It's a cop-out if you say "laziness" as if it explains anything. That's like the police finding a crime scene and concluding that the gun killed the man, and then packing up their things and going home.

We need to figure out why people are lazy and check if we can address it. Maybe we're making it too difficult?

Here's an example: Backups. Even I didn't have a good backup regime until Apple came up with Time Machine. It's just too much stupid work. But someone sat his ass down and asked the right question. And that's not "why are these fuckers so fucking lazy?", but "how can we make it easier for the users?".

That exactly is the point. If people see our work as an obstacle - maybe every once in a while we should climb down from our high horse and admit that they could be right?

Messaging apps are driven purely by networks. If all your friends switched to Threema, you'd do it too. If nobody does it, you're unlikely to be the first. Security doesn't matter enough to lose contact with all your friends.

That's not been true for a decade. Due to overloading (i.e. multiple organisations, same name), the Foobar Inc you are looking for could be at foobar.com - but it could also be at foobar-inc.com or foobarinc.com or foobar-newyork.com or foooobar.com or whatever domain name was still available when they finally went on the Internet.

It highlights a problem with the DNS system since ICANN took over.

We used to have a logical, hierarchical system. Any company would be under .com and any university under .edu -- then it broke apart and you would find anything under .com and anyone who couldn't get the .com name under .org, .net or whatever.

Then ICANN came along and greed won. Now you'll find anyone under anything, provided they paid for it. The TLD part has become entirely meaningless as it does not convey meaning anymore. ".dev" does not actually mean anything. You might think it means something if you associate those three letters with a meaning, but actually it only means "owned by Google".

We should just ditch the .tld entirely and that's it.

Sarcasm aside, professionals use the right tool for a job. Not necessarily the most complex or expensive or technical. A professional knows when to use the combo-hyper-pro-magic-machine as well as when to take a hammer or a screwdriver.

URLs have a reason to exist, and they will. The same way that IPs have a reason to exist and will, even though we rarely use them today. But 10 years ago, I knew the IPs of all my servers by heart. Today I need them rarely, but sometimes I do and I know where to find them. Today I know all my domains by heart. Maybe in 10 years I will use them rarely, but when I do, I know how to do it.

If you have the long laundry list of crimes that Kimble has, and everyone with any interest in the subject is wondering how you're still not in jail, then yes, that is the proper approach.

Don't get me wrong, in a court of law, I'm all for the innocence assumption. But outside, in the real world, when you're dealing with a career criminal then for your own safety you should assume that he's not suddenly turned into a little angel just because you are such a sweety to him.

Three years ago, I tried to start something called the Human Security Initiative. Not by accident acrynomically close to Human Computer Interfaces.

This is desperately needed. We need to sit our asses and oh-so-smart brains down, get some designers and psychologist into the room, and talk about how to properly design security, not just engineer it.

I know. I've tried my own hand on this topic, to no avail. It's really hard.

And yes, entering your password once is a very big progress.

If you have to, or really, really want to, you will learn to use the worst tool in the history of mankind. But we should think about people who have no such drive.

That's a cop-out. Another cheap excuse. You're blaming the user and stopping there. Let me help you with some cognitive dissonance: The same users that you call "lazy" spend an hour a day clicking on a screen to plant FarmVille crops. The most useless and boring activity ever invented. If Zynga can get them to click on some pixels repeatedly, twenty times a day, why can't we get them to click on a button once?

There's your problem right there. Once we grow three brain cells and understand that corporations are not people, and while they deserve rights, they don't deserve the same rights. I'm not even saying higher or lower, just saying there's a fucking difference, acknowledge it!

I'm not saying users are completely blameless littel angels. But I'm so sick and tired of this reflex of blaming everything on stupid users.

Some comedian said it very nicely about another topic: When a house burns down, and the firefighters put out the flames, they don't just go home and write a report saying "fire destroyed the house". They go in and sift through the debris and try to figure out what caused the fire.

In IT we largely don't do that. We treat users as mystical black boxes and root causes and once we've found the user somewhere in the chain of causality, we stop. We don't ask ourselves why the user made this mistake or why the users don't seem to want security. We say "stupidity" the same way ancient map makers put "here be dragons" on their maps.

And that, I say, is stupid. We should go in there and figure out what actually is in that white spot. Why did the user make this mistake? Why do they fall for phishing? Why do they want speed over security? And a boilerplate "because they're stupid" is not an acceptable answer.

We're so smart (or so we think), but we can't figure out how to make security desirable, unobtrusive and a positive experience. Really?

cheap excuse

Then make it not necessary to type in a password. Even I don't understand why I should type a password for every mail I send.

No, it's not. It might be technically the best tool, but if it's unusable, then in sum total, it's not. There are many factors that go into these equations, and we techies are sometimes blind to some of them.

But it's so easy to make a good estimate, takes less than 10 seconds:

Take your instinctive estimate.
Double it.
Increase units by one (if you think "hours", make it days. If you think "weeks" make it months, etc.)

So if you think it'll take 2-3 days, tell your manager it'll be ready in 4-6 weeks. Don't forget that in management school, they teach these fuckers to under-promise and over-deliver. He understands.

The psychological issue is that you don't know, but you have a hunch, you have some insight. You know it's probably going to be a few hours.

But for non-techies, all this stuff is a total blackbox. When you say "I don't know" they panic, because for them that means anything from a day to a month or maybe infinity. Uncertainty is a horrible psychological state and people try to avoid it. It's an instinct. When you don't know if that shadow is a monkey or a lion, it's better to panic just in case.

By saying "three days", you give him certainty. Now he knows the shadow isn't a lion.

Test equipment is allowed to transmit and receive on those frequencies. If it looks like a radio, it can't. I have a number of cellular testers hanging around here that can act like base stations, mostly because I buy them used as spectrum analyzers and never use the (obsolete) cellular facilities. Government has different rules regarding what it can and can't do in the name of law enforcement, although FCC has been very reluctant to allow them to use cellular jammers.

If you can afford it, something from Ettus would better suit your application.

We think after we build this new PCB we can go for the croudfunded manufacturing run. It's mostly surface-mount, and we expect to sell assembled boards in this run, and then the next version will be fully-packaged radios.

Hi AC,

Matt Ettus has a story about a Chinese cloner of the USRP. The guy tells Chinese customers that it is illegal for them to buy from Ettus, they must buy from the cloner instead. Then, when they have problems and require serivce, he tells them to get it from Ettus. Who of course made nothing from their device sales and can not afford to service them.

This is not following the rules of Open anything. It's counterfeiting.

So, sometimes it is necessary to change the license a little so that you will not be a chump. I discussed the fact that the hardware is fully disclosed but not Open Hardware licensed with RMS, the software is 100% Free Software, and there is a regulatory chip you can't write. We can go for Respects Your Freedom certification that way..

I've paid my dues as far as "Open" is concerned, and Chris has too. This is all we can give you this time.