This is the most interesting conference badge I’ve worn

LAS VEGAS–I’ve spent the last two days wearing a circular circuit board topped with a slab of quartz, which is not just normal but required behavior to attend the DEF CON security conference here.

DEF CON 27 badgeI had heard upfront that DEF CON badges–available only for $300 in cash, no comped press admission available–were not like other conference badges. But I didn’t realize how much they differed until I popped the provided watch battery into my badge (of course, I put it in wrong side up on the first try), threaded the lanyard through the badge, and soon had other attendees asking if they could tap their badges against mine.

These badges designed by veteran hacker Joe Grand include their own wireless circuitry and embedded software that causes them to light up when held next to or close to other badges. As you do this with other attendees of various classes–from what I gathered, regular attendees have badges with white quartz, press with green, vendors with purple, and speakers with red–you will unlock other functions of the badge.

What other functions, I don’t know and won’t find out, as I’m now headed back from the event. That’s one way in which I’m a DEF CON n00b, the other being that I didn’t wear any other badges soldered together from circuit boards, LEDs and other electronic innards.

(Update: Saturday evening, Grand, aka “Kingpin,” posted detailed specifics about his creation, including source code and slides from a talk I’d missed.)

You might expect me to critique the unlabeled DEF CON badge for flunking at the core task of announcing your name to others, but forced disclosure is not what this event is about–hence the restriction to cash-only registration. And since I have mini business cards, this badge met another key conference-credential task quite well: The gap between the circuit board and the lanyard was just the right size to hold a stash of my own cards.


What to expect from me on Twitter

A few years ago, the sci-fi author John Scalzi decided to write an explanation of how he uses Twitter, then pinned a tweet linking to that post to his profile so anybody thinking of following him could easily find it. That’s a good idea, so I am stealing it.

Birds want to fly.

What I tweet about: I’ve often used the phrase “public notebook” to describe my tweets–in the sense that I share observations about the things I’m writing about as I learn them. Twitter remains highly useful for that, and for learning about various tech accomplishments and failures as other people report them.

I don’t just stick to tech, though. You will also find me rambling on about politics (writing freelance means I can ignore any stupid newsroom verdicts asking reporters to pretend they don’t think about the issues they cover), food, travel, gardening, space, sports (usually baseball), transportation, architecture, music, and parenting. Yes, there will be dad jokes.

Whom I follow: Most of the nearly 1,000 people I follow have some connection to the tech industry–they’re other tech journalists, analysts, policy advocates or industry executives. I also follow many politicians, in some cases because I think they have notable things to say about tech policy and other cases because I kind of have to (trust me, I’d rather not have Donald Trump’s rants in my timeline). Some companies are in my following list for customer-support purposes, and some friends are there because I like hearing from them. And in one case, I followed a reader by accident after fat-fingering the “follow” button, then decided to let that stand.

Why I might not follow you: While I’ve overcome my early snobbishness about cluttering my timeline with too many people, I’m still not going to follow somebody just because they ask. And “follow me back so I can DM you” is the worst kind of follow-me request. My e-mail address is in my bio for a reason, people!

I use the block button: I still don’t block people all that often, but if somebody is wasting my time with bad-faith arguments, I don’t owe them my attention. And tweeting nutcase conspiracy theories at me–about Seth Rich’s murder, to name the most common–will get you blocked almost immediately.

My DMs aren’t open: Direct messages can be useful as a replacement for text-message banter, but I don’t have my DMs open for everybody for the same reason I don’t invite the world to text me–I don’t need my life to be any more interrupt-driven. So if you were thinking of sending me a PR pitch via DM: My e-mail address is in my bio for a reason.

Retweets might be endorsements: Retweets always mean I want the original tweet to get a wider exposure, but that doesn’t mean I think highly of them. You can be sure that I hate a tweet if I share a screengrab of it to avoid accidentally popularizing that tweet or its author (and I wish more of you would do that instead of having Twitter’s algorithm think some idiot’s output deserves broader publicity). If, however, I retweet without adding any commentary, I probably do approve of that message.

Other notes: I’m frequently sarcastic, which can go over poorly in a medium that destroys context. I often live-tweet events like tech conferences, which can make my feed really busy. I have almost never done any live video on Twitter but probably should. And because I am a sci-fi nerd, my proudest moment on Twitter just might be getting retweeted by Mark Hamill.

Bookmarks for a Web privacy tune-up

I talked at length about privacy when I spoke this morning at the Washington Apple Pi user group’s general meeting–but I realized halfway through that I was keeping too much documentation to myself. As in, I hadn’t remembered to put together a set of links for the privacy settings I discussed.

That’s where this post comes in.

Ad preferences: If you don’t want giant Web platforms to target you with ads based on your browsing history–or if you want to correct some inaccurate targeting–these settings will let you do that.

  • At Amazon, selecting “Do Not Personalize Ads from Amazon for this Internet Browser” will stop the retailer from retargeting you across the Web with reminders of things you searched for. But you’ll have to remember to adjust this in every browser in which you shop at Amazon.
  • Facebook provides more control, allowing you to set “Ads based on data from partners” and “Ads based on your activity on Facebook Company Products that you see elsewhere” to “Not allowed.” You can also see what interests Facebook thinks you have and check which advertisers and businesses have targeted you on the social network with their own uploaded contact lists.
  • At Google, you can see what interests the Web giant has discerned in you and opt out of its ad personalization; taking that step will reward you with the image of the sleeping robot shown above.

Tracking protection: If you use Apple’s Safari, you’re already protected from ad networks’ attempts to follow you around the Web to build a model of your interests. New installs of Mozilla Firefox include a comparable level of default tracking protection, as I wrote at USA Today two weeks ago, but you may need to change these settings yourself. Select “Content Blocking” from the menu, click “Custom” and set it to block trackers “Only in Private Windows” and block only cookies identified as “Third-party trackers.”

You may also want to install the Facebook Container extension to shut down Facebook’s attempts to track you on other sites, although I’m not totally clear on what this adds over the newest tracking protection.

Limit Google’s memory: While Google’s ability to remind you of where you’ve been can be useful, that doesn’t mean it should have unrestricted access to that information. Fortunately, you can now set Google to automatically erase your Web and app activity after three or 18 months. You can also take advantage of the lesser-known of option of setting a sync passphrase for your copies of Google Chrome that will encrypt your browsing history, leaving Google unable to use that data in building a profile of your interests.

Okay, so I am on Patreon now

I launched a Patreon page Monday night, and as I write this, it’s attracted zero supporters. Which means it’s performing as expected—this post is my first attempt to publicize my experiment at this crowdfunding site.

I’ve been thinking of experimenting there since having more than a few people at the XOXO conference in Portland last October suggest I try it myself. Spending too much time checking out how creative types I trust use Patreon and some conversations with two of them (thanks, Glenn Fleishman and Mike Masnick) advanced those thoughts further.

But it took an expiration date to get me to proceed—11:59 a.m. Monday was my last shot at launching a page under more favorable terms than those now on offer under Patreon’s tiered membership structure.

I am cautiously optimistic about how my page could work. I think the value proposition I offer—depending on what tier you pay for, you get content not available elsewhere and, more important, increasing access to my time—is both a fair trade and a reasonable way for me to monetize the scarcest thing in my daily routine, my attention. I also like the idea of having a bit of a sandbox to play in; while I’ve committed to write some patron-only posts and set up a Slack channel, maybe I’ll try doing short podcasts there? There’s nobody to stop me.

But it’s also possible that nobody will support me, and that other people will then point and laugh. That might be chickenshit of them. But it would certainly be chickenshit of me not to try this, not when there are so many things going wrong with the business of journalism.

My own business seems fundamentally sound—at least compared to the cratering existence Jacob Silverman describes in a soul-crushing article at the New Republic. But there’s no such thing as a permanent freelance client, and I would very much like to be less beholden to the tastes, schedules and budgets of my various editors.

So if what I have on offer to patrons strikes you as a good deal, I would very much appreciate your support. And maybe if everything goes well, this new venture will at least make enough to recoup the cost of the XOXO trip that lodged this foolish idea in my head.

AirDrop apologists have some opinions

Who knew suggesting that an Apple interface enabled undesirable outcomes and ought to be changed would be so controversial? Me–I’ve been critiquing Apple’s products since before the company was doooomed in 1996.

But even so, the level of enraged techsplaining that greeted last weekend’s Yahoo post about AirDrop file-sharing has been something else. To recap that briefly: While AirDrop’s default contacts-only setting is safe, accepting a file transfer from somebody not in your contacts requires setting it to “Everyone”–a setting that does not time out but does automatically display a preview of the incoming image. The predictable result: creeps spamming strangers who had set AirDrop to Everyone and then forgot to change it back, and by “spamming” I mean “sending dick pics from iPhones with anonymous names.”

AirDrop settings screen on an iPhone.(For more details, see my Aug. 2017 USA Today column or this Dec. 4 post from the security firm Sophos.)

Suggesting that Apple have the Everyone setting time out or not auto-preview images did not go over well the people–most apparently men–who filled the replies to my tweet Sunday sharing the post. Let me sum up the major points these individuals vainly attempted to make, as seen in quotes from their tweets:

“It’s contacts only by default.” Yes, and if nobody ever interacted with people who weren’t in their contacts and offered to use this handy feature to share in a file, you would have a point. As is, this request comes up all the time–my wife saw it from Apple Store employees–as I explained in the post that these techbros apparently did not finish reading.

“Still trying to make a big deal of something I’ve never experienced.” Thank you, sir, for proving my exact point about the problems of having development teams dominated by white men. As writing about “Gamergate” made obvious, things are often different for the rest of humanity, and “I don’t have this problem” is not a valid defense of a social feature without confirmation from people outside your demographic background. Sorry if asking you to acknowledge your privilege is so triggering, by which I mean I’m not sorry.

“At some point, you have to take some goddamn responsibility.” Ah yes, the old blame-the-customer instinct. I hope the multiple people who expressed some version of “why are you coddling people too dumb to turn Everything off” don’t and never will work in any customer-facing role.

“you don’t have to accept every airdrop item that comes in.” What part of “automatically display a preview” don’t you understand?

“What I don’t understand is why these creeps aren’t reported by the receivers to authorities.” What part of “iPhones with anonymous names” don’t you understand? And before you next resort to victim blaming like this, you should really read up on the relevant history.

“There are far worse UX issues in iOS if that is what you are concerned about.” News flash, whataboutists: I write about problems in the tech industry all the time. Stick around and you’ll see me take a whack at a company besides your sainted Apple.

And that brings me to the annoying subtext beneath all these aggrieved responses: The notion that questioning Apple’s design choice is an unreasonable stretch, so we should look anywhere else for solutions to what even most of my correspondents agreed was a problem. Well, if that’s your attitude, turn in your capitalist card: You’re not a customer, you’re a supplicant. And I don’t have to take your opinion here seriously.

Here’s my Web-services budget

The annual exercise of adding up my business expenses so I can plug those totals into my taxes gave me an excuse to do an extra and overdue round of math: calculating how much I spend a year on various Web services to do my job.

The result turned out to be higher than I thought–even though I left out such non-interactive services as this domain-name registration ($25 for two years) and having it mapped to this blog ($13 a year). But in looking over these costs, I’m also not sure I could do much about them.

Google One

Yes, I pay Google for my e-mail–the work account hosted there overran its 15 gigabytes of free storage a few years ago. I now pay $19.99 a year for 100 GB. That’s a reasonable price, especially compared to the $1.99 monthly rate I was first offered, and that I took too long to drop in favor of the newer, cheaper yearly plan.

Microsoft Office 365

Getting a Windows laptop let me to opting for Microsoft’s cloud-storage service, mainly as a cheap backup and synchronization option. The $69.99 annual cost also lets me put Microsoft Office on one computer, but I’ve been using the free, open-source LibreOffice suite for so long, I have yet to install Office on my HP. Oops.

Evernote Premium

This is my second-longest-running subscription–I’ve been paying for the premium version of my note-taking app since 2015. Over that time, the cost has increased from $45 to $69.99. That’s made me think about dropping this and switching to Microsoft’s OneNote. But even though Microsoft owns LinkedIn, it’s Evernote that not only scans business cards but checks LinkedIn to fill in contact info for each person.

Flickr Pro

I’ve been paying for extra storage at this photo-sharing site since late 2011–back when the free version of Flickr offered a punitively-limited storage quota. This cost, too, has increased from $44.95 for two years to $49.99 a year. But now that Yahoo has sold the site to the photography hub SmugMug, the free tier once again requires serious compromises. And $50 a year doesn’t seem that bad, not when I’m supporting an indie-Web property instead of giving still more time to Facebook or Google.

Private Internet Access

I signed up for this virtual-private-network service two years ago at a discounted rate of $59.95 for two years, courtesy of a deal offered at Techdirt. Absent that discount, I’d pay $69.95, so I will reassess my options when this runs out in a few months. Not paying for a VPN service, however, is not an option; how else am I supposed to keep up on American news when I’m in Europe?

LastPass Premium

I decided to pay for the full-feature version of this password manager last year, and I’m already reconsidering that. Three reasons why: The free version of LastPass remains great, the premium version implements U2F two-step verification in a particularly inflexible way, and the company announced last month that the cost of Premium will increase from $24 a year to $36.

Combined and with multi-year costs annualized, all of these services added up to $258.96 last year. I suspect this total compares favorably to what we spend on news and entertainment subscriptions–but that’s not math I care to do right now.

LastPass shows how to do two-step verification wrong

I finally signed up for LastPass Premium after years of using the free version of that password-management service. And I’m starting to regret that expense even though $2 a month should amount to a rounding error.

Instead of that minimal outlay, I’m irked by LastPass’s implementation of the feature I had in mind when typing in credit-card digits: support for Yubikey U2F security keys as a form of two-step verification.

Two-step verification, if any reminder is needed, secures your accounts by confirming any unusual login with a one-time code. The easy but brittle way to get a two-step code is to have a service text one to you, which works great unless somebody hijacks your phone number with a SIM swap. Using an app like Google Authenticator takes your wireless carrier’s security out of the equation but requires regenerating these codes each time you reset or switch phones.

Using a security key–Yubikey being one brand, “U2F” an older standard, “WebAuthn” a newer and broader standard–allows two-step verification independent of both your wireless carrier and your current phone.

Paying for LastPass Premium allowed me to use that. But what I didn’t realize upfront is that LastPass treats this as an A-or-B choice: If you don’t have your Yubikey handy, you can’t click or type a button to enter a Google Authenticator code instead as you can with a Google account.

A LastPass tech-support notice doesn’t quite capture the broken state of this user experience:

If multiple Authentication methods are used, only one will activate per login attempt. If you disable one, then another will activate on the next log in attempt. Because only one activates at a time, you cannot have multiple prompts during the same log in.

The reality you see if you happened to leave your Yubikey at home or just have your phone closer at hand: an “I’ve lost my YubiKey device” link you’re supposed to click to remove that security option from your account.

This absolutist approach to two-step verification is not helpful. But it’s also something I should have looked up myself before throwing $24 at this service.