https://falseblue.com The personal site of Ben Craton: software developer, project manager, and cybersecurity professional. Zola en Thu, 13 Jun 2024 12:09:27 -0400 Thu, 13 Jun 2024 12:09:27 -0400 Ben Craton https://falseblue.com/posts/the-robot-over-my-shoulder/ https://falseblue.com/posts/the-robot-over-my-shoulder/ <figure> <img src="cover.png" alt="Illustration of a woman working at her computer while a large robot sits directly behind her, watching" loading="lazy"> </figure> <p>In a recent announcement at Microsoft Build, the CEO told the world what everyone knew but no one wanted to say out loud: AI requires <em>your</em> data. Windows is getting a new AI assistant feature to help you remember what you were up to and search through whatever you did on your computer; this includes games you played, who you were on a call with, or what you might be interested in doing next. Sounds fantastic! The digital assistant that Silicon Valley has been dreaming of since HG Wells is finally available to the masses. And the first question on everyone’s mind was, according to numerous articles, blogs, and even my local morning radio DJs was, “Wait, how does it know all this about <em>me</em>?” followed quickly by “What the hell?” Hopefully I can help shed some light on what kind of hell this is turning out to be.</p> <h2 id="how-does-ai-work">How Does AI Work?</h2> <p>I have no insider knowledge on how Microsoft is rolling out AI into Windows, only an understanding of the fundamentals behind the technology that these tools have been built on since the initial release of ChatGPT. In general, and at a very high level, the AI works like the auto-complete in your mobile keyboard of choice. The key difference is that these AIs can “know about” more than just text; they can “see” and “learn about” sound, images, or really any kind of information that can be stored in a structured way in a computer.</p> <h3 id="how-a-robot-learns">How a Robot Learns</h3> <p>At its core, all machine learning is an exercise in trying to predict what comes next. In your mobile keyboard’s auto-complete, this is accomplished by a very simple method of prediction called a Markov-chain. Think of it as a big excel sheet with words in column A, and then in each column after that, another word and the probability that it comes after the word in column A. Now have every row be a word in the English language.</p> <p>AI training is the process where we figure out what those probabilities are. That would take a while to determine, right? You’d need to think about all the combinations that words would appear in. We could feed it all the books, newspapers, and webpages you could find. It’s daunting, but doable.</p> <div class="admonition note"> <div class="admonition-icon admonition-icon-note"></div> <div class="admonition-content"> <strong class="admonition-title">NOTE</strong> <p><strong>Key Terms</strong></p> <ul> <li>The books etc are the “Corpus” or library of source material</li> <li>The Excel sheet is an “AI model”</li> <li>The formula is an “AI Assistant”</li> </ul> </div> </div> <p>In the end, we will have our excel sheet. Since we’ve calculated all these probabilities once, we can save the sheet and use it again and again without needing a rebuild. Now we can get to the predictions and figure out a formula for “given any word, give me a word that’s likely to come next.”</p> <p>You may have noticed some major limitations with our Excel sheet example, though. We can only check what word might follow some other word. What about the case where you’ve been texting “I love” to someone and auto-complete helpfully suggests not only “you” but also “pizza,” “puppies,” or “your ex’s name”?</p> <noscript> <strong>⚠️ JavaScript is required to render the diagram.</strong> </noscript> <pre class="mermaid invertible-image"> graph TD A[I] -->|0.5| B[love]; A -->|0.4| C[want]; A -->|0.1| D[think]; B -->|0.9| E[you]; B -->|0.1| F[your ex's name]; </pre> <p><em>Simple Markov Chain</em></p> <h3 id="context-matters">Context Matters</h3> <p>Clearly, “love” has different meanings based on context and we need more than just one word to figure out the next appropriate word. But now we’re going to need an Excel sheet for every word-A, a row for every word-B, and columns for all the possibilities. Our Excel file just got massive. What about three words? 20? Ok, we’ll need a different approach.</p> <p>In step the current AI models. At their core, all of them are prediction models based on a corpus of previously assembled data that can “look back” much, much further on more than just words. They are fancier and beautiful mathematically, but the models are big sets of probabilities that one thing might follow another.</p> <p>All the investment and media coverage around how these AIs are trained is rooted in what the “things” are and what content was used to figure out those probabilities. The concerns around privacy are (rightly) rooted in whether the proprietary information you entrusted to a company is now a “probable next thing” in a stranger’s document. The fears about hallucinations and AI malpractice are the same as accidentally getting your ex’s name sent to your spouse.</p> <h3 id="enter-the-assistant">Enter the Assistant</h3> <p>The assistant, or agent, or robot, or digital therapist is the Excel formula on steroids. It can not only take in what you’ve written so far in your text, but what time you’re writing it, where you are, what apps are open, who you’re talking to, where they are or might be, the weather, the news, your temperament, and so on. This one-time snapshot is the “one-shot” colloquially. Take all that context, feed it into your formula and it gives you a likely next word (or paragraph).</p> <noscript> <strong>⚠️ JavaScript is required to render the diagram.</strong> </noscript> <pre class="mermaid invertible-image"> flowchart TB subgraph Sources A(📝 Current Text) B(🕗 Time) C(📍 Location) direction LR D(📱 Open Apps) E(👥 Contacts) F(⛅ Weather) end A & B & C & D & E & F --> G G(🧑‍💼 AI Assistant) G -->|Produces| H(💬 Next Word Prediction) </pre> <p><em>Hypothetical AI Assistant</em></p> <p>Note that we never saved that context. The model, or “excel sheet,” didn’t change. Nothing <em>has</em> to be saved to get the result we are after.</p> <p>But we could.</p> <h2 id="throwing-a-robot-out-with-the-bath-water">Throwing a Robot out with the Bath Water?</h2> <p>Hopefully, I’ve helped provide a solid basis for how these AI tools work in general. The devil, as they say, is in the details. And with so much data, it’s details all the way down.</p> <h3 id="sourcing-locally-is-usually-fine">Sourcing Locally is Usually Fine</h3> <p>As with farmers markets, the closer you get to the source, the more you know about where your data comes from and how it’s been processed. When a company like Microsoft says that “the model is on your computer,” what they mean is the Excel sheet is saved on your hard drive somewhere. When they say, “it will know about what you are doing and what you’ve been up to,” they are saying “we’re going to use things like system logs, documents, and files that already exist, plus what’s on your screen as inputs to the formula.”</p> <p><em>As stated,</em> that’s usually fine. But, what if, say, you wanted to keep the processing of all those probabilities, based on everything your computer can offer, for later? We’d probably not like our laptop battery draining every 10 minutes as it crunches numbers. That’s where things get tricky.</p> <h3 id="what-is-saved-and-how">What is Saved and How</h3> <p>To recap, we have the base model on our hard drive along with all our files provided to us by a vendor like Microsoft. We’d like to personalize it with the content that is available on our computer. So that’s what we do. We create a new “baby” model based only on the content on the machine. Then we update our assistant formula to use both the base model <em>and</em> our baby model when making personalized predictions.</p> <p>But that baby model needs to be secure. It has a probability record of <em>everything</em> on our computer. It <em>has</em> to be secure.</p> <p>Thankfully, most modern devices (and specifically ones that run Windows 11) have what’s called a TPM (trusted platform module) that uses public-key cryptography to encrypt and decrypt files like our model. This is unique to our device and <em>should</em> keep the baby model secure from all but the most determined state-sponsored hacker.</p> <noscript> <strong>⚠️ JavaScript is required to render the diagram.</strong> </noscript> <pre class="mermaid invertible-image"> %%{ init: { 'flowchart': { 'curve': 'basis', 'htmlLabels': false, } } }%% flowchart TB M -->|"`Searches`"|V V -.->|"`_Maybe also_ Provides`"| C & TPM subgraph C["`**Our Computer**`"]; AI -->|"Uses"|M & B subgraph E["🔒 Encrypted"]; B -->|"`Searches`"|D D -.->|"`'Learning'`"|B B("`🤖 'Baby' (local) Model`") D[("`💾 Our Personal Data`")] end TPM("🔐 TPM") -->|"Encrypts"|E end Me("🤓 Me") -->|"Asks"|AI V("🏢 AI Provider") -->|"Provides"| AI("🧑‍💼 AI Assistant") & M("🤖 Vendor Model") </pre> <p><em>An “ideal” AI set up</em></p> <h3 id="but-microsoft">But Microsoft</h3> <p>Here’s where the public writ large seems to bristle at the Built AI announcement, even if they aren’t sure exactly why. If I may be so bold as to speak for the layman, the issue lies with all the “yeah but“s:</p> <h4 id="yeah-but-companies-like-microsoft-and-apple-also-make-the-devices-these-things-run-on-so-how-could-we-trust-they-don-t-have-access-to-this-tpm">“Yeah, but companies like Microsoft and Apple also make the devices these things run on, so how could we trust they don’t have access to this TPM?”</h4> <p>You must trust them based on their published documentation and marketing.</p> <h4 id="yeah-but-can-t-they-just-send-the-saved-file-back-to-headquarters">“Yeah, but can’t they just send the saved file back to headquarters?”</h4> <p>They absolutely can and do. It’s usually based on the privacy policy or user agreement which is miles long and written (deliberately in too many cases) in legalese like a contract (which it is).</p> <h4 id="yeah-but-won-t-they-train-the-models-they-send-out-with-my-model">“Yeah, but won’t they train the models they send out with my model?”</h4> <p>They aren’t supposed to unless you’ve agreed to it.</p> <h4 id="yeah-but-how-did-they-train-it-to-begin-with">“Yeah, but how did they train it to begin with?”</h4> <p>Using scraped internet websites (under litigation), bulk-data sales (now illegal in California), metrics and content from their free-tiers of services (usually allowed in lieu of cash for continued use). The list goes on (and can you see a pattern)?</p> <h4 id="yeah-but-how-are-they-going-to-keep-this-base-model-updated">“Yeah, but how are they going to keep this base model updated?”</h4> <p>An excellent question. Does it need updated? If so, what’s going to feed in the future if we, the consumers, start exercising our rights to restrict that use? Won’t the models stagnate? It remains to be seen.</p> <h2 id="conclusions">Conclusions</h2> <h3 id="consumers">Consumers</h3> <p>Question the use of <em>your</em> data. Data about you, your family and loved ones is being used by these companies offering services. Some of them are taking your concerns seriously with dedicated people keeping these risks at heart while still offering great AI services, but not all of them. Maybe not even a majority of them.</p> <h3 id="founders">Founders</h3> <p>Security and privacy is a strength in selling. If early morning DJs in Indiana are talking about it, your customers are thinking about it. It is a boon to have an upfront and honest commitment to your ultimate source of income about how you use the data they entrust to you.</p> <h3 id="product-and-security-leaders">Product and Security Leaders</h3> <p>Know what you are requiring of the users to make your amazing features work and <em>why</em>. Let your users know about it in a proactive manner, not hiding it behind a labyrinth of micro-service options that change every full moon.</p> <p>As I have advised since GPT mania in 2022:</p> <blockquote> <p>You wouldn’t let your keyboard auto-complete do anything on your behalf without your oversight. Don’t let “AI.”</p> </blockquote> <hr /> <p>Editor’s note: Revised to add visualisations for clarity</p> Thu, 04 Apr 2024 20:12:09 -0400 Ben Craton https://falseblue.com/posts/qr-code-safety/ https://falseblue.com/posts/qr-code-safety/ <figure> <img src="cover.png" alt="Illustration of a person with headphones scanning a giant QR code displayed on a phone-shaped street sign" loading="lazy"> </figure> <p>A while back I was in Seattle visiting my brother. My wife and I did the normal touristy things around downtown: go up the Needle, look at the museums, gawk at The Mountain, etc. Though while riding the monorail for the second time, back through the dense urban forest, I noticed a poster for some charity or other whose call to action was a giant QR code.</p> <p>Many of us probably would pass it by without notice. Those few that found the plea for contributions and the cause worthy enough to scan a code no doubt didn’t think twice about it. After all, their phone was out anyway doing tik-toks or planking or whatever kids and bored adults do these days. But consider this. Anyone can throw up a poster in a subway or bus. Anyone can <a class="external" rel="external" href="https://goqr.me/">make a QR code</a> linking to any website. And unfortunately, anyone can lie.</p> <h2 id="what-are-qr-codes-really">What Are QR Codes Really?</h2> <p>QR codes are essentially <a class="external" rel="external" href="https://www.qrcode.com/en/about/standards.html">fancy barcodes</a> like those you’d use at the store to check out. Most product (<a class="external" rel="external" href="https://www.gs1us.org/upcs-barcodes-prefixes/guide-to-upcs">UPC</a>) codes are simply a number, which is almost always written below it for verification.</p> <figure> <img src="barcode.png" alt="barcode" loading="lazy"> <figcaption>UPC Barcode</figcaption> </figure> <p>Because a QR code is two-dimensional, it can hold more information than a <a class="external" rel="external" href="https://www.gs1us.org/upcs-barcodes-prefixes/what-is-a-gtin">number less than a hundred trillion</a>. In fact, they can hold many numbers which can be interpreted by your phone as text, wifi password, or <a class="external" rel="external" href="https://www.youtube.com/watch?v=ExwqNreocpg">even a game</a>. I’ve used them for <a class="external" rel="external" href="https://www.qr-code-generator.com/blog/qr-code-inventory-management/">inventory documentation</a> for myself.</p> <figure> <img src="qr-code.png" alt="qr code" loading="lazy"> <figcaption>QR Code</figcaption> </figure> <h2 id="should-i-quit-relying-on-them">Should I Quit Relying on Them?</h2> <p>No more than you should trust a normal link you’d click on to open a website. In fact, even less so. When was the last time you felt the urge to manually type in a web address into the url? Probably only when you had an existing problem and saw a billboard or flyer that would undeniably address that need: communicated in the very limited space available. QR codes’ <a class="external" rel="external" href="https://www.uniqode.com/blog/qr-code-insights/5-reasons-why-qr-codes-are-still-effective/">selling point</a> in marketing and communication is to lower the barrier to action or information. And without a doubt, for that, they are great!</p> <p>However, lowering a barrier isn’t an excuse to remove it entirely for convenience. While typing in a URL was tedious, it made us mindful of what we were about to interact with. While a QR code is quick and easy, we still need to pause before clicking through our camera to the address.</p> <h2 id="how-to-keep-quite-reasonably-safe">How to Keep Quite Reasonably Safe</h2> <h3 id="qualitatively-read-before-scanning">Qualitatively Read before Scanning</h3> <p>The context always matters. A QR code on the menu at your <a class="external" rel="external" href="https://www.upmenu.com/qr-code-menu/">local diner</a> probably is not malicious. It would be quite a conspiracy to forge a delicious line-up to get you onto a malware site. A billboard is often the same. The visibility and cost is way too high for a common criminal to exploit it without getting turned over by the ad agency.</p> <p>It is much simpler to attack using plain paper with a generic message in a public space. If you see QR codes on stickers, flyers, or anything the teenager in your life can purchase at Wal-Mart and print onto, perhaps give them a pass. If you see an identical sticker etc again in a completely different setting and your interest is again piqued, then it might be worth pulling out the phone for step two.</p> <p>Also glance below or around the code. If there is no alternative URL and there’s enough space that there’s no reason it <em>couldn’t</em> have been there, then someone made a choice to omit it. Question why and move on with life.</p> <h3 id="quickly-read-the-link">Quickly Read the Link</h3> <p>Your phone should preview the code’s link for you to authorize opening a browser.<sup class="footnote-reference" id="fr-1-1"><a href="#fn-1">1</a></sup> Usually the preview is tiny, showing only the first few characters of the link. Marketers and scammers alike know this and often use link shorteners so that you can see their brand (or not). You can see this with <code>yt.be</code>, <code>fb.me</code>, etc. If the link looks like it is strongly associated with the brand or organization on the material, then you can proceed to step three.</p> <p>If the QR code is using a generic link shortener such as <code>bit.ly</code>, or something that doesn’t look right, stop. Your curiosity can be satiated by typing in a url manually.</p> <h3 id="question-redirects">Question Redirects</h3> <p>If you got this far in the 0.75 seconds since you began this process, you’re jumping to a browser and the url bar is updating a few times. That’s the url “un-shortening,” so to speak. Going to <code>yt.be</code> would expand to <code>youtube.com</code> for example. That redirection causes a page refresh. One is normal. Two? Probably some kind of single-sign-on authentication and also fine. Three to five? Ok, maybe the poor developers have to use <a class="external" rel="external" href="https://www.youtube.com/watch?v=y8OnoxKotPQ">microservices</a> and that’s the price we pay. More than that? You should probably lock your phone now if you’re around others because there’s a good chance where you’re going isn’t safe for work. <sup class="footnote-reference" id="fr-2-1"><a href="#fn-2">2</a></sup></p> <p>After the page loads, double-check the url that you landed on. All mobile-browsers that I’m aware of keep the url bar displayed until you start scrolling down. Take a last glance. Does the url make sense based on that original material you read? Is it a secure connection? Is the page what you expected? If yes to all of these, carry on. If not, close the tab, silently curse the greed of others, and get on with the day.</p> <h2 id="quintessential-recap">Quintessential Recap</h2> <p>Ok, I’ll stop with the alliteration. If you take nothing else from this piece, take this: <strong>don’t let convenience blind you to risk</strong>. In those few seconds while passing a tree, the 5g cuts out, and your phone is deciding if it really can do anything without the cloud, think what you could have done as a rebellious child with this tool at your disposal; what pranks you would have pulled; and what Charles Ponzi would have attempted.</p> <blockquote> <p>URLs, information, and food are all the same. We should consider what we put into our bodies and devices respectively.</p> <p><em>- Abraham Lincoln_probably</em></p> </blockquote> <section class="footnotes"> <ol class="footnotes-list"> <li id="fn-1"> <p>If it does not, and it automatically opens for you for any QR code you point it at, check with your phone’s manufacturer’s support website on how to disable that behavior. <a href="#fr-1-1">↩</a></p> </li> <li id="fn-2"> <p>And that’s not just glib advice. Locking your phone will stop the browser from continuing down a rabbit-hole of sin and viruses until you unlock it again. I would suggest locking your phone and then immediately powering it off and restarting it. That will kill the browser. <a href="#fr-2-1">↩</a></p> </li> </ol> </section> Sat, 09 Mar 2024 00:00:00 +0000 Ben Craton https://falseblue.com/posts/self-hosting/ https://falseblue.com/posts/self-hosting/ <figure> <img src="cover.jpg" alt="A living room being slowly consumed by a homelab: glowing server racks, bundles of cable across the ceiling, and one increasingly cornered couch" loading="lazy"> </figure> <h2 id="introduction">Introduction</h2> <p>I started my tech journey back in the ’90s writing HTML by hand. Ever since I started doing tech work for money in 2006, I’ve been trying to keep abreast of the systems and machines I’ve helped maintain and manage by doing it myself in a home lab. I credit where I am today on essentially taking the same tools from work and breaking my home network, much to my wife’s chagrin.</p> <h2 id="keeping-costs-low">Keeping Costs Low</h2> <p>Even though I’ve been self-hosting since 2006, I had, until 2013, no real server in the house. I rented machines in data-centers for cheap, having known the best deals from working web-hosting support. I moved all of my hosting literally in-house for the better part of a decade. This saved tremendously on monthly hosting costs, even if the up-front cost of hardware was a little pricy.</p> <p>However, as what I worked on professionally changed in complexity, so did my home-lab and my projects. My costs were measured in time instead of dollars, and they were annoying, but manageable.</p> <h2 id="security-and-exposure">Security and Exposure</h2> <p>As my position and responsibilities grew, the less I could focus on my hobby projects in long-stretches as I had in the past. Also, the more I became a potential target for attackers. After 2020 and the shuttering of physical offices in my city, the less I liked having my work and personal devices on the same network as the hosting services (even with VLANs and VPN).</p> <p>Since my CISSP exam in January of 2024, I decided to essentially pull the plug on all non-essential hosting until I’ve had time to vet the services and get them into a self-compliant state. If you want to know the state of a service, see below.</p> <h2 id="aniki-fm">Aniki.fm</h2> <p><a href="https://falseblue.com/projects/anikifm/">Project page</a></p> <p>Status: Down</p> <h3 id="rationale">Rationale</h3> <p>Aniki was originally just a wordpress <a class="external" rel="external" href="https://blubrry.com/">blubrry</a> site. It eventually evolved into a more dynamic site that had a wordpress backend and a <a class="external" rel="external" href="https://v2.nuxt.com/">nuxt v2</a> frontend. However, I built a new version in 2020/2021, and then let the code sit for a long while. As of March 2024, the project no longer builds at all and the kubernetes infrastructure that I used to host it, while useful for keeping up with my DevOps guys, was not useful in being maintainable in the slightest (k8s is a castle of glass, in my honest opinion).</p> <h3 id="future">Future</h3> <p>Our recording is currently on hiatus for present while I, at least, get some long-term life stuff sorted out. I would like to convert the site to <a class="external" rel="external" href="https://castopod.com/en">castopod</a> or similar should we continue. Until then, recordings are available on <a class="external" rel="external" href="https://open.spotify.com/show/0CDLvxkVrQZ8xB3GpAAx9e">Spotify</a>.</p> <h2 id="magic-falseblue-com">Magic.Falseblue.com</h2> <p><a href="https://falseblue.com/projects/magic-card-generator/">Project page</a></p> <p>Status: Down</p> <h3 id="rationale-1">Rationale</h3> <p>While the magic card site started as a simple php form, it evolved to have multiple backend-services, including an AI NSFW photo filter beginning in ~2015. The site never had user-management by design.</p> <p>As of January 2024, more than 250,000 cards had been created by people all over the world.</p> <h3 id="future-1">Future</h3> <p>I doubt this will return. If you found it fun, let me know!</p> Thu, 22 Feb 2024 12:26:53 -0500 Ben Craton https://falseblue.com/posts/why-we-check/ https://falseblue.com/posts/why-we-check/ <figure> <img src="cover.jpg" alt="Two people at a desk with laptops, reviewing hand-drawn diagrams on paper" loading="lazy"> </figure> <p>What comes to mind when you hear that a security audit is underway? Nervousness? Trepidation? It would be surprising if you found the news exhilarating, but must we associate a security audit purely with negativity?</p> <p>We are all human and the fear of “being found out” is one that haunts us our whole lives. When a security audit is announced, our minds immediately go to our past failures, the mountain of work in front of us, and intimate knowledge of where we could have done better. However, the purpose of an audit is not to cast judgement or find fault, but instead to put aside that task list, discuss those mistakes, and bring weaknesses to the forefront.</p> <p>In school, exams were always a stressful time. Would you pass or would you fail? The exam was the focus and we were perhaps myopic to the real purpose of those tests: to find where your weaknesses were and train those skills further. In football, cricket, or any sport, to succeed and dominate the competition, discovering where you could improve is always the key differentiator.</p> <p>Audits are a chance for us to reflect on our progress, our strategy, and our prowess. Yes, they can bring on stress and anxiety, but if we are brave enough to face the threats and competition in the market that we do on a daily basis, we can face our opportunities for growth and maturity with the same confidence.</p> <p>Photo by <a href="https://unsplash.com/@homajob?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash">Scott Graham</a> on <a href="https://unsplash.com/photos/person-holding-pencil-near-laptop-computer-5fNmWej4tAA?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash">Unsplash</a></p> Wed, 24 Jan 2024 12:05:51 -0500 Ben Craton https://falseblue.com/posts/cirno/ https://falseblue.com/posts/cirno/ <figure> <img src="&#x2F;images&#x2F;cirno.jpg" alt="Fan art of Cirno, a small blue-haired ice fairy, looking extremely confident" loading="lazy"> <figcaption>The strongest.</figcaption> </figure> <h2 id="who-is-she">Who is She?</h2> <p>So what’s up with this image on the site? This is <a class="external" rel="external" href="https://en.touhouwiki.net/wiki/Cirno">Cirno</a> from the <a class="external" rel="external" href="https://en.wikipedia.org/wiki/Touhou_Project">Touhou</a> series of games. She is a little ice fairy you meet in several of the games who believes that she is the “strongest” despite being introduced as a mid-boss for level 1. This fan art of her by an unknown (to me) artist enchanted me when I saw it. She’s so full of confidence and so unaware of her own weakness while, in my mind’s eye, spouting off nonsense to a patronizing and exasperated audience.</p> <h2 id="but-why-your-profile-picture">But why Your Profile Picture?</h2> <p>tl;dr I do what I want.</p> <p>Back when I worked at EDS/HPE, we were required to use the enterprise equivalent of MSN Messenger. I was fresh out of college, rebellious, but not provocative. At some point we were required to have an image in the app. Being private by nature, I didn’t like the idea of the entire corporate directory knowing what I look like. Plus, it wasn’t fair to my co-workers to expose them to my visage on a daily basis.</p> <p>The corporate IT guys did the best they could with what they were given. You had to use your corporate profile image. No uploading a custom one. Oh dear, but what was this? In the settings, while profile images were greyed out, there was a field to allow for a remote image, in retrospect, probably there to facilitate subsidiary domains. Regardless, having my own server, I went about hacking together a script that not only would host my remote image, but change it on a daily basis.</p> <p>I was big into Touhou at the time. Something about the indie-dev spirit and the wildly creative fan-base with virtually no limits on creative license appealed to me. I used a bunch of character images from the games as my pool of avatars. Other than the occasional inquiry from a co-worker who found it silly, no one noticed for my entire tenure there.</p> <p>It’s since then become my thing. The Cirno image here specifically started when I was at Arxan and had to settle for one image since they used Slack. This is the one I landed on.</p> <h3 id="it-s-how-i-try-to-see-myself">It’s how I Try to See Myself</h3> <p>While I may have letters after my name and a lot of experience, I’m still one man on current-year planet earth. Since one of my hobbies is just learning for the sake of it, I’m confronted daily with things I didn’t know or was mistaken about. I like to remind myself that confidence does not equate correctness. Having that image front and center every working day helps with that.</p> <h3 id="it-s-how-i-choose-to-have-others-see-me-digitally">It’s how I Choose to Have Others See Me Digitally</h3> <p>I’m well aware that post-2020, the profile picture is often the first thing your co-workers, or even the public, see and associate with you. I’m still that private guy I was post college, even more so now with the CISSP. I put myself in the shoes of a brand-new dev who I need to ask a question: how would getting a ping from this image sit with me?</p> <p>My answer is: I would be a lot less terrified of a leader who chooses to be silly over one who chooses an image that exudes power. Let me be seen as clownish. It breaks down a wall if nothing else. And if they see me as I see me, they will take my advice as a fellow imperfect human, and treat it with their own critical eye.</p> <h2 id="but-also">But also</h2> <p>it’s funny</p> Tue, 23 Jan 2024 12:45:37 -0500 Ben Craton https://falseblue.com/posts/a-history-degree/ https://falseblue.com/posts/a-history-degree/ <figure> <img src="cover.jpg" alt="An open book whose pages glow with starlit text, before ancient temple ruins under a night sky" loading="lazy"> </figure> <p>I’ve told this story many times, but might as well put it here. I started at Purdue in the nuclear engineering program for NROTC with the intent of becoming a naval officer working on “really cool physics stuff.” I had a full ride scholarship to do so but…</p> <ul> <li>I was not prepared for the amount of outside-class work required.</li> <li>I was not prepared for the physical toll of P.T. on top of the academic load.</li> <li>I was not prepared for being taught physics and calculus by (some) professors who were not native English speakers and who were not interested in teaching.</li> <li>The commitment required for the commission was 4 years longer that I had been initially lead to believe.</li> </ul> <p>Well what do you do at the end of the first semester when you’re presented with the choice of “you can stay in the NROTC program and we’ll pay for your education, but you have to do this for 10-12 more years,” “you can decide to drop out of the NROTC program later, but then you will have to enlist after college,” or “you can drop out of the NROTC program now and pay for college yourself, with no guarantee of a job in the United States after college.” I chose the last option.</p> <p>I finished out the first year course schedule, but dropped out of NROTC and gave up the scholarship after the first semester. In the second semester I found the Purdue anime club and a sub-group called boilermaker-anime. They were the ones that re-sparked the interest in computers and programming that I had in middle school. My goal changed to getting into the computer science program and doing something along the lines of high-performance computing (beowulf clusters were the cool thing at the time).</p> <p>My second year was spent trying to convince the Purdue computer science department to let me in. It was a college transfer away from engineering so it came with a lot of red tape. I was a good boy and did as instructed, but after a year of being told “no you need more of these classes that cover material you learned while sitting on the couch in your apartment,” I was getting frustrated and running up against graduating on time and in budget.</p> <p>With two years left, I looked through the course catalog and found that a B.A. in history would only require those two more years and allow me to essentially go learn whatever I wanted in the process using required electives. So it was decided that with only a single extra semester, I could graduate on time and in budget with a degree in history. I used that time to learn about the history of science and technology, especially concerning the development of nuclear weapons and energy. Most of the electives were taken up by earth and atmospheric science and cosmology classes because you cant keep a good nerd down.</p> <p>That last semester I only had one class, so I took a job at a local outsourced-tech support company. One thing led to another and here I am.</p> Mon, 30 Oct 2023 00:00:00 +0000 Ben Craton https://falseblue.com/projects/lastchoice/ https://falseblue.com/projects/lastchoice/ <!-- TODO(ben): when the "Data Archeology" blog post publishes (content/posts/lastchoice-data-archeology/), link it from here. --> <h2 id="why-this-exists">Why This Exists</h2> <p>My dad was an early adopter. He ran his business and much of his life through <a class="external" rel="external" href="https://winworldpc.com/product/pfs-first-choice/3x">PFS: First Choice</a>, an all-in-one DOS suite from the late ’80s, and over the years its little flat-file database accumulated things worth keeping. Then his old computer finally died, and the data was stranded in <code>.FOL</code> files that nothing modern can open. The recovery options I found were either paid services or tools you’d need to already be a programmer to use.</p> <p>So: a family IT ticket, escalated to engineering.</p> <h2 id="enter-lastchoice-and-zig">Enter LastChoice (and Zig)</h2> <p><a class="external" rel="external" href="https://github.com/tsunaminoai/lastchoice">LastChoice</a> is a command-line tool that reads FirstChoice <code>.FOL</code> databases and exports them to formats that will outlive us all (SQLite, CSV, JSON). I wrote it in <a class="external" rel="external" href="https://ziglang.org">Zig</a>, partly because a binary file format parser is a great fit for a systems language, and mostly because I wanted an excuse to learn Zig properly.</p> <p>It turned out to be a good pairing. Parsing a 1980s block-structured format (128-byte blocks, records that span blocks, a schema you have to reconstruct) is exactly the kind of work where Zig’s explicit memory management keeps you honest. No garbage collector to hide behind; you know where every byte lives, which is rather the point when the bytes are your dad’s records.</p> <h2 id="what-came-of-it">What Came of It</h2> <ul> <li><strong>The data came back.</strong> Records that would have been lost are now in a SQLite file my dad’s newer software can actually use. That felt better than shipping most professional projects, if I’m honest.</li> <li><strong>It’s public.</strong> Anyone else sitting on <code>.FOL</code> files (and the retro-computing corners of the internet suggest there are more of you than you’d think) can recover their own data for free. Data archeology as a public good.</li> <li><strong>I learned Zig on a real problem</strong> instead of a tutorial, which is the only way it sticks for me. (It wasn’t the last time, and the language keeps showing up in my projects.)</li> </ul> <p>Niche? Extremely. But formats die and bytes don’t, and somebody has to keep the ferry running between them.</p> Tue, 26 Sep 2023 11:57:33 -0400 Ben Craton https://falseblue.com/bio/ https://falseblue.com/bio/ <h2 id="my-career">My Career</h2> <p>I’ve been doing this for a bit over two decades now. It started with an unhealthy interest in computers and *nix systems at Purdue (see <a href="https://falseblue.com/posts/a-history-degree/">the history degree</a> for how <em>that</em> went) and turned into an actual career almost by accident: one tech-support job during my last semester, and one thing led to another.</p> <p>Since then I’ve worked in small startups, one very large corporation, and growth-phase companies in between. I’ve done embedded systems, web applications, a state medicaid system, an encryption product, and now security compliance. The common thread is that I’ve had a seat in nearly every part of a technology company at some point (development, project management, operations, security), which mostly means I’ve collected a lot of examples of what makes projects succeed, and rather more examples of what makes them fail.</p> <p>I hold the CISSP (Certified Information Systems Security Professional), PMP (Project Management Professional), and CSM (Certified ScrumMaster). The certificates are useful shorthand, but honestly the more valuable education came from the mistakes (mine and other people’s). My approach keeps changing because I keep learning, and one of my hobbies is just learning for the sake of it.</p> <p>If you’re here to see whether we should work together, or just poking around: welcome. The <a href="https://falseblue.com/projects/">projects</a> section is the portfolio, the <a href="https://falseblue.com/posts/">blog</a> is where the stories go.</p> <h2 id="experience">Experience</h2> <h3 id="founder-principal-consultant">Founder, Principal Consultant</h3> <p><a class="external" rel="external" href="https://sc2.in">SC2</a> · Apr 2024 – Present</p> <p>I started Star City Security Consulting to bring my knowledge and experience to the small and medium-sized businesses of Lafayette. I am responsible for everything as of this writing. Our chief aim is to provide data security guidance for where you are, what you want to do, and what you have on hand.</p> <h3 id="compliance-manager">Compliance Manager</h3> <p><a class="external" rel="external" href="https://onboardmeetings.com">OnBoard</a> · Aug 2018 – Present</p> <p>I am currently working as a compliance manager at OnBoard taking our InfoSec compliance posture to the next level; maintaining compliance with SOC 2 Type 2, ISO 27001, ISO 27701, and emerging privacy regulations around the globe. I am leveraging prior technical experience for a holistic and knowledge-led approach to security compliance.</p> <ul> <li>Completed external audits of ISO 27001/27701 and SOC 2 Type 2 with zero non-conformities two years in a row</li> <li>Created GRC tracking and management solutions focused on objective risk assessment and greater non-compliance visibility</li> <li>Led business and product compliance efforts on AI, requiring rapid learning of LLMs and transformers, vendors, architecture approaches, public concern, and reinterpreting privacy regulations in light of how LLMs function.</li> <li>Instituted an organization-wide rollout of ISO 27701</li> </ul> <h3 id="scrum-master">Scrum Master</h3> <p><a class="external" rel="external" href="https://arxan.com">Arxan</a> · May 2016 – Feb 2018</p> <p>As a Scrum Master for our encryption product team, I was responsible for transitioning the team to more agile work methods, adapting to new standards and initiatives, identifying and mitigating risks, advocating for the team with internal management, and assisting the team in meeting feature goals and objectives.</p> <ul> <li>Guided team to more consistent agile development with 2 week sprints utilizing JIRA</li> <li>Assisted product owner in maintaining product and sprint backlog in accordance with product road-map</li> </ul> <h3 id="technical-functional-area-lead">Technical Functional Area Lead</h3> <p><a class="external" rel="external" href="https://hpe.com">Hewlett Packard Enterprise</a> · Feb 2008 – April 2016</p> <p>While also being a developer, I was responsible for managing the prior authorization subsystem and Atlantes subsystem of the medicaid account. I was also responsible for the coordinated efforts of a small team of developers to maintain and build onto the eligibility system as well as communicating with account management regarding improvements, problem mitigation, and policy.</p> <ul> <li>Architected the flow of data along with interfaces and standards between subsystems</li> <li>Rearchitected full letter generation engine</li> <li>Rearchitected testing environment refresh process</li> <li>Worked with client to define business rules</li> <li>Performed project management duties on behalf of PMO for the prior authorization subsystem team</li> </ul> <h2 id="education">Education</h2> <h3 id="bachelor-of-arts-in-history-of-science-and-technology">Bachelor of Arts in History of Science and Technology</h3> <p><a class="external" rel="external" href="https://purdue.edu">Purdue University</a> · 2002 – 2006</p> <p>My path through Purdue was a winding one, starting out in NROTC and Nuclear Engineering. The timing was not right for me, and I took a year of computer science in an attempt to transfer colleges. Long story short, I ended up in the History department with a minor in the history of science and technology.</p> <p>Extracurricular Activities:</p> <ul> <li>NROTC</li> <li>Pre-law Society</li> <li>Japanese Club</li> <li>Purdue Anime Club</li> </ul> <h2 id="certifications">Certifications</h2> <div class="cert-badges"> <a href="https://www.credly.com/badges/54b23151-f2cc-4f68-afab-9dd26683ae1d/public_url" title="CISSP, Certified Information Systems Security Professional"><img src="/images/cissp.png" alt="CISSP, Certified Information Systems Security Professional"></a> <a href="https://www.credly.com/badges/e6ddcb92-2826-474c-8180-fa8853e8c593/public_url" title="PMP, Project Management Professional"><img src="/images/pmp.png" alt="PMP, Project Management Professional"></a> </div> <p>Click through for the Credly verifications.</p> <h2 id="contact">Contact</h2> <p>If you have any questions or would like to work together, please feel free to reach out to me at <a href="mailto:benjamin.craton+contact@gmail.com">benjamin.craton+contact@gmail.com</a>. For sensitive requests, my GPG key fingerprint is <code>E48B 9BA1 3823 B0D8 D065 C110 7467 B453 13F5 5526</code></p> <h2 id="some-frequently-asked-questions">Some Frequently Asked Questions</h2> <h3 id="what-s-with-the-name-tsunami-no-ai">What’s with the name “Tsunami.No.Ai”?</h3> <p>In high-school (c. 2000) I was big into this new thing I’d been exposed to called “anime.” Around the time our family got our first hosted domain with our ISP, I got to choose a subdomain for myself. Having just watched the original Tenchi Muyo OVA, I wanted “tsunami” in the name. It was taken, of course, so being a romantic, I added “noai” to the end. It was a play on words, “tsunami no ai” meaning (incorrectly) “tsunami of love” in Japanese. I was a teenager, what can I say? Not too long after, I found out that the correct phrase would be “ai no tsunami” and that “tsunami no ai” would mean “love of tsunamis.” It must have been a sign of not wanting to fool with DNS records that I kept it ever since.</p> <h3 id="what-s-up-with-that-profile-picture">What’s up with that Profile Picture?</h3> <p>It’s <a href="https://falseblue.com/posts/cirno/">Cirno</a>.</p> <h3 id="a-history-degree">A History Degree?</h3> <p>Yes, <a href="https://falseblue.com/posts/a-history-degree/">a history degree</a>.</p> Tue, 26 Sep 2023 11:55:22 -0400 Ben Craton https://falseblue.com/posts/what-is-security-training-for-anyway/ https://falseblue.com/posts/what-is-security-training-for-anyway/ <figure> <img src="cover.jpg" alt="A man at a home desk smiling through a video call on his laptop" loading="lazy"> </figure> <p>You know the drill, it’s audit time, you’re scrambling to get all your ducks in a row, and then your HR department realizes that you’ve still got stragglers who haven’t completed their security training. Leaders have been emailed, reminders have been sent, and still, there are people who haven’t completed their training. You’re not alone, this is a common problem for many organizations. So what can you do about it?</p> <h2 id="the-problem-with-compelled-training">The Problem with Compelled Training</h2> <p>Most companies and employees treat security training as a box that must be checked by a certain calendar date. As security professionals, this makes us want to bang our head against a wall. We know that the training is important, but the priority that takes in each person’s head is different. For some, it’s a fire that should be extinguished immediately, for others, it’s a nuisance to be filtered out by email clients. For most, it’s somewhere in between.</p> <p>Think back to when you were in grade-school. The times you can recall being excited for homework were few and far between. Not only did you dread having extra tasks piled on you that you didn’t ask for, you don’t even know why you have to do it. What’s the point? The same applies to security training for most employees. They know why they have to complete it, but do they really know <em>why</em>?</p> <h2 id="finding-empathy-in-security">Finding Empathy in Security</h2> <p>The most compelling training, unfortunately, is the training some people get when they’ve had “information security” as a concept bleed into their personal lives.</p> <p>A friend of mine called me up one day asking for guidance. Her friend had been the victim of one those “There’s a problem with your account and you should call this number, which is definitely Microsoft” scams. She felt stupid, ashamed, and violated. In fact, she was embarrassed for having her friend call me to ask for help.</p> <p>Now in this case, everything worked out fine. She’d not given them any vital information, no private information was on her computer at the time, and her computer was able to be restored. She learned a lesson and was eager to warn others in her social circle using her experience as a cautionary tale.</p> <p>Is that a success? I’d say so. She learned a lesson, and she was eager to share it with others. She was able to empathize with the victims of these scams and wanted to help them avoid the same fate. Suddenly, she was a security advocate.</p> <h2 id="make-security-training-personal">Make Security Training Personal</h2> <p>The key to making security training effective is to make it personal, relatable, and shareable. If you can make it personal, you can make it relatable. If you can make it relatable, you can make it shareable. If you can make it shareable, you can make it stick.</p> <p>Think about your employees and how they interact with the technology you’ve provided them. They all see those tools in different ways and use them in different ways. Some may see email as simply a chat session whereas others use it to archive critical business documents. You may see a VPN as a way to access internal resources, but they may see it as a way to get around a firewall to access their favorite streaming service. To connect with your employees, you need to understand how they use the tools at their disposal.</p> <p>Let’s consider two cases where I’ve (rightly or wrongly) assumed you have a good ISMS or equivalent rolled out to your organization.</p> <h3 id="the-developer">The developer</h3> <p>The developer sees the world in terms of code. The tools they have to do the work of building more tools has given them an experience of how to break things and fix them again. Asking developers to do security training is not a problem in understanding <em>why</em>, for them it’s a problem of interest. They have other work and more interesting challenges to solve.</p> <p>To connect with the developer, connect the lessons in the training to those they can use personally. Perhaps they have side projects that they are working on and could use insight on how to apply security practices to a solo project. Perhaps they have a friend or family member who has been the victim of a scam or hack. Perhaps they have a favorite open source project that they could contribute to by adding security features.</p> <h3 id="the-salesperson">The salesperson</h3> <p>The salesperson sees the world in terms of people and connections between them. For them, the technology we put in front of them is a means to that end and nothing more. Asking a salesman about applying security to their work is like asking a sprinter to please wear a weighted vest. It’s not going to help them do their job, and it’s going to slow them down.</p> <p>To connect with the sales person, connect the lessons in the training to those they can weave into their pitch. Security is not a list of “do’s and don’ts” it is a commitment to quality in the services you provide your customers. Taking training isn’t a yearly reminder of what not to do, it’s a reminder of the trust your customers have put in you to keep them safe. And it’s a reminder that they can use to show their customers that they are committed to that trust.</p> <h2 id="conclusion">Conclusion</h2> <p>Security training is a necessary part of life. You have an opportunity to make it a positive part of your employees’ lives and empower them as people first, employees second. It might sound cheesy, but those are the facts. If you can make security training personal, relatable, and shareable not only will you have checked all your GRC boxes, you’ll have a workforce that evangelizes on your behalf.</p> Tue, 30 May 2023 00:00:00 +0000 Ben Craton https://falseblue.com/projects/ai-compliance/ https://falseblue.com/projects/ai-compliance/ <p>When ChatGPT dropped in November 2022, my phone started ringing. Not literally, but everyone at work suddenly wanted to know what this thing was, whether we could use it, and whether we were allowed to. As the compliance guy, “are we allowed to” was my desk.</p> <p>The honest answer at the time was “nobody knows yet,” which is not an answer you can put in a policy. So I went and learned how the things actually work.</p> <h2 id="doing-the-homework">Doing the Homework</h2> <p>Regulation always lags technology, and LLMs were lapping it. Rather than wait for a framework to be handed down, I dug into the architecture of transformer models (what they actually do with the data you feed them, where that data goes, and where the compliance landmines were likely to be). That turned into a compliance overview written for <em>our</em> business specifically, not a generic think-piece. (Some of that thinking eventually became a blog post: <a href="https://falseblue.com/posts/the-robot-over-my-shoulder/">The Robot Over My Shoulder</a>.)</p> <h2 id="the-onboard-ai-assistant-beta">The OnBoard AI Assistant Beta</h2> <p>By March 2023 that homework paid off: I led the compliance side of the OnBoard AI Assistant beta rollout. The goal was to have privacy and security in the design conversation from day one, instead of the traditional approach where security reviews the finished thing and everyone gets mad at each other.</p> <p>A surprising amount of the job was translation. “Context window,” “fine-tuning,” and “vendor model training rights” mean nothing to a business stakeholder until you convert them into “here’s what happens to the customer’s data and here’s what we’re promising.” Once people understood the mechanics, they made good decisions on their own.</p> <h2 id="an-ai-policy-before-it-was-cool">An AI Policy Before It Was Cool</h2> <p>By June 2023 I had drafted and rolled out an organization-wide generative AI tool policy (at a time when most companies’ policy was a shrug). It covered data privacy, acceptable use, security requirements, and how existing law applied to the new toys. Nothing exotic; just written down, agreed to, and enforceable, which put us well ahead of the curve.</p> <h2 id="what-came-of-it">What Came of It</h2> <p>We got to say “yes, and here’s how” instead of “no”, which is the whole job, really. The company adopted generative AI with guardrails already in place, the auditors had something to point at, and I got a crash course in a technology that clearly wasn’t going away. I’d rather write the policy before the incident than after it.</p> Sun, 26 Jul 2020 12:43:39 -0400 Ben Craton https://falseblue.com/projects/anikifm/ https://falseblue.com/projects/anikifm/ <h2 id="about-aniki-fm">About Aniki.fm</h2> <div class="admonition note"> <div class="admonition-icon admonition-icon-note"></div> <div class="admonition-content"> <strong class="admonition-title">NOTE</strong> <p>If you’re wonder where the site is: see <a href="https://falseblue.com/posts/self-hosting/#aniki-fm">this post</a>.</p> </div> </div> <p>Aniki is a podcast about anime with two brothers, bringing the passion about their hobby to the world. It is a weekly project with set delivery dates and workflows which involve scheduling, sound production, research, and social marketing. It is currently a nonprofit project. Three seasons and over 50 episodes have been produced.</p> <p>In addition to producing the podcast, I rewrote the front end of the podcast’s website to run nuxt with a headless Wordpress backend running on kubernetes. In doing so, I learned about streaming (as a custom audio player was implemented into the site) and how to implement vuex stores for reduced API traffic.</p> <h2 id="the-podcast">The Podcast</h2> <h3 id="design-work">Design Work</h3> <p>I designed the logo and branding for the podcast, as well as the website. The website was designed to be a simple, clean, and easy to navigate site that would be easy to maintain and update. The logo was designed to be simple and recognizable, and the branding was designed to be consistent across all platforms.</p> <h3 id="season-designs">Season Designs</h3> <p>For each season, I designed a new logo and branding to match the theme of the season. This included creating a new color scheme, logo, and website design.</p> <figure> <img src="season_1_banner.jpg" alt="Season 1 Banner" loading="lazy"> <figcaption>Season 1 Banner</figcaption> </figure> <figure> <img src="season_2_cover.jpg" alt="Season 2 Cover" loading="lazy"> <figcaption>Season 2 Cover</figcaption> </figure> <figure> <img src="season_3_banner.jpg" alt="Season 3 Banner" loading="lazy"> <figcaption>Season 3 Banner</figcaption> </figure> <figure> <img src="season_4_banner.jpg" alt="Season 4 Banner" loading="lazy"> <figcaption>Season 4 Banner</figcaption> </figure> <figure> <img src="cover.jpg" alt="Season 5 Banner" loading="lazy"> <figcaption>Season 5 Banner</figcaption> </figure> <h3 id="sound-production">Sound Production</h3> <p>Using Adobe Audition, I have been responsible for the all of the sound production for the podcast. This includes editing the audio, adding sound effects, and mixing the audio to create a professional sounding podcast, at least to my ears.</p> <h3 id="interactivity">Interactivity</h3> <p>For our seasonal preview episodes, I created a web app that allowed users to follow along with the episode and see the images and videos we were discussing. This was done using Vue.js and the Vuetify framework.</p> <h3 id="social-media">Social Media</h3> <p>I have been responsible for the social media presence of the podcast, including creating and maintaining the Twitter, Facebook, and Instagram accounts. I utilized Hootsuite to schedule posts and track engagement.</p> <h3 id="analytics">Analytics</h3> <p>Before Castopod and other podcast analytics tools were available, I created a custom analytics dashboard using a webhook from the podcast backend and a custom database with a front end built in Vue.js. This allowed us to track our listener numbers and engagement directly without relying on third party tools.</p> <h3 id="videos">Videos</h3> <p>For the seasonal podcast preview episodes, I created a video version of the podcast that included the images and videos we were discussing. Since we already had the timing information for the interactive episode page, I was able to use that to script a python program to automatically create the video with the correct timing and images. To a point. I still had to manually adjust the timing and add labels and transitions directly in Adobe Premiere.</p> <h2 id="equipment-used">Equipment Used</h2> <ul> <li>Electro-Voice RE20 Microphone</li> <li>Rode Procaster USB Microphone</li> <li>Focusrite Scarlett 2i2 Audio Interface</li> <li>dbx 286s Microphone Preamp</li> </ul> <h2 id="technologies-used">Technologies Used</h2> <ul> <li>Nuxt</li> <li>Vue.js</li> <li>Vuetify</li> <li>Wordpress</li> <li>Kubernetes</li> <li>Hootsuite</li> <li>Adobe Audition</li> <li>Adobe Premiere</li> <li>Adobe Illustrator</li> </ul> Thu, 01 Jun 2017 00:00:00 +0000 Ben Craton https://falseblue.com/projects/magic-card-generator/ https://falseblue.com/projects/magic-card-generator/ <div class="admonition note"> <div class="admonition-icon admonition-icon-note"></div> <div class="admonition-content"> <strong class="admonition-title">NOTE</strong> <p>If you’re wonder where the site is: see <a href="https://falseblue.com/posts/self-hosting/#magic-falseblue-com">this post</a>.</p> </div> </div> <h2 id="introduction">Introduction</h2> <p>I like Magic: The Gathering and I like programming, so in 2017 I built a web page that let people make their own Magic cards: upload some art, fill in the card attributes, get a card. That’s it. That was the whole idea. It then proceeded to eat nearly a decade of my hobby time, one rewrite at a time, and by January 2024, strangers on the internet had made <strong>over 250,000 cards</strong> with it.</p> <p>The honest framing: every version of this site was an excuse to learn whatever I’d just been exposed to at work.</p> <h2 id="version-1-php-like-an-honest-man">Version 1: PHP, Like an Honest Man</h2> <p>A basic PHP form and an image generator. Users typed in card text, the server composited it onto a card frame. It taught me web development fundamentals the traditional way: by breaking a live site repeatedly.</p> <h2 id="version-2-the-learning-platform-era">Version 2: The Learning Platform Era</h2> <p>When I came back to it, I rebuilt it as an excuse to learn the “grown-up” stack of the mid-2010s:</p> <ul> <li><strong>Python 3 &amp; Django</strong> for the backend</li> <li><strong>Neural networks &amp; image recognition</strong> for automated analysis of uploaded card art</li> <li><strong>Bitbucket, Jenkins, Docker, Rancher</strong> (a real CI/CD pipeline for a silly card site)</li> </ul> <p>The unglamorous lesson came from migrating 250k existing images and their data to a new format. Nothing teaches you respect for data integrity like the possibility of destroying a quarter-million pieces of other people’s art with one bad script.</p> <h2 id="version-3-peak-complexity">Version 3: Peak Complexity</h2> <p>Version 3 adopted whatever my DevOps colleagues were excited about that year:</p> <ul> <li><strong>Vue.js</strong> frontend, <strong>Node.js &amp; MongoDB</strong> backend, <strong>Redis</strong> caching</li> <li><strong>An AI NSFW filter</strong> (because the site had no accounts by design, and anonymous internet users plus an image uploader is exactly the moderation problem you think it is)</li> <li><strong>Docker &amp; Kubernetes</strong> for orchestration, <strong>Azure DevOps Pipelines</strong> for deployment</li> </ul> <p>Yes, this is an absurd amount of infrastructure for a card generator. That was partly the point: I got to make my architecture mistakes on my own time instead of my employer’s.</p> <h2 id="where-it-stands">Where It Stands</h2> <p>The site is down (see <a href="https://falseblue.com/posts/self-hosting/#magic-falseblue-com">the self-hosting update</a> for why), and I doubt it’s coming back. But a quarter-million cards is a quarter-million small moments of someone making a thing and grinning at it, and every skill this project taught me got used professionally within a year or two of learning it. Not bad for a hobby project that started as one PHP file.</p> Fri, 03 Mar 2017 00:00:00 +0000 Ben Craton https://falseblue.com/projects/base-emoji/ https://falseblue.com/projects/base-emoji/ <!-- TODO(ben): when the "Signing Tweets with Emoji" blog post publishes (content/posts/base-emoji-signatures/), link it from here. --> <h2 id="what-is-it">What is it?</h2> <p>A silly project to learn unicode, <a class="external" rel="external" href="https://github.com/tsunaminoai/baseEmoji">baseEmoji</a> is a base1024 encoding scheme that uses emoji as its lookup table. The primary purpose is to represent otherwise ugly data in more “pleasing” form in social media.</p> <h2 id="use-case">Use Case</h2> <p>The impetus for this module was to represent digital signatures in social media in a less obtrusive way. A signature on a tweet from a user to a bot is useful in alerting the bot to run commands that can be trusted to have come from a specific source. However, these signatures look like jibberish to human readers. Instead, this signature could be represented by emoji using baseEmoji and appear to a human reader like a typical Instagram user.</p> <h3 id="practical-example-signing-a-tweet">“Practical” Example: Signing a Tweet</h3> <h4 id="signing">Signing</h4> <pre class="giallo z-code"><code data-lang="python"><span class="giallo-l"></span> <span class="giallo-l"><span class="z-keyword">import</span><span class="z-source"> sys</span></span> <span class="giallo-l"><span class="z-keyword">import</span><span class="z-source"> tweepy</span></span> <span class="giallo-l"><span class="z-keyword">import</span><span class="z-source"> baseEmoji</span></span> <span class="giallo-l"><span class="z-keyword">from</span><span class="z-source"> ecdsa</span><span class="z-keyword"> import</span><span class="z-source"> SigningKey</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-source">CONSUMER_KEY</span><span class="z-keyword z-operator"> =</span><span class="z-punctuation z-definition z-string z-string"> &#39;********&#39;</span></span> <span class="giallo-l"><span class="z-source">CONSUMER_SECRET</span><span class="z-keyword z-operator"> =</span><span class="z-punctuation z-definition z-string z-string"> &#39;********&#39;</span></span> <span class="giallo-l"><span class="z-source">ACCESS_KEY</span><span class="z-keyword z-operator"> =</span><span class="z-punctuation z-definition z-string z-string"> &#39;********&#39;</span></span> <span class="giallo-l"><span class="z-source">ACCESS_SECRET</span><span class="z-keyword z-operator"> =</span><span class="z-punctuation z-definition z-string z-string"> &#39;********&#39;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#set up tweepy and connect to Twitter</span></span> <span class="giallo-l"><span class="z-source">auth</span><span class="z-keyword z-operator"> =</span><span class="z-source"> tweepy</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">OAuthHandler</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">CONSUMER_KEY</span><span class="z-punctuation">,</span><span class="z-meta z-function-call z-arguments z-python"> CONSUMER_SECRET</span><span class="z-punctuation">)</span></span> <span class="giallo-l"><span class="z-source">auth</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">set_access_token</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">ACCESS_KEY</span><span class="z-punctuation">,</span><span class="z-meta z-function-call z-arguments z-python"> ACCESS_SECRET</span><span class="z-punctuation">)</span></span> <span class="giallo-l"><span class="z-source">api</span><span class="z-keyword z-operator"> =</span><span class="z-source"> tweepy</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">API</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">auth</span><span class="z-punctuation">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#create a signing key. In practice this would be saved</span></span> <span class="giallo-l"><span class="z-source">signKey</span><span class="z-keyword z-operator"> =</span><span class="z-source"> SigningKey</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">generate</span><span class="z-punctuation">()</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#our message</span></span> <span class="giallo-l"><span class="z-source">message</span><span class="z-keyword z-operator"> =</span><span class="z-punctuation z-definition z-string z-string"> &quot;This tweet is signed&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#sign the message</span></span> <span class="giallo-l"><span class="z-source">signature</span><span class="z-keyword z-operator"> =</span><span class="z-source"> signKey</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">sign</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">message</span><span class="z-punctuation">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#convert the signature into an emoji signature</span></span> <span class="giallo-l"><span class="z-source">emSig</span><span class="z-keyword z-operator"> =</span><span class="z-source"> baseEmoji</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">encodeStr</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">signature</span><span class="z-punctuation">,</span><span class="z-punctuation z-definition z-string">&quot; &quot;</span><span class="z-punctuation">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#create the tweet with a delimiter for later parsing</span></span> <span class="giallo-l"><span class="z-source">tweet</span><span class="z-keyword z-operator"> =</span><span class="z-source"> message</span><span class="z-keyword z-operator"> +</span><span class="z-punctuation z-definition z-string z-string"> &quot; #blessed &quot;</span><span class="z-keyword z-operator"> +</span><span class="z-source"> emSig</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#send the tweet</span></span> <span class="giallo-l"><span class="z-source">t</span><span class="z-keyword z-operator"> =</span><span class="z-source"> api</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">update_status</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">tweet</span><span class="z-punctuation">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#...</span></span></code></pre><h4 id="viewing">Viewing</h4> <p><img src="https://falseblue.com/projects/base-emoji/tweet.png" alt="Tweet" loading="lazy" decoding="async" /></p> <h4 id="">Verifying</h4> <pre class="giallo z-code"><code data-lang="python"><span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#...</span></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#get the verification key</span></span> <span class="giallo-l"><span class="z-source">verifyKey</span><span class="z-keyword z-operator"> =</span><span class="z-source"> signKey</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">get_verifying_key</span><span class="z-punctuation">()</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#retrieve a tweet (in this case the tweet we just sent)</span></span> <span class="giallo-l"><span class="z-source">v</span><span class="z-keyword z-operator"> =</span><span class="z-source"> api</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">get_status</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">t</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-arguments z-python">id</span><span class="z-punctuation">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#split the text of the tweet into the message and the signature</span></span> <span class="giallo-l"><span class="z-punctuation">(</span><span class="z-source">rmessage</span><span class="z-punctuation">,</span><span class="z-source">remSig</span><span class="z-punctuation">)</span><span class="z-keyword z-operator"> =</span><span class="z-source"> v</span><span class="z-punctuation">.</span><span class="z-source">text</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">split</span><span class="z-punctuation">(</span><span class="z-punctuation z-definition z-string z-string">&quot; #blessed &quot;</span><span class="z-punctuation">,</span><span class="z-constant z-numeric">1</span><span class="z-punctuation">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#convert the emoji signature back to its original form</span></span> <span class="giallo-l"><span class="z-source">rsignature</span><span class="z-keyword z-operator"> =</span><span class="z-source"> baseEmoji</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">decodeStr</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">remSig</span><span class="z-punctuation">,</span><span class="z-punctuation z-definition z-string">&quot; &quot;</span><span class="z-punctuation">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-punctuation z-definition z-comment z-comment">#verify that the signature is valid for the message</span></span> <span class="giallo-l"><span class="z-keyword z-control z-flow z-python">assert</span><span class="z-source"> verifyKey</span><span class="z-punctuation">.</span><span class="z-meta z-function-call z-python">verify</span><span class="z-punctuation">(</span><span class="z-meta z-function-call z-arguments z-python">rsignature</span><span class="z-punctuation">,</span><span class="z-meta z-function-call z-arguments z-python"> rmessage</span><span class="z-punctuation">)</span></span></code></pre> <p>In the wild, it may be advantageous to use a smaller digital signature algorithm and to also check that the length of the message plus the delimiter and signature don’t go beyond 140 characters. While the signature itself can be a fixed size of bytes, because some emoji require more than one code point, the emoji signature could be a few characters longer according to Twitter’s counting.</p>