Colophon

Note A Sources

The lake chart behind this site shows Lake Champlain from Port Henry and Bulwagga Bay to Crown Point.

Soundings, buoys, lights, the bridge, obstructions, and place names come from NOAA’s electronic navigational charts US4NY1LS and US4NY1MS. The shoreline comes from the USGS National Hydrography Dataset. Both are U.S. public-domain data, and no other map data goes into the chart.

NOAA’s soundings come from surveys made between 1870 and 1939. Depths are in feet below Low Lake Level, which NOAA’s U.S. Coast Pilot 6 puts at 93.0 ft above mean sea level. The depth contours, and the 100 m depth grid the sounder reads, are interpolated from NOAA’s soundings and its shallow-water contours. For the wave speed, the chart takes the lake to be 3 ft above Low Lake Level, about its long-term average at the USGS gauge at Burlington, Vermont.

A script in the repository (tools/lake-chart) builds the chart file from the NOAA and USGS downloads. Two runs from the same downloads produce byte-identical output.

Not for navigation.

Note B The chart

The chart is drawn in your browser, on a canvas, from one data file this site serves.

On a wide screen the narrows are scaled so the shores and buoys sit beside the text and open water lies under it. Scrolling pans the chart south toward Crown Point at about a third of the scroll speed.

Over the water beside the text, the pointer works as a depth sounder and reads the charted depth. On a phone, press and hold on the water. A click or tap on open water sends a wave at the shallow-water speed, c = √(g·h), so the crests slow over the shoals, bend around the points, and stop at the shore. Time is sped up, but the relative speeds are real.

Nothing is drawn while nothing moves. Animation stops in a hidden tab, and with reduced motion the chart is a single still frame.

Each background in the picker has a smoke test that runs it in Node with a stubbed canvas and DOM. It checks for exceptions, loops that never go idle, work in hidden tabs, and listeners or timers left behind.

Note C Security

This site is static. Every page is built ahead of time, and nothing runs on a server.

Every page carries a strict Content-Security-Policy. Scripts, styles, fonts, images, and data load only from this site. Inline code runs only if its SHA-256 hash is in the policy. That’s how the small script that applies your saved background before the page paints gets to run. There’s no 'unsafe-inline', no 'unsafe-eval', and no other origin.

Code blocks are highlighted with Prism rather than Shiki, because Shiki’s inline styles would break that policy.

GitHub Actions builds and deploys the site. Every action is pinned to a full commit SHA. The workflow defaults to read-only permissions. Only the deploy job gets write access, and only to publish to Pages. Dependencies install with npm ci --ignore-scripts, and checkout doesn’t keep its credentials. Dependabot watches both the npm packages and the actions for updates.

On every build, a script checks the policy, the Prism setting, the workflow settings, and the Dependabot config against the repository, and the build fails if one stops being true. The source is public on GitHub.

The policy’s fixed directives are listed at the end of this note. The build adds script-src and style-src to each page, with 'self' and that page’s hashes.

Found a security problem? security.txt says how to report it.

default-src 'none';
img-src 'self' data:;
font-src 'self';
connect-src 'self';
manifest-src 'self';
base-uri 'none';
form-action 'self';
object-src 'none';
upgrade-insecure-requests

Note D Privacy

This site has no analytics, no trackers, and no ads. Its pages load nothing from any other site: the policy in Note C allows no other origin.

This site sets no cookies. The only things it keeps are in your browser’s local storage, and they never leave it: the background you pick (gj.bg), and any knots you plant on the Wood grain background (gj.bg.grain.knots).

This site publishes no phone number, email address, or street address. To get in touch, use LinkedIn.

The build fails if a page’s text shows anything that looks like an email address, a North American phone number, a US amateur call sign, a VIN, or exact coordinates. It also fails if a JPEG, PNG, WebP, or AVIF image still carries EXIF or XMP metadata, which is where a photo keeps its location.