Just published 15,000+ words on security keys. 🔐📱💻

With SIM attacks at their highest, now is a great time to take a closer look at your online security.

Removing SMS from your two-factor auth is a start, but authenticator apps have downsides too...

https://t.co/Dk0MPJHL2V

Just look at these headlines from recent SIM swap and port attacks.

It's all too established for attackers to find ways to socially engineer control of your phone number and start gaining control of your accounts.

I first talk about some general security tips.

Unfortunately not all websites let you remove your phone number from accounts.

You may consider migrating your phone carrier to @googlefi , which requires email account access to do anything (and can be locked down with security keys and even Advanced Protection)

Beyond SMS, I talk about issues that TOTP authenticator apps (the code generators) have as a form of two-factor auth. They're so, so much better than relying on SMS for your second factor but they still have issues like utilizing shared secrets and lacking phishing prevention.

Enter security keys!

Utilizing public key cryptography they don't have any shared secret between the client and the server. They prevent phishing by taking the website domain into account.

Even if you get tricked by a clone phishing website, your key won't.

Originally, tweet length was 160 minus username length. One day, I turned to Jack and pointed out that I got one more character than him. He said, "That's not fair. We should standardize." I agreed. He said, "How about 140?" I said, "Sure." And he updated the code.

Last year, we upgraded tweet length to 280 and guess what? Use of 'please' is up 54% and 'thank you' is up 22%. I love that! Also, people are asking more questions and having more conversations. All this, and the majority of tweets are still under 140. It worked.

Wanna disable Defender when enabled Isolated Core and Tamper protection?

Its a bit more trouble- but doable, without ruining Isolated Core/Secureboot etc.

Defenders process will run as a unkillable protected service- so new tricks needed.

Here we go:

Ok- tamper protection is easy, just make .bat - run as adm:
:again
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdFilter\Instances\WdFilter Instance" /v altitude /t REG_SZ /d -1 /f
goto again

Then unload minifilter with process hacker:

The registry key will be changed while the minifilter do not protect it, when tamper protection makes the driver load again it cannot attach to volumes nor protect registry keys.

Removing it will make it recreate, but invalid altitude do the trick

Notice now the service is: Protected light(antimalware)
Now we cant do anything to the service/process- not even see its open handles.

Lets start by elevating to SYSTEM- just launch a command prompt, then close process hacker- and run it again from the command prompt.
Now process hacker runs as SYSTEM

Facebook lost another 1 million daily users in Europe and stayed flat in North America as scandals and low engagement with teens come back to bite its business https://t.co/O7tfyIw7Fd tip @Techmeme

Facebook still added 37M monthly & 24M daily users thanks to big gains in the Asia-Pacific region, but those users earn it 1/10th as much as US/Can users

The real story dragging on Facebook's share price is that yearly revenue growth has fallen from 59% 2 years ago to 33% today. It's run out of lucrative Western users and News Feed ad space.

Let's remember that Facebook doubled its security staff & cut back on viral videos/clickbait. That drags on its profits & revenue, but are crucial to society. And while Twitter shares soar, it has made no such commitments to fighting harassment & misinfo.

What happens when a skill you have becomes obsolete? No, this isn't a R vs. Stata thread---it's a thread about a working paper w/ @sonnytambe!
https://t.co/w6nLf1tnST

The skill we look at is Adobe Flash, which @apple decided to no longer support back in 2010, which in turn caused demand/interest to plummet, as measured on @StackOverflow and in online labor markets, one of which is our empirical context

Despite the big fall-off in Flash jobs posted, very little else appeared to change in the market for Flash skills: wages for Flash jobs didn't fall, jobs didn't become easier to fill & openings weren't inundated with out-of-work Flash programmers

What happened was that (a) new entrants stopped specializing in Flash and (b) at least some existing Flash specialists started moving to other skills. In short, the demand shock quickly became a supply shock

At the level of the individual Flash worker, using a matched sample, we find (a) no fall-off in their wages, (b) some decline on-platform hours-worked. The most-focused on Flash workers had substantial increases in application intensity and a movement towards new skills

argh chrome updated and it seems they've intentionally broken custom search engines. I have had a keyword search for "foone" which searches my own twitter, so I just type "foone BLAH" and it gives me a twitter search for when I said BLAH, right?

but now I get that option in the titlebar of "search twitter self-search" which is the name of the search"
if I just type "foone blah" now...

it ignores the search I have had defined for years and just googles it.

and this is definitely on purpose because they didn't just break it, they changed it. it's now "fooneblah"

there doesn't seem to be an option to make this stop and get the old behavior back :(

Surveillance companies assure us that they employ safeguards to ensure that their customers aren't abusing their products to engage in unlawful or unethical surveillance. And yet, inevitably, these companies abuse their tools THEMSELVES.

1/

It's almost as though being the kind of person who dreams of achieving incredible wealthy by spying on people makes you kind of an asshole.

2/

Like the people at @VerkadaHQ, "a fast-growing Silicon Valley surveillance startup" whose male employees used its own products to sexually harass their female colleagues and received the barest wrist-slaps for

Male Verkada employees maintained a private Slack channel where executives posted photos of female employees - captured with the company's own surveillance tools - and made sexually explicit remarks about them.

4/

When this came to light, the company's founder and CEO Filip Kaliszan called an all-hands meeting, expressed disappointment in the harassers, and told them that they could either quit...or lose some stock options. They chose the latter and remain employed there to this day.

5/

[1/4] Ok this is really funny, check this out.
I was in the process of booking a flight via @OneTravel. Trying to make me book ASAP, they claimed: "38 people are looking at this flight".
Whoa, 38 is a lot, I have to hurry up. But first I have to check how they came up with 38 >>

[2/4] Right click and a quick "inspect" on the number, I found out the element's class name is "view_notification_random".
Awesome variable naming guys.
So you're _randomly_ trying to freak me out. Alright >>

[3/4] So what's your sophisticated pseudo-random algorithm?
Apparently, OneTravel are choosing a number between 28 and 45.
Because as you all know, based on serious psychological research, these numbers tend to make people book their flights fast #sarcasm #not42 >>

[4/4] Here's a bonus graph.
Thanks @IddoYadlin and #WolframAlpha.

We just launched a fun little tool called Phantom Analyzer. It’s a 100% serverless tool that scans websites for hidden tracking pixels.

I want to talk about how we built it 👇

The idea came about early this year after @mijustin gave us an idea about badges/certification, which developed into “what if we could scan websites for Google Analytics?!”. But we left the idea in Basecamp for many months.

Fast forward to Halloween, we’re thinking about fun ideas we could do to entertain people. We discussed “Phantom Analytics” in response to people getting confused with our product name, and had various ideas. And then we landed on the URL analyzer idea.

Once we’d finalized the spec, Paul got to work on our Halloween themed product and then coded up the HTML/CSS for it all. I then took it, put it into a Laravel application. Nice and easy.

Off the bat, I already knew the base stack I was using.

> Laravel Vapor
> ChipperCI for deployment
> SQS for queues
> DynamoDB for the database

We went with DynamoDB as we don’t want to worry about our database scaling!

Most commit messages are next to useless because they focus on WHAT was done instead of WHY.

This is exactly the wrong thing to focus on.

You can always reconstruct what changes a commit contains, but it's near impossible to unearth the reason it was done.

(thread)

Think about the last time you `git blame`d something.

You were almost certainly thinking "WHY is this like this?", not "What is a one-line summary of what happened in this commit?".

Here's the antidote: use this commit template (stolen from @joeferris).

```
[one line-summary of changes]

Because:
- [relevant context]
- [why you decided to change things]
- [reason you're doing it now]

This commit:
- [does X]
- [does Y]
- [does Z]
```

Leading with the WHY has tremendous value.

First, it captures context that will be near impossible to recover later. Trust me, this stuff is gold.

Secondly, if you train yourself to ask why you're making every change, you'll tend to make better changes.

Give this template a try for a while.

The first time you see a commit message like the above instead of "refactor OrderWidget", you'll be a convert.

Lockpicking Floppies!

I don't know why twitter is refusing to insert a card for this one. In any case, It's the @LockPickingLwyr, and it's a floppy-drive-lock.

so I've been meaning to do a video or thread on these sorts of locks myself. I have several, of different designs.

generally they're all designed vaguely like this one: it's a plastic insert that goes into the floppy drive, then it has some bit that rotates with the key to hold itself inside.

and they pretty much universally use super-cheap low-security tubular locks like this. You can probably pick most of them with a ballpoint pen

Keybort

This one is a MicroWeb Touch-1 XT/AT. Kinda.

See if you look up that keyboard you find the Deskthority page on it, showing this.
It's clearly pretty similar, but there are some differences.

Also that one uses a PC/XT/AT DIN5 connector, and this one uses some kind of RJ connector.

This one isn't in the greatest of shape, but considering I got it from the Chuck Colby estate sale, it's surprising it isn't completely water-damaged.

It's got some minor rust damage inside, where the metal clips rubbed off on the PCB.

"The engineers on my team just want to code. They don't want to have anything to do with product. They just want specs. What do I do?"

1/n Are you asking them do to X *and* do their "day job" as defined by their managers (and frankly your roadmap) ?

If so, start there...

2/n Do they have a reason to believe that doing X will in any way improve the quality of the product and make their lives easier? Have they ever seen X "work" ?

Show don't tell.

3/n Is there average day/week a quagmire of unnecessary meetings, wading through tech debt, struggling to get *anything* to work ... and jumping through process hoops to prove their worth?

If so...no they will not have bandwidth.

4/n How do incentives work on the engineering team? Maybe they want to help, but their "grade" is determined by something altogether different.

"I'd love to, but I am on the hook to deliver [some project] this quarter to make a good impression..."

Talk to eng management.

5/n Have they had any time to practice?

Or did they get thrown into the deep end the first time they were given a shot ... expected to brainstorm on demand, be as vocal as practiced PdMs and designers, and "participate" !

Make it safe to practice. Reasonable expectations.

15 Times Japan Proved It Was Lightyears Ahead Of The Game

Thread....

1. High-tech Toilets

Japanese toilets will not only wash and warm your bum, will also play music for you so no one can hear your business

2. Wrinkle Remover

Someone must have really hated ironing. They have a hands- and effort-free shirt wrinkle remover that eliminates wrinkles

3. Butter Applicator

Someone created a portable butter stick, just because they can

4. Braille Cans

Drink cans have information in braille on top to help those with sight issues.

5. Feeding Falsies

They’ve invented a device that allows fathers to approximate the benefits of breastfeeding.

help

stuff. just stuff. its all too easy to order more stuff. so much stuff. I dont need any more stuff but I cant stop ordering stuff.

Because microtest TDD is more a "way of geeking" than a technique or a received body of knowledge, building one's faculties is a long and sometimes perilous effort. Let's talk about learning.

(I, too, feel a little relief just now, tho not as much as some, because recent events aren't an ending, they're the beginning of a lot of work.

Black Lives Matter.

Stay safe, stay strong, stay angry, stay kind.

Let's keep changing this.)

I want to approach the question(s) of learning TDD in some ways that are a little different from others I've seen. I've written two TDD curricula myself, and am involved currently in helping with two more. I see all of them, including the current ones, as "interesting failures".

At first, learning/teaching TDD seems like a road, then over time it seems to become a tree, and ultimately it feels much more like a spreading activation network, including lots of external triggers, plateau periods, and transformative experiences.

(I'm open to the possibility that this is what *any* judgment-centric skill looks like, but for now I just want to talk about TDD.)