Tag: You’re Doing it Wrong

Apple Adds Big Brother to iOS

There are two dominate smartphone operating systems: Google’s Android and Apple’s iOS. Google’s business model depends on surveilling users. Apple has exploited this fact by making privacy a major selling point in its marketing material. When it comes to privacy, iOS is significantly better than Android… at least it was. Today it was revealed that Apple plans to add a feature to iOS that surveils users:

Child exploitation is a serious problem, and Apple isn’t the first tech company to bend its privacy-protective stance in an attempt to combat it. But that choice will come at a high price for overall user privacy. Apple can explain at length how its technical implementation will preserve privacy and security in its proposed backdoor, but at the end of the day, even a thoroughly documented, carefully thought-out, and narrowly-scoped backdoor is still a backdoor.

[…]

There are two main features that the company is planning to install in every Apple device. One is a scanning feature that will scan all photos as they get uploaded into iCloud Photos to see if they match a photo in the database of known child sexual abuse material (CSAM) maintained by the National Center for Missing & Exploited Children (NCMEC). The other feature scans all iMessage images sent or received by child accounts—that is, accounts designated as owned by a minor—for sexually explicit material, and if the child is young enough, notifies the parent when these images are sent or received. This feature can be turned on or off by parents.

When Apple releases these “client-side scanning” functionalities, users of iCloud Photos, child users of iMessage, and anyone who talks to a minor through iMessage will have to carefully consider their privacy and security priorities in light of the changes, and possibly be unable to safely use what until this development is one of the preeminent encrypted messengers.

I’ve been pleasantly surprised by the amount of outrage I’ve seen online about this feature. I expected most people to praise this feature out of fear of being labeled a defender of child pornography if they criticized it. But even comments on Apple fanboy sites seem to be predominantly against this nonsense.

This move once again demonstrates the dangers of proprietary platforms. If, for example, a Linux distro decided to include a feature like this, users would have a number of options. They could migrate to another distro. They could rip the feature out. They could create a fork of the distro that didn’t include the spyware. This is because Linux is an open system and users maintain complete control over it.

Unfortunately, there aren’t a lot of options when it comes to open smartphones. The options that do exist aren’t readily accessible to non-technical users. Android Open Source Projects, which are versions of Android without Google’s proprietary bits, like LineageOS and GrapheneOS don’t come preinstalled on devices. Users have to flash those distros to supported devices. Smartphones developed to run mainline Linux like the PinePhone and Librem 5 still lack stable software. Most people are stuck with spyware infested smartphone. Exacerbating this issue is the fact that smartphones, unlike traditional x86-based computers, are themselves closed platforms (which is not to say x86-based platforms are entirely open, but they are generally much more open that embedded ARM devices) so developing open source operating systems for them is much harder.

Maybe Connecting Everything to the Internet Isn’t a Great Idea

I’ve made my feelings about the so-called Internet of things (IoT) abundantly clear over the years. While I won’t dismiss the advantages that come with making devices Internet accessible, I’m put off by industry’s general apathy towards security. This is especially true when critical infrastructure is connected to the Internet. Doing so can leads to stories like this:

Someone broke into the computer system of a water treatment plant in Florida and tried to poison drinking water for a Florida municipality’s roughly 15,000 residents, officials said on Monday.

The intrusion occurred on Friday evening, when an unknown person remotely accessed the computer interface used to adjust the chemicals that treat drinking water for Oldsmar, a small city that’s about 16 miles northwest of Tampa. The intruder changed the level of sodium hydroxide to 11,100 parts per million, a significant increase from the normal amount of 100 ppm, Pinellas County Sheriff Bob Gualtieri said in a Monday morning press conference.

The individuals involved with the water treatment plant have been surprisingly dismissive about this. They’ve pointed out that there was never any danger to the people of Oldsmar because treated water doesn’t hit the supply system for 24 to 36 hours and there procedures in place that would have caught the dangerous levels of sodium hydroxide in the water before it could be release. I believe both claims. I’m certain there are a number of water quality sensors involved in verifying that treated water is safe before it is released into the supply system. However, they’re not mentioning other dangers.

Poisoning isn’t the only danger of this kind of attack. What happens when treated water can’t be released into the supply system? If an attacker poisons some of the treated water, is there isolated surplus that can be released into the supply system instead? If not, this kind of attack is can work as a denial of service against the city’s water supply. What can be done with poisoned water? It can’t be released into the supply system and I doubt environmental regulations will allow it to be dumped into the ground. Even if it could be dumped into the ground, doing so would risk poisoning groundwater supplies. It’s possible that a percentage of the plant’s treatment capacity becomes unavailable for an extended period of time while the poisoned water is purified.

What’s even more concerning is that this attack wasn’t detected by an intrusion detection system. It was detected by dumb luck:

Then, around 1:30 that same day, the operator watched as someone remotely accessed the system again. The operator could see the mouse on his screen being moved to open various functions that controlled the treatment process. The unknown person then opened the function that controls the input of sodium hydroxide and increased it by 111-fold. The intrusion lasted from three to five minutes.

This indicates that the plant’s network security isn’t adequate for the task at hand. Had the operator not been at the console at the time, it’s quite possible that the attacker would have been able to poison the water. There is also a valid question about the user interface. Why does it apparently allow raising the levels of sodium hydroxide to a dangerous amount? If there are valid reasons for doing so (which there absolutely could be), why doesn’t doing so at least require some kind of supervisory approval?

It’s not uncommon for people involved in industries to cite the lack of budget necessary to address the issues I’ve raised. But if there isn’t a sufficient budget to address important security concerns when connecting critical infrastructure to the Internet, I will argue that it shouldn’t be done at all. The risks of introducing remote access to a system aren’t insignificant and the probability of an attack occurring are extremely high.

Whenever somebody discussing connecting a device to the Internet, I immediately ask what benefits doing so will provide. I then ask which of those benefits can be realized with a local automation system. For example, a Nest thermostat offers some convenient features, but many of those features can be realized with a local Home Assistant controller.

One-Sided Contracts

Yesterday I once again reiterated the fact that if you don’t own your infrastructure, you’re at the mercy of whoever does. Today I want to discuss why third-party providers can so easily pull the rug out from underneath you.

Businesses all over the world rely on third-party providers for any number of goods and services. They do so without too much concern that those third-parties are going to suddenly kneecap them. How do they accomplish such a feat? The answer is contracts. Large business deals aren’t made by one business clicking the accept button on a provider’s terms of service of end user license agreement. They’re made by lawyers on both sides negotiating terms. If one party only offers a deal where they can do whatever they want and the other party simply has to accept it, the other party will likely walk away. But such one-sided deals are common with online service providers.

If you sign up for an account on Amazon Web Services, Digital Ocean, GoDaddy, or any other hosting provider, you are presented with terms of service that you have to accept in order to use the service. There is no opportunity for you to negotiate. If you bother to read the terms of services, you’ll realize that they tend to put a lot of obligations on you as the paying customer but almost none of them as the provider. The terms of service usually allow the provider to cut you off for any reason without notice. But do you get any guarantees in return? Do they guarantee you uptime, reliability, or anything along those lines? If they do, do they agree to pay a financial penalty if they fail to provide what they guarantee? Do they offer a concise list of specific terms that are the only terms under which they are allowed to terminate the agreement without paying a financial penalty to you? They don’t.

I’ve been fortunate enough to observe contract negotiations between businesses. It’s both an interesting and painstaking process. They can take weeks, months, and even years. During that time both parties will strive to ensure every detail that could impact them is hammered out. Neither party wants to be in a position where the other can screw them.

Every end user license agreement and terms of service you’ve accepted over the years was likely entirely one-sided. The company you’re paying probably reserved all of the power for themselves. It’s likely that they dictated who will arbitrate any disagreement between them and you (if any disagreement is even allowed to you under the terms). This is one reason, perhaps the biggest reason, you can’t rely on a third-party service provider. If you decide to host your site on Amazon Web Services, Digital Ocean, GoDaddy, etc., they can remove your site for any reason without any advanced warning. In return you get to take it and ask for more.

No competent business would knowingly enter a one-sided contract. Take a page from their book. If you’re looking to purchase a good or service and the only offer is a one-sided agreement where the provider gets all of the power, walk away.

Educating People in Order to Argue with Them

Long ago I was taken aback when a friend of mind who was a prolific online debater told me he swore off online debates. I was curious and asked him why. He said, “I’m tired of educating people just so I can debate them.”

After that conversation I started to pay attention to my online debates and quickly realized that most of what I thought was debating was actually educating. Since I hold views that are outside of the zeitgeist, most people I encounter have little, if any, understanding of them. In a majority of online debates the people with whom I’m debating make arguments that have no meaning within the context of what I’m saying. I then have to spent time educating them about what I mean just so they can actually debate me.

I’m certainly not unique in this. Consider Marxists for a moment. It’s pretty easy for them to have a very rudimentary debate about workers’ rights because that issue is part of the zeitgeist. However, if they want to make an argument based on historical materialism, they usually have to invest time in educating the other individual(s) on the subject so they have enough of an understanding to intelligently debate the issue. Libertarians have the same issue. It’s pretty easy for a libertarian to debate somebody about decriminalizing cannabis because that issue is part of the zeitgeist. But when a libertarian wants to debate monetary theory, they have to first teach their opponent(s) about the Austrian tradition of economics.

This problem runs even deeper. Few in what I will refer to as the masses appear to be educated on the topics of rhetoric and formal debate. Rhetoric is the skill of speaking convincingly. Formal debate is a framework which establishes ground rules for debates. A lot of people tend to conflate the two. They will try to argue against rhetoric by citing logical fallacies and make statements in a formal debate that contain logical fallacies. For example, consider the phrase “All cops are bastards.” The statement is valid rhetoric, but would not fly in a formal debate because the proposition is made with insufficient data (namely that every single individual who works in law enforcement is a bastard even though the debater is likely basing their argument on a small sample size of law enforcers).

I’m going to create two sides to further illustrate this issue: pro-cop and anti-cop. An anti-cop individual may say, “All cops are bastards,” as a form of rhetoric. They may not have meant the statement literally nor were they taking part in a formal debate. They’re merely trying to convince people to join their cause. But a pro-cop individual may rebut with, “That’s a hasty generalization fallacy!” The pro-cop individual is citing a rule that doesn’t apply to the situation. Now I’ll change the scenario. The two individuals have agreed to participate in a formal debate. When the anti-cop individual says, “All cops are bastards,” it would be proper for the pro-cop individual to say, “That’s a generalization fallacy,” because they both agreed to operate under the rules of formal debate.

How does this relate the the need to educate people in order to argue with them? More often than not I run into individuals who know nothing about rhetoric or formal debate. Their counterarguments will often involve pointing out logical fallacies in my rhetoric and making logical fallacies of their own. They know just enough about logical fallacies to recognize and call out a few of them, but not enough to avoid making the rest (which is usually the majority) of them or to know when they are appropriate to cite. They unknowingly (or knowingly, but I’m giving the benefit of the doubt here) attempt to establish an environment where I have to abide by the rules of formal debate while they operate by the rules of rhetoric. I then need to explain the difference between the two and convince them to pick one or the other. By the time that’s done the thread has digressed so far that everybody has lost interest.

This is where I reminisce about the good old days of the Internet when I could participate in online debates without having to spend a lot of time educating my opponents just so they could intelligibly argue with me. At one time I blamed the change on the diminishing state of education in the United States. However, when I was reminded of the term Eternal September, I started to blame two related issues: everybody and their grandmother is now online and Internet forums are more centralized. The early Internet was broken up into a large number of small Usenet groups, forums, and chatrooms. Most of those were topical so the people who joined usually already had an interest and at least a basic understanding of the group’s, forum’s, or chatroom’s topic. Today it’s not uncommon for a random user to find a Facebook group because it appeared on their Timeline when one of their friends made a comment in it. That random user may have no understanding of the group’s topic, but they end up posting a comment to the thread because they saw it on their Timeline and disagreed with something another user posted.

Killing Yourself Slowly

Trump is working to take this country back to the good old days of mercantilism when governments decided who would succeed and who would fail. Implementing tariffs was just the first act in his strategy to provide a supposed advantage to American companies. His latest act was far more blatant. He issued an executive order to prohibit Huawei from the United States market. In the aftermath of this executive order Google has revoked Huawei’s use of its services, including its Play Store:

President Trump issued an executive order last week banning “foreign adversaries” from doing telecommunication business in the US. The move was widely understood as a ban on Huawei products, and now we’re starting to see the fallout. According to a report from Reuters, Google has “suspended” business with Huawei, and the company will be locked out of Google’s Android ecosystem. It’s the ZTE ban all over again.

That’ll give a much needed boost to American device manufacturers, right? You know, all of those device manufacturers who manufacture their devices in China, where Huawei is headquartered. Because I’m sure this executive order won’t result in any reciprocation from the Chinese government.

But even if we set aside the likelihood of a Chinese retaliatory response, this executive order sends a rather clear message for companies headquartered outside of the United States. That message is that they shouldn’t rely on products or services from companies headquartered in the United States. Huawei can still use Android since it’s an open source project (a good reason to prefer open source code to closed source code) so it doesn’t have to write an operating system for its devices from scratch. It does have to figure out a replacement for Google’s proprietary bits though. There are several solid third-party clients available for Android that allow access to online calendaring, contacts, and e-mail services. Many of those clients are also open source. Huawei could utilize them in place of apps like Google Calendar, Google Contacts, and Google Mail (Google Maps is the tough one to replace but a third-party client could be written for it). So it would only need to worry about distribution and it has enough funding to build its own app store (it could also use something like F-Droid, but that’s unlikely). It could also make licensing money off of its app store by providing access to other Android device manufacturers who had their access revoked by Google due to an executive order.

Foreign companies aren’t going to stop doing business when the figurehead of the United States puts his signature on a piece of paper. They’re going to either make or buy replacements for everything can no longer use. If this behavior of barring foreign companies from business in the United States continues, companies headquartered outside of the United States are going to become more and more wary of relying on American products and services and instead seek foreign alternatives. American companies like Google will find themselves more and more isolated from the global market. The constantly dwindling market size will cause them serious economic hardship, which will translate into economic hardship for their employees.

Isolating domestic businesses from foreign markets is slow economic suicide.

Play Stupid Games, Win Stupid Prizes

This story is an illustration of how not to handle a fender bender:

Following the fender bender, Kamrowski stopped in the left lane and got out of his Ford F-150 pickup truck to exchange insurance information with Fitzgerald, according to police.

Fitzgerald, 37, of Ashland, Massachusetts, stayed inside of his white 2016 Infinity QX70 SUV, authorities said.

“That encounter became adversarial,” police said in a statement.

At some point, Kamrowski of Framingham, Massachusetts, reached into Fitzgerald’s vehicle and snatched a water bottle and then stood in front of Fitzgerald’s SUV, police said.

Ideally, after a collision, both parties get out of their vehicle and cordially exchange insurance information and let their respective companies deal with the situation from there. However, ideal situations are almost as rare as honest politicians. If you find yourself in a collision and the other party won’t exit their vehicle, don’t approach. But if you can’t stop yourself from doing that, at least don’t reach into the vehicle. Record the other driver’s license plate number, the make and model of their vehicle (if you can determine it), and identifying characteristics of their car (color, bumper stickers, etc.) and person. If the driver flees, you have a good description to give to the police. If they don’t, they’ll have to get out of their vehicle eventually.

Let’s pretend for a moment that you’re an idiot though and couldn’t restrain yourself form approaching and reaching into the car. At least don’t do this:

“Fitzgerald then began driving towards Kamrowski, who subsequently jumped on the hood of Fitzgerald’s vehicle,” according to the statement from police.

The box of his F-150 would have been a better place to go (or, better yet, back into the cab). But if do jump on the hood, do it only long enough to jump off the vehicle in a safer direction. If you decided to overstay your welcome (and your welcome will be approximately zero seconds), you could end up going for a ride:

With Kamrowski clinging to the hood, Fitzgerald headed west on the turnpike, accelerating and stopping in an apparent herky-jerky attempt to shake Kamrowski, police said. Fitzgerald’s Infinity hit speeds of up to 70 mph as it traveled about three miles on the highway with Kamrowski holding on, police said.

Now you get to ask yourself a question, is the driver panicked and working from their fight or flight state of mind or are they purposely trying to kill you? It’s a pointless question because the answer is irrelevant to your situation. But asking it might distract you from the fact that you’re probably going to die because of your poor decisions.

Fortunately for Kamrowski, a good Samaritan managed to end the situation before he died:

Several motorists tried unsuccessfully to get Fitzgerald to stop, police said. When Fitzgerald eventually got bogged down in traffic, a motorist with a permit to carry a concealed weapon approached Fitzgerald and ordered him out of the SUV at gunpoint just as troopers arrived on the scene, according to the police statement.

But that’s not something you can bet your life on. Moreover, you’re probably still going to jail:

Fitzgerald was charged with assault with a dangerous weapon on a person over 60, negligent operation of a motor vehicle and leaving the scene of a property damage accident.

Kamrowski was arrested on suspicion of disorderly conduct and malicious damage to a motor vehicle.

In summary, don’t be either Kamrowsky or Fitzgerald. Especially don’t be Kamrowsky though because he put is life in danger (Fitzgerald, on the other hand, was at least smart enough to stay in his vehicle and thus maintained a significant advantage in the deadly situation they both worked to create).

The Hypocrisy That Wasn’t

Longtime readers know that my opinion of Rand Paul isn’t high but my opinion of intellectually dishonest people is even lower. The story that Rand Paul has decided to go to Canada to receive medical treatment has been spreading like wildfire in socialist circles. A proponent of capitalism is going to a country with socialized medicine in order to receive treatment seems like a great demonstration of hypocrisy after all. However, the socialists sharing this story have forgotten one major fact: although Canada is a land of socialized medicine, a handful of private facilities still exist. This minor detail is important because it turns out that Rand Paul is going to one of those private facilities:

Those who chuckled at this supposed irony missed a major detail, even though it was noted in the press coverage: Paul’s surgery will take place at the Shouldice Hernia Hospital in Thornhill, Ontario. The clinic is private, and run for profit; The Toronto Star’s Daniel Dale, who is from Thornhill, notes that it was “grandfathered in to Ontario’s socialized health system.”

Instead of demonstrating Rand Paul’s hypocrisy, this story demonstrates one of my pet peeves: biased nuance. When you criticize the actions of an individual those who consider themselves on the same side as that individual will analyze your criticism with a fine-tooth comb in the hopes of finding a detail that calls your criticism into doubt. That same level of concern isn’t take for criticisms made against perceived opponents.

If you see a criticism of somebody you perceive to be an opponent, do a little digging before you share that story with your ideological circlejerk. It’ll save you from looking like a fool when somebody on that individual’s “side” analyzes the criticism and finds details putting it into doubt.

Don’t Forget to Put Your Shoes on the Charger

Nobody could credibly accuse me of being a Luddite but there are a lot of products that cause me to tilt my head and say what the fuck. Nike released a video of basketball players adjusting a pair of self-lacing shoes with a smartphone app. The shoes themselves are blurred out like genitals in a Japanese porno but the point is made clearly enough: Nike has self-lacing shoes that interface with smartphone.

My initial reaction was to assume that this product was the epitome of laziness. But then I thought about it and decided that digging out my smartphone, unlocking it, opening an app, and tapping a button actually requires more work than manually tying shoes. So I’m left to assume that these shoes are aimed at people who a) want to add the risk of being unable to lace up their shoes in the morning because they forgot to put them on the charger the night before and b) want the thrill of adding more hazardous materials to landfills when they toss out their battery equipped shoes.

Binary Thinking Is, on the Whole, Harmful

A recent report released by the American Psychological Association (APA) has been making the rounds and stirring up outrage. Why? Because it more or less argues that traits commonly associated with the Western concept of masculinity are bad:

The main thrust of the subsequent research is that traditional masculinity—marked by stoicism, competitiveness, dominance and aggression—is, on the whole, harmful.

My gripe with this claim is the same gripe I have with most claims made in controversial debates: everything is placed on a binary scale of good and evil.

It’s true that any one of these traits can be unproductive. For example, getting aggressive because you perceive that some guy across the bar is looking at your funny isn’t productive. However, us humans have these traits so they must serve some kind of purpose, right?

If you subscribe to the idea that humanity was created by a higher power, then you likely accept that we were given these traits for a reason. Likewise, if you subscribe to the idea that humanity is the product of millions of years of natural selection, then you’re probably open to the idea that these traits serve some evolutionary purpose. Either way you look at it, these traits obviously have some benefits.

I find that most of the people who criticize stoicism don’t actually understand stoicism (this can really be said about most critics of most things). Stoicism doesn’t teach that humans should be emotionless automatons. It teaches that humans shouldn’t be slaves to their emotions. Not making rash decisions based on the whims of your feelings is actually a pretty solid foundation upon which to build a personal philosophy in my opinion (another aspect of stoicism is to treat others fairly and that all individuals are equal, which are other points that I think make a good foundation for a personal philosophy).

Without competitiveness humans likely wouldn’t strive to achieve great things. Look at the Space Race. The United States put a man on the moon to show up the Soviets, who put the first artificial satellite and man into orbit to show up the United States. All of those satellites currently orbiting the Earth that enable satellite television, the Global Positioning System, and global communications are the byproduct of competitiveness.

You might not expect a self-proclaimed anarchist to say anything positive about dominance but even it can serve a valuable purpose. Consider the scenario where somebody gets shot. All too often this scenario can result it onlookers doing nothing other than recording the aftermath and uploading it to YouTube. When this happens, the person who was shot often dies. However, if a single person decides to dominate the situation, the outcome often changes. All it takes in those situations if for a single individual to point to a specific person and say in a commanding voice, “You, call 911,” to get medical personnel on site. Dominance is an important trait in crisis situations because if nobody takes charge, more often than not, no coordinated effort is made to deal with the aftermath in a productive way.

Aggression is also a valuable trait unless you enjoy being steamrolled constantly. If somebody tries to coerce you into doing something you’d rather not do, getting aggressive is often the best way to convince that person to strong arm somebody else. For example, if an individual is attempting to kidnap you, fighting back fiercely might convince them that you’re more trouble than you’re worth.

So all of these traits, on a whole, are not harmful. They can be harmful in excess but that is true of all human traits. But recognizing that requires breaking away from the binary thinking that dominates thinking here in the United States (and, really, most of the world).

You’re Unboxing It Wrong

Apple has spent the last couple of years transitioning itself from a consumer electronics company to a luxury products company. For the most part it has been doing a good job of this. The company’s attention to detail on its products is easy to see. However, when you’re a luxury products company, expectations go up. Somebody who buys a Seiko 5 isn’t likely to throw a fit because the second hand doesn’t sweep smoothly. Somebody who spends the big bucks on a Rolex is probably going to be unhappy if their second hand isn’t gliding smoothly over the watch face. Likewise, somebody who buys an Amazon Fire table is probably willing to tolerate a number of limitations and defects. Somebody who spends no less than $799 on an iPad Pro is probably going to be unhappy if their brand new tablet is bent out of the box:

Apple has confirmed to The Verge that some of its 2018 iPad Pros are shipping with a very slight bend in the aluminum chassis. But according to the company, this is a side effect of the device’s manufacturing process and shouldn’t worsen over time or negatively affect the flagship iPad’s performance in any practical way. Apple does not consider it to be a defect.

The thing about being a luxury products company is that you need to make your customers feel special. Telling them that they have to live with a defect on a brand new product isn’t going to fly, especially when your cheaper competitors are apt to replace new products that have any kind of defect whatsoever (if you received a slightly bent Fire table, Amazon would probably get a replacement heading your away immediately).

Apple’s response on this matter is reminiscent of Steve Jobs’s response to people complaining about the iPhone 4 dropping calls when they held it in their left hand (for those who don’t know, he told them that they were holding it wrong). That might have flown when the iPhone was a reasonably priced option on the market but I have my doubts that such a cavalier attitude is going to fly now that Apple’s products are priced as high as they are.