing and Sabrina Carpenter

To understand this joke, we need a crash course on Japanese phonetics. Let’s first talk about timing in languages.

English is stress-timed, meaning you’ll spend a roughly equal amount of time pronouncing sounds between each stressed syllable. Try this:

I’M deVELoping A NEW appliCAtion.

If you’re a native English speaker, you probably sped up the unstressed syllables to maintain a constant interval between each stressed syllable. Try pronouncing the sentence, but allot an equal time for each syllable, regardless of it’s stress. You sound like a robot.

Interestingly, languages like Spanish are indeed syllable-timed, which means native speakers do allot an equal amount of time for each syllable, regardless of stress.

Now we get to Japanese. Japanese is neither syllable-timed nor stress-timed; it is mora-timed. What is a mora, you might ask? Well, just like the syllable is the basic building block of English, the mora is the building block of Japanese.

Let’s look at the loanword sensei (yes, like what you would call your karate teacher, but also any other teacher for that matter). You might split the word into two syllables: sen / sei. However, a native Japanese speaker would split it into four mora: se / n / se / i. This moraic timing is so innate to the language that it is embedded into the writing systems. Notice how there are four characters, each corresponding to one mora: せんせい.

The nasal sound “n”—the only final-position consonant in the language—is allotted its own mora. The extended vowel “sei” (which may or may not be pronounced as a diphthong depending on where the speaker is from) is allotted two mora—two units of time.

And now we have the requisite elite ball knowledge to understand the joke! The video game company Nintendo is spelled 「任天堂」; or in a syllabary, 「にんてんどう」. Each character corresponds to ni / n / te / n / do / u respectively.

Just like the “sei” in sensei takes up two mora, the “dou” in Nintendo takes up two mora. (And, in fact, Nintendo should be properly romanized as “Nintendou” if it were started any time after 1908). So, to respect the moraic timing, the dou should take two units of time to pronounce.

And look at that: Carpenter chose to elongate the “dou” when pronouncing “switch it up like Nintendo” in her hit song “Espresso”!

We briefly touched on romanization, but now it’s time to explore that topic in depth… are you ready?

2. Traditional vs. Modified Hepburn and the Performative Male

We looked at loanwords like sensei and proper nouns like Nintendo. Have you ever wondered: when a new word gets imported from Japanese into English, how do we convert the Japanese characters into Latin characters?

Well, there are various different answers, depending on whom and when you ask. Let’s look at the word 「社長」（しゃちょう）.

If you ask the Japanese government for an official romanization, they are required by law to give you “syatyô”. This became official because it was standard in Japan during the time the law was written. However, if you showed this romanization to an English speaker without any Japanese knowledge, they will probably pronounce it wildly wrong.

To combat this, Christian missionary and Japanophile (read: OG weeb) James Curtis Hepburn introduced a new romanization system. This system was designed so that English speakers encountering these romanized words would instinctually pronounce them quite closely to their original Japanese pronunciations. So, our word would become “shachō” (with the macron indicating a long vowel, as previously discussed). This is much closer to the original pronunciation!

While the Hepburn system was introduced in 1867, it was revised in 1908. The original version is known as “traditional Hepburn” while the revised version is “modified Hepburn.” One difference is the treatment of the nasal 「ん」, so your favorite battered and deep-fried seafood (天ぷら) would be “tempura” in traditional, but “tenpura” in modified. (The former reflects the assimilation of the nasal consonant, while the latter is just simpler.)

Back to the joke. Just like vowels can be extended (like “sei” in “sensei” and “dou” in “Nintendou”), consonants can also be extended to take up two mora. Your favorite green drink 「抹茶」(まっちゃ）has a 「っ」character in it, elongating the following consonant. In Hepburn, this would be romanized as “matcha” (with the elongated “ch–” sound being rendered as “tch–”). However, if you were a true performative male and cared about the integrity of the Japanese language, you would romanize it with Kunrei-Shiki as “maccha” (in “situations for which prior precedent would make a sudden reform difficult”), or “mattya” (if you were really willing to die on this hill).

We’ve focused on the syllabary writing systems of Japanese, but now let’s pay attention to the Chinese characters!

3. Radicals and the Zero-Width Joiner

As you may know, many languages other than Chinese use Chinese characters. Korean used to have them in the form of hancha, until my GOAT King Sejong the Great banished them. Japanese still has them in the form of kanji.

Chinese characters are built on the mixing-and-matching of radicals—symbolic or ideographic building blocks. For example, you’ll see the radical 氵, meaning water, on the characters 「海」(ocean) and「酒」(alcohol).

Pivoting for a second, let’s talk about emoji. Open Twitter and type the 😶‍🌫️ (face with clouds) emoji 280 times. 280 is the character limit for a tweet… so why can’t we tweet 280 😶‍🌫️ emoji?

It turns out that 😶‍🌫️ is represented as two separate characters, 😶 (face without mouth) and 🌫️ (fog), merged together with a Zero Width Joiner. This Zero Width Joiner (ZWJ) is a special character defined by Unicode (not Yoonicode) that allows the combination of characters to create a new one. Since it is “zero width”, it doesn’t actually get rendered on the screen—it is a special instruction to your computer’s text renderer!

So, my great idea: what if we could use ZWJs to merge any radical we want? For example, what if you could combine the 串 (skewer) character with the 手 (hand) radical to represent skewers that you pick up with your hand? Or maybe you’ll combine it with the 鳥 (bird) radical to specify poultry-related kebabs. This would open the floodgates for linguistic innovation in China, Japan, and any other country that uses CJK (Chinese, Japanese, Korean) characters.

Isn’t it lovely that the character for skewer looks just like a kebab? Now I’m hungry… 串串串

Conclusion

You’re here because you wanted three jokes explained to you… but you’ve left with new knowledge on Japanese phonetics, romanization, and even some technical details of UTF-8. I’d call that a win!

Stay tuned for the next installment of “Explain The Tweet.” Subscribe so you don’t miss it!

Opinions are mine, and do not necessarily represent the views of any social media companies I have worked at in the past or will work for in the future.

Try to remember Instagram in 2015. What’s on your home page? Maybe a few vacation photos from your close friends, maybe some candids from your mutuals. How about Twitter? In-jokes and life updates from the select accounts you follow.

Now, transport yourself back to the present. What does scrolling Instagram, X, or TikTok feel like? You’re bombarded with short-form content, autoplaying videos, and people SCREAMING to get your attention in the few milliseconds they have before you scroll away. How many of these people do you know? These people are not your friends, nor faces you’ve ever seen in real life. They took the “social” out of social media.

How did this happen? From 2015 to now, you probably didn’t notice this change in real time. This shift consisted of a series of subtle but intentional UI and algorithm design changes; and we were none the wiser, like a frog in a boiling pot.

Remember this? Although often called an “infinite scroll,” 2018 Instagram had an end. Once you ran out of friends’ photos to see, you’d hit this wall at the bottom of your feed: “you’re all caught up.”

Come 2020, Instagram quietly adds content below this wall, which they called suggested content. This wasn’t a big change at the time—you’d still see exclusively media from accounts you follow above this “you’re all caught up.”

Soon, a switch was quietly flipped. The main feed became driven by the “suggested posts” algorithm; the old feed was only accessible through a small toggle at the top of the screen. (Which, of course, reset back to “suggested” every time you closed the app.)

The exact same thing happened with Twitter. The “For You” feed was added; a toggle was implemented to go back to the “Following” chronological feed; and quietly, this option was made not “sticky” so you would have to click it every time you opened the app.

During the introduction of each of these subtle UI changes, there was some backlash from power users, yet not much attention from the casual scroller. And this is how we got bait-and-switched into content consuming machines.

Some Other Thoughts

• Is it a coincidence that Instagram moved the “Reels” button to the exact location where the “Notifications” button used to be? Muscle memory is very strong… and at a company with product designers and user research galore, could this really have been a coincidence?

• Featuring songs in your “grid” posts seems like an innovative feature. But the slow creep of autoplay music and video makes social media feel markedly stressful, at least for me. There is no way to pause content, besides exiting the app, or literally holding your finger to the screen. And with the creeping sense that every second spent looking at a post affects your algorithm, there is no respite.

The Impact

Where do you have most of your spontaneous ideas? Personally, I am most inventive in the shower (the one place you literally can’t use your phone) or before falling asleep (intentionally designated as a no-screens time for me). This is all speculation, but I’d say that endless content has been a great detriment to our creativity as a society driven by the invention of great ideas. Every minute you spend thinking, you have a small but existent chance of “striking gold” with an idea that could change the world; every minute you devote to scrolling instead, you’re throwing that chance away.

What I’m Doing

So… today, I deleted all of my social media apps. My attention span has been noticeably declining since the moment I downloaded them at the age of 13. I’m restless in lectures, I instinctively pull out my phone when I’m waiting for an elevator… I’ll still be around to promote my upcoming games and post esoteric jokes on Twitter, but I won’t be consuming any more content. (We’ll see how long this lasts.)

Me: “So, where’d you get that shirt?”
Other: “I picked it up at that store on Broadway, the one that started in Japan with the—”
Me: “Uniqlo?”
Other: “…”
Me: “…”
Other: “Yeah, so I picked it up at that store on Broadway…”

Notice the moment of awkward silence after I cut the other speaker off. This will occur 10–20 times in a conversation. But, as I started to pay more attention to conversational flow, I noticed that this only happens with a handful of people. With others, it looks something more like this:

Me: “So, where’d you get that shirt?”
Other: “I picked it up at that store on Broadway, the one that started in Japan with the — ”
Me: “Uniqlo?”
Other: “Yeah, Uniqlo! I love their summer clothing.”

Or even like this:

Me: “So, where’d you get that shirt?”
Other: “I picked it up at that store on Broadway, the one that started in Japan with the — ”
Me: “Uniqlo?”
Other: “Actually no, it was called GU—”
Me: “right, right right—”
Other: “it’s a sister brand of Uniqlo actually.”

Despite the multiple interruptions by me, conversation didn’t come to a halt. It seemed much more natural—the interruptions made it feel like I was signaling my interest. Compare this feeling to if I let the speaker monologue for 15 seconds without providing any feedback.

Me: “So, where’d you get that shirt?”
Other: “I picked it up at that store on Broadway, the one that started in Japan with the red sign. Uniqlo, I think it’s called. Yeah, they sell these kinds of shirts and they come in all different colors, you should check it out someday.”
Me: “Oh, cool. I’ve heard of it before.”

Despite my interruptions being a way for me to signal active engagement with the information being relayed, why did it fall flat with some partners, introducing awkward silences? After doing some research, the answer to my question came from Thanksgiving dinner. But not my own family’s Thanksgiving dinner last Thursday; rather, Dr. Deborah Tannen’s recordings and transcriptions of Thanksgiving conversation as detailed in her book Conversational Style.

The part of this book that’s relevant to my question is the discussion of two contrasting styles of conversation: High-Involvement vs. High-Considerateness.

High-Involvement style consists of many different aspects, including an affinity for personal topics, a faster rate of speech, and talk oriented around telling stories. But, the most relevant aspect of High-Involvement conversation style is a high degree of cooperative overlap.

My interjection of an educated guess “Uniqlo?” is an example of this cooperative overlap. Rather than being a bid to “steal the floor,” it serves as a way for people who converse like me to demonstrate interest in the topic. Even people who are unfamiliar with the topic at hand can use these interjections to feel as a part of the conversation, “piggybacking” off of others’ guesses, somewhat like character C does in this example:

A: “I picked it up at that store on Broadway, the one that started in Japan with the — ”
B: “Uniqlo?”
C: “Oh, yeah, Uniqlo!”
A: “Actually no, it was called GU — ”
B: “right, right right — ”

You’ll even see rapid-fire repetition of quick phrases (“right, right right”), which Tannen calls “machine-gunning.”

If this sounds like your ideal conversation, you may be a High-Involvement conversationalist. Tannen makes a precursory observation that the New Yorkers at her Thanksgiving dinner were more likely to be High-Involvement speakers.

Does this sound like a nightmare for you? You might be a High-Considerateness speaker. Read on…

So, what happened in my original conversation, where the exact same cooperative overlapping led to awkward silence?

Me: “So, where’d you get that shirt?”
Other: “I picked it up at that store on Broadway, the one that started in Japan with the — ”
Me: “Uniqlo?”
Other: “…”
Me: “…”

This interlocutor here believed I was interrupting them because they thought I had something substantial to say, rather than a simple interjection to confirm understanding. They may leave the conversation feeling like they were not being listened to. This is at no fault of their own, mind you—it’s simply an incongruency with my High-Involvement style and their High-Considerateness style.

High-Involvement speech may be a natural skill, but it’s definitely a learned one: The non-New Yorkers at Tannen’s dinner table remarked that they were astounded at how many people could talk at once (and still hold an intelligible conversation). Others yet expressed that they previously misunderstood High-Involvement conversation as repeated interruptions and unwelcome bids to speak.

So, what can we do? Here, I stray from the research done by Tannen and present my own opinions.

First, try to identify the type of speaker you’re talking to! You may be able to make an educated guess based on their cultural upbringing, but the best way is to listen. Do they cooperatively overlap frequently, or do they patiently wait their turn before speaking? You might even be able to use the other qualities of either conversation style, like their propensity to talk about personal topics or their tolerance for silent pauses, to determine which bucket they fit into.

If you’re a High-Involvement speaker like me talking to a High-Considerateness partner, you may have to make a conscious effort to hold your interjections and wait for them to finish. If you’re a High-Considerateness person talking to a High-Involvement interlocutor, try to remember that they aren’t trying to interrupt you. Finish your sentence—after all, they are trying to cooperatively overlap with you, which necessarily requires more than one person speaking at once!

Learning a little about conversation flow from the field of linguistics can help us be better speakers and listeners. So let’s start practicing now, and we’ll be ready for next Thanksgiving!

Referenced:

Tannen, Deborah. Conversational Style: Analyzing Talk Among Friends. Oxford Scholarship Online. New ed. New York: Oxford University Press, 2023

• Specifically sections “Features of High-Involvement Style,” “The Thanksgiving Conversation,” and “Overlap and Pace.”

• The Tannen text is available from the Yale Library if you are a student, or elsewhere online if not.

The anatomy of a Whales of Yale post looks something like this: a picture of the crochet creature, a small portion of a floor or a wall (if you’re lucky), and a fun caption. Interestingly, each caption is updated after each whale is found with its former hiding location.

At first, I thought there might be some pattern to whale drops. After all, the people hiding them are students too. Maybe one of the hiders has class on Science Hill on Mondays and is more likely to hide whales around that region. Maybe whales hidden after 9PM were more likely to be around the dorms. I set out to make an interactive map, plotting each whale’s hiding location.

The first step was designing a data pipeline to download these images and obtain their latitude/longitude coordinates. The first step was easy — using the python instagrapi library, I was able to mass-download each post, along with their captions.

Extracting the geocoordinates proved to be a harder problem. First, I needed to figure out a way to extract only the place name (“Davies”), out of the caption which may contain other text. Many posts would refer to a location with a colloquial name used by Yale students: for example, “Davies” for Davies Auditorium, “WLH” for William L. Harkness Hall, or “LC” for Linsly-Chittenden Hall.

The perfect tool for this, I figured, was an LLM! Using the Gemini API, I was able to have each place name extracted from the caption, turned into the official building name, and saved to a .csv file. To make sure the LLM did not return any extra text, I used the Structured Outputs API, instructing Gemini to return two fields: one string containing the place name, and one boolean indicating whether it is confident in its answer.

With a list of place names, I could now pass them to the Google Maps Places API (New). Provided with some hints that the POI would be in the general New Haven area, the Google Maps API was able to extract the latitude and longitude of each whale.

The final step was to create a GUI to display each post. I was able to vibe-code a website, making use of the Mapbox API. Enter the Whales of Yale: Intelligence Map.

After playing with the tool for a while, I realized that there was unfortunately no discernible pattern between weekday or time of day and whale location. Though, the work done to make this map interface seemed useful. My next idea was to add “reference photos” to the map. If I saw a brick floor, for example, I could look through the reference photos and find the ones with brick floors.

Gathering Intelligence

And so, I went on a multi-day expedition to take photos of Yale campus. Not photos of the pretty architecture or beautiful fall colors, mind you — I was snapping pics of floors, walls, trees, and furniture.

Building on the work I did for my Instagram pipeline, I made a second pipeline to process these reference photos. First, a script would extract the geocoordinates from each image, using the EXIF data (…). Then, I had Gemini take each image and return a set of pre-defined tags.

Finally, I plotted these reference photos alongside the Whales of Yale posts on my Intelligence Map. With the help of a way to filter reference photos by tags, I had made a super powerful tool that would let me quickly sort through hundreds of reference photos.

The Catch

The day finally came. I got the Instagram “new post” notification. The rule I set up on BuzzKill for Android triggered, immediately setting off an alarm. Spotted linoleum floor… concrete wall… let’s apply the tags.

Eureka! It’s a match. I sprinted to Davies, and saw the bench. Whale #210 captured!

The Hunt for the Capsules

As this was the second Veritas Search, I knew some of the tricks the puzzle creators liked to pull. Last year, there were various hidden clues buried around the different pages of the website. Also, don’t forget the cryptic pointers posted on the hints page.

At this point, I knew what I needed to do. I vibe-coded a bash script that scrapes the HTML page, parses out the filepath of the associated JS script, downloads all JS assets, and sends me a Discord message when there is a change to the website code.

The website seemed to be made in React, so the bundled code was unfortunately obfuscated and minified. This didn’t pose a problem to me, though. Using the built-in bash diff command, I was able to have the difference — only the lines that changed — sent to me in the Discord message body.

I set up a cronjob to run the script every 15 minutes, awaiting any changes to the website; the sort of “set it and forget it” kind of deal.

I spent a few days getting the occasional ping. Sometimes, it would simply alert me of someone new being added to the winners page. Sometimes, it told me that a new clue was added to the hints page, which gave me an immense advantage over the people who had to manually refresh the page whenever they felt like checking.

I was able to decipher some of the hints fairly quickly, but my general lack of athleticism made it so that I couldn’t run to the hiding spots fast enough. (I was even chased down by a wide-eyed sophomore on a bike once.)

But then, the day came. I was alerted to an unusual diff; usually, the changes made to the website were only a few lines long, and usually pertained to the hints page or the winners page. This one seemed different. Why was the blurb on the home page being updated?

Upon further inspection, I saw some strange code in the HTML source. Individual letters, spelling out “STOECKEL”, were put in their own tags!

Knowing this referenced Stoeckel Hall (the home of my 9AM music class), I sprinted down Elm St in the rain and searched all over the building. Eventually, I found the capsule tucked away underneath the emergency staircase.

I later learned that the intended solution related to the hint published on that same day: “Patience is a virtue. Over the view lies the clue.” Normal seekers were intended to wait 15 seconds on the home page before each highlighted letter would change color. However, with my diff alerter, I bypassed this element of the puzzle altogether!

With two scavenger hunts conquered, the only thing left for me is to decide what I want to ask Mark Cuban.

This article was originally published on the Yale Computer Society blog. Happy hunting!

By now, you might’ve published your game on the MacOS App Store after reading my handy tutorial. Or, you may already be distributing your game for Windows on Steam after learning about it in my guide. Now, it’s time to publish our games on the Windows Store!

Introductory Knowledge

First, note that modern Windows Store apps run on the Universal Windows Platform (UWP). Gone are the days of building an .exe file for each architecture (x86, x64, ARM). Now, you can build one binary with all app versions included, and the Windows Store will automatically download the right one! Since this is such an improvement over the old way of doing things, the Windows Store requires all new app submissions to be UWP-compatible. This means we’ll have to build for UWP from Unity. This also means you must develop on a Windows machine to be able to publish for Windows Store, since there is no UWP build support from Unity for Mac or Linux.

Prerequisites

You’ll need a Microsoft Partner Center account. You need to also have made an Entra ID account, and have made that Entra ID account a tenant in your Partner Center account. (Entra ID = “work or school account”, which is distinct from your personal Microsoft account.)

You’ll also need Visual Studio for Windows, along with the Windows SDK installed.

Building from Unity

First, switch your platform to Universal Windows Platform in Unity.

In the Player tab under Project Settings, create a test certificate. Specify a password. (Note that this certificate is only used for local debugging; when you associate your app with the Windows Store, it will get replaced.)

Important: locate your newly-generated .pfx file and double-click it! This will install it in your Windows credential store.

In Build Settings (Ctrl+Shift+B), make sure build configuration is set to Master”; set architecture to whatever architecture your development machine is using. (We’ll be able to build binaries for other architectures later!) Also make sure development build is unchecked.

Now, build your project! The resulting artifacts will be a Visual Studio solution. At this point, make sure you have the latest version of Visual Studio for Windows installed. (The free version is fine.)

Testing your Project in Visual Studio

Let’s make sure our binary works on our own machine before submitting to the Store.

First, we have to take care of a known issue. Open the .vcxproj file in Notepad. Delete the <ItemGroup> element which contains an <SDKReference> to WindowsMobile .

Now you can open the .sln file that was built by Unity.

We’ll need to tell Visual Studio to use the testing certificate we generated. In your Solution Explorer, open the Package.appxmanifest file. Under Packaging, select Choose Certificate. Navigate to the certificate you created and enter the password.

In your solution view, set the configuration to Master and set the platform to whatever architecture your development machine uses. Click Start without debugging (the hollow green triangle).

Publishing to the Store

If your game works locally when run through Visual Studio, it’s time to publish a package to the Store.

First, let Visual Studio know that your app is associated with a Windows Store product. Right click on your UWP project (not the solution—it should have the “++” icon.) Go to Publish → Associate App with the Store.

Important: log in with your Entra ID tenant account, not your personal Microsoft account!

Right-click on your project again; go to Publish → Create App Packages. Select Microsoft Store as <your app name>.

Set “generate app bundle” to Always, to let Visual Studio know to combine your three architectures into one file. Deselect ARM (32-bit) support since the latest versions of the Windows SDK do not support it. You may also want to check, then uncheck ARM64 build support (see this bug report).

Once your bundle finishes building, run the Windows App Certification Kit tester. Don’t worry if the tests don’t pass—this might just be indicative of quirks on your local machine, and your submission should get through app review just fine.

Upload the generated unified .msixupload file via the web interface in the Microsoft Partner Center. You’re done!

Troubleshooting

Here are some common issues I’ve found while building to Windows.

• “Unable to start debugging”: right click on the C++ project; go to Configuration Properties → Debugging → selectg Local Windows Debugger. (SO)

• “GameAssembly.dll is not a valid Win32 Application”: in Solution Explorer, right click your C++ project and click “set as startup project”. (Unity Forums)

Hope this guide helps. Check out my games at yoonicode.com!

As a lurker in the tech-adjacent part of the Internet, I can’t seem to catch a break from reading takes on AI. I’ve heard it all, ranging from the perspectives of artists and creatives to the hot takes of L5 MANGA SWEs. Now feels like the right time to offer yet another take—if only so I can look back in 5 years and laugh at how much I got wrong.

Regarding Bubbles

When a new piece of technology comes out, perhaps the most important question to ask is: “is this a bubble?”. While it may seem obvious in hindsight, it’s incredibly difficult to tell in the moment, despite the efforts of many (financially) interested parties. Perhaps a few years ago, crypto was seen as the hot new thing—yet most would agree that it was a bubble and is largely irrelevant nowadays, with the exception of some niche applications far from the widespread use cases championed by crypto evangelists. The fate of virtual reality, a similarly-hyped technology, has yet to be determined. Generative AI seems somehow distinct from the former two examples; it seems to fit more in the category of “steam engine” and “World Wide Web” rather than the likes of “Non-Fungible Token.”

I think a distinction is necessary between the developers of foundation models and the secondary/tertiary repackagers of generative AI. Though they are far from profitable, I do not see OpenAI, Google, or Anthropic going away any time soon. However, my prognosis of “B2B SaaS” companies like Cursor, Windsurf, or the viral Cluely (to use a humorous example) is not very positive. “ChatGPT wrappers” are a dime-a-dozen and offer little to no added value.

Let’s delve into my example of Cursor. While definitely a novel technology, Cursor offers few features that any other company couldn’t immediately clone. In fact, as someone who never made the jump to Cursor from Microsoft’s Visual Studio Code, I’ve personally watched VSCode catch up to Cursor in only a few months. Given that Cursor is a fork of VSCode, this seems like a classic example of Microsoft’s not-so-secret strategy: embrace, extend, extinguish.

ChatGPT wrappers are simply too easy to create that I seriously doubt the long-term viability of such companies. On the other hand, OpenAI, Google, and Anthropic’s value proposition is not one that any company can create overnight. The high costs of training a sufficiently large model creates massive barriers to entry that small companies simply can’t compete with, which is precisely the reason why I think they’ll be sticking around. But these same barriers to entry represent some of my largest fears about AI.

Regarding Barriers to Entry

It’s easy to understate the power of the open-source software community. To my knowledge, no other industry has such an amazing implicit agreement and expectation of collaboration above profit. For example, Meta decided to open-source React, giving us the most powerful web framework ever made; Google decided to open-source Chromium, giving us Electron apps like Slack and VSCode; and hobbyist devs contribute to libraries like ffmpeg and tz, which hold up modern computing as we know it. I see foundation models as a threat to this open-source ecosystem.

Perhaps open-source software flourished because code is inherently democratizing. As long as you have a good enough machine, you can run any piece of software. This suddenly becomes untrue as soon as we introduce compute-heavy tasks like training, or even running, a foundation model. Although open-source, local models exist, none will ever come close to the power of OpenAI, Google, or Anthropic and their GPU farms. If AI is truly the next big step in our tech tree, gone are the days of cloning a repo and running it on your own machine. If you want to do anything with powerful AI, get ready to enter your credit card information—and make sure to stay on OpenAI’s good side.

Perhaps I’ll end this section with an appeal to emotion. Think of any other industry with high barriers to entry in your life. What’s your general sentiment towards cell service providers? How about airlines? That’s what AI will be like in a few years.

Regarding AI Taking Our Jobs

With the risk of sounding like a detached economist, blissfully unaware of the very real lives of actual laborers, I generally am unconcerned with “AI taking our jobs.” As a probable future software engineer, I’m definitely in the crosshairs. But to create policy based on the fear of AI replacing human labor is misguided.

Although I generally reject the premises of Laissez-Faire ideology, I do think there’s some truth in the saying a rising tide lifts all boats, albeit with a slightly different interpretation than originally intended. Technology is the rising tide. The Industrial Revolution eliminated dangerous manual labor positions, yet introduced many more jobs that were before unseen. (Although perhaps not less dangerous.) The invention of the computer eliminated plenty of administrative desk jobs, yet created entire industries of IT and software. It may be the case that AI will take jobs, but such is a “necessary evil” in the progression of society. People will become more educated and more will be well-equipped for the jobs that AI creates. Holding back AI because of the loss of jobs will slow down the creation of new ones—jobs that contribute more to society.

Although we’re still a ways away from this utopia, the ideal end goal of this progression of technology is the replacement of all jobs that only exist out of necessity. Just like computers [sense 1] were replaced with computers [sense 2], doctors and lawyers will be made unnecessary, freeing up time for humans to do what they were always meant to do: create art.

Regarding Computers Making Art

Speaking of making art, a new cultural divide is emerging between creatives and technologists. Can a computer create art? Should a computer create art? My position is still forming, so I will instead offer a series of questions.

• Is the invention of image-generating AI different than the invention of the camera? What did people think when the camera was invented, and how does that mirror/differ from the sentiment towards image-generating AI now?

• What is the human brain other than a computer that takes inputs, combines them with memory of previously-seen works (commonly known as “inspiration”), and produces outputs?

• Is an art piece’s value based solely off of how good it looks, or is there some other mushy factor that gives it worth?

• Can a computer feel?

Perhaps this discussion is gratuitous. Perhaps “computers making art” will be a short-lived fad, overshadowed by something much more impactful, yet much less talked about…

Regarding Non-Generative AI

I think recent advances in non-generative AI has largely flown under the radar. Amazing breakthroughs are being made in medical and scientific industries. Have you heard the latest about protein folding or cancer classification? These advances are what is going to drive forward technology and society, not “Ghibli filter” bots.

Regarding The End of AI

Many people point to the exponential curve of AI ability and assert that progress will never slow down. While I’m not certain, I believe AI development will reach an asymptote due to model collapse.

Garbage in, garbage out. AI output is being put on the Internet en masse, with no real way to tell whether a piece of content is human– or AI–generated. As we all know, large-data models necessitate huge amounts of training data, scraped from Reddit and the likes. But what if Reddit is all AI content in the first place? Studies have shown that training AI on AI output does not improve it. It may be the case that we are approaching the maximum capacity of AI, unless we can solve the Dead Internet problem.

Conclusion

I’d love to hear your thoughts, especially if you are deeply immersed in the field of AI. Reach out: eric@yoonicode.com

What if your Discord bot could add songs to Spotify playlists? Or access a user’s Google Calendar to schedule events?

While services like Google and Spotify give developers access to this kind of data, developers generally have to set up entire OAuth2 flows, which can be confusing and result in a bad experience for the end user.

Enter AuthConnect, a library designed specifically for Discord.js bots that makes OAuth2 integration super simple.

• 📝 Simplifies OAuth2: The entire flow, from getting permission from your users to getting a token to use for your requests, is handled for you.

• 💾 Built-in data storage solutions: AuthConnect provides built-in ways to store users’ authentication data, such as on-disk or in Firebase.

• 🌐 Fantastic user experience: All users have to do is click a link and accept the prompt. Everything else is handled between you and AuthConnect.

• 🔒Your data is safe: AuthConnect cannot make API requests on your behalf and cannot access your users’ data.

• 🔢 Multiple server support: Each server your bot’s in can have its set of accounts associated with it.

The Authentication Flow, Simplified

1. You call generateAuthURL() and show your users the link.

2. The user authorizes your app and is redirected to our landing page, which sends the result data to your server.

3. You call getAccessToken(); we refresh the token if it's expired then give it to your app.

4. You call an API with your access token!

Demo: Setting up Google login with AuthConnect

What better way to learn than by example? Here’s step-by-step instructions to use AuthConnect to get authorization from a user to access their Google data.

Set up a Google Cloud project

From the Google Cloud Console, create a new project.

Head to APIs & Services and click on the Credentials page. A credential is a set of keys that allows your program/server to interface with Google APIs.

Click on Create credentials, and select type OAuth Client ID. When prompted for an application type, choose Web application. Give your credential a friendly name.

Now, add the following as an authorized redirect URI, which will allow users to be redirected to the AuthConnect website that beams data back to your bot:

https://authconnect-djs.web.app/redir.html

All in all, your credential should look like this:

Once your credential is created, copy down the Client ID and Client Secret that you’re given. These values identify your app to Google so that no one else can impersonate you.

Finally, head to the Library tab of the Cloud Console, and enable whichever service you plan to call.

Adding the code

Now, all we need to do is add AuthConnect to our Discord project! Once you’ve gotten a Node project created and Discord.js installed, install AuthConnect:

npm install authconnect-djs

Now, let’s start writing the code. First, let’s import our libraries:

import AuthConnect from "authconnect-djs";
import {Client, GatewayIntentBits} from "discord.js";

Let’s define some constants. This is where you’ll paste your bot’s token and the values you got when you set up your Google Cloud credential.

Scopes define what your app is allowed to request; for example, a user might only authorize your bot to access their Youtube data and nothing else. Check out this page to see what scopes you’ll need, and paste them in the code, separating each scope with a space.

const DISCORD_TOKEN = "123_your_discord_token_456";
const GOOGLE_CLIENT_ID = "123_your_google_client_id_456";
const GOOGLE_CLIENT_SECRET = "123_your_google_client_secret_456";

const SCOPES_TO_REQUEST = "https://www.googleapis.com/auth/youtube";

Now, let’s initialize our bot.

const bot = new Client({
    intents: [ GatewayIntentBits.Guilds, GatewayIntentBits.GuildMessages, GatewayIntentBits.MessageContent, GatewayIntentBits.DirectMessages ],
    partials: [ "CHANNEL" ]
});
let auth;

bot.login(DISCORD_TOKEN);

Let’s give our bot an “on ready” callback, in which we will initialize our AuthConnect object. We’ll tell AuthConnect to store authentication data in a file, but you can also have it store data in Firebase or in your own server.

bot.on("ready", () => {
    auth = new AuthConnect({
        google: {
            clientId: GOOGLE_CLIENT_ID,
            clientSecret: GOOGLE_CLIENT_SECRET
        }
    });

    auth.useDefaultDataHandlers("./auth-data.json");
    console.log("Bot ready and AuthConnect initialized.")
});

Now, let’s allow users to log in when they send a “login” command, only if they’re an admin. We’ll generate an auth URL and DM it to the admin.

bot.on("messageCreate", async message => {
    if(message.guild !== null && message.content === "login" && message.member.permissions.has("ADMINISTRATOR")) {
        const url = auth.generateAuthURL("google", message.guild.id, SCOPES_TO_REQUEST);
        message.channel.send("Please check your DMs for a link to log in.");
        message.member.send(`Please visit this URL to log in: ${url}`);
    }
});

Now that we have the user’s permission, AuthConnect will give us a token with which to send API requests. let’s make a request when the user tells us to, for example using the fetch function.

// this snippet goes inside the messageCreate callback:

// bot.on("messageCreate", async message => {
  // code from previous snippet here
  if(message.guild !== null && message.content === "call an API") {
          if(await auth.isGuildLoggedIn("google", message.guild.id)) {
              const token = await auth.getAccessToken("google", message.guild.id);
              
              // You can use this token to call a Google API, such as this Youtube search endpoint:
              /*
              await fetch("https://www.googleapis.com/youtube/v3/search", {
                  headers: {
                      "Authorization": `Bearer ${token}`,
                      "Content-Type": "application/json",
                  }
              });
              */
          } else {
              message.channel.send("This server is not logged in to Google. Have an administrator type `login`.");
          }
      }
// });

Putting it all together

Your entire file should look like this:

import AuthConnect from "authconnect-djs";
import {Client, GatewayIntentBits} from "discord.js";

const DISCORD_TOKEN = "123_your_discord_token_456";
const GOOGLE_CLIENT_ID = "123_your_google_client_id_456";
const GOOGLE_CLIENT_SECRET = "123_your_google_client_secret_456";

// Replace this with the scopes you want to request: https://developers.google.com/identity/protocols/oauth2/scopes
const SCOPES_TO_REQUEST = "https://www.googleapis.com/auth/youtube";

const bot = new Client({
    intents: [ GatewayIntentBits.Guilds, GatewayIntentBits.GuildMessages, GatewayIntentBits.MessageContent, GatewayIntentBits.DirectMessages ],
    partials: [ "CHANNEL" ]
});
let auth;

bot.login(DISCORD_TOKEN);

bot.on("ready", () => {
    auth = new AuthConnect({
        google: {
            clientId: GOOGLE_CLIENT_ID,
            clientSecret: GOOGLE_CLIENT_SECRET
        }
    });

    // This is where your auth data will be stored on disk.
    auth.useDefaultDataHandlers("./auth-data.json");
    console.log("Bot ready and AuthConnect initialized.")
});

bot.on("messageCreate", async message => {
    if(message.guild !== null && message.content === "login" && message.member.permissions.has("ADMINISTRATOR")) {
        const url = auth.generateAuthURL("google", message.guild.id, SCOPES_TO_REQUEST);
        message.channel.send("Please check your DMs for a link to log in.");
        message.member.send(`Please visit this URL to log in: ${url}`);
    }

    if(message.guild !== null && message.content === "call an API") {
        if(await auth.isGuildLoggedIn("google", message.guild.id)) {
            const token = await auth.getAccessToken("google", message.guild.id);
            
            // You can use this token to call a Google API, such as this Youtube search endpoint:
            /*
            await fetch("https://www.googleapis.com/youtube/v3/search", {
                headers: {
                    "Authorization": `Bearer ${token}`,
                    "Content-Type": "application/json",
                }
            });
            */
        } else {
            message.channel.send("This server is not logged in to Google. Have an administrator type `login`.");
        }
    }
});

More about AuthConnect

You can view AuthConnect on Github! The library can do much more than what we’ve covered in our example. Check out the README for more detailed instructions.

Publishing shouldn’t be this hard. While trying to figure out how to build my Unity game to macOS, I encountered dozens of errors and read heaps of StackOverflow posts, documentation pages, and Q&As. So, I’ve packaged what I’ve learned in a guide. Here’s how to build Unity games to macOS, for either sideloading or for Mac App Store distribution.

This guide will take you through Apple Developer certificates, code signing, packaging an installer, and notarization, and there’s even a bash script for easy automation!

Creating an App Password

Before we get started, we’re going to need an App-Specific Password from Apple. Head to Security Settings on the Apple ID webpage, click App-Specific Passwords, and create one. Take note of the generated password.

Downloading Certificates

You’ll need an Apple Developer account to complete this guide, but there are already many great tutorials on how to do this, so I’m going to assume you’re already set up.

The first step is downloading the correct certificates from Apple. Without these, we can’t tell Apple our app is safe and your users might encounter “untrusted” or “unsafe” popups.

You’ll first have to create your own Certificate Signing Request (CSR) file from Keychain Access on your Mac. This file acts as your private key.

Choose Keychain Access in the menu bar ➤ Certificate Assistant ➤ Request a Certificate From a Certificate Authority.

You’ll want to enter your email address; you can give the request a name in the Common Name field.

• Leave the “CA Email Address” field blank.

• Select “Request is: Saved to disk.”

• Check “Let me specify key pair information”.

Press Continue and choose a file location. On the next screen, keep Key Size set to 2048 bits and Algorithm set to RSA.

Press Continue. You’ll want to keep your .certSigningRequest file around in case you ever need to request additional certificates in the future.

Head to Certificates, Identifiers, and Profiles on the Apple Developer account settings page. You’ll need to generate two certificates depending on where you plan on distributing your app.

If you want to sideload your app (i.e. sending a file to friends or publishing through a non-Apple marketplace), create 1) a Developer ID Application certificate and 2) a Developer ID Installer certificate.

If you want to upload your app to the Mac App Store, create 1) a Mac App Distribution certificate and 2) a Mac Installer Distribution certificate.

To create these certificates, you’ll have to upload the .certSigningRequest file you generated. After you download these certificates, simply double-click them to add them to Keychain Access.

Take note of the names of these certificates—you can view this by opening the quick preview (press spacebar). They should look like “Developer ID Application: John Doe (XXXXXXXXXX)” or “3rd Party Mac Developer Application: John Doe (XXXXXXXXXX)” depending on which certificates you created. The code in parentheses is called your provider short name.

Declaring Entitlements

We first need to make a list of entitlements. This file tells Apple what capabilities and requirements your app has. Create a file at the root of your project directory called YourGameName.entitlements . Copy the text below into the file:

<?xml version=”1.0” encoding=”UTF-8”?>
<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd“>
<plist version=”1.0”>
    <dict>
        <key>com.apple.security.app-sandbox</key>
        <true/>
        <key>com.apple.security.cs.allow-jit</key>
        <true/>
</dict>
</plist>

You can add any additional entitlements that your app might need. For example, if your game connects to the Internet, include the com.apple.security.network.client key and add <true/> below. Here’s a complete list of entitlements.

Code Signing

First, build out your .app file from Unity with Mac, PC, and Linux Standalone as your platform. You may also need to grant execution permissions by running this Terminal command:

chmod -R a+xr “Path/To/Your/Game.app”

Code sign your app using this XCode command (you may have to open XCode for the first time and install developer tools). Run this command from your project’s root folder.

codesign --deep --force --verify --verbose --timestamp --options runtime --entitlements “YourGameName.entitlements” --sign “Developer ID Application: John Doe (XXXXXXXXXX)” “Path/To/Your/Game.app”

Fields that you need to edit are bolded. Change Developer ID Application to 3rd Party Mac Developer Application if you’re deploying to the Mac App Store (in other words, this should be the name of your Application certificate).

Creating a .pkg Installer

There are a few types of containers an app can be shipped in—a .zip file, a .dmg disk image, or a .pkg installer. A .pkg file is what the Mac App Store expects and is in general the most frictionless for users.

Use the built-in XCode command below to create a .pkg and codesign it all in one step (both the inside .app and its .pkg need to be signed). We specify that we want our app to be installed to the user’s Applications folder, but you can change this as you wish.

productbuild --component “Path/To/Your/Game.app” /Applications --sign “Developer ID Installer: John Doe (XXXXXXXXXX)” “Your/Build/Folder/YourGameName.pkg”

Note that the certificate name argument in this command is not the same as the one you used to codesign your app! This should start with either Developer ID Installer or 3rd Party Mac Developer Installer .

Notarization (for sideloading only)

Starting with macOS 10.14.5, Apple requires sideloaded apps to be notarized as an additional layer of protection. You do not need to complete this step if you only intend to distribute through the Mac App Store.

First, let’s upload our app for notarization to Apple servers:

xcrun notarytool submit --apple-id “your.apple.id@example.com“ --team-id “XXXXXXXXXX“ --password “your-apps-pass-word“ “Path/To/YourPackage.pkg” --wait

Remember, your team-id is the code in parentheses at the end of your certificate names.

Wait for the command to finish. Run one last command to “staple” the notarization info to your package:

xcrun stapler staple “Path/To/YourPackage.pkg”

You’re now ready to distribute your .pkg to anywhere for sideloading!

Uploading to the Mac App Store

If you’re looking to distribute your app through the Mac App Store, uploading your package is easy. After you’ve created and configured your app in App Store Connect, you can upload your first build using XCode:

xcrun altool --upload-app --file “Path/To/YourPackage.pkg” --type macos --username “your.apple.id@example.com“ --password “your-apps-pass-word“

Automating With a Bash Script

I’ve written a bash script to automate this entire process. Simply copy into a file at the root of your project directory, chmod +x yourscript.sh , and fill in the variables at the top.

#!/bin/bashAPPLE_ID=”your.apple.id@example.com“
DEV_ID_APPLICATION_CERT_NAME=”Developer ID Application: John Doe (XXXXXXXXXX)”
DEV_ID_INSTALLER_CERT_NAME=”Developer ID Installer: John Doe (XXXXXXXXXX)”
APPLE_APPLICATION_CERT_NAME=”3rd Party Mac Developer Application: John Doe (XXXXXXXXXX)”
APPLE_INSTALLER_CERT_NAME=”3rd Party Mac Developer Installer: John Doe (XXXXXXXXXX)”
APP_PWD=”your-apps-pass-word“
TEAM_SHORT_NAME=”XXXXXXXXXX“
APP_LOCATION=”Path/To/Your/Game.app“
PKG_LOCATION=”Your/Build/Folder/GameName.pkg”
ENTITLEMENTS_FILE=”YourGameName.entitlements”chmod -R a+xr “$APP_LOCATION”read -p “Do you want to package app for sideloading or for the Mac App Store? (mac/sideload) “ targetif [ “$target” == “mac” ]; then
    APPLICATION_CERT_NAME=”$APPLE_APPLICATION_CERT_NAME”
    INSTALLER_CERT_NAME=”$APPLE_INSTALLER_CERT_NAME”
else
    APPLICATION_CERT_NAME=”$DEV_ID_APPLICATION_CERT_NAME”
    INSTALLER_CERT_NAME=”$DEV_ID_INSTALLER_CERT_NAME”
fiecho “Code signing...”
codesign --deep --force --verify --verbose --timestamp --options runtime --entitlements “$ENTITLEMENTS_FILE” --sign “$APPLICATION_CERT_NAME” “$APP_LOCATION”echo “Generating pkg and signing...”
productbuild --component “$APP_LOCATION” /Applications --sign “$INSTALLER_CERT_NAME” “$PKG_LOCATION”if [ “$target” != “mac” ]; then
    echo “Uploading for notarization... check back here in a few minutes.”
    xcrun notarytool submit --apple-id “$APPLE_ID” --team-id “$TEAM_SHORT_NAME” --password “$APP_PWD” “$PKG_LOCATION” --waitecho “Stapling notarization...”
    xcrun stapler staple “$PKG_LOCATION”
fiif [ “$target” == “mac” ]; then
    read -n1 -p “Do you want to upload to App Store now? (y/n) “ choice
    echo “”if [ “$choice” == “y” ]; then
        echo “Uploading to app store...”
        xcrun altool --upload-app --file “$PKG_LOCATION” --type macos --username “$APPLE_ID” --password “$APP_PWD”
    fi
fiecho “Finished”

Additional Reading

Here are some of the StackOverflow posts and documentation I read trying to get this all set up! Take a look if you’re stuck.

SO: How to obtain Certificate Signing Request
Unity Docs: Delivering your application to the Mac App Store
Apple Docs: Notarizing macOS Software Before Distribution
Apple Docs: Customizing the Notarization Workflow
SO: macOS: Notarize in Script?
Apple Forums: How to notarize app at CI Build?
Apple Support: Using app-specific passwords
Notarizing installers for macOS Catalina
How to notarize a Unity build for macOs 10.15 Catalina
Getting a “certificate is not trusted” error for iOS Distribution Certificate

Changelog

• 2023–11–28: Updated script to use notarytool instead of the deprecated altool notary feature.

• 2023–12–02: Added JIT entitlement.

Hope this guide helps. You can check out out my work at yoonicode.com.

Steam is one of the most popular game publishing platforms today, yet Steam developers haven’t made it exactly easy to publish apps to the platform, even in 2022. Here’s how to publish Mac and Windows

Glossary

Steam has lots of confusing terminology that you should get used to.

• Steamworks: Steam’s game publishing platform for developers.

• Steamworks.NET: a C# library used to implement Steam features in your game.

• SteamPipe: a command-line utility to upload your game builds to Steam.

• Depot: think of a depot as an SKU for your game. There could be a depot for Windows, a depot for Mac, or a depot for French-speaking Mac users.

Getting Started with Steamworks

Head over to partner.steamgames.com and create a developer account. This guide will not go over account creation, but the website is fairly straightforward to use. Once you have an account, pay a product submission fee and create a new application.

Adding Libraries to Unity

Steam has lots of great platform features such as achievements, cloud saves, and the Steam Overlay. We want to be able to harness this power in our game!

We will be using the open-source Steamworks.NET library to add this functionality to our game.

1. Download the latest Steamworks.NET .unitypackage file from the repository’s releases tab. Double-click the package and select all files to import it into your game.

2. At the root of your Unity project (not in your Assets folder), you will find a new file called steam_appid.txt. Go to your Steamworks application page, copy the App ID in parentheses (which identifies your app to Steam), and replace the “400” found in the file with your App ID.

3. Open up the SteamManager.cs file imported by Steamworks.NET under Assets/Scripts/Steamworks.NET. Around line 99, replace AppId_t.Invalid with (AppId_t)xxxxxxx , where xxxxxxx is the App ID that you copied.

4. Create a new empty GameObject in your scene and add the SteamManager script to it.

Now, you’re ready to build your Unity app.

Building Your App

Build your app for Mac and Windows normally. If you are building for Universal Windows Platform, you’ll want to build for Standalone instead.

When building Mac apps, you need to staple a certificate and notarization to your package so users don’t get “app not trusted” errors. Follow my guide for preparing sideloaded apps here.

Steamworks Configuration

On your Application Dashboard in Steamworks, you’ll see two checklists: a Store Presence checklist and a Build checklist. To get your game published, you’ll have to complete both checklists and submit your app in both review queues.

To complete the store presence checklist, you’ll have to upload some artwork and fill out some forms, but this guide won’t cover this process.

We will be overviewing how to complete each step in the Build checklist to publish your app.

Installation Setup

On your Application Dashboard, click Edit Steamworks Settings. Go to Installation > General Installation. Create two launch options:

Launch Option 0
Executable: release/YourGame.exe
Operating System: Windows

Launch Option 1
Executable: YourGame.app
Operating System: macOS

Depot Setup

Go to your Edit Steamworks Settings page. Go to SteamPipe > Depots. Create two depots: one for Mac and one for Windows, setting the Operating System field properly. Take note of your depot numbers; all but the last digit will match your App ID. For example, if your App ID is 1234560 , your depots will be 1234561 and 1234562 .

Important: now head to the Publish tab and click Prepare for Publishing. Click Publish to Steam and type the secret key STEAMWORKS . Click Really Publish.

Permissions Setup

In the header, head to Users & Permissions > Manage Groups. Create a new group. Grant all permissions to the group, add your application to the group, and add yourself to the member list.

This step is often overlooked in tutorials, but not doing so will result in a permissions error when you try to upload your build.

Package Setup

Back in your Application Dashboard, click All Associated Packages, DLC, Demos and Tools. For each package in Store/Free to Play or Promotional or special use, click on the package and add the two depots that you created.

Uploading your Builds

There are two methods to upload builds to Steam. You can either use the Web interface and upload ZIPs, or you can use the SteamPipe CLI utility.

• The web interface only allows uploads of up to 2048MB.

• The web interface does not show error info. If you run into an error, use SteamPipe instead for extended logs.

• SteamPipe is supposed to work on Mac and Windows, but I could only figure out how to run it on Windows. Your mileage may vary.

• There seems to be an issue uploading macOS apps using Steampipe, in which certification and notarization gets lost in the process. If your app becomes unrunnable when uploading from Steampipe, try using the Web interface instead.

Method 1: Using the Web Interface

Create two zips: one containing your Mac .app folder/file, and one containing a folder called release that contains your .exe file. Head to partner.steamgames.com/apps/depotuploads/xxxxxxx where xxxxxxx is your App ID. Upload both ZIPs.

Method 2: Using Steampipe

Download the latest version of the Steamworks SDK from this page.

Inside tools/ContentBuilder/content , create two folders: mac and windows . Place your .app build into the Mac folder. In the Windows folder, create a folder called release that contains your .exe file.

Now, let’s open up a few files in your favorite code editor and make some modifications.

tools/ContentBuilder/run_build.bat : replace the contents of the file with the following and replace bolded elements:

builder\steamcmd.exe +login your_steam_username your_steam_password +run_app_build ..\scripts\app_build_YourAppID.vdf

tools/ContentBuilder/scripts/depot_build_1001.vdf : rename the file, replacing “1001” with your Mac depot ID.

• Set “DepotID” to your depot ID.

• Under “FileMapping”, set “LocalPath” to .\mac\* .

In the end, your file should look like:

“DepotBuild”
{
  “DepotID” “xxxxxx1“
  “FileMapping”
  {
    “LocalPath” “.\mac\*“
    “DepotPath” “.”
    “Recursive” “1”
  }
}

tools/ContentBuilder/scripts/depot_build_1002.vdf : rename the file, replacing “1002” with your Windows depot ID.

• Set “DepotID” to your depot ID.

• Under “FileMapping”, set “LocalPath” to .\windows\* .

In the end, your file should look like:

“DepotBuild”
{
  “DepotID” “xxxxxx2“
  “FileMapping”
  {
    “LocalPath” “.\windows\*“
    “DepotPath” “.”
    “Recursive” “1”
  }
}

tools/ContentBuilder/scripts/app_build_1000.vdf : rename the file, replacing “1000” with your App ID.

• Fill in the “AppID” field with your App ID.

• Set “Preview” to "0" .

• Comment out (put a // before the line) the “Local” and “SetLive” fields.

• Change “ContentRoot” to "..\content\".

• Replace each entry in “Depots” to have your depot number, followed by the name of the depot file from the previous steps.

In the end, your file should look like:

“AppBuild”
{
  “AppID” “xxxxxxx“
  “Desc” “My Game 1.0.0“
  “Preview” “0“
  // “Local” “..\..\ContentServer\htdocs”
  // “SetLive” “AlphaTest”
  “ContentRoot” “..\content\“
  “BuildOutput” “D:\output\”
  “Depots”
  {
    “xxxxxx1“ “depot_build_xxxxxx1.vdf”
    “xxxxxx2“ “depot_build_xxxxxx2.vdf”
  }
}

Double click run_build.bat and watch the Command Prompt window. You may have to enter a 2FA Steam Guard code. If any errors occur, they will be logged in the output folder. Your build should be uploaded to Steam.

Setting Your Build Live

Back in Steamworks under Edit Steamworks Settings > SteamPipe > Builds, there should be a new build listed. Under Set build live, click “default” as your branch and click Preview Change. Click Set Build Live Now.

Finally, click on the Publish tab, and go through the same process you did before to deploy your changes to the Steam store.

If you go to your Steam client, you should see that a new app appeared in your library! Wait 3 minutes and click install on your app.

Verify that your app files correctly installed on your machine and that you can run your app. On Windows, your files should be in C:\Program Files (x86)\Steam\steamapps\common\Your App Name . On Mac, your files should be in ~/Library/Application Support/Steam/steamapps/common/Your App Name .

Additional Reading

Thanks to the many tutorials and posts that helped me figure this out myself. I’ve linked some posts that helped me through this process. Take a look if you’re stuck.

• Steamcmd builds in preview mode, but fails otherwise

• Building your content in Steampipe

• Preparing your Unity game for Steam

Conclusion

Thank you for reading, and I hope this guide helps. You can check out my work at yoonicode.com.