Two-factor authentication is proof we are living in hell

If you’ve never encountered the following screen, consider yourself lucky.

Network Solutions login two-factor authentication screen

I hate it. I hate it so much.

No normal human understands how DNS works. Or wants to. Or needs to. But that means that freaks like me have to understand how it works, because we take care of all of this nonsense for them.

Enshittification is everywhere in 2026, of course, but I don’t think it’s so acutely, painfully present as it is in having to log into someone else’s domain registrar account.

Domain names are pretty sensitive. It makes sense that the tools for managing them need robust security. But they also need to be accessible not just to the non-technical owner of the domain, but the geek that owner is paying to do the geeky stuff for them.

Most good registrars (ha! there are no good registrars, just less-bad ones) have set up mechanisms for domain owners to grant access to technical users. Network Solutions was late to that party, and even though they do finally offer it, their underlying, archaic systems are so fucked up and incompatible with each other that the process is still fundamentally broken.

This morning I needed to get into this client’s Network Solutions account. Of course, the email address associated with their account — the one that gets the initial 2FA verification code — is long-since out of use. (Yeah, this is going to open up a whole new world of pain for them at some point in the future, but I’m not dealing with it today.) Fortunately they do have their cell phone associated with the account, so I was able to have the code texted to them instead.

Then it’s a race against the clock. Are they checking their texts? Will they respond within the tight 10-minute window before the code expires? Of course not, so I waste a half hour trying new codes and hoping I can get in touch with them.

Finally, I’m in. And the first thing I do is go to the team settings and add myself as a user on the account.

When the confirmation email comes in, with a verification link for me to click, I hastily click it, forgetting that it’s going to open in the same browser I am already using, kicking me out of the existing Network Solutions session I have open with the client’s user ID in the process.

No big deal. Now that I’m in with my own account, I can just use it instead. Only… the client has two different domain names, and for some reason the account I’ve been granted access to only sees one of them. And of course, it’s not the domain I need to edit.

Back to trying to log into the client’s account so I can try to sort out my own access. Now, in the past, Network Solutions did not require re-entering a 2FA code if you logged back into the same account within 24 hours. Of course that has been changed.

And, at this moment, I am in another half-hour-plus cycle of requesting a code, hoping the client will reply, and… oh wait. Shit.

Your code has expired and no more resend attempts are available. You may request a new code tomorrow.

THIS IS HELL!

P.S. I already complained about this five years ago and if anything it has only gotten worse since then. How could it get worse???

Betas are for finding (and fixing) bugs

First, yes… I know you’re taking your chances when you install a beta OS on your primary device. As it happens, I was willing to take that chance with the macOS 27 Developer Beta on my primary Mac, because a) I had heard (and have seen myself) that it is very stable for a beta OS, and b) the Liquid Glass UI nonsense in macOS 26 was so bad that I was willing to risk running unstable software to get away from it.

And so, I have been running the macOS 27 Developer Beta for the past month, with very few problems. Oh, definitely not no problems. With an earlier build, Final Cut Pro — one of Apple’s own apps — was an absolute crash fest. In the process of editing a fairly simple video, I had it crash at least two hundred times in a single day. Fortunately, Final Cut is constantly saving your work, so I never lost a single bit of my project through all of those crashes… although it was definitely challenge to keep my ADHD brain focused to remember what it was I had just been working on 5 seconds ago.

The whole purpose of a Developer Beta OS is for developers to test their software against the new OS and see if there are any bugs they need to fix. I’m pleased to say, Apple’s own Final Cut team is certainly doing that, and with the latest beta, Final Cut seems to be back to its usual rock-solid stability.

Now granted, it may not technically be the purpose of a Developer Beta for users to test third-party developers’ software against the new version of the OS, but guess what… it’s gonna happen.

There are a couple of apps I rely on constantly throughout my workday, both of which have exhibited a couple of bugs with the new OS. They’re not showstoppers, just minor inconveniences.

I don’t want to name the companies, but let’s just say, one is a relative newcomer, building a client app for Gmail. The other is one of the most storied indie Mac development companies around, and I’ve been using their FTP client for literal decades. But frankly, they seem a lot more interested in their bright yellow handheld video game device than in supporting their crusty old Mac software at this point.

I submitted bug reports to the two companies a day or two ago, and I received responses from both of them within a half hour of each other today.

The mail client company thanked me for submitting my bug report, and let me know that there was already an update available that should fix the issue. I ran it, and it does.

The FTP client company sent me a cursory response linking to an FAQ page on their website that basically says, “hey dumb-dumb, don’t complain to us if things don’t work when you’re stupid enough to be running a beta OS.” OK, it maybe wasn’t quite that mean-spirited, but it felt that way.

Here’s the thing… maybe neither of these companies really wants or expects user feedback during the Developer Beta period, since they are — or at least should be — conducting their own extensive testing of their apps with the beta OS. But when they get that feedback, they should at least have the courtesy to feign appreciation, rather than assuming the worst about their own user base and dismissing their very legitimate concerns that bugs in an app that’s critical to their workflow may not be resolved before the final OS release.

Honestly, at this point I would have long since given up on that company’s FTP client, but sadly, the market for FTP clients is pretty slim. What am I supposed to use, Filezilla? Yuck. At least this is, in John Gruber’s words, a “Mac-assed app,” even if it’s buggy and feeling a bit neglected these days. Kind of like me.

The Mac App Store has an authenticity problem: a story in two screenshots

Chapter 1

A screenshot of a search for “google authenticator” in the Mac App Store, showing a bunch of deceptively branded knockoff apps.

Chapter 2

A screenshot of a Google search result for “Google Authenticator App for Mac,” showing an AI overview indicating that an official app does not exist, followed by a sponsored result for one of the knockoff apps.

Epilogue

Obviously, Google itself has a problem too. There is no official Google Authenticator app for Mac. And given the whole purpose of authenticator apps, I would only want one that was official.

“Let the market decide” and all of that nonsense. But I think Apple and Google both have a responsibility not to let their users be misled, especially about their own products. I’m of the opinion that, if you search “google authenticator” in the Mac App Store, nothing should come up, because users’ implicit expectation is that they’re going to get a Google-made app, but there isn’t one.

Likewise, I find it almost comical that Google’s AI Overview, of all things, is saving the day here. No, there is no official Google Authenticator app for Mac. But once you’re past the AI stuff, the first result is a sponsored link for a knockoff app.

The second link — the first “organic” link — is for the official Google Authenticator app in Apple’s App Store. But that’s the iOS version, the only real version of the app, and it won’t run on a Mac.

Which all gets me to my point. 2FA is better than passwords alone, but it’s a pain in the ass. Having an “authenticator” app that is always at-the-ready with your 6-digit code is more efficient (and more secure) than having to wait for an SMS message to come through, but it would sure be nice not to have to rely on a second device, especially when I don’t have my iPhone right by my side.

Of course, now that I think about it, the only times I’ve needed access to Google Authenticator when I’m using my Mac, and I haven’t had my iPhone right by my side, have been because my iPhone is plugged into a charger in another room.

That’s been happening a lot lately, because my poor, old, long-in-the-tooth iPhone 13 mini can barely make it to lunchtime without needing to be charged at this point.

All things considered, the answer to my conundrum of there not being an official Google Authenticator app for Mac is astoundingly obvious.

I need a new iPhone.

Stupid CSS trick of the day: Make a list two-column only if it contains at least five items

I’m working on a new WordPress site that has long dropdown navigation menus. I wanted to make the dropdowns two-column, but only if there are at least five items in the submenu.

The two-column part is easy:

.sub-menu {
  column-count: 2;
}


I’ve (finally) been learning more about some of the “new” conditional selectors in modern CSS over the past year or so. It occurred to me that there might be a very easy way to do this, checking if the submenu has at least 5 items. But I wasn’t sure it would work, so… I tried it:

.submenu:has(.menu-item:nth-of-type(5n)) {
  column-count: 2;
}


Much to my delight, it works! Submenus with four or fewer items are displaying as a single column, and the ones with at least five are displaying as two columns.

Now, this of course is using CSS classes WordPress creates for its navigation menus, so if we were talking about barebones vanilla HTML5, you could use this:

ul:has(li:nth-of-type(5n)) {
  column-count: 2;
}


This also doesn’t really account for tertiary nested menus, but I only have this site set up to display two levels of depth on its nav menu.

In praise of link rot

Thanks to my On This Day plugin (not the plugin I was asking ChatGPT for help with in my last post), it’s really easy to “surface” (I hate that as a transitive verb) some really old posts here on my blog, which has now existed for about 24 years… frighteningly close to half of my life.

I clicked on the link to a post I wrote on this day in 2008. It was about links to articles I didn’t want to lose track of.

And it’s interesting for a couple of reasons. First, there was — was — an image at the top of the page. What it was, I have no idea. But that, like all of the other images on the blog before about a year ago, are now gone. I deleted them, because I was tired of getting harassed into paying hundreds of dollars out of the blue for random images that were lurking, unseen by anyone, on ancient blog posts no one reads.

I’ve usually been pretty good about only posting images I created, but when you’ve been at this for two decades, there are going to be a few times when you get lax. And there are a couple of news agencies who have contracted with a company that is absolutely ruthless about shaking down unsuspecting bloggers. What a racket.

But I digress… I wanted to talk about the links on that page.

They’re both dead, too, but they still go somewhere. The domains they linked to are still active, but now they redirect to 404 pages on completely different domains. Whoever owned those domains either sold them or let them lapse, and now they’re something completely different.

A lot of people want to fight “link rot.” But not me. I relish it. The Internet is an Orwellian memory hole, and fixing broken links in blog posts from 2008 just accelerates that. The pages I’m linking to have long since disappeared. But their URLs remain in a zombie state here on my blog as a testament to the fact that these things once existed.

Like the website Veer.com. I don’t even remember exactly what it was, and it had been years since I had last contemplated its existence, but once I saw that link, my immediate reaction was, “Oh yeah, I remember that site. Well… no, actually I don’t, but I remember that was a site, and I used to like checking it out semi-regularly.”

There are so many lost worlds like this. No longer present anywhere on the Internet*, but lingering in the dusty backrooms of Gen Xers’ minds.

*I lied, of course. The Wayback Machine exists. I managed to find a snapshot of that URL from June 10, 2008, about a week before I posted about it.

It even still has the image of the coffee mug I was interested in! But I’m not going to post it here. I know better. Finally.