cellio: (Default)

A few weeks ago I created an account on Mastodon and have been trying it out as an alternative to Twitter (and I suppose Facebook, which I don't use). I'm not leaving Dreamwidth, my friends here, and DW's support for longer-form posts; DW and "social platforms" are good at different things.

As I mentioned in a previous post, the part of the Mastodon community (-ies) that I've encountered so far feels to me like the earlier days of the Internet. It feels more friendly, helpful, and supportive than even pre-Musk Twitter (driven by algorithms and ad sales). It kind of reminds me of some of the more social Usenet newgroups of yore, like the Rialto and alt.callahans.

It's different, and different takes time to get used to, and different is sometimes better and sometimes worse. And getting set up isn't going to be as easy as going to Twitter or Facebook and clicking "sign up".

barriers to entry

I actually looked at Mastodon back in the spring, when the Twitter thing was starting to happen, but I bounced. You see, Mastodon isn't a service, like Twitter or Facebook is; it's a federated platform. The best analogy I've seen to setting yourself up on Mastodon is getting an email address. You can get email services from lots of places and they all inter-operate. Choose Gmail or outlook.com or your ISP's bundled account or your own server or anything else; no matter what you choose, you'll be able to send and receive email. Email providers aren't all the same and you might find your choices have consequences -- Gmail silently nukes certain messages and you'll never know, and aol.com is oft seen as a bad neighborhood. You choose an email provider, follow its rules, and deal with its issues -- and if you decide to move later, with some disruption you can. Your choice matters some, but it's not permanent.

Mastodon servers are like that. There are hundreds, maybe thousands, of Mastodon servers out there, and there are lists of recommended servers that you can find with a search for something like "find mastodon server", and from the outside it can be overwhelming. Back in the spring I saw that I had to Make Decisions first, and I didn't know enough to make decisions, and I hadn't seen the email analogy, and I was only casually looking and wasn't invested...and I walked away.

All of that is true today, too, except that more of my friends were moving there so I had a reason to dig a little deeper.

I found one of those pages of "50 servers you might consider" or some such, many of which are aligned to particular interests like Linux or open-source software or furries or art, and started browsing things I wouldn't mind being affiliated with. (Your Mastodon server, like your email provider, shows up in your "address", so there's an appearance aspect to it.) Servers can have their own moderation rules and terms of service and those are things I care about, so I read those pages on short-list candidates, eliminating some by what I found there. I identified a server that aligned well with my interests, my views on moderation, and the expected local conversation (more about that in a bit), and applied for an account.

Yeah, "applied" in this case. Some servers are totally open -- anyone can create an account. Some were but then Twitter started to implode and servers that had had 5000 people were seeing tens of thousands of new accounts and buckling under the load, so they went to a wait-list model. The server I joined asked for a short "why do you want to join this server?" message.

There are some huge, general-purpose, open servers. I recommend against trying to join them now. Across the network of all public Mastodon servers, there were something like a million new accounts in the first week of the Musk era. These servers aren't usually being run by well-funded megacorps but by mostly volunteers trying to keep up with demand.

the fediverse

Mastodon isn't a single site or a single thing. It'd decentralized and distributed. "Mastodon" is the name of the software. Strictly speaking, when you join a Mastodon server you are joining a server that is part of "the fediverse" -- "fed" like in "federated". People talk about being "on Mastodon", and what they mean is "on one of these servers", and sometimes a well-meaning person tries to correct your terminology, and I want to give y'all a heads-up.

The fediverse has other "things" besides Mastodon. There's a whole big set of open-source projects for sharing different kinds of things across a network, with an interface called ActivityPub at the center of it. I don't know very much about that stuff yet.

So, technically: there is the fediverse, and Mastodon servers are part of it, and so are other things. But there's no mastodon.com that runs it all, like twitter.com or facebook.com. Remember: like email, not like corporate social media.

(There is a mastodon.com. Of course there is; every URL you can imagine that consists of a single English word is claimed by someone. This one is a forestry site.)

sounds like a lot of work; how's this better than Twitter?

Still with me?

On the surface Mastodon looks kind of like Twitter, federation aside. You can see short posts from other people in a feed, and you can interact with them (liking them, replying to them, etc). There's a big difference, though, and I think it's an important difference that helps with constructive discourse instead of amplifying the loudest people.

Twitter creates, and Google+ after the early days created, a "feed" for you, curated by an algorithm. I don't know how G+'s worked; on Twitter, a post (tweet) is more likely to show up in your feed if it's posted by someone with a lot of reach (the reach get reacher), or if it has a lot of likes (encourages socks, bots, and echo chambers), or if it's somehow connected to someone you follow. That last seems to be the least important, anecdotally. I almost never use my Twitter feed because it's full of stuff I don't care about. In Musk's Twitter, rumor has it that paid members also get substantial priority.

Mastodon gives you multiple feeds (I'll get back to that), and the "algorithm" is "reverse chronological", like it is here on DW and probably on every blogging site you've ever used. You see stuff as it was posted, not something yanked out of its context from three days ago and pushed at you now, and not yanked out of its context of all the other conversation happening around it. Nothing has priority; you get what you asked for, in order. I've found the things I read and interact with here on DW to be much more thoughtful, nuanced, and civil than what I see on Twitter (granted post length is a factor too), and so far that's what I'm seeing on Mastodon too. (BTW, posts on Mastodon are by default 500 characters, larger than Twitter, and it's a server setting. I've seen one server that lets you use 5000 characters so long as you put most of it behind a cut tag.)

Mastodon also gives you multiple feed options, so you can choose the size of your fire hose. You can see just posts from (or boosted) by the people you follow, or just posts from your local server (regardless of who you follow), or a "federated" view that reaches out to other servers and does, um, something based on the people you follow and their connections. I haven't explored that one much yet. It's big. But it's still reverse chronological, no prioritization, no buying or shouting your way into top position.

I think that local feed will end up being pretty important. If you choose a server that aligns with some of your interests, then that "local" view can connect you with people who share those interests. Because people are usually multi-faceted and the instance is a home, not a topic restriction, you'll see a variety of content from the people there. It's not like Usenet newsgroups or Codidact communities where you can only talk about this thing here and not that thing, but there's a rough sort based on some shared interest, if you want to use that. (Of course, if you want to create multiple accounts on multiple servers, for example to separate personal and professional content, you can do that too.)

I'm being an armchair sociologist here with too few observations and no data, but I think this "local community of multi-faceted people" aspect will act somewhat like physical neighborhoods (back when we socialized with our neighbors, but maybe your barony or congregation is a model too) or like the more social Usenet groups. Because these online neighborhoods aren't bounded by geography or (probably) by culture, the people I see on that local feed are more heterogeneous, more diverse, more "like me in some ways, very unlike me in others". I hope easy interaction with that community will help build connections and resist polarization. I'm game to try the experiment, at least. On Twitter, only the loudest (and probably most extreme) "people not like me" would make it to the feed, the feed that was overrun with topics I don't care about from people I don't know so I never looked at it anyway -- but if I did look, I wouldn't find the "regular people", only the people with big fan followings.

(Aside: a week or so ago I came across a server for my city. So physical neighborhoods might be represented too.)

boosts and retweets

On Twitter, you can "retweet" something, which means "show this to my followers". On Twitter you can also retweet and add your own message. If you've seen tweets that embed other tweets, that's what's happening. So you might see Musk's latest policy flip-flop and retweet to your followers, adding a snarky comment of your own, and your retweet will be its own tweet, not part of the thread of replies to the original tweet.

On Mastodon you can "boost" something, which is like that first kind of retweet. I saw something that I wanted to add my own message to (further support in my case, not snark), and I couldn't figure out how to do it -- the "boost" button doesn't have an option for adding a comment. On investigation, I learned that this was an intentional design choice.

My initial reaction was "huh, weird". Then I thought "ok, maybe if you can't easily snipe at people you'll be less likely to snipe, so maybe that improves the climate?" and that sounded like a good idea. But since then I've seen more cases where it would have been helpful to either add something (as the booster) or comment to the booster not the original poster (as a reader). So I'm not sure how I feel about this now.

You can always do this manually, of course -- you can link to anything, after all. You won't get the fancy rendering, that thing that looks like an embedded tweet on Twitter. But if you decide to just boost something, instead of creating your own post, then people who want to respond to you can't. Like, if you didn't know that that thing you boosted has been debunked or has more context or something like that... no easy way to do that.

mindset

Mastodon, and the fediverse in general, exudes a scrappy "do more for yourself" mindset. There's no single entity making decisions for you -- what you see, how it's moderated, how the software works, etc. Servers are run by ordinary people who make those decisions for their servers only. Norms can vary. I expect that the most successful servers operate by some form of consensus, either up front or emergent (as people opt in or out). Servers can block other servers, so there's some level of shared baseline to operate in polite society. You can set up your own neo-Nazi server if you want to, but you might find that a lot of people don't want to talk with you.

I've seen the fediverse compared to anarchy (you and those with shared goals can do whatever you want), and I've also seen it compared to fiefdoms (somebody controls your server and it's probably not you). I don't think it's a fiefdom in the way that Twitter is; first, you can move to a different server, and second, that you can set up your own server for you and your friends mitigates if you don't like any of the options. A serf can't just say "well I'll take that land over there and do my own thing", because all land is ultimately owned by someone. On the Internet, you can buy a domain and set up shop -- the space isn't wholly owned. But whether you're a serf or an Internet denizen unhappy with the existing servers, you have to do work -- setting up your own place isn't free. And that effort can be a substantial barrier, too. So it's not a complete mitigation for networks with problematic owners, but I think we'll be better off on the fediverse than on Twitter or Facebook, which feels like an even bigger fiefdom to me. Time will tell.

cellio: (Default)

If you are using your Twitter account to sign in to other sites ("the "sign in with Google/Facebook/Twitter/etc" system), you should stop doing that now. Also, if you are using SMS for two-factor authentication with Twitter, that same article has advice for you. Some parts of their 2FA setup have stopped working, and apparently SMS validation is now unreliable.

There is an outstanding thread -- on Twitter, natch -- about the kinds of things that SREs (site reliability engineers, the people who keep large systems running) worry about. Parts of large systems fail all the time; in a healthy setup you'll barely notice. Twitter is, um, not healthy.

Debirdify is a tool for finding your Twitter friends on the Fediverse (Mastodon), for those who've shared that info. It looks for links in pinned tweets and Twitter profile ("about") blurbs.

I'm at https://indieweb.social/@cellio, for anyone else who's there. I'm relatively new there, like lots of other folks, but so far the vibe takes me back to the earlier days of the Internet -- people are friendly, help each other, presume good intent, and have actual conversations. It is not Twitter; some intentional design choices appear to encourage constructive use and hinder toxicity. I hope to write more about Mastodon later.

cellio: (Default)

John Bull wrote a post (in tweet-sized pieces, naturally) that rings true for me, and he gave a name for the phenomenon we're seeing with Twitter, saw with LiveJournal, and partially saw with Stack Overflow. The thread starts here on Twitter and here on Mastodon (the Fediverse). Selected quotes:

One of the things I occasionally get paid to do by companies/execs is to tell them why everything seemed to SUDDENLY go wrong, and subs/readers dropped like a stone. So, with everything going on at Twitter rn, time for a thread about the Trust Thermocline.

So: what's a thermocline?

Well large bodies of water are made of layers of differing temperatures. Like a layer cake. The top bit is where all the the waves happen and has a gradually decreasing temperature. Then SUDDENLY there's a point where it gets super-cold.

The Trust Thermocline is something that, over (many) years of digital, I have seen both digital and regular content publishers hit time and time again. Despite warnings (at least when I've worked there). And it has a similar effect. You have lots of users then suddenly... nope. [...]

But with a lot of CONTENT products (inc social media) that's not actually how it works. Because it doesn't account for sunk-cost lock-in.

Users and readers will stick to what they know, and use, well beyond the point where they START to lose trust in it. And you won't see that.

But they'll only MOVE when they hit the Trust Thermocline. The point where their lack of trust in the product to meet their needs, and the emotional investment they'd made in it, have finally been outweighed by the physical and emotional effort required to abandon it. [...]

Virtually the only way to avoid catastrophic drop-off from breaching the Trust Thermocline is NOT TO BREACH IT.

I can count on one hand the times I've witnessed a company come back from it. And even they never reached previous heights.

cellio: (Default)

I've participated in a lot of online communities, and a lot of types of online communities, over the decades -- mailing lists, Usenet, blogging platforms like Dreamwidth, web-based forums, Q&A communities... and social media. With the exception of blogging platforms, where readers opt in to specific people/blogs/journals and the platform doesn't push other stuff at us, online communities tend to end up with some level of moderation.

We had (some) content moderation even in the early days of mailing lists and Usenet. Mostly[1] this was gatekeeping -- reviewing content before it was released, because sometimes people post ill-advised things like personal attacks. Mailing lists and Usenet were inherently slow to begin with -- turnaround times were measured in hours if you were lucky and more typically days -- so adding a step where a human reviewed a post before letting it go out into the wild didn't cost much. Communities were small and moderation was mostly to stop the rare egregiously bad stuff, not to curate everything. So far as I recall, nobody then was vetting content that way, like declaring posts to be misinformation.

On the modern Internet with its speed and scale, moderation is usually after the fact. A human moderator sees (or is alerted to) content that doesn't fit the site's rules and handles it. Walking the moderation line can be tough. On Codidact[2] and (previously) Stack Exchange, I and my fellow moderators have sometimes had deep discussions of borderline cases. Is that post offensive to a reasonable person, or is it civilly expressing an unpopular idea? Is that link to the poster's book or blog spam, or is the problem that the affiliation isn't disclosed? How do we handle a case where a very small number of people say something is offensive and most people say it's not -- does it fail the reasonable-person principle, or is it a new trend that a lot of people don't yet know about? We human moderators would examine these issues, sometimes seek outside help, and take the smallest action that corrects an actual problem (often an edit, maybe a word with the user, sometimes a timed suspension).

Three things are really, really important here: (1) human decision-makers, (2) who can explain how they applied the public guidelines, with (3) a way to review and reverse decisions.

Automation isn't always bad. Most of us use automated spam filtering. Some sites have automation that flags content for moderator review. As a user I sometimes want to have automation available to me -- to inform me, but not to make irreversible decisions for me. I want my email system to route spam to a spam folder -- but I don't want it to delete it outright, like Gmail sometimes does. I want my browser to alert me that the certificate for the site I'm trying to visit isn't valid -- but I don't want it to bar me from proceeding anyway. I want a product listing for an electronic product to disclose that it is not UL-certified -- but I don't want a bot to block the sale or quietly remove that product from the seller's catalogue.

These are some of the ways that Twitter has been failing for a while. (Twitter isn't alone, of course, but it's the one everyone's paying attention to right now.) Twitter is pretty bad, Musk's Twitter is likely to be differently bad, and making it good is a hard problem.[3]

Twitter uses bots to moderate content, and those bots sometimes get it badly wrong. If the bots merely flagged content for human review, that would be ok -- but to do that at scale, Twitter would need to make fundamental changes to its model. No, the bots block the tweets and auto-suspend the users. To get unsuspended, a user has to delete the tweets, admit to wrongdoing, and promise not to do it "again" -- even if there's nothing wrong with the tweet. The people I've seen be hit by this were not able to find an appeal path. Combine this with opaque and arbitrary rules, and it's a nightmare.

Musk might shut down some of the sketchier moderation bots (it's always hard to know what's going on in Musk's head), but he's already promised his advertisers that Twitter won't be a free-for-all, so that means he's keeping some bot-based moderation, probably using different rules than last week's. He's also planning to fire most of the employees, meaning there'll be even fewer people to review issues and adjust the algorithms. And it's still a "shoot first, ask questions later" model. It's not assistive automation.

A bot that annotates content with "contrary to CDC guidelines" or "not UL-certified" or "Google sentiment score: mildly negative" or "Consumer Reports rating: 74" or "failed NPR fact-check" or "Fox News says fake"? Sure, go for it -- we've had metadata like the Good Housekeeping seal of approval and FDA nutrition information and kashrut certifications for a long time. Want to hide violent videos or porn behind a "view sensitive content" control? Also ok, at least if it's mostly not wrong. As a practical matter a platform should limit the number or let users say which assistance they want, but in principle, fine.

But that's not what Twitter does. Its bots don't inform; they judge and punish. Twitter has secret rules about what speech is allowed and what speech is not, uses bots to root out what they don't like today, takes action against the authors, and causes damage when they get it wrong. There are no humans in the loop to check their work, and there's no transparency.

It's not just Twitter, of course. Other platforms, either overwhelmed by scale or just trying to save some money, use bots to prune out content. Even with the best of intentions that can go wrong; when intentions are less pure, it's even worse.

Actual communities, and smaller platforms, can take advantage of human moderators if they want them. For large firehose-style platforms like Twitter, it seems to me, the solutions to the moderation problem lies in metadata and user preferences, not heavy-handed centralized automated deletions and suspensions. Give users information and the tools to filter -- and the responsibility to do so, or not. Take the decision away, and we're stuck with whatever the owner likes.

The alternative would be to use the Dreamwidth model: Dreamwidth performs no moderation that I'm aware of, I'm free to read (or stop reading) any author I want, and the platform won't push other content in front of me. This works for Dreamwidth, which doesn't need to push ads in front of millions of people to make money for its non-existent stockholders, but such slow growth is anathema to the big for-profit social networks.

[1]: It was possible to delete posts on Usenet, but it was spotty and delayed.

[2]: The opinions in this post are mine and I'm not speaking for Codidact, where I am the community lead.

[3]: I'd say it's more socially hard than technically hard.

cellio: (Default)

Every now and then I remember to look at my web site's traffic. Every month my site produces a few hundred "URL not found" errors, and almost all of them are related to Wordpress -- wp-login.php, xmlrpc.php, and wlwmanifest.xml (tried at a bunch of entry points, each exactly 30 times in the last 30 days, presumably a daily probe).

I don't run Wordpress -- never have. But I guess it's popular enough, and has bugs or security holes, that people find it worthwhile to send their bots to look for it on every web site they can find?

cellio: (Default)

As the whole Internet knows, Facebook and other stuff they own were all down for several hours a few days ago. They were off the network entirely: DNS couldn't resolve their host names. A post from Cloudflare describes what happened from the outside, including explaining how some of the key parts work (like BGP and Autonomous Systems, terms I learned this week), and a post from Facebook explains what happened inside.

From Cloudflare:

Due to Facebook stopping announcing their DNS prefix routes through BGP, our and everyone else's DNS resolvers had no way to connect to their nameservers. Consequently, 1.1.1.1, 8.8.8.8, and other major public DNS resolvers started issuing (and caching) SERVFAIL responses.

But that's not all. Now human behavior and application logic kicks in and causes another exponential effect. A tsunami of additional DNS traffic follows.

This happened in part because apps won't accept an error for an answer and start retrying, sometimes aggressively, and in part because end-users also won't take an error for an answer and start reloading the pages, or killing and relaunching their apps, sometimes also aggressively.

[...] So now, because Facebook and their sites are so big, we have DNS resolvers worldwide handling 30x more queries than usual and potentially causing latency and timeout issues to other platforms.

Also, today I learned that Cloudflare owns 1.1.1.1. They don't seem old enough to have been issued that; did they buy it from someone?

From Facebook:

When you open one of our apps and load up your feed or messages, the app’s request for data travels from your device to the nearest facility, which then communicates directly over our backbone network to a larger data center. [...] The data traffic between all these computing facilities is managed by routers, which figure out where to send all the incoming and outgoing data. And in the extensive day-to-day work of maintaining this infrastructure, our engineers often need to take part of the backbone offline for maintenance — perhaps repairing a fiber line, adding more capacity, or updating the software on the router itself.

This was the source of yesterday’s outage. During one of these routine maintenance jobs, a command was issued with the intention to assess the availability of global backbone capacity, which unintentionally took down all the connections in our backbone network, effectively disconnecting Facebook data centers globally. Our systems are designed to audit commands like these to prevent mistakes like this, but a bug in that audit tool prevented it from properly stopping the command.

This change caused a complete disconnection of our server connections between our data centers and the internet. And that total loss of connection caused a second issue that made things worse.

To ensure reliable operation, our DNS servers disable those BGP advertisements if they themselves can not speak to our data centers, since this is an indication of an unhealthy network connection.

And then the measures that protect their data centers from tampering kicked in when engineers tried to fix it.

They don't say, and I don't know, what the command was that was meant to query the network and actually shut it down. Yes they had (faulty) auditing, but I have more fundamental questions, like: was there no "this will take down the network; are you sure? (Y/N)" check in that command?


Edited to add: I just came across a good explanation by [personal profile] mdlbear.

cellio: (Default)

This is oddly fascinating, even though I don't understand all of it. If I understand correctly:

A "short" is a bet that a stock price will fall: you promise to sell it on a certain date at a certain price, but you don't actually own the shares. On that day, the idea goes, you'll buy the shares at the lower price you expect and then turn around and fulfill your contract, pocketing the difference. I don't know if regular folks like you and me can do that, or if only investment funds and professional stock-market people can. There are some rules that are different for the big players and the little folks; I don't know if this is one of them.

So... some big Wall Street hedge funds (one often mentioned is Melvin Capital) placed vast quantities of shorts on a gaming-gear company that isn't doing well (GameStop). A bunch of people on Reddit observed this and said to Wall Street: hold my beer.

They bought the stock. Hundreds of thousands of people on Reddit bought the stock. At that scale, any individual participant doesn't have to buy a lot; you could play this game for $20 back when it started. And it's not like you can spend that $20 going out to a movie right now, so there was probably an untapped market of bored people looking for fun.

Did I mention that this subreddit bills itself as "like 4Chan for investers"? And did I mention that Elon Musk tweeted about it to his 42 million followers? That subreddit has way more than "hundreds of thousands" of subscribers now.

What happens when lots of shares of a stock start getting bought? The price goes up. The price for GameStop shot up from less than $20 to, at one point, $347. And I think it was higher; I was only able to find daily closing prices, and the hour-by-hour swings have reportedly been wild. There's some background information on CNet.

The stock price, of course, won't stay high. It's a ridiculous price for that company, and eventually the market will bring it back down. But in the meantime, those hedge funds holding shorts have lost billions of dollars -- remember, they still have to buy the stock on "short day", at whatever price is then current, and then sell it for $10 or whatever the bet was.

The Redditors and crew, meanwhile, have turned their sights to other stocks; Blackberry and AMC have been mentioned as other companies in trouble that investors have considered prime candidates for shorts. Stock exchanges and Robinhood have stopped trading at times or restricted purchases.

By the way, the people rallying against Wall Street have a song -- a sea shanty:

I don't know what a "tendieman" is (Google has been unhelpful), though I assume it has to do with tendering, in this case selling at the right time. Ryan Cohen is a major investor in GameStop who's recently been investing more and trying to change the company's business strategy, though I can't tell if he has an actual position there. (The song implies he's on the board.)

As far as I know, the people organizing on Reddit and wherever else aren't doing anything illegal. They're not insider traders with privileged information -- quite the opposite. They're just...massively trolling big investors who traditionally make a lot of money with these kinds of bets. Some of them seem to be in it for the laughs; some are trying to make money riding this (but a lot of them will probably lose money, including anybody who tries to join in now). The line between a movement and a mob can be fuzzy; I'm not sure which this is. I wonder what the other damages are going to be. They're pitching this as little people versus big investors, but will little people with modest retirement funds end up taking some of that damage in those funds too? Or are hedge funds more esoteric and not usually part of IRAs and suchlike?

Bizarre, fascinating, and unsettling.

cellio: (Default)

Someone who can self-identify if desired shared Google's summary of the recent email outages (PDF). This is the outage that caused my address (and many others) to start sending permanent bounce messages.

Background: The Gmail SMTP inbound service uses a configuration system that allows specific service options and flags to be changed while the service is already deployed in production. The "gmail.com" domain name is specified as one of these configuration options. An ongoing migration was in effect to update this underlying configuration system to meet Google internal best practices.

A configuration change during this migration shifted the formatting behavior of a service option so that it incorrectly provided an invalid domain name, instead of the intended "gmail.com" domain name, to the Google MTP inbound service. As a result, the service incorrectly transformed lookups of certain email addresses ending in "(at)gmail.com" into non-existent email addresses. When the Gmail user accounts service checked each of these non-existent email addresses, the service could not detect a valid user, resulting in SMTP error code 550.

[...]

To guard against the issue recurring and to reduce the impact of similar events, we are taking the following actions:

  • Update the existing configuration difference tests to detect unexpected changes to the SMTP service configuration before applying the change.
  • Improve internal service logging to allow more accurate and faster diagnosis of similar types of errors.
  • Implement additional restrictions on configuration changes that may affect production resources globally.
  • Improve static analysis tooling for configuration differences to more accurately project differences in production behavior.

Ouch.

Fixing things in production systems is hard. I've been there; things can go wrong, sometimes badly wrong. I'm used to thinking of Google as having near-infinite resources, including a replica of their production system to test changes on. Perhaps that's unrealistic.

cellio: (Default)

There's apparently another widespread Gmail outage, but this one is more harmful -- it's lying to senders about addresses being invalid (permanent error).

This might be the swift kick in the rear that I needed to figure out a different approach to email. I have a domain, so I should set up a single "collector" address there to receive everything I'm currently forwarding to Gmail (which I'll have to hunt around for; Pobox is easy but not the only one). I hadn't done that before because I thought that relying on Google (a huge, hardened service) was a safer bet than relying on my domain -- what happens if my domain gets hijacked, my hosting company compromised, etc? Rethinking that now...

Fortunately, I'm already forwarding Pobox to an address on my domain, a backup for Gmail, so I probably haven't lost anything. But I might be getting silently dropped from mailing lists I cared about. We'll see.


Ok, I think I now have everything going to one mailbox on my domain and, from there, mirrored to Gmail for now. I'd like to have all my mail in one place, but the last download of my Gmail mailbox was a 10G file in mbox format, which I don't know how to read or plug in to something else. (I mean, obviously that's a standard format, but what can I use on my Mac to read it?) I don't really want to store all that on my domain server long-term (it'd raise my storage costs), but there's probably a lot of junk in it, mixed in with the stuff I care about. I'd already done some passes to, for example, nuke years-old mailing-list threads that I don't care about now, because Google has storage limits, but that's time-consuming.

I welcome input from people who've wrangled large mailboxes, domains, and email more generally.

cellio: (Default)

Dear brain trust,

On my domain, I have email addresses that collect a local copy (i.e. I can use webmail on my domain to read them) and also forward a copy to my Gmail address. This is particularly helpful for low-volume addresses that I might not otherwise check frequently.

Today somebody with whom I'd been corresponding contacted me via another channel to report that his email was now being rejected -- by Gmail. Sure enough, the copies are sitting in my domain mailbox just fine, but there's no sign of them at Gmail -- not in trash, not in spam, just not there. Gmail seems to have decided to reject them and not even tell me.

I have questions.

  1. How do I get Gmail to stop doing that, at all? If email is sent to my Gmail address, especially by my own forwarder!, I want it to show up there. In the spamtrap is fine if Google thinks it is. Silent deletion is Not Ok.

  2. If I can't get Gmail to stop doing it, can I get notifications somewhere?

  3. I expected the forwarding from my domain to Gmail to be a private matter between those two parties. Why did the Gmail rejection get all the way back to the sender? Why did I not receive a notice of the rejection at my domain address, which is what sent it along to Gmail? Is there something I can do, presumably via CPanel, to intercept rejections by forwarding addresses?

  4. Gmail has filters, which can be used to process incoming email in various ways. I've used them to whitelist a few senders that Gmail thinks are spammers that aren't. When in the pipeline do filters get applied? I think it's after this rejection it's doing, since the message goes nowhere that I can see, but I've whitelisted this particular address now in any case.

cellio: (Default)

This is surreal. A year ago, somebody entering data on Open Street Map recorded a suburban building as being 212 stories. A backyard shed, apparently. It seems to have been an honest typo, later corrected. It happens. No big deal, right?

The error was later corrected by another [profile] openstreetmap user, BUT, in the interim, Microsoft took an export of the data and used it to build Flight Simulator 2020. The result... this incredible monolith (2/2)

The original thread where people tracked it down is hilarious.

cellio: (Default)

A long time ago, I created a YouTube account to post a video to which I hold copyright. Later, Google bought YouTube. Time passed and I mostly forgot about that video.

Recently it's attracted attention and a troll. I would like to take it down.

Old YouTube accounts no longer work; you can't sign in with them. They have a way to claim old accounts, but it is not accepting the password I used (and recorded) at the time, nor any plausible variants. I can prove it's my account; I get email when somebody interacts with it (which is how I was alerted to the newer attention).

I've long since learned my lesson about relying on third-party media-hosting services (yeah, still have a lot of pictures hosted at LJ and Google that I haven't yet cleaned up on this journal). But I need to repair this error from the past.

I could file a DMCA takedown request, but that's the nuclear option and I don't know what repercussions it will have for the account owner, i.e. me.

Does anybody reading this know a better path? No, there's no "contact us" form, and their Twitter responder doesn't do anything other than send links to help I've already read.

cellio: (Default)

I have a lot of links I've been meaning to share accumulating in tabs, tweets, and whatnot. I'd wanted to "curate" this more, but sharing something is better than sharing nothing because I didn't get to that, so...

cellio: (Default)

Steven Bellovin, one of the creators of Usenet 40 years ago, has written a retrospective and history of the project. I've actually had this open in a tab for a while; when I first came across it about half the articles had been posted and there were placeholders for the rest. He's now finished it.

This is a mix of technical and political history. At the time I was using it (I gained access around 1983, I think), I didn't know any of the background; to me as a student, ARPANet and Usenet were just two different networks that moved stuff around. (My experience of ARPANet at the time was limited to mailing lists.) I knew that Usenet was decentralized (unlike ARPANet, a government network), but I didn't at the time know the extent to which it was put together by a scrappy band of grad students with limited resources and an attitude of "it's easier to ask forgiveness than get permission". Or so it seems to me in reading this series of posts, anyway.

I learned a lot about the behavior of networked communities on Usenet. I made lots of mistakes, of course; I mean, not only was it a new concept to me, but I was an undergrad without a lot of broad, cultural experience outside my own. And even though I was a bumbling student learning the ropes, I could participate alongside everyone else there -- what you wrote and how well you communicated mattered a lot more than who you were. I -- a lowly undergrad and relative newcomer -- was taken seriously by the architects in planning the Great Renaming. Later the New Yorker would publish that famous cartoon about how on the Internet nobody knows you're a dog; even before that, I had already learned that on Usenet nobody knows (or cares) that you're an undergrad, or insert-demographic-here, or whatever. In retrospect, this might have been somewhat formative for me online.

Technologies change and communities change. Spammers got more aggressive, some of the communities I participated on either scattered or moved elsewhere, and the web emerged as a new way of interacting online. I preferred mailing lists to web forums (because email is push and web sites are pull; this was before syndication was a thing), and then I discovered blogs and LiveJournal. I gradually drifted away from Usenet. And over time I drifted away from some of those other things in favor of yet other things; online communities aren't done evolving by a longshot. (And then there's social media, which feels...different from intentional communities to me. Less cohesive, more episodic and sound-bite-ish.) I imagine that looking back to today in 40 more years will seem just as foreign and quaint as looking back to the beginnings of Usenet must seem to those who weren't around at the time.

cellio: (Default)

I remember, when traveling in the 90s and into the 00s, looking for hotels with business centers, where I could use their computer to check my email. Technical and geek conventions that set up actual terminal rooms for this purpose were golden. (This happened even in the 80s for sufficiently-geeky contexts.) But mostly, the connected traveler was responsible for figuring it out or just doing without.

After reliance on quasi-public computers came the rise of laptop computers. I was late to this phase, only getting a laptop of my own in (I think) 2006. For the next while, I looked for hotel rooms that had ethernet ports. I took that laptop when traveling not for any work purpose but so I could access my email (and, on big vacations, upload photos somewhere so I didn't risk a single point of failure). I carried an ethernet cable for years. (I have a story from this time about having to fall back to a public computer, or rather a public computer's network connection that I probably wasn't supposed to touch, so public computers were still an occasional thing.)

A few years after the rise of hotel ethernet ports, places (hotels, restaurants, etc) started to advertise free WiFi. I still carried that ethernet cable because you could never be sure, and if there was an ethernet port I still preferred it. I only started to pay attention to public WiFi when I got a smartphone and later a tablet (which can't use ethernet). The smartphone's data plan had limits, so public WiFi seemed useful if I wasn't doing anything that required extra care. (Surfing yes, online banking no -- that kind of thing.)

I used a hotel's WiFi as recently as January, when I found evidence of some unwelcome probes that I couldn't explain any other way. After that I realized that for practical purposes I have unlimited data (it gets slower after 2GB/month but I rarely exceed that). At Origins a couple weeks ago, I dutifully took the piece of paper the hotel desk gave us with the WiFi access information, dropped it on a table in the room, and never touched it again, preferring to use my phone to create a hotspot so I could use my tablet. Much safer.

I'm back to arranging my own access and not looking for public accommodations. I feel like I've gone in a circle.

cellio: (demons-of-stupidity)

The last couple times I've tried to have a Google Hangout from my desktop computer, we have had audio problems. Specifically, the other people could hear me just fine, but I couldn't hear them. The "test" button in the Hangouts settings produced sound just fine, and other applications produced sound. The last time this happened I resorted to joining the call from both my computer (for video and screen-sharing) and my phone (for audio). That felt stupid. I had previously used Hangouts on this computer just fine.

Tonight I got Dani's help (needed another call participant) while I tried to debug it. Same symptoms and no bright ideas. (We tried the phone thing; that worked fine again.) This time my searches led me to this thread, where I saw that somebody else solved the problem by using a different browser. Specifically, Safari.

I was using Chrome, figuring that Google's browser and Google's conferencing application ought to play well together. But nooooo, that was a mistake. I don't know whether the fault lies with Google or Apple, but sheesh! (No, there was nothing relevant in my Chrome settings. Chrome offers to prevent sites from using your input devices, like your camera or microphone, but this was output.) Switching to Safari worked, after I installed and enabled a plugin.

I suspect that, the last time it worked, I was using Firefox instead of Chrome and that made the difference. But once I found a solution I stopped taking up Dani's time with experiments, so I haven't tested.

WTF is wrong with Chrome + Hangouts + Mac? I found lots of other people who had this problem; it's not just me.

cellio: (Default)

I don't know a lot about the nuts and bolts of responsive design (the "how", I mean), but Stack Exchange is moving toward it so I'm starting to pay attention.

Meanwhile, my ancient tablet seems to be in its death throes, so I've started to look around at what's out there these days, and I realized something. I'm looking at some 10" tablets with resolutions like 2048x1536. My 30-inch monitor at work is something like 2500px wide. These are, of course, not even remotely the same size pixels. Pixels have always varied with the size of the monitor, of course, but a ~10" tablet used to be in the range of 1024 or 1280 wide (landscape), not twice that.

I've seen discussions of SE's upcoming responsive design that say things like "and at widths under 900px it does this" and "the max width for the content area is (some number of pixels)".

How does this work? How can I see reasonable "real-world" sizing of things on both my big monitor and my tablet when designers are measuring things in pixels and tablets are doing crazy-dense things with pixels these days? I guess the same can be said of 4k displays (which I don't have). Do these ultra-dense devices somehow tell the browser "no, really, treat me as half that for layout purposes"? On a tablet will I need to have tons of zoom -- but still struggle to see the actual application's controls, because those don't zoom when you make content bigger?

I must be missing something obvious. Anybody want to enlighten me?

cellio: (avatar-face)

If you use Patreon, a site that connects creators (writers, artists, musicians, cartoonists, anybody) with people who'd like to support their work, then you probably already know that they're about to start charging the patrons (funders) for the credit-card transaction fees. (So you signed up to pay somebody, say, $1/month, and you'll now be charged $1.38.) What you might not have noticed is that they're charging a little more than what the credit-card companies charge them, and they're charging for each individual transaction even though they charge your card once for all the creators you support each month. Uh huh. [personal profile] siderea did some money math on their current practices.

One of the complications in trying to do online financial match-making, whether that's Patreon or PayPal or others, is that actually holding money is messy, legally speaking. So creators who have income and support other creators don't get to pay from their income (which is just bookkeeping); each transaction has to start with a credit card and end with a deposit. Or so it sounds.

Back in 1995 when the web was still young, I went to work for a micro-payment research project at CMU, NetBill. The idea was that consumers used a credit card to load some small amount, like $20, into a NetBill wallet, and merchants could sell digital goods for a nickle or a dime or $1/month or however they wanted to structure things. There was a secure protocol with escrow so nobody got screwed, and nobody was paying transaction fees on ten-cent sales. Since this was a university research project it was never set loose in the wild, so nobody ever had to decide what NetBill's fees would be. What made me think back to that now is that I have no idea how the financial regulatory stuff was supposed to work; we were holding money, after all. What I do know is that the project had Visa and a major bank on-board from the start to make sure it would be legal. Now I wonder how they planned to do that. I assume the rules have changed since then anyway, but I now realize that this was a part of the business model that I had no real insight into.

(I joined the project in part because it sounded interesting and in part because it sounded like something that could launch a start-up and that sounded interesting. Instead, two years after I joined, CyberCash licensed the technology and that was the end of that.)

Making small payments was hard then and it hasn't gotten much easier since. If you want to publish through Amazon Kindle or iTunes you can still make some income that way (and of course the platform takes a large cut), but self-publishing for small amounts is still hard. And supporting people without going through the "make a sellable thing on Amazon or iTunes" is even harder.

Edited to add: Some donation-processing systems give donors the option to pay the transaction fees. For example, Jewcer, the site we used to raise funds for "Days of Awe - Mi Yodeya" a couple years ago, was like that, and most donors tacked on the fees. My congregation asks members to kick in the fees when we make credit-card payments and, again, it's optional. Sometimes I do, sometimes I don't -- depends on what the payment is for. But the key is that it's optional. If Patreon had offered patrons the choice instead of imposing the change, this might have gone over better -- but they couldn't do that, because they're using this to overcharge for those fees so people who know that won't go along with it.

cellio: (Default)

The New York Attorney General is investigating fraud aimed at FCC commenting. The FCC refused to cooperate. According to this post, tens of thousands of New Yorkers, and many more people elsewhere in the US, had their names falsely and illegally used in fake feedback on net neutrality.

Successfully investigating this sort of illegal conduct requires the participation of the agency whose system was attacked. So in June 2017, we contacted the FCC to request certain records related to its public comment system that were necessary to investigate which bad actor or actors were behind the misconduct. We made our request for logs and other records at least 9 times over 5 months: in June, July, August, September, October (three times), and November.

We reached out for assistance to multiple top FCC officials, including you [Chairman Pai], three successive acting FCC General Counsels, and the FCC’s Inspector General. We offered to keep the requested records confidential, as we had done when my office and the FCC shared information and documents as part of past investigative work.

Yet we have received no substantive response to our investigative requests. None.

Net neutrality is important. The integrity of the public record is even more important, as it is used to support policy changes (not just this one). And right now it looks like we've lost both.

You can use this site to look for fake comments using your name and, if you find them, file a complaint. With, um, somebody -- I didn't find any under my name, so I haven't gone down that path.

oops

Nov. 19th, 2017 05:58 pm
cellio: (whump)

My Mac has been bugging me to let it install some updates for several days now (requiring a reboot), so since I was going out for the afternoon anyway, I let it do so.

I completely forgot that this would cause Firefox to update to version 57. Oops. (At work I both turned off automatic updates and did some prep work to update to add-ons that will continue to work in 57. I hadn't gotten around to updating add-ons at home, and I forgot that I hadn't turned off browser auto-updates.)

I've lost my Stylish CSS overrides. Some I shared between home and work (or between Firefox and Chrome at home), so those ones I have, but some sites I only visit at home so I didn't have those at work. I found some stuff about how to find them on a Windows machine, but the filenames mentioned there don't exist on my Mac.

For the most part I'm going to just live without them and migrate more of my browsing activity to Chrome. The main reason I limit Chrome is that the tabs display is totally unreadable if you have too many tabs, unlike Firefox which sets a minimum size and gives you scrolling and a drop-down menu to see all of them. I just found a Chrome extension that provides that drop-down menu, so I can at least find stuff, though I haven't yet found a way to get Chrome to stop trying to show all of them anyway.

I also found these instructions for doing some of the things that Classic Theme Restorer did.

I've updated my earlier post about Firefox 57 with other workarounds I've found. For userscripts, I installed TamperMonkey, which I'm already familiar with from Chrome. For both scripts and CSS, I decided that at home I'll just do all my Stack Exchange stuff in Chrome -- I mostly was anyway, and now that it'd be actual work to get those scripts and styles back, time to just commit to it. Firefox is now almost exclusively for blog-reading (mainly Dreamwidth and those few people still on LJ), and everything else I do in Chrome. (That's at home; at work I do a lot more in Firefox.) I tend to have a lot of DW tabs open, so keeping that activity in the browser that handles tabs better makes sense.

cellio: (fist-of-death)

I found out today, via a notice provided by one of my add-ons (Stylish), that the next version of Firefox (57) is going to break most add-ons, which they are now designating "legacy". Firefox, like Chrome, automatically updates itself (I'm not sure that can be turned off any more), and these changes are coming "in November". I found this blog post from Mozilla from August, but I never received any sort of notification as a user and I don't make a habit of seeking out blog posts from vendors of software I use.

Why the hell didn't I get some sort of notification from Firefox? Is this news to you, too?

So now, the hunt for replacements commences. Gee thanks, guys.

Here's what I've found so far, untested unless otherwise noted:

  • Stylish replacement (notice pushed by Stylish, apparently): Stylus. Listed as beta. I don't know whether styles will just work (after being manually imported, it appears) or if changes will be needed. ETA: I needed to rework one style, which had several blocks applying to different sets of (related) sites. I had to break that up. The style I was using to make tooltips bigger doesn't work (not supported by Mozilla's new API), but I found a workaround. The day after I got all this migrated to Stylus, I got a Stylish update -- but it couldn't read my existing scripts either, so I would have had to migrate to it in exactly the same way I'd just migrated to Stylus. (The UI was even the same.) So I punted that; I've already got Stylus working.

  • Greasemonkey: Google led me to ViolentMonkey. Ditto about not knowing if things just work or require adjustments. ETA: ViolentMonkey is slow and times out about a third of the time for me, but TamperMonkey (which I already know from Chrome) exists and works fine. I had to manually add each of my scripts (to either), but I didn't need to modify them.

  • NoScript: it looks like they're migrating, but I don't know if I'll have to do anything. ETA:* Seems to be broken in 57; supposedly they're working on it.

  • Session Manager: is this built into Firefox now? It's very important that when I restart Firefox, I get the tabs and windows I had before. Can anybody who doesn't use an add-on for that confirm whether that works out of the box now?

  • AdBlock Plus: this is my one extension not listed as legacy, so I assume it will keep working.

  • Classic Theme Restorer: um, I found this github repository; haven't waded too far into the readme yet. ETA: this page explains how to move the tabs below the URL/extensions bar where they belong. The other look&feel stuff it did isn't as critical. (One could make a good argument that the URL bar belongs below the tabs, but all the other stuff the browser puts in that horizontal slice is more global, and having those reversed confuses me.)

cellio: (Default)
I get email sometimes that is presumably the result of somebody using my email address (erroneously or intentionally) to sign up for services like Facebook, Twitter, dating sites, etc. (Also the occasional hotel booking confirmation.)

Today I got email from Twitter with a subject line of something like "please confirm your account (account name that is not mine here)". I figured anti-confirming might be helpful (at least to me; don't know about the other guy), so I looked. The body of the message was in Portuguese.

The text that looked most like "not my account" passed muster with Google Translate, so I clicked -- and worried that I'd have to navigate a Portuguese confirmation page. But no! The page was in English. Yay; with luck that email stream will stop now.

So I guess when they sent the mail I thought I was that other person, and that account has a default language or a language setting, so they used it. But they weren't sure enough to also use Portuguese in the subject line. (Correct call: I wouldn't have opened it if it weren't in English.) And then when I indicated "nope" they either chose a language based on my IP address or just used English on the assumption that everybody on the web is used to that. I wonder which it was.

Making decisions about this stuff is probably harder than it first appears. I think they made all the right calls here (except they might have repeated the "nope, not me" link in English), and they didn't just pick one language and go with it.
cellio: (avatar-face)

Yesterday Cloudflare, a service that increases reliability (and speed?) of web sites, shut down the Daily Stormer web site. Daily Stormer, if you haven't heard, is the site for the a hate group with broad impact in the US, most recently in the violence and murder in Charlottsville.

Their CEO's blog post announcing the termination isn't just a "they're evil and they're gone" announcement like you sometimes see. It's a thoughtful post that explains the dilemmas faced by the organizations that, by and large, make the Internet work, and what dangers this decision opens up.

Our team has been thorough and have had thoughtful discussions for years about what the right policy was on censoring. Like a lot of people, we’ve felt angry at these hateful people for a long time but we have followed the law and remained content neutral as a network. We could not remain neutral after these claims of secret support by Cloudflare.

Now, having made that decision, let me explain why it's so dangerous.

[...] Someone on our team asked after I announced we were going to terminate the Daily Stormer: "Is this the day the Internet dies?" He was half joking, but only half. He's no fan of the Daily Stormer or sites like it. But he does realize the risks of a company like Cloudflare getting into content policing.

I also found this tidbit interesting:

In fact, in the case of the Daily Stormer, the initial requests we received to terminate their service came from hackers who literally said: "Get out of the way so we can DDoS this site off the Internet."

After finding that post I found this post on Gizmodo that, among things, quotes from internal email he sent.

This was my decision. Our terms of service reserve the right for us to terminate users of our network at our sole discretion. My rationale for making this decision was simple: the people behind the Daily Stormer are assholes and I’d had enough.

Let me be clear: this was an arbitrary decision. It was different than what I’d talked talked with our senior team about yesterday. I woke up this morning in a bad mood and decided to kick them off the Internet. I called our legal team and told them what we were going to do. I called our Trust & Safety team and had them stop the service. It was a decision I could make because I’m the CEO of a major Internet infrastructure company. [...] No one should have that power.

I don't have a coherent opinion yet. On the one hand, policing content is a dangerous game and why I support net neutrality. On the other hand, private companies (and individuals) should be free to act (legally) in their own interests; companies have been refusing service to unacceptable customers on a case-by-case basis for years. On the third hand, there are differences between competitive markets and monopoly markets. (Within monopolies there are government-sponsored ones and we're-big-and-drove-everybody-out ones too.) Balancing all of that is hard.

Pennsic

Aug. 13th, 2017 04:43 pm
cellio: (sca)

I'm home from Pennsic. Brief notes in the form of bullet points:

  • My good friend Yaakov HaMizrachi was elevated to the Order of the Laurel! Yay! The Laurel is the SCA's highest award (peerage) for arts and sciences. He's also now known (additionally) as Yaakov HaMagid, Yaakov the Storyteller. The ceremony felt like a reunion of old friends, and it was a nice touch that they had his son chant the scroll (in Hebrew).

  • The part of Atlantian court that I attended (because of the previous) was very well-done and engaging. I don't live there, I don't know most of those people, and yet I was not bored. They moved things along without it feeling rushed, and everybody speaking from the stage could be heard clearly. They also mixed it up, instead of doing all recipients of one award and then moving on to the next. Sprinkling the peerages throughout the court works well and, really, it's not a big deal for order members to get up more than once in an evening. (Also, if peerage ceremonies are burdensomely long -- theirs weren't; ours sometimes are -- it's nice to be able to sit down between them.)

  • I don't think I've ever heard "we're ahead of schedule; let's take a 10-minute break" in the middle of court before, though. I wonder if someone on the stage had an urgent need?

  • They elevated another bard to the Laurel, and that one sang his oath of fealty. While he was doing so I wondered if the king would respond in song -- and he did. That he used the same melody suggests some advance coordination (beyond "we're singing"), I wonder which of them wrote the king's words.

  • I had long, enjoyable conversations with both Yaakov and Baron Steffan. I miss the deep email conversations I used to have with both of them, before the great fragmenting of the digital-communication world (some to email, some to blogs/LJ/DW, some to Facebook, some to Google+, some to Twitter, some to places I don't even know about). It's harder to track and stay in touch with people than it used to be.

  • No I am still not going to start using Facebook. It's frustrating that by declining to do so I miss more and more stuff, but I'm not ready to let yet another thing compete to be the center of my online life. Also, Facebook in particular is icky in some important ways.

  • SCA local group, that means you too. Plans for a baronial party at Pennsic were, as far as I can tell, announced only on Facebook. (I've checked my email back to the beginning of April, so no I didn't just forget.) And thus I did not bring a contribution for your pot-luck. I do not feel guilty about that.

  • The Debatable Choir performance went very well. I conducted a quartet singing Sicut Cervus (by Palestrina), which I think went well. Two of the four singers had not previously done a "one voice to a part" song with the choir, and I'm proud of them for stepping up and doing a great job. I hope we got a recording.

  • I went to a fascinating class on medieval Jewish astrology (taught by Yaakov in persona). I've seen zodiacs in ancient (and modern) Jewish art and in synagogues, and a part of me always wondered how this isn't forbidden. It turns out that astrology is more of an "inclination", a yetzer, than a hard-and-fast truth -- there are stories in the talmud where astrology predicted something bad but the person, through good deeds, avoided the bad outcome. Also, in case you're wondering (like I did, so I asked), the zodiac signs get some solar smoothing, so if there's a leap-month (Adar Bet) there's not a 13th sign in those years.

  • Our camp has two wooden buildings (besides the house on the trailer, I mean), which we wanted to sell this year because we're making a new kitchen trailer that will replace both of them. We succeeded in selling the larger one (yay!). Maybe we'll be able to sell the other next year. (We'll set it up and use it for something else, because potential buyers would want to see it set up.)

  • Overall the weather was good. There were big storms on the first Friday ("quick, grab snacks and alcohol and head for the house!" is our camp's rallying cry), but only occasional rain after that and it wasn't sweltering-hot, which makes a huge difference.

  • The last headcount I saw was around 10,500.

cellio: (Default)

We've all seen text on the web that looks almost like ASCII, but it's really very-similar characters from other alphabets like Cyrillic, right? These can appear in domain names too, and your browser will helpfully display them in Unicode.

So, yeah, that can be exploited. It's called a homograph attack.

Browsers display a URL with some special characters in its uglier, non-translated form, so you can tell. But there's a bug or feature, depending on whom you ask, that if the domain consists entirely of special characters from a single language, it all gets translated. You can see how that would be helpful to Internet users in Russia or Israel or China, but for those who surf using the Roman alphabet, it's a risk that even careful security-minded people can miss.

Chrome version 58 reportedly fixes the problem. Firefox isn't going to fix it, but there's an about:config setting you can change (set network.IDN_show_punycode to true).

This post from Ars Technica explains the problem in more detail.

Expand Cut Tags

No cut tags