The Confusatory

I’ve been noodling with intermittent, morning fasting recently, and just put it to practice on a trip to Greece. Here’s my experiences with both: I hope my anecdotes are helpful, and shed some light on an experience which others may be considering.

Food

Food is a finicky little problem for me. Every meal, every bite, is a joyous little moment in my day, one of visceral delight and pleasure. Deriving experiential pleasure from caloric ingestion is a very tricky thing to navigate: I’ve learned I must anticipate this when I plan a meal, its ingredients, and its size, and need to be present for every bite. Without imposing a heavy-handed, highly cognitive self-regulation during a meal, every nibble, even when I’m full and sated, will earn a stamp of approval from my naïve and error-prone mental arithmetic: on its own, each bite brings immediate happiness, and incurs a small, abstract, longer-term cost, so I nibble my way from “sated and full” to “regret and sadness”.

I did a small project with two meditation group friends on being more mindful of one’s habits, and my odd tendencies of food consumption came to mind. I evaluated some changes to my environment and behaviours which could be introspective, or perhaps affect a change directly. Intermittent fasting has been one of the more interesting ones.

My first fasts have been in the morning: rather than eating breakfast, I stretch out the period of foodlessness from dinner the night before through to lunchtime. In practice, it’s simple: in the morning, I pick a time to eat lunch, around 12:30 or 1 PM, and take a moment to plan out a healthy meal. Once that’s figured out, I make a cup of black coffee (importantly, no milk or sugar) and go on with my day. (I don’t drink much coffee, but I’ve found a good half or full cup of coffee helps keep me energized and distracted from my grumbling stomach.)

I’ve been surprised and impressed by my brain and body’s reactions to the fasts. They feel clarifying and simplifying: there’s no meal preparation or cleanup, and having my lunchtime menu and time planned out helps silence my brain’s normal angst and perpetual hand-wringing about hunger and food: “Am I hungry now?” “When did I eat last?” “Is it ok to eat now, or should I wait?” “Should I snack, or wait and make a full meal?” “Rice pudding is an acceptable breakfast, right?” “I don’t really want to take the time to cook, but I’m hungry…” Also of significance: my body’s hunger subsides an hour or two after my usual breakfast time, and it doesn’t seek revenge at lunchtime and come roaring back.

I’ve done a small morning fast for a few mornings while working at home, and during a couple of travel days on the road. I’ve found it easier than I’d expected, and a very calm experience. It reminds me, in some strange ways, of meditation: it’s a very deliberate removal of a stimulus from one’s environment, and in its absence, there’s a bit more space and free airtime for other things.

Around the same time as I began my fasting project, I realized I might have a trip from San Francisco to Greece on my schedule. I’d wanted to try a fasting-oriented approach to coping with jet lag, and this was great practice: the fast I’d need to do while traveling would be at least 12 to 16 hours, possibly longer, and I’d be awake for most or all of it. Greece is 10 hours ahead of San Francisco; during a trip to Uganda last summer, also 10 hours ahead, I suffered from jet lag for several days, I was suddenly very interested and motivated to try something new.

The rough principle behind fasting during timezone travel: by removing the day’s normal food schedule cadence, you upend your body’s day and night rhythms. When you break your fast in your destination in the morning, and sync up the rest of your day with the new time zone’s food schedule, your body, hungry for food and eager for stability, takes the hint about the change in time far more easily than if you’d continued eating on a normal schedule. As I explained this to Patrick and Maja: normal international travel is confusing to your body. You wake up, eat breakfast, lunch, then dinner after dinner after dinner, a snack, another dinner, one last dinner, and then go to bed. Fasting keeps it simple: wake up [loss of food signal] off the plane breakfast lunch dinner bedtime!

(More reading on jet lag and fasting: a write-up from Harvard Business review on the original research, a bit in Harper’s Magazine, Jezebel with a handy timezone calculator, and the obligatory Lifehacker article.)

So: here I am in Greece, three days after my arrival, and I feel pretty great. Here’s my little story, a few anecdotal data points, from which someone can perhaps draw some inferences or plan out their own fast:

My departure, travel to Europe, and arrival in Greece

I ate my last meal in San Francisco at 10:30 am Pacific: I had a regular night’s sleep, and ate a small breakfast with a small espresso. I fasted for 13 hours, skipping lunch in SFO and dinner on the plane, slept less than an hour on the plane, and ate breakfast shortly before landing in Frankfurt. (Frankfurt is one hour behind Greece, nine hours ahead of SF, and this meal was provided around 8:30 am local, 9:30 am Athens, 11:30 pm San Francisco)

I crash-napped briefly on my next flight, from 3 to 4:30 pm local time (6 to 7:30 am PST), and ate dinner in the airport around 8 pm Athens time. I slept fitfully that night, but did get around 8 hours of rest, from 10:30 pm to 6:30 am (and I caught a pretty delightful sunrise!)

I ate on a regular schedule on my first full day in Greece: a substantial breakfast with a tiny cup of coffee at 8:30 am, and a large lunch at 2 pm. I snacked again at 3:30, and that was my last food for the day. At 6:30 pm, just as the light was fading for sunset, my body crashed hard, probably from the lingering sleep deprivation and general time zone nonsense, and I went to bed. (This was 8:30 am PST: perhaps my body had some fuzzy, lingering memories of sleepy weekend mornings it was trying to recreate.) I woke up at midnight, fairly awake and pretty hungry, and had to keep myself entertained until sunrise and breakfast. So, in sum: 5 hr 30 min of sleep.

I had breakfast at 8:30 am on that second, very insomniac, day, totaling up to a 17 hour fast. I ate on another normal schedule that day: coffee with breakfast, espresso at 11 am, lunch at 1:30, and dinner and drinks around 7:30–8 pm. I was sleepy in the early evening, but stayed up, and crashed into my bed hard at 10 pm. I slept pretty soundly until church bells woke me up at 7 am, for 9 hours of sleep.

In Review

My daily energy has felt quite completely normal from the morning through daytime hours until 6 pm. Even today, my third full day here, my body felt drained and sleepy right around 6. (Then again: I get yawny right around 9:30 pm on a normal day at home, so maybe I’m just a bit early of that mark.)

My sleep has been weird: I slept real funky that first night, had a bad night on the second, and I’m not sure if last night’s rest was the start of a better trend, or a post-insomnia correction.

My appetite has been in sync with the usual local mealtimes. It’s nice to be hungry when places are open, and aside from night two, to not wake up to a growling stomach.

What I think has been effective:

I’ve avoided an unnecessary amount of caffeine. I’m happy to go to bed a bit early: 8 or 9 pm is fine by me, as long as I get more than five or six hours of rest.

I’ve avoided drinking for the first couple of days. It’s pretty normal to sober up while sleeping, and your body has a brief middle-of-the-night wakefulness episode as a result. If that were to occur while my “middle of the night” was actually “10 am Pacific time”, I’d expect to have a tremendously difficult time sleeping.

I’ve stuck to normal meal schedules. I woke up fairly damn hungry at midnight that second night, but I knew a 2 am snack would do more harm than good. I drank plenty of water and kept myself occupied until it was breakfast time, and I think that extended fast probably helped cement my body into the local timezone.

What I’d do differently next time:

I wish I’d done a longer fast during the flight out. If I’d skipped breakfast on my day of departure, my total fast from dinner in SF to breakfast in Frankfurt would have been 26 hours, instead of 13. I think this would send a much stronger signal about the time change.

What I've got:

A UIViewController subclass

A XIB for the view controller's view, named "MyViewController.xib"

How I'm using it:

MyVC *vc = [[MyVC alloc] init];

On iOS 9, this works: iOS loads the VC's view from the xib, and hooks up its IBOutlets.

On iOS 8, this doesn't work. (Tested in the iOS 8.4 Simulator, and on an iPhone 5 running iOS 8.4 (12H143). This seems to be a bug in iOS 8.)

To work around this, I've added some shim code to my VC:

// When calling `init()`, iOS 8 doesn't load our xib. Make sure we do. // http://stackoverflow.com/a/25152545/774) convenience init() { let className = String(self.dynamicType).componentsSeparatedByString(".").last self.init(nibName: className, bundle: nil) }

Easy enough! Now this class can be used elsewhere with the traditional simple allocation call, without the caller needing to know it's backed by a xib.

tl;dr: The iPhone 6s charges at the same rate on Apple's 5W, 10W, and 12W chargers. (It charges at 5W.) If you're using the phone heavily while it's charging, the 10W or 12W chargers can provide additional power, ensuring the phone charges at its max rate while being used. But unless that's a common scenario (needing the fastest charge possible, while also using the crap out of the phone), I wouldn't bother finding/buying a 10/12W charger.

Here's quick bit of data about iPhone 6s charging on different Apple (and a third-party) USB charging bricks.

This started with Marco's sloppily-worded headline ("Charge your iPhone 6/6S faster with an iPad power brick"), despite the source material only measuring charging a iPhone 6S Plus, not an iPhone 6s.

So here's my totally unscientific, n=1 data sample, for my iPhone 6s.

My measurement scenarios:

Max draw: the highest-achievable draw from the wall. To do this, I turned up the screen to full brightness and ran Geekbench's processor benchmark.

"Normal" draw: measured immediately after the device is locked, but before it steps into a lower power, idling + charging mode. This is, more or less: all the chips are on, but the screen is off.

Average draw: the power draw level which my phone eventually quiesces to. This is the rate any ol' phone, plugged into any ol' charger, will charge at. (Ignoring iCloud backup or background fetch which use a bit of power for the processor and wifi/cellular connections.)

I measured:

Apple's 5W charger, included with all iPhones. (This lil cutie.)

Apple's 10W charger, included with iPads until the retina iPad. (Here's their page on distinguishing between chargers. Basically, it says on the bottom, "10W" or "12W".)

Apple's 12W charger, from a newer iPad.

Twelve South's PlugBug, a great travel accessory for MacBook + iPhone owners. Mine is the original PlugBug, not a PlugBug world, but it's still rated for 12W.

My measurements:

Analysis (from a person on a sofa in their pajamas):

Regardless of the charger's maximum rating, the iPhone 6s, when sitting with its screen off, just chillin', charges the same on all chargers.

If the phone is under heavy load (e.g. screen on, streaming data from the network), the higher-watt chargers have the headroom to provide additional power for the processor's power needs along with the normal current for charging the battery.

In other words: I'm going to hold onto my 5W chargers. I'll continue to travel with one, and I'll keep them scattered about the house. I already have one iPad-specific charging spot in the house, but I'm definitely not going to buy any 10W chargers for my phone: I don't charge while I play games, so it's not necessary.

If I need to use my phone while charging it, I'm probably running out the door, so I use a battery pack or a battery case. The Wirecutter's reviews here are 👌 just the gosh-darn best, and their piece on extending your iPhone's battery life is also fantastic.

Why is a San Francisco hospital named for a social media billionaire, when his wife works there as a doctor in pediatrics?

While Mark Zuckerberg's Facebook stock bankrolled a $75 million donation to SF's General Hospital, his wife, Dr. Priscilla Chan, is the doctor of the family. She went to med school at UCSF and did her pediatric residency there (and worked with friends of mine). She now works in pediatrics at SF General, and it should have been named for her instead: "Chan San Francisco General Hospital".

This post from a developer who worked on Google’s Allo1 included a great blurb about designing security for users:

Simply Secure did an awesome study2 where they asked a group of users what they think about secure messaging in mobile apps, and here's what they found [emphasis is Thai's]:

"After in-person, semi-structured interviews with 12 African-American New Yorkers about mobile messaging, we identify design directions to improve secure messaging.

We uncovered a contradiction between the participants’ concerns and the priorities of the developer community. Participants:

Believe online/governmental surveillance is inevitable

Worry about physical security of mobile devices

Developers should better communicate the value proposition of secure messaging through app store descriptions.

Secure messaging and open source weren’t understood terms

Participants proposed the term “blocking”

Secure messaging was assumed to mean auto-deleting messages from the device.

Time-limited messages were the crucial privacy-preserving feature."

In summary, he states: [copyedited for readability, emphasis is mine.]

To most users, what matters the most is not whether the NSA can read their messages, but the physical security of their devices, blocking unwanted people, and being able to delete messages already sent to other people. In other words, their threat model doesn't include the NSA, but their spouses, their kids, their friends, i.e., people around and near them.

Thai also is the co-author of three significant attacks on SSL/TLS/HTTPS: BEAST, CRIME, and POODLE. ↩︎

The internet's results for this are terrible, so:

For Xcode 7.3:

Quit Xcode

open /Library/Developer/CoreSimulator/Profiles/Runtimes/

Remove any old Simulators you don't like.

I just went to a four-hour MTA board meeting at City Hall. Here’s a few things you should know:

Before you go, look up the agenda for the meeting. Find out where your issue is in the schedule: is it early? late? dead last? (I got most of my inbox triaged by the end of the meeting.) (City Hall had pretty good T-Mobile coverage.)

When you arrive, check in with the person running the meeting, and register for public comment on the issue you want to speak about. It doesn’t matter when you register, so long as it’s before they vote, but I recommend doing it before the meeting starts.

If you want a seat in the main room, get there 10-15 minutes early.

Today's meeting opened up with nearly an hour of vociferous complaints from taxi drivers about medallion prices and availability. I believe there's always a general comment period preceding the vote-specific public comments. You could probably skip the first 30-60 minutes while everyone has their personal Two Minutes Hate.

For each issue up for a vote, they take a presentation from relevant city officials, if any, then take comments from the public in two-minute chunks, if anyone has registered to comment. After public comments, the board discusses the comments and presentation, may call up officials if they have additional questions, then eventually make a motion for passage or denial of the agenda item.

As you head up to speak, remember a few things:

You have two minutes.

Take a deep breath.

Slow down.

(Some people made a point of stating, “I’m speaking in support of/in opposition of….” I don’t know if this is tallied up in any way, but I got the impression that the board cares to see how many people say, explicitly, “Hey, I’m in favor of/against this.” What's up with that?)

I think there’s a way to attend and comment which requires less than an entire afternoon:

Look up the meeting agenda, know where on the docket your issue is. Come in before the meeting to add your name on the list for public comment, then go work at the public library or nearby coffee shop.

Watch the meeting live on SF Gov TV. (http://sfgovtv.org) Know where in the schedule your vote is, and head over just before it comes up for discussion.

Other things I learned:

They do read letters and emails they receive, though they get some really gnarly and unhinged ones. A letter of support or critique matters in the aggregate.

If there’s an issue which is a toss-up for them, show support or opposition with bodies. 10 or 20 people coming in person to speak is a big deal. In this meeting, the board went through several rounds of discussion amongst themselves and with MTA staff for a motion that would otherwise have been a quick up-and-down vote. They did so specifically because there was so much public comment about it, and because it was clear there was room for improvement.

Why did I go? To support a neat new traffic plan on Twin Peaks. It passed, by the way, and I got a smile and a nod from one of the board members as I left.

I also spoke with two of the board members during a quick recess and bonded with them a bit (mostly about the hundred taxi drivers). Building a relationship with the staff is likely the best way to get an idea of their concerns before the meeting and vote, and perhaps give you a chance to address them in the public comment period before their own intra-board discussion.

Some stream-of-consciousness notes for my future self about Flux/Redux, React, and iOS applications. These might be useful to you too. Say hi on Twitter: I want to know what here was helpful, and what questions you have.

Andrew Ray's "Flux for Stupid People" is wickedly smart. He wrote, "The official documentation is written like someone's stream of conciousness, and is a bad place to start.", and I strongly agree. Start here, and read it twice.

The official documentation is readable once you understand the high-level concepts.

Lin Clark has drawn and written a Code Cartoon for Flux and another for Redux.

There's, of course, a Swift-based library for Redux. Haven't tried it, but I just might.

Takeaways so far

Flux is Yet Another Data Flow model for building applications. Andrew's post helped contextualize why this is important for web front-ends: they've lacked the structure which UIKit brings/imposes on iOS applications.

This is to say: Flux is cool! I like the conceptual lines it draws around different parts of an application's logic. I think they're good lines. MVC, MVVM, VIPER: these are all just slightly different circles we draw around the myriad bits of work an application performs, and we group together the things which are most like each other to try and reduce conceptual and implementation complexity.

But! I think Flux's magic is not in anything it does: its magic is in React's Virtual DOM.

The Virtual DOM

The Virtual DOM, and its diff calculations, is what makes this architecture work. The concepts in Flux, of dynamically-dispatched, loosely-bound updates, and trickle-down data (re-)calculation, that's all great, but: it only comes together in the Virtual DOM, and that's what transforms it into something that works, works well, and looks good. I think the Virtual DOM (and an iOS equivalent, a virtual/shadow view and view-model hierarchy) would make nearly any architecture we're using today work much better.

The Virtual DOM helps insulate the application's view-oriented layers from the hard work of calculating the changeset from old to new data. In my applications, I feel like my View Controllers (and their View Models) spend 80% of their code dealing with different cases of data source states and transformations. This Stack Overflow answer about the Virtual DOM discusses of the Virtual DOM's perks in detail. I particularly liked one paragraph of their answer, so I've rewritten it with iOS applications in mind:

A virtual view and view-model hierarchy lets us write our code as if we were re-drawing the entire screen. Behind the scenes, we compute a patch which updates the view hierarchy to look how we expect. One side of the application declares exactly what it wants, and the virtual view hierarchy will calculate how to make the current views look like this. We don't have to do manual view manipulation or get confused about previous state; we don't have to re-render the entire window, either, which is much less efficient than patching it with deltas.

Hmm.

Sue Gardner's post about Wikimedia and fundraising is another good read. She talks about the impact fundraising has on an organization's priorities, and how it's at cross odds with organizational effectiveness.

Plus, I really liked this bit about donors and their inexperience in the problem domain. The New Yorker piece on the Ford Foundation also brushed up against this idea. (The trick: take donors' money, not their advice.)

This effect is amplified by the presence of major donors, who are typically wealthy retired business executives.

The New Yorker has a long profile of Darren Walker, President of the multi-billion dollar Ford Foundation, in its January 4th, 2016 issue. It's a fantastic piece of long-form reporting. It discusses Walker and how his background has shaped his leadership at the organization. It also sketches out the world of philanthropy, nonprofits, and their interactions with society and with governments: a topic which I find endlessly fascinating, perhaps because it's an area in which I believe I'll work in one day.

I particularly liked these two anecdotes about Walker's leadership:

[Here], the people who needed help were far away—distant supplicants who communicated through applications and waited months for an answer. The supplicants had no right to demand anything—they took what they could get and were grateful for it. Once, he noticed that a person who reported to him was about to go on vacation leaving a stack of grant files on his desk—files that represented more than a million dollars that couldn’t be disbursed to the nonprofits waiting for them until they were processed. He asked how the person could think of going on vacation before the files were dealt with, and the person said that it wasn’t a problem, he would take care of them when he got back.

Last year was the Year of the Cookie. I didn't make many, but I ate quite a lot. I also ate a lot of freshly-baked bread, all from places here in San Francisco: Josey Baker, Outerlands, Della Fattoria, Acme, and more.

I think this year's food theme is bread. And, not just eating lots of it, but making it too.

I made this recipe while I was home in Virginia, and brought one loaf back with me on the flight home. The Mom had a Dutch oven and a KitchenAid, so this was an easy one to knock out. Overall, it's a bit lackluster: when it comes to white flour bread, I'm used to sweeter, taller country loaves, or a sourdough-based loaf. (Acme's sourdough loaf is A+ magnifique.) So now I have a new project: get some sourdough starter spun up.

A year of bread! I'm excited. (And planning more exercise to offset the constant carb-loading.)

Oh! I almost forgot: photos of the bread! Duhhh.

fresh out the oven:

The social media shot.

In the same vein as diffing UTF-16 .strings files in git:

It's easy to set up git to show diffs for binary .plist files.

Add a textconv key for this conversion to your ~/.gitconfig:

git config --global diff.plist.textconv "plutil -convert xml1 -o -"

In your global .gitconfig, it'll look like this:

[diff "plist"] textconv = plutil -convert xml1 -o -

Add a mapping from filename to diff command to your project's .gitattributes file:

echo "*.plist diff=plist" >> .gitattributes

(Bonus points) Set up a global .gitattributes file via this Q&A on Stack Overflow to always do this:

git config --global core.attributesfile $HOME/.gitattributes echo "*.plist diff=plist" >> ~/.gitattributes

What this looks like in practice:

Here's a follow-up to this post about CDMA LTE support with the iPhone 6s:

(Warning: this is an n=1 story. The plural of anecdote is not "data". Et cetera.) A new iPhone 6s from Apple, bought full-price off-contract (i.e. ships with a T-Mobile SIM) fully supports both GSM (AT&T and T-Mobile) and CDMA (at least Verizon) carriers.

Here's what I tried:

My iPhone 6s shipped with a T-Mobile SIM out of the box, and immediately worked when I placed my existing T-Mobile SIM into it. When I swapped in my pre-paid Verizon SIM, the carrier logo changed to Verizon, LTE came up fine, and data worked as expected. I was then able to swap it back to the T-Mobile SIM and use it with them without any problems.

It appears that for the first time, the iPhone 6s doesn’t have two different model numbers for GSM vs CDMA support. (See Apple’s magnificent LTE list for details) (Technically, the CDMA phones tend to be a superset of GSM support, which is why this is all so frustrating.) (I also have no idea why this different SKU thing even exists. Is there a technical reason for it?)

I believe this has a very neat consequence for people owning unlocked hardware, especially in the US.

I have an unlocked iPhone 5s, bought from Craigslist, that was bought from Verizon (a CDMA carrier) to start. The CDMA 5s supports a superset of the GSM LTE bands, so this phone has been used on AT&T, Verizon, and T-Mobile.

Since my 5s supports both my current carrier, T-Mobile, and Verizon (my old one), I’ve use it in a fun hybrid mode when I go on backcountry trips: I activate a pay-as-you-go SIM I have from Verizon, so I have better data and phone coverage while I’m out. (It’s surprising how often a nearby ridge has Verizon voice coverage. It’s a useful tool.)

I want this same setup for my iPhone 6s, but was worried about the normal GSM/CDMA activation nonsense, and couldn’t think of a way to have my phone work on T-Mobile and Verizon without starting out with a Verizon-activated phone, unlocking it, and taking it with me.

Reading the above LTE band support grid, I think this’ll work with my pre-ordered and unlocked 6s.

I’ll be testing this when I get my hardware next week, and I’ll make sure to write up what happens. I have two pre-orders coming (that’s another story altogether) so I’ll activate each phone with a different carrier SIM to start, and see if that has any effect on what happens.

Background

I have an external drive I'm using for lazy storage/backup of data. I wanted to partition it and set up the partitions as Full-Disk Encrypted (FDE) volumes in OS X (Yosemite/10.10, just to note it). I didn't want to create a regular volume and convert it to FDE (and wait days for the disk thrash/conversion to complete), so I did this a different way.

I generated a very long password in 1Password for these drives, and saved it in 1Password as a note. In Disk Utility, I created the partitions I wanted, then reformatted the volumes as "HFS+, Encrypted", and entered my 1Password volume password.

After unmounting and re-mounting the drive, OS X prompted me for the volume's password to unlock it; there wasn't a Keychain entry for the volume's password yet. As of OS X El Capitan (10.11.4), this prompt now accepts pasteboard entries. While this obviates the need for this post, the information below is still useful. This prompt, however, disallows pasting and drag-and-drop (a great anti-pattern for password entry fields). Rather than manually type in four 50-character passwords, one for each partition, I decided to dive into security, the command-line interface for the OS X Keychain, and create the Keychain entry OS X needed for these drives to automatically unlock.

tl;dr How to make a Keychain entry for a Full-Disk Encrypted Volume

You'll need some information:

[volume name]: The name of the volume. In my example below, it's "DeskSpace", mounted at "/Volumes/DeskSpace".

[volume password]: The password you entered in Disk Utility when you created the volume. It should be very random and very long.

[volume mountpoint]: i.e. disk3. I’ll show you how to find yours.

[logical volume UUID]: This one is also hard to find. Here’s how:

Finding your volume's Logical Volume UUID (LV UUID) and /dev mountpoint

You cannot use Disk Utility to get the volume’s LV UUID. (An “Info” window on the volume you want to unlock does contain a UUID, but I was unable to map the UUID it displays to any UUID listed by diskutil list or diskutil cs list. What is this UUID?)

In a shell:

# diskutil cs list

will print out a list of CoreStorage volumes. Here's the output for my example DeskSpace volume:

… +-- Logical Volume Group B0C61158-F7FD-432A-BB25-17F760B4C6A3 | ========================================================= | Name: DeskSpace | Status: Online | Size: 999786520576 B (999.8 GB) | Free Space: 15437824 B (15.4 MB) | | | +- Logical Volume Family 8BF6D6F0-D624-47B1-A08F-7FFD69041ED6 | ---------------------------------------------------------- | Encryption Status: Unlocked | Encryption Type: AES-XTS | Conversion Status: Complete | Conversion Direction: -none- | Has Encrypted Extents: Yes | Fully Secure: Yes | Passphrase Required: Yes | | | +-> Logical Volume 02A929A0-5D5A-40F0-9F94-EAC907FA580A | --------------------------------------------------- | Disk: disk3 | Status: Online | Size (Total): 999418757120 B (999.4 GB) | Conversion Progress: -none- | Revertible: No | LV Name: DeskSpace | Volume Name: DeskSpace | Content Hint: Apple_HFS | …

The Logical Volume UUID for "DeskSpace" is "02A929A0-5D5A-40F0-9F94-EAC907FA580A”, and it’s mounted at /dev/disk3.

With these pieces of information, the LV UUID, the password, and the volume name, you’re ready to create a Keychain entry with security, and the disk mountpoint will be used later to unmount the volume to test the Keychain entry.

The security command we want is add-generic-password. I’ve done the hard work of comprehending the many and poorly-documented parameters to add-generic-password, so here’s all you need to know:

Create a keychain entry with security add-generic-password

Start an interactive security prompt at the command-line. (Interactive mode means your password won’t be written into a shell history file or viewable with ps)

# security -i

Run add-generic-password with your three pieces of information from above filled in accordingly:

> add-generic-password -D "Encrypted Volume Password" -a [volume name] -l [volume name] -w [volume password] -s [logical volume UUID]

Hit control-C to exit security. (Why doesn't it support exit or \q or any other command to terminate the interactive prompt?)

Test the Keychain entry!

Unmount and remount the volume with diskutil:

# diskutil eject /dev/[disk mountpoint]

Disconnect and reconnect the drive. Upon connection, OS X will attempt to mount the drive, and the CoreStorage system will try to access the Keychain entry. This will display a UI prompt for Keychain Access under the name "CSUserAgent". Here’s what the prompt looks like:

I selected "Always Allow" so that it auto-unlocks this volume when it's attached in the future (i.e. while this keychain is present and unlocked).

Show me an example!

Here's how I created the Keychain entry for "DeskSpace”. Using the diskutil cs list output from above, I had the following information:

[volume name]: DeskSpace

[volume password]: this is my secret.

[volume mountpoint]: disk3

[logical volume UUID]: 02A929A0-5D5A-40F0-9F94-EAC907FA580A

Here's what I ran:

security -i add-generic-password -D "encrypted volume password" -a DeskSpace -l DeskSpace -s 02A929A0-5D5A-40F0-9F94-EAC907FA580A -w <the secret password for deskspace><control-c> diskutil eject /dev/disk3

Errata

To the best of my knowledge, in OS X Yosemite 10.10.4, this Keychain entry is identical to the keychain entry created by OS X's "Unlock this volume" prompt.

Here’s an entry created by OS X for another drive:

% ○ security find-generic-password -s 154E05AB-B790-4B8C-8FC2-40777B09842E keychain: "/Users/cbowns/Library/Keychains/login.keychain" class: "genp" attributes: 0x00000007 <blob>="SpaceClone" 0x00000008 <blob>=<null> "acct"<blob>="SpaceClone" "cdat"<timedate>=0x32303135303831333231313132345A00 "20150813211124Z\000" "crtr"<uint32>=<null> "cusi"<sint32>=<null> "desc"<blob>="Encrypted Volume Password" "gena"<blob>=<null> "icmt"<blob>=<null> "invi"<sint32>=<null> "mdat"<timedate>=0x32303135303831333231313132345A00 "20150813211124Z\000" "nega"<sint32>=<null> "prot"<blob>=<null> "scrp"<sint32>=<null> "svce"<blob>="154E05AB-B790-4B8C-8FC2-40777B09842E" "type"<uint32>=<null>

Here’s the keychain entry created by our security add-generic-password for the DeskSpace partition: