What can be better than candy? Automated candy!

We normally get lots of kids trick or treating on our street. It's usually lots of fun to give out candy and see all the costumes. One year, we even ran out of candy (rookie mistake) and had to run to a nearby grocery store to get more last minute.

Sometime over the summer after COVID started, I realized that Halloween wouldn't be the same this year, and that was even before trick or treating was banned by the city and CDC. But I didn't want to totally kill all the fun of Halloween. So I came up with the crazy idea of building an automated candy dispenser. Even if it didn't work, it would be an opportunity for me to learn about Arduino and Alexa, a couple technologies I was interested in.

Apparently several other people had a similar idea and built their own contraptions all over the country.

Some people have asked to go through my engineering process and design, so I'll do a series of blog posts about that so others can learn. I certainly benefitted from the "prior art" out there and hope this can benefit future candy dispenser designers.

Below is a little promo video I shot. I made it to serve as a little "invitation" to our friends and neighbors, and it was really just an excuse for me to practice flying my drone and editing some video. In future blog posts, I'll go through the results of how Halloween went, some of the prior art, my overall design process, and potential areas of future work.

I couldn't have done this without the help of my father-in-law who spent many hours helping me to construct the mechanical assembly, so I owe him a huge thanks. And I also owe thanks to the rest of my family for their supporting me to work on such a silly idea.

After hearing about all the major websites getting hacked every few months, I decided to be proactive about improving online security.

Over time I began switching to a password manager, and I discovered that it had a feature to review the security of all your passwords for weak, blank, and reused ones. I tried running this and was daunted by how many issues it found and never got around to fixing it.

Then I came up with a solution: just change one password per day. It usually takes less than 5 minutes. The only annoying part is when your login info doesn't even work and then you need to go through a reset process of some sort (and maybe where the account got migrated to some other website where you have to sign up fresh).

Why do this at all, especially for sites you may no longer actively use? So many sites keep our personal info in their databases, even if we aren't actively using them. And to minimize the chance of that info being hacked, it's good to have as strong security as possible.

So along with changing reused or weak/blank passwords, I also took the time for each site to turn on 2FA if it was available for that site. You could argue that I could just turn on 2FA and leave the password alone, but I figured two levels of protection are better than one.

All in all, it took me about 3 months to get through the sites/passwords I cared about to make them all strong, turn on 2FA, etc. (and there were many days I skipped it if I was busy).

Here are the detailed steps in case you want to take on a similar such "daily password change" habit for yourself:

1. ​Run your password manager's security review function.
2. Copy the report to a Google doc as plaintext.
3. Each day, take the top site and change its password to a new, long, strong password. And turn on 2FA on that site while you're at it if the site supports it.
4. Delete/cross out the site you just did and watch as the list slowly shrinks as you make slow and steady progress over time.
5. Do this for reused and weak/blank passwords. In my mind, the "old" passwords are less critical and can be optional to change.