Krebs on Security recently wrote about investigations into the wave of extortion spam doing the rounds. As chance would have it, I recently started receiving these emails myself. I’ve had three, so far, over the last week or so. All from the same @yahoo.jp email address (obviously not the real origin), and all with slight variations on the same message, and a unique Bitcoin wallet each time. For example:

These are the first few mail systems used by the most recent message, before the message reaches my own setup:

Interesting things to note:

• The password given must be from the Tesco data breach – I remember that one as their sign-up form cut off part of the password I had typed in – I don’t remember being a Tesco Bank customer, but I have used their online grocery store, and I assume it’s all the same login system.
• The amount they want paid has decreased over time – it started at $3000, the most recent email is $1000
• Similarly, the number of friends they threaten to send their “recording” to has gone from 9 to 5. Perhaps the scammer is testing at what “level” they get the most returns?
• The English is good, but not quite native-speaker level.

Given I already know this is a scam (and I don’t even have a webcam attached to my PC, for another thing… ?), I’m not exactly a prime “mark” for this. But I can easily see how some less clued-up person could be scared into handing over their savings.

[Addendum] – as I’ve been writing this, a fourth email has arrived. Same sender, same basic message, but this time asking for $5000, and threatening to send to 14 friends.

Update:- I added some of the mail headers to the post, for a bit more information.

Mike Monteiro has written some of my favourite articles on about Twitter, most written from a place of frustration, sadness, and anger at the avoidable decline and lack of leadership. I wanted to bookmark them here so I had one simple place to refer back to them from, and to share them with any readers who hadn’t yet come across them.

• The People vs. Donald Trump vs. Twitter
• One person’s history of Twitter, from beginning to end
• Merry Last Christmas, Jack Dorsey.
• Jack Dorsey’s Resignation Letter to Twitter
• Twitter’s Great Depression

I’m one of those people who still cling to their RSS Reader as a way to aggregate and read interesting things and news. Even though half the feeds in my blog folder are dead, I keep them around in the hope they one day spring to life again as we all get tired of the social media walled gardens, and start publishing on our own sites again. I’m sure it’s part habit, part convenience, part nostalgia.

At the moment I’m using The Old Reader, and using Stylus to fix the horrible, horrible default reading experience. TOR has worked fine for me up to now, but I was already near the subscription limits of the free tier, and I have a whole lot of new feeds to import that would basically double the number of sites I follow.

I know I could just use Feedly, as the free tier supports unlimited sources. That’s my fallback, but I left Feedly for The Old Reader several months ago, as I was becoming increasingly annoyed by some of their attempts to push Feedly Pro and team-based features. I just want to read my news, not create collections or share with teams, or whatever else they’ve come up with since. My RSS reader is not a shared experience.

So I’m probably going to have to start paying for a web-based reader, I want to make sure I’m using the best one I can. TOR is ok, but paying for something I have to use an addon to “fix” seems a bit silly.

If you’re using a paid-tier reader, which one are you using? My basic list of requirements are:

• 3rd Party Apps can use it as a synchronisation source, so I can read on my iPhone or iPad.
• Support for 200+ feed sources
• A nice reading experience in the web client

Let me know in the comments what your preferred reader is!

This post, by Steve Smith, speaks to me and my constant struggles to finish projects:

…starting a project is thrilling. The unknown is exciting. The opportunity to solve new problems in new ways is inspiring. But nothing compares to the joy of finishing. Starting is easy. Finishing is hard.

Steve is talking about software, using his hobby of woodworking as an example. For me, it’s all about the hobby. Finishing a miniature painting project that is taking more than a couple of days is hard. Maintaining the motivation and enthusiasm needed to get through all those finishing steps is hard. Heck, even getting through the first few steps of picking out all the base coats is hard. Throw in my personal rule of not playing with unpainted miniatures, and it’s easy to figure out why I’ve not played a game of Warhammer 40,000 since before 8th Edition launched.

Strangely enough, the building stage… that’s easy, although it’s the part I usually complain about. Perhaps I should learn to let go and play with “the grey tide”?

Don’t be silly. I’ll just have to keep pushing through and finish.

Enough users are fed-up with Twitter and the cess-pool it’s becoming, that they have declared Friday 17th August to be #DeactiDay. The hope is a short, sharp, shock of mass account deactivations will make those in charge sit up and listen. I’ve no hope left that it will, but it’s worth a shot.

I’ll admit that I’m torn. Some aspects of Twitter are still worth checking out. The wargaming/hobby community and the connections I’ve made have been wonderful. It’s clinging to these positive interactions which have made Twitter my most used social media site.

But outside of these bright spots, the service has been slowly sinking into a toxic morass. It’s just not fun any more, and the leadership seems to be morally vacuous.

I’ve noticed myself becoming more and more wary of using Twitter. It’s one reason I just spent the weekend retooling this site so I can reclaim a space to post my thoughts free from a looming sense that I’m helping prop up something which is doing more harm than good.

Last week I deleted my entire tweet history (apart from ~275 which can’t seem to be accessed). In part, this was because I couldn’t tell you everything that was in the nearly 10 year-old bundle of half-thoughts. With the increased weaponisation of long-forgotten tweets, as shown in the James Gunn and Sarah Jeong incidents, keeping nearly 29,000 tweets around felt like an unnecessary risk. Others have already done the same, or left the site altogether.

This coming Friday I will deactivate my account and take at least a 30 day break from Twitter. If the message is heard and acted on, I might reactivate. If not? I guess we’ll see if the few positives manage to keep me around. I suspect they won’t.

[Hat-tip to BoingBoing: I’m joining the campaign to deactivate my Twitter account on August 17. ]

I’ve had my Series 3 since launch¹. At different points over the last several years, I’ve had many a wearable strapped to my wrist, and several times over my lifetime I’ve tried to get into the habit of wearing a watch. I’m pretty confident in saying that nothing has stayed on my wrist more than a few months. So why get a Series 3, and is it any better?

First, Some Background

Wearable tech always ended up falling short of its promises. In this category, I’ve tried various health trackers and one other SmartWatch — a Motorola 360 v2. My most common technological complaint with all of these devices was software quality, with “utility” (specifically: lack of) being a close-run second. Each device has been close to what I wanted the technology to be at the time, but each had maddening quirks and flaws which would build up frustration over time.

When it came to actually wearing each of these devices (and the traditional watches), we get to the main reason I stopped using them: none were comfortable. Whether it was thick, sweat-inducing rubberised straps, solid fastening mechanisms digging into my wrist as I tried to work, or general size, shape, and weight… I rarely wanted to keep them on my wrist for long.

Nothing epitomises all of my previous complaints more than the Motorola 360 I wore for a few months, around 2 years ago. Within a few days I knew I’d made a mistake but as I’d spent what felt like a lot of money on it, I was determined to stick it out. It was big, heavy, and I struggled to find a position on my wrist which was comfortable. The weight meant that it would slide further down my wrist as I was walking, so it wouldn’t stay comfortable for long. The strap buckle would dig into my wrist when I was typing; I tried several alternatives (1st and 3rd party), but each had their own flaws. The software was “OK”, especially when sticking to the Android Wear 1st-party apps, but in general, it was slow as hell. Very few 3rd-party applications were worth installing, though I tried a lot. Battery life was terrible — even when I wouldn’t use it all that much I’d have to charge it every night, and often during the day too. There were annoying bugs: notifications wouldn’t appear, or would appear multiple times; the screen would randomly stop responding to touch input; software would freeze up and the watch hard-rebooted. I think I lasted 9 months, mostly out of sheer stubbornness. The last month of that, I’d switched back to iOS, and without an Android phone the 360 was practically useless – so I threw it in the metaphorical drawer.

So. The Series 3…

Let me start by saying I had low expectations. I went into this fully expecting to be returning the Apple Watch to my nearest store within a few days, maybe 2 weeks at most.

So colour me surprised when the Series 3 turned out to blow away all of my expectations. For reference, I bought the 42mm “Space Grey” aluminium-bodied watch, with the “dark olive” Sports Loop strap.

The first thing I want to say is this is the most comfortable anything I’ve worn around my wrist. The “Sports Loop” strap is fantastic. It’s soft, unlike nearly any other hook-and-loop strap I’ve worn previously, and has a little bit of stretch to it, so at no point have I felt like the strap is constricting my movements. I like it so much I’ve put 2 more on my wish list.

The watch body itself is so light, and the shape — for me — has been perfect. Maybe if I’d tried a rectangular watch I’d have managed to get into the watch habit before now? As far as size goes, the 42mm has been perfect. It feels small, but it’s deceptively big… without feeling big, if that makes sense?

The combination of low-weight and stay-out-of-the-way shape mean that on more than one occasion I’ve grabbed at my wrist because it feels like the watch isn’t there anymore.

It even looks nice. The Motorola looked fine if a little cheap. Other wearables have looked like toys. The Apple Watch looks positively amazing compared to them all. Granted, I have a soft-spot for black anodised aluminium which stretches back to my PC building days.

Oh, that controversial red dot on the Digital Crown? I really like it, on the Space Grey model at least (I haven’t seen it on the other models in person yet).

The “bulge” on the bottom of the body for the various sensors has the added benefit of keeping the watch in one place on my wrist. Once I tighten up and fasten the strap the watch just does not move unless I reposition it.

The only ergonomics “quibble” I have is the plastic tab at the end of the Sport Loop. It sometimes catches on my shirt when I go to check the time or a notification… and sometimes I’ve felt it when I’ve been typing. This seems to be dependant on the keyboard setup I’m using at the time. It’s more noticeable on the very small (65%) keyboard I use at home than with the full-size keyboard at the office.

Battery life has been a revelation. Most days I never dip below 75%, and some days it doesn’t go below 80%. I’ve had a conundrum about charging the watch every night – I want to extend the life of the battery as much as I can, so I should let it run down more often: maybe only charge it every second or maybe even every third night would be the way to go?

Now, to be fair here, I’m not exactly stressing the watch much. The only 3rd-party app I have installed is Dark Sky, for the watch face complication. I’m not using the headline feature of the Series 3 — LTE connectivity — as my carrier doesn’t support it yet. I am frequently checking notifications or the time (so turning on the screen quite a bit), using the movement and heart-rate tracking constantly, and using Siri semi-regularly to set timers or reminders and stuff. I haven’t tried using the watch as a music player (paired with my AirPods), as 1) any time I’d want to listen to music I’ll already have my existing phone setup with me, and 2) I mostly listen to podcasts these days, and podcast apps pretty much suck on the watch. It is something I’m going to try out at some point in the near future though.

But for now, it’s doing everything I want it to do, and it’s doing them without any fuss or bother. If I absolutely must pick out one quibble with the software it’s that the audible notifications volume setting seems to suddenly jump from inaudible to Really Very Loud. I’m still trying to find the right setting for me.

One of the biggest reasons I wanted to try the Apple Watch was for the health tracking features. Already these have exceeded my expectations. The subtle (sometimes not so subtle) motivations the watch gives me have actually started to have an effect. I’m looking for ways to close out those rings: getting off the bus a stop early for a few more steps or the chance at a brisk walk; standing up regularly to stretch my legs. Even the Breathe app has been an unexpected hit with me – and I made fun of that app heavily when it was first announced. (Who didn’t?) I don’t use it as regularly as I maybe should, but the times I’ve remembered to it’s genuinely helped me feel more relaxed and focussed.

The only thing I’m really missing is a good way of tracking my sleep, something I know is a problem area for me. And maybe blood sugar monitoring, but rumours are that Apple is already researching this. If it does happen, hopefully it can be done with just a software update.

With the data from my watch feeding into the Health app on my iPhone and coupled with some data fed in from other apps, I’m starting to build a decent picture of my overall health and habits – and more importantly, started to make adjustments. Since wearing the watch, and making these admittedly small changes, I’ve managed to lose 5lbs. Still, a lot more to go (and weight isn’t the be-all-end-all of health), but it’s a start.

TL;DR

All of this is to say: the Apple Watch Series 3 is the first piece of wearable technology I actually believe in. It’s good, so much better than anything I’ve used before it’s almost comical. I didn’t expect to be this impressed with it, but here we are.

As something to wear, it’s light and comfortable, and the first anything I’ve managed to keep on my wrist without causing discomfort. WatchOS is doing everything I want it to do now, without any frustrations, and I still have more scope to dig into features I’m not using yet.

I enjoy my Apple Watch, which was not what I expected coming into this.

Recently I’ve been “[sunsetting][]” old email accounts I don’t really need any more. One of them was a private domain, and was hosted with Fastmail. In most cases I could have set up a simple forwarding rule from my domain registrar to my master email, but this one domain made extensive use of subdomains to filter and “tag” email from services — i.e. user@service.domain.com. Forwarding from the registrar would only catch mail at the top level. Everything else would return an error to the sender¹. If I were to move the DNS to Cloudflare, like my other “active” domains, I wouldn’t be able to do even this basic forwarding; I’d have to setup my own mail server to handle the domain.

[sunsetting]:{{site.url}}{% link _posts/2017-09-08-sunsetting-a-decades-old-email-address.markdown %}

Running your own email server, in 2017, is a fool’s errand. I needed to find another way.

After a few evenings research, and weighing the pro’s and con’s of each approach, I settled on using Mailgun to route email².

Step 1. Mailgun

Create your Mailgun account. Add your domain. Mailgun will encourage you to use a subdomain, but I didn’t. During the setup, you’ll be presented with several DNS records you need to add to Cloudflare – 2 TXT records, 2 MX records, and a CNAME record. Leave this tab open for now.

Step 2. Cloudflare

Add the domain to Cloudflare, if you haven’t already. Modify the DNS records to remove any previous MX records and add in the details Mailgun gave you. To get the subdomain email addresses to work, you also need to add 2 more MX records similar to these:

MX    *.domain.com    mxa.mailgun.org    10
MX    *.domain.com    mxb.mailgun.org    10

For some reason I also needed to add a wildcard A record (*.domain.com) to get things to work correctly. This might be a Cloudflare quirk.

Step 3. Back to Mailgun

Click through to finish adding the domain to your Mailgun account. Depending on DNS propegation timings, you might need to click the “Check DNS Records” button a couple of hours later, to verify the domain (usually it will only be minutes). Under Domain Settings, change Wildcard Domain to On.

Switch to the Routes screen. Create a Route. A “Catch All” type should be fine, but you can check out the Mailgun documentation to define more complex rules. Make sure the Forwarding checkbox is ticked, and enter your master email address as the destination. Set the priority to 10, give the Route a name, and click Create Route.

Use the Test Your Routes box to, well, test the route with a sample email address to make sure it will fire appropriately.

Step 4. There is no Step 4.

At this point you should be done. I needed to wait a few hours for the DNS records to propegate out to other services before test emails would arrive properly. But once DNS did its thing I was receiving email to my master address just like I had been in Fastmail.

I recently decided it was time to consolidate several email accounts, spread across multiple services, to one easily managed account. Some of these have been in use for over a decade. Some are “custom” domains, some are Gmail and other hosted services.

Partly this was for simplifying things — “what account did I use for signing up to that?” — partly it was to reduce the number of services I pay for every year (more on that in another post. Probably.) and partly it was to reduce my online “footprint” for privacy and security reasons. As a welcome side effect it would dramatically reduce the volume of spam I receive!

Importantly, my goal wasn’t to just redirect them all into yet another account. That would just lead to more juggling in the future. My goal was a full purge. I would have one master account and anything old would no longer exist.

Step 1. Identify What Was “To Go”

I had one fairly recent Gmail account which was practically never used, and had a decent address. I quickly settled on this as my new master account. Everything else was on the chopping block from this point on. This included some domains setup at FastMail which used some special setup to let me segregate each service I’d signed up to under its own subdomain address (i.e. user@service.domain.com). More on these domains in a later post.

I checked through my password manager to make sure I’d found all of the email services I had logins for, in case I’d forgotten about any.

Step 2. Secure the Master Account

Buy a Security Key. Use it. I followed these steps to get things setup so I have 2FA through either the key, or the authenticator app on my phone. This lets me avoid the backup SMS codes I’ve never really felt were particularly secure.

I really wish more services supported this setup, instead of limiting you to app + SMS. Or primarily SMS — yes, I’m looking at you, Twitter.

Step 3. Temporarily Redirect Everything to the Master Account

This was so I could categorise and prioritise the mail I was receiving. I applied a filter to incoming mail to tag it with the service it was forwarded from. From here I was able to identify where I had to put the most work in.

Step 4. Update Priority (Non-Email) Services

Mostly this involved going through my 1Password vault and updating anything I felt was important during the first pass. As many of the services used an email address as part of the login, I could search for each address in turn to cut down on the number of sites I’d have to update in each session.

Step 5. Purge Unnecessary Services

While I was updating services it was as good a time as any to delete any accounts which were idle. Using Just Delete Me sped the process up considerably. I think I’d cleared out 100 logins from my 1Password Vault by the end of the first week.

Step 6. Export Email Data

If it’s an old GMail account, you can use Google Takeout to download an archive of your mail. Other services vary, but the easiest way to grab an archive of your mail is to configure a desktop client, synchronise/download to your local computer, and then export from there. This is what I had to do with my Fastmail domains.

Step 7. Tidy-up

We’re in the final stretch now… with all the legwork out of the way, you’ll want to: make sure you’ve updated any friends, family, and contacts who would have the old email account; update any profiles or web pages where you have the email address listed; remove the account from devices, and basically remove as many references to the address as you can.

Step 8. Close the Email Account

This should be the obvious bit, but there might be some caveats… for example, with GMail you need to close the entire Google Account, taking any data in other Google services like YouTube with it. Some services make it harder than others to delete your account. If in doubt, check Just Delete Me, or try a search for “delete account.”

A clear, concise guide on using a hardware Security Key¹ with a Gmail account. I didn’t even know it was possible to avoid using SMS as your backup second factor — thanks to this guide I have my Key as my main and the Authenticator app as backup. No SMS involved. (My phone number has since been removed from my Google account)

The official documentation/setup guide should really make this clearer.

1. Sublime Text (Portable) + Plugins

By using Sublime Text with the Sublime Jekyll and Git plugins allows me to write and publish posts from within a single app. By-and-large, Sublime is the “Admin UI” for this website.

I tried using other editors, but I just couldn’t get them to work the way I wanted them to work. Your mileage may vary though, so if you don’t feel Sublime is still worth the license fee, Visual Studio Code is good.

Using the portable version of Sublime lets me drop it into a USB stick/Dropbox/whatever and take my settings with me. 99% of the time this works seamlessly, but now and then I’ll run into an environment issue breaking the link between Git and Sublime. This isn’t that big of an issue though — I just open up a terminal session for all of the Git commands instead.

2. Setup Some Templates

Sublime Jekyll gives a lot of handy commands for quickly working with Jekyll — ctrl-shift-p jnp to start a new post was my most used for quite some time. But manually typing in all of the front matter except the title was a PITA. I use front matter for controlling the “style” of different post-types on the front page, so it is important to my setup. Then I found out about the ability to create templates, which speeded things up considerably.

To use templates, create a _templates folder in your Jekyll site. Create one or more markdown files in there to correspond to your various front matter defaults. $n can be used to set tab-stops. For example, here are my “Post” and “Link” templates respectively:

---
layout: post
title: 
date: $1
---

---
layout: link
title: 
date: $1
link_title: $2
link: $3
---

Note the tab-stop marker on date which lets me quickly insert the full, formatted, date and time using a Sublime Jekyll command

3. Git, plus a Commit Hook

I can’t always install Ruby + Jekyll on the environment I’m working on, so I offload the compilation of the site to the web server itself. To automate things, I manage the source files with Git, push changes to a repository on the server, and a commit hook fires whenever the server receives an update.

If you followed my post on [setting up a blog with Caddy and Jekyll][g], you might already have this setup. If not, the details can be found in this guide on Digital Ocean, which I linked to from there.

[g]:{{site.url}}{% link _posts/2017-06-26-start-a-blog-with-caddy-and-jekyll.md %}

4. Write

This bit I’m still working on improving my efficiency at…

Fantastic choice.

External link: Doctor Who’s 13th Time Lord to be a woman

I completely missed this when Agile Bits introduced their new 1Password.com product (which, admittedly, I didn’t really pay attention to), but standalone licenses for 1Password are no longer being marketed. If you want one, you have to email Support to get one.

As someone who’s bought multiple versions and upgrades of 1Password over the years, I’m a little torn over this. On the one hand, if there are genuine technical limitations caused by supporting standalone versions with local vaults, and the new platform provides a truely better experience, then great. On the other, I’m always wary of putting all my eggs in one basket… if Agile Bits were to suffer some catastrophe tomorrow then my standalone 1Password 4 and local vault wouldn’t be affected in any way at all. I’m mostly fine with the security aspects, as from what I can tell, even if they were to be breached, all a hacker could get would be an encrypted binary of your data.

Something for me to think about, I guess.

External link: 1Password Support Forum Thread