Kyle Rankin @kyle@librem.one

Opt-out by default would be huge:

"Under the terms of the OPA, individuals would have the right to obtain, correct, and delete data collected about them by covered entities, as well as to request "a human review" of automated decisions. Users would also have to opt-in to having their personal data used for training machine learning algorithms." https://arstechnica.com/tech-policy/2019/11/new-bill-would-create-digital-privacy-agency-to-enforce-privacy-rights/

The 4-day work week is the headline, but I suspect the main productivity gains came from halving meeting times to 30 mins, limiting attendees to 5 people (with single representatives for each team), and encouraging chat for collaboration:
"Microsoft Japan Says 4-Day Workweek Boosted Workers' Productivity By 40%" https://n.pr/2qqT8m3

New book! I'm reading Poisoner in Chief, about the `50s CIA MK-ULTRA mind-control program. It references a manual CIA commissioned Mulholland, a Houdini protégé, to write. It documented slight of hand techniques to deliver poisons, etc. All copies were thought destroyed until one surfaced a decade ago.

Any kid who's successfully forged their parent's signature on school forms has demonstrated the flaws with biometrics as single-factor auth.

A reminder that biometric auth security is not based on secrecy (#biometrics aren't secret), but on the difficulty of making a copy that can trick a sensor. Now there's an app for that. #infosec

https://fossbytes.com/a-new-app-can-scan-fingerprints-from-drinking-glass-to-unlock-your-device/

Every breath you take, every move you make, every bond you break, every step you take they'll be watching you.

https://arstechnica.com/gadgets/2019/11/google-buys-fitbit-for-2-1-billion/

Out from his basement, greybeard's voice did ring
Seems he was troubled by just one thing
Checked his shell PID, and shook his fist
and said: "Whatever happened to my well-configured zsh?"

It's now just bash, the default shell is bash
The default bash, on Debian it's dash
It's now just bash, it'll catch on in a flash
It's now just bash, the default shell is bash

From my infrastructure in the US-east
To the master bedroom where my bedtime ceased
The DDoS came from some IoT nodes
And gave my front-end some error codes

They made it crash, they made the website crash
The website crash, it was production SaaS
They made it crash, I logged on in a flash
They made it crash, they made the website crash

I was working in Gitlab, late one night
When my eyes beheld an eerie sight
For the RAM used in a tab, began to rise
And suddenly to my surprise

It made it crash, Slack made the browser crash
That browser crash, it caused a keyboard smash
Slack made it crash, it made me lose my cache
It made it crash, Slack made the browser crash

Happy Halloween!

I always thought it would be interesting to see the lawsuits and other aftermath in cop movies when the hero and villain destroy half the town in the car chase and final standoff:
"Police Owe Nothing To Man Whose Home They Blew Up, Appeals Court Says" https://n.pr/2JuLI8f

Data isn't gold, it's uranium. Companies stockpile and refine it because of the great power it creates. But the industry is largely unregulated and creates hazardous by-products. When it spills it's almost impossible to clean up and when it explodes it leaves a wasteland behind.

Many people don't know that @purism offers an anti-interdiction service for laptop orders. In this post I describe what the service is and some of the measures we put in place, including some new ones based on our PureBoot tamper-evident boot process.
https://puri.sm/posts/anti-interdiction-services/

Five years from now: "Whoops, it turns out we trained our AI on existing staff so it finds white men most trustworthy. Sorry everybody, we were told AI was unbiased." https://www.maketecheasier.com/face-scanning-ai-judge-job-applicants/

Two interesting tidbits:
1. Actual enforcement of the penalty clause for abusing DMCA takedowns.
2. He could use DMCA takedowns to get a person's home address!

https://arstechnica.com/tech-policy/2019/10/man-agrees-to-pay-25000-for-abusing-youtubes-takedown-system/

I've gotten some questions about Packagekit and why we don't provide interactive signing during package updates. I talk at length about some of the challenges with that approach here: https://github.com/osresearch/heads/issues/533

I wrote an article about best practices (including travel tips) for PureBoot, @purism 's #FOSS tamper-evident boot firmware that allows the user to control all of the keys and secrets used for the signing process. Check it out here: https://puri.sm/posts/pureboot-best-practices/