What. The. Actual. Fuck?

Seriously… between then and now, the United States unravelled faster than a bodice in a Louis Lamour novel. The president, and the cronies who committed the vile ritual that channeled Mussolini’s epic clown skills and Hitler’s <cough>authoritarianism</cough> into an orange wind sock, have been trying to undo an election where Il Douche lost due to the unfair situation of having received far fewer votes than his opponent.

Meanwhile, in Michigan, terrorists wanted to kidnap the governor because she had the audacity to put public health measures into action to help stave off the ongoing plague.

In 19 days I guess we’ll all know if they’re going for another civil war.

And that was the Christmas present from the universe to the Earth… we all wait and see if the most powerful man in the world is going to completely lose his shit, or go quietly and fade into obscurity.

I’m writing this in July 2020, on my birthday, actually.

The plague is easing up a bit, and things are starting to open. Dumbasses were protesting yesterday on Parliament Hill – protesting being told to wear a mask because apparently, wearing a mask makes your penis fall off if you’re a certain kind of person.

The notion of protesting wearing a mask by people without bona fide respiratory issues is befuddling to people who aren’t comically stupid, but that’s the state of things in Canada… Let’s hope that in 2020, the survivors of that protest are a little more beneficial to the gene pool.

It’s been a hot and relatively dry summer so far. By the time this gets read, we’ll probably be complaining about the cold.

It was neat in 2020, not really having to spend any time in the office. I wonder how things are going to be in 2021? I think that for a lot of people around Ottawa, the traditional trudge to the bilingual salt mine downtown is pretty much done. Most civil servants, I think, are going to be in a work-at-home-most-days sort of routine by now, and I’d be surprised if that Petri dish that is Place du Portage is even open to regular business yet. People used to die of respiratory diseases there before COVID-19, so I would expect a lot of resistance to repopulating that building until it’s been sanitized to within an inch of its life.

Hopefully by now many of the people who lost their jobs have had a bit of an opportunity to recover their livelihood.

2021 really can’t be much worse than 2020, so here’s hopin’

Unless you live without social media (particularly Facebook in that example), you will have seen these little questionnaires and although I normally wouldn’t do this, I’m going to jump most of the way to the end before I really begin: Never answer those, or if you do, answer only false and misleading information. Do not cut and paste them. And never, ever click a link to one of them.

It was important to get that out of the way right up front.

There really is a major issue with those that applies to absolutely every person – young, old, computer nerd, supercool executive, whatever you think of yourself. That issue has two prongs, and neither are very nice.

The most straightforward issue is that many of the online services we all use ask us to submit the answers to “security questions.” These questions are used to authenticate you in the event that you get locked out of your account. The questions are supposed to be a secret known only to you and the service. In fact, the use of questions as a method to ensure the person saying they are you is, in fact, you, requires that the answers be known to you and you alone.

Those four items in that example are all examples of security questions that I’ve seen, and in these little text games, I’ve seen a whole lot more. With that information, any random person could take over your account. That’s annoying if it’s your Gmail account. It’s terrifying if it’s your bank account.

Anything you write on social media is going to end up in the hands of people you never expected. That’s a fact of the internet. These questionnaire games are what I call “victim participation” events… where the potential victims give the bad guys all the tools they need to commit the crime.

That is a good segue into the more esoteric issue: social engineering in general. You see, someone might take that info and use it right away to get into your Gmail, and maybe change your password, send a bit of spam and then leave you to clean up the mess. That happens.

Better crooks might build up a profile on you. These questionnaires provide great information for identity thieves. These are the people who go after your passport, your bank account, even your house. Publish enough of that kind of information to the world and with a bit of bad luck, you’ll be the next contestant on “Someone stole my identity!” – the modern game show where the winners lose a bit of sleep and thousands of dollars for clean up, and the losers lose everything.

Don’t think for a second that you’ve set your privacy settings well and you’re safe. You have no idea what your friends are doing with it, or how those other people (you don’t really know in real life but are “Facebook Friends” that you added because they wrote a funny joke once three years ago) are using that information, or passing it on to others via their poor privacy settings. If you take nothing else away today, please take this: When you write it on the internet, it’s permanent. The internet never forgets.

All of which brings me to the “never, ever click a link to one of them” comment. When you click a link you’re surrendering at least your browser, if not your social media profile to an external application/web site. This is incredibly risky. There are plenty of documented examples of shady organizations scraping data and building profiles on people via web sites and dodgy social media apps. Remember – if you’re not paying for it, you are the product being sold. That is the truth about all social media.

What can you do about it?

First, I’ll deal with the easy one: the blackmail scam. All blackmail – whether it’s a silly email, or some modern thug threatening you over the phone works like this:

• the dirtbag claims to (maybe even actually does) have some information about you that you might find embarrassing;
• the dirtbag claims that they won’t release the information if you pay them.

What actually happens is one of three things:

• They don’t have the information but got a lucky guess at something that embarrasses you, and you literally throw money at some scumbag. You’re poorer, and hopefully wiser; but…
• If they got money once, they’ll make the same threat again because if you paid once, you’ll pay again; OR
• They really do have information, in which case it works like the previous two items except…
• If they really have the information it’s going to get out sooner or later, so you’ll still be embarrassed AND be out the money.

In short, if you ever pay a blackmailer, you’re literally throwing money away for nothing – either because they can’t actually hurt you, or because you’re going to get hurt whether or not you pay. THIS IS HOW ALL BLACKMAIL WORKS. Never pay a blackmailer, ever. And if you really think they have something, suck it up and admit it wherever it would be important because that important place/person is going to find out eventually. Never pay though. Not even once.

OK, now on to the issue at hand – the password. Maybe you saw it in a blackmail email, maybe you got a notification that there was an information breach on some service you use. Maybe your IT professional kids are telling you to stop using “password” as your password. Whatever the reason, you’ve been prompted to think about passwords.

Passwords are an archaic, borderline useless authentication mechanism. They’re a pain in the arse for humans to use effectively, and ever increasingly trivial for computers to guess at. However, they’re also inexpensive to implement and relatively easy for anyone to use. One time.

The problem comes when you have more than one account that needs a password. If you’re a nerd, like me, I literally have close to 500 password-protected accounts. I cannot remember 500 passwords – especially passwords that are long and complex. Now, lots of people solve this problem by using the same password everywhere. That’s really bad, and here’s why:

Think about that email that says there is video of you wanking to porn. Obviously, they have your email. It also contains a password scraped from any of a multitude of security breaches at big-ticket services like LinkedIn, Yahoo!, Adobe, and more. Crooks take that email and that password and try it *EVERYWHERE*. So if you’re cutting corners by using the same email and password for everything, one LinkedIn breach and now every crook has access to your Facebook, maybe banking, Twitter, Instagram, store/merchant accounts like Cafe Press, and so on. Testing those things is all done automagically by computer programs, so the crooks literally buy a compromised database and run tools on it to see what they come up with. There is very little they love more than the person who uses the same email and password for everything.

I’m not going to get into why you should have multiple email addresses because I know that far too many people will say “I’m not a computer nerd. I can’t be arsed to have 234 email addresses.” Fine. However, there really is no excuse not to have a different password everywhere. What I am about to show you should be considered “Computer Basics”. This is like learning what the brake and accelerator pedals do when you learned to drive a car.

1. Install a password manager – There are plenty out there. I use PwSafe because it works on Windows, Linux, iOS, and Android. There are others – many people I know enjoy LastPass. There are other choices too, so consider having a look at this article. What they all give you is a small application/database to which you have to remember ONE password, and the database stores all your other passwords, allowing you to click/cut/paste them into login screens where you need them. Of course, this means that the password to that database should be STRONG AND LONG (<cough>insert obligatory internet porn reference </cough>) because if that database password gets hacked, you’re sunk. However, because it’s the only password you’ll have to remember, doing that should be easy. Realistically, this is truly a must-have application on your computers and devices, and it doesn’t matter how unsophisticated a user you believe you are.
2. Use a different password for every single account, without exception – The reason you install a password manager is because of this. It is simply not smart, reasonable, nor acceptable in 2020 to reuse passwords. If you use a password manager, they all have the ability to generate crazy-strong passwords for you, because they know you’ll never have to remember them. Use this feature. In this way, even if some service gets hacked, the worst case would be that the crooks get the password to that service, and nothing else.
3. Generate long, strong passwords – Password managers will do this automatically, but usually you can tweak the rules it uses. I am going to tell you how to set the rules. To begin with, unless the service you are setting a password for is ancient and only accepts 8-character passwords, know now that an 8-character password has a break strength of less than a day… much less if it’s a commonly used word, or something similar to what is on THIS LIST. By and large, you want to set the rules to a MINIMUM of:
   1. Length – 12 characters, 16 is better, 20+ is best. In my experience, plenty of sites still weird out if you go for 16 or more (although they shouldn’t but ranting about awful application and web site security could be another 238 posts).
   2. Complexity rules – at least one uppercase, one lower case, and one symbol and/or digit.
4. Don’t worry about password expiry – if you’ve made strong passwords, you don’t have to worry about that old school “change your passwords every X days” crap. The idea behind that was that you changed your passwords in a time period shorter than it would be expected that a crook could break your password. Right now, an 8-character password is crackable in minutes to about a day, so if you’re using password expiry, you need to change an 8-character password about 4 times an hour to be safe. A 12 character, or longer, is good for years.
5. It’s still a good idea to change your passwords once a year as a matter of course – you’re using a password manager, so changing passwords isn’t a big deal because you don’t have to remember them. I do “Christmas Holiday Computer Maintenance” when I check my digital photos, and change passwords. The reason you do this is because it limits potential damage if your password is breached and nobody notices.

In Part 3 we’ll learn about “Things you shouldn’t answer or click on in social media”.

I’ve decided, at the urging of friends, to start a little series of informative posts to help people maintain their peace of mind and hopefully, their personal computer security during these times… and in the future, because this advice doesn’t apply just during lockdown; it applies all the time.

So what are some important things you need to know right now? Oddly enough, you should probably know these things all the time, but since you have more free time on your hands, now is a good time to learn them.

No civilized government accepts payment in gift cards or cryptocurrency.

I figured I’d start with this one because the fake tax people are out in droves right now. They’re going to call you – maybe even with a well-faked Call-ID and pretend to be your government tax man. They’re going to threaten you, and demand payment in things like iTunes gift cars, Bitcoin (aka Dunning-Krugerrand) or other crypto currency, or maybe e-transfer to some bizarre email address.

Now… you will hear Official Government Statements ™ that the tax man (be it Internal Revenue, Revenue Canada, whatever) will never call and threaten you. While a nice platitude, that is complete and utter bullshit. The real tax man will, in fact, call and aggressively threaten you – I know this because the real tax man called and aggressively threatened me. However, they’re not going to do it over a few hundred dollars. If you owe the government tens of thousands of dollars, they might, but you probably already know your tax situation so it won’t be a surprise.

What a real tax man won’t do, however is any of the following:

• Send police to your house on the strength of a threatening phone call. If they’re going to send police to your house, they’ll just do it, they won’t call you to threaten it.
• Call you over the phone to tell you about a warrant for your arrest. Think of it – how many people do you think get picked up by the police AFTER someone calls to warn that the police are coming.
• Demand immediate payment in gift cards, or cryptocurrency. That should go without saying… seriously, think for 2 seconds about what the government would do with a stack of iTunes cards. While something like Bitcoin may seem more plausible, governments deal with coin of the realm, not internet quasi-frauds like cryptocurrency. Perhaps anyone reading this in Venezuela might get asked by the real government for Petros (Venezuelan cryptocurrency) but it’s a fair bet absolutely nobody else will receive a bona fide request from their government for cryptocurrency.

If you get one of these calls, what should you do?

• If you are reasonably sure your tax account is in fair shape, hang up and block the number. If you have a macaw, like I do, put the phone in the parrot room and encourage the bird to scream for a while… then block the number when the crook hangs up.
• If you are seriously concerned that you might owe taxes, go to the telephone directory for your location, look up the number for the tax service, and phone it directly. Don’t call the number back that called you.

In fact, no bona fide business accepts gift cards except the business that issued them. Anyone purporting to represent any organization other than Apple that is asking for iTunes gift cards is scamming you. Period.

Also: If you are in Canada, and can speak French, greet a Canada Revenue caller in French. Canada Revenue is required by law to provide service in English and French. To date, I am unaware of anyone receiving a fake tax call from a caller who could speak French. It’s not guaranteed, but odds are, crooks will hang up immediately.

Stay tuned for the next installment… Passwords.

Happy 2020!

It did not start well. I opened 2010 in a deep depression cycle, and on a grossly restricted diet that persists to this day, although the restrictions reduced in the later part of the decade. The biggest remaining restriction is that I am very limited in alcohol consumption – more than a drink or two in a month will make me very ill. Yay idiopathic pancreatitis!

Interestingly, I have little memory of 2009 to mid-2012 nor 2015, except as noted below, probably due to mental health. Maybe that’s a good thing.

I started the decade unemployed, but eventually found what I thought was my dream job – corporate security officer in a financial institution. And it was decent at the beginning, but as so many places do, they tried to “modernize” which largely meant bringing in longer hours and increased responsibilities along with much more intrusive HR monitoring, all combined with no increase in pay. This eventually sent me back down the depression hole.

Those events did spawn two changes – I went back to consulting and became much happier. And with Beth, we brought home the two dinosaurs:

This is a profound life change as the Squid-o-Drome has never had a dog or cat as anything but a temporary visitor. The dinosaurs have added a great deal of happiness to my life.

Time marched on, and I cashed in my consulting gig for a permanent civil service position. Essentially, I’m doing the same job, but now with benefits and pension. Most importantly, I can see the end of my working career now… less than a decade away. It is strange to be looking at the proverbial “light at the end of the tunnel” but it feels very good.

There were some awesome experiences in the decade too. We travelled south to Australia for the November 2012 total solar eclipse:

In 2014 we took a trip through the Panama Canal, one of my bucket list items…

And we managed a tour of the American Southwest for the August 2017 solar eclipse:

Through Facebook, I managed to reconnect with old friends from a part of my life nearly forgotten, and yet the re-connection was very much enriching. Sometimes one loses contact by circumstance, not choice, so I consider this a rare positive thing that came out of Facebook.

Thus the decade ends on a somewhat cheerier note than it began. I’m looking forward to the coming decade, as there are new adventures waiting (two more eclipses, retirement, and a decade of fluffy dinosaur cuddles).

So let’s address the core whining right fresh and early!

The Conservatives Won The Popular Vote ™

TL;DR: No. No they didn’t.

What they did was get more total votes (barely) than any other party. However, that doesn’t mean they won the popular vote. In fact, nobody has won the popular vote in Canada since the very first election I could vote in: 1984. In that election, the Mulroney Progressive Conservatives swept the election with just over 50% of the popular vote. Since that time, no party has ever managed much more than 40%, usually less, although individuals may have won the popular vote in specific ridings.

What this means is: Yes, the Scheer Conservatives may collectively have received more votes than the Trudeau Liberals, but it is a fact that about 2/3 of Canadians did not support the Conservative party. That simply cannot be held up as a popular vote win. It would be more accurate to say “we didn’t suck at the popular vote as much as we could have” or “we didn’t suck at the popular vote quite as much as the Liberals.”

Nor can the Liberals claim any high ground here. About 2/3 of Canadians didn’t vote for them either.

It seems pretty clear to me, that nobody won the popular vote. I will say, the Bernier “People’s Party” absolutely lost the popular vote. That’s about the only thing you can infer from the popular vote statistics.

I want to be unequivocal here: The Conservative Party of Canada did not win the popular vote. The Liberal Party of Canada did not win the popular vote. The popular vote was a fractured mess.

But the Conservatives are underrepresented based on their voter support!

Yes. Yes they are. You know who else is underrepresented in a serious way? The NDP and Green. In fact, if we allocated seats purely on popular vote, the NDP and Green would take a significant chunk of both Liberal and Conservative seats. The Liberals would be cut down to size, an the Bloc Quebecois would be hobbled. Scheer still wouldn’t be prime minister because all those lefty parties (Lib, NDP, Green even Bloc) wouldn’t put up for the religious moralizing that passes for Conservative politics these days.

You know who else is underrepresented, looked at a different way? Ontario, Alberta, and BC who give up seats in favour of Quebec and the Atlantic provinces. PEI, for example, has population to justify one, maybe two seats. They get four.

Nevertheless, if you want to see popular vote reflected, then start supporting electoral reform. Conservatives typically don’t back electoral reform… well, look at those election stats and see why we need it in Canada: 157 Liberals and they got essentially the same votes as Conservatives, but 30-odd more seats.

But nobody should be saying that the Conservatives (or anyone else) won the popular vote in yesterday’s election. Nobody won, least of all, Canadians.

It also means that people will be buying computers, and by January be complaining that they’re slow, whining about Microsoft, etc.  So in order to, hopefully, save some people some grief, I’ve decided to write a little buying guide.  This information, if taken to heart and followed, should not only get you the computer you need, but also save me and those like me the hassle of trying to explain to you why your computer is slow without making you look like a cheapskate.

Step 1: Determine what you want to use the computer for

I can’t stress this enough. All computers are not created equal. They are tools, and they’re intended for specific purposes. A hardcore gamer needs different equipment than a photographer or your grandmother.

If all you want to do is watch netflix and youtube, buy an AppleTV. Seriously. In fact, a modern smart-TV probably costs less than any computer and may even have netflix and youtube built-in.

If you just want to do email and browse the web, rarely doing much else of note, then you need a tablet, not a laptop or desktop. Buy a bluetooth keyboard with it for those times when you need to do slightly more business-like work. Always buy the newest, largest tablet you can afford because if you skimp, you will be unhappy, guaranteed. Planned obsolescence is bad enough in this part of the market without cutting off your own legs cheaping out. However, if you don’t mind moving your data from device to device, money can be saved buying older versions more often. You’re trading price for inconvenience and environmental damage, but it could be workable. Also, if you’re not technically inclined, buy an iPad. This is not because Apple itself is anything special – indeed, they’re overpriced and have less functionality than an Android tablet… but they do have AppleCare. Unless you’re a computer geek, you (and your computer geek friends) really will want AppleCare on your tablet.

If you do actual work, think hard about whether you really need a laptop. The determining factor should be: Does my work require that I need my whole computer with me when I move around? Odds are, the answer is no, but it’s a personal decision. Just recognize that in terms of bang-for-the-buck, laptops are crazy expensive and inflexible.

Step 2: Pay for the correct specifications

Desktop or laptop, the important thing is not to cheap-out on what is important. And that means: DO NOT CHEAP OUT ON MEMORY. I cannot stress that enough, particularly if you plan to run Windows. Yes, the minimum specs for Windows 10 is a 1 GHz CPU and 2 GB of RAM. That’s fine if you’re going to time-travel back to 1998. A machine acquired in 2019 should have 8 GB or more memory. If it doesn’t, you’re going to hate it and be whining about a slow computer on Facebook in less than 2 years. If you are on a limited budget and need to sacrifice something to get more memory, then reduce, in order: graphics card, internal storage (hard drive), screen size.

The logic there is that if you’re not doing a lot of gaming, you probably don’t need a high-end graphics card. Internal storage doesn’t matter much after 256 GB because external storage is cheap and easily available (USB drive or cloud). Screen size may be less important because you can always attach an external screen. If any sales drone tells you that 2, 4, or 6 GB memory is fine, they are flat-out wrong. You will be sorry if you purchase such a machine, guaranteed.

Also, and this is a bit hardcore for people not technically inclined: Do not, under any circumstances, run a 32-bit operating environment on any computer purchased since 2011. Why? Because CPUs have been 64-bit since 2011 (mostly before that, but 32-bit CPUs were still being produced in small batches until 2011). Companies try to sell underpowered laptops with low memory by running 32-bit Windows. It’s unnecessary, it’s slow, it will make Jesus cry. It will also make your techy friends cry when you keep calling them to complain that this or that device isn’t supported, that your computer is slow, and so on.

Think about how long you plan to keep the thing. If it’s intended to be used for a couple of years, then tossed, you can probably cheap out and buy whatever junk you want. If you plan to hold on to it for 6-10 years, then you definitely want whatever you buy to be upgradeable. That usually means buying a desktop, and pretty much requires that if you aren’t capable of building your own computer, you enlist the advice and assistance of someone who is… and most importantly, listen to what they have to say. Do not trust a computer salesman to do this for you. Much better to hit up your kids now with your “mom needs help buying a computer” call than with years of “can you speed up my computer?” calls. You and your computer-geek kids will be happier.

Step 3: Mac or PC or Linux

Ahhh… the age-old debate.

If you are not a computer nerd and don’t have ready access to compliant, tolerant computer nerd friends and relatives, buy an Apple product (Mac, iCrap), and pay for AppleCare. There is absolutely no wiggle room on this.

Yes, you’ll be stuck with regular planned obsolescence. Yes, it will cost more than a Windows machine. However, you will save your sanity, and likely the sanity of everyone around you.

MacOS will run business applications that are standard everywhere. You can even run Reflections and slide a Windows environment on there if you need some special application. The Genius Bar, via AppleCare will support you. It is a win all-round.

If you are a mid-level computer nerd, or really just can’t afford an Apple, then PC+Windows is your next bet. They’re ubiquitous, compatible with nearly everything, and if you’ve bought something upgradable, they’re more immune to the industry’s planned obsolescence. You will, however, have to be capable of figuring computer stuff out on your own.

A modern business-quality machine would be something like an Intel i5 or higher CPU (or AMD equivalent), 1.8 GHz or better clock, 8 GB or more RAM, and a 256 GB SSD. You can save a bit of money by getting a hard drive instead of an SSD, but your computer will seem slow. Nobody has ever regretted getting an SSD.

If you are a power nerd, you’re probably not even reading this because you already know it. However, Linux is for people who really know what they are doing. If you’re someone’s dad and not a lifelong computer geek, and someone tells you “you should run Linux”, that person needs to be told to do something sexually challenging with their own body because they clearly hate you. If you are that nerd, and don’t have a lot of direct business application interaction with the real world, Linux certainly has the right price point, and Libre Office will get you far enough.

If you’re a gamer, you need a high-end desktop PC running Windows. It will be expensive. Enough said on that.

Now, I could go on here about how 30 km/h is absurdly slow; how it’s slower than many cyclists pedal through the Glebe; but I really want to talk about the critical issue, since other neighbourhoods in Ottawa (including mine) have been lowering speed limits.

Here it is: wasting money on signs and paint doesn’t do much if you’re not going to pay for enforcement. It is a well-documented fact that people (for the most part, there are always idiots) drive at the speed the road and conditions comfortably permit. You can put up 30 km/h signs until you’ve exhausted all the iron in all the asteroids, and people will still drive 40, 50, 60 km/h unless there are cops there to enforce the lower limit.

My first suggestion, therefore, is that taxes for people in the Glebe be raised to provide 24/7 enforcement on the new speed limit. Probably 1 police position and equipped duty car should do it, which means 5 officers (3 full time, 2 part time) and probably 2 new equipped police cars. At an average salary of about $90000 for the officers and about $100000 for the cars, an annual tax increase of about $400000 split among the Glebelings should cover it, plus a one-time levy of about $200000 for the purchase of cars, signs, and paint. Until the people of the Glebe, and councillor Menard are willing to do that, they should stop their self-righteous posturing about people speeding in the Glebe.

All that said, the Glebe is also rife with speed bumps – those annoying humps of ashphalt that slow down emergency vehicles, mess with snow plows, and are mildly annoying to cyclists. Since the bumps are all about safety, I’d like to bring back an idea that a friend of mine had. This idea will both improve safety and, since ostentatious displays of self-righteousness are all the rage in the Glebe, openly display your concern for the safety of the people of the Glebe:

TWO TOOTS FOR SAFETY!

That’s right… every time you’re in the Glebe and go over a speed bump – day or night, rain or shine, weekday or weekend, give two friendly taps on the horn to let people nearby know that a car is coming by and they should be careful. Nobody can say an evil car snuck up on them if you’ve been giving fair warning. You saw the video in driving school where the instructor reminds you to give a friendly warning tap on the horn. Obviously, Glebelings are seriously concerned about their safety and cars, so help them out. Two Toots for Safety! It’s good for everyone!

And because we know how much emergency vehicles and snow plows love speed bumps, they should do it too. Remember, safety is paramount and in the Glebe, cars are dangerous.