Privacy & Security on Jamie Thingelstad

Sat, 26 Sep 2026 14:52:52 -0500

I used some of my Claude Cloud credits to put in place a truly secure pipeline for Elixir Collector. Starting at v3.0.0 all releases are signed using a private key that I manage and the entire pipeline is signed all the way to ingestion. It also got safety improvements in the auto-update process.

Amazon Spending

Tue, 20 Jan 2026 22:09:42 -0500

Peter Rukavina posted a graph of his Amazon spending and I couldn’t resist taking a look at my data. You can easily request this from Amazon in the “Privacy Center”. A quick pivot table later and I had this graph. I’m omitting the actual scale on purpose — the shape does enough to tell the story.

I’m not that clear on what happened in 2015 that drove a big jump that stayed that way. My family comments that I purchase a lot from Amazon and I thought they were overstating it, but maybe not.

Honestly I was truly surprised at the frequency and amounts.

Easy Way or the Hard Way

Thu, 18 Sep 2025 18:36:36 -0500

Government censorship the “easy way or the hard way”.

ABC, a television network owned by Disney, suspended Jimmy Kimmel’s late-night chat show indefinitely after the Federal Communications Commission’s chairman implied ABC’s broadcast licence was at risk. On Monday Mr Kimmel suggested that Charlie Kirk’s alleged killer was a MAGA sympathiser, sparking an outcry from conservatives. “We can do this the easy way or the hard way,” Brendan Carr, the head of the FCC, said on Wednesday. Critics fear that free expression over Kirk is being silenced by firings and threats. — The Economist, The US in Brief, September 18th 2025

ABC pulled Jimmy Kimmel’s talk show following comments the American comedian made about the murder of Charlie Kirk. Mr Kimmel said the “MAGA gang” was scoring political points over the shooting of the right-wing activist, and pretending the murderer was “anything other than one of them”. Mr Trump–who is increasingly targeting what he considers left-wing organisations–congratulated the Disney-owned network for its action. — The Economist, The World in Brief, September 18th 2025

Thu, 03 Jul 2025 17:07:08 -0500

I’ve supported the Electronic Frontier Foundation for over twenty years. I am excited to have this 35th anniversary coin, number 0061, as a keepsake. If only they did POAPs. 🤩

“Working to ensure that technology supports freedom, justice, and innovation for all people.”

Wed, 25 Jun 2025 06:49:38 -0500

Important ruling for AI model training, copyright, and fair use. This aligns with how I would think about it.

A federal judge in America ruled it was “fair use” for Anthropic, an AI lab, to train its chatbot on books without authors’ permission. Its storage of over 7m pirated books, however, was not. Last year three authors sued Anthropic for allegedly copying and storing pirated material without compensation; the judge said Anthropic will face a separate trial to determine the damages it owes. — Economist, World in Brief, June 25, 2025

Tue, 17 Jun 2025 20:52:12 -0500

While doing blog gardening today I saw a post I wrote 21 years ago about privacy issues. This is a topic I’ve been consistent on for a very long time it seems.

Telling Stories with Maps

Sun, 06 Apr 2025 08:15:35 -0500

These days we mostly interact with maps in a singular, digital manner. However, if you want to have a guaranteed way to get a conversation going in a group put a map in front of everyone and shortly the stories will start coming. “I remember when we were here and this thing happened.” A long time ago I was in Canada at a remote location fishing. Every evening over dinner the entire group would hover over the map of the area and share stories of the day. “This is where we caught this huge Northern.” “Over here is where the Walleye are in the morning.” “We took the boat down this stream and it was too shallow for the prop.” Maps can be an incredible way to tell stories.

Telling stories with maps is one of the things that I wish blogs did better. My blog has posts that I created from all over the place, but you wouldn’t know it to read it. You can see my archive of thousands of posts, but you cannot easily see the posts I created in Iceland, or various times I visited a specific state. How about the blog posts on a road trip that connect together to tell the story of the whole trip?

This desire to tell stories through maps is why I got really excited to see Micro Social add support for locations. Micro.blog has supported location data for posts since the very beginning. However, it has always felt like an afterthought created to allow people to import Foursquare activity. I’ve wished for years that the Micro.blog app would attach my location to all my posts. I get not everyone would want this, but it would seem to be an easy add for those that do. Now at least I can use Micro Social to do this.

Ultimately I wish that my blogging platform would allow me to use location like I use time stamps. The time stamp of a post is the when. The location is the where. The archive page shows posts by the when. There should be a map page that shows posts by the where. The same way I can create collections of photos, I would like collections of posts and then show a map of those collections. I can edit the time stamp of a post, I would like to edit the location of a post.

Even social platforms that do collect this information do this poorly. I suspect they mostly use location as another surveillance tool to target advertising as opposed to creating a new way to share things.

Full support of location data for posts would create a whole new way to tell stories and connect the writing on your blog together. I’ll keep wishing, but I know that if I could add and edit location data to posts I’d be doing that during gardening, and it would create an incredibly rich and vibrant way to tell more stories.

Sat, 11 Jan 2025 10:45:53 -0500

Little Snitch is a great app to protect your privacy. It is also incredible to use your computer for average stuff and see that you are connecting with systems all around the world. I’m even running 1Blocker in my browser which stops some things before they even get to the network layer!

Sun, 15 Dec 2024 22:13:10 -0500

Hey LinkedIn,

Do you remember in 2013 when you started routing emails through your proxy server without asking users about it?

I do.

Because of that you will never have an app on my device. You are only allowed in the web browser where it is safe.

Fri, 29 Nov 2024 09:06:44 -0500

I find this growing trend of sending a one-time code via email to login very annoying. Especially when companies make it the default. I’m good with 1Password.

Fri, 30 Aug 2024 22:49:29 -0500

I currently have 326 different Masked Email addresses set in Fastmail. It takes effort but is a powerful way to limit tracking and increase security. 🔒🥸

Mon, 03 Jun 2024 02:56:53 -0500

When we travel in Europe I’m always pleasantly surprised to see all the various privacy notices that websites are required to provide. I smile and press the appropriate button to reject all tracking. So easy.

Thu, 02 Nov 2023 20:38:16 -0500

Thirteen years ago today I added my 100th login to 1Password. It is amazing to me that I’ve been using 1Password for that long! I now have 937 logins and 303 other items across 8 vaults shared with 1Password for Families!

Sun, 01 Oct 2023 07:35:12 -0500

I received an email this morning from a service I have no recollection of informing me that their terms of service were updated. I have no idea what this service is. I looked in 1Password and have no entry record of it either, so it is very old. I don’t know the password on the account so I issue a password reset, just so I can then delete this account. It then requires me to provide a reason for cancellation. My reason is “This field should not be required.”

There should be a requirement similar to “1-click unsubscribe” but to delete your account.

Lost Wallet

Tue, 18 Jul 2023 02:02:09 -0500

Update: My wallet was recovered!

Yesterday morning I realized I had lost my wallet. The previous day we had finished our first hike and while waiting for the train in Ardez I gave Tyler some cash so that he could get small ice cream cups for the group from this self-serve stand. That was the last time I saw my wallet.

I realized I didn’t have it when walking to dinner that night, but assumed it was in the room and didn’t think much of it. The next morning I looked for it and started to worry when I didn’t find it right away. Where was it?

I traced my actions and remembered the ice cream. I also remembered that Tyler brought me change back and I put that in my wallet. But i didn’t. I found the change in my pants pocket.

So where did my wallet go? I suspect I set it down by the train station thinking I would put the change in it, then I didn’t. I also was rearranging my backpack at the same time.

Our guides did there best to try and find it. Dave actually took the train back to Ardez the next morning to look for it but no luck, and then hiked back to the group. The hotel called around as well, no luck. By the late afternoon after having looked everywhere multiple times I declared it lost.

I keep all my important numbers and info in 1Password and years ago read a suggestion to tag items with “Wallet” that are in your wallet. That paid off yesterday when I was able to confidently inventory all I needed to deal with.

Net it isn’t too big of a deal. Unfortunately I had a good bit of spending money in it and that is gone. But everything else is in the process of getting replaced now. And having everything on my phone gives a good backup.

Surveillance in URLs

Sun, 11 Jun 2023 07:50:21 -0500

The Uniform Resource Locator is the glue of the web. Mostly we don’t think about URLs unless you create content on the web. Some browsers have even started to “simplify” the URL display worried that people might get confused. Or are they hiding it on purpose? URLs are however, a place where you can be tracked and surveilled right in the open. There are a myriad of ways to make URLs completely unique so that you are the only person in the universe that has it and whoever created that link can specifically know that you, or someone you shared it with, clicked on it. They also know when, where, and on what device. Every time.

I don’t think that is acceptable.

I curate and collect URLs and am always on the lookout for tracking information in them. It is usually easy to spot and remove. I got really excited when I saw that iOS 17 automatically removes tracking parameters from links. Unfortunately the feature is far too limited. It is nice that it works in a variety of applications, including Mail. However it only removes the unique tracking, and doesn’t get rid of the rest of the surveillance. And it only activates in Safari Private Browsing mode.

This is what URL surveillance looks like from a link I recently received from a friend. The link itself was a slight 28 characters. The surveillance was 302 characters. Over 90% of the information in the URL was to surveil and track the users of the link. I’ve changed the specifics so this isn’t a valid link, but here is what it looks like split onto multiple lines for readability.

https://abcdefg.com/a/123456
?utm_source=Instagram_Stories
&utm_medium=ad_story_smartly
&utm_campaign=123456_msp
&ad_id=123456789012
&utm_term=987654321098765
&fbclid=PAAaZnG…5kyWFFJ

The person that sent me this got it from Instagram, apparently in an Instagram Story. They were advertised with a utm_campaign focusing on “msp”, our nearest airport code. The creepiest parameter is fbclid which specifically identifies the click event for this paid content and will track the specific link of humans that this goes through. Letting the originator know that my friend also shared it with other people, and all of their metadata too.

The good news is you can just delete everything after the ? and it works great. Which is the thing I do a lot. A truly privacy aligned feature for a browser would be to strip all URLs of all surveillance parameters. There is a corollary too. Browsers that hide URL parameters are assisting in the surveillance of users.

As a user, you can significantly improve your privacy and fight surveillance by being aware of the tracking parameters placed routinely in URLs and removing them. Remove it before you share it. Remove it before you create a bookmark. You often can just delete anything after the ?. Doing this helps your privacy, and helps protect the privacy of those you send links to.

Sat, 20 May 2023 14:50:36 -0500

Interesting technical solutions to identity and privacy in the “Web 5: Open to Build” session with Daniel Buchner at Bitcoin 2023.

Sat, 15 Apr 2023 09:09:38 -0500

I’ve been searching for a super simple way to sign strings of text with my Ethereum wallet and share that proof with anyone online and generally the options have been terrible. I had resigned myself to having to use PGP signatures. And then I found Signatorio which does exactly what I wanted! 👏

Thu, 23 Mar 2023 19:29:00 -0500

I’m digging these Women Cryptologists of World War II Stamps.

During World War II, some 11,000 women labored day and night, helping to process and decipher an endless stream of enemy military messages. Their work was by turns frustrating and exhilarating—and one of the conflict’s best-kept secrets. With this stamp, the U.S. Postal Service honors all of the women cryptologists of World War II, whose service played an inestimable role in the Allied victory.

Isolating Crypto Assets and Access

Sat, 04 Mar 2023 14:44:49 -0500

For the last couple of years I’ve done all of my Ethereum activities using my thingelstad.eth address with the associated identity. I’ve used this for storing value, holding NFTs, collecting POAPs, and everything else. I decided that it was time to create some isolation of access and identity.

I’m still using thingelstad.eth as my primary address and means of authenticating with various services. It also holds a number of my NFTs and crypto assets. But I’ve also now created two activity-specific addresses.

mint.thingelstad.eth is the address that I’m using specifically just to mint NFTs. When you mint NFTs you have to authenticate with a new smart contract and usually provide some form of limited access to your assets. By using a dedicated address just for minting I can limit the risk of a malicious smart contract.

vault.thingelstad.eth is the reverse of the minting address. This address is specifically to hold NFTs or other assets that I have no intent of selling or transferring. This address will never be used to authenticate to any website. All activities here will be done using wallet transfers.

Additionally, I decided to create some specific addresses for applications that I use a lot. This was inspired in part from Vitalik’s conclusion:

That said, it is my view that wallets should start moving toward a more natively multi-address model (eg. creating a new address for each application you interact with could be one option) for other privacy-related reasons as well.

I love the idea of wallets automatically associating a unique address with each application. I do this today by using a masked email addresses with Fastmail and passwords managed by 1Password.

ens.thingelstad.eth is the address I’m using to hold my Ethereum Name Service registrations. ENS has built in capability for one address to register a name, and the control of that name to be delegated. So all of my 21 registered ENS names are now owned by this address, and control of them is delegated to thingelstad.eth. The only app that will ever connect to this address is ENS itself, which protects my name registrations from malicious actors.

POAP.thingelstad.eth is an address I’ve made just for collecting POAP tokens. I currently hold 90 different POAP tokens in this address. This allows me to have a specific identity and address just for POAP usage. Most activity for this address is on Gnosis Chain since that is what POAP uses natively.

niftyink.thingelstad.eth is an address just for using Nifty Ink. I’ve collected 736 “inks” on this site and now I have them isolated into an address that I only use for that purpose. 🤩 This is again a way to limit access from a malicious smart contract.

Technically I also have reddit.thingelstad.eth but was created by necessity since Reddit Vaults are managed differently. However, it serves the same pattern as the other application specific addresses.

Fri, 24 Feb 2023 08:26:00 -0500

From The Economist, World in Brief, February 24 2023.

Sam Bankman-Fried, a former billionaire and founder of FTX, a collapsed crypto exchange, was charged with four new criminal offenses, including conspiracy to commit bank fraud and securities fraud. Prosecutors allege that Mr Bankman-Fried developed a “series of systems and schemes” through which he could “access and steal” billions of dollars of customer deposits. Mr Bankman-Fried has pled not guilty to all of the eight original charges against him.

Bankman-Fried was a criminal mastermind more than any crypto mastermind.

Polarizing Technology: Encryption and Crypto

Tue, 27 Dec 2022 11:13:39 -0500

The fury and vitriol towards crypto is strong. People use words like “hate” and you can feel the emotion in their voice. I’ve had friends suggest that I must hate the environment if I support crypto. Or even that they thought I was “too smart” for crypto. Many suggest that blockchains are “just a database”, but I’ve never seen people yelling at each other, dismissing opinions, and ultimately even losing friends because they liked a database!

This made me wonder, is this unique to crypto? What else in technology might be so polarizing and carry so much emotional energy with it?

Then I realized that crypto isn’t alone. Encryption has a similar polarizing affect. And as I explored that hypothesis, I clearly also saw that the entities that find these technologies threatening use very similar tactics to attack them.

Encryption

Ways to encrypt data have been around for as long as we’ve written things down. Famous hardware devices like the Enigma machine were key tools to successful war operations. Modern technology has made encryption more sophisticated and even more difficult to defeat.

In 1991 Phil Zimmerman wrote Pretty Good Privacy or PGP. PGP was the first widely available implementation of the incredibly secure public-key cryptography. After Zimmerman created PGP he shared the source code online, triggering the US Government to open an investigation into Zimmerman and PGP for potential violations of the Arms Export Control Act. For obvious reasons, the US Government doesn’t want encryption technology that it cannot defeat to be in the hands of other entities. Five years later the US Government dropped its investigation into Zimmerman with no indictment.

The early history of the Electronic Frontier Foundation also involved encryption. In 1995 they represented the defendant in Bernstein v. United States. Similar to Zimmerman, Bernstein wanted to publish the source code of his encryption software. After four years we had a landmark ruling that determined that software source code was speech, and is thus protected by the First Amendment.

It is worth noting that the Bernstein v. United States ruling was one of the cases referenced by Apple when it refused to hack the San Bernardino shooter’s iPhone.

Encryption is now used widely, and necessary to provide hundreds of secure services. Every modern phone has dozens of encryption routines in it, many that just operate in the background so that if someone stole your device, your private information would be protected.

But should private citizens be able to use encryption that is so secure that nobody else access it? Even law enforcement? Even the US Government? Even after 30 years public opinion on this is still not settled. It absolutely makes law enforcement harder when all communication between parties is encrypted, but it has immense benefit to the privacy of those individuals.

I firmly believe that we have a right to encrypt data in a way that no other entity can ever access it. The same way that I cannot be compelled to share a secret I have memorized, I have the right to have digital information that is completely secure and private to me.

However, there are many people who disagree completely. Many feel strongly that law enforcement particularly should have a backdoor to get into encrypted data. Many believe that Apple should have hacked those terrorist phones and retrieved information for the FBI. The government itself continues to fight for this with. In 1993 we had the Clipper Chip, but the battle continues.

Encryption itself challenges power. It allows normal people to do something that beforehand only governments or corporations could. The power to access secret information is a big one. Those that previously held that capability exclusively are not going to let it go easily. And that is why the FBI steps in to sue Apple when the time is right.

There are two wedges that are used to argue why encryption should not be allowed for regular individuals: terrorism and protecting children. Horrible topics to be sure, but they are the most effective at swaying public opinion against encryption. The next time an established entity with power makes a legal claim that encryption must have a backdoor, look for those two topics.

If we had a Digital Bill of Rights, I would include encryption as one of the first.

Crypto

Crypto, blockchain, cryptocurrencies — this technology has many similarities to encryption. First, let me clarify that while encryption and cryptography play a key role in crypto, it is a completely different solution and set of use cases. There could be no crypto without cryptography, but the application of crypto is not about protecting secrets.

Very similar to encryption though, crypto takes an activity that was previously the exclusive domain of powerful entities and makes it accessible to many. You could not have created a currency that could be trusted by millions without crypto. I can assert ownership of many digital assets without the benefit of any company or government entity, thanks to crypto.

Crypto allows individuals to store and exchange things of value completely on their own, common digital ownership.

The Bitcoin Whitepaper written in 2008, and then launched in 2009 was in many ways like Zimmerman’s publishing of PGP in 1991. The technology was furthered significantly when Ethereum launched in 2015, allowing completely new use cases to be created. Similar to encryption, in the crypto world we now have dozens of technology solutions and thousands of applications built on top of that. But the fundamental ethos is about storing and transferring value between people, directly without a company or government in the middle.

The efficiency benefits of blockchain are incredibly enticing, and like encryption it is possible for existing entities that control power to use these technologies internally to get benefit. The crypto version of a government backdoor is a US Digital Currency, run on a private and controlled blockchain.

Imagine if the FBI published an encryption tool. Would you use it?

Depending on when you start the clock with crypto we are between 7 and 14 years into the same kind of debate that we have been having with encryption. Should groups of people on their own be able to store and transfer value without any tools from the Government? Many smart, educated, and well-meaning people will have different views on this. It is important that a government can control their own currency. It is also important that a government have legal domain over certain forms of ownership. But personally I don’t believe those are blanket needs, and I see a great opportunity for technology to enable new capabilities here.

To fight off crypto there are two narratives that have developed. The first is that crypto supports fraud & crime. The second is environmental destruction. It is true that almost all Ransomware takes payment in Bitcoin, and the energy footprint of a proof-of-work blockchain is enormous. However, Bitcoin has also enabled people with no access to banking systems to store and transmit value. And while the energy footprint for Bitcoin is high, the gold industry certainly has a large energy footprint too. What amount of energy is acceptable for a digital reserve currency of the world to use?

***

This thought exercise was helpful for me to add some context and perspective to these two debates. I hadn’t previously connected the encryption debate that I’ve observed and supported for years with what I was seeing in crypto. Connecting them in this way draws a couple of conclusions:

Encryption has been an open debate for 30 years and is still unsettled. I suspect that crypto will have a similar path. I don’t think we will gain a consensus as a society soon.
Existing entities with power that is threatened by encryption and crypto will not give it up easily. Progress will be slow and begrudgingly.
Unfortunately these technologies do get used for nefarious activities. Terrorists do use encryption to protect terrible things, and bad actors do use Bitcoin to get payments.

What, Why, and How to Improve Your Security and Privacy

Mon, 26 Dec 2022 23:12:25 -0500

I thought I would share a few of the things that I personally do to improve my security and privacy online. I do all five of things I’ve included here and services I reference are ones I use, in many cases for several years. I’m not recommending anything that I don’t personally do.

What: Keep secrets safe.

Why: We all manage a lot of secrets. We have hundreds of passwords to various websites. You’re not using the same password all over the place right? We have a ton of other secrets too. Those random questions that some websites ask about where you were born or the name of your first pet? There are also more traditional secrets like banking information, or the combination to your safe. This stuff all needs to be kept accessible but very secure.

How: I use 1Password for all of my secret management. Specifically, I use 1Password for Families because it allows all four of us to have our own accounts, keep our own vaults, and share vaults between different family members as well. 1Password is a password manager, but it also manages any number of different secrets, including any random notes that you may want to keep in it’s encrypted database.

What: Use a unique email address per service.

Why: Whenever you create an account on a new service, you should create a brand new email address for that account. You know how people have been saying for years to never share passwords between websites? Well, you also shouldn’t share an email address. You see, if you sign up for dozens of websites using the same email address, those websites may share tracking information using your email address as a shared identifier! Gross right? Yeah. The way to defeat this is to make sure that the email address is unique for each service you use.

How: There are a number of ways to do this, and I’ve tried all of them.

Many services allow for “plus addressing”, so if your email address is foobar@proton.me, you can make it unique by putting a + in it with some characters. So, foobar+lyft@proton.me could be the address you give Lyft.

There are also email relayers just forward email to you through a random address. These can be hard to use because they are outside your usual email flow.

I’ve used Fastmail for years and they recently rolled out a Masked Email feature that is awesome. It is easy to create any number of addresses, I have hundreds of them. You can delete any of them at anytime to destroy an address, and fairly unique to Fastmail if you reply it will use your masked email address at the from address. They even supports custom domain names so all of my addresses are in the form of polar.bison4837@thingelstad.com. The nice thing about this is that I could still get these masked emails on another provider if I setup a Catch All address.

Creating unique email addresses is key to limiting tracking.

What: You need a content blocker in your browser.

Why: Imagine if you didn’t have a spam filter on your email for a second. Imagine every single email you ever got just landed in your inbox. That is what is happening if you surf the web without a content blocker. Actually though, it is worse. Because you aren’t just letting every email in, you are letting infinite numbers of little programs run on your computer from any number of different companies. Those programs are tracking you and collecting up all sorts of information about you. Dozens (or more!) of them on every website you visit. Yes, it is terrible. Running a content blocker is the key. Some will get caught in the ethics of running an ad blocker, but good content blockers can selectively block by category. So, if you feel ads should stay that is fine. You can still block the trackers.

How: I’ve used 1Blocker for this and think it is absolutely the best. It has a robust set of categories and definitions are updated regularly. I love that I can create my own custom rules as well. I have a set of rules that stop all activity to any Facebook property. My Internet doesn’t even have Facebook services on it. It is fabulous.

What: Your searches should not profile you.

Why: Google knows what you’re thinking. Searching is a particularly effective way to build a profile of a person. No company should get to hear all the questions that you have in your brain.

What: I love the idea of just paying for search, and have been using Neeva for a long time. I pay a small fee, and in turn they don’t profile and harvest my inner thoughts. That seems fair to me. If you absolutely can’t see to it to pay for something, at least switch your search engine to DuckDuckGo and stop using Google. DuckDuckGo is way better for privacy.

What: Get a feed reader!

Why: New content is published everywhere, and the best way to preserve your privacy is to have a service to get it for you. Instead of subscribing to a YouTube Channel in YouTube, you can have your Feed Reader watch it and show you. YouTube then doesn’t get that data. Or, want to follow a Twitter account but avoid being logged into Twitter, good feed readers can do that too. Your Feed Reader gets to be your armored agent, going into various services and pulling new content for you. No algorithms here either, as the content is just shown in time order. Brilliant!

What: Feedbin is my favorite service here and I’ve been a subscriber for years. I use it for RSS feeds, email newsletters, Twitter accounts, YouTube channels, Medium, Substack, and the list goes on and on. I don’t have to go to all those things, I just go to Feedbin. No social amplification, no algorithms, no ads. Just the stuff I subscribed to in exchange for a small fee.

Connected Device Disclosures for Rental Properties

Sun, 08 Aug 2021 07:24:56 -0500

We’ve been staying almost exclusively in Airbnb properties for a while now. We enjoy the unique accommodations and the ability to stay in locations that are not served by traditional hotels.

As connected smart home devices like cameras and sensors get more popular it is common to find them in rental properties. I understand why owners want to have connected devices. It almost certainly helps them manage the property. We have some cameras at our cabin so I can keep tabs on the property when we are not there.

Given the frequent appearance of connected devices I’d like to see properties disclose what is in use and why. The disclosure could list:

Device type: camera, thermostat, speaker, sensor.
Manufacturer: who makes the device.
Model: what is the specific device.
Location: where in the property is the device located.
Access: list every entity (person, management company, service provider) that has access to the device and what they can do remotely.

A disclosure would help give peace of mind to the people staying in the property while still providing the benefits to the owner. It would help answer questions when you see a device that is clearly online and is unclear what it is there for.

Tue, 11 May 2021 16:19:00 -0500

I love the #TeamSPS Cyberweek 2020 Shirt, and for the first time a paired challenge coin! 🪙 The challenge coin was also minted as an NFT. We also included the themed deck of playing cards. ♠️ Thank you to Kat Alberts for the great design.

Wed, 16 Dec 2020 18:44:02 -0500

Facebook’s opposition to Apple’s privacy enhancements on their platform is a strong positive signal. The fact they are so worried about it validates that these actions must be meaningful in the fight against surveillance.

Sun, 01 Nov 2020 23:13:56 -0500

Celebrating the Electronic Frontier Foundation’s 30th Anniversary by converting from an annual to a monthly supporter. Join me and donate today!

Government Websites Should be Surveillance Free

Mon, 05 Oct 2020 21:48:05 -0500

Excuse me while I vent for a moment. Today I tried to visit the State of Minnesota COVID-19 resource page. I wanted to see what the State of Minnesota had shared recently. However, when I visited the page it was blank. Just a white page.

I run multiple layers of software to block surveillance software on the web. It amazes me that this software blocks about 30% of all requests that my browser attempts to make, and by and large websites I visit are unaffected. Just think about that for a second. 30% of all web activity that my browser goes to offers no value to me, but is instead surveilling me for various other activities.

Back to the State of Minnesota though, unfortunately their site breaks entirely if you block this surveillance. I tested it and if I paused blocking it worked, enabled blocking and it was a blank white screen again.

This burns me up because this is my government resource that I want to access, and I do not think that my government should force me to be surveilled by private companies in order to access resources I want as a citizen of my state. I feel the same way when government services are only available via social networks. There should be no circumstance where I should have to submit to surveillance in order to get access to government information.

So, what is all this amazing stuff that the State of Minnesota wants to watch me with? Let’s take a look.

First, we have Google Tag Manager which is Google’s bundled thing to put nearly anything into a website. Google is all over the web and follows us nearly everywhere I go. I especially dislike the idea of Google seeing what resources I’m looking at from government services. That could lead to some terrible profiling activities. Plus, Google has nothing to do with Minnesota and I don’t see why I need to send my data to a company in California to get information from Minnesota.

Registrant Organization: Google LLC
Registrant State/Province: CA
Registrant Country: US

Next we have SiteImprove! Now we aren’t just getting another state involved but an entire separate country. It turns out that a company in Denmark is also needed to get me my COVID-19 information from Minnesota.

Registrant Organization: Siteimprove AS
Registrant State/Province: 
Registrant Country: DK

Okay, deep breaths. Now we add cdn.perfdrive.com, which I’ve never heard of. They don’t seem to have an easily available website. Their domain registration is hidden behind a legal proxy, so I have no means to identify who this company is that is getting my data.

Then we have something called btstatic.com. The domain’s whois information shows some entity in Chicago, IL but then an administrative contact in the United Kingdom. With Denmark already in the mix we have a full global action here for me to talk to my State Government.

Registrant Organisation: Signal Digital, Inc.
Registrant Street: 222 N. LaSalle St.
Registrant Street: Suite 1600
Registrant City: Chicago
Registrant State/Province: IL
Registrant Postal Code: 60601
Registrant Country: US

Admin Organisation: Safenames Ltd
Admin Street: Safenames House, Sunrise Parkway
Admin Street: Linford Wood
Admin City: Milton Keynes
Admin State/Province: Bucks
Admin Postal Code: MK14 6LS
Admin Country: UK

Rounding out the fun we also have two additional California companies that are getting my data too. Apparently we are optimizing via optimizely.com and amplifying via amplitude.com! Ugh.

Registrant Organization: Optimizely
Registrant State/Province: California
Registrant Country: US

Admin Organization: Amplitude
Admin State/Province: CA
Admin Country: US

So to recap, in order for me to get COVID-19 information from the State of Minnesota I need to give my data to three companies in California, one in Denmark, one in Chicago or the UK, and a final one that I have no legal way of identifying.

It should be a requirement that government resources on the web are available without surveillance. Citizens should not be forced to send there data all over the globe to get something that is essential to the services expected.

Sun, 27 Sep 2020 08:38:07 -0500

Amazon’s marketing strategy with Ring seems to be:

Make you worry about something you weren’t worried about yesterday.
Sell you a product to try and counteract that worry they created for you.
Try to distract you with technology that seems from the future.
Give lip service to privacy concerns.
Create a large volume of data to sell you more things.

Refusing to Amplify is not Censorship

Wed, 03 Jun 2020 17:20:34 -0500

Recently Twitter made the decision to tag some of President Trump’s tweets as incorrect and limit distribution of them. Facebook decided the same content was fine. I’m going to skip over the actual decision here for a moment, and address the matter of calling this censorship. These platforms are not censoring, they are deciding to not amplify, and there is a big difference.

YouTube, Facebook, and Twitter are all for-profit public companies. They have as much obligation to carry your message as the Mall of America has to allow you to protest inside of it, which is none. Their Terms of Service are controlled by them and they can do whatever they want, including change their Terms of Service. But these companies are not the only ways to publish content on the Internet. Their refusal to do anything with your content is not censorship!

You have every right to create your own website, and put those messages on it. The Internet is wide open for that, and it costs very little to nothing. There is nothing keeping those millions of people on Facebook from getting your message on your site. It’s just laziness on all sides to want to put it all through these platforms. To be spoon fed and manipulated by algorithmic newsfeeds. But that laziness comes with a tradeoff of control. You cannot, and should not, expect to control that message. Probably the control of your message will drive with whatever makes the most money for the platform. It is absolutely not driven by importance, or truth, or value.

Many social platforms have tried to position themselves as “the commons” and talk about things like Freedom of Speech. This is all a bunch of nonsense, and frankly it has tied them in knots that make no sense for private companies to solve. If you want to get your message out, own your site, publish it. It has never been easier to do that. Need an audience? Earn it. Build it.

Nobody, not you, me, or anyone else have a right to amplification, and none of us is being censored.

Sat, 16 May 2020 17:42:09 -0500

This graph of DNS requests by client at our cabin is a good example of how metadata and privacy interact. When did we get there? How many people were there? All reasonable things that you could derive from this metadata.

Sat, 11 Apr 2020 18:58:03 -0500

I liked the privacy and security benefits of having a Pi-Hole at home so much that I decided to put one in the cabin too. Next up cable management. 😁

Sun, 05 Apr 2020 21:06:18 -0500

I find it interesting that my Pi-hole blocks 10-20% of DNS requests made when nobody is home. Average of 200 DNS requests every 10 mins when nobody is home, and 20-40 of those are some form of tracking. 😠

Thu, 05 Mar 2020 23:24:02 -0500

The top blocked domain that my Pi-Hole is protecting me from every day is api.segment.io. That isn’t a web browser thing that 1Blocker could even block. It is API calls embedded, I suspect, in iOS Apps. I love having multiple layers of surveillance blocking!

Sun, 22 Sep 2019 15:56:49 -0500

iOS 13 prompts for requesting location data are really good. This feels like you know what is really being shared.

Fri, 13 Sep 2019 15:02:17 -0500

Started getting a crazy number of robocalls. 😤 Found that Nomorobo had become deactivated! Fixed, now better.

Thu, 22 Aug 2019 22:54:02 -0500

LinkedIn is now prompting you to identify your teammates, and then asks you specifically to reflect your current and past reporting relationships. Isn’t this just a way to mine org chart data from companies?

Wed, 23 Jan 2019 20:44:24 -0500

Ordered End of Trust, McSweeney’s Issue 54 done in collaboration with the EFF! 💜

Using API Credentials in Shortcuts

Tue, 22 Jan 2019 00:00:00 -0500

Shortcuts on iOS can do incredibly powerful things, and with a little bit of extra magic you can connect to most API’s as well. Pulling data from API’s, manipulating it, and extending your shortcuts is really powerful. However, you need to have a good way to manage the authentication tokens and secrets for those APIs.

Most Shortcuts I have seen use a Text variable and put the token in that variable. It’s then used throughout the Shortcut. This works, but it exposes problems if you share that Shortcut. It also has issues if you use the same API in multiple Shortcuts. You are now copying that token in numerous places.

Another approach that I prefer is to create Shortcuts that do nothing but return those tokens. You can then call those Shortcuts from another Shortcut to get the token. I prefix these Shortcuts with the prefix “Secret”.

Then when I need to use an token for an API I call the Shortcut and then reference the magic variable returned from it. You can even hide the execution of that second Shortcut.

In addition to reuse, you also get other benefits from this approach. Your Secret Shortcut can have some logic. For example, I access Working Copy from Shortcuts and it does so with a local URL call, protected with a random key. That key is specific to each iOS device. So, rather than try to synchronize the keys I have the Secret shortcut return whatever key is right for the device that is running.

I do a similar thing with MailChimp’s API token that requires some encoding be applied to it.

I find this a better way to manage these secret tokens, get reuse, and make it easier to change them. 👍

This post is part of the Shortcuts Collection.

Wed, 16 Jan 2019 22:35:42 -0500

“You’re one of 772,904,991 people pwned in the Collection #1 data breach.” That is a shockingly large amount of credentials compromised. Good blog post describing it. Very happy I use unique, random passwords with 1Password!

Thu, 03 May 2018 20:03:59 -0500

When Twitter updates Terms of Service I get notices for multiple accounts that I deactivated/deleted a long time ago. Do others get this? Shouldn’t the accounts be deleted and no notice given?

Thu, 19 Apr 2018 21:15:36 -0500

Just preordered 1Blocker X. I rely on 1Blocker to keep me protected on the web. I use it on all my devices.

Identify Addictive Application Patterns

Sun, 04 Feb 2018 19:42:00 -0500

As our environment gets more complex we need to be better educated to navigate it. For example, I think that people would be more protective of their privacy, if they learned all the ways the data is used to manipulate them. I have been considering lately that we need to better identify other patterns that are intentionally used to create addictive behavior in applications and websites. Knowing these patterns may allow us to understand certain features for what they are and avoid them.

Pull to Refresh

Bucket this in with any refresh mechanism that gives you that rewards when there is occasionally something new to see. Open your email and pull to refresh? Is there anything new? It is reward seeking behavior. It is well established that having a random award (new email!) appear after an action is an addictive pattern.

Infinite Scroll

This pattern ties into our desire to “finish” a set of activities. When we have read through all of the items, we get that reward of completion. Infinite scroll tricks us into reading more and more, waiting to get to the end. Eventually we realize that we will never get to the end and have to give up. Instead of the reward of being done, we have the shame of giving up.

Feedback Loops

These come in two flavors, public and private. How many likes did that post get? That is a direct feedback loop to reinforce some pattern of desired behavior. This is an obvious one to see and is present in all social feedback loops.

There is also Analytics as Addiction. Exposing the activity based on your content is on the surface a good intent to inform you on how effective your content is to some goal, whatever that may be. But it also reinforces a desire to check repeatedly and insidiously alter behavior to steer to more engagement.

I have also noted that some of these patterns show up in other places that I don’t think of as intentionally addictive. They become user paradigms that people adopt as best practices. Pull to refresh for example appears in nearly all email clients. There is no commercial benefit to us getting a reward for obsessively checking our email, but its presence can encourage it.

Fri, 12 Jan 2018 14:28:32 -0500

I continue to see more people covering the camera in their laptops. How come nobody covers the forward facing camera on their mobile phone?

Tue, 12 Dec 2017 20:59:48 -0500

Proud member of the EFF! Donate now!

Removed Google Analytics

Tue, 05 Dec 2017 21:45:45 -0500

I’ve never desired to put a lot of tracking code on my websites, but I had left Google Analytics. I’ve decided to remove that too. In fact, I’ve removed all third party resources. You can check for yourself by using Ghostery and going to my sites.

While I found the information on what you all read and look at interesting, there are three primary reasons I’ve done this.

Analytics as Addiction

I believe there is a clear trend to use analytics as an addicting feature. How many views, likes or comments something receives is a psychologically affirming tool that services use to addict us to them. Is there any social media platform that doesn’t use these feedback loops to encourage you to spend even more time using them?

If your goal is to addict a user then, by all means, use every means possible to create feedback loops. If your goal is to drive attention and engagement on content, then show writers analytics so they can optimize that. I don’t have these goals for my sites, so I don’t need it. I’m needlessly toying with an addictive substance that I don’t need.

Residential Zone

I’m a firm believer that we need a concept of zoning on the web. When I’m in someone’s house, I have a different expectation of privacy than when I’m in a shopping mall. When I’m in a park, I have different expectations of safety and freedom than when I’m in an industrial facility. We should be able to cue our expectations around privacy and freedoms off of our surroundings. On the web this is confusing. Facebook is a shopping mall, but it pretends not to be.

Visiting my websites should be closer to visiting me, personally. If you are having dinner at my house and comment on my espresso machine, I don’t send a note to a tracking service to let them know you might be interested in buying a coffee machine. I don’t think that should happen on my website either.

Don’t be a Hypocrite

I run 1Blocker and Ghostery in my browsers to protect my privacy. In those tools, I block hundreds, and perhaps thousands, of 3rd party services and scripts. I think you should do the same. It is hypocritical for me to embed a tracking service on my sites, that I block on other people websites, and encourage people to block themselves.

Mon, 04 Dec 2017 21:54:31 -0500

Eero Plus subscription with security and ad blocking, and now Encrypt.me and 1Password for Families partnerships is a pretty good deal. I’m in! 👍

Wed, 29 Nov 2017 22:12:37 -0500

You can import and export 1Blocker packages. I put my custom packages on GitHub so I can version them and share with others. 👍

Wed, 29 Nov 2017 20:40:33 -0500

I wish 1Blocker had a built in system for sharing and subscribing to custom packages made by other users. Similar to Workflow and TextExpander. I know there would be packages I would want to subscribe and share.

Sat, 07 Oct 2017 07:18:34 -0500

Recommend registering your email at Have I Been Pwned. Great awareness tool of data breaches!

Sat, 05 Aug 2017 19:19:24 -0500

Figured out how to digitally sign git commits. Cool capability. See verified label on 85ce711.

Fri, 21 Jul 2017 22:34:49 -0500

I’m trying out the eero plus security service and got my first weekly report. Says it blocked 48 malware and 5 spyware connections. Hmm…

Tue, 04 Jul 2017 23:49:00 -0500

If you’re looking for a solid content blocker for Safari I’m liking Better for iOS and Better for macOS

Thu, 18 May 2017 20:52:17 -0500

Why is it that when Twitter updates their Privacy Policy I get email notices for Twitter accounts that I supposedly deleted years ago. Were these accounts actually deleted? 😕

Mon, 08 May 2017 21:46:07 -0500

GoFCCYourself.com ← Go and express your support for strong net neutrality. Use this link and click on “express” link.

Fri, 28 Apr 2017 21:19:29 -0500

Built in support for Creative Commons licenses versus Copyright notice on micro.blog templates would be nice and would seem very much in the spirit of IndieWeb.

Sat, 07 Jan 2017 07:25:34 -0500

Let’s Encrypt 2016 In Review. This may be the most important thing that happened on the Internet in 2016. Massive enabler of security.

Tue, 22 Nov 2016 21:24:00 -0500

Facebook Said to Create Censorship Tool to Get Back Into China ← Continue to feel great about leaving Facebook

Sat, 29 Oct 2016 23:07:48 -0500

Feeling like I need to invest in learning and using Little Snitch.

Wed, 12 Oct 2016 10:41:17 -0500

Seems crazy that in 2016 we are still dealing with security issues from Word and Excel VBA macros.

Wed, 05 Oct 2016 06:50:49 -0500

Didn’t use my Yahoo! account for anything but deleted it if only to protest this.

Use @Yahoo? They secretly scanned everything you ever wrote, far beyond what law requires. Close your account today. https://t.co/dJrJUyyxk6
— Edward Snowden (@Snowden) October 4, 2016

Fri, 09 Sep 2016 07:04:26 -0500

Bad behavior from Dropbox. I’m also seeing HipChat has gotten a similar privilege somehow.

How Dropbox hacks your Mac (by faking what looks like an OS X authentication dialog): https://t.co/FsY6ZEYfxL pic.twitter.com/ZdHMO2HXSB
— John Arundel (@bitfield) September 9, 2016

Thu, 04 Aug 2016 21:07:39 -0500

Encryption Update ← Really glad Day One is working on encryption for journals! Very needed!

Mon, 01 Aug 2016 20:17:00 -0500

Very happy to see Omni Group adding full encryption to OmniFocus! Upgraded all my installs and am now encrypted!

With version 2.15 for iOS and 2.6 for Mac (both out today), OmniFocus supports end-to-end encryption: https://t.co/eXW3T8mbHh
— OmniFocus (@OmniFocus) August 1, 2016

Autosave for /add actions will be a really nice win for Workflow automations! Thanks OmniFocus and Ken Case!

Beyond end-to-end encryption, @OmniFocus 2.15 also adds iOS backups, an autosave option for /add URLs, and more: https://t.co/1Dd7475ikZ
— Ken Case (@kcase) August 1, 2016

Thu, 19 May 2016 08:34:18 -0500

I told our security team that when we got our ISO certification I would wallpaper my office with it. They took the opportunity to do it for me. How awesome! #TeamSPS

Deleting Old Tweets with TweetDelete

Sat, 30 Apr 2016 00:00:00 -0500

I’ve been a long-time user of Twitter (user #82,903 joining in December 2006) and while I’ve had ups and downs with the service and generally think of it as a guilty pleasure I continue to use it. However, I have always thought of Twitter as ephemeral. Tweets to me are very different than blog posts. They often do not stand on their own but are really meant to be understood in the context of the moment.

Many years ago, before the Twitter API introduced OAuth requirements I used to run a script on one of my machines that would delete tweets after a while. This became annoying to manage after the API changed and I stopped running it.

Now there is TweetDelete! I found this service via another user and it does exactly what my script used to. You authenticate the service, tell it how long you want your tweets to live, and then they delete them after that period of time. I set 90 days for mine. TweetDelete is free and is a service from Memset. I did check the TweetDelete privacy policy and terms of service and was pleased to find this clarification in the terms:

We never store any of your tweets on our servers, we only delete them on your behalf.

How terrible would it be if a service like this actually archived the tweets and then sold it for advertising purposes to 3rd parties. Terrible, and in the modern Internet it would be completely unsurprising so I was glad to see this stated clearly in their very human readable terms of service.

But what about archiving? While I do view my Tweets as ephemeral I do keep them for myself. I see little to no value for others in what I tweeted 10 years ago, but I do like to have a diary like record for myself. That is where Pinboard comes in! Pinboard has always had a feature that archives the tweets of up to 3 accounts and I’ve had that on for several years so I still have a personal archive of everything which I like. By the way, it’s an archive I pay for and know isn’t shared with others. I love the ethos of Pinboard!

I would encourage you to ask if there is a reason you want your old tweets around and if not have Tweet Delete take care of it for you. Think of it as helping poor Twitter not have to keep so much data around.

Tue, 12 Apr 2016 15:36:25 -0500

A CAPTCHA on an email newsletter unsubscribe page? Is that CAN-SPAM compliant? That’s a new low IAB.

Sun, 03 Apr 2016 20:43:00 -0500

Super happy to see 1Password for Families real now and able to start paying for it. Great product for a real need.

Sun, 13 Mar 2016 17:09:38 -0500

Life after death: How will you handle your digital legacy? ← Not enough for Facebook to monetize your life, why not death too?

Sun, 17 Jan 2016 23:07:31 -0500

Had a fraudulent charge show up on credit card. Bank is reissuing cards. Happy they caught it, but sure is annoying.

Sat, 19 Dec 2015 21:50:43 -0500

Not enough being said about streaming music services bringing DRM back to an ecosystem we only recently rid of that plague.

Sat, 19 Dec 2015 00:22:43 -0500

Read paragraph 2 of this security notice. Considering what we know from Edward Snowden, you wonder who may have put this backdoor in.

Thu, 19 Nov 2015 21:54:40 -0500

Glad to see Amazon has finally implemented two-factor authentication. Do yourself a favor and set this up.

Wed, 18 Nov 2015 00:26:00 -0500

Going to setup a family account on 1Password for Teams also to share secrets amongst Tammy and I, and soon kids.

Part of win with 1Password for Teams is to rid myself of the janky sync setup with Dropbox or iCloud. Neither give confidence.

Wed, 18 Nov 2015 00:25:00 -0500

Got Minnestar setup on 1Password for Teams. Moved a bunch of secrets in. Worked great. Like how well it integrates with app.

Sun, 25 Oct 2015 16:55:00 -0500

This should not surprise anyone. Do yourself a favor and delete your Facebook profile.

Mon, 12 Oct 2015 19:55:50 -0500

You can reach me using Signal, get it now.

Sun, 04 Oct 2015 21:03:57 -0500

Just ordered a Yubikey Neo so I can try Universal 2nd Factor and other features.

Mon, 28 Sep 2015 22:30:00 -0500

Neat new Keybase Key Model on the way. Curious to see what this enables!

Namecheap Leaks Password in Security Notification

Sun, 27 Sep 2015 00:00:00 -0500

Please make sure to see UPDATE section at end of this post.

This isn’t good at all. I have security notification alerts enabled in Namecheap because I want to know when something is changed related to my domains, just to make sure I’m always the one that initiated it. Today I changed my password and got this:

Notification For     : PASSWORD
Date                 : 9/27/2015 4:15:28 PM  
IP Address           : 66.41.226.251
Username             : my-username
Domain (if relevant) : N/A

Old Details
-----------
my-old-password-in-plaintext

New Details
-----------
my-new-password-in-plaintext

Additional Information
----------------------
N/A

I’ve replaced the passwords that were in the email because they were my passwords, sent in plaintext, in email. This is pretty much terrible.

Of course email isn’t encrypted so now anyone that has sniffed that email knows my password, and my username is handily referenced as well (I changed it as well in this copy).
This is evidence that Namecheap is storing my password in plaintext somewhere. They should only be storing the hash of it using something smart to protect it. Double bad!

The only good news is I have the optional two-factor authentication enabled that uses an SMS message to my phone so I at least have that to fall back on but this is a terrible security practice that I’m shocked Namecheap is doing.

Please fix this immediately!

PS: After fixing this, can we get a real two-factor solution instead of SMS?

UPDATE (Sept 28)

Within minutes of sharing this post on Twitter I got a [response from @Namecheap](https://twitter.com/Namecheap/status/648344264724770816), and 17 minutes after that they confirmed that they fixed this.

Given how fast they fixed it I have to assume that what they fixed was issue #1, that they are suppressing the email notification for “PASSWORD” events. That is good and will keep the password from leaking into email, however I would really like to know if they are storing passwords in plaintext somewhere. It should be impossible for a service to tell you what your password is, they should only know some form of a hash derived from your password.

Sat, 26 Sep 2015 22:58:05 -0500

If you block web activity when you surf, make sure none of the sites you personally run track your users. Don’t practice asymmetric privacy.

Sat, 26 Sep 2015 22:22:53 -0500

Using Tunnel Bear along with Block Bear is a super easy way to get a very protected web experience on iOS.

Tue, 11 Aug 2015 21:13:53 -0500

Wish the new EFF tool Privacy Badger supported Safari!

Thu, 16 Jul 2015 22:41:48 -0500

I gave to EFF because they fight for the users. Join me in celebrating their 25th anniversary!

Fri, 26 Jun 2015 06:51:44 -0500

Had no idea there was a service as polished as Tunnel Bear for VPN and privacy services! Thanks MacSparky for sharing!

Thu, 28 May 2015 18:04:00 -0500

Moved my two-factor authentication setups from Authy to 1Password. Like Authy, but nice to have everything together in 1Password.

Wed, 13 May 2015 20:14:00 -0500

Got my ProtonMail account invite. Cool to see how they are bringing encryption to email in a better way.

Thu, 16 Apr 2015 12:52:00 -0500

GitHub’s 2014 Transparency Report ← Glad more companies are starting to share this information.

Mon, 06 Apr 2015 12:24:19 -0500

Messages on OS X started requiring an App Specific password for Apple ID’s that have 2-Factor Authentication enabled? Others see this too?

Sun, 21 Dec 2014 08:56:23 -0500

Happy to see Dollar a Day pick EFF today! Have been an EFF member for many years.

Fri, 19 Dec 2014 23:30:00 -0500

Really like how sslmate does certificates, but I sort of want to get wait for Let’s Encrypt to get going!

Mon, 15 Dec 2014 20:28:52 -0500

Just typed a 40 character random password on my Kindle. That was horrible.

Sat, 13 Dec 2014 19:41:00 -0500

Waiting for PayPal security code to arrive via SMS wishing there was support for proper 2-factor auth.

Fri, 28 Nov 2014 19:35:26 -0500

Took a trip through my spam folder for first time in forever. Seems things have gotten a bit aggressive in Bayes land.

Twitter Spam #NFL

Fri, 28 Nov 2014 01:00:00 -0500

If you have a Twitter account, or have many like I do I’m guessing you got this email from Twitter. I sure hope the NFL paid them a pretty penny to annoy all their users.

I really have 13 Twitter accounts? Well, not really. @VeloTweets, @thinglesBot, @SenateTweets and @Wikinosh are accounts I’ve deleted. Odd Twitter, why do you send email to deleted accounts?
I’ve now unsubscribed 13 accounts from this type of message, which I think I did already, but maybe “#NFL promotions” is a new type of message I have to unsubscribe from?
Couldn’t Twitter at least have done some looking at my feed and realized I don’t follow anything football, never tweet about football or show any interest in this?

Supporting the Open Internet

Sat, 22 Nov 2014 01:00:00 -0500

“It’s only an illusion that the Internet appears to be open…” — Dave Winer

As we approach the end-of-the-year many of us start thinking about charitable donations. There are many, many great causes out there that deserve our support. I think it is critical that we consider supporting the digital future that we want as part of our giving. There is nothing fundamental about the Internet that insures free and open speech will occur. In fact, the Internet if left to the wrong interests can be the most monitored, tracked and near totalitarian environment we have ever seen. If you are curious to read more on this, I highly recommend The Master Switch by Tim Wu. Great book.

We know that the Internet will continue to be a growing part of our lives. There are organizations that are working hard to make sure the Internet is the kind of place I want in my life. If the Internet is just Facebook tracking cookies and advertisements like a mall, we have failed. Supporting these organizations is one way to help this cause!

Electronic Frontier Foundation

The EFF was founded in 1990 and has been the champion of digital rights since. In many ways I think of the EFF as the “ACLU of the Internet”. They have both a legal and advocacy organization. They are pushing for the expansion of encryption technology online. They support causes like open and free access to WiFi networks. They continue to help Tor.

Donate here! Wikipedia’s EFF page is a great background.

Creative Commons

Creative Commons is all about creating a copyright framework that allows for the sharing of content in a way that content creators want. My blog is creative commons licensed making it easy for people to remix and share the content here. Larry Lessig is the founder of creative commons and he does a better job than I ever could explaining why Creative Commons, and the commons as a whole, is critical to our culture. You should watch his TED talk on Laws that Choke Creativity.

Donate here! Wikipedia’s page on Creative Commons is a great background.

Wikipedia

I often suggest that Wikipedia is the most amazing thing to be born of the Internet. It could never exist in any other way. The depth and quality of content is amazing, but the ethos of it is even more amazing. Wikipedia is run by the Wikimedia Foundation which runs hundreds of other wikis as well. They also open source all of the software behind Wikipedia called MediaWiki. MediaWiki is used by tens of thousands of sites on the Internet to host new and interesting content, including the software that organizations as provocative as WikiLeaks use. (My project WikiApiary tracks a large percentage of all MediaWiki sites in the world!)

Donate here! Not surprisingly, Wikipedia’s own page on Wikipedia is a great background.

Internet Archive

The Internet Archive has been working to archive a growing part of the Internet over time. It is the place where the history of the Internet is being recorded. It is also the place where you can find a huge amount of media that is no longer in copyright. The goal of the Internet Archive I think is often something that we forget about in the digital world. We think that the Internet is permanent, but it’s only as permanent as we make it. The Internet Archive gives me hope that hundreds of years from now people will still be able to read the blog post you are reading right now.

Donate here! The Wikipedia page on Internet Archive is a great background.

As an aside, we spend so much time focusing on the billionaires of the Internet behind services like Facebook and Twitter. Think of these names: Larry Lessig, John Gilmore, John Perry Barlow, Mitch Kapor, Richard Stallman, Brewster Kahle, Jimmy Wales and Larry Sanger. These people deserve as much space in our minds.

Tue, 18 Nov 2014 22:40:00 -0500

Very excited by the announcement of Let’s Encrypt! We’ve needed this for a long time!

Question2Answer Number Captcha

Sun, 16 Nov 2014 01:00:00 -0500

I’ve been using Question2Answer for a number of years now to power Ask Planet Kubb. I like Question2Answer because it is simple to run, uses a standard PHP + MySQL setup and can even be used in a multi-site farm configuration easy enough. However, I’ve been frustrated by it’s ability to manage spam registrations.

Question2Answer has built in support for ReCaptcha and it has a plugin method to use other anti-spam measures. I’ve used ReCaptcha for a while, but it results in 4 to 10 spam registrations a day. I tried switching to the Q2A Logical Captcha by amiyasahu which uses Text Captcha. I even submitted a pull request to properly salt the captchas. But this resulted in 3-4 times the spam registrations as ReCaptcha! Ouch!

I decided to apply the same type of spam defense I’ve successfully used for MediaWiki and early results are great. It uses the Numbers_Words PHP package to spell out a number of nine digits and then ask the user to identify the number in a specific position. The question looks like this:

This works really well. You can grab q2a-number-captcha and git clone it for your own use.

AWS re:Invent - Day 1

Wed, 12 Nov 2014 19:02:00 -0500

Seated for AWS re:Invent keynote!

Andy Jassy “Cloud has become the new normal.” True for many!

“shower cycles”? New term to me.

Amazon Aurora looks compelling.

Impressed by first day keynote and all the work going on!

At the re:Invent Security Keynote. AWS capabilities for security has radically changed and improved in recent years. AWS has 5 to 7 thousand instances running continual security tests against internal systems constantly.

Lunch for 9,500.

You will not miss Michael Ducy. Very sparkly!

Nice demo of Datadog.

Attending impressive session on Key Management in AWS with Amy Patton. Wishing Milinda Rambel Stone, our security leader for #TeamSPS, was here too!

Sat, 01 Nov 2014 07:48:00 -0500

All my accounts are locked down! Authentication via Authy.
PayPal doesn’t support real 2-factor authentication (uses SMS) and can’t deal with passwords over 20 characters?
Trying new thing doing weekly security audit with 1Password. Good process, just do five logins a week.

Updated Dynamic Questy Captchas

Tue, 28 Oct 2014 00:00:00 -0500

A little over a year ago I shared a method of generating dynamic Questy Captchas for the MediaWiki ConfirmEdit extension. This method has been awesome for stopping registration spam on the thingelstad.com wiki farm and many other wiki admins have used it with success. Unfortunately it was more useful in it’s novelty than in it’s difficult to solve, and eventually some spammers wrote the logic to solve it and the registration spam started flooding in.

I decided to put a new method in place that is based on the same question. The previous question generated 8 characters and asked the user to provide one of them based on a random index. I’ve now changed this to generating a number between 100,000,000 and 999,999,999, turning that into spelled out words and then asking to identify one digit. It looks like this:

What is the sixth digit of the number nine hundred fifty-one million eight hundred ninety-eight thousand four hundred twenty-seven?

That turns out to be a somewhat hard question for a human too. I find I typically have to type out the number as I read it. The benefit of this is the solution isn’t in the text of the page. And while I’m sure there are great libraries for turning written numbers back to digits, it’s not immediately obvious.

Implementation

I had no interest in implementing my own code to convert a number into words, and happily there is a PHP package called Numbers_Words that does just that. The URL and install information are in the comments right before the require line. Everything else is pretty simple stuff.

To implement this I used the same technique I did previously. Here is what this looks like in LocalSettings.php.

# Let's stop MediaWiki registration spam
require_once( "$IP/extensions/ConfirmEdit/ConfirmEdit.php" );
require_once("$IP/extensions/ConfirmEdit/QuestyCaptcha.php");
$wgCaptchaClass = 'QuestyCaptcha';

# Set number question for questy
# sudo pear install channel://pear.php.net/Numbers_Words-0.16.2
# http://pear.php.net/package-info.php?package=Numbers_Words 
require_once("Numbers/Words.php");

$myChallengeNumber = rand(0, 899999999) + 100000000;
$myChallengeString = (string)$myChallengeNumber;
$myChallengeStringLong = Numbers_Words::toWords($myChallengeNumber);
$myChallengeIndex = rand(0, 8) + 1;

$myChallengePositions = array (
    'first',
    'second',
    'third',
    'fourth',
    'fifth',
    'sixth',
    'seventh',
    'eighth',
    'ninth'
);
$myChallengePositionName = $myChallengePositions[$myChallengeIndex - 1];

$wgCaptchaQuestions[] = array (
    'question' => "What is the $myChallengePositionName digit of the number <strong>$myChallengeStringLong</strong>?",
    'answer' => $myChallengeString[$myChallengeIndex - 1]
);

Initial results of this are very solid.

The Numbers_Words package also supports localization into over a dozen languages. I didn’t explore this but clearly this should work for multiple languages pretty easily as well.

Mon, 06 Oct 2014 19:48:16 -0500

The main thing I’ve learned from my WikiApiary project is how horribly bad the spam bot problem is in the MediaWiki world.

Tue, 30 Sep 2014 22:55:00 -0500

TextCaptcha looks like a nice tool. Trying it on one of my sites. Thanks @robtuley!

Tue, 16 Sep 2014 06:48:00 -0500

Better security and privacy through image proxying — Nice! 👍

How Facebook

Sat, 14 Jun 2014 00:00:00 -0500

Improving ads, wow, how excited should I be? Just to be clear what this message really means is that Facebook is now actively collating all of the data that it collects about you from every website that you visit that has those cute little Facebook Like buttons and is using that to target ads at you in a better way.

“improving” and “giving you control”. Bullshit.

Keybase and MediaWiki

Sun, 11 May 2014 00:00:00 -0500

I’m really intrigued by what Keybase.io is doing with identity. The ability to cryptographically prove your identity on the web without a centralized party like Twitter or Facebook owning the approval process is a needed function. I setup my profile and you can now prove on your own that I am who I say I am on Twitter, Github and five of my domains.

I’m trying to figure out how this could be extended to MediaWiki. I would love to be able to prove that my user account is me at:

This seems really hard. The method used on Github is to public a Gist, and you could certainly have a wiki user publish something on their user page, but that can also be edited by anybody.

But if we could do this, it would be a great way to allow Wikipedia editors to claim ownership with proof of their identities (if they wish) and would benefit thousands of self-hosted MediaWiki websites.

I think something more like the Twitter proof could work. How?

Have the user in question edit their User page. The contents of the edit don’t matter, the Summary field is what will be looked at. (Limited to 255 characters)
MediaWiki websites have a permanent revision history attached to each page. (This would be like a Tweet, see my change on May 11 2014)
This information is accessible via the MediaWiki API, and there is a revid attached to each revision.
This revision ID can be used to pull the proof forward for keybase.io.

Here are the last 5 revisions for my User page on WikiApiary (API call).

{
  "query": {
    "pages": {
      "43": {
        "ns": 2,
        "pageid": 43,
        "revisions": [
          {
            "comment": "This is my message for keybase.io to prove I am who I am!",
            "parentid": 884728,
            "revid": 904406,
            "timestamp": "2014-05-11T13:10:17Z",
            "user": "Thingles"
          },
          {
            "comment": "remove gittip button",
            "parentid": 569866,
            "revid": 884728,
            "timestamp": "2014-04-30T02:55:26Z",
            "user": "Thingles"
          },
          {
            "comment": "",
            "parentid": 569864,
            "revid": 569866,
            "timestamp": "2014-02-21T01:56:28Z",
            "user": "Thingles"
          },
          {
            "comment": "added badge",
            "parentid": 552628,
            "revid": 569864,
            "timestamp": "2014-02-21T01:54:59Z",
            "user": "Thingles"
          },
          {
            "comment": "add babel box (needs templates and styles)",
            "parentid": 528928,
            "revid": 552628,
            "timestamp": "2014-02-15T19:36:51Z",
            "user": "Thingles"
          }
        ],
        "title": "User:Thingles"
      }
    }
  },
  "query-continue": {
    "revisions": {
      "rvcontinue": 528928
    }
  }
}

Now that we have the revid we can find the information for this revision to continue to claim proof (API call). The key is that the title of the page “User:Thingles” matches with the user that made the change “Thingles”.

{
  "query": {
    "pages": {
      "43": {
        "ns": 2,
        "pageid": 43,
        "revisions": [
          {
            "comment": "This is my message for keybase.io to prove I am who I am!",
            "parentid": 884728,
            "revid": 904406,
            "timestamp": "2014-05-11T13:10:17Z",
            "user": "Thingles"
          }
        ],
        "title": "User:Thingles"
      }
    }
  },
  "query-continue": {
    "revisions": {
      "rvcontinue": 884728
    }
  }
}

And now I’ve proven my identity. The only trick is that the comment must contain all the data, and that should be easy since keybase already does something similar for Twitter.

And here is another example of me making a proven comment on my user page on Wikipedia (en) (API call).

{
  "query": {
    "pages": {
      "14604697": {
        "ns": 2,
        "pageid": 14604697,
        "revisions": [
          {
            "comment": "Here is my message for Keybase from Wikipedia.",
            "parentid": 551074105,
            "revid": 608054849,
            "timestamp": "2014-05-11T13:56:25Z",
            "user": "Thingles"
          }
        ],
        "title": "User:Thingles"
      }
    }
  },
  "query-continue": {
    "revisions": {
      "rvcontinue": 551074105
    }
  }
}

keybase.io

Sun, 11 May 2014 00:00:00 -0500

I have my profile setup on Keybase.io. Keybase is an interesting product using public key cryptography in a decentralized way to allow identities to be known without having to meet people in person, but instead through public proof.

Mon, 05 May 2014 20:22:17 -0500

I backed The Internet’s Own Boy on Kickstarter and can’t wait to get my copy. Watch the preview.

Wed, 23 Apr 2014 06:28:00 -0500

Yesterdays 1Password updates are great. Just one key thing missing — be able to have multiple vaults open at once in multiple windows.

Tue, 22 Apr 2014 22:27:00 -0500

Excited to have multiple vault support in 1Password on all devices now!

Dropbox Arbitration Opt-Out

Sun, 02 Mar 2014 01:00:00 -0500

If you missed the news that Dropbox is now automatically putting all users into an arbitration agreement you should take a moment to opt-out of this change. You can go to And easily opt out.

Fri, 21 Feb 2014 12:42:31 -0500

Always makes me smile when I get spam that starts with “Hi %%first_name%%,”

Sat, 08 Feb 2014 10:35:55 -0500

Has anyone done a network sniff in Facebook Paper to see what behaviors it is reporting back to the mothership? #notrust

Sun, 02 Feb 2014 08:59:13 -0500

Facebook won’t let you delete a friend list!? Only archive it? There is ad targeting value in that too? (removed all members instead)

Mon, 13 Jan 2014 16:47:45 -0500

How long until Google Ad Sense can target households based on interior temperature? People who are home during the day?

Putting a Google connected collection of sensors in my house doesn’t thrill me.

Opt-Out of Google Plus Gmail integration

Fri, 10 Jan 2014 01:00:00 -0500

It’s lame when the only time you need to log into services is to disable privacy invading features that I have no interest in.

Sat, 04 Jan 2014 18:06:00 -0500

Hoping multiple vault support is coming soon for 1Password for iOS. Am eager to use the feature but need it for mobile too.

Tue, 31 Dec 2013 09:59:34 -0500

Why I donated to EFF: they keep the Internet free and open! You should too!

Tue, 24 Dec 2013 09:52:00 -0500

Didn’t have my anti-spam settings right for Wiki on a Stick. It was blank, likely will just reset it.

Sun, 22 Dec 2013 01:00:00 -0500

Here’s Everywhere You Should Enable Two-Factor Authentication Right Now

Two-factor authentication is one of the best things you can do to make sure your accounts don’t get hacked. We’ve talked about it a bit before, but here’s a list of all the popular services that offer it, and where you should go to turn it on right now.

This is a great list. Highly recommended to go and enable all of these that are relevant to you.

Sat, 16 Nov 2013 07:26:00 -0500

procps security updates cause rkhunter warnings that give pause.

Sun, 03 Nov 2013 16:34:00 -0500

Secure erase = 1 day 8 hours? 500G disk. Wow.

Sat, 26 Oct 2013 19:56:00 -0500

Deleted LinkedIn iPhone app. Can’t trust them after recent Intro release.

Sun, 20 Oct 2013 21:34:56 -0500

Website security question: “Where did you first meet your spouse?” How often is that the city you currently live in? Dumb.

Sat, 19 Oct 2013 22:09:52 -0500

Adobe loses my credit card info, then give me Experian Protect My ID membership which gets all my personal data. Cure seems worse than the problem?

Sat, 19 Oct 2013 20:42:53 -0500

Renewed S/MIME certificate tonight FWIW. Decided to also get S/MIME certificate for Tammy. Didn’t like the fact our email wasn’t encrypted.

Thu, 10 Oct 2013 22:21:40 -0500

Facebook to rip search opt-out from under those who were using it ← Time to delete account yet?

Fri, 04 Oct 2013 20:37:00 -0500

1Password 4 for Mac Review — I’ve been using 1Password 4 for a couple days and like it a lot.

Sat, 21 Sep 2013 18:39:18 -0500

Encryption question: can a Certificate Authority (eg. Verisign) decrypt data encrypted with keys they generate? Or is that not possible?

Thu, 19 Sep 2013 21:07:16 -0500

I think it’s time I revive my usage of PGP encryption in addition to the S/MIME I’ve been doing. My public key.
Wish I still had the secret key file for that PGP key I made in 1993. 😀
Care about your email? Check out GPGTools for the Mac. Makes PGP encrypted email easy.
oPenGP will get your PGP encryption working on your iPhone too.

Sat, 14 Sep 2013 15:20:01 -0500

I had no idea that the State Department funded EFF’s Tor Project.

The State Department funds Tor to communicate with political dissidents from Iran to Myanmar and to help them access the unfettered Web, a key element in Secretary of State Hillary Clinton’s mission of so-called “Internet Freedom.”

This Machine Kills Secrets (Chapter 4) by Andy Greenberg

Sun, 08 Sep 2013 21:55:42 -0500

I finally got a chance to watch We Are Legion. Very good.

LinkedIn: Yes, I know my daughter!

Tue, 27 Aug 2013 00:00:00 -0500

Tonight while on LinkedIn I was prompted for some people I might now, including this one.

So, yeah, in fact I do know my 8-year-old daughter. I didn’t realize she was on LinkedIn? I wonder what professional updates she might have to share with me? What?!

I know for a fact this isn’t a real LinkedIn account. Anyone know where LinkedIn gets this? And what are they doing here? My best guess is that the LinkedIn iOS application sucked this email address and name from my contacts and is now prodding me to click the “Add to network” button to allow them to start sending emails inviting this address to join LinkedIn?

Password v. Passphrase

Tue, 30 Jul 2013 00:00:00 -0500

Today’s xkcd highlights what might be one of the biggest security mistakes of our digital age: using passwords over passphrases. The comic does a great job of illustrating it. I’ve mentioned before that I use 1Password to store over 400 unique, random passwords. But how do I unlock 1Password? A passphrase that is long. Very long.

Sadly being an active 1Password user I can highlight that many websites fail if you use passwords that are greater than 20 characters, much less a 40 or 50 character passphrase.

Stopping MediaWiki Spam with Dynamic Questy Captchas

Tue, 09 Jul 2013 00:00:00 -0500

This method of using Questy Captcha has been defeated by some spammers. Please check out my updated dynamic Questy Captcha method. MediaWiki websites are often plagued by spammers. It’s annoying in the extreme. If you setup a blank MediaWiki website and do nothing it is likely that within a couple of weeks your site will be found, and in a matter of days you will have thousands of spam user accounts and tens of thousands of pages of spam. There are a number of ways to stop wikispam. I tried using Recaptcha to little benefit. I still got a large number of spam registrations on my publicly available wikis. I’ve found the combination below to be incredible efficient.

I started to use QuestyCaptcha which is a plugin for the ConfirmEdit extension (WikiApiary) which uses a simple question/answer paradigm and that worked well. However, the hard part with Questy is figuring out what questions to use. Particularly if your wiki is global, you need to avoid using questions that are specific to one culture or location, or even language. What color is the sky? Well, in what language? For WikiApiary I want to make sure that people from anywhere are able to register. I started with simple questions, like “What is the name of this website?” but that was quickly defeated and spam registrations started showing up. What to do?

I decided to see if QuestyCaptcha could accommodate dynamic questions and it can! So, the first thing I did was decide to use a question that required someone to know something generic, but could also be easily found with a single click on a URL. My choice was to ask about the GMT time, because if you search for “gmt time” on Google, it tells you the answer. The PHP function gmdate will also give the answer. So I created two questions that asked for the day of the week and the hour (24 hour time) at GMT, and provide hyperlinks to the answer. This worked great!

Then I decided to go a little further and ask a very dynamic question. This time I generated an 8 character random string, and ask the user to identify one of the characters in the string. No language issue! No culture challenges! Simple. Here is the code for both of these solutions as it would appear in your LocalSettings.php file.

# Let's stop MediaWiki registration spam
require_once( "$IP/extensions/ConfirmEdit/ConfirmEdit.php" );
require_once("$IP/extensions/ConfirmEdit/QuestyCaptcha.php");
$wgCaptchaClass = 'QuestyCaptcha';

# Set questions for Questy
# First a couple that can be answered with a linked to Google search
$wgCaptchaQuestions[] = array (
    'question' => "What day of the week is it at <a href="http://google.com/search?q=gmt+time">Greenwich Mean Time</a> (GMT) right now?",
    'answer' => gmdate("l")
);
$wgCaptchaQuestions[] = array (
    'question' => "In 24-hour format, what hour is it in <a href="http://google.com/search?q=gmt+time">Greenwich Mean Time</a> (GMT) right now?",
    'answer' => gmdate("G")
);

# Now a more complicated one
# Generate a random string 8 characters long
$myChallengeString = substr(md5(uniqid(mt_rand(), true)), 0, 8);
# Pick a random location in those 8 strings
$myChallengeIndex = rand(0, 7) + 1;
# Let's use words to describe the position, just to make it a bit more complicated
$myChallengePositions = array ('first', 'second', 'third', 'fourth', 'fifth', 'sixth', 'seventh', 'eighth');
$myChallengePositionName = $myChallengePositions[$myChallengeIndex - 1];
# Build the question/anwer
$wgCaptchaQuestions[] = array (
    'question' => "Please provide the $myChallengePositionName character from the sequence <code>$myChallengeString</code>:",
    'answer' => $myChallengeString[$myChallengeIndex - 1]
);

# Skip CAPTCHA for people who have confirmed emails
$wgGroupPermissions['emailconfirmed']['skipcaptcha'] = true;
$ceAllowConfirmedEmail = true;

After putting these in place I’ve had nearly zero spam registrations (1 or 2 were clearly done by a human testing it). Now, can this be broken? Sure, easily. But not nearly as easy as static questions that could be harvested by a person and then put into a tool to automatically create accounts. In order to attack me, spammers would have to write a special handler that dealt with the randomness of the questions. This is very unlikely.

Feel free to use these examples, or, use other dynamic question/answer combinations. It’s not obvious that this type of configuration works with QuestyCaptcha, but it does and it allows for very powerful spam blocking.

Catalog Unsubscribing

Sun, 14 Apr 2013 00:00:00 -0500

I make it a routine task to request removal from any and all catalogs that show up in our mailbox. Sometimes there is a bit of detective work to get removed from them, they don’t go out of their way to make it obvious. This made me wonder why email is required to have an unsubscribe method clearly displayed while catalogs and regular mail don’t have any requirement.

There should be a requirement for unsubscribe information to be presented plainly and near the mailing label. In fact, how about a URL printed for each mailing address that unsubscribes that address? Heck, I might even use a QR code for that!

Wed, 26 Dec 2012 15:36:27 -0500

Another award for a website that allows you to set a 20 character password but silently stores less than 20 characters of it.

Please Charge Me Something

Wed, 26 Dec 2012 01:00:00 -0500

For Christmas the brother-in-laws on Tammy’s side pick names. There are only four of us but we like the simplicity of just getting one name to pick better. For a couple of years now we’ve used a website called DrawNames.com to handle the name drawing, sending emails and even handling exclusions so you don’t get the same person every year. They sent an email asking for feedback and I felt like sharing some thoughts with them and decided I should share them publicly too.

I like your service a lot and if I had more name drawing groups at Christmas I would use it for sure. I’ve suggested your service to others and I know that at least some of them have used it. Everything went very smooth and I think you have the right email confirmations in place to make sure you don’t get “busted” email picks in spam folders.

With that said, I have a concern that your service makes enough revenue to be around. My alternative to using your service is to write a small script that will pick names and send emails. It would be ugly. Probably break a lot. Would likely not get delievered right. I’d rather use your service! I see that I can keep a wishlist and I’m sure that generates affiliate revenue, but I’m not sure many people do that. I know we don’t.

I would rather just pay a small fee for each name drawing group that I have. Maybe a $1? $2? I’m not sure what the right amount is, but I have a hard time seeing how you would make $1 off of our group now, so at least for us that would be an increase.

In addition to making me feel like your service will continue to be around, it would also give me confidence that you are not dropping remarketing cookies in my browser (you aren’t right?) and that my friends and family are not having their email addresses sold to others (which your privacy policy assures me is not happening already).

While I have your ear let me also thank you for not littering the site with link ads. Thank you for not requiring the use of Facebook connect or login with Twitter stuff.

That’s it. The service is nice and works really well. Just charge me something. :-)

My hope is that they have thought about charging before but assume that nobody would pay. It’s the Internet right? Nobody pays. But they do. They pay in droves for the right thing. This website is worth as much to me as many iOS apps I’ve bought for $0.99. Maybe if they hear customers saying they would pay, they can see the path to something that pays the bills and is worth keeping around clarify a bit.

Thu, 13 Dec 2012 11:50:34 -0500

Yesterday renewed EFF membership, today did annual Creative Commons donation! Join me!

Wed, 12 Dec 2012 15:45:11 -0500

I renewed my EFF membership. They work to keep the Internet free and open. Join me and get a 3x Power Up!

Guest network now openwireless.org

Wed, 31 Oct 2012 00:00:00 -0500

For years I’ve ran a guest WiFi network at home that has been called “Thingelstad Guest”. It makes it super easy for people that are visiting to hop online when they are visiting. I also don’t have to share the key for the “Thingelstad Home” network with people that are visiting which is a plus.

Last night my buddy Ry4an Brase posted on Google+ this EFF Open Wireless project. I’m a proponent of allowing unfettered access to the Internet so I decided to join up and rename our guest network.

Does your router support a guest network? How about doing the same on your network?

Mon, 30 Jul 2012 21:32:41 -0500

Wow. Apple’s web site to schedule a Genius Bar appointment doesn’t work right in Safari 6? Can’t move to future days. Works in Chrome. 😕

Okay, the Apple Genius bar website does work on Safari 6. They bug it with an Omniture tag and Ghostery was blocking Omniture.

Terms of Service Screens

Thu, 05 Jul 2012 00:00:00 -0500

Got this a while back on my iPhone.

That gave this.

You got that right? Good.

Another Reason You Need to Use a Password Manager

Fri, 02 Mar 2012 01:00:00 -0500

Got this in my mailbox just now.

Dear Slicehost Forum Member,

Our records show that you have used the Slicehost forum at some point in the past. We’re writing to inform you that we believe an unauthorized party gained access, for a period of time, to the Slicehost forum login database. This database contains the email address, user I.D. and password that you selected to access this public forum (which is completely separate from the systems that run our Slicehost services). Although all passwords in this database are encrypted, out of an abundance of caution, and in support of our policy of transparency with customers, we want to alert you to this situation. We have blocked all access to the forum database and will not bring it back up with existing I.D.s and passwords. We have also temporarily shut down the Slicehost forum.

You probably adhere to Internet best practices, which include maintaining a separate I.D. and password for each website and application that you use. (emphasis mine) If you do so, you need take no action, as the forum contains no personal information.

However, if you used your Slicehost forum I.D. and password in other places, including any Rackspace account, we recommend that you change those I.D.s and passwords. In fact, the next time you attempt to access the Slice Manager, you will be required to change your password. If you use the same password for the forum and for your Slicehost account, and you also use an API key, we recommend that you consider changing your API key as well.

During the period when the Slicehost forum is shut down, you can contact your Rackspace support team with any forum question you may have.

We apologize for our failure to maintain an adequate level of security on our public Slicehost forum, and for any inconvenience this may cause you. We will bring back a great forum experience soon.

Sincerely,

The Slicehost Support Team

I can look at 1Password with 392 unique passwords and read this message without a worry in the world.

My favorite line in that note is the one that I’ve added bold emphasis to. I sincerely doubt even 1% of Internet users do that.

SOPA Scrapbook

Fri, 20 Jan 2012 01:00:00 -0500

I participated in the SOPA blackout on January 18th. All of my personal websites went dark at 8:00am CT and returned at 8:00pm CT. I served 6,235 STOP SOPA notices. My handful of sites were just a drop in the big ocean of over 115,000 sites that went dark. It really felt historic. I took notice of the first time that so much of the Internet banded together to make something happen, and did it happen. Just two days after the blackout the bills have lost major supporters and are going back to committee.

It felt like something momentous. A punctuation mark in the big timeline of the Internet. I decided to grab some screenshots and make a little scrapbook of the day.

My Sites

Here is what thingelstad.com looked like on SOPA blackout day.

Tammy also participated, blacking out Smaller Than A Redwood.

And so did Mazie. I explained to her that we were blacking out our websites in protest of a proposed law. She asked what protest meant and I explained it to her. She didn’t have a strong opinion about SOPA, but felt it was right to go along with her Mom and Dad.

Same Template

The awesome template I used to black my sites out was developed by Zach Johnson. He had an amazing SOPA blackout story with so many websites using his template. Here is what his website looked like. He increased the font size slightly on his site.

His template got picked up by a lot of sites, including Greenpeace.

Net.Freedom

I was happy to see sites and services that I care about, and in some cases donate to, supporting the blackout. Wikipedia was the largest site on the Internet to go completely dark. I thought it was a great touch that you could still get to the Wikipedia page for the Stop Online Privacy Act (SOPA) though.

I’m a big fan of Semantic MediaWiki, which is a suite of extensions for MediaWiki, the software behind Wikipedia. The team behind that project followed the lead of Wikipedia and also went dark. I liked their message and display.

WordPress is a strong supporter of an open and free Internet and they made WordPress.org completely dark.

It was cool that Automattic also took action with WordPress.com and did a very creative blackout of just content.

I’m a supporter of the Electronic Frontier Foundation and they censored their logo and used their site to share information on their opposition to SOPA.

I’m also a supporter of Creative Commons and they put a black banner on top of their site.

Publishers

A variety of publishers took part on the blackout. Ars Technica had a good banner with content regarding SOPA. Although I thought the banner ad on top was tacky and a bit tone deaf to the point of the protest.

O’Reilly did a very nice job with it’s blackout and a strong message an simple design.

Wired did a very cool blackout using the censoring of words and then changing it as you moved around on the page.

One of the best web comics did an awesome blackout. This is what xkcd did.

And The Oatmeal also did an amazing blackout. This one had an animated GIF that went on for a while about why he took issue with SOPA and involved Oprah on a jet ski in only the way the Oatmeal could.

I Can Has Cheezburger had a nicely done call to action.

Disappointing but predictably, my former colleagues at the Wall Street Journal came out in favor of SOPA.

Big Sites

I was curious what Google would do. The censored logo was striking, and to many folks that weren’t plugged into what was going on I think it was a strong message.

Flickr did a very creative blackout allowing people on Flickr to blackout any photos on Flickr they wanted to. I blacked out one of my photos.

Mozilla, the organization behind the open source Firefox web browser, participated in the blackout.

Reddit was one of the first big websites to say they would participate in the blackout. They had a great mix of content and call to action.

Criagslist participated in the most boring HTML display possible, totally fitting Craigslist.

BoingBoing did a nice blackout and I thought it was cool that they actually showed the HTTP status code.

Minecraft, a game played by 4.7 million people, went dark for the day.

Facebook didn’t do anything that impressive, which was a bit disappointing. They could have blacked out their logo like Google. However, Mark Zuckerberg did at least post a comment on Facebook regarding SOPA.

More Protests

I’m a customer of Pinboard, a paid bookmarking utility. He didn’t blackout, and I was happy they didn’t since I pay for the service and use it daily. There was a call to action on the top of the site.

I was happy to see my congressman Keith Ellison participating in the blackout.

Dave Winer blogs at Scripting.com and had really debated if he was going to black out. He did, and in fact just totally blacked out with nothing on his site.

Archive.org went dark as well.

Going White

TheDailyWTF decided to be different and go white.

FARK also went white. I don’t know much about FARK other than they “fark’d"Road Sign Math once.

ZanHabits also went white, in a very zen way.

Tin Ear

Sadly, not all Internet leaders participated. Even though Bing has this big image format on their website that would have easily led to something interesting, even just a black image. But instead it just looked as it always does.

Yahoo was even worse, sporting football news and advertisements. Completely ignoring such a historic event.

Wed, 18 Jan 2012 00:31:43 -0500

The SOPA page on Wikipedia is not blacked out. Good.

Participating in SOPA Blackout

Tue, 17 Jan 2012 01:00:00 -0500

I just added these crontab entries

0 8 18 1 * /srv/www/maint/sopa/deploy-sopa.sh
0 20 18 1 * /srv/www/maint/sopa/remove-sopa.sh

On January 18th at midnight all of my personal websites will be going dark to protest the proposed SOPA and PIPA bills being discussed in congress. I’m joining sites like Wikipedia and Reddit in this process. I realize I don’t get a lot of traffic, but I felt it was important to join in. My sites will be in protest display from 8 AM to 8 PM central time.

Sun, 06 Nov 2011 14:53:00 -0500

Just made my annual contribution to the EFF. You should too!

Tue, 02 Aug 2011 00:56:35 -0500

Doing some Unix cleaning tonight and found the website I host for my cousin had been compromised. Ugh! 😕

One crappy WordPress plugin (is-human) with a PHP exec hack.

Google Reminding People to Update

Sun, 19 Jun 2011 00:00:00 -0500

I got this email yesterday for a blog that I help my brother-in-law out with. I haven’t ever seen a notice like this:

Dear site owner or webmaster of domain-name-removed. Your site appears to be running an older version of WordPress. Google recommends that you update to the latest release. Older or unpatched software may be vulnerable to hacking or malware that can hurt your users. To download the latest release, visit the WordPress download page. If you have any additional questions about why you are receiving this message, Google has provided more background information in a blog post about this subject. Best wishes, Google Search Quality Team

I didn’t know that Google would send a notice like this. Seems like a good thing to do to keep the web a better place.

I logged in and upgraded his site for him.

Update July 6th: This seems less cool than I hoped. Today I’ve gotten a number of emails on blogs that I upgraded on 7/4 to the newest WordPress saying I should upgrade them. Maybe Google is just seeing that the site is running WordPress and sending a note regardless of what version it is currently running?

Asking For Too Much

Tue, 24 May 2011 00:00:00 -0500

Softball season has arrived again and the B-Squad is back out trying to win a game. My softball team calls Dusty’s in Northeast home, and after every game (and sometimes before) you will find us at Dusty’s enjoying a Grain Belt Premium.

Part of our ritual is the jukebox and Dusty’s has now upgraded their jukebox to a fancy new version that has a touch screen display as well as a connection to the Internet to do various things. I would assume it gets new music that way. It also can get messages about what to play from the Internet and there is a handy little iPhone app that you can install for free to control the jukebox. I was eager to give this a try.

I downloaded myTouchTunes to do some remote control of the Dusty’s jukebox. I expected to just be able to install it, connect to the jukebox through some lookup and somehow pick songs. However, it seemed I had to create an account with myTouchTunes to do that. Annoying, but okay I thought. I’ll make an account and I’m guessing you can save some preferences or something for me (although, that could just be done on my phone). So I tapped the Register button to make an account and got this screen.

It was one thing to have to create an account, but why exactly does anyone need to know my age and gender to pick a song on a jukebox? Why is my zip necessary to queue up Black Sabbath’s Ironman. It is not! I closed the application and deleted it. I’ll stick to putting plain old dollar bills in and picking songs.

Seriously, what in the world is myTouchTunes doing here? I think asking for all that information is despicable on its own, but what in the world good is it doing them? If they want popular songs by area, they don’t need my zip. They know where the jukebox is. Why do they care if I’m a guy or gal? Of what possible utility is that to them?

I’ll pass.

Centralized Data Breaches

Sat, 09 Apr 2011 00:00:00 -0500

The design of the Internet allows for an incredible amount of decentralization. My blog, is run on my server, and yet you can all get to it. We don’t have to have all blogs in one place. And that is a good thing.

I got three notices recently that highlight one of many downsides of centralization. Epsilon had a data breach, and the dominoes fall all over the place.

Save the Lead

Tue, 15 Mar 2011 00:00:00 -0500

I tapped on a unsubscribe link today to rid myself of another spam list. This URL quickly flashed through the browser as several redirects were occurring. What does this URL say?

http://your-website-here.com/index.php/leadCapture/save

That certainly reinforced that I didn’t need those emails anymore. I wonder what cookies they dropped on my browser in all those redirects.

Tue, 22 Feb 2011 02:08:49 -0500

Just spent two hours cleaning vandalism off of one of my websites. (mediawiki, not WordPress). Nasty Internet out there.

Mon, 07 Feb 2011 13:55:58 -0500

Having fun with Daytum. After 1-month I’m pretty happy with my beer page.

Why No Mail Encryption on iPad?

Sun, 06 Feb 2011 01:00:00 -0500

I like to use digital signing in email, and some friends have done the same and we can exchange fully encrypted email. However, it’s a major issue that iOS has no support for this. If you get an encrypted email, this is all you can see.

There is nothing you can do with the email. This is a shame, since it would be really easy to get all this information from my keychain on my Mac.

Hope Apple decides to add support for encrypted email at some point soon.

Good Passwords with 1Password

Mon, 13 Dec 2010 01:00:00 -0500

This morning I read the news about Gawker having 1.3 million passwords taken from their servers. These passwords were attached to email addresses. What do you need to login to Amazon again? Email, got it. Password, probably have that to.

I read this article with a bit of smugness. I’m certainly a proficient user of the Internet and I know all the risks of sharing passwords, but until a couple of months ago I was as guilty as the worst offenders out there. I had three passwords, one that was really sloppy for sites that I didn’t care so much about. Another for semi-secure sites. And a third that I used for stuff that mattered. But even that bit was sloppy and not really managed well. The password was short, could be brute forced, etc.

Then I decided to take the plunge and do passwords right. I had meant to do it forever, but just didn’t get around to it. In fact, I’m a bit embarrassed to admit that even having my PayPal account hacked didn’t get me to “see the light” when it came to passwords. I knew I couldn’t do this on my own, I needed a tool to help. I had bought 1Password forever ago in the first MacHeist so I looked into the product again, liked what I saw, bought an upgrade to the newest version and was off.

How to do it?

It’s simple really. Here is what I did. I installed 1Password on all my machines. I told it to ask me to save credentials, which it did very nicely in any browser I used. It synchronized everything between multiple machines and iPhones and iPads using Dropbox. Great. Now just start saving passwords.

I then set up a Smart Folder in 1Password and told it to filter anything that used a known bad password. As I was creating accounts this folder started getting full of insecure credentials. This gave me my to do list. I would then separately go to that folder and go to those sites and change my password to a unique, randomly generated string. In most cases I’m using a very secure 20 character random string.

To create this folder I just selected File and then New Smart Folder and saved the criteria as shown below. Note that it is critical to change the criteria to “any” of the following are true. The default is “all”.

Success!

I just did this for a month. Looping through, changing passwords. It wasn’t that laborious actually. The biggest challenge is dealing with logins on the iPhone. 1Password has a really nice universal app that works on all iOS devices and synchronizes wonderfully thanks to Dropbox. Copy and paste as well as fast application switching is the critical bit here, without it the thing would fail. When I need credentials I double-tap to activate fast app switching and go to 1Password, copy the password, use fast app switching again, paste. All done!

As I write this I now have 196 logins to various websites, with 196 unique and very strong passwords. This makes me feel very comfortable with the security of my accounts.

Other Benefits

I’ve found other benefits with 1Password. It turns out to be a great place to store software licenses. I now have 115 software serial numbers in 1Password that I can easily get to. I also like the Wallet section and have put the critical information that is in my leather wallet there for safe keeping. Lose my wallet? No worries, it’s in 1Password.

Passwords to Remember

All in I really like this solution. There are however two passwords that I found I cannot just throw random characters at because I have to remember them.

First, my Dropbox is the backdoor to getting at my 1Password information. If I’m on some foreign computer and I need to get a password, I can go to Dropbox and load my information using a great HTML hack that 1Password does. However, this means I need to remember my Dropbox password. So, this one I had to commit to memory with a special mnemonic.

I also found that my iTunes password needed to be committed to memory. It however ended up being 32 characters long, so I even tend to go to 1Password and copy and paste it. However, in a pinch I do know what it is and can laboriously type it in on an Apple TV for example.

Everything else is just stored away.

Do it!

The web is not a safe place, and it’s not a safe place to leave your buying capabilities protected with the password “password”. I think most people don’t really connect the dots that if one system, like Gawker, is compromised, that leads to a chain of further compromises that share those same credentials. Is it a pain at times to do this? Sure. But I have complete control over my accounts. Another side benefit to this is that you actually have an inventory of all the websites you have accounts at! I was amazed just how many websites I even have logins at, nearly 200! Time to delete some accounts!

Twitter Spam

Fri, 10 Dec 2010 01:00:00 -0500

It’s clear to me that spam on Twitter continues to be a growing problem. Tonight I posted a simple question about weather apps on the iPad.

Within seconds I got these really helpful replies from four attractive women that supposedly follow my every message, including one that seemingly has no clothes and only a bra to wear for her avatar.

I reported the accounts as spam. This stuff is so blatant though. You would think that Twitter could be doing a much better job blocking this stuff if they put any thought into it. Too much traffic? Somehow firewalls manage high traffic loads. Too complex of a problem? Don’t buy it.

Maybe they don’t mind it. After all, aren’t each of these yet another Twitter user which increases the theoretical worth of Twitter?

Unsubscribing

Wed, 03 Nov 2010 00:00:00 -0500

I’ve started the process of having our name and address removed from all the junk mail that we get. We moved a few months ago and now it seems to be queueing up again. It’s mysterious to me that 8-month old Tyler is getting catalogs.

Tue, 02 Nov 2010 19:45:00 -0500

Just added my 100th web login to 1Password.

Tue, 03 Aug 2010 21:11:10 -0500

This new talk from Larry Lessig is worth watching. Great stuff.

Flickr, Leaving You in Control

Sat, 26 Jun 2010 00:00:00 -0500

I want to take a moment to applaud Flickr. It really frustrates me when websites do not give you full control of your data. I decided that I wanted to start over on Flickr and delete every picture I have. Some services make this so painful. In Flickr though, it was just a couple of clearly labeled and easily accessible clicks away.

That took a while, but when it was done I had a blank slate to start with again.

Thank you Flickr for making it very clear that I am in charge of my account and what is there.

Video: Open Internet

Sun, 25 Oct 2009 00:00:00 -0500

This is a really great video that explains in plain language why Net Neutrality is so vitally important.

Unauthorized Transactions

Fri, 23 Oct 2009 00:00:00 -0500

This morning when I checked my email I found many more unread messages then typical. A bit concerned, I found many PayPal messages.

That isn’t a great way to start the day. You see, I have no idea who “NC Interactive, Inc.” is. Additionally, I can tell you that at that time I was fast asleep getting a good nights rest. Ugh!

It seems that someone got access to my account and decided to buy some credits for an online game. Each transaction was between $39 and $59. There were 16 transactions totaling nearly a $1,000 of fraudulent charges.

After seeing this I immediately changed my password as well as my secret question answers. I filed these transactions as fraudulent and I’m assuming that this will be easy to get PayPal to reverse. However, they say it will take about a week to get it resolved.

I wonder if the criminal just stopped using it after $1,000? The charges stopped a couple of hours before I noticed it and changed the password. They didn’t seem to do anything further in my account either.

In years of using PayPal, and generally just doing commerce on the web, this is the first time I’ve gotten hit with any fraudulent activity. I guess my luck ran out.

R.I.P. Thawte Web of Trust

Tue, 13 Oct 2009 00:00:00 -0500

Still saddened that the Thawte Web of Trust system is being shut down by the new owners, Verisign. Anyone surprised since Verisign offers a pay product that Thawte did for free? To make matters worse, I had become a Thawte notary a few months ago. It’s crazy that while they have sent emails to everyone the Web of Trust website doesn’t indicate anything about it going away. They are still happily letting people sign up? Huh?

How to Expire Tweets on Twitter

Fri, 28 Aug 2009 00:00:00 -0500

A lot of people consider Twitter a microblogging platform. I don’t really agree with that. I think Tumblr and Posterous are great examples of microblogging platforms. Twitter, to me, is much more like a “micromessaging"platform. As such I think it has more in common with email and instant messenger than WordPress and Tumblr.

I’ve been thinking more recently about the digital trails we all leave and it struck me that Twitter really should be managed more like messaging applications. In those applications, I tend to have an expiration date for things. To be formal about it, there is a retention policy for that content. Twitter needs a retention policy. Do I really care to have archived forever the Tweet about lunch from three years ago? No. Does Google need to index it? No. The only practical use I can think of for a long history on Twitter is to be able to profile me for advertising better. No thanks.

I did a little looking and couldn’t find anything to do this, so whipped up a Ruby program with the handy Twitter4R library to do what I want.

This script requires Ruby, the Twitter4R library and is intended to be ran on a schedule with a utility like cron. Edit the code to use your login credentials and set the days that you want to expire tweets after. This program will then repeatedly look at your timeline and delete status messages that occur more than the number of days you specify ago.

#!/usr/bin/ruby
#
# Get requires out of the way
require('rubygems')
gem('twitter4r')
require('twitter')
require('time')

# Configuration parameters
twitter_username = "YOUR_USERNAME"
twitter_password = "YOUR_PASSWORD"
delete_after_days = 14

# Let's get a Twitter Client created
client = Twitter::Client.new(:login => twitter_username, :password => twitter_password)

# Expire deadline
expire_before = Time.now - (delete_after_days * 60 * 60 * 24)
expire_ids = []

puts "Expiring all Twitter updates prior to #{expire_before.to_s}."

# Iterate through timeline
# Purposefully get a large number of updates. As written, if your delete_after_time does not
# occur within the number of updates this script will never see an update that is old
# enough and never delete anything. It would be nice if we could request the timeline from
# the oldest tweet forward, but I cannot find a way to do that with Twitter4R. (The :since
# parameter does not seem to do anything for a :me request)
# If you have problems with this scripte set the count to something like the number
# of tweets you would create in delete_after_time days.
# Using the defaults, if you Tweet more than 200 times in 14 days this will never expire
# anything. If you try to use an expire length that is very long, like 365, this many not
# work at all.
timeline = client.timeline_for(:me, :count => 200) do |status|
  if status.created_at < expire_before
    puts "Queueing delete status ID #{status.id} created at #{status.created_at}  (#{status.text})."
    expire_ids.push(status.id)
  end
end

# Now we'll sort the array, this will have the affect of putting the oldest items first in
# the list to be deleted.
expire_ids.sort!

puts "Deleting #{expire_ids.length} tweets."

# Now let's delete the stuff
# The Twitter4R library delete method seems to be completely broken. So, rather than a simple
# client.status(:delete, delete_status) we are going to go right to the API methods on Twitter
# this is ugly, but we are just going to spawn curl to do this work for us. And I'm sure I
# could do this without execing curl in the shell, but, whatever...
# Note: the delete method is not rate limited.
expire_ids.each do |delete_status|
  puts "Deleting #{delete_status}..."
  `curl -s -u #{twitter_username}:#{twitter_password} --http-request DELETE [twitter.com/statuses/...](http://twitter.com/statuses/destroy/#){delete_status}.xml`
end

This script does not do any checks to make sure the delete commands succeeded. Consider yourself warned. I don’t think it matters much since if it fails a delete it will just try again the next time.

Since the delete method is not rate limited, you could run this whenever. However, I would suggest to run it at once a night, perhaps late in the evening, so that you don’t interfere with the Twitter API usage from your normal Twitter clients.

Sat, 22 Aug 2009 00:00:00 -0500

I seem to be very focused on the themes of Creative Commons, GNU Public License and having control of my computing future lately. This is a good thing.

Thu, 13 Aug 2009 00:00:00 -0500

I’m trying to suck all of my Tweets off of Twitter and there seems to only be 3,200 tweets. However, Twitter says on my profile page I have tweeted 4,237 times. Where are the other 1,037 tweets? Reason #75 why hosted services don’t deserve our content.

Fri, 08 May 2009 07:10:48 -0500

Just made my first Thawte Web of Trust assertion!

Mon, 30 Mar 2009 20:45:47 -0500

I am now a Thawte Web of Trust Notary. Cool!

Google Forcing Software Update Install

Tue, 03 Feb 2009 01:00:00 -0500

I just upgraded to the new Google Earth 5.0 beta and was really surprised when I first launched it to get this dialog.

The problem with this are the options. So, I get to either install Google Software Update, or Quit Google Earth. Where is the button saying “Decline” and allow me to just happily run my software and update it myself. Smells a lot like Microsoft. The last paragraph of the text is the worst (highlighting is my addition).

To continue using Google Earth, you must accept the new Google privacy policies and allow Google Software Update to run in the background on your computer.

I may have to remove Google Earth and bid this thing farewell. Google, you must accept that people have the right to choose what software they allow to run on their computer. It’s my computer, not yours. Get back! I didn’t read the new privacy policies, almost scared to look in there. What else does this Google Software Update do while running in the background?

Mon, 26 Jan 2009 01:00:00 -0500

I Am Here: One Man’s Experiment With the Location-Aware Lifestyle ← I’ve done some playing with location-aware applications, mostly Brightkite, and this article rang true to some of the thoughts and challenges I had with them as well. Location-awareness brings a new dimension to the web, but it will take some time to figure out how to do it right. His example of how easily he was able to find out where a woman he saw taking pictures in the park lived is an eye opener.

Found via GrumbleDroid by Tim Bray.

Fri, 09 Jan 2009 17:13:35 -0500

Updated email encryption certificate 1 day before it expired.

All of iTunes now DRM Free

Tue, 06 Jan 2009 01:00:00 -0500

The announcement today that all music in the iTunes store was going iTunes Plus and removing the DRM protection was one that I was expecting and looking forward to. I don’t mean that I was following recent rumors about DRM being removed, but rather that I’ve expected that DRM will be removed from music for over a year. It’s just a matter of time. I’m happy to mark this milestone on my calendar.

I came home and fired up iTunes. It found 49 albums plus some odds and ends to upgrade. I track DRM in my library with a smart playlist. It says I have around 1,800 items (including movies and TV shows) that have DRM. 728 songs takes a huge chunk out of the music and the rest will follow in coming weeks.

I’ve never had iTunes download 700+ items in one shot. It seems it can only do 250 at a time, so this will be busy downloading for a while.

I can happily say goodbye to music-related DRM now. We still have DRM for movies and TV shows, we’ll see where that road leads.

Keep Track of DRM Protected Content in iTunes

Tue, 06 Jan 2009 01:00:00 -0500

I mentioned in my post on DRM being removed from iTunes that I track DRM content using a Smart Playlist. I’m fine with some DRM content, but I like to keep a handle on what is DRM-protected. iTunes makes this easy, just create a Smart Playlist like this.

DRM protected tracks have the word “Protected” in their Kind description, so this will let you easily keep tabs on what content you have this is DRM restricted.

This can be a really useful playlist to subtract DRM protected content out of other playlists using this. For example, if you wanted all content added in the last 6 months, that is not DRM protected do this.

This is particularly useful if you are trying to sync content to a device that will not play FairPlay protected tracks.

How to Remove Your Facebook Wall

Mon, 05 Jan 2009 01:00:00 -0500

I’ve become more of a fan of Facebook over recent months (see my profile). They have made a number of improvements that I really like, and the number of people joining the service seems to just increase more and more over time. I’m really amazed at home many people you can find on it. I think they are well on their way to being the de facto White Pages of the Internet.

With that said, I don’t like the Wall feature of Facebook at all. For whatever reason, I’m just not real hip on anybody coming to my profile and just typing away. I’ve turned my wall off for a long time, and enough people have commented to me “Hey, you don’t have a wall! How did you do that?” that I thought I would share how to remove your wall.

Now, to be clear, we are not removing the wall per se. Facebook will not allow you to remove the Wall application. Instead, we are going to adjust privacy settings to hide the wall entirely. First, go to your privacy settings.

Now click on your profile.

In this screen, scroll down a ways and you will find the “Wall Posts"section. Simply change your settings to look like this. Uncheck the “Friends may post to my Wall” box and change the privacy option.

You could set this so that only you can write on your wall if you want. There are a couple of different options. I have it set like above which effectively removes the wall.

Jan. 8, 2009: I’ve gotten some questions from people saying this doesn’t work. I think the challenge is catching the result. I’m adding this section to help illustrate what this does.

Result

Now that you have made this change you probably want to check to make sure it worked. This is a little hard on Facebook since it’s not terribly easy for you to see your profile as someone else. Facebook does have a feature that allows you to test this out, in your Profile Privacy settings, where you changed your wall privacy options, you can type the name of a friend and see your profile as they would see it. This works great for testing, particularly if you are using Facebook groups to assign privacy levels differently for various people.

You may be confused that even after these changes your profile will still have a tab called “Wall”. That is impossible to remove, per my earlier comment that we cannot really remove the Wall. It’s integral to the functioning of Facebook. All we did was remove the ability for people to write stuff on it.

Before these changes this is how a friend would see your wall.

Note the option to Write on the wall. After making these changes a friend sees your wall like this.

The option of writing on your wall is gone now.

Mon, 15 Sep 2008 14:28:21 -0500

For the life of me I cannot figure out why spammers so badly want to create accounts on my WordPress sites. Luckily SABRE solves the problem

Wed, 30 Jul 2008 09:52:43 -0500

Seems like a lot of “spam friends” coming on Twitter lately. It needs to be easier to identify these and block them.

Your friends list on Twitter.com should show basic stats of friends and provide 1-click actions. That would help a lot.

Clearly Twitter is going to need to deal with a recent sharp increase in spam activity.

Mon, 28 Apr 2008 15:59:01 -0500

Just seeing that Postini has grabbed some emails from me that were not spam.

Zip Code Insult for Gas

Tue, 25 Mar 2008 00:00:00 -0500

I’ve already written about how annoying it is to be bombarded with advertisements while buying gas. Now they’ve gone even further. I went to buy gas the other day and got this great screen demanding my zip code.

Find missing image "I Just Want My Gas! flickr.com/3097/2315643138_4519e68bb2_m.

Now, this is lame for so many reasons. First, the implementation is so poor that it accepted six zeros as a valid zip code. Six zeroes. Yeah. Secondly, this is a real cheat since you don’t know if the zip code is for credit authorization or marketing purposes. Since it took six zeroes I assume it’s for marketing purposes.

Companies need to start respecting our privacy at least the slightest, tiniest bit. We need to vote with our dollars and avoid these scams, or mess them up with invalid data – like six zeroes.

Sun, 23 Mar 2008 19:00:00 -0500

Yeah - found a plugin to block registration spam. I’ve been getting hammered with it the last few days.

New Year Resolutions - Tech Edition

Mon, 14 Jan 2008 01:00:00 -0500

I don’t have New Year resolutions every year, but this year I figured what the heck. Looking back, while I didn’t call it a resolution, I did force a switch to Camera RAW for photography on January 2nd, 2006 and that was great. I have a few technology and Internet related resolutions that I thought I would share this year. Hopefully I’m as happy with these changes in a couple of years.

Digitally Signed Email

The time has come for this to be standard. This feels a lot like the Camera RAW resolution above. Not many people use digital certificates with their email because it's generally a pain and complicated. But, without it email is like writing on a bathroom wall, in a really big bathroom. It's so wide open it is somewhat shocking. Digital certificates solve this problem.

I have now enabled my OS X Mail with a digital certificate from Thawte and if you get email from me it will be signed. This isn’t universal since the iPhone at this point doesn’t sign messages, and I do occasionally have to resort to webmail. But if it’s from Mail.app it will be signed.

Go get your own certificate as well and we can even encrypt the message. There is a somewhat dated, but good explanation on doing this for OS X at Joar Wingfor’s website.

Less Google

Yes, less Google. Google knows too much about me. I've decided this trend needs to reverse. I've stopped using GMail and am using Tuffmail for my mailbox. I've ditched Google Calendar. I'm even thinking about moving from Google Reader, a frightening thing to even consider. But I think 2008 needs to end with less Google than it started with. It isn't that I think they are evil, it's just that I don't think one company should really have that many angles on my personal data. After moving my email to Tuffmail, I had this sense that I was no longer being monitored. Real or not, I had that feeling.

More Wikipedia

This resolution was made by another guy at the office and I liked it so much I'm adopting it myself. It seems that many times when I search on Google I end up at [Wikipedia](http://www.wikipedia.org/). So I'm going to try to cut down on the middle man. Even better, how about doing Wikipedia searches from inside OS X's Dictionary.

Cleaner URL’s

I have a tendency to put an unnecessary trailing slash on URL’s. I’m going to try to stop doing this.

Defensive Domain Names

Tue, 01 Jan 2008 01:00:00 -0500

I purchased thingelstad.com in April 1999. I’m a little surprised that it took me until 1999 to buy my own last name. It seems odd to me now that I didn’t buy it in 1995 or so, when I clearly knew that this whole Internet thing was real. Luckily I beat a Thingelstad in Norway who had to settle for thingelstad.org in June 2000.

I recently filled out my personal domains and grabbed thingelstad.net as well as thingelstad.name. These were imminently obvious. It also seems to me that if you care to own your identity on the Internet you should make sure to own your full name. As such, I also own jamiethingelstad.com, jamiethingelstad.net, jamiethingelstad.org and jamiethingelstad.name.

Lastly, I have to deal with a name that is long and not easy to spell. The most common misspell of my name is to transpose the e and the l. So, I also now own thinglestad.com, thinglestad.net, thinglestad.org and thinglestad.name. These all just do a permanent redirect to the real domain.

GoDaddy really loves me. 🙂

Get a Gravatar and Be Cool!

Tue, 01 Jan 2008 01:00:00 -0500

If you have commented on my blog you have likely noticed this blue Gravatar image appearing next to your post. This is the default image that appears if you have no avatar, and you really should get one. I’ve been on a total avatar kick lately. I had my own custom avatars made. I think that this is part of keeping the Internet personal and “connected”. I love to fill in my OS X Address Book with pictures for people so that when they call or I get email from them I get to see them.

A gravatar is a globally used avatar. It’s a service that takes your email address and creates a key to map it back to your gravatar. Automattic now owns Gravatar and is embedding it into WordPress. Now there is a plugin for the OS X Address Book that allows you to pull Gravatars into the Address Book.

So, why wait? Go to Gravatar and personalize yourself. It’s cool!

Copyright Notice in RSS Feed

Tue, 04 Dec 2007 01:00:00 -0500

If you are reading thingelstad.com via the RSS feed you will notice that I have added a ~~copyright notice~~ creative commons license to the feed, along with a digital fingerprint and for fun the IP address of the machine that pulled in your RSS feed. I’m doing this to fight back against website hijacking.

I’m noticing a lot of my content being stolen via my RSS feed and then republished on spammer websites. This is a slimy practice and is a growing trend. Lorelle wrote on this at some length recently. I decided to do something about it with the CopyFeed WordPress plug-in.

I went out of my way to just put the ~~copyright notice~~ creative commons license in a regular HTML block at the end of the post. I decided to post about this to encourage others to consider adding this if their content is being stolen, and to let you know why the ~~copyright notice~~ creative commons license has appeared.

OpenID Makes Identity Easy

Fri, 11 May 2007 00:00:00 -0500

I’ve been using OpenID for a couple of weeks now, and I’m really impressed. I created an OpenID identity on MyOpenID a few months ago, but there was nothing to use it with so it just sat. In these few months though, there has been a lot of progress! Recently David Hansson was blogging about OpenID which peaked my interest again (I asked him about it in the interview with him at Minnebar –fast forward to 44:13 minutes). There are now a decent number of web properties that are using OpenID to manage authentication. What is OpenID?

I’m not going to write this when others have done it so well. Excerpt from ReadWriteWeb:

OpenID is an open, decentralized, free framework for user-centric digital identity. It is aimed at solving the problem of Web single sign-on. How does the problem of web single sign-on affect you? Well, if you struggle with keeping track of different usernames and passwords at different websites where you have an account, OpenID can help you. With OpenID you will be assigned a standard username (typically a URL or an i-name, similar to an email address) that you can use on all sites that support OpenID.

There is a wealth of information at the OpenID “How it works” page as well. If you insist on not wanting to read anything (and you likely wouldn’t have made it this far in this post if that were the case), Simon Willison did a nice screencast on using OpenID that is worth watching.

Where is the momentum?

OpenID is getting a surprising amount of support. There are now over one hundred sites, including some fairly large ones, that allow OpenID authentication. The list is growing daily with sites like Digg announcing they will be using OpenID. Microsoft is working to make OpenID and CardSpace work together. AOL has adopted OpenID and every AOL account now has OpenID capability (all 63 million of them!). Sun has announced support of OpenID. Mozilla has also announced that Firefox 3.0 will support OpenID. I’m a bit mystified at Google’s complete silence on this topic.

That is a lot of activity, and much more momentum than was ever enjoyed by passed failed attempts at single-sign-on on the web like Microsoft Passport (now Windows LiveID). The fact that OpenID is decentralized, free and open-source gives it a very good chance at making it.

Cool OpenID Stuff

Once you have an OpenID account using OpenID-enabled sites is a breeze. Here is my OpenID. I can go to any OpenID-enabled site and type in http://thingles.myopenid.com/ and I’m in. I could even make that my own website URL, but I haven’t found a need. Passwords become a thing of the past.

Having a centralized identity also opens up new capabilities. Jyte is a website that makes little sense without OpenID. Jyte is like Everybody Votes for Wii built on OpenID using the Web. See my Jyte page. What makes Jyte compelling is that identity is shared across OpenID sites. So, if I gave permission, another website could query Jyte, using my OpenID URI, and retrieve my information from Jyte to personalize my experience at the new site. Very cool! (And a little scary.)

ClaimID is another interesting idea around identity management. It uses the centralized identity of OpenID to allow you to claim ownership of URL’s. See my ClaimID page. It combines OpenID federation, with the MicroID (get the Wordpress plugin!) microformat (a topic worthy of another post) to allow you to verify ownership of URL’s and centralize this in one federated OpenID-enabled identity.

Hopes

I hope that OpenID continues to get adoption. Identity management is a big problem on the web, and everyone has a myriad of passwords. Additionally, it gets really annoying to have to retype your name, email, address, etc. OpenID has a great framework for selectively controlling the distribution of that information. It removes so much of the friction from both signing up for a new service, and returning to use it in the future.

Operation Junk Mail

Thu, 07 Dec 2006 01:00:00 -0500

I’ve decided enough is enough. Perhaps it’s just the holiday season, but our mailbox has been overloaded with mail order catalogs. Sometimes as many as ten a day. It’s insane! I’ve decided to declare a War on Catalogs!

I’ve had good success so far. I’m going to the website of every company that we get a catalog for and submitting a customer service request. So far most are responding promptly. I’m keeping a list of who I contact, when and any relevant tracking numbers so I can escalate if I need to.

Hopefully our recycling will go down, our mail carrier will be happier, and we’ll have less junk thrown in our face to buy.

Good Spam Filtering for Home

Sat, 18 Nov 2006 01:00:00 -0500

I’ve started to get deluged with spam again at home. The last time this happened I decided to switch my email address – a little “shake and bake” as it were with due credit to Talladega Nights. At work I’ve been using Postini for years now and I’m a huge fan. They do an amazing job of handling spam and viruses – both of which I had nothing to stop at home.

I would have loved to use Postini but they don’t offer individual accounts, boo! However, they do have resellers. Some quick searches and I found a Postini reseller that set me up for $2.50/month per address. They got me setup very quickly and now I’m a much happier email recipient.

Threat Level Orange

Fri, 17 Nov 2006 01:00:00 -0500

I just got home from another business trip. I seem to be in the middle of another spat of business travel with all the requisite fun of airports, flights, taxis, rental cars and hotels.

As I drove to the airport for this trip I noted the electronic sign at the entrance of the airport proclaiming:

Threat Level Orange

I have to ask, what good is this? What in the world is this supposed to do to make my life better? Really. Let’s think about this. My reaction to the blazing orange threat level was essentially as follows:

Is orange bad? What is really bad? Orange sounds horrible. Does this mean my plane is going to explode?
What caused the threat level to be orange? Is there a global terrorism plot targeting the Minneapolis airport on the day I’m flying? Did some high school kid threaten to explode football stadiums?
At what threat level do I not fly? Seriously. If this is supposed to inform me and make me more educated, when do I turn around and go home. Maybe orange? I’m going home, I don’t want to die.
This is stupid.

So I’m back to the beginning, what is the point? Other than making me feel nervous, slightly anxious, remind me that if I’m lucky enough to win the lottery I might have a terrorist incident in the airport. The only real impact this blazing “Threat Level Orange” had on me was to reinforce a low level of fear that is propogated by a variety of government and non-government agencies.

I decided to visit the Department of Homeland Security website and find out what these levels really were. The image to the right is from the DHS website. I love the names. I’ve never, ever, seen green. That really makes sense after all, when are you ever safe. Someone may be stalking you right now, and yes, your plane may blow up. Be afraid, very afraid. Guarded is great. Blue doesn’t make intuitive sense to me on this scale, but I’ll leave that for now. Be guarded, don’t trust those strangers. Then there is the issue of the scale as a whole, is it really linear with these equal bands? It would seem to me that the way a scale like this should work, if it should even exist, is that from 0 to 60 it’s low. In essence, the vast majority of the time. And 61 to 80 is guarded. An exponential, not linear, scale.

Since I cannot determine any value provided to me from this wonderful service other than fear it just strikes me as very Orwellian. What better way to keep people under control than constantly remind them of things that are statistically irrelevant.

Update!

I just went to the DHS website and it looks like the threat level may now be yellow!

Or not? I love this graphic. The top says the threat level is ELEVATED (note the all caps, it’s important) and the yellow bar is highlighted. Then the text says it is HIGH. Turns out that they are just telling us that there is a “significant risk of terrorist attacks” in general, and that in the airlines there is a “high risk of terrorist attacks”. It’s confusing to say the least, but make sure you stay scared.

Watch out!

Weekend Geekfest

Sun, 28 Aug 2005 00:00:00 -0500

I spent a bit of time this weekend on my home network. I had a “security incident” about 10 days ago that I had to both clean-up and prevent from happening again. No damage of any significance was done. I had setout on segmenting my network and replacing my ZyWall with a full-blown firewall. I did not end up there as it just turned out to be way too much work to get going. Instead I reinstated all my firewalls on every machine and pruned down the ports. I also put in place blocking rules on my LAN to WAN connection to block certain traffic that should never originate from my LAN, like IRC for example. This is a nice step-up, although not as robust as my plans were.

I also reformatted and reinstalled my Linux boxes (victims of said “security incident”) with Fedora Core 4. This time I left SELinux enabled and clamped down the firewall more.

I’ve also been working on reducing my electrical load in the house so I’ve made all the desktops go to sleep with inactivity. I was able to setup all of my backup scripts to use Wake-on LAN functionality to turn on in the middle of the night, do their housework, and then go back to sleep and stop spinning the electric dial so much. Of course my servers still have to stay on all the time, but this cuts in half the number of machines powered on at times.

Blog Upgrades

Sat, 16 Jul 2005 00:00:00 -0500

Applied a couple of upgrades to the blog this morning. Decent amount of work that will have absolutely zero impact on you the reader. 🙂 I did a decent amount of research on upgrading from my .Text blogging engine to it’s successor, Community Server. CS is now at 1.1 and it’s improving, but it’s got a lot of pork with forums added. While it is certainly feasible for me to migrate, great people out there have written wonderful tools to help make that possible, I’m going to wait a bit longer I think. Perhaps wait for a 2.0 release. In the meantime I’m stuck using my great, but now dead, open-source .Text package. So, time to spiff it up a bit.

First, I removed all the old spam protection I put on my sites with the random character CAPTCHA and all that and went a different route using this ReverseDOS toolkit from angrypets.com. I just installed it this morning so we’ll see how it goes, but it doesn’t put the burden on a person and tries to make life real hard for spammers.

The second big upgrade was to move from FreeTextBox 1.0 (built into .Text) to FreeTextBox 3.0. The main driver behind this was so I could have a nice, rich editing environment with spell checking in Firefox (FTB 1.0 did not support Firefox). This proved to be a bit of a hassle, lots of trial and error, but I now have it working great. Google is the savior here of course since there are about a dozen sites that tell you how to do it but they all seem to be missing one or two steps. You have to feel your way with Jedi-like focus in order to get it working. These are the best references: DanBartels.CS, Dave Burke (2.0 actually, but steps are helpful) and Markyologist (don’t forget the browsercaps!).

Comment Spam Protection

Thu, 30 Jun 2005 00:00:00 -0500

Just implemented some further spam protection to keep the evil doers at bay. I installed this great add-on that requires entering a validation code before providing feedback. I realize it is a bit of a pain, and sometimes the validation code is hard even for people to read, but it keeps those evil spammers away.

Stopping TrackBack Spam with DotText

Fri, 24 Jun 2005 00:00:00 -0500

I’ve seen a huge increase in trackback spam to my sites lately. It’s now reached hundreds a day. I thought this was one or two hosts so I added a rule to snort to capture trackback spam and found it was coming from nearly all unique IP addresses. I’m guessing this is being propogated via spyware that is sitting on unsuspecting peoples computers. I couldn’t just block this at the router like I do with feedback spam since it was coming from a variety of sources.

I did a quick search after a failed attempt at stopping this with ISAPI URL rewriting because it cannot see POST data. However, a developer in Ireland has solved this problem and been kind enough to share his solution. I just installed it and am waiting to verify everything works well. One concern I have is that his solution is built against DotText 0.95.2004.102 and I’m running 0.95.2004.111. The 111 build was a bug fix build, and the last one that I know of, issued by the author to fix some API issues. So far the Dottext.Framework.dll file seems to work fine intermixed with the other version, but I’m not positive yet.

While typing this I got my first spam alert, check it out

Spam has been detected!!!

Title: black jack
URL: BLAHBLAH
IP Address: 218.244.225.180
Excerpt:

Take your time to visit some helpful info in the field of <A href=“URL REMOVED”>vegas casinos</A>

Looks like the detection part is working! Provided I don’t have anything break I’m going to be a much happier blogger.

Hardcore Geeking!

Sat, 11 Jun 2005 00:00:00 -0500

I’ve been having fun with what I expect will be my last weekend of hardcore geeking with my gear at home for a while. Once Baby Thingelstad arrives I’ll have more important things to do!

This weekend I jammed on two tools. First is Snort, which I have setup in a network intrusion detection mode. I now have one of my Fedora boxes listening on an unnumbered interface to all traffic on my gateway. Snort, with the appropriate ruleset, watches all traffic over the wire and takes note of anything suspicious. Snort then logs this to a mysql database and I’m using BASE to review the information. BASE is nothing to get excited about, but it seems to be the best out there.

I am getting some interesting information out of this rig. I’m pretty amazed at how many times SQL Slammer is still hitting me. It tries to get to me about every 20 minutes. Code Red is less active than it was before, but it’s still out there. Perhaps oddest of all is whoever is at hammurabi.acc.umu.se who is hitting Road Sign Math with a large ICMP packet on a seemingly random interval all day.

The other tool I got going this weekend is Cacti. Cacti is a better (I think?) and easier to use (without a question) SNMP graphing tool than MRTG. I’m going to leave MRTG and Cacti running in parallel probably for ever. Some things I like better in MRTG than Cacti. Cacti uses RRDTool 1.2 (as opposed to 1.0) and generates these super nice images with anti-aliasing and robust font support (static image for example, as compared to.

I’d share access to these tools with you like I do with MRTG and my web logs but they require logins and I also don’t know that I want people being able to see attack alerts my intrusion detection system is throwing. You can admire the login pages from the links at the bottom of the page. As a side benefit of this work I’ve now designated a Linux server as a first-class citizen in my server setup and can now deploy other packages on it in the future if I want.

Google Web Accelerator, Just say NO!

Sat, 07 May 2005 00:00:00 -0500

I’ve got a ton of respect for Google. They do an amazing job with search. Products like Google Maps make my jaw drop. It’s innovative, works exceptionally well and does things that many wouldn’t think you could do in a web browser without client-side software. Their stock, GOOG, has certainly performed well thus far. I think they have a great approach to technology. They push the envelope!

The Google Web Accelerator is one of the newer products from Google Labs and it frankly concerns me. The pitch for the product is to save you time on your web browsing, sounds great right? Well, to do this you assign Google as your proxy server and then funnel all of your web requests through them. They compress things, prefetch things and do a number of other tricks to make browsing faster. This sounds great right?

Well, take note that everything you do in your web browser goes through Google. They say they are not using this information in any way, but I simply wouldn’t trust any company with that much information. The allure is just too much to resist. Google could track every thing you ever look at on any website. They can track how much time you look at each page. They could even take the opportunity to alter the content from the publisher before it gets to you.

Actions like this on the part of Google make the Googlezon story sound more and more realistic. Add to this products like the My Search History from Google and you see a real cauldron of privacy issues starting to boil at Google.

Marketing Security Updates

Sat, 12 Feb 2005 01:00:00 -0500

It was patch week from Microsoft this week. This month brought 9 or 10 security updates depending on your version of Windows. I find it really funny how differently Microsoft and Apple release their security patches.

Microsoft

We get a monthly release of all the security updates. They are packaged individually, which is a good thing since it gives the administrator the ability to not have to apply all of them. They generally have scary sounding names and cryptic looking descriptions. Security Patch for WonderBall.dll (KB123456) for example. And it will usually include words like malicious and takeover. Scary stuff! And wow, there sure are a lot of them. The average person would conclude that this software is horrible.

Apple

MacOS X is a totally different experience. Today, while updating my Windows boxes, I also got to update my Mac. Apple takes a different approach. I just got this nice dialog saying MacOS X 10.3.8 was available and did I want to upgrade my software. The funny thing is there was no mention of security, no words like malicious code. In fact it was completely opaque. If you look into the details though there are dozens of security updates. The whole thing is really a security patch to deal with bugs.

I’m not trying to say that Microsoft doesn’t have security problems. They do. But people that say the MacOS X is so extremely secure need to check reality. And I would suggest Microsoft change their wording but if they did they would be skewered for hiding security problems.

In Code

Fri, 24 Dec 2004 01:00:00 -0500

I just finished reading In Code by Sarah Flannery. Sarah’s book is about her love of mathematics and a project that won her great acclaim in building a new public key cryptography algorithm. The book is light on math, enough to get you interested and is approachable to a variety of skill levels. Sarah was a mere high school student when doing all of this and challenging the famed RSA algorithm. Ultimately her CP algorithm is found to be vulnerable to an attack lessening it’s usefulness but not her story.

The book is an interesting read about a brief moment in this brilliant woman’s life. I think this would be a great read for girls that are interested in math but are far too often discouraged from embarking on it due to societal concerns.

Privacy or the Lack Thereof

Thu, 17 Jun 2004 00:00:00 -0500

“The average American is listed in at least 50 databases, and that’s not counting government files.”

This is the lead line in this article from PC Magazine about the amount of data that is stored about you in all the databases that different corporations have. Privacy on the Internet continues to be a long-term issue that concerns me greatly. I worry that our personal information is becoming a commodity on the network and that it will only be the technically savvy/elite and wealthy that are able to retain some control of their personal information.

What can you do to help ebb the flow? Be aware of this issue! The next time you are at Best Buy and they ask you for your zip code when making a purchase, say no! When asked to give freely information that can be used to give a profile for you, refuse. If you receive value that you feel is justified for turning over this information then go ahead, this is a transaction to buy your personal information. Just don’t give it away!

Organizations like the EFF are keeping an eye on this and they can use your support. Also, there is legislative action going on in this arena and it’s worth being aware of and letting your representatives know you care. With George W. at the helm, who knows what could happen to privacy legislation!