Max Masnick ~ blog on public health and technology

Stop the paranoia: it doesn't matter if Google reads our email

2012-02-12T11:00:00-05:00

There’s been some recent buzz about how it’s bad that Google is “reading” the email of Gmail users. Google examines email algorithmically to power its targeted advertising in Gmail.

This practice would be worth worrying about only if email was otherwise secure (it’s not) and if it was likely to hurt users (it isn’t). Ironically, switching away from Gmail could reduce, not enhance, email security.

Microsoft pans Google for "reading" your email in this ad. But does Hotmail/Office 365 offer the features that actually make email safe, like two-factor authentication?

Secure email is a myth

Email is simply not secure. Messages are not secure in transit: the protocol used for sending email (SMTP) does not require encrypted connections, so it could easily be intercepted by a third party as travels over the internet. You also have no guarantees about the security of a recipient’s email client or server. A hacker could have surreptitious access to a recipient’s inbox, or curious IT guy could be reading through email on the server.

You also have no control over what someone does when they receive an email. One of the biggest realistic risks for email security is human error: accidentally sending or forwarding to the wrong person, inappropriately replying-all, etc. A sensitive email could be inadvertently left on the office printer.

Given all these insecurities, Google’s algorithmic email reading is the least of my concerns. I simply assume that any email I send could be read by a third party, and when I need to communicate about a sensitive topic, I pick up the phone.*

Focus on the realistic threats

It’s easy to see how a single email could fall into the wrong hands, but what’s the most likely scenario for your entire email account being compromised? There are a bunch of plausible options:

A targeted attack on your account.
A phishing scam.
A stolen laptop.
A massive security breach at your email provider.

Google becomes evil and steals all your email to do X is not on this list because it seems absurd by comparison. Google’s business model relies on analyzing user data in order to target ads. It’s in Google’s best interest to maintain the trust of its users so they will keep giving Google their data.

Also, I can’t even think of what X is – what nefarious thing Google could do with my email that is in its interest and that would cause me harm? Google’s business model is not a zero sum game: they can use my data to target ads without hurting me. Contrast this to all the plausible scenarios above, where a malicious entity is trying to get access to email for personal gain (e.g. stealing from bank accounts or credit cards). That is a zero sum game.

Google is actually probably one of the most secure places to keep your email because it is in their best interest to keep your data safe, and they have tons of resources and good engineers to do this. They also provide tools like two factor authentication, default HTTPS access, and suspicious activity monitoring that make individual accounts more secure. Few, if any alternative providers offer all these features.

Paranoia is part of human nature

Human brains are not wired to respond logically to risk. For example, we are often more concerned about low-risk, high-consequence risks than more common dangers. The classic example of this is being afraid of airplanes but not being afraid of driving in a car.

Paranoia about Google turning evil and ruining its users lives by reading their email may be human nature, but the net result of worrying about this extremely unlikely (but admittedly very scary) scenario is probably worse email security.

Moving from Gmail to a different email service could result in your messages being stored on a less secure server with fewer security-related features. And the time spent getting your email set up on this new service would probably be better-spent mitigating more realistic dangers, like your laptop being stolen.

Never use gmail.com

With that said, I think it’s a bad idea to use a @gmail.com address (or any other domain name you don’t own). If Google – or your email service of choice – does turn evil or shuts down, at best you have to change your email address, and at worst they own a critical part of your online identity.

Google Apps is an easy, free way of using your own domain name with Gmail’s interface. This makes switching to a new email provider transparent to the people you correspond with.

* Phones aren't perfectly secure either, but I'd argue they are substantially more secure than email.

Comment on this post at Hacker News.

Blogging with Jekyll + S3 + CloudFront

2012-01-21T18:35:32-05:00

When I decided to power this blog with Jekyll, it took me a while to figure out a good way to host and configure it. I thought explaining my setup might be helpful for others who are getting started with Jekyll.

If you have a blog but haven’t heard of Jekyll, you should check it out. It’s great for anyone who likes writing in the text editor of their choice instead of some web interface, wants to store their work in Dropbox or version control, and is comfortable running a few Terminal commands.

Why S3?

I initially started out hosting my blog on GitHub Pages, which is a free service offered by GitHub for hosting a Jekyll blog stored in Git. The price is certainly right, but there were a couple problems.

First, GitHub Pages experienced some downtime while I was setting up my blog, and I feel strongly about having good blog uptime. Second, if you don’t have a paid GitHub account ($7/month+) the repository containing your blog is accessible to the world, including drafts and unpublished posts.

An alternative is using Amazon S3, Amazon’s cloud file storage service. Amazon lets you host a static website on S3 with your own domain name. You can also easily use Amazon CloudFront with S3. CloudFront is a CDN (content distribution network) that serves your content from a worldwide server network and helps to make your website faster.

Setting up S3 and CloudFront

If you’ve never used Amazon Web Services before, it can be a little confusing to get started. First, you need to sign up for an AWS account. When you have your account, log into the AWS Management Console and head to the S3 tab. Then:

Create a bucket called www.yourdomain.com. One minor downside to S3 is you can’t use yourdomain.com – you have to use some subdomain like www or blog. I’ll talk about this more below.
Under the properties for this bucket, you’ll need to go to the Website tab, check the box to enable static web hosting, and set your index and error documents. Your index document should probably be index.html. Your error document is another HTML page for file not found (404) errors.
Make a note of your endpoint (mine is http://www.maxmasnick.com.s3-website-us-east-1.amazonaws.com/). You’ll need it below.
On the permissions tab, create a bucket policy. You can copy mine and just change the bucket name.

You can go ahead and enable CloudFront now too. Head over to the CloudFront tab, and create a new Distribution for the S3 bucket you just created. This will mirror your S3 bucket on CloudFront – for example, http://d2lazzs3blj336.cloudfront.net/index.html shows the home page of my website exactly* as it appears on S3.

* CloudFront will cache the contents of your S3 bucket for up to 24 hours. This cache is created from S3 the first time someone hits an asset under your CloudFront URL. This means that CloudFront won’t necessarily reflect changes on S3 immediately. You can manually expire objects in CloudFront, but it’s easier to just not use it for anything that will change frequently.

Setting up your DNS

You’ll need to create some DNS records to use your own domain with S3. The way you do this depends on your DNS provider (I use Zerigo, which is cheap, reliable, and easy to use). At a minimum, you’ll need to follow your DNS provider’s instructions to create a CNAME pointing www.yourdomain.com at your S3 endpoint.

Zerigo lets you create a redirect from yourdomain.com to www.yourdomain.com – you can’t use a CNAME on a bare domain. You can set up a redirect with Apache if your DNS provider doesn’t do redirects.

You can also create a CNAME for your CloudFront endpoint. I use cdn.maxmasnick.com for this.

Getting your Jekyll site onto S3

There’s a great command line tool called s3cmd that acts like rsync for S3. It makes it easy to upload your Jekyll site onto S3, and after your initial upload s3cmd will only upload file that have changed. If you’re on Mac, you can use Homebrew to install s3cmd by running brew install s3cmd.

I created a file called publish.sh in my Jekyll folder so I can run jekyll && ./publish.sh to publish to S3. publish.sh only has one line in it:

s3cmd sync --delete-removed _site/ s3://www.maxmasnick.com/ --verbose

If you haven’t used s3cmd before, you can set it up with your access keys by running s3cmd --configure. You can get these access keys off the Security Credentials portion of the AWS website.

Jekyll configuration for CloudFront

To make it easy to serve my assets from CloudFront, I set up a custom Liquid filter:

module Jekyll
  module AssetFilter
    def cdn(input)
      "#{@context.registers[:site].config['cdn']}/#{input}"
    end
  end
end

Liquid::Template.register_filter(Jekyll::AssetFilter)

Then I added a CDN entry to my _config.yml file. If I comment this line out, my assets will be served off of S3 (or localhost if I’m running Jekyll locally).

cdn: http://cdn.maxmasnick.com

Whenever I want an asset to be served by the CDN, I pass it through this Liquid filter. For example, in my layout file I have:

<link rel="stylesheet" href="&#123;&#123; 'assets/css/frameless.css' | cdn &#125;&#125;" />

Alternatives

I like hosting on S3 because it’s reliable (S3 is ”designed to provide 99.999999999% durability and 99.99% availability of objects over a given year”) and cheap (I served more than 20,000 pageviews for less than $1 this January).

However, there are alternatives for hosting static sites. As I mentioned above, GitHub Pages is free and works pretty well. You can also host a static site on Heroku (for example, see this great post on hosting a static blog on Heroku + Google App Engine).

If you’re looking for alternatives to Jekyll, I wrote about the different options.

Comment on this post on Google+.

Ultimate webdev/power user tools for Mac (2011 edition)

2011-12-29T14:15:19-05:00

Hardware

Evoluent VerticalMouse 4.

11” MacBook Air
I have the 2010 model and it’s pretty much fast enough for everything I do; the new model is even better. The only thing I’ve noticed that is really slow is loading the Rails stack.

Evoluent VerticalMouse 4
I find this more comfortable than any normally-shaped mouse, and it has a super accurate laser sensor and a ton of buttons. It’s also a, uh, conversation piece.

24” screen
I have a Dell work and home, and this great $170 24” ViewSonic in Montana. I would love to have one of the 27” Apple displays, but they’re way out of my price range.

Sennheiser PXC 350 Active Noise Cancellation Headphones
These are discontinued but there’s a newer model. I got them for airplanes but ended up using them a lot. They sound ok with and without the noise cancellation on and collapse down into a sturdy, flat case.

I recently saw some of my friends using their laptops/external monitors in the configuration below. I don’t know why I didn’t think of this before, I really like it – it lets you use your laptop screen for email or Terminal without the awkwardness of a horizontal layout (it’s hard to get an 11” laptop to the right height next to a 24” screen).

Stacked screens in Montana.

I was inspired by Scott Hanselman’s Justin William’s ultimate developer/power user tool lists, so I decided to share my own. Scott is on Windows and Justin is a Mac/iOS developer, while I do mostly web development – so my list has a somewhat different focus.

Top 5 developer tools

Sublime Text 2
Like many, I got tired of waiting for TextMate 2 and started looking for alternatives. I tried MacVim for a while, but eventually ended up switching to Sublime Text as my primary editor. It supports TextMate syntax highlighting bundles and has some really convenient features, such as live previews of files selected with the quick open (Cmd-T) dialog and Vim keyboard bindings. I’ve tried the TextMate 2 Alpha, but I still thing Sublime Text is better.
Zsh + oh-my-zsh
The Z shell (zsh) is a replacement for bash. It is greatly enhanced by Robby Russell’s oh-my-zsh. Together, these give you a highly customizable prompt (see the screenshot below), tab completion for Git branches, and some great plugins like the bundler plugin that automatically runs rails-related commands with bundler exec.

oh-my-zsh with my own theme. It shows the user and computer name, the current folder, Git branch and working directory status for repositories, and the active version of Ruby via rbenv.
Git and Gitbox
I use Git for version control. I generally use the command line interface, but sometimes it’s faster to use a GUI (e.g. staging a subset of changed files from a bunch of different folders). Gitbox has a clean, extremely simple UI without sacrificing functionality. I actually recommend Gitbox to Mac users who are new to Git: it allows you to learn the Git workflow and terminology without mucking around with the CLI.
Github and Bitbucket
One of the best things about Git is how easy it makes collaborating on code. Github (and Bitbucket) make this even easier. Both are web-based hosting for Git repositories with social features like pull requests for reviewing submitted changes and issue tracking. Github is by far my favorite of the two, but the pricing structure makes having lots of private repositories prohibitively expensive. Bitbucket has most of Github’s features and is essentially free for personal use.
Rubular
If you write complicated regular expressions, Rubular will change your life. It makes it extremely simple to text regexps and keep track of captures.

Honorable mentions

Google Chrome
Specifically, the inspector is invaluable for front-end development. It has almost completely replaced Firebug for me. I mostly use the elements inspector to manipulate HTML element styles in real time (without having to refresh) and the console for JavaScript debugging. The Network tab is also useful (see below).

Google Chrome Inspector.The Network tab shows the time it takes for your assets to load.

Kaleidoscope
This program can be used to display side-by-side or inline diffs. It works with Gitbox and with the git difftool command, and is way more readable than standard diffs.

Transmit
Transmit is the swiss army knife for connecting to remote file systems. I use it mainly for sftp and Amazon S3, but it supports lots of different protocols. It has the best UI of any file transfer app I’ve seen.

pow.cx
If you run local servers for Rack apps (including Rails), pow.cx can save you some keystrokes and Terminal windows. It will run local servers in the background for any Rack app and it makes them accessible at http://something.dev.

rbenv and ruby-build
rbenv is a cleaner implementation of rvm’s functionality. ruby-build is the companion tool that handles installation of multiple versions of Ruby.

Top 5 power user tools

Dropbox
This is must-have for every computer user with an internet connection. It’s incredibly simple, extremely robust cloud storage. I use Dropbox literally every day both for backups and for sharing files. Their mobile apps make everything in your Dropbox accessible on the go. This might be the only programs I would recommend for anyone on any platform.
Sparrow
This is a desktop client for gmail. I’ve found it much faster for everything than browser-based gmail except for search. It’s especially helpful if you have multiple gmail accounts. Sparrow recognizes a bunch of the standard gmail keyboard shortcuts so you don’t have to retrain your fingers.
1Password
Password management is a pain, but 1Password makes it as easy as it can be. They have good browser plugins for Chrome and Safari (and presumably Firefox, though I haven’t used it), and great iOS apps. Your passwords are encrypted locally with a master password, and can be synced between devices over Dropbox.
CloudApp
CloudApp makes one-off file sharing easy. You can drag any file to its menu bar icon, and CloudApp will upload the file and automatically copy the URL to your clipboard. It’s free for light use.
Arq
Arq encrypts and backs your files up on Amazon S3. I also use tarsnap on servers, but I like having a graphical interface on my laptop. There are a bunch of other cloud backup utilities out there, but Arq has several advantages.

First, S3 is extremely reliable so you don’t have to worry about data loss. Second, Arq encrypts your files locally so there’s no way for a third party to gain access (this is a problem with Dropbox and other cloud backup providers that give you access to your files through a web interface). Third, the format Arq uses for storing your files is open source, so you will still be able to access your backups if Arq disappears. Finally, the only recurring fee is S3 usage, so it can be cheaper month-to-month than the alternatives (I pay less than $2/month).

Honorable mentions

Skitch
Skitch is my go-to tool for quickly annotating screenshots. You can share Skitch screenshots directly on CloudApp by dragging the thumbnail at the bottom of the Skitch window to the CloudApp icon.

Jing
Jing is an easy, free screencasting tool. The free version limits your recording time (5 minutes, I think), but it’s really easy to use and you can’t beat the price.

Spotify
Spotify has essentially replaced iTunes for me. The new beta has third-party apps – for example there’s a Pitchfork app that lets you directly play their best new albums and tracks. I have some gripes about the interface and their mobile app isn’t very full-featured, but they seem to have a fairly complete collection. If you know what you want to listen to it works pretty well.

8tracks
When I don’t know what I want to listen to, 8tracks is great. It’s basically the mixtape of the 21st century: you can create a mix (8 or more tracks) and share it with the world. It’s good for discovering new music.

Greplin
Greplin is Google for your personal cloud. It can search a ton of online apps, including gmail, Dropbox, Google Docs, Facebook messages, Twitter, 37signals products, and more. It’s indispensable when you’re looking for something but you can’t remember if it was in a Facebook message or an email or in Dropbox or in… I have 136,107 documents currently indexed by Greplin.

Views.fm
Views.fm makes it easy to share Dropbox folders over the web. They have a great lightbox mode for photos that I like better than flickr or 500px. Here’s an example.

Twitter Mobile
I didn’t realize new new Twitter had been released for about a week because I use http://mobile.twitter.com on my laptop. If you’re overwhelmed by Twitter proper, give this a try.

Papers2
If you do anything with scientific papers, Papers2 helps keep everything organized. It also does citations like Endnote, but is way easier to use.

If you’ve made it this far, you should follow me on Twitter.

Comment on this post at Hacker News.

New Kindle first impressions

2011-11-22T09:00:00-05:00

New Kindle 4 vs. original Kindle DX. Apologies for the crappy iPhone photo.

Amazon delivered my new Kindle 4 a day early – a nice Monday afternoon surprise. The new Kindle is replacing my first generation Kindle DX, which seems absurdly large by comparison.

I decided to go for small, light and cheap this time. The DX is great for reading, but it’s a pain to lug around and it’s expensive enough that I’m worried about losing or breaking it.

I’ve read that Amazon’s goal with the most recent refresh to the Kindle line is to make the devices themselves less important while emphasizing the great content you can access on them. With this in mind, going cheap makes sense. When Amazon releases a new version of the Kindle, it will be much less painful to upgrade from a $79 Kindle than a $250 Kindle.

Kindle vs. Kindle Touch

I decided not to get the Kindle Touch because I really didn’t want the extra weight and the speakers. I also rarely type on my Kindle DX, so I thought I probably wouldn’t mind the “keyboard” on the non-Touch Kindle.

Kindle 4 on-screen keyboard.

The “keyboard” on this Kindle is controlled with the four-way selector. You have to select one character at a time, but it actually works surprisingly well – as long as you only use it for entering wifi passwords and the occasional search. If you ever use the Kindle’s notes feature or do a lot of searching on the Kindle Store, I would imagine the Touch or the Kindle with the physical keyboard would be the better choice.

Using the Kindle

The new Kindle is incredibly small and light. It is very comfortable to hold in one hand while reading. There are page turn buttons on both sides of the device. They essentially make up the middle 50% of both the left and right edges. They don’t extend very far onto the front of the device, which can make them hard to push initially, but I adjusted quickly. They are hard enough to push that I didn’t have any trouble with inadvertent page turns.

The refresh time has improved significantly since the DX. The Kindle only refreshes the entire screen (this causes the Kindle’s screen to flash black for a moment) about every six page turns, which makes page turns more seamless and faster. There’s been some speculation about how this would affect the clarity of the text as this theoretically degrades with each page turn that doesn’t trigger a full refresh, but I can’t notice any difference under normal reading.

The price point

With a charger and a case, my order came in at $115. This is approaching the point where for many people, the Kindle will be more of an impulse buy instead than a carefully considered purchase. For me, I think think this point is closer to $60 – I thought about this purchase for almost two months before I pulled the trigger.

Getting to the “impulse buy” price is critical for Amazon to succeed with their device-only-as-interface strategy. People will not want to pay a lot of money for a device that is meant to be replaced frequently and doesn’t offer the same functionality as other expensive devices.

The Kindle Fire is moving towards the “impulse buy” price point in the tablet market – despite suffering from some pretty serious usability issues, they are selling like hotcakes.

I think this device-as-interface philosophy will help Amazon to lead the digital content market for books and video. By lowering the barrier to entry for consumers by making fairly good devices at low prices (Jeff Bezos likes to call them “premium products at non-premium prices”) I would imagine Amazon will pick up a lot of business selling content.

Comment on this post on Google+.

Mapping U.S. obesity rates at the county level

2011-11-15T21:00:00-05:00

Age-adjusted obesity rates by U.S. county (2008). Click to enlarge, or view the large PNG or SVG. Higher obesity rates are darker.

I thought it would be interesting to see how obesity rates were distributed geographically in the U.S., so I did some searching. The CDC has a great time-lapse map of state obesity rates, but I was curious how this would look at the county level. For example, there are huge differences between the western and eastern parts of Montana (my home state), or between the areas around big cities and the rural counties in North Carolina (my current state).

There is county-level data available, but it’s separated by state. I wanted to see the entire country at once, so I made my own map (see above).

Probably the most striking thing about this map is that it looks like the South is in trouble. Obesity-related chronic disease is costly to treat, affects worker productivity, and generally reduces quality of life. Not surprisingly, the states with the highest obesity rates have the worst overall health according to at least one ranking. I’m curious how this relates to health insurance expenditures – I’m looking at what data are available on this for a follow-up post.

There are also some striking differences within states. Look at North Carolina, for example:

That’s a pretty striking difference between the eastern and western halves of the state. Visually, it looks like this difference might be correlated with population.

Speaking of correlations, I wanted to see how obesity rates correlated with socioeconomic status. Using median household income in each county as an estimate of this, I made this map:

Median income by U.S. county (2008). Click to enlarge, or view the large PNG or SVG. Lower income is darker.

Here are the two maps next to each other (obesity on the left, income on the right):

Visually, there are some macro-level similarities between these maps, especially low-income high-obesity regions in the South, and high-income low-obesity regions in the Northeast and the West. However, the association between socioeconomic status and obesity appears to be weakening.

Finally, take a close look at the key of the obesity rate map:

This means that about 5/6ths (83%) of U.S. counties have obesity rates over 25%.

Source materials and methods

Map coloring. I used code from an excellent tutorial at FlowingData. Both maps were colored by splitting the counties into sextiles (six roughly equally-sized groups by obesity rate or median income), giving the best variability in color across the map.
2008 county-level obesity rates. From the CDC Diabetes Data & Trends website. But the data download interface on this website is awful. There was no way to download all the U.S. data at once – each state had to be downloaded individually. It was also impossible to scrape the site to automatically download the data, so I had to click “download” 50 times. Except that because of a bug in the interface, it didn’t work the first time, so I had to click “donwload” 50 more times.

This download interface is so bad that I’m making a combined CSV dataset of county-level obesity data for all 50 states available here so no one has to repeat this pain. Please verify the correctness of these data before you use them for anything important.
2008 county-level median income. From the US Census. Much more accessible than the CDC data.
Source map. I used this excellent pubic domain SVG map from Wikipedia.
Color scheme. I used http://colorbrewer2.org/ to generate the color scheme for the maps.

Comment on this post on Google+.

Usability & UX: forgotten in obesity web intervention?

2011-11-09T09:00:00-05:00

A group of researchers in the Netherlands just published the results of their web-based adolescent obesity intervention. This kind of intervention is promising because it scales well: more users on a website are essentially free, while adding people to an intervention that requires doctor visits would be much more expensive.

Scaling is important because reaching a significant portion of the large number of obese people (e.g. 1/3 of US adults) will be cost-prohibitive with an intervention that is expensive to scale.

But scaling well only matters if the intervention is effective. Unfortunately for the Netherlands intervention, after two years there was no positive effect on the physical activity, diet, or BMI of the children who participated.

Where’s the usability testing?

Why wasn’t the intervention effective? The authors offer some possible explanations, such as its short duration (“8 sessions of 15 minutes each within 10 weeks”). However, there was no mention of any usability testing, and poor usability could torpedo a web-based intervention just as easily as any other website.

Tools for improving intervention websites

There are a number of tools used especially by web startups that could be beneficial to web-based interventions for obesity and other diseases.

A/B testing
This is essentially a usability mini-study: visitors to your site see either site A or site B. Ideally, you want site A and site B to differ only a little bit (e.g. color of the “sign up” button).

Business track response rate (e.g. signing up for a free trial); researchers could do this in focus groups and track responses to feedback questions.
Usage statistics
There are a bunch of great tools for collecting usage statistics. Google Analytics is widely used for collecting all kind of statistics about your website’s users (e.g. time spent on pages, search terms used to find your site, etc.).

One kind of usage information that could be extremely useful are heatmaps that shows where users click on a page:

(Image from Flickr/labnol.)

Analytics companies such as ClickTale and Clickdensity can generate click heatmaps from any website.
Session tracking
There are some services that can help you do more in-depth tracking of what a user does on a website. For example, OpenHallway and Silverback let you record a user’s screen and voice (and face, in the case of Silverback) while they test your website and play the recordings back later.

User experience really matters

Users form first impressions of a website in only 50 milliseconds, and this first impression matters:

The lasting effect of first impressions is known to psychologists as the ‘halo effect’: if you can snare people with an attractive design, they are more likely to overlook other minor faults with the site, and may rate its actual content (such as this article, for example) more favourably.

Especially with self-directed web-based interventions, the intervention’s website is directly competing with the other media available to the participant, i.e. everything else on the internet. It’s not surprising that dropout rates are high for web-based interventions.

It seems that good design and usability are necessary, though certainly not sufficient, for long-term success with web-based chronic disease interventions. I’m going to be on the lookout for studies that include rigorous usability testing.

Citation for the Netherlands study:

Ezendam, N. P. M., Brug, J., & Oenema, A. (2011). Evaluation of the Web-Based Computer-Tailored FATaintPHAT Intervention to Promote Energy Balance Among Adolescents: Results From a School Cluster Randomized Trial Archives of pediatrics & adolescent medicine. doi:10.1001/archpediatrics.2011.204

Trello Icon

2011-09-15T12:20:00-04:00

I just spent 15 minutes putting together a (mediocre) Trello icon for use with Fluid. I am not a designer so, I’m sure someone could improve on this.

Here it is in my Dock:

You might want the ICNS version.

I used DrawIt, which I got as part of some software bundle a while ago. Here’s trello.drawit if you want it.

This logo is presumably a trademark of Fog Creek Software. Please let me know if it’s a problem to post this here.

Update

@innovati has graciously provided a prettier Trello icon:

I’ve mirrored it here just in case: download .zip. The .zip includes both a PNG and a Photoshop file.