Monica

Swiss-cheese security

Fri, 16 Feb 2024 02:49:08 GMT

Cory Doctorow's How I got scammed was a fascinating read. Phishing has gotten more sophisticated, but also, even people whose security practices are way above the norm can get hit when the stars (mis)align just so.

There's a name for this in security circles: "Swiss-cheese security." Imagine multiple slices of Swiss cheese all stacked up, the holes in one slice blocked by the slice below it. All the slices move around and every now and again, a hole opens up that goes all the way through the stack. Zap!

The fraudster who tricked me out of my credit card number had Swiss cheese security on his side. Yes, he spoofed my bank's caller ID, but that wouldn't have been enough to fool me if I hadn't been on vacation, having just used a pair of dodgy ATMs, in a hurry and distracted. If the 737 Max disaster hadn't happened that day and I'd had more time at the gate, I'd have called my bank back. If my bank didn't use a slightly crappy outsource/out-of-hours fraud center that I'd already had sub-par experiences with. If, if, if. [...]

The following Tuesday, I called my bank and spoke to their head of risk-management. I went through everything I'd figured out about the fraudsters, and she told me that credit unions across America were being hit by this scam, by fraudsters who somehow knew CU customers' phone numbers and names, and which CU they banked at. This was key: my phone number is a reasonably well-kept secret. You can get it by spending money with Equifax or another nonconsensual doxing giant, but you can't just google it or get it at any of the free services. The fact that the fraudsters knew where I banked, knew my name, and had my phone number had really caused me to let down my guard.

Years ago, I got a call on a weekend from someone claiming to be from my credit card and was just plausible enough for me to not hang up. (Also a claimed fraud alert.) But I got suspicious when the caller started asking me for private information and then claimed it was necessary to authenticate me (at my own phone number). So I said "I also need to authenticate you; what's my mother's maiden name?" Oh no, the caller said, we can't give you that information... but with all the data breaches we've seen, that technique is no longer safe. The phisher might have my mother's maiden name [1]. Doctorow's phisher had his unpublished phone number. Secrets aren't.

[1] Helpful tip: don't use the actual answers for security questions that people might be able to research or guess. As far as your bank is concerned, your mother's maiden name can be QjFVa6ufeqr_7.

comments

thoughts from a former community manager at Stack Overflow

Sun, 19 Nov 2023 01:30:02 GMT

I came back from Shabbat to a link to this interesting blog post by Jon Ericson. Jon and I haven't discussed this.

The original post contains links that I haven't reproduced in this excerpt:

After contemplating the situation for many years, I've come to the conclusion that Monica ran into a wall of injustice veiled in the language of progressivism. Applying Bari Weiss' framing, Monica was powerful within the community so her behavior was suspect by default. The factors I thought were to her favor by the new ideology didn't seem to matter:

She has vision problems which puts her at a disadvantage in the age of screens.

She's a woman in technology which means she's in the minority.

She's Jewish which puts her in a minority that's been discriminated against so often there is a common word for it in English.

The analysis I should have understood was:

It's possible the people deciding her fate didn't know about her vision. In any case, vision is a problem that can be corrected with technology and money.

In the calculus of intersectionality transgender people are more marginalized than straight women.

What I thought were strong arguments that removing a Jewish moderator on the Shabbat before Rosh Hashanah was a bad look, turned out to not matter. I can't prove it, but I suspect it's the result of subtle antisemitism that comes from observing that Jews tend to be successful in certain fields. Jew might be a minority, but they aren't under-represented so paradoxically that must mean they are among the powerful.

I'm not an expert on these things and so I operated under the naive assumption that progressive ideology was working toward the goal of treating people as if we were all created equal. But the standard tools of the new morality are ineffective. Instead, the logical conclusion of the new ideology appears to require mistreating people who don't conform to its evolving standards.

comments

Bari Weiss: you are the last line of defense

Thu, 16 Nov 2023 04:15:36 GMT

I just came across a speech that Bari Weiss recently gave for the Federalist Society, specifically for their lawyers' convention. She starts by talking about how surprising a choice she was for that; she's not exactly their type.

I found this worth my time to read. Choosing concise excerpts (to stay within the bounds of fair use) is hard, but here are some bits to give the flavor. I read the transcript; there's also a video if you prefer to listen.

( content warning: Hamas war and reactions to it )

comments

some Twitter-related links

Sun, 20 Nov 2022 23:39:20 GMT

If you are using your Twitter account to sign in to other sites ("the "sign in with Google/Facebook/Twitter/etc" system), you should stop doing that now. Also, if you are using SMS for two-factor authentication with Twitter, that same article has advice for you. Some parts of their 2FA setup have stopped working, and apparently SMS validation is now unreliable.

There is an outstanding thread -- on Twitter, natch -- about the kinds of things that SREs (site reliability engineers, the people who keep large systems running) worry about. Parts of large systems fail all the time; in a healthy setup you'll barely notice. Twitter is, um, not healthy.

Debirdify is a tool for finding your Twitter friends on the Fediverse (Mastodon), for those who've shared that info. It looks for links in pinned tweets and Twitter profile ("about") blurbs.

I'm at https://indieweb.social/@cellio, for anyone else who's there. I'm relatively new there, like lots of other folks, but so far the vibe takes me back to the earlier days of the Internet -- people are friendly, help each other, presume good intent, and have actual conversations. It is not Twitter; some intentional design choices appear to encourage constructive use and hinder toxicity. I hope to write more about Mastodon later.

comments

the trust thermocline

Fri, 04 Nov 2022 17:31:11 GMT

John Bull wrote a post (in tweet-sized pieces, naturally) that rings true for me, and he gave a name for the phenomenon we're seeing with Twitter, saw with LiveJournal, and partially saw with Stack Overflow. The thread starts here on Twitter and here on Mastodon (the Fediverse). Selected quotes:

One of the things I occasionally get paid to do by companies/execs is to tell them why everything seemed to SUDDENLY go wrong, and subs/readers dropped like a stone. So, with everything going on at Twitter rn, time for a thread about the Trust Thermocline.

So: what's a thermocline?

Well large bodies of water are made of layers of differing temperatures. Like a layer cake. The top bit is where all the the waves happen and has a gradually decreasing temperature. Then SUDDENLY there's a point where it gets super-cold.

The Trust Thermocline is something that, over (many) years of digital, I have seen both digital and regular content publishers hit time and time again. Despite warnings (at least when I've worked there). And it has a similar effect. You have lots of users then suddenly... nope. [...]

But with a lot of CONTENT products (inc social media) that's not actually how it works. Because it doesn't account for sunk-cost lock-in.

Users and readers will stick to what they know, and use, well beyond the point where they START to lose trust in it. And you won't see that.

But they'll only MOVE when they hit the Trust Thermocline. The point where their lack of trust in the product to meet their needs, and the emotional investment they'd made in it, have finally been outweighed by the physical and emotional effort required to abandon it. [...]

Virtually the only way to avoid catastrophic drop-off from breaching the Trust Thermocline is NOT TO BREACH IT.

I can count on one hand the times I've witnessed a company come back from it. And even they never reached previous heights.

comments

attention and its lack

Mon, 03 Jan 2022 01:56:48 GMT

From Your attention didn’t collapse. It was stolen:

When you arrive at the gates of Graceland, there is no longer a human being whose job is to show you around. You are handed an iPad, you put in little earbuds, and the iPad tells you what to do – turn left; turn right; walk forward. In each room, a photograph of where you are appears on the screen, while a narrator describes it. So as we walked around we were surrounded by blank-faced people, looking almost all the time at their screens. As we walked, I felt more and more tense. When we got to the jungle room – Elvis’s favourite place in the mansion – the iPad was chattering away when a middle-aged man standing next to me turned to say something to his wife. In front of us, I could see the large fake plants that Elvis had bought to turn this room into his own artificial jungle. “Honey,” he said, “this is amazing. Look.” He waved the iPad in her direction, and began to move his finger across it. “If you swipe left, you can see the jungle room to the left. And if you swipe right, you can see the jungle room to the right.”

His wife stared, smiled, and began to swipe at her own iPad. I leaned forward. “But, sir,” I said, “there’s an old-fashioned form of swiping you can do. It’s called turning your head. Because we’re here. We’re in the jungle room. You can see it unmediated. Here. Look.” I waved my hand, and the fake green leaves rustled a little. Their eyes returned to their screens. “Look!” I said. “Don’t you see? We’re actually there. There’s no need for your screen. We are in the jungle room.” They hurried away. I turned to [teenager], ready to laugh about it all – but he was in a corner, holding his phone under his jacket, flicking through Snapchat. [...] I realised as I sat with [teenager] that, as with so much anger, my rage towards him was really anger towards myself. His inability to focus was something I felt happening to me too. I was losing my ability to be present, and I hated it. "I know something’s wrong," Adam said, holding his phone tightly in his hand. "But I have no idea how to fix it." Then he went back to texting.

I realised then that I needed to understand what was really happening to him and to so many of us. That moment turned out to be the start of a journey that transformed how I think about attention. I travelled all over the world in the next three years, from Miami to Moscow to Melbourne, interviewing the leading experts in the world about focus. What I learned persuaded me that we are not now facing simply a normal anxiety about attention, of the kind every generation goes through as it ages. We are living in a serious attention crisis – one with huge implications for how we live. I learned there are twelve factors that have been proven to reduce people’s ability to pay attention and that many of these factors have been rising in the past few decades – sometimes dramatically.

The article is an interesting read (though it does not list those twelve factors). It's an excerpt from a forthcoming book, which I presume does.

Edited to add (2022-01-09): I've now seen some challenges to the research in this book, including that the CMU study was not peer-reviewed and that some other studies have not been reported accurately.

comments

signal boost: am I liable if my murder commits murder?

Sun, 21 Feb 2021 21:35:56 GMT

This was shared with me in the form of screen shots (so, hard to read), but then I found the link to where it happened on Reddit (in a "legal advice" channel). I thought my readers might enjoy this.

Original post, two months ago, which has a note from moderators saying they've verified the story:

[oregon] I accidentally created an army of crow body guards. Am I liable if my murder attempts murder? (Personal Injury)

To make a long story short, im a late 20 something living in portland oregon. I had a pretty intense emo/goth phase as a tween that i thought i had grown out of.

A couple months ago, i was watching a nature program on our local station about crows. The program mentioned that if you feed and befriend them, crows will bring you small gifts. My emo phase came back full force and i figured that i was furloughed and had lots of time- so why not make some crow friends.

My plan worked a little too well and the resident 5 crows in my neighborhood have turned into an army 15 strong. At first my neighbors didnt mind and enjoyed it. They're mostly elderly and most were in a bird watching club anyway. They thought the fact that i had crows following me around whenever i go outside was funny.

Lately, the crows have started defending me. My neighbor came over for a socially distanced chat (me on my porch her in my yard) and the crows started dive bombing her. They would not stop until she left my yard.

They didnt make physical contact with her, but they got very close.

Am i liable if these crows injure someone since i fed them? I obviously cant control the crows. I would rather them not attack my neighbors. But since i technically created this nuisance, could i be financially on the hook for any injuries?

To be clear, they're not agressive 100% of the time. If just the neighbors are out they are friendly normal crows. They only get aggressive when someone gets close to me or my property.

ETA: TL;DR- I have turned into Moira Rose, queen of the crows. My inadvertent crow army has gotten aggressive towards others. If they hurt someone could i be held liable?

ETA PT II: I did not train these birds to attack. Also thank you for all of your awards. Im glad my stupid decisions bring you joy. Please consider donating that money to your local Audubon society instead

There's a followup, posted yesterday with a positive outcome:

So to make a long story short, i called our local Audubon society. They didn't think feeding the crows was bad and suggested that the neighbors also start feeding them so they essentially became better socialized.

The plan worked and the crows are now a beloved part of the community. There have been no recent dive bombings.

Most amazingly, the crows may have legitimately saved my neighbor. Our city had a pretty big ice and snow event recently. Like i said in my last post, most of my neighbors are older. One of my neighbors was walking down his steep driveway, slipped, and couldnt get back up.

The crows started going ballistic and were making more noise than we have ever heard. A different neighbor went outside to see what was up and found the gentleman in his driveway. Neighbor is mostly ok! Just some serious bruises.

Needless to say the crows have been getting some high value food since then.

Thanks for all the help on my original post. It blew up way more than i was expecting and i thought you guys would enjoy an update.

comments

"Blah blah blah."

Tue, 08 Dec 2020 16:21:52 GMT

Today's bit of randomness:

When I was a young programmer I worked for an AI company on a text-categorization project -- for a commercial client, all hush-hush for a while to preserve their competitive advantage and such, apparently really innovative (didn't realize then; I was just writing code to solve a problem, y'know?). Then somebody accidentally published the training dataset. And apparently it's gotten quite a lot of use in the research community, which I was completely unaware of, having never really been that kind of researcher.

For 30+ years there's been a mystery in that dataset that people have noticed, commented on, and apparently never tried to track down...until now. This podcaster got in touch with me and some others last week, and here's the result: Underunderstood: The Case of the Blah Blah Blahs. (36 minutes; no transcript yet but it looks like they're planning one.)

It was neat to hear this trip down memory lane, and also to hear other parts of the story I'd never known about before, including the discussion from a researcher from the "other side" of one of the big arguments in AI in the 80s.

comments

abuses of the weak, and dominoes

Fri, 05 Jun 2020 01:59:23 GMT

Our government is out of control; that's been true for some time but it's gotten worse. The murder of George Floyd is appalling. That he's one of many is appalling. That many police are trained to do such violence, and are supported in it, is appalling. That our government responds with more unprovoked violence and escalation is appalling. I keep using that word, and I feel like I should have better words and more coherent thoughts, and I don't.

But I have this talk that you should listen to -- under 20 minutes, and Trevor Noah has some insightful things to say about the many dominoes that have fallen to get us here and societal contracts and more.

What is society? Society is a contract that we sign as human beings. We agree on common rules, common ideals, and common practices that are going to define us as a group. And the contract is only as strong as the people who are abiding by it.

comments

location services + police

Mon, 09 Mar 2020 00:47:51 GMT

We know that any device (like a phone) with location services turned on is generating a large pile of data about your every movement. If you don't want Google or Apple to know that, you turn location services off.

And if you're about to commit a crime and you're planning to get away with it, you leave your phone at home, or you turn location services off well in advance and keep them off so you don't create an obvious window.

These things I knew. What I hadn't previously heard of is geofencing warrants, where police can subpoena location data for everything in range of a crime scene, dig through it, and then get an arrest warrant for the owner of a specific device. Fortunately Google give the target a heads-up; unfortunately I do not know if that is them "just being nice" (so they could decide not to) or if they have to.

H/t madfilkentist.

comments

link roundup (mostly online communities)

Sun, 16 Feb 2020 19:06:10 GMT

I have a lot of links I've been meaning to share accumulating in tabs, tweets, and whatnot. I'd wanted to "curate" this more, but sharing something is better than sharing nothing because I didn't get to that, so...

Stack Exchange (aka Stack Overflow Inc) fired its two longest-serving, most-community-connected community managers. A week before, a third such had given notice, though that was not yet public when the firings happened. Here's a post on Meta.SE. Jon posted about his departure on his blog. He talked more about it in his 2019 in review. Meanwhile, firing Shog9 was egregious enough in the community's eyes that a GoFundMe campaign to help tide him over between jobs has raised $11k so far. Jon and Shog, and also ex-SO moderator George Stocker, have been writing a lot on Twitter about the company's change in direction, often in intertwined threads that are hard to link into.
Jon on Misunderstanding Meta
Effective apologies -- five of these six elements are core to teshuva, the Jewish understanding of repentance. (I forget who shared this where.)
For managers: different ways of showing recognition (I saw this while in the midst of year-end reviews at work)
Designing for people, which is timely as we work to build Codidact
On site design in general, Alphabet of accessibility issues. Yes I experience several of these, and I'm just one person!
Register article on GitLab and diversity
To kill a community
What is community anyway?
Internal monologues or not?
On grieving: how not to say the wrong thing. Synopsis: rings of concern, comfort in, dump out.
siderea on the problem of punching up
Samuel Liew's Stack Exchange timeline

comments

link round-up

Fri, 05 Jan 2018 02:26:17 GMT

Some stuff has been accumulating in browser tabs. Some of it lost relevance because I waited too long (oops). Here's the rest.

This article explains the Intel problem that's going to slow your computer down soon. I don't know much about how kernels work and I understood it. I do have some computer-science background, though, so if somebody who doesn't wants to let me know if this is accessible or incoherent, please do. In terms of effects of the bug, you're going to get an OS update soon and then things will be slower because the real fix is to replace hardware, but you probably want to take the update anyway.

This infographic gives some current advice to avoid being spear-phished. It has one tip that was new to me but makes a lot of sense: if you have any doubt about an attachment but are going to open it anyway, drop it into Google Drive and open it in your browser. If it's malicious it'll attack Google's servers instead of your computer, and they have better defenses.

Sandra and Woo: what the public hears vs. what a software developer hears.

This account of one hospital's triage process for major incidents blew me away. I shared the link with someone I know in the medical profession and he said "oh, Sunrise -- they have their (stuff) together" -- they have a reputation, it appears. Link courtesy of metahacker and hakamadare.

I was one of the subject-matter experts interviewed for this study on Stack Overflow's documentation project. Horyun was an intern and was great to work with.

From siderea, the two worlds, or rubber-duck programming and modes of thinking.

The phatic and the anti-inductive doesn't summarize well, but I found it interesting. Also, I learned some new words. "Phatic" means talking for the sake of talking -- so small-talk, but not just that. Social lubricant fits in here too.

Rands on listening for managers.

From the same source as the "phatic" post, a story about zombies made me laugh a lot.

From Twitter:
Three logicians walk into a bar. The bartender says "Do you all want something to drink?"
The first logician says "I don't know."
The second logician says "I don't know."
The third logician says "Yes."

comments

embedded geek

Fri, 14 Jul 2017 02:12:30 GMT

A friend shared this with me earlier today and I literally laughed out loud:

(Source)

The second-last column is about a famous Zulu leader. The last one is about walled cities under fire.

"Shaka, when the walls fell" is a key phrase in a rather unusual episode of Star Trek: The Next Generation, named "Darmok". The famous universal translator doesn't work when the Enterprise encounters these particular aliens, because their language doesn't work at the word level. They speak in what the crew calls metaphor. I've seen discussions of this over the years ("could that really work?" "improbable, because..."). The post about the Jeopardy episode links to this Atlantic article about the episode that argues that we're looking at it all wrong. I found it an interesting read.

Also, Atlantic does in-depth articles about episodes of SF shows? Who knew?

(I don't have a Trek icon. Here, have one from one of my favorite shows instead.)

comments

debugging a toy

Mon, 03 Jul 2017 01:31:14 GMT

The detective work and presentation in the top answer to this question on English Language & Usage are quite impressive. What is that picture of a word beginning with "Y" supposed to be?

I haven't read all the comments, but it appears there's a lot of forensics to be found therein, too.

comments

link round-up

Mon, 03 Apr 2017 01:34:58 GMT

I have some things collecting in tabs, so here's a hodge-podge:

First, border-crossing. You've probably heard by now that border control in the US has gotten aggressive, including demanding passwords for encrypted devices and then taking them out of view for an extended time. You don't have to give up your password, but if you don't, they can confiscate your device for weeks or months for "review". The rights you have against unreasonable search and seizure in the US are not the same as those you have at the border. While they can't deny entry to US citizens, they can to others.
It's important to know what you don't know. David Director Friedman has an interesting idea about applying economics to teaching -- specifically, grading exams.
A lot of the Rands article The New Manager Death-Spiral sounds very familiar.
We all know one of the Internet rules: don't read the comments. The parts of the net I frequent tend to be better than, say, a random sample of YouTube, which is due to a mix of conscientious participants and comment moderation. A while back I came across a comment-moderation policy described as "Victorian Sufi Buddha Lite": they require a comment to be at least two of true, necessary, and kind.
I'm not sure that philosophy applies to windshield notes, but they sure are funny.
How do we know Humpty Dumpty is an egg? The rhyme doesn't say so. Huh, I never thought about that.
Speaking of things I hadn't thought about, have you ever noticed the similarities between fantasy-adventurer settings and westerns?

comments

Worldbuilding blog

Mon, 06 Feb 2017 00:51:56 GMT

Hey, Dreamwidth folks... I've syndicated Universe Factory, the blog of the Worldbuilding Stack Exchange community, here on DW. We started the blog late in 2015; you can see a complete list of posts, including some from me.

Some specific links:

- Fight Earnestly and Hit Them in the Gaps, two articles from a HEMA (Historic European Martial Arts) student.

- Articles on generating rivers, using cellular automata to generate terrain (yes, like in Game of Life), and using distortion fields to generate continents. I believe the author of this series is our first contributor who found us via Medium instead of via Stack Exchange.

- An article on calculating political power.

- Building a Truly Alien Alien.

- When Am I? Navigation for Time Travelers

That's all in the last two months. Among older articles, you might enjoy:

- Building the World of Pangaea, an interview I did with Michael Burstein (mabfan) about the worldbuilding behind a shared-world anthology he was part of (edited by Michael Jan Friedman). That reminds me: wasn't book 2 supposed to be out around now?

- Nature's Oven, a short story.

- Worldbuilding As You Go: A Case Study, which is about how I approached writing The Sisters' War (Chapter 1, summary of the story so far).

- What if the world was (completely) round?

- My Revelation for RPGs series (link is to the index).

comments