I don’t want to use biometrics on my phone. There are a lot of reasons, most of them not very good for a nobody like me. Still, I like reading about OPSEC and thinking about it.

Biometrics are not revocable like a code. That may seem like a strange concern, but if, say, your fingerprint gets reproduced on the internet, there’s no way to prevent its abuse. People have 3D-printed fingers in gelatin with a captured image and gotten past phone fingerprint sensors. Many years ago when I was in the aerospace industry, we’d joke about the Russians “borrowing” your head if they wanted to get through the retina scanner at a secure facility. Again, do I have this kind of security requirements? No, but I still don’t want to use biometrics.

For the longest time, I couldn’t find the way to get Apple to honor my preference. I get a daily pop-up telling me to “finish setting up your phone.” Naturally, it pops up when I’m in the middle of a phone call and trying to do something with my calendar or something, and it gets in the way. Furthermore, it’s disrespectful. I don’t want to set up Face ID. Stop bugging me, Apple!

I used to be able to click into Preferences > Finish Setting Up Your iPhone and clicking the “Set up later…” button on each feature I didn’t want. Now there’s only an “Enable” feature. But it turns out that you can click the “Enable” and then “Cancel” when it asks for your passcode. This stops the nagging.

Apple has always thought they know best how you should be using their products. I’m finding it increasingly annoying. Why should each update turn on Apple Intelligence? I don’t want “AI” just as much as I don’t want biometrics.

I don’t want to go full Luddite, but maybe it’s time for me to start thinking more along the lines of a dumber phone.

A long PDF was to be printed, but only the text was important. As it was full of images, it seemed like removing the images would save a whole lot of ink.

It turns out ghostscript has some very nice filters for removing classes of content from a file. You can very simply remove text, images, or vector objects without changing the rest of the layout.

For example, to strip vector and images from a PDF, you can use:

gs -o text-only.pdf -sDEVICE=pdfwrite -dFILTERVECTOR -dFILTERIMAGE pdf-with-pictures.pdf

If you don’t have ghostscript installed but use Docker, there are containers that make it easy:

docker run --rm -v pwd:/app -w /app minidocks/ghostscript gs -o text-only.pdf -sDEVICE=pdfwrite -dFILTERVECTOR -dFILTERIMAGE pdf-with-pictures.pdf

The Department of Water and Power is doing work near the office, and over the weekend, there was a sustained power outage. I came in Monday to shrieking UPSes and had to power up the firewall and a few other machines. It was the normal stupid kind of stuff.

We have a few virtual servers out in “the cloud,” and we use point-to-point VPNs to make them seem local to our network. Those VPNs also needed restarting.

Through the course of the day, however, one VPN connection kept unceremoniously disconnecting. Looking at logs on the various servers was unenlightening. Everything was running normally, other than the surprise disconnects.

In the evenings, I’ve been watching the old Grenada TV/Jeremy Brett Sherlock Holmes series, so I had to apply Holmes’ deductive process. The virtual servers had experienced no changes except being disconnected, so I needed to focus on the firewall. The firewall had experienced no change, except being restarted. What could have happened?

I finally found a configuration that was incorrect (it was a netmask that was insufficiently restrictive, allowing devices not on the VPN to collide with VPN IP addresses). I fixed the netmask, and the VPN has been up and stable ever since.

But how could this be? It had been running properly literally for years. It had to be something to do with the power outage. But if that had corrupted the configuration, it wouldn’t have been a single IP netmask changing. “[W]hen you have eliminated the impossible, whatever remains, however improbable, must be the truth.” The bad configuration file could not have been in use.

The best theory is that the configuration file had been (accidentally?) modified at some point in the past, but never loaded. When the firewall was restarted, it loaded this modified configuration for the first time.

This is a WordPress site, first created in 2003. Why I created a WordPress blog site when I was involved in the CMS Made Simple project back then, I don’t recall.

I maintain a handful of other sites running on WordPress too. It was a lot of work until I discovered the wp command-line tool (thanks Beau!). I was able to lock down permissions of the WordPress directories, and have a nightly script that would update WordPress and all of the plugins to make sure I was up to date and (moderately) secure.

One of these WordPress sites I maintain is for an organization. The site has gone through a lot of evolution. I originally built it with a Perl-based system called “Scribe” that I wrote in 2002 or thereabouts. It used a markup-based templating system, CVS to maintain versions, and published static HTML from CGI scripts. Later, I was working on the CMS Made Simple project as part of the core team, so I ported this site to CMSMS. Eventually, I left the CMSMS project, and in 2017 I decided to migrate the site to WordPress (based on the fantasy that other people would join me and maintain content on the site). I was busy, and paid an overseas development firm to port the site for $300. The language barrier made the project difficult, and I ended up rewriting a substantial portion of the code.

This morning a security update resulted in one of the site’s plugins throwing fatal errors and taking the site completely offline. I eventually had to manually poke around in the database and modify JSON strings to resolve the problem (and disable the broken plugin).

I started reflecting on the overall functionality of the site and how it’s used. Maybe it’s time for me to move away from WordPress and go back to some static generating strategy. I hear good things about Jekyll. Of course, this would also probably involve a site redesign too. Ugh. Well, more to evaluate and think about.

So, computer folks always talk about the 3-2-1 strategy of backups: have three copies of your data, stored on two different types of media, with one geographically separated. They also like to repeat slogans like “if you have one backup you have no backups.”

For years, I’ve relied on Time Machine, the backup system Apple includes with their operating system. It not only provides a backup, but it keeps multiple versions of files, so if you, for example, accidentally clobbered your book manuscript by searching and replacing a badly-chosen term but didn’t notice for a week, you could go back to the version you had backed up last week. I felt like I was doing a pretty good job of securing my data: I back up onto an external drive at home, and I also back up on an external drive at the office, a little over 1km away. These external drives are encrypted, so if someone were to break into either place and swipe a drive, they’d have the hardware but not my data.

A few years ago, I also added another layer of redundancy: an encrypted cloud backup. I hadn’t liked the cloud backup services I’d seen before, because all of my files would be on someone’s machine where I had no control over them. A screw-up on the part of a system administrator somewhere could make my files available to the open internet! However, a bunch of new services started offering encrypted backups, where the encryption happens locally and the service doesn’t have view into your files other than it’s a big chunk o’ data (more on this later).

To make a long story short, I tried a few services, and went with Backblaze (disclaimer: that’s an affiliate link, I get credits if you follow it and subscribe. You can always avoid that by going directly to https://backblaze.com).

Fast forward a few years. A friend who’s not particularly computer savvy needed help with some IT stuff. They had an external hard drive connected to their machine and used Windows backup, but the process had silently failed a year before. In diagnosing and fixing this, I also convinced them to pay for and use cloud backups.

This friend lost their house and everything in it during the wildfires last week. Among the long list of things that they didn’t have time to grab before evacuating was that backup hard drive. Cloud backups to the rescue! I was able to download all their files for them.

The surprising scope of the fires also brought one thing into sharp focus: my original strategy of “one backup at home and one at the office” is really insufficient. One kilometer’s not far enough away! Having a remote backup somewhere is an important part of backup plans.

I mentioned above that encrypted cloud services like Backblaze have no visibility into your data. This is not completely true. If you use their encryption scheme, the data is encrypted on your local machine before the data is transmitted over the network. So it’s true in normal operations that there’s no way for them to see the contents. However, when you use their interface to restore files, you need to give them your encryption key so they can identify which file(s) you wish to restore. That means the data is (at least temporarily) decrypted on their servers. When I did a full restore of my friend’s files, I provided the key and they generated a zip file for me to download. That zip file was not encrypted. They say it’s on their server for only a seven days, and I don’t have any reason to distrust them.

I want my data encrypted when it’s backed up because I have financial information like account numbers, etc, that could be abused. That these could exist as clear-text on someone else’s server for short periods of time is not ideal, but it’s also a pretty minimal threat. That being said, if you are involved in journalism, political activism, or other activities where your information could impact people’s lives, this may not be the best solution.