Extracting Bookmap from ThinkorSwim on Linux

I have decent-level data now, thanks to Schwab and dxFeed. This will save me a bundle.

Also, thanks for blocking Bookmap in the Ubuntu version and making me think outside the box.

---

The problem

Schwab bundles Bookmap — the L2 order-book heatmap visualization — inside ThinkorSwim on Mac and Windows. If you're a paid subscriber, it just works. Click Charts → Bookmap, pick a symbol, watch the depth.

Except on Linux. The Linux build of ThinkorSwim ships without Bookmap. No menu item. No JARs. Nothing. Schwab's position appears to be: Linux users don't get Bookmap. The eligibility page says nothing about OS restrictions — just "non-tax-advantaged account." Mine qualifies. So why can't I use what I'm paying for?

Bookmap standalone costs $49/month for the equivalent data, on top of whatever you already pay Schwab. I already have the data entitlement through my Schwab account. What I'm missing is the software to display it.

If they'd given me Global Plus Lifetime for $1k two years ago, I wouldn't have had the desire to do this. But here we are.

---

What I built

I prototyped on a throwaway DigitalOcean droplet running Ubuntu 24.04 (the production version will run on my own server). The droplet had:

1. ThinkorSwim Linux (the official Schwab installer) with the Bookmap addon JARs transplanted from a Mac install
2. A headless dxFeed L2 stream that pulls live order-book data using the TOS-issued authentication token — 84,000+ SPY events in 65 seconds, dumped as JSONL
3. Standalone Bookmap 7.7 running on the same droplet, rendering live L2 heatmaps for MSFT via the extracted dxFeed connection

All using credentials and entitlements I already pay for. No additional subscriptions. No API keys from third parties.

---

The rest of this article is encrypted with AES-256-GCM (PBKDF2, 100k iterations). For a blog post with gated-but-not-classified content, that's probably fine. Anyone determined enough to write a custom PBKDF2 cracker with a targeted wordlist for my blog¹ probably deserves to read the article. But if I wanted to harden it, a random password like kX9#mQ2vL7, like I have in my first encrypted article, would make the dictionary attack useless and force the 10¹⁵-year brute force path. Brute-forcing the key directly is virtually impossible: with 80,000 chained NVIDIA B200 GPUs (10,000 8-GPU NVLink nodes) it would take ~10⁵³ years. Even with a quadratic speedup via Grover's algorithm at a theoretical 10¹⁸ quantum ops/sec, you'd still need ~10¹³ years, assuming ~6,000+ logical qubits. We were at ~16 the last time I spoke with Chetan Nayak at the Bloomberg Quant (BBQ) Seminar on September 29, 2025, where he was the keynote speaker and told me Google was nowhere near Microsoft or PsiQuantum when it comes to quantum with successful defense implications.

¹ Some of my gated posts use word-based passwords.

---