Sunday, November 12, 2017

Hackaday Supercon 17: Film Contest

The Hackaday Supercon badge was super fun to play. I decided the clunky old Omnivision cam was just begging for noir b&w. The contest limit was no longer than 1 minute. Here's what I came (cam ;-) up with shooting content day one and composing the following morning ^_^


Posted by at No comments:
Labels: , , , ,

Friday, October 6, 2017

Social Media and Safety for Parents and Guardians

Ironically, the day after speaking to the parent/guardian group about social media and safety, the whole Rose McGowan thing exploded on Twitter. I decided to participate in #WomenBoycottTwitter, and went dark at 00 October 13th.
For me, it's not so much about Rose McGowan specifically, but rather a growing outrage over the Russian hacking and the distorted over-intellectualized interpretation of free speech that rationalizes giving self-professed Nazis a platform for hate speech - while collecting ad dollars and blowing off users who report flagrant violation of Terms of Service. It's the lack of standards coupled with a thinly veiled drive to keep "big names" on board tweeting up a storm, regardless of the horrific destabilization those threats are causing to our global political fabric (why does @realdonaldtrump still have an account?!). It's the fact that I've played the Report and Block game since August of 2016, but at most Twitter recognizes 30% of the accounts I report as being in violation - and then I STILL find those accounts active, blasting away their vitriol.
It's knowing all the research that has come out pointing to the role Twitter's army of bots and sock puppets played in the 2016 Presidential election, and how very how easy technically it would be to clean-up the platform, but instead Twitter had the balls to show up at the congressional hearings with 200 accounts identified from the Facebook data instead of conducting independent research.
Which really gets at the heart of the matter: Twitter does not "believe" there is a problem. Or maybe they just think they're smarter than everyone else and no one will notice how lame the response is.
Hopefully the boycott will rattle some cages at Twitter HQ. I miss my virtual friends. Here's the final outline with links to a few articles.

 Social Media and Safety
What is social media? Online community with networking ((engagement) and/or shared content. Technically there is a distinction but …lines getting increasingly blurred.
  1. Facebook (1.9 billion users): Social media, networking, IM, and gaming (VR)
  2. WhatsApp (1.2 billion users): Cross platform IM (acquired by Facebook 2014)
  3. Messenger (1.2 billion users): Facebook IM
  4. YouTube (1 billion users): Video content and comments (acquired by Google 2006)
  5. WeChat/Weixin (889 million users): Chinese IM (Tencent released 2011)
  6. QQ (869 million users): Chinese IM (Tencent released 1999)
  7. Instagram (700 million users): Photo/Video editing and sharing (acquired by Facebook 2012)
  8. Qzone (638 million users): Chinese Blog (Tencent released in 2005)
  9. Twitter (328 million users): Micro-blog and streaming video (hold that thought…)
  10. Weibo (313 million users): Chinese micro-blog
Notes: Facebook has bought more than 50 startups. VK is huge in Russia, but not on the list. http://www.makeuseof.com/tag/top-8-russian-social-networks-makes-great/
  • Investor focus on MAUs as value: umber of unique active users in a 30 day period. Encourages tech companies to host sock puppets and bots... http://www.investopedia.com/terms/m/monthly-active-user-mau.asp
    • Facebook: Logged in
    • Twitter: Users who sign in and follow at least 30 accounts and are followed back by at least one-third of those accounts
    • Google+: An account that uses a Google service
Kids are kids. They’re immortal and smarter than adults.
  • Don’t take time to check privacy settings let alone set-up 2FA.
  • Chat code: abbreviations, memes, and emojis
  • Delete and Snapchat, but The Internet never forgets.
It’s The Wild, Wild West
  • Legal system is not capable of handling Internet crimes and rapid change in technology
  • We are in the middle of a grand 10 yr experiment, 1st generation that is fully plugged-in
  • No one know the answers
Recommendations:
  • Be realistic: it’s socially important to be online and there’s a lot of good
  • Look at your own behavior
  • Look for the signs of sleep deprivation or lack of focus - and talk!
  • Engage in social media so you have a touch point
  • Teach balance, time management, focus, and cynical critique.
Posted by at No comments:

Tuesday, June 27, 2017

Airbnb: Run Don't Walk

An airbnb supervisor just told me that "Customer Support died in the 80's. This is Customer Experience".

Noooo...Customer Support did not die. There are plenty of companies that excel at customer service. Drop your coffee at Peets? They hand you a new one, no questions asked - after making certain you're okay.  Problems with an L.L. Bean shipment? They overnight a replacement and arrange for return of the lost package - without charging your card. Lost your Debit Card? Charles Schwab immediately mails a replacement and offer to overnight at no charge.

"Experience" may be how airbnb managers excuse what they're doing, but as a first-time-never-again customer, I see a company that is in failure. Another poster child in the rise and fall of shared economy. They have lost sight of the fact that without a dedicated customer base, they don't have a business. Booking accommodations 3,000 miles away from home is completely different than picking up a used lawnmower. It's not Craig's List, and trying to justify operating as though the two offer an equivalent connection service is foolish, especially when airbnb collects a service fee from the guest for the booking.

When the I booked this apartment in Boston, the host told me the address was 38 Queensberry St. I looked it up on Google Maps, and went okay! This'll work.






Skip one month, a verrryyy long flight from the West Coast, and one Uber, I'm standing outside this very nice complex with my kid and pile of bags. Waiting. Wondering. Where is the host? Where is 38? I can see 36, and 40, but no 38.

After 15 minutes I checked my 1% phone and found a message from the Host instructing me to go a block away to meet "Eddie" at a Pizza Parlor.



We hauled everything down the street, and waited. Eddie shows up and takes us ANOTHER block down to a large apartment complex at 62 Queensberry St. 

It's was about 8:30 at night. Dark.

Eddie talks a fast talk about the apartment having been on Craig's List, and nobody is who they say they are, so when they moved to airbnb they didn't want to lose the good ratings, so they kept the old address, even though it's not right. (Huh?!) But you'll love this place because it's all professionals. Doctors and lawyers.



It's student housing.

When we got into the apartment, I was pretty shocked to see it was only one bed, not two as advertised. Eddie showed me the kitchen saying there was a little hole under the carpet probably from the dishwasher leaking, but they were going to get it fixed and I could use it if I wanted to, though really; you don't want to cook, do you?

FINALLY he left and I pulled back the carpet. The soft area went from wall to cabinet, was about 2 feet wide and punched straight through the subfloor in spots.



There were other soft spots throughout the unit and large holes in the walls:


The shelf in the living area was falling out of the wall. An ancient window AC could barely kick out air through the crust of dust.




The bathroom looked like it hadn't seen a scrub brush or caulking in years, and the door couldn't close.




The sheets were threadbare.  Pillows disgusting.

I told my son to sleep on the coach and I caught a few hours sleep before looking for a hotel the next morning. 

The first two hotels were booked solid because the Dead were playing Fenway Park that weekend. The third had room, but would have to move us three times, and Saturday and Sunday were going to $695 per night. Fortunately the gals at the front desk told me to check out Hotel Buckminster because they always had rooms - and they did! At a reasonable price. (Great hotel!)

We packed up and were out the door by 10:30 am. I contacted the airbnb Host while standing on the street waiting for an Uber to let him know we'd checked out. He asked why, and I sent the pictures.

The next day, while on a school tour, the Host started sending messages telling me I had no right to leave because all that could be fixed in 20 minutes 0_o

I contacted airbnb as soon as we got back to the hotel. I was scared.  I wasn't exactly certain about airbnb procedures, but at this point, it seemed over the top even for the "unstoppable share economy". 

Technically, this was Day 3, but only two nights.

The support folks were wonderful! Totally focused on the right thing: our safety. Discontinue contact with host. You've done everything you can. 

But I was worried. I contacting support multiple times and ended up with TWO case numbers that got joined.  I filed for a refund for the 5 days we didn't stay plus cleaning fee (cause it wasn't) and service fee (because it shouldn't have been).

Of course the host denied my refund. Per airbnb policy, I had to wait 72 hours before requesting help from the Resolution Center. I submitted the paperwork and photos and called. The support rep was wonderful! She was horrified by my experience and assured me it warranted a case worker who would contact me shortly.

William, the case worker, sent me an email days later that succinctly stated the reservation had not been "officially" canceled, and as a result the Host had lost money.

I told William that I HAD contacted airbnb multiple times and not one person mentioned that I needed to "officially" cancel the reservation. That the Host had communicated outside the app when texting my phone directly, and had changed his profile name from Alan to Edward - resulting in ALL the communications within the app being retroactively modified!

William responded that I was still in violation of the 24 hour notification policy, even though there was false advertising, and questioned the location issue, "because nobody else had complained". I sent him the very negative reviews that had posted since I'd booked, and the text message that Alan/Edward/Eddie had sent outside the app which identified the address as 62.




William told me the best he could do is refund the cleaning fee, service fee, and 50% of the nights not stayed because of the 24 hour policy. Regardless of the breach of contract and multiple contacts with airbnb. He refused to provide his last name for "security reasons", and refused to let me speak with a supervisor. 

It's not easy to find a phone number for airbnb. 

1-855-424-7262

The supervisor who lectured me is quite proud of the fact that being a web service they don't have a phone number published on the site.

How was I supposed to contact airbnb the 1st night so they could find another place for us to stay?! 

I will never use airbnb again.

btw - Alan/Edward/Eddie is still a host.

Posted by at No comments:
Labels: , , , , , ,

Thursday, April 27, 2017

Part and Parcel

One of the truly gut-wrenching set-backs that we experienced while making the BSidesSF badge was due to a package not being delivered.

No, this isn't another story about China parcels being held hostage in customs, or a bad weather act of God. This is a story about 10 years of war with Ron the UPS Driver.

We were on a tight timetable with one month to go until the con. Duclass was calculating estimated time to complete for three separate dev epics on a daily basis: software, case manufacturing, and board assembly. The final PCBs were ordered from Advanced Circuits on January 13th specifically because they agreed to a rush delivery on Friday January 20th; we needed the weekend for assembly.

Ron the UPS Driver showed up as expected Friday morning - and demanded a check for $1,746. The package was marked COD. When we tried to explain the order had been paid in full, he walked away taking our precious boards with him, and a box of batteries, saying the packages would be marked for delivery next business day.

Monday. No weekend assembly.

It was a really bad scene. IF I had answered the door, and we weren't emotionally trashed from months of sleep deprivation, I coulda woulda just written a check and dealt with either reimbursement or cancelling it later. But duclass answered the door and everything about Ron the Driver's dismissive controlling manner pushed his buttons.

So. There were conversations. Some louder than others. Advanced Circuits did everything they could, but UPS would not budge. The only way we could get the package was to provide a check.

I called the distribution center and they said they would redeliver that day. But they didn't. And they didn't the next day either.

Ironically, after 5 years of telling duclass about what an asshole Ron the Driver was, there was no satisfaction in getting validated. This is the jerk, who parked his truck in our private driveway easement, completely blocking our garage door - then went to lunch! I caught him a block away and told him he had to move it, and he got pissed because "that's the only shade on the street". Private property be damned.

Monday. I had two checks written and ready for UPS: the international shipping fee for the batteries and the PCBs. Fuck me it happened AGAIN; Ron the Asshole showed up right when I was in the shower so duclass answered the door. Ron had only one package, the PCBs, and no idea what happened to the batteries. Bad scene, but at least we could start assembly.

I called the distribution center about the missing package. Fortunately, one of the warehouse sorters stumbled into it on the floor and scanned it, so at least it wasn't lost. I drove down and picked it up.

The PCBs were the last package Ron delivered to our home. That day, January 20th, he started marking all packages "customer requests pick-up" without my authorization. At first, I called the distribution center thinking, "Oh, they must not know or support what he's doing because they must be concerned about doing their job." The same two people kept answering the phone, politely listened to my problem, said all the right things - and did not deliver the packages.

Skip to a month after the conference. Ron was still marking packages for pick-up. So I started calling UPS customer service. Then I started calling the vendors. The Customer Support reps were always shocked. They would file a report with UPS, and we'd get delivery - but never from Ron, and the problem persisted.

I asked if I could select the carrier. We get deliveries from FedEx, USPS, OnTrac, and AMZL without issue. But that is not an option with the companies that I order from. They optimize profit by selecting cheapest delivery for that from/to destination.

I started returning packages that were held for pick-up, thinking that would get someone's attention. But no such luck.

At one point, Amazon connected me directly to a special unit at UPS that is dedicated to resolving Driver Problems. It operates outside the standard UPS customer support line. She told me there are a lot of problems because the drivers are union, and "escalated" the report to the regional level. When that package was delivered, I thought we were finally done with the bullshit. Then I got a call from the driver manager at the local distribution center who was "researching" my problem report - then said I was the problem.

Ron continued to mark packages for pick-up without my authorization. But of course...

One night, duclass and I were having a beer, and he said, "You know, this has been going on for a long time. Not just since January. Or the driveway incident". Duclass started marked all deliveries to the office, and encouraged me to do so too.

But I got to thinking, and I got pissed. Really pissed.

I knew a few things. Calling the vendors for help always worked, but it was a one time shot. Calling the distribution center did buttkiss. Calling UPS customer support did less than buttkiss. I needed more data.

Instead of ordering and going on my merry, I started checking for the carrier, and if UPS, followed the tracking status online: https://www.ups.com/WebTracking/track?loc=en_us

I could see every scan, including timestamp when it went on the truck, and when that fucker marked it for pickup. I watched for when UPS was on the street. The status was always changed about an hour after the truck left.

I called the manager at the distribution center. He said there was more than one driver on our dead-end street, didn't know where the package was and - this was wild - had no way to reach the driver while on route. Cover-up confirmed. No need to bother with them again.

I called the UPS 800 number. They said it was a mistake, and would be happy to follow up with the distribution center to help locate my package. "But," I said. "The distribution center IS the problem." That's when I discovered you have to specifically request the problem be escalated to regional, but it's still only good for that delivery. 

 I had an established pattern, but needed to force Ron's hand. I did a little OSINT to confirm the status scans fed into a fairly elaborate delivery system. Then checked the meaning of the codes and all the labels on my packages. Also read up on the teamsters union and the specific local riders for UPS drivers in my area.

Another package, same old shit. But this time, I hit twitter, e-mailed customer.service@ups.com, called the 800 number, and e-mailed and called Amazon - who filed a complaint with UPS. Logic being written complaints are more likely to be added to a log and garner attention. I told all parties that marking packages for pick-up without my authorization is essentially theft since I had already paid for the goods, and that I was being subjected to harassment.

Apparently that brought some kind of corporate heat because the next package: Ron and company actually deleted scan history from the delivery and changed the status from "by 8pm" to "delayed due to operating conditions". Like, WTF?!

That was great - but unfortunately I didn't have screensnaps to prove the deleted history. Another round of calls an emails, and this time I had a complete record when the following Monday they did it AGAIN, and marked the package as "receiving business was closed."

End Game. Now it was about the data that UPS depends on. Another round of customer support calls and emails, and for the first time in three months: I have no problems with UPS deliveries. It's been two weeks.
Posted by at No comments:

Friday, February 17, 2017

BSidesSF 2017 E-Badge: A Few Notes

A few notes about the BSidesSF e-badge.

 It was an extraordinarily fast spin. We proposed in mid-September, were surprised to get a thumbs-up in October, and hit the first technical no-go in November.

Upon reflection, what stands out from initial concept to final deliverable is sticking to the goals:
  • Get folks talking, collaborating, and sharing
  • Provide a valuable ioT learning experience
  • Create a memorable conference collectible that reflects the Mr Robot theme, and the uniquely vibrant entrepreneurial Maker infused Bay Area tech culture
  • Keep the BOM at $50 to $60
There is no way we could have delivered without sticking to agile principles. Not the programmatic duly (or dully) certified bastardization of agile, but the true intent and meaning of the word.

 We ramped up over Thanksgiving, went crunch over Christmas, balls-to-the-wall week before the conference, and pulled an all-nighter Friday that lasted through a catnap Sunday night. At that, we still didn’t have all the badges assembled in time for registration, and there are still a few outstanding.

Successful disaster 0_o
First Pivot:
The original pitch was a Raspberry Pi Zero, the adorable $5 micro-processor. Unfortunately, Raspberry Pi moved production in-house resulting in severely limited stock. To this day, it is available one per customer from a few select resellers -  if they have it in stock and have not bundled it with add-ons.

 We knocked our heads against that wall for a couple of weeks before realizing there was no way we could purchase the quantity required and, if this project was going to move forward, we had to find a different CPU.

 The NanoPi NEO Air from FriendlyArm (FriendlyElec) at first-blush looked too expensive, but then we realized the onboard wifi and bluetooth made up for the cost difference.

 We ordered a bulk shipment that slid through customs right before Chinese New Year (January 28th).

 Manufacturing and shipping stops week before Chinese New Year as workers start their annual migration back home. The full-stop lasts about 7 - 10 days which this year was February 6th. Way too late for the conference.

 Ordering components in general was nerve wracking, especially since one of us (that would be me) didn't listen to the other (REDACTED) and accept the preferred method of communication is Skype.

 Final Pivot:
We loaded the assembled badges in the car and the parts we needed to keep making, and headed over (late) Sunday morning feeling like we'd totally fucked it up.

 Instead of dodging rotten fruit, there was this group of cool people who made it easy to accept their help carrying the boxes - and then they hung out. Building through lunch, through dinner, through the parties.

 It was a spontaneous hardware hacking village! One of the most amazing experiences of my life. The wave of curiosity and enthusiasm kept us going. You know who you are. Thank you!

 What does it DO?!
We wanted to hook folks into hacking the badge.

 The initial concept was a capture-the-flag game where points are gathered based on social-ability, ioT, and hacking. For example, did you change the root password?

The badges communicated via AP with a scoreboard server. After kicking around a few locations we decided to stash the laptop and AP in a backpack for sake of mobility, not knowing the exact conference layout and best location to maximize frequency of communication with greatest number of badges.

 It worked in test mode.

We started flashing the distro to the EMMC, connected the pis - and the server completely froze after 10.

That was a bad moment. bloom ripped out 60% of his code :/

 Known Bug: If you have NO lights and a 4 char code on the display, that means the final version did not get flashed to your badge; it is running test code. We will be posting an update that you can download, but not certain when...

 The e-badge does two things:

 Blinky Lights:
The blinky lights are a row of three, 3-color LEDs that blend together for a rainbow effect through the light pipe on the case. They are so bright, that bloom dropped the output to 30%.

 Each LED was supposed to change color depending on how many flags were captured by that badge. The overall effect of the light pipe would communicate with other badge wearers and, hopefully, get folks wondering, Why are the colors on the badges different?

But you can also change the color display via tap codes picked up by the accelerometer / gyro sensor (look it up; very cool). You don’t have to bang the case. The lights will change if you set the board on a table and bang the table.

 There are six, 6-tap codes where ‘T’ is a tap and ‘^’ is a pause”

 TTT^TTT
TTT^T^T^T
T^TT^TTT
TT^TT^TT
TTTT^T^T
T^T^TT^T^T

 Known Bug: If the LEDs don't change color you need to boot the pi.

 Bluetooth Scanner:
The OLED display was intended solely for the wearer of the badge.

 When you first turn the badge on, it shows an 8 character ID. Then it changes. The e-badge scans for and displays the ID of broadcasting bluetooth devices within 10’ to 30’.

 ioT Dev Kit
We were inspiried by the FSociety’s takedown of Evil Corp via RPi (eps1.3__da3m0ns.mp4), and had initially explored deploying a PwnPi-like toolset but after becoming more familiar with the NanoPi, it just didn’t make sense.

 The NanoPi NEO Air was released in October, 0.9 square inches 40x40mm of bad-ass with a half gig of RAM, wifi, bluetooth, camera port, and USB input. The add-on cam500 module is a 5 megapixel camera that streams 30 fps directly to the cloud (somewhere, over the rainbow). The images are not stored locally. We added a wifi antenna for your hacking fun.

 We flashed the EMMC with a custom Armbian Debian distro which eliminates the additional cost of an SD card, while (somewhat) lowering the power consumption and increasing reliability.

 Root password is ‘owatagoosiam’.

 The python code is at  /usr/sbin/badge.py

 The achilles heel is power management. The NanoPi Neo Air was designed for set top boxes (TV) i.e., plugged in via USB for power. We coulda shoulda put better power management on the board to support the batteries. But by the time we figured out the power management it was too late. For this board ;-)

 The e-badge battery life is about 6 hours running on 3 AAA lithium batteries.

To power on, push the switch on the side of the case down. Off is up. Design is based on wearing the e-badge on a lanyard where the lights and faux camera lense are facing out, where other people can see them.

 The micro USB input is accessible on the bottom without cracking the case. You can plug into a computer and access via telnet or putty (or UI of choice). Battery switch should be OFF when powering via USB.

 There is one screw on the bside (uh backside) that holds the case, bracket and board. Be careful when jiggling the little OLED display into place and tucking the wires; we found a number of badges in the RMA box because the components were scraped off the display board.

 Known Bug: If the display doesn’t work, it takes the LEDs with it. The code needs to be modified to trap errors instead of crashing. We’ll be posting an update, but not certain when...

 The Case
The body worn cam, uh badge, is two snap pieces that REDACTED designed in SolidWorks and iterated on our Lulzbot printer using standard black PLA filament.

We wanted folks to experience what it’s like to try talking with people when they think a camera is recording the conversation.

 It takes about 2.5 hours to print each case and bracket. The Plan for scaling production to 175 e-badges was to build 5 - 7 silicone molds from the 3D print and pore Type 3 plastic, figuring 1 hour to turn each case. Each mold took an entire day to construct. Fortunately, REDACTED started testing after 3 molds and found the original time estimate was off by a factor of 3. There was no way we could produce enough cases one week before the conference.

 Meanwhile, he was still surface mounting PCBs and baking them in a re-flow oven because there wasn’t enough time to send out for assembly. (This process not for the faint of heart.)

 The obvious solution was to scale 3D printing. I requested quotes from about a dozen companies: large online, small independent, and medium-sized local production.

The independents were cheap, but obviously had one printer; average production time 3 - 4 weeks. The large online companies were fairly priced and could make the deadline, but there was only one-shot, and I wanted the option to tweak the files after first article. The medium-sized locals tended to be astronomically over-priced, but gave a free lecture about using injection molding (which of course they do in-house); over $4k for the mold not counting cost to produce 175 cases. One-shot, no edits.

We outsourced the job to a 3D printer company that caterers to the small run manufacturing market. Type A Machines got us back in production.

 Summary
More than once I've thought about 1o57, and been struck by the magnitude of producing THOUSANDS of badges, let alone 175. It is, and he is, awe. Inspiring.

Electronic or not, badge-making is some kinda crazy performance art.
Posted by at No comments:
Labels: , , , , , ,