The Random Mumblings of a Disgruntled Muscular Minarchist
Igitur qui desiderat pacem praeparet bellum
Wednesday, October 28, 2015
You just... you have to laugh at the absurdity of it all...
Mel was transferring the rest of our stuff from a friends house to our storage unit, and had put a bunch of that stuff up on the front lawn, waiting to load it into the truck.
Then she and our friend went into the garage to get that stuff ready to load in the truck.
While they were in the garage, someone came by the front yard, and took most of what was out there.
It ended up being a couple thousand dollars worth of clothing, shoes, electronics, and furniture that they took... Including a lot of Mels clothes, a lot of the boys clothes, and most of what was left of my business wardrobe (I'm now apparently down to 3 pairs of pants, three collared shirts, and two button downs... That's not good).
It was also several hundred pounds worth of not obviously saleable things (all but the furniture was packed in bins ready to load up).
...And this is in Milton, a town with effectively zero crime, on a quiet side street in a nice neighborhood etc... etc...
Honestly... It may have been an overzealous charitable donation van, or someone assuming we were putting out trash, because I can't imagine someone just pulling up a van to grab all that. It just wouldn't look like it was worth much, and it would have been a fair bit of effort to move it.
And... I just have to laugh at the ridiculousness of it all... Just... Wow.
Thursday, August 20, 2015
Critical Process Capture
I'm going to illustrate for you how process capture, and broken processes, have real world consequences, for the success of your organization, as well as for the people in it.
At the very end of April, my father had a serious heart attack. In the wake of that, my wife and I decided to move back to the Boston area, to be closer to him.
I start looking for jobs up here, I go through interviews, I get some great opportunities, I spend most of June and early July hustling a new gig... I even get a choice of potential offers...
One of them looks like a really great gig, and it's only a few minutes from my dad, and they want me to start right away, and GREAT... I take the offer, I sign the contract, I let the other employers know I'm unavailable, and I start getting ready to come up here.
That was July 11th...
Now, it's mid... I guess late... August... August 20th to be exact. Six weeks after I signed the contract... and now tied for the longest time I've gone between signed contract, and start date.
When I was recruited, this was a critically urgent... in fact months overdue... requirement. And they had a very quick process for interviewing and hiring me... It was two weeks from first phone call, to signed contract, with a projected start date another two weeks out... "Maybe three at the most".
At this point, "the process" got started... and the failure started along with it.
A two week out start date, became the first week of August... Then, after my tickets have been booked for two weeks, and I'm a day from travelling, I get a phone call... It's not gonna be the 3rd, it'll be a meeting on the 5th to get my badges and paperwork done, and then I'll start either the 6th or the 10th.
Ok, that's annoying, but I can deal with it... a few days of hanging out with my family, seeing my friends... It's a big pain losing a week of billing, but we'll live.
Then I go to the meeting on the 5th expecting to be ready to go... get my badge, fill in my final paperwork... This is what my recruiter and contract manager said the meeting was supposed to be about...
Except "the process" had other plans.
I talk to the hiring manager in the meeting that Wednesday, and I find out that due to "delays in the approvals process", even though I had signed the contract on July 11th, the actual PO for the first phase of the engagement, had only been signed that Monday... and, because it is a completely serialized process, with no parallel work streams allowed, the SOW hadn't even been signed or approved yet.
At that point, they hadn't even started the paperwork to get me cleared to start, never mind a start date, a workspace, a PC, ID'S etc... and in fact, because of "the process", they weren't even allowed to START the sub process for doing do.
But "they're working on it"... "it should be the next week, assuming all goes well, or at worst, the 17th", because "someone will be working "the process" the whole time".
Only the week of the 10th the hiring manager goes on vacation... and I find out that nothing even got started the week before, except my background check...
... Which I told them at the first meeting would pop an issue if they did a credit check, because of the medical issues and losing the house etc... and which they said wouldn't be a problem, there was an exception process and they'd get started right away...
Remember, I signed the contract July 11th, and was told by the contracting agency, that the background check had cleared, THREE WEEKS BEFORE, or I never would have got on a plane in the first place...
And, of course, there's an issue with my background check, because they are one of the few companies that still does a credit check for pre-employment screening ...even though I'm just a subcontractor... and they have arbitrary rules about what's "clearable", so there's a problem...
...but there's an "exception process", and I need to wait for the paperwork from the background check company in order to do my part of the process... Which by the way they send to Florida instead of here, and which doesn't get to Florida, until this past SATURDAY, more than a week after the background check was initiated.
...Meanwhile my hiring manager needs to start the exception process... which can take 10 to 15 business days... which he was supposed to do after the meeting on THE FIFTH...
... Only he's on vacation, and he didnt start the "exception process" because they can't start the exception until the background check starts being processed and comes up with a problem... and that didnt actually happen until he was already on vacation... and the person who is supposed to be "working the process" isn't "working the process", because only the hiring manager is allowed to start the "except process"...
...but the manager "knows about it, and will start on it as soon as he gets back".
... yeah...
The hiring manager finally got back from vacation on Tuesday, and apparently NOBODY understands the damn process, because four different people in four different groups have a different idea of what needs to be done by who...
...and there can't be any separate work streams, it's all serial...
...and unless they can "expedite the exception process", it may be ANOTHER 10 TO 15 BUSINESS DAYS before the EXCEPTION can be processed... and that has to be completed before the REST of the on boarding process can even START...
... which may take 10 to 15 days beyond that...
... Unless they can "expedite the on boarding process"...
That's been my last few days... and in fact, my last few weeks.
Yesterday, I got a call from the contact administrator, the hiring manager says it's absolutely critical to get me on boarded as soon as possible, and he's working the exception process but needs me to go back to the group that told me that I need to have the hiring manager work the "exception process".
They're now six months overdue on the requirements I'm supposed to be filling, and every day I'm not working they fall further and further behind...
... but "the process" must be obeyed, and there is no way around it except "the exception process", which is really just another part of "the process".
Later today, I talk to that group again... I tried working with them again yesterday, but the guy who was supposed to be working with me, was out the last few days, and their backfill person had no clue what to do... except to "start the process over again" from scratch, which would take... you guessed it... another 10 to 15 business days.
This friends, is process capture... I'm almost tempted to say at its worst... but unfortunately, I've seen worse...
Monday, December 22, 2014
The concept of "Cultural Appropriation" is both false and harmful
If you're unfamiliar with the concept of "cultural appropriation" here's a definition (from wikipedia):
Cultural appropriation is the adoption of elements of one culture by members of a different cultural group, specifically the use by cultural outsiders of a minority, oppressed culture's symbols or other cultural elements. It differs from acculturation or assimilation in that cultural "appropriation" or "misappropriation" refers to the adoption of these cultural elements, taken from minority cultures by members of the dominant culture, and then using these elements outside of their original cultural context.Cultural appropriation, is often taken to be an act of racism, or at best racial insensitivity or intolerance, and in some cases, this can be a valid interpretation... SOME cases.
To be clear, Iggy Azalea doesn't claim to be black, pretend to be black, doesn't "act black" (whatever that's supposed to mean) in her normal speech, accent, or mannerisms etc... She simply raps in a style commonly used by black rappers.
Here's a video of her biggest hit to date "Fancy"(which hit number one earlier this year):
Overall, there is outrage, among the easily outraged, that a white woman is "acting black", and that this is racist, disrespectful, and cultural appropriation. Also, that she is racially insensitive... even stupid... And that in general, she sucks.
While I don't disagree that Iggy Azaelea sucks (actually, she's quite capable as a performer... she sucks on purpose, because it makes her... and her producers who really run the show... a lot of money), I hold the entire concept of "cultural appropriation" as a negative thing... or even as a thing... as not only false, but harmful.
If it was done mockingly, or deceptively, sure... but we're talking about a performance style, not someone actually passing themselves off as a different race.
More importantly, nothing is being STOLEN... You can't steal a cultural identity, or a performance style, or a form of artistic impression.
She isn't copying anyone in particular, she isn't plagiarizing, and she isn't stopping black people from rapping in the same way, or making money doing so.
No race "owns" any type or style of art. Just because someone of one race chooses to create or perform a style of art most commonly created or performed by another race, does not invalidate that art, or make it racist.
To suggest otherwise is to suppress freedom of expression.
It is also to suggest that Nat King Cole, Charlie Pride, and Harry Belafonte were illegitimate... or that the Beatles, Rolling Stones, The Who, The Yardbirds... Yeah, I could go on, about both sides... for hours.
I personally sing blues and soul. I love the music, it moves me, and I sing it very passionately, and well, with a great deal of emotion and expression...
If I preform this music as it is intended to be performed... or at all... Is that racist cultural appropriation?
I love Indian, and Mexican food... is it racist cultural appropriation if I cook and serve these foods in a restaurant?
Or is that just ridiculous?
Now... to criticize Iggy Azalea for racial and cultural stupidity... I'm right there with you.
But the whole cultural appropriation concept... or the notion that it somehow diminishes anyone or disrespects anyone... really needs to die.
Thursday, November 13, 2014
Well Fuck
It's a very desirable truck, a 2006 dodge diesel 4x4 in black. It's probably already in pieces.
It also had our cameras in it, some other electronics, a bunch of my tools, and most importantly, our car seat.
I just checked our insurance, and it won't pay, because it turns out it had been cancelled a few months back because the credit card I had set to autopay had expired, but we didn't get the notification because they were still sending them to the old address.
It's just been one damn thing after another the past few years.
Monday, August 04, 2014
I think he works for Apple
This was a GOOD thing.
Everything was clearly differentiated and visually distinct from every other thing, and could be easily found within ones visual field, whether on a large computer screen, or a small phone screen.
All of a sudden, in 2010 or so, this started changing for the worse.
What asshole suddenly decided that the new modern cool clean thing for interfaces was to undo ALL of that 30 years of progress, and make everything flat, 2d, and composed of meaningless geometric shapes, in bright primary colors, spread across a featureless background of bright primary colors; with no visual indication of, or connection to, that things name or function?
That asshole is fucking up the world, and he should be killed, immediately, and in a painful and public way; pour encourager les autres.
I think he works for Apple.
Tuesday, July 22, 2014
Mr. Watson... Go the hell away, I don't need you now
I really hate talking on the phone... Always have really, but more and more so as I get older.
I have to talk on the phone for hours and hours as part of my job; it's the absolute last thing I want to do when I'm not working
Even if I love you and you're a great friend and we haven't talked in a while... I still hate talking on the phone, and unless there's something specific to talk about, if you call me, I'm likely to say ten words (four of which are likely to be SSDD) and then beg off.
I make an exception for my less technical relatives, with whom I generally can't communicate via email, IM, or Facebook; and with whom I will have long phone conversations a few times a year... But that's pretty much it.
There are times when I simply cannot stand to talk with ANYONE on the phone, or even via instant message... sometimes for a few days at a time. My head just feels like exploding even thinking about picking up the phone.
When I am feeling like that, I will simply not answer the phone or IM for anything other than emergencies or critical work calls. I cancel my con calls, I don't even listen to voicemail never mind respond (oh and DON'T leave me voicemail unless its an emergency and its the only way you know how to contact me. IM, email, or TXT me... I LOATHE voicemail no matter what mood I'm in).
If I am in one of those moods... I am not avoiding you, I just REALLY DO NOT WANT TO TALK ON THE PHONE... Just EMAIL me. I can respond to you properly when I have time and when my head feels better.
Believe me... Its not you I hate.... Its the gods be damned telephone.
Wednesday, July 09, 2014
A Technological Life, or something like it
I got sick last Thursday and was in bed all day, Then I thought I was better enough to go to a 4th of july BBQ and made myself worse. Because I'm an idiot, and do this almost every time I'm sick.
Then Monday, I have no idea what happened, I don't recall doing anything stupid to it other than... growing old I guess... but for some reason my lower back just locked up.
Rather painful that. Could barely move. I tried to get out of my truck and pump some diesel, and I literally couldn't manage it.
Two hours of little Korean lady sadists (yes, it took two of them. The first one could only last about 45 minutes before she was worn out) beating, elbowing, kneeing, and walking on my back (accompanied by repeated exclamations in mixed Korean and English to the effect of "Jesus christ... too much muscle... all too tense... all tied in knots") later, and I could almost sorta kinda walk upright again.
Almost...
The next morning however I was completely locked up again, and I've pretty much been locked up in bed, or on the couch, ever since.
Yay, pain.
Being sick, makes you dumb. Having back pain, very much makes you dumb. Which kinda leads to to the next thing...
My macbook pro is out for warranty service with Apple right now, so I'm on my windows laptop.
As it happens, I also just changed phones.
We switched from Verizon to T-Mobile a few months ago, but were using our old verizon phones (they're unlocked multiband global 4g phones) with t-mobile SIMs (yes, this works, you just have to know how to reprogram the phone to work on the new network, and it has to be fully unlocked).
A few weeks into this, my Galaxy S4 decided to stop working on T-Mobiles network, so I had to replace it.
After researching and comparing the current smartphone landscape, I ended up picking up a google Nexus 5. It's alright, but I don't really like it. I tend to work my devices hard, and the Nexus just didn't quite keep up with what I wanted it to do.
Mels phone was also unreliable, and since I have been preparing to start a new contract which will have me travelling a lot, we needed to get her a reliable replacement.
Or rather I got a replacement. Since I didn't care for the Nexus 5 but Mel likes it, she got the Nexus, and I grabbed a Galaxy S5 (which I'm quite happy with, as I expected I would be. I loved my S4, and the S5 is a straightforward upgrade to it).
Both my windows laptop, and my new phone, are wonderful, current, high performing examples of their type... However, neither of them had my full and current working setup or documents on them. The setups that typically take me a few weeks or more of tinkering and tweaking to get right, when I switch devices.
I am one of those folks who depends on their digital exobrains to run their lives; because, so to speak, I've got too many active tracks going, and I LOSE track of the ones not currently active.
I had forgotten to configure two pieces of software, and two accounts, on my windows laptop and new phone. A combination of just too many little things to remember, and the fact that I've been braindead the last week between being sick, and having really bad back pain.
This not having my digital exobrains properly updated and configured caused me to miss several messages, emails, and two con calls over the past few days.
Nothing that's going to kill me or anything, just one of those irritations of modern life.
Monday, June 02, 2014
Let's all get screwed over JUST A LITTLE BIT LESS
This... in it's entirety. Not one single word said here is incorrect in any way.
This is not a left, right, or libertarian issue... it's an EVERYONE GETTING SCREWED MORE issue.
Let's all try to get screwed JUST A LITTLE BIT LESS people.
It's a Typical American Phenomenon...
...and who, again mostly are not in fact conservatives, mostly they are reactionary right wing populists...
...are up in arms... again... about the possibility that Republicans might actually work with Democrats on some nebulous form of "Immigration Reform".
Outside the Beltway: House Republicans To Move Forward On Immigration Reform This Summer?
So... To be clear...
U.S. Immigration laws, regulations, and policies are universally recognized by all parties, regardless of politics, in and out of the U.S.; as stupid, wrongheaded, ineffective, and in fact damaging to both the nation, and to those who seek to immigrate here.
We are very effective at keeping the people out who we actually want here. We are absolutely ineffective at keeping out the people we want out.
There are many reasons for this, but they pretty much all come down to the laws, regulations, and processes being completely wrong and stupid...
... and EVERYONE KNOWS IT.
The current disagreement is in theory based on the idea that we should go about fixing these problems in a slightly different order, or with slightly different priorities.
From the politicians side of things (and yes, they are their own side here, and they're all on the same side... the one that obtains and retains greater power for them) the dispute is ACTUALLY about who gets to score what points, with what voting and donor blocs, and what media organizations.
From the PEOPLES standpoint, the dispute is ACTUALLY about the fact the "sides" don't trust each other not to use the issue to deliberately screw over the "other side"...
... and of course about ingroup identification and social signalling, because this is a "wedge issue".
And mostly, the people doing the "arguing", are the vocal morons who have no clue what is actually going on, or why, or even what the laws, regulations, and processes ARE... Never mind what they should be...
... or the people who are USING THOSE PEOPLE... to whatever their particular ends may be.
So really... it's a fairly typical "wedge issue" in American politics today, more about "identity" than about the actual issue.
See "entitlement reform"
See "Tax Reform"
See "Environmental Policy"
Tuesday, May 20, 2014
Note to "OUR" side... Strongly worded communication to follow...
The headline was "Chipotle declares it's stores shooting galleries".
My response was thus:
Let us be absolutely clear...
After years of being perfectly fine with people carrying firearms in Chipotle stores, "open carry activists" carrying AR-15s and deliberately provoking confrontations with customers and police, have forced Chipotle to change their policies.
Note to "OUR" side:
This is not "activism", this is attention seeking, nothing less. It's the same kind of thing that conservatives decry about "feminist activists" who walk around topless around children, or "gay activists" who wear leather thongs and dry hump in street parades.
Yes... you should have the legal freedom to do that... because we live in a free society.
...But you shouldn't ACTUALLY DO IT, because doing to is nothing more than shocking sensibilities for its own sake. It's assholic attention seeking.
It also brings us back to one of those paradoxes, or irritating factors I keep coming back to...
"An unfortunate number of theoretically liberty oriented people are that way; not because liberty is the best way, but simply because they are horses asses, misanthropes, contrarian, or insane"
Thursday, February 13, 2014
I am sick of the last six weeks
This is a long story, but I really need to get it all out, at least to vent.
Ok... here goes.
So, just before we left New Hampshire, after a month of looking for a house and being repeatedly disappointed (a couple were sold out from under us, a couple weren't available 'til March or April etc... etc...), we managed to sign a lease on a house in Laconia.
Laconia is the biggest town in the New Hampshire lakes region, and largely the center of activities for the area. It's a nice place, an old mill town, and it still has a lot of the original 19th century architecture.
If you're a biker, Laconia has additional meaning, because it's the home of the third largest motorcyclist gathering in the country (after Daytona and Sturgis); Laconia bike week, held the week of fathers day every year.
The house wasn't exactly what we wanted (we wanted rural, or at least private, on some land if possible), but it was near the big lake (less than a mile from Winnepesaukee), pretty big (5 bedrooms, over 3000 square feet including the partially finished basement), in a nice quiet neighborhood but still close to everything, and it had a big fenced yard (important for the dogs). It even had a good sized pool off the rear deck.
So yay, new house.
Now all we had to do was drive back to Arizona, get our stuff and our dogs, then haul all of it, and us, back to New Hampshire.
How hard could that be, right?
**No, I wasn't silly enough to actually say, or even think, "how hard could that be" or "what could go wrong". After DECADES of extremely painful experience, I most certainly know better. Ask those questions, and they WILL be answered, THOROUGHLY.Yeah... So that's when the REAL unfun started
Actually, to be fair, the prelude to the unfun started on Christmas day, when Mels 93 year old grandmother (who lives with Mels dad) had a stroke, falling and breaking her hip in the process.
Now, our original plan was to drive back to Arizona over new years, spend less than two weeks with Mels dad (one week of which I was supposed to be at a clients site in Seattle), hook up the trailer, pack up the dogs, and head straight back to New Hampshire.
The second part of that got screwed up just before we left.
Mels grandmothers injury put her in the hospital for a week, after which she was transferred to a rehab clinic. The plan to deal with Grandmas injury was to have her come home from the rehab clinic the following week, and get a live in home care aide.
From a practical standpoint, what that meant to us, was that we couldn't stay with Mel's dad, because the spare bedroom would be in use by the home care aide.
So then, the plan was to stay with Mel's best friend (none of my friends in the area were in a position to put us up for a couple weeks). Unfortunately, her housemate (who is also her brother) objected to living with a two extra adults and a teething baby for a few weeks (understandably. It's a small house, and there's not a lot of noise isolation).
What we ended up having to do, was stay in a hotel; which should have been fine, since it was only supposed to be for a couple weeks anyway.
Sure, it's not cheap even in a room with a kitchen (it ended up being about $450 a week at an Extended Stay America. You pay more for the kitchen, but spend a LOT less on food and drink), but it's certainly tolerable.
So... then we actually set off...
The trip itself was pretty nice actually, minus the repeated ice storms. We got to hang out with friends and family we haven't seen for a while, and I got to meet family I hadn't met before; always good things.
Unfortunately, towards the end of the drive, I started coming down with something.
From about January 4th (when we checked into our hotel), I had a full blown flu. From the symptoms, likely H1N1 aka "Swine Flu", which has been widespread this flu season.
Meanwhile...
...actually, while we were driving from NH to AZ...
...the client changed their schedule.
So, instead of being onsite the week of the 6th, I was supposed to be onsite the week of the 13th.
From one perspective that was a good thing, since I ended up being sick the week of the 6th and wouldn't have been able to fly out there anyway.
Unfortunately, we were planning on LEAVING Arizona the week of the 13th (we were supposed to take possession of the house on the 15th). Moving the onsite a week later, also also meant staying in AZ until at least the 20th, and for logistical reasons the 25th.
So, we changed our plans again, and extended our hotel stay to the 25th.
Then, the Friday before I was to leave, the client cancelled the onsite week entirely. So, yay, I didn't have to fly while I'm still sick, but we'd already prepaid for a hotel through the 25th (had to prepay or it was 20% more expensive), and rejiggered everything else to make the 25th work. We couldn't change it all back.
Turns out that the later date would have been necessary anyway however, for four reasons:
First: At the same time as my client was being fickle, our new house in New Hampshire had a pipe burst. A large portion of the house flooded, with significant water damage; and the house wouldn't be ready for us to take possession until at least the 1st of February, possibly later.
We planned on, and agreed with the owners to take possession of the house on the 5th of February (that way we could leave the Friday before, and drive over the weekend, giving us plenty of time to get there).
Second: The next week, the steering on our truck failed while Mel was driving it.
Thankfully no-one was hurt, but the entire steering mechanism and part of the suspension were badly damaged, and needed replacement (with a newer design, heavier duty setup from the factory).
The failure was due to defective tie-rod ends (which it turns out were subject to a recall). The tie-rods were covered under the recall, but the parts that were damaged or destroyed because of them (and the associated labor) were not. The repairs, all up, including a rental car for five days, ended up costing about $3,000.
Third: Money...
By January 31st, between repairs, hotel bills, additional meals, additional travel expenses, and unreimbursed expenses from work (they're being paid on my check this Friday), we had to lay out a HUGE amount over our planned and budgeted expenses for the month.
Then there's the AMEX bill, covering all the previous travel and expenses, and purchases from December (moving is EXPENSIVE).
Then there's the actual BUDGETED travel expenses, and all our regular bills and expenses (truck payment, fuel, food, insurance, phones, medications etc... also budgeted).
Combined, our total outlay Jan-1 to Jan-31 (which, to be fair, included paying most of the bills and expenses from December) was somewhere around $17,000 (and no, I don't make NEARLY that much a month. In part it was covered by expense reimbursement, combined with pretty much all of what I took home in January, and part of what I took home in December).
That's nearly double the outlay we had planned for the month.
That $17,000 meant we wouldn't actually have enough cash to complete the move ($4,200 in rent and security deposit on the house, and $2,500 in travel expenses for the drive. Hauling a trailer, 3 people, and 2 dogs 3000 miles is EXPENSIVE) before February anyway.
Fourth: At that point I was still sick, and getting sicker.
The flu seemed to subside around the 14th or so, which was good. Unfortunately, the flu led to a sinus infection and bronchitis, which was not.
The sinusitis and bronchitis hung on for a while, but I was managing the symptoms fairly effectively with medication (I take adderall, and a very strong anti-inflammatory anyway, and it just so happens that the combination makes a pretty effective treatment for the symptoms of sinusitis and bronchitis).
Unfortunately, I take those medications because I need them to function properly. When their effects are being taken up relieving symptoms, they aren't actually making me functional.
Worse, the medications also masked the fact that I wasn't actually getting better. I was just staggering along being propped up by the wonder of modern medicine.
Some time around Friday the 24th, I started getting sicker again.
MUCH sicker.
For the first week I thought it was just a combination of sleep deprivation, and a relapse of the flu.
Meanwhile...
We couldn't extend our stay at the Extended Stay America past the 25th, as they were fully booked. Unfortunately, this is the time that peak golf travel season hits Arizona, and rates at any of the extended stay/kitchen suite places went from $450 a week, to $700 a week, basically overnight.
Thankfully, rather than find a place for a week at a ridiculous rate, a friend agreed to let us stay with him 'til the end of the month (when we planned to leave for NH).
Unfortunately, he got sick that week as well (though not from me. I was past the contagious stage then, and it turned out to just be a bad cold or maybe a light flu for him).
And I kept getting sicker...
By Sunday the 26th, I was pretty much in bed 24/7. In fact, from the 26th until today (February 13th. 19ish days ), I've pretty much been sick in bed, minus changing the actual location of said bed.
A couple times I've felt better for a day or two, only to be slammed back down even worse afterwards.
Anyway, our friend was sick, and he needed his place free of a teething baby and two houseguests in order to rest.
So, we ended up transferring from our friends place to another hotel a couple days early, and swallowing the $700 for a week (six nights actually). At least it was a much nicer place than the ESA (a Hilton garden inn, with a 2 room suite. Funny thing was, it was actually only $40 more than the ESA would have been).
Unfortunately, I couldn't enjoy the nicer surroundings, because I was pretty much out of my head sick. By that point, it was clear that my Bronchitis had developed into pneumonia.
And then life got more complicated...
At that point it was ALSO very clear we wouldn't be leaving AZ until WELL after the fifth. So, we asked our new landlords if we could take possession on the 15th.
Initially they agreed. Unfortunately, a few days later, they insisted that we take possession on the fifth, and pay a full months rent for February, plus the deposit etc... and that they wanted the full amount by the 5th.
Apparently the husband (who had initially agreed to our request) was fine with what we wanted to do, but the wife wasn't, and she was making the decisions.
After I told them this was unacceptable to us, they agreed to prorate the rent from the 5th, but no further.
I told them I was perfectly willing to pay from the 15th, ON the 15th, whether we were there to take possession or not; but that we weren't going to pay a full months rent for a half months occupancy (or likely less, given that we wouldn't even be able to LEAVE AZ until at least the 15th... frankly I doubted whether we could get to NH before the end of February). I thought it was kind of silly to lose tenants over a matter of 10 days rent, and that if they agreed to the 15th I would be willing to send them half the security deposit immediately.
Well, that wasn't acceptable to them.
So as of February 1st, we were stuck in Arizona, no longer having a new house to bring our stuff and our selves back to.
We started looking for a new place immediately of course.
And we had to change venues again...
By the 1st, it was clear that Mels grandmother wouldn't be coming home. Between her injuries, the stroke, and her dementia, she can no longer be cared for at home, even with an aide. She's still in the rehab facility, but when they release her, we're transferring her to a 24 hour care facility.
This is really for the best. She needs 24 hour care that she can't get here.
That also meant that the spare room in my father in laws house would be available to us again (of course, it ended up being available the whole month, and we could have avoided wasting $2,000 for a months worth of hotel charges, and god knows how much more on a bunch of takeout/restaurant meals for when we didn't want to use the kitchenette... but we didn't know that at the time).
So, not knowing how long it would take to find a new place to live in NH, and rather than pay for more hotel rooms, on the 5th we transferred our operation back to Mels fathers house.
And I kept getting sicker...
The day we moved over my father in laws house, I basically collapsed into the bed, and I've barely left it since.
The last eight days have been really bad, with low to medium fevers, sweats and chills, lots of pain (particularly joint pain, and stomach pain), a nasty cough, myalgia, stomach and intestinal issues, sinus problems, photophobia... it's just sucked frankly.
Actually, yesterday (the 12th) was the first day since the 24th that I didn't have a fever.
The only compensation has been that for most of the past week, the pneumonia has knocked me out for 10 or 12 hours a day. For the first few weeks of this crud, it was bad enough to keep me from sleeping, but NOT bad enough to knock me out.
Oh and by the by, my wife, and my 10 month old son have ALSO been sick for the last three weeks (since the week with our friend), though thankfully it's just been a mild flu or bad cold (it can be hard to tell) and a touch of bronchitis for them.
...Of course, it's also kept THEM from sleeping until the past few days as well.
Combined with the boys MASSIVE teething issue the past month or so... (he's cried more in the last six weeks than he did in the entire previous 9 months)... I pretty much hadn't slept the entire month of January.
Basically I was averaging about 2 hours of not particularly restful sleep out of every 24.
And then of course there's been the stress issue. The money, the mad rush, the uncertainty, the not having a place to live... You could say it's been a LITTLE bit stressful.
Between being sick, and not sleeping, I was pretty much a zombie for most of January (unless I was taking plenty of adderall, nasal spray, and anti-inflammatories, which you can't do all day every day).
Oh and of course, stress, sleep deprivation and exhaustion make illnesses worse, and make healing much harder. Frankly, it was probably the sleep deprivation and exhaustion that made it progress to pneumonia in the first place.
The bad news...
I just spent most of my second month (and half my third month) with a new employer, dead sick. For two weeks of that, I've been damn near useless.
I've been so sick, I've barely done any useful work in the last two weeks (I've been doing a lot of reading and research, and a little bit of writing), and I haven't been on anything billable for four weeks.
Also, I'm still in Arizona, a month after I was supposed to be back in New England, with at least a few more weeks to go before I actually make it back.
They're somewhat less than thrilled with me at the moment.
The good news...
I've got two pieces of good news actually.
First, the pneumonia seems to have broken. I haven't had a fever in over 24 hours, my coughing is greatly diminished... the only major thing really left is a particularly nasty sinus problem... and I think that's really a leftover, not a new sinus infection.
Second, we found a new house... and it's damn near exactly what we were looking for, at about half the price the Laconia place was (though it is MUCH more remote... which is both good and bad). Even better the owners are going to work with us on a lease to buy option. We're in the process of signing on it now (more on this house in a later post).
Ok, vent over...
Saturday, January 11, 2014
Satisfying Design, Unsatisfactory Solution
I AM going to have it fixed. The phone is functional except for the screen and it's $200 to replace that. No sense in NOT fixing a $700 phone.
Unfortunately, I'm in the middle of moving and business travel, and it's going to be a couple weeks to get my old phone fixed. I can't go a couple weeks without a phone.
When I'm working, I can't go two DAYS without a smartphone frankly. It's not only my telephone, it's also my organizer, my email client, my internet connection etc...
So, I had to rush out and get a new one.
Since I've already got multiple android devices (between us, I think Mel and I have seven or eight devices of some type, which run android in some fashion), and my iDevices are all several years old, I decided to grab an iPhone 5s (64gb black ).
Given my job, I need to have a working iDevice around for testing purposes if nothing else. My old iPhones are VERY old at this point. Having been purchased in 2009 makes them dinosaurs, which can't run the latest iOs, and thus no longer useful for testing. I was planning on picking up an iPad mini at some point soon... but what the heck, here's an opportunity to get a new iDevice while filling another need.
Verizon has a pay by installment plan that lets you keep your existing service plan (I'm well beyond my contract period, and have grandfathered unlimited data), so I DIDN'T have to lay out $800 all at once yesterday for a new phone, which is rather useful.
In fact, because I have a discount plan, I ended up getting the phone, and a great accessory bundle worth about $200 (including a mophie Juice pack power station pro ), for a grand total of $200 up front.
Unfortunately, I don't like the phone at all. In fact, I rather hate it both as a phone, and as a computing device.
Oh, it's pretty... it's just stupid and broken, by design.
I just don't care for iDevices. I need to have at least one around for testing purposes, and because there are still an unfortunate number of iDevice exclusive apps; so I don't regret buying it, and I'm not going to take it back...
I just don't like it.
I don't like how limited and simplistic iDevices are, even once jailbroken. I don't like being forced into Steve Jobs and Jony Ive's personal vision of "perfection". I like things the way I want them, not how Apple tells me I should want them.
I WANT options. I WANT complexity, when complexity is appropriate. I want to be able to do with my device what I wish, when I wish, how I wish...
Even jailbroken, iDevices just don't do that.
A perfect example: tethering
Even jailbroken, tethering is pathetic with an iPhone. You can't configure ANY options of any kind other than your WPA password. You can't even configure your SSID, as it's set automatically and unchangeably, to the host name of the phone.
Worse, when you are using the iDevice as a hotspot, it doesn't participate in the hotspot network. It can act as a gateway, but you can't be tethered to it, and communicate with it directly at the same time.
That is... universally, phenomenally, stupid and broken.
... but its "simple" and "elegant"... after all "users shouldn't have to think about those sorts of details and techy stuff, they just want it to work when they hit the button".
Yeah... I want it to work... and I want it to work in situations OTHER than what apple thinks will be common.
So, when I get my android phone fixed, I'm switching back... and I will have a very nice media streaming, game playing, and testing device.
Wednesday, December 11, 2013
Google Malware Detection Being Stupid Again
As it was here: http://anarchangel.blogspot.com/2010/09/google-malware-detection-throwing-false.html
and here: http://anarchangel.blogspot.com/2013/02/no-this-blog-is-not-hosting-malware.html
"No, this blog is not hosting malware
Sometimes googles malware detection gets a little stupid; and they flag completely benign sites as hosting or distributing malware.
In this case google malware detection is reporting that I am hosting or distributing content from "cooking issues" "a known malware distributor".
Well, first of all I'm not hosting or distributing content from them; they are (or were, I just removed it) a link in my blogroll nothing more.
Second, they aren't a known malware distributor, they're the blog of a few instructors at a cooking school who like to mess around with unusual and interesting techniques for producing food. Very good site, I just wish they'd update more often.
It appears they haven't updated since August... and it's entirely possible that in that time someone has snuck some malware onto their site... But much more likely is that they also have a link to a site, which has a link to a site etc... etc...
This is the weakness of automated malware detection, automated intrusion detection etc... In fact, this can even be used as a deliberate denial of service attack, getting "content protection" services to block a site (it can be VERY difficult and annoying to get unblocked).
Anyway, I've pulled the link off my blogroll and everything seems to be fine now, with no more false alarms."
Tuesday, December 10, 2013
Hmm... overkill or under targeting?
... and I admit, it got me a mite peeved.
So much so that I sent this EECB email directly to the CEO and SVP of customer service at DirecTV.
... and sent a trimmed (2000 character limit) version of the same thing through the "contact the president" site at DirecTV;
... and put up public facebook posts on both my timeline and theirs;
... and tweeted it (direct message and hashtagged);
... and submitted it to http://www.consumerist.com (who love ragging on cable companies and the like)
... and posted it on my personal blog:
https://www.facebook.com/cbyrneiv/posts/10152064462877436
https://www.facebook.com/directv/posts/10152064465007436
https://twitter.com/chrisbyrne/status/410307231209373696
http://anarchangel.blogspot.com/2013/12/directv-customer-service-problem-engage.html
DirecTV EECB mode: Engaged
@DirecTV
+DIRECTV
To: Mike.White@DirecTV.com; Ellen.Filipiak@DirecTV.com
Subject: Very difficult customer service and customer retention issue
Message body:
Dear Sirs,
I have been a DirecTV customer for almost four years, and have generally been satisfied, excepting several problems I have had over the years with customer service and billing (in fact most of these issues were early in my time with DirecTV, and were the fault of a third party telco bundling your services).
Up until now, all of these issues had eventually been resolved to my satisfaction; and I have always been very happy with the programming, content, and quality of service I received.
I am writing because I have been experiencing a very difficult and frustrating customer service problem with DirecTV, for more than four months now; which has caused me many hours of wasted time, and a great deal of frustration and irritation.
I am sorry to have to resort to direct email to deal with this problem, but at this point I have exhausted my other options.
The problem I'm currently having stands as this:
I moved from my service address at the end of August, to temporary accommodations while waiting to start a new job, and complete my relocation. Knowing that I would be doing this, I called DirecTV in late July (I can't recall the exact date this point), to ask that my service be temporarily suspended from August on, while I was moving.
At that time, they informed me that my service could be suspended for up to six months, that I should just retain my DVRs, and call for installation of mini-dish hardware when I had a new permanent home.
I would like to continue using DirecTV. As I said, I have been very happy with the content, programming, and quality that I have received up 'til now. In particular, as an avid football fan, I really love NFL Sunday ticket.
I moved as planned. Some time in early August (before Sunday Ticket games started) I disconnected my DirecTV receivers and packed them up in boxes with the rest of my household. Unfortunately, for some reason, my service was never suspended.
Since September, I have spoken with your customer service or billing reps numerous times; each time explaining the situation, each time being transferred to multiple people, each time being assured that the issue would be fixed. Each time, a month would go by, and your billing people kept adding another months service charges, and I would get collection calls. In October, they added an unreturned DVR fee, and early cancellation fee of more than $300, bringing the total to over $600.
In October, I finally found out that the reason my account wasn't suspended in August as requested, was because I had an outstanding balance on the date I had requested to suspend my service.
At that time (October 30th), I was told that I could pay the balance due in August (it was appx. $150, about a months worth of services plus a late fee), and my service would be suspended for up to six months; however I couldn't do that yet, as the billing department needed to remove the box fee, early termination fee, NFL Sunday Ticket charges, and additional service and late charges.
I am perfectly happy to pay for the services I received, I just don't want to pay for services I did not receive, nor fees incurred because my account wasn't suspended as requested.
On that call, I spent over 3 hours on the phone with various service, support, billing, and retention personnel, and was transferred multiple times. I eventually lost connection while on hold for over 30 minutes. However, before the call was lost, I was told that they were working on the problem, and that my account would be fixed; that I just needed to pay the outstanding balance due in August, and that if we were disconnected they would call me back, or send me a bill at my temporary residence. I never heard back from them, but I assumed that finally, given all the time and effort, the problem was solved.
Since that time I have started my new job, and changed temporary accommodations, moving all the way across the country for the second time since August (in August I temporarily moved from Idaho to Arizona. Then, in November I moved to temporary accommodations in New Hampshire. We're looking for a house in the area now).
A few minutes ago, December 9th (at 11pm at night by the way) I received another call from DirecTV's collections department, asking me for more than $600, and stating that my account was already in collections.
I explained the situation yet again, and asked the service rep to check the notes. She did so, but said that she couldn't do anything about this problem as it was now December, and the last call was in October. She said that since I couldn't PROVE that I had called to suspend service back in August, that I would have to pay the full amount (less the early termination fee and box fee... about $350 total) to get out of collections and have my service re-instated.
After several minutes of going back and forth with her on this issue she became strident, and I became angry. I said that I wanted to talk with a customer retention representative, as this was a customer retention issue. She refused, saying "this IS the only customer retention for this account". I asked to speak with a supervisor and she told me that none were available.
At this point I was quite frustrated and I told her that unless we could resolve this issue I would be permanently canceling service with DirecTV. I asked her if DirecTV was really willing to lose a customer who wanted to pay them $150, and continue paying them more than $100 a month for the next few years, over less than $200. She said that it didn't matter because my service was already cancelled and that I was already in collections.
I repeatedly told her that I was happy to pay the balance due for services I actually received, I just was not willing to pay several hundred more for services and fees I didn't receive and shouldn't have incurred.
Finally I asked her for some way of resolving this issue short of a law suit. She informed me that I could send a letter to a PO box in Colorado and ask for a dispute investigation. I asked if there were any other way of expediting the process; if there was an electronic form, if I could email them, if I could call them on the phone, if I could fax them, even if I could get a direct address not a PO box so I could overnight a letter. She said that I could only contact the dispute resolution department by postal mail to that post office box, and that I would need to attach documentary evidence of my claims to the letter in order for a dispute to be considered.
At this point I apologized for becoming angry, and ended the call. I then immediately looked up the executive customer service contact information.
Again, I am sorry to have to contact you directly... This isn't a matter of not being able to afford it, or not having the money (though after two moves in four months, with an 8 month old baby, money isn't exactly flowing freely), it's simply a matter of not wanting to pay for services I didn't receive, and fees I shouldn't have incurred.
I sincerely hope that we can resolve this dispute to our mutual satisfaction and benefit. I really would love to continue receiving service from DirecTV.
Thank you for your time and consideration, and any assistance you can render,
Chris Byrne
Sunday, November 24, 2013
Mad Rush - Day 1 - AAR
Point one: When the voice in the back of your head says "maybe you should do this thing just in case", you should generally listen.
In this case, it was "put a CB in the rental". I have a CB for my truck, but it's not a handheld. I don't happen to own a handheld CB at the moment. I thought about getting one to take in the rental with me, but I figured... "ehhh, what the hell, I probably won't need it". I also neglected to bring my handheld amateur radio, again thinking, "ehh, we're not going off the interstates, it'd be nice to have, but I probably won't need it".
I was wrong. I needed it. Badly.
Remember that adage, better to have it and not need it, than need it and not have it? Yeah...
For lack of information and preparation, we ended up stuck in the midst of literally thousands of trucks, for 5 hours, and 40 miles, of cell dead zone; with no way of getting information about what was happening, or why; and no information about the incoming weather.
The rental truck was supposed to have weather radio, and it does, sort of. Unfortunately, it's not NOAA weather radio, it's satellite weather, and is dependent on the Sirius working. For some reason, it wasn't. We got several sirius stations, but not weather or traffic; and we couldn't call them to fix it. There was no AM or FM local traffic or weather coverage either (thank you very much clear channel), just sports talk, top 40, and spanish language; with no local news, traffic, or weather.
So, I'd made myself blind and helpless, with the wave of a hand.
If I'd been able to listen to the truckers, I could've got off the highway, turned around, and taken an alternate route... or just gone back to El Paso to hang out with Rod. And when it came time for the I-20 split, I could've heard their reports about the nastiness that was coming, and continued down the I-10 down to San Antonio, which stayed clear.
Yeah, it would've added miles, but they'd have been safe and clear miles, and I would've at least been able to make Dallas (or maybe stayed south for Houston) by stop time tonight.
Point two: Internet connected apps are great. Use them, enjoy them... don't depend on them. 5 hours in a dead zone, with no information, NOT FUN.
Similarly, and related, OnStar, SyncServices and other connected vehicle systems that offer emergency assistance, information, weather, traffic etc... don't work in cell dead zones.
We were using an android weather app for weather mapping. It's awesome. We can see realtime weather maps, radar, forecasts etc...
... except when there's no data connection, for hours...
Point three: Pack the Gear, Check the Gear, Maintain the Gear; so that when you NEED the Gear, you HAVE the Gear.
Prior Preparation Prevents Piss Poor Performance.
When making long distance, cross country, or back country trips in rental/borrowed vehicles, make sure to prep the vehicle, with at least the critical elements, of the same gear and supplies you prep your own vehicle with.
If I get into trouble with my truck, I know that I have the gear and supplies to get out of all but the most severe situations. I can self rescue, or safely wait out to rescue. With this rental truck, as is... we've got SOME of the gear and supplies we normally have, but not enough to be confident.
Yeah, we'd be safe until rescue under normal circumstances... but what about abnormal, but reasonably possible, and easy to prepare for, circumstances?
... Like, oh, say, an ice storm in northwest Texas maybe...
So, first thing I did after we ate dinner, was hit up wally world for supplies and gear we'd neglected to transfer from our truck (just a few little things. The one thing I'm unhappy not having is some recovery gear, but it's a rental. If it needs recovery, I shouldn't be doing it, I should be calling someone from the rental company to do it).
Second thing, was to go buy a CB/weather radio, a 12v power lead, and an external magnetic mount antenna (factory rubber ducks aren't worth a damn, particularly in rough country. We radio geeks call them "portable dummy loads" or "flexible test resistors" for a reason).
I will not be blind and helpless again like that if I can avoid it.
Thursday, October 24, 2013
Useful Complexity
...And even then it will be cracked, because GPU based cracking and cracking method optimization, have reduced the time required to crack the entire passwordspace for most passwords down to a matter of minutes, or at worst hours.
According to several recent articles in various industry publications and websites, approximately 85% of all Windows passwords can be recovered in less than 60 minutes, and more than 90% within 24 hours, using only a single multi-core cpu, multi-gpu computer (basically a high end gaming rig).
Using small clusters of multi-cpu many-gpu systems (basically, spend $20,000 on off the shelf hardware) the entirety of the 8 character Windows passwordspace (all possible 0-8 character Windows passwords) can be cracked in a few days, or less.
With the computing power available today, the only useful thing high password complexity does, is make your password harder for a human to guess.
...Unfortunately, the bad part is, that also makes it harder to remember, and harder to enter.
Here's the level of minimum password complexity that is actually useful:
8 or more characters, not forming any dictionary word or combination of words (including letter substitutions), and including at least one special character.
Anything else is just making your users life more difficult, without actually making them any more secure in the real world.
Ok, so... why is this the "useful level of complexity" ?
Because in the real world, an 8 character password, without any dictionary words or variants on dictionary words, and including at least one special character, requires a cracker to use the entire characterspace to crack your password.
Wait... what? No, that's wrong isn't it? There's 128 ASCII characters, or 255 in the extended character set right? Upper and lower case alphabetic characters, numerals 0-9 and a whole bunch of "special characters"... All of those can be used in passwords right?
Well, yes, theoretically the possible characterspace is 255 characters (or 256 for ISO-8859/UTF-8 encodings).
...Theoretically...
In reality, it's not. First thing is that most password systems don't allow the entire 8 bit characterspace.
While it is theoretically possible to use the entire 8 bit U.S. character set (extended ASCII or UTF-8) in a password (or even to use a multibyte character set), it requires special keyboard codes, and these characters are difficult to enter. Further, most mobile devices do not allow you to enter characters other than those on the standard keyboard (or make it very difficult to do so).
There are 94 or 95 characters available on a standard US keyboard (depending on whether you count the nonbreaking space i.e. the space bar): 10 numerals, 32/33 special characters, and 52 letters (upper and lower case).
By the by, these are generally referred to as the "printable characters", with the remaining characters referred to as "non-printable".
Even if you wanted to use them, accepting that they are difficult to enter and mobile devices may not be able to enter them at all... most password systems exclude unprintable characters, leaving a maximum of 95 possible characters.
For those password systems which allow the non-printable character set, they generally limit passwords to the 7 bit basic ASCII character set (or sometimes ANSI-1 or UTF-7, which are technically different, but include the same characters), which is 128 characters.
... but no-one does.
Even computing systems that accept large character sets for text input (those supporting the Chinese GB18030 standard for example, or a full implementation of UTF-32, with over 1.1 million possible characters), generally only accept a limited subset of characters (usually UTF-8) for passwords (because you can't guarantee compatibility with large character sets across all hardware and software combinations).
So yes, the theoretically possible characterspace is actually many more than 255 characters, but the 95 keyboard characters comprises the entirety of the passwordspace most people might actually use.
Oh and many password systems exclude some or all of the characters !@&*$?/|\ and almost all password systems exclude the nonbreaking space (the space bar), because they can cause problems with parsing. Some actually exclude all special characters, but this is rare now.
What it comes down to, is that the "normal" characterspace is 94 characters.
That would seem to make it even MORE important to use case shift, and numerals; as they comprise 38% of the available characters.
In theory just using lowercase and special characters takes 36 of those 94 characters out, meaning that crackers only need to use 72% of the characterspace to crack your password.
...In theory, it would be better to make them need to use 100%...
...but in reality it doesn't work that way.
Okay... why doesn't more complexity increase security?
At this point, the computational power of multi-gpu cracking system, is enough so that in any serious cracking run, crackers can include the entire alphanumeric space without undue penalty; so including numbers and case changes can help a bit, but not much.
The first cracking run on a password will be optimized for high speed, and will include an optimized dictionary, and tables of common dictionary variations and substitutions (substituting 3 for E, @ or 0 for O etc...). Combined with a full lowercase alpha only run, that only takes a few minutes, to at most a few hours, for the entire 0-8 character passwordspace.
From there, crackers go to brute force, with or without optimizations. The first thing they're going to do is add in the full alphanumeric space, before they add in special characters; and any run that includes special characters will therefore almost certainly include mixed case and numerals.
That means that in a bruteforce attack, whether you included mixed case and numerals in your password or not, the cracker will still try all of them as if you did, and therefore it will take just as long to crack your password as if you did include them.
Yeah, it MIGHT take longer to bruteforce your password if you've got all 3... but your password is going to be one in a hundred, or a thousand, or a million, the cracker is trying to crack all at once; and they're going to run the entire mixed case alphanumeric space, before they even start adding special characters.... and these days "longer" is a few hours, or at most a couple days, not "more than 30 days".
So, unless your password policy is that users change their passwords every week (and that would be a huge support nightmare, causing more lost productivity than any value doing so might provide)... adding any more complexity doesn't significantly increase the security of a password; but does significantly increase the trouble to your users.
Include more complexity if you want to... but don't make it a requirement.
My personal recommendation for how to create good passwords?
Using the first or last letter of each word (or better, both the first AND last letter) in a phrase, poem stanza, song lyric, or other memorable passage, combined with special characters; is generally a good way of producing a pseudorandom non-dictionary string that is of sufficient length to provide reasonable security, but which you can still actually remember.
Include more than one special character, and don't make the specials ONLY the first, last, or middle/joining characters in the password. Also, don't make the only special characters you use, common letter substitutions like $ for S, ! for I etc...
All of these are common optimizations which crackers use to reduce the time it takes to bruteforce a password by the way. Not doing them forces the cracker to bruteforce the entire passwordspace, not just the MUCH reduced optimized space.
Going to more than 8 characters is actually useful, if the password system doesn't drop or ignore the extra characters (many do).
More than 16 characters generally isn't useful for a pseudorandom password, because 16 characters using the 94 character passwordspace, is essentially uncrackable at this time (it's computationally infeasible within a reasonable time horizon). Really any complex pseudorandom password with 12 characters or more is likely to remain computationally infeasible for at least 10 years.
Telephone company studies to determine the ideal length of phone numbers, figured out that human beings are pretty good at remembering strings of 1, 2, 3, and 4 characters, and combinations of those strings (2+3=5, 3+4=7, 3+3+4=10 etc...); with 3 and 4 character strings being the easiest to remember due to something they called "memory chunking" (the human memory seems to run 4/4 time).
Those same studies showed that humans are generally bad at remembering strings of other lengths, more than 4 strings total, and more than 13 characters total (with optimal recall at 3 or fewer strings, and 10 or fewer total characters).
Given that, I say make your passwords 9-12 characters long, with at least two special characters. You can improve your password strength dramatically with every additional character up to 16, but you trade off on memorability.
The standard recommendation is to use a different password for every account; but given the huge number of accounts people often have these days, it seems unrealistic to expect them to remember that many different passwords.
One solution is to use a password manager, which will create a unique strong password for every account, and store them, requiring you only to enter the strong password you created for the password manager itself.
Another solution is to create unique strong passwords for your high security impact accounts (those with banking, credit, legal, and healthcare impact for example), and then to have several other passwords that you use for other security levels, having just one for each level, but changing them at least every 90 days.
Whatever you do, it's always a tradeoff between length and complexity (increased entropy), and memorability and easy of entry.
Speaking of length and memorability... passphrases?
If the password system in question doesn't drop or ignore characters beyond 8, 12, 16 etc... you can also use longer passphrases instead of pseudorandom passwords.
At first glance, this would seem to be an easy way to have a memorable password that is still very long; which is true, but there are some major issues with passphrases that make each character in added length of much less value than in a pseudorandom password.
Multi word phrases using common dictionary words are less secure for an equivalent length, than pseudorandom passwords with special characters, simply because the possible solutionspace for each is very different.
With an 8 character password, in a 94 character passwordspace, there are 6,095,689,385,410,816 possible combinations of characters. There are only about 30,000 8 letter words.
There are between 250,000 and 400,000 words in the english language (depending on what words you count and whose estimates you believe). The average English speaker however only knows 20-40,000 words, and only uses about 2000-4000 words regularly.
Further, English words exhibit very strong letter frequency patterns, which are well understood in statistical analysis (in fact that understanding is critical for cryptanalysis). For example, the average english word is 5 letters long, and more than 80% of english words contain at least two of 6 most common consonants, and at least one of the vowels e, i, or a.
Reducing the dictionary set to common words of 8 letters or fewer, brings your wordspace down from 400,000 to something like 100,000.
These characteristics dramatically reduce the total entropy of passphrases; and dictionary optimized bruteforcing, based on common words, and english letter frequency, can be many orders of magnitude faster than a straight bruteforce.
Essentially, each word in a passphrase provides less than the entropy of a pair of pseudorandom characters.
In fact, given the reduction in entropy inherent in using dictionary words; if you are going to use a passphrase without increasing the complexity, I would recommend at least 8 words and at least 32 characters (not including the non-breaking space. Longer words are better).
... which really means you should be increasing the complexity.
The first and most basic thing, is to use at least one word 8 characters or longer, preferably an uncommon one (say... antidisestablishmentarianism for example). This makes the wordspace required to crack your passphrase DRAMATICALLY larger (the average English word is 4.5 characters long. Going from 4-5 character words to an 8 character word increases the cracking space from around 40,000 to over 150,000 words).
Passphrases should include as much of the full 94 character passwordspace as possible; using mixed case, multiple special characters (punctuation is good for that, but because spacing between words is common, it has a lower expected value than other special characters), and if it is easy to remember, and makes sense, numerals. Also, using a special character substitution in more than one word here provides a dramatic increase in entropy that is very worthwhile, particularly if it's not a common substitution.
I would also recommend replacing (os letter substitution with) one or more dictionary words in the phrase with a pseudorandom string. For example, use the first two and/or last two words of the phrase to create a pseudorandom string with the first and last letters.
Increasing word complexity and adding pseudorandom strings to a passphrase of any length more than 5 words or more, and at least 20 characters should make it functionally impossible to bruteforce.
Common words of 3 characters or fewer are actually easier to bruteforce than single additional pseudorandom characters. So you want to average at least 4 characters per word... preferably 5 or more (more than the average word length).
Oh and as spacing is predictable in standard English phrases, make it unpredictable. This results in combination words that together are harder to brute force than the multiple individual words with spaces would be.
Basically... if your pass phrase includes "the" and "end" you should make sure that you've got two 6 letter words in there and make it something like "Always-beTTer intheenD!" (which would be functionally impossible to bruteforce any time in the forseeable future).
At that point you have the same entropy as a pseudorandom string of the same length... it's just easier to remember.
Monday, October 07, 2013
Hmm... yeah... there's your problem right there...
A few weeks ago, I started getting disk corruption, that couldn't be handled with the normal disk utilities; and required me to get a clean backup on an external drive, wipe and reformat the internal drive, and restore...
Well, I kept getting the corruption problems after a few hours or a few days... and they kept getting worse.
Finally, I ended up rebuilding the thing 5 times in two day; and 3 times in one night (this was the night before my big compliance webinar. I didn't sleep at all the day before or that night, and ended up working all night and all morning before the webinar to try to get sorted).
This was basically two weeks of escalating pain, but until the last night the issues were intermittent with variable recurrence, so I couldn't get enough diagnostic info to nail it down.
With the 3 in on night episode, I was finally able to see the problem occuring...
And it's something I have NEVER seen... never even heard of...
What was happening on the HDD was lots of tiny single bit/single block/single write i/o errors. Ok, that happens... but why? It was a less than 90 day old relatively high end SSD (my last SSD went bad this past summer).
So I looked deeper at the errors, and noted that not all of them were from the hard drive...
Some of them were from the DVD drive...
Which had a scratched up DVD-R in it...
I pulled out the bad DVD-R and... holy crap, no more I/O errors.
What was happening, was that the particular damage on the DVD drive, was causing the I/O controller to constantly attempt to re-read the drive, and fail... hundreds of times a second. Instead of just limiting out though, it was causing enough latency in the SSD, that it was getting I/O errors as well...
Thing is... I didn't notice, because the DVD drive wasn't constantly spinning up... just a couple times an hour maybe? Which could have been explained by finder doing crap.
I've never seen that before... never even heard of that before, in a desktop or laptop (it's something that can happen with large high volume high transaction count servers, if they don't have sufficient spindles or cache, and their i/o controllers don't handle the exceptions properly).
Anyway... I got that resolved, and got my MBP functional...
But, ever since the last rebuild (after I figured out the problems), it's been a bit wonky. The finder doing some weird things etc...
I've run all the normal diagnostics, and at this point I'm pretty sure that to get sorted, I'm going to need to do another clean beackup, but instead of just restoring, I need to do a clean install, then migrate my apps and data.
It's a PITA, so I'm putting it off until I can't put it off anymore...
Meantime, I'm living with assorted wonkiness.
One of the items of said assortment; I hadn't really noticed it until a couple days ago, but I couldn't empty my trash.
This happens on OSX sometimes, it's not really a big deal. Usually it's a file that is locked somewhere and it can't be forced to let go because of a zombie process, or a bad pointer somewhere etc...
It's generally easy to fix. You just go into the trash directory from the command line, and force delete everything.
So, I went in, as root, and did a listing of my .Trash.
And it took a while... a LOOONG while... many many many screens of data flashing by my screen...
24 MILLION ITEMS... for a total of 243.8 gigabytes.
Well... there's yer problem right there...
It seems that the detritus of the multiple rebuilds... including several complete copies of my hard drive... ended up getting stuck in the trash for some reason; and couldn't empty out.
So, I started the force delete and went on to other things in other windows... after about 20 minutes I came back... and my command prompt hadn't come back...
I figured it had frozen up, or otherwise wasn't working; so I cancelled the job. Ran the listing again...
Nope... it had been working... It had deleted 9 million of the items, there were still 15 million left.
So I started the job back up again and went away for 20 more minutes... went back... still working...
As I was about to switch windows away it finally finished.
It took 40 minutes to delete the crap from the command line, no wonder I couldn't empty or open my trash in finder...
