Commit Graph

299 Commits (f92d061bc0eb0cc41879eb880212220220ea6892)

Author SHA1 Message Date
Mike Gerwitz f92d061bc0
:resume: Update wording
This is merely annual housekeeping; it is not in preparation for
job hunting. ;)
2018-05-01 22:37:51 -04:00
Mike Gerwitz ea177110c5
When Talking About Mobile Tracking, Don't Veil Bad Actors With Blanket Statements
It's difficult to have useful conversations about mobile tracking when
  someone says "your phone / mobile device tracks you";
  such statements don't often lead to constructive conversation because they
    are too vague and therefore easily dismissed as sensationalism or
    paranoia.
  And they are all too often without substance because,
    while users do have legitimate concerns,
    they aren't necessarily aware of the specific problems contributing to
      those concerns.

A mobile device is nothing more than a small computer that you carry around
  with you.
The networks that you connect to can spy on you---your
  cellular network, bluetooth, wifi, etc.
To help mitigate these threats,
  you can disable those communications until you are in a safe place that
  you don't mind others knowing about.
We can only have confidence that these connections have been disabled by
  physical means,
    like a hardware switch or a bag that acts like a Faraday cage.
[iOS deceives users][ios-deceive] when they ask to disable those communications
  for example.

The software running on your device often spies on you:
  the operating system itself often spies;
  the apps you install often spy.
This is the fault of the individual _authors_---_they_
  are the problem.
Consider using free/libre software that empowers you and serves _you_ rather
  than its creators;
    it's much harder to hide secrets in free software.
On Android,
  consider using only free software available in [F-Droid][].
We also need fully free mobile operating systems,
  like [Replicant][] and hopefully Purism's Librem 5 that is still under
  development.
Don't be fooled into thinking the Android on most phones is free
  software---only
    its core (AOSP) is.

Call out those that do harm---don't
  veil and protect them using statements like "your phone tracks you".
Talk about the specific issues.
Demand change and have the courage to reject them entirely.
This involves inconvenience and sacrifice.
But if we're strong now,
  then in the near future perhaps we won't have to make any sacrifices,
  much like the fully free GNU/Linux system desktops we have today.

Fore more information on tracking,
  see my [LibrePlanet 2018 and 2019 talks](/talks) "The Surreptitious Assault on Privacy,
  Security, and Freedom" and "The Ethics Void", respectively.

[F-Droid]: https://f-droid.org
[ios-deceive]: https://web.archive.org/web/20170922011748/https://support.apple.com/en-us/HT208086
[Replicant]: https://replicant.us
2018-04-24 23:18:27 -04:00
Mike Gerwitz b9d6fc0314
:style.css: Reduced line width, increased height
Improve readability.
2018-04-24 22:24:17 -04:00
Mike Gerwitz 5027e5b27c
:Resume: The Ethics Void 2018-04-14 00:51:11 -04:00
Mike Gerwitz cd53ff95ed
:Add ethics void links 2018-04-14 00:44:07 -04:00
Mike Gerwitz 4387bd420b
:doc/40-talks.md: Update LP2018 talk abstract 2018-03-17 15:29:38 -04:00
Mike Gerwitz a985435866
Meltdown/Spectre and the Web
The recently-released [Meltdown][] and [Spectre][] CPU timing attacks
  affect virtually every user in some way;
    the consequences are profound.
There are plenty of good write-ups on the topic,
  so I don't feel the need to re-iterate the technical details here.
(See an easily digestible one [from the Raspberry Pi][rpi] project, and an
  in-depth analysis [from Project Zero][zero].)

What I do want to draw attention to is that these attacks [are exploitable
  via web browsers][mozilla].

The reason for this is that your web browser,
  by default,
  automatically downloads and executes programs without your knowledge or
    consent.
Most commonly,
  web pages embed software in the form of JavaScript code.
Because of the features available in modern JavaScript environments,
  CPU cache timing attacks are possible.

[I spoke about the security issues][lp2016] of running these programs in your web
  browser back in 2016---it
    was a bad idea then,
      and it's still a bad idea now.
[I spoke further of privacy issues][lp2017] last year at LibrePlanet 2017.
I encourage you to use extensions like [NoScript][] to block the execution of
  JavaScript by default,
    and stop random people from treating your computer as a puppet to do
    their own bidding.

[Meltdown]: https://meltdownattack.com/
[Spectre]: https://spectreattack.com/
[rpi]: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/
[zero]: https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
[mozilla]: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
[lp2016]: https://media.libreplanet.org/u/libreplanet/collection/restore-online-freedom/
[lp2017]: https://media.libreplanet.org/u/libreplanet/m/the-surreptitious-assault-on-privacy-security-and-freedom/
[NoScript]: http://noscript.net/
2018-01-08 22:27:38 -05:00
Mike Gerwitz cc0c4fcb58
:Update repo URLs for footer commit links
* Makefile (url_root, repo_url): Update URLs.
2018-01-06 00:39:05 -05:00
Mike Gerwitz e6c03df640
:Correct LP2018 link on Talks page
* docs/40-talks.md: Correct LP2018 link.
2018-01-05 23:02:45 -05:00
Mike Gerwitz 34c3eedd45
:Remove #tags from new talk abstract (The Ethics Void)
Oops!  Copied from the GNU Social notice.

* docs/40-talks.md (The Ethics Void): Remove #tags.
2018-01-05 23:00:52 -05:00
Mike Gerwitz 09900b8dbf
:Correct LP2016 logo on Talks page
* docs/40-talks.md: Correct LP2016 logo.
2018-01-05 22:59:19 -05:00
Mike Gerwitz b4cceff3fc
The Ethics Void: Join Me at LibrePlanet 2018!
I got word today that I'll be speaking again at this year's [LibrePlanet][]!
I was going to attend even if I were not speaking,
  but I'm very excited to be able to continue to build off of last year's
  talk and further my activism on these topics.

The title of this year's talk is _The Ethics Void_.
Here's a rough abstract:

> Medicine, legal, finance, journalism, scientific research—each of these
> fields and many others have widely adopted codes of ethics governing the
> lives of their professionals. Some of these codes may even be enshrined in
> law. And this is for good reason: these are fields that have enormous
> consequences.

> Software and technology pervade not only through these fields, but through
> virtually every aspect of our lives. Yet, when compared to other fields, our
> community leaders and educators have produced an ethics void. Last year, I
> introduced numerous topics concerning #privacy, #security, and #freedom that
> raise serious ethical concerns. Join me this year as we consider some of
> those examples and others in an attempt to derive a code of ethics that
> compares to each of these other fields, and to consider how leaders and
> educators should approach ethics within education and guidance.

(My previous talks can be found on my ["Talks" page][talks].)

For this talk,
  I want to solicit the community at various points.
I know what _I_ want to talk about,
  but what are some of the most important ethical issues to _you_?
Unfortunately there's far too much to fit into a 40-minute talk!
Feel free to send me an e-mail or reply to the [thread on GNU Social][thread].

[LibrePlanet]: https://libreplanet.org/2018/
[talks]: /talks
[thread]: https://social.mikegerwitz.com/conversation/99140
2018-01-05 22:55:53 -05:00
Mike Gerwitz e521680ece
:Year-specific LP logos on Talks
* docs/40-talks.md: Consistent styling and year-specific logos.
* images/lp-2016.png: Add LP2016 logo.
* images/lp-2017.png: Add LP2016 logo.
* style.css: Whitespace above logos.
2018-01-05 22:48:09 -05:00
Mike Gerwitz 4f5a47a970
:Add The Ethics Void to Talks page
* docs/40-talks.md (The Ethics Void): Add section.
* images/lp-2018.png: Add LP2018 logo.
* style.css (.talk-logo): Add class.
2018-01-05 22:36:48 -05:00
Mike Gerwitz cd806b4a23
:Fix LP201{7=>6} title for 2016 talk LP image
* docs/40-talks.md: Correct lower image title.
2018-01-05 22:02:48 -05:00
Mike Gerwitz 781a073692
:Here's a hash
49142b66305e2ef67755c21bea80b13ec06ff025

Just in case you were looking for one.
2018-01-05 00:51:09 -05:00
Mike Gerwitz b61ced73b6
:Restrict index body width to 40em 2017-10-29 00:15:09 -04:00
Mike Gerwitz 5accbfbac4
:resume: Objective section update
Mention of educator/research role.  It is hard to articulate this cleanly;
it is better that someone just ask.
2017-09-23 23:03:40 -04:00
Mike Gerwitz ce5eda1527
:resume: Reduce length slightly
This removes some whitespace, extra sentences that aren't needed, and
entirely removes the education section that wasn't adding any value or
useful information; I'm self-educated.
2017-09-23 21:34:27 -04:00
Mike Gerwitz 8e39d0abde
:resume: FSF abbr whitespace fix
Newlines appear in rendered title.
2017-09-23 21:19:24 -04:00
Mike Gerwitz 686895429e
:resume: Add EFF affiliation 2017-09-23 21:18:40 -04:00
Mike Gerwitz c69a64d600
:about.md: Image license notice nbsp 2017-09-23 13:39:32 -04:00
Mike Gerwitz df0b0c38c1
:Desaturate icons on all resume layouts 2017-09-23 13:36:11 -04:00
Mike Gerwitz 64cbee0030
:Add EFF link 2017-09-22 03:07:18 -04:00
Mike Gerwitz a8a6dadd31
:Add images/tp build
This adapts the same methodology I used for my SAPSF LP2017 talk to keep
third-party resources out of the repository.  This is not only good from a
licensing perspective, but also good for the repo and programatically
defines how I derive the image displayed on my site from a source image (and
proves that it does not constitute a derivative work, as it is not
transformative).
2017-09-22 03:06:37 -04:00
Mike Gerwitz 8a36221301
:githubbub: minor wording update 2017-08-01 22:00:33 -04:00
Mike Gerwitz 82745bc857
:resume: Link to githubbub
Originally I wanted to keep the resume purely informational regarding my
skills.  This is more proper, for me.
2017-08-01 01:32:27 -04:00
Mike Gerwitz 311741bac4
:Octoright octoflop
It should be obvious, no?
2017-08-01 01:30:33 -04:00
Mike Gerwitz a816754a34
:Resume HN icon 2017-07-30 22:42:53 -04:00
Mike Gerwitz b26e73f278
:Fade resume icons in lower-res views 2017-07-30 22:17:23 -04:00
Mike Gerwitz 50a05be618
:Fix short GPG key on resume 2017-07-30 01:24:21 -04:00
Mike Gerwitz 7414318a8c
:Organize headline images vertically at smallest resolution
Was squishing text too much.
2017-07-30 01:16:45 -04:00
Mike Gerwitz b7eeecc280
:Responsive design for resume
Complete with snarky remarks.

I'm surprised this has gone this long without me realizing that I never
implemented lower-resolution views.
2017-07-30 01:00:42 -04:00
Mike Gerwitz 879db402d6
:Fix HN icon display on mobile 2017-07-29 08:47:41 -04:00
Mike Gerwitz be4fda5058
:Remove `Academic' languages in resume
Not necessary; so infreqently used that they're useless to list.

* docs/about/resume.html: Remove academic languages.
2017-07-24 21:29:01 -04:00
Mike Gerwitz 0633a1dd4d
:Move Education to bottom of resume
* docs/about/resume.html (Education): Move section to bottom.
2017-07-24 21:27:02 -04:00
Mike Gerwitz bd59be0d37
Don't force me to use your tools [on the Web]
There was an interesting discussion on [libreplanet-discuss][] recently
  regarding web interfaces.
Below is a rather informal off-the-cuff statement regarding the use of Web
  interfaces (specificlaly Discourse) over my own tools.

-----

I live a huge chunk of my life in my mail client
  (which happens to be my editor as well).
It's scripted,
  heavily customized,
  and integrated with other things.
I do task management with Org mode,
  which integrates simply but well enough with Gnus.
I can use my editor keybindings and such when composing messages.
The same goes with my IRC client.
I never have to leave home, if you will.

Contrast that with websites:
  if I have to write anything substantial,
    I often have to write it in my editor first and paste it in.

Many of us hackers don't care for flashy interfaces;
  we'd rather use the tools we've invested our lives into and know well.
  Tools that can compose and work well in pipelines.
Trying to use interfaces that reinvent the wheel poorly is painful.
And let's not be fooled---these are programs.
Especially when they're heavy on JavaScript.
There's no difference between this and someone asking me to download Foo and
  put my Emacs toy away, as cute as it is.

But I know that many people don't feel that way.
I have coworkers that think I'm crazy (respectfully so).
And I think they're crazy too. ;)
Admittedly, using your own tools is a large barrier to entry---my
  tools are useful because I've spent a great deal of time learning and
    researching and customizing.
And now I can reuse them for everything.
For your average user looking to get into activism,
  who may not even be a programmer,
  that's a bit different;
    it's easier to say "here's your single tool (Web)---go use it".

There are systems that allow for a level of integration
  (e.g. mailing lists and forums).
But they're often treated as fallbacks---as second-class citizens.
They might provide a subset of features;
  it leaves certain members of the community out---those
    who want to use their own tools.

I haven't used Discourse.
I do see "mailing list support";
  maybe that's a good sign.
But one of the phrases at the top of the features page is
  "[w]e're reimagining what a modern discussion platform should
  be".
Many of us don't want to see it reimagined.
That's the opposite of what many want.

Trying to strike a balance isn't a bad thing if that's the audience
  we're looking to attract.
But it's difficult,
  and something I struggle with a great deal.

-----

tl;dr:
  Asking someone to use an interface on the Web is asking them to use
    /your/ program instead of their own.
  Be respectful by using [Web standards for accessibility][accessibility];
    [progressive enhancement][];
    and make use of well-established standards with rich histories,
      especially if your audience makes use of them
      (e.g. mailing lists, RSS feeds, federation standards, etc).

Thank you.

[libreplanet-discuss]: https://lists.gnu.org/archive/html/libreplanet-discuss/2017-06/msg00032.html
[accessibility]: https://en.wikipedia.org/wiki/Web_accessibility
[progressive enhancement]: https://en.wikipedia.org/wiki/Progressive_enhancement
2017-06-27 01:33:03 -04:00
Mike Gerwitz d68fc4d991
Russia wants to review source code of Western security software
Reuters [released an article][0] entitled "Under pressure, Western tech
  firms bow to Russian demands to share cyber secrets".
Should Russia be permitted to do so?
Should companies "bow" to these demands?

I want to draw a parallel to another highly controversial case regarding
  access to source code:
    the [Apple v. FBI][2] case early last year.
For those who don't recall,
  one of the concerns was the government trying to compel Apple to make
  changes to iOS to permit brute forcing the San Bernardino attacker's
  PIN;
    this is a [violation of First Amendment rights][3] (compelled speech),
      and this afforded Apple strong support from even communities that
      otherwise oppose them on nearly all other issues.
The alternative was to have the FBI make changes to the software instead of
  compelling Apple to do so,
    which would require access to the source code of iOS.

Becuase of the hostility toward the FBI in this case,
  even many in the [free software community][4] took the stance that the FBI
  being able to modify the software would set terrible precedent.
But that's missing the point a bit.
Being able to modify software doesn't give you the right to install it on
  others' devices;
    the FBI would have had to compell Apple to release their signing keys
    as well---_that_ is a dangerous precedent.
If the government compelled Apple to made changes themselves,
  _that_ is dangerous precedent.

"Cyber secrets" in the above title refers to source code to software written
  by companies like Cisco, IBM, SAP, and others;
    secrets that can only exist in proprietary software that
      [denies users the right to inspect, modify, and share][1] the software
      that they are running.

For those who agree with the free software philosophy,
  it's important to remove consideration of _who_ is trying to exercise their
  [four freedoms][1].
In the case of the FBI,
  from a free software perspective,
  of course they should be able to modify the software---we
    believe that _all_ software should be free!
      (But that doesn't mean they should be able to install it on _someone
      else's_ device.)
In the context of this article by Reuters:
  Russia doesn't have to ask to examine software that is free/libre.
  And if they did, it shouldn't be a concern;
    restricting who can use and examine software is [a slippery slope][5].

Unfortunately, not all software is free/libre.
But if we extend the free software philsophy---there
  should be no _ethical_ concerns with a foreign power wanting to inspect
  proprietary source code.
But proprietary software might have something of concern to hide:
  it might be something malicious like a backdoor,
  or it might be something like a lack of security or poor development
  practices;
    [proprietary software exists only to keep secrets][6], after all.

If Russia has to ask to inspect source code for security software,
  you probably do too.
And if that's the case,
  the security being provided to you is merely a facade.
It's not Russia to be suspicious of for asking---it's
  the companies that keep secrets to begin with.

[0]: http://www.reuters.com/article/us-usa-russia-tech-insight-idUSKBN19E0XB
[1]: https://www.gnu.org/philosophy/free-software-even-more-important.html
[2]: https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute
[3]: https://www.eff.org/deeplinks/2016/03/deep-dive-why-forcing-apple-write-and-sign-code-violates-first-amendment
[4]: https://www.gnu.org/philosophy/free-sw.en.html
[5]: https://www.gnu.org/philosophy/programs-must-not-limit-freedom.html
[6]: https://www.gnu.org/proprietary/proprietary.html
2017-06-24 00:37:15 -04:00
Mike Gerwitz 25061618a2
:Update sapsf{=>.pdf} link on Talks page 2017-06-11 01:26:59 -04:00
Mike Gerwitz 2c015a8844
:GitLab self link title rename to mention username
* tpl/.config: Mention username in GitLab self link.
2017-06-11 01:11:19 -04:00
Mike Gerwitz ee07c2ccfb
:Add HN self link
Uses "HN" instead of the "Y" in the YCombinator icon.

* style.css: Create HN icon out of link.
* tpl/.config: Add HN link.
2017-06-11 01:10:10 -04:00
Mike Gerwitz cea58a8164
:doc/40-talks.md: Source code and bib link for sapsf 2017-06-08 00:34:09 -04:00
Mike Gerwitz 693165d552
GNU is more than a collection of software
GNU is more than just a collection of software; it is an operating system:

  [https://www.gnu.org/gnu/thegnuproject.html]()

Many hackers and activists within the free software community don't
understand this well, and it's a shame to see attacks on GNU's relevance (as
measured by programs written by GNU on a given system) going
unchallenged. Software for GNU was written by the GNU Project when a
suitable free program was not available. It wouldn't have made sense to
write everything from scratch if free programs already solved the problem.

When we say GNU/Linux, we really are referring to the GNU operating system
that just happens to be using Linux. It could be using the FreeBSD kernel
([GNU/kFreeBSD][]). It could be using a Windows kernel with a Linux API
([GNU/kWindows][]). It could be using the [Hurd][] ([GNU/Hurd][]). The
disambiguation is important, but the end result is pretty much the same.

There are many systems that use Linux that are not GNU. Android is not GNU,
for example. We shouldn't attempt to call those systems "GNU/Linux"
blindly. (Also note how it's called "Android", not "Android/Linux", or just
"Linux". Somehow GNU is controversial, though.)

So if you see someone challenging GNU's relevance because GNU/Linux contains
so much software that isn't part of a GNU package, then please provide the
above link, and kindly explain to them that their observation is correct,
because GNU is an operating system, not a collection of programs.

[GNU/kFreeBSD]: https://en.wikipedia.org/wiki/Debian_GNU/kFreeBSD
[GNU/kWindows]: https://mikegerwitz.com/2016/04/GNU-kWindows
[Hurd]: https://www.gnu.org/software/hurd/
[GNU/Hurd]: https://www.debian.org/ports/hurd/
2017-06-03 01:24:57 -04:00
Mike Gerwitz 675ae2a13a
:Remove Earth's Magic from resume
It's already covered by the freelancing section.  This was long enough ago
and my portfolio is large enough that this is really unnecessary.

* doc/about/resume.html (Earth's Magic): Remove experience.
2017-05-26 01:35:20 -04:00
Mike Gerwitz f46aea17af
Self-Discovery Before the Internet
This is an autobiographical opinion piece prompted by [a HackerNews
post][hn] discussing what it was like to learn programming before Stack
Overflow (and other parts of the Internet).

I'm not old.  I was born in 1989.  I started programming around 1999.  The
Internet sure did exist back then, but I was 10, and my parents weren't keen
on having me just go exploring.  Besides, it was dial-up---you couldn't go
search real quick; especially if someone was on the phone.  Using the
Internet was an _event_, and an exciting one at that, listening to those
dial tones, logging in using that old Prodigy dialog.  Back then you had
Dogpile and Ask Jeeves.  Most sites I'd visit by name; usually that was
GameFAQs or CNET download.com, because those are the sites my friend told me
about when he introduced me to the Internet.

I'm entirely self-taught.  I didn't know any programmers.  I didn't have
contact with any.  I told my parents that I wanted to learn how to program
and they skeptically brought me to Barnes and Noble where we picked out
Learn to Program with Visual Basic 6 by John Smiley (*gasp* yes I started as
a Windows programmer).  It came with a VB6 CD that for a while I was
convinced could only run the book examples, because I had no idea what I was
doing.  I struggled.  I tinkered.  Hacker culture was on the complete
opposite end of where I was, but by the time I discovered it years later, I
felt like I finally found myself---I finally discovered who I was.  The
struggle made me a hacker.

It's easy to half-ass it today.  It's easy to simply say "eh I can Google
it" and forego committing knowledge.  But it also makes it easy to gain
knowledge, for those who do care to do so.  It makes trivia easy.  It makes
discovery easy.  It also exposes people to subcultures quickly and
demands conformance to stereotypes and norms before one can discover
_themselves_.  Who would I be today without having to struggle for myself
rather than someone else _telling_ me who I am, and what I do?

This is more than just technical knowledge.  This is the difference between
dropping a child off in the wild or dropping them off at the local
scouts.  And at least scouts will discover themselves together.  With the
Internet, you absorb a body of existing knowledge; you _rediscover others_,
not yourself.  You often read blogs containing opinions of others, not books
or manuals.

That's not to say that you can't learn on your own.  Many still do.  Many
focus on manuals and books and source code rather than social media.  It's
sure hard, though, when everything is integrated as such.  Social media
can be beneficial---you do want communication and collaboration.  I sure as
hell want to communicate with others.  Opinions of others are deeply
important too.  Some of the best things I've read are on blogs, not in
books.  But I've already found my niche.  I've found myself.  I wasn't
tainted or manipulated---I learned in a world of proprietary software where
developing license systems was fun and emerged a free software
activist.  Because I was forced to look inward, not post on Stack Overflow
or HN or Reddit expecting a hand-guided tour or `dd` of thoughts (okay,
you're not getting that on HN).

Not everyone needs to be a passionate hacker or developer.  Really, the
world needs both.  And based on what I've seen being pumped out of schools
and universities, the self-taught are generally better off either way.  The
vast resources available to modern programmers make many tasks easier and
cheaper, though it also increases maintenance costs if all the programmer is
doing is using code snippets or concepts without actually grokking
them.  But this is what most of the world runs off of.

Let yourself struggle.  Go offline.  Sit down with a print book and get out
a pen and take notes in the margin, write out your ideas.  Getting syntax
errors in your editor or REPL?  Figure it out!  Or maybe consult the manual,
or the book you're reading.  Don't search for the solution.  When I learned
Algebra in middle school, I had little interest, and forgot all of
it.  Years later, I needed it as a foundation for other things.  I
discovered the rules for myself on pen and paper.  Not only do I remember it
now (or can rediscover on a whim), but I understand _why_ it works the way
it does.  I've had those epiphanies.  It's easy to miss the forest for the
trees when you don't gain that essential intuition to help yourself
out.  And the forest is vast and beautiful.

[hn]: https://news.ycombinator.com/item?id=14339293
2017-05-17 02:51:14 -04:00
Mike Gerwitz e7356fd8ef
:Add txt extension to githubbub files
Will ensure that proper MIME type is served to the client.
2017-04-14 00:50:03 -04:00
Mike Gerwitz f6c2a1e255
:s/&/+ in subtitle
My hacking and activism is inseparable.
2017-04-09 00:51:17 -04:00
Mike Gerwitz 91d6d46702
:Resume update
There are a number of changes here.  It doesn't mean that I'm looking for a
new job.  With that said, my employer surprised everyone with an acquisition
the day it was actually agreed upon, so we'll see how things go.
2017-04-09 00:49:14 -04:00
Mike Gerwitz 4191b282be
:Projects page is now a placeholder
Server now routes to cgit
2017-04-03 23:55:44 -04:00
Mike Gerwitz 58069270b1
:cgit styling (CSS) 2017-04-03 23:52:53 -04:00