Bottle Deposits, i.e. a government-mandated deposit placed on disposable drinks containers refundable upon return to the place of purchase, are a popular environmentalist policy worldwide. The aim of such a policy is generally to reduce the polluting impact of littered drinks containers while simultaneously increasing the recycling rate of the same.

<p>Bottle Deposits, i.e. a government-mandated deposit placed on disposable drinks containers refundable upon return to the place of purchase, are a popular environmentalist policy worldwide. The aim of such a policy is generally to reduce the polluting impact of littered drinks containers while simultaneously increasing the recycling rate of the same.</p> <p>Bottle Deposits are universally bad policy, imposing outweight costs on society while barely helping the problems they are intended to. This occurs notwithstanding the purported success of a deposit policy in terms of return rate.</p> <h2 id="simulation">Simulation</h2> <p>A simple economic analysis of a bottle deposit system gives the cost to society per bottle that is no longer littered as approximately £10.</p> <p>Let’s construct a simple system where our hypothetical country of 1 million people proposes a bottle deposit system:</p> <ul> <li>There will be a 20p deposit levied on all sealed, disposable drinks containers.</li> <li>This will be collected by local beverage distributors, and passed on by retailers.</li> <li>Containers can be returned to the point of purchase (or other participating location) for a full refund of the deposit.</li> <li>Retailers are responsible for disposing of the collected container and can claim funds back from the government for refunds issued, as well as 5p per bottle for disposal and administration.</li> <li>Any shortfall (or surplus) is covered by (returned to) the general fund of the government.</li> </ul> <p>Making the following realistic assumptions:</p> <ul> <li>Each citizen uses 300 bottles per year, for a total of 300 million bottles.</li> <li>7.5% of all drinks containers were littered before the deposit.</li> <li>90% of issued containers are returned for a refund once the system is operational.</li> <li>There is an average wage of £30.</li> <li>Property rental costs are £200 per square meter per year for homes, and £1000 for shops.</li> <li>80% of bottles are returned using reverse vending machines and 20% manually by an attendant.</li> <li>RVMs cost £4000 per year to rent, service and empty, can process 150000 bottles each. and take up 2 square meters of floor space.</li> <li>It takes an cashier 10 seconds to process the return of a bottle.</li> <li>People store their bottles at home prior to return. This takes up 0.1 square meters.</li> <li>It takes 30 seconds per bottle in overhead to sort, collect and transport for consumers.</li> </ul> <h3 id="costs">Costs</h3> <p>Now we can calculate the costs. The direct cost to the government is simple, calculated as the costs of administration less the unreturned surplus:</p> <ul> <li>300000000 * 0.9 * 5p - 300000000 * (1 - 0.9) * 20p = £7,500,000</li> </ul> <p>Costs to consumers are more challenging: as well as direct losses from unreturned bottles, one must also account for sorting, storage, transportation and return overheads. Transportation costs can be ignored as return is always combined with a trip to buy more bottles.</p> <ul> <li>Unreturned bottle cost: 300000000 * (1 - 0.9) * 20p = £6,000,000</li> <li>Storage cost: 1000000 * 0.1 * £200 = £20,000,000</li> <li>Administration time: 300000000 * 0.9 * 0.5/60 * £30 = £67,500,000</li> <li>Total cost to consumers: £6,000,000 + £20,000,000 + £67,500,000 = £93,500,000</li> <li>Total cost to an individual consumer = £93.50</li> </ul> <p>It is tempting to ignore costs to retailers as costs are subsidised by the administration fee. However, as retailers legally must collect bottles, and the fee has not necessarily been set correctly, their costs must be considered anyway.</p> <ul> <li>Human time for bottle redemption: 300000000 * 0.9 * 0.2 * 10/60^2 * £30 = £4,500,000</li> <li>RVM Costs: 0.9 * 0.8 * 300000000 / 200000 * (£4000 + 2 * £1000) = £8,640,000</li> <li>Administration remittance: 300000000 * 0.9 * 5p = £13,500,000</li> <li>Ignoring accounting costs, there is a small residual benefit of £360,000 to retailers.</li> </ul> <p>The total net costs of the proposed system would therefore be: £93,500,000 + £7,500,000 - £360,000 = £100,640,000, or £100.64 per citizen. It is notable that at 33.5p per bottle, this is much higher than the bottle deposit itself!</p> <h3 id="benefits">Benefits</h3> <p>Marginal benefits from recycling can be assumed to be zero, as the market for recyclate in developed countries is saturated, with negligible residual value. Excess sorted waste is dumped, stockpiled or exported for disposal by countries with lower standards. In fact, since consumers of recycled material are subsidised both by the market (consumer demand for recycling) and governments, encouraging additional recyclate collection may in fact be a net negative for society - even if it appears to be economically neutral.</p> <p>Higher value recycling may be possible with additional regulation - for instance standardisation of bottle shape and adoption of refillable bottles. However, this is not economically viable, and therefore countries like Germany that formerly reused the majority of its bottles now prefer to crush and recycle: the economic and environmental costs of collection, transport and cleaning exceed the benefits.</p> <p>Nevertheless, bottle deposits may still have benefits in reducing litter. Although drinks containers are only one component of litter, they are a significant component.</p> <p>It does not follow, though, that a 90% return rate reduces litter by 90%. Littering is a crime of convenience and does not occur when beverages are consumed at home - it will always be easier to put the container in a bin than to throw it on the ground outside. If 60% of drinks are consumed at home where their containers will always be returned, the remaining 40% of drinks consumed away from home can still be littered at a 25% rate and 90% return will be maintained overall.</p> <p>If we assume the bottle deposit reduces container litter by 50%: 7.5% of bottles were littered before the policy, and 3.75% would be after. That’s 11,250,000 less pieces of litter on the street than before the policy. That sounds like a win until you realise that the bottle deposit policy costs more than £100,000,000.</p> <p>That means our hypothetical society will be paying £9 per bottle to clean up litter! Even if you assume the complete elimination of littering, the cost per bottle only reduces to £4.50, which is plainly ridiculous. For £4.50 of a litter picker’s time, far more can be achieved than collecting a single bottle.</p> <p>If you want to have a go with your own simulation, <a href="/blog/images/2021/bottle-deposits.ods">download my spreadsheet</a> and have a go.</p>

hCaptcha is a reCAPTCHA clone that has been growing in popularity over 2020 and 2021, in particular due to Cloudflare’s conversion of their nag screens from Google’s reCAPTCHA to hCaptcha. Although hCaptcha advertises itself as being a privacy-conscious alternative to reCAPTCHA, there’s also an incentive for websites to switch over: hCaptcha will pay websites each time one of their users completes a hCaptcha challenge.

<p>hCaptcha is a reCAPTCHA clone that has been growing in popularity over 2020 and 2021, in particular due to Cloudflare’s conversion of their nag screens from Google’s reCAPTCHA to hCaptcha. Although hCaptcha advertises itself as being a privacy-conscious alternative to reCAPTCHA, there’s also an incentive for websites to switch over: hCaptcha will pay websites each time one of their users completes a hCaptcha challenge.</p> <p>Now the question is: how does you completing a captcha earn anyone money? Of course, hCaptcha is a VC-funded business, so it can afford to burn money in the pursuit of market share; nonetheless there needs to be a plausible business model there, and it’s not obvious at first sight.</p> <p>If you read the <a href="https://www.hcaptcha.com">hCaptcha website</a>, they suggest that AI startups will pay them to label their images for them. <sup id="fnref:1" role="doc-noteref"><a href="#fn:1" class="footnote" rel="footnote">1</a></sup> Labelling images is a labour-intensive task and required for some current-generation machine learning approaches. AI startups are well-funded and have money to spend on labelling, so this sounds like a reasonable case of selling shovels during a gold rush. But the output from solving CAPTCHAs isn’t obviously isomorphic to the type of labelling required for machine learning, which is often quite specific and requires a very low error rate.</p> <p>Complex CAPTCHA challenges are not possible, as web users turn out to be drunk, blind, 3 years old, or just randomly clicking buttons to get this infernal thing to go away. Accordingly, hCaptcha challenges are simple: select the images that match a simple 1-3 word prompt from a 3x3 grid. This is fortunately easy for most real people. <sup id="fnref:2" role="doc-noteref"><a href="#fn:2" class="footnote" rel="footnote">2</a></sup> <sup id="fnref:3" role="doc-noteref"><a href="#fn:3" class="footnote" rel="footnote">3</a></sup></p> <p>The most common prompts seem to be selecting buses, trucks, boats or trains out of the grid.<sup id="fnref:4" role="doc-noteref"><a href="#fn:4" class="footnote" rel="footnote">4</a></sup> The market demand for this sort of simple labelling must be rather limited, even if challenges have to be repeated many times and cross-checked to get an acceptable error rate.</p> <p>So far, a little inscrutable but all seems sensible enough. But then it all gets interesting when you actually take a look at the images in a little more detail:</p> <p><img src="https://bearbin.net/images/captcha/1.png" alt="hCaptcha example" /></p> <p>Starting from the top left and going right, we have:</p> <ul> <li>A boat that appears to have been painted by Dalí, with a mast drooping like a wet noodle.</li> <li>A plane with tricycle landing gear, except it’s got two sets of wheels at the front and one at the back. That’s not normal!</li> <li>A normal looking plane with some odd-looking clouds above.</li> <li>A bus with an axle in front of the door, and another behind it, and another at the back. Hmm</li> <li>A boat in a marina made of splodges.</li> <li>A normal-looking boat on a normal-looking sea, except - look at that horizon! How did that happen.</li> <li>A single-decker london bus with a ghost of it’s double-decker cousin above. And a giant moth perched on it at the back.</li> <li>Another ghostly upper deck on a regional bus.</li> <li>A sailing boat with some oddly stylised “alien” writing on the sail.</li> </ul> <p>These images are obviously AI-generated. They have all the hallmarks of GAN output, with typical artifacts and oddities. <a href="https://bearbin.net/images/captcha/2.png">Have</a> <a href="https://bearbin.net/images/captcha/3.png">some</a> <a href="https://bearbin.net/images/captcha/4.png">more</a> and see if you can spot the same things in these other challenges - it’s not hard at all, is it!</p> <p>The question then is why? Why would hCaptcha be generating these challenges - aren’t they supposed to be labelling real life, not some AI mirages? You know the labels before you generate them, what’s the point in using humans to re-label them again… And why are the results so bad - these are definitely not state of the art!</p> <p>The only explanation that makes sense is that hCaptcha is not really doing this whole AI-labelling business at all, or if they are it’s only in very limited fashion. Most of the time they’re just using a GAN to generate images that defeat the bots’ image recognition AI. And the GAN isn’t trained to optimise human recognition, rather to confound the bots in an arms race, leading to the bad image quality.</p> <p>If you have any better ideas I’d be glad to hear them because this whole thing doesn’t really make much sense.</p> <p>Footnotes:</p> <div class="footnotes" role="doc-endnotes"> <ol> <li id="fn:1" role="doc-endnote"> <p>If you look closer, they have an <a href="https://medium.com/hcaptcha-blog/hcaptcha-technical-architecture-high-level-design-4373a8c944b2">article that purports to explain the “technical architecture of hCaptcha”</a> which is a supreme example of buzzword-stuffing blockchain-washed nothing. There is less than zero need for a blockchain to track customer requests, much less the public Ethereum blockchain, but it’s the buzzword of the month so it must go in. <a href="#fnref:1" class="reversefootnote" role="doc-backlink">&#8617;</a></p> </li> <li id="fn:2" role="doc-endnote"> <p><em>Most</em> real users, that is. There are some users for whom the challenge is actually too hard, or who’ve been blackholed and are interpreting bad IP reputation as poor skill. But the ones who fall down most often are those who try too hard and analyse the prompt and challenge in too much detail. The real way to solve these image challenges is to answer what you think <em>other people will answer</em>, rather than the <em>correct answer</em>. And don’t take too long either, just a quick glance is all your competition are giving! Anecdotally, this isn’t too common with hCaptcha, but reCAPTCHA challenges are extremely prone to this failure if you think too hard. <a href="#fnref:2" class="reversefootnote" role="doc-backlink">&#8617;</a></p> </li> <li id="fn:3" role="doc-endnote"> <p>Unfortunately <a href="http://dx.doi.org/10.1109/SPW53761.2021.00061">this is also quite easy for bots</a>, somewhat subverting the point of a CAPTCHA, so that’s how browser fingerprinting and IP reputation creep in to get reasonable enough results. <a href="#fnref:3" class="reversefootnote" role="doc-backlink">&#8617;</a></p> </li> <li id="fn:4" role="doc-endnote"> <p>These prompts are so common that a <a href="https://news.ycombinator.com/item?id=29838908">front-page post on Hacker News</a> consisted of this observation (and prompted me to write up my thoughts on the topic from the past few months). <a href="#fnref:4" class="reversefootnote" role="doc-backlink">&#8617;</a></p> </li> </ol> </div>

It’s getting to be the end of 2021 - so it’s a good time to look through some of the things I bought over the year, and reflect on how they’ve turned out. Some of them have been rubbish of course, but there are a number of things that have turned out to be very useful, or to have brought me joy in some other way, and made them into a list in the hope somebody else will find it helpful.

<p>It’s getting to be the end of 2021 - so it’s a good time to look through some of the things I bought over the year, and reflect on how they’ve turned out. Some of them have been rubbish of course, but there are a number of things that have turned out to be very useful, or to have brought me joy in some other way, and made them into a list in the hope somebody else will find it helpful.</p> <p>Choosing what to buy is a hard problem - and nobody has the exact same criteria for their purchases as anybody else, but it’s still useful to hear how other people got on, and to see reviews in context. So just take this list as social proof - “it worked for me”.</p> <p>I’ve tried to provide a Amazon US and UK link for the items that are sold there - these are affiliate links, so I will get a small cut if you buy something on Amazon after clicking one. However, due to Amazon’s monopoly pricing power, you’ll probably find the best price somewhere else local to you - the links are just there for your convenience.</p> <h2 id="tools">Tools</h2> <h3 id="knipex-cobra-250mm-water-pump-pliers">Knipex Cobra 250mm Water Pump Pliers</h3> <p><a href="https://amzn.to/3mMqc2l">amazon UK</a> <a href="https://amzn.to/32vzKIk">amazon US</a></p> <p>These are a really excellent set of water pump pliers. They can substitute for (or improve on) at least three tools: pliers, an adjustable spanner and a pipe wrench. I’ve used these many more times than I had imagined I would when I got them, they really are a do-anything tool. The fit and finish is immaculate as you’d expect for something made by Knipex plus they have a great feel in the hand with an ergonomic textured handle, and the ultra-hard jaws grip on to anything. And they’re <a href="https://www.youtube.com/watch?v=qjDG4gaiRp8">Project Farm approved</a> too!</p> <p>I do wish that these came in a left-handed variant, as the adjustment button is slightly uncomfortable to push when in your left hand. And I now need to get another in a smaller size that I can put on my electronics desk permanently - these big ones are spending more time out of the toolbox than in!</p> <h3 id="ut-210e-acdc-clamp-multimeter">UT-210E AC/DC Clamp Multimeter</h3> <p><a href="https://amzn.to/3qzs5AI">amazon UK</a> <a href="https://amzn.to/3EO3YmY">amazon US</a></p> <p>I needed a clamp multimeter for electronics work: the UT-210E does DC, and it has a great 1 mA resolution (other meters typically have 100mA, which is useless for electronics). It’s not terribly accurate, but it’s more than good enough once you zero it out, and it’s super cheap compared to others on the market. It’s so useful to be able to clamp on to a wire and quickly measure out the current without having to shut down the device, splice wires and restart like you do with a normal multimeter. This is a simple tool, but it does it’s job perfectly and I have had absolutely no problems with it.</p> <p>The <a href="https://amzn.to/3mNPfSy">VoltCraft equivalent of this meter</a> should be identical aside from the colour of the case, but it was more expensive at the time I bought mine so I ended up with the Uni-T brand.</p> <h3 id="makita-m4301-jigsaw">Makita M4301 Jigsaw</h3> <p><a href="https://amzn.to/3eBEy0S">amazon UK</a></p> <p>Yes, it’s a red Makita! It’s heavy, brushed and corded. But it’s cheap, sturdy, and it works perfectly: it has variable speed control, a high quality plastic construction and proper rubber cord. It works about 100x as fast as a hand saw, so you’ll be saving time. And for the £35 I paid it’s a no-brainer if you don’t have a jigsaw already. It even came with one good quality blade so you’re ready to go from the start.</p> <h3 id="mechanix-fastfit-gloves">Mechanix FastFit Gloves</h3> <p><a href="https://amzn.to/3JyUrDU">amazon UK</a> <a href="https://amzn.to/3pEFDeH">amazon US</a></p> <p>Versatile gloves that provide reasonable protection and excellent grip without taking away too much feel. They work touchscreens too. I bought a new pair this year - they last about a year for my light-duty use. They’re really easy to put on and take off but they stay fitted perfectly and allow good freedom of movement.</p> <h3 id="zebralight-sc64c-le">ZebraLight SC64c LE</h3> <p><a href="https://eu.nkon.nl/zaklampen/brands/zebralight-flashlights/zebralight-sc64c-le-18650-lh351d-4000k-high-cri-flashlight.html">nkon.nl for Europe</a> <a href="http://zebralight.com/SC64c-LE-18650-4000K-High-CRI-Flashlight-Limited-Edition_p_239.html">ZebraLight.com for US</a></p> <p>For a torch (flashlight), this is perfection. It’s amazingly bright, wonderfully compact (barely larger than the 18650 battery it contains), runs seemingly forever on a charge, and it has an excellent belt-clip too.</p> <p>Every detail of this is right: it’s got a high-CRI 4000K emitter for nice colours and versatile usage day or night, an intermediate-distance orange-peel reflector design for smooth spill and graduated light distribution, with some throw for when it’s needed. It’s got a electronic side-switch with simple UI: no turning on in your pocket, and always the right mode first try. I have owned a lot of torches, and this is the best.</p> <p>It is expensive, and ZebraLight unfortunately has persistently poor stock levels and only sells within the US. That said, I now have two, just in case I lose this one and can’t get another immediately. And I say lose - there’s no chance of this breaking, it’s so well put together. Even the anodising is practically like new after a year of use.</p> <h2 id="technology">Technology</h2> <h3 id="quntis-52cm-monitor-light-bar">Quntis 52cm Monitor Light Bar</h3> <p><a href="https://amzn.to/3z9KDva">amazon UK</a> <a href="https://amzn.to/3zjYtuX">amazon US</a></p> <p>My desk at home was always quite badly lit - with most of the light in the room coming from a pendant behind me, the desktop was in shadow without a desk lamp. As a result I’ve always had space on my desk taken up by a heavy desktop lamp base, and put up with uneven lighting.</p> <p>Since I got the monitor light bar, it’s been completely transformed. I’ve got more space on the desk as the light bar just rests on top of the monitor, and the lighting is so much more even. Although adjustability is a little bit limited and you have to bring your own power supply, it’s still a good deal for usable desk lighting. I don’t use the sensor function, so can’t comment on how that works, and I also don’t know how this compares to the Benq version at twice the price, but I’m happy with this one so not inclined to find out.</p> <h3 id="dji-osmo-pocket-2">DJI Osmo Pocket 2</h3> <p><a href="https://amzn.to/3qF41Mv">amazon UK</a> <a href="https://amzn.to/3sMgLUr">amazon US</a></p> <p>This is a perfectly conceived product - basically the modern incarnation of the camcorder form factor. It’s so handy and easy to use - just point and shoot. And the results are impressive: the video is entirely competent 4K with reasonable bitrate, but the real joy is the stabilisation; it’s perfect - thanks to the gimbal there’s zero shake or roll. The focal length of the standard lens is just about right - I feel the FOV is too narrow just about as often as I feel it’s too wide. Of course there is an extra-wide angle attachment, but it’s certainly not essential.</p> <p>Not to say this is perfect: it’s expensive, the menu system is painful until you get your muscle memory, and you have to install an app on your smartphone to ‘activate’ the device before you use it for the first time: you need to phone home to DJI’s mothership at least once. And the case is an infuriating missed opportunity - it’s essential for protection of the fragile gimbal head, but rather than doubling as a useful handle or tripod mount (it doesn’t come with one by default!), while you’re shooting you have to shove it in your pocket where it just takes up space.</p> <h3 id="kwmobile-matte-screen-protector-for-13-mbp">kwmobile Matte Screen Protector for 13” MBP</h3> <p><a href="https://amzn.to/3sRaffj">amazon UK</a> <a href="https://amzn.to/32vzcSM">amazon US</a></p> <p>Unfortunately I’m forced to use a MBP for my job. Although Apple’s design choices are in general awful, the glossy screen on MacBooks is particularly so: you get terrible glare, and when the laptop is closed, the screen touches the keyboard transferring a grease-print of your keys onto the coating, leaving discoloured patches. This matte film fixes both issues, reducing glare considerably and also increasing the cleaning interval for the screen - I used to clean it twice a week, and now I only have to clean twice a month!</p> <p>You do lose a little bit of brightness, but it’s not very noticeable, and a tiny bit of sharpness (although this actually improves the image IMO). These tradeoffs are perfectly fine, however, because the film makes the laptop usable when it wouldn’t be otherwise. Why this is not the default from the factory I don’t know!</p> <h3 id="base12-laptop-stand">BASE12 Laptop Stand</h3> <p><a href="https://amzn.to/3FXI9ml">amazon UK</a> <a href="https://amzn.to/3FI6YT3">amazon US</a></p> <p>I’ve had several laptop stands before, but this was recommended to me in the summer and I can confirm that it’s the best one so far. It holds the laptop up nice and high (or lower, if you want) and it’s sturdy. And when you’re done it folds up very neatly to a small package for transport. On the downsides: it’s not beautiful (although the branding is tasteful - no giant ugly logos), and the feet are slightly slippery so it is unsuitable for sloped desks.</p> <h3 id="durgod-taurus-k320-mechanical-keyboard">Durgod Taurus K320 Mechanical Keyboard</h3> <p><a href="https://amzn.to/3EALJRK">amazon UK</a> <a href="https://amzn.to/3sMBp70">amazon US</a></p> <p>I’ve been a mechanical keyboard user for quite a few years - I’ve had several of the cheap chinese keyboards with blue switches. I decided to upgrade this year due to WFHing more often, and it was a choice between the Durgod K320 and the Keychron K8: I needed a nice full-size TKL keyboard with UK layout and brown switches.</p> <p>I ended up with the Durgod because it was in stock at the time, but it’s an excellent keyboard - sturdy construction, high quality PBT keycaps (with no misprints!), and well lubricated original MX brown switches. The cable is Type-C and detachable so can be replaced, or switched for a Type-A if desired. I was so pleased with mine that I bought another one for the office.</p> <h2 id="kitchen">Kitchen</h2> <h3 id="stainless-steel-garlic-press">Stainless Steel Garlic Press</h3> <p><a href="https://amzn.to/3zb76YC">amazon UK</a> <a href="https://amzn.to/3JG1FGa">amazon US</a></p> <p>A garlic press is an essential tool in the kitchen. In go cloves of garlic, skin on, and out comes perfect crushed garlic straight into the pan - no tedious peeling or chopping. I’m probably using 5x as much garlic now I have the press, and my food is better for it.</p> <p>Sadly most garlic presses on the market are terrible. They are either made of cheap thin steel that doesn’t stand up to the simple task of crushing a clove of garlic, or they are made of cast zinc. Cast zinc has no place in the kitchen - it is weak, brittle and corrodes easily and as a result harbours dirt and grime. Plus, it can’t be washed in the dishwasher so cleanup is an extra step at the end of every meal.</p> <p>Luckily this press is made of solid, polished stainless steel. There’s lots of leverage for stubborn cloves, and you can be confident it won’t fall apart. When you’re done it can just be dumped in the dishwasher (turned inside out) ready to wash up perfectly for next time. I expect mine will last for many years to come, and I have given several of these presses out as gifts.</p> <h3 id="metal-dustpan-and-brush">Metal Dustpan and Brush</h3> <p><a href="https://amzn.to/3zcIFdg">amazon UK</a></p> <p>Why were plastic brushpans invented in the first place? This metal one is perfect: no plastic to warp in the sun and no annoying rubber seal to wear out after a year. Simple.</p> <h2 id="fun">Fun</h2> <h3 id="powerball-wrist-gyroscope">Powerball Wrist Gyroscope</h3> <p><a href="https://amzn.to/3sR9SBr">amazon UK</a> <a href="https://amzn.to/3qCqeuL">amazon US</a></p> <p>This allows you to work out your forearm while you have fun at your desk, with the simultaneous benefit of annoying all the people around you with a loud whining noise. Once you get the hang of it, this is surprisingly fun and easy to use, and it really gets the blood pumping into your hands if they’re a bit cold. Yes, it’s cheap and plasticy, but it’s also cheap!</p> <h3 id="nikon-aculon-8x42-binoculars">Nikon Aculon 8x42 Binoculars</h3> <p><a href="https://amzn.to/31bqoR5">amazon UK</a> <a href="https://amzn.to/3sHSyPb">amazon US</a></p> <p>My old binoculars broke, so I had to buy a new set. These may be from the budget range and of an unfashionable porro prism design, but the optical performance is leaps and bounds ahead of my old vintage set (made in Japan). The image is bright, sharp and colourful, plus you can use them with glasses on and the field of view is wider than the more popular roof prism design. If you’re still using vintage binoculars, think about an upgrade to a modern equivalent, you may be surprised!</p> <h3 id="midwest-tungsten-1kg-cube">Midwest Tungsten 1kg Cube</h3> <p><a href="https://amzn.to/32N3cJA">amazon UK</a> <a href="https://amzn.to/3FKqiyT">amazon US</a></p> <p>Yes, it’s a meme. And yes, I now have several more dents in my desk than I did last year. But The Cube is also a really fun object to hold, to pick up and play with. And there’s no way the wind is going to blow papers off my desk now I have it to weigh them down! And when you sell an NFT for a million dollars, you too can be the owner of The Cube ;) You’ll need that million too, as the price now seems to be about 3x what I paid for mine!</p> <h2 id="dishonourable-mentions">Dishonourable Mentions</h2> <p>These are the things I bought that turned out to be a bad idea in retrospect.</p> <h3 id="duronic-spice-grinder">Duronic Spice Grinder</h3> <p><a href="https://amzn.to/3zbHrPD">amazon UK</a></p> <p>This is bulky, impractical and loud. And it smells like it’s going to catch on fire every time I use it. I switched to a mortar and pestle instead - much nicer!</p> <h3 id="compatible-earcups-for-sony-wh1000-xm3">Compatible Earcups for Sony WH1000-XM3</h3> <p><a href="https://amzn.to/3zjXb35">amazon UK</a> <a href="https://amzn.to/3Jx9uhi">amazon US</a></p> <p>The original Sony earcups are made of memory foam and do a very impressive job blocking out sound leakage. These are not made of memory foam, and as a result they do a terrible job blocking out sound, making them completely pointless unless there’s no other option. Unfortunately there is no other option, as Sony seemingly doesn’t make spare earcups available to replace mine that have fallen apart. Bad Sony!</p> <h3 id="noris-digital-emr-marker">Noris Digital EMR Marker</h3> <p><a href="https://amzn.to/3HpUM9O">amazon UK</a> <a href="https://amzn.to/344b9KR">amazon US</a></p> <p>I wanted a new marker for my Remarkable Tablet - I thought I would try the Staedlter Noris one, because it looks cool and it has a rubber as well. Well I returned it pretty much immediately: it’s a plasticy piece of junk and it rattles as you write, and it misses half the strokes you put down when the remarkable one gets them all. Plus the tip is way too soft and slippery: it feels like you’re writing on plastic, not paper. I’m happy with the ReMarkable one even though it will set you back twice the price.</p>

Last week I opened up VS Code, ready to get to work on a project. Instead, I was greeted with a wodge of error messages piling up in the bottom right corner. The C++ language server had crashed. This was important. My project is written in C++, and I need the language server. So I closed the window and opened it again. No difference. I restarted the langauge server manually using a palette comand. No difference. I updated the IDE to the latest version (a new one comes out seemingly every week) - no difference. What if I uninstall the C++ plugin and install it again? No difference! It was dead, kicked the bucket, shuffled off its mortal coil!

<p>Last week I opened up VS Code, ready to get to work on a project. Instead, I was greeted with a wodge of error messages piling up in the bottom right corner. The C++ language server had crashed. This was important. My project is written in C++, and I need the language server. So I closed the window and opened it again. No difference. I restarted the langauge server manually using a palette comand. No difference. I updated the IDE to the latest version (a new one comes out seemingly every week) - no difference. What if I uninstall the C++ plugin and install it again? No difference! It was dead, kicked the bucket, shuffled off its mortal coil!</p> <p>Of course the error message in the UI is singularly unhelpful. It tells me it crashed, OK fine, but then how do I fix that? Of course there’s no error code, no stacktrace, nothing. This is a tool for modern developers - you see; in today’s world nobody can be expected to understand the workings of their own tools. Least of all the toolmakers themselves, when they treat their own components as black boxes! In vain, I tried opening the IDE in verbose mode, to see if there was anything to be gleaned from the logs. Nothing obvious. That’s the point you realise something is going to take time to fix. So that’s that, I could fix it later, then… the feature was simple enough to write without the language server, I thought! My broken tool has only sent half an hour down the drain, no matter.</p> <p>And then I realised that I can’t write code anymore. I can’t write C++ without the language server enabling the IDE to guide me, to complete my word when I press tab; to go to definition when I need it, and to give me the types when I hover. My muscle memory is so attuned to the IDE that I don’t know how to do anything outside of it’s safety. I have never thought of myself as an IDE softie - I wrote lots of the code for this project before VS Code even existed; and the magic incantations that control CMake are at the top of my mind. But compiling the code yourself is not the same thing as the oldfashioned mental map of the source code, the innate knowledge of the types and parameters of the functions you use everyday, and the ability to write a line of code that actually compiles!</p> <p>Well I got the feature done, but it took a lot longer than usual, and only after a few false finishes when it failed to compile - no red squiggles to fix my mistakes as I go without the language server after all.</p> <p>Now I have an IDE again, after I deployed the nuclear option of a whole fresh installation.<sup id="fnref:1" role="doc-noteref"><a href="#fn:1" class="footnote" rel="footnote">1</a></sup> Everything is back to normal and productivity is great. Just another lesson of the force multiplier that is modern tooling.</p> <p>So what am I to take away from this all? Of course using an IDE makes the craft easier, but am I really a better, more efficient, programmer when I use an IDE, or am I in reality letting my skills rot away for some pretty colours and a few less keystrokes? Maybe… but I’ll try the next project with the training wheels turned off from the start, and see what difference it makes.</p> <h2 id="footnotes">Footnotes:</h2> <div class="footnotes" role="doc-endnotes"> <ol> <li id="fn:1" role="doc-endnote"> <p>Although it must be said I was planning to do this anyway, due to Microsoft’s increasingly monopolistic behaviour in the space. Switching to <a href="https://github.com/VSCodium/vscodium">VSCodium</a> and avoiding the proprietary extensions is sort of the minimum you can do. <a href="#fnref:1" class="reversefootnote" role="doc-backlink">&#8617;</a></p> </li> </ol> </div>

Ads are annoying, right? Getting right in your face and shouting for your attention when all you want to do is something else - when you get an unskippable ad before a video to watch; when you’re reading an article and an ad pops up over the writing; when somebody you had trusted endorses something that you and they both know is bunk. This badvertising is a scourge on modern society and a manifestation of all that’s wrong about suveillance capitalism.

<p>Ads are annoying, right? Getting right in your face and shouting for your attention when all you want to do is something else - when you get an unskippable ad before a video to watch; when you’re reading an article and an ad pops up over the writing; when somebody you had trusted endorses something that you and they both know is bunk. This badvertising is a scourge on modern society and a manifestation of all that’s wrong about suveillance capitalism.</p> <p>That’s not to say that adverts are evil, or that they have no place. But they must be in their place. When you’re reading in the hypothetical yellow pages, that’s advertising. Or when you’re walking down the high street, looking in shop windows; advertising again. Or a specialist magazine; instagram channel or even so called <em>content marketing</em>. They’re all adverts, but they are in their place. Both the advertiser and the viewer get value out of the interaction - enough that you seek them out yourself.</p> <p>Now, in some ways technology is the great equaliser of our time: the same tech that allows ever more complicated and pervasive badvertising also allows ever more complete and simple de-badvertising. The good citizen of the net makes technology work for them: they install <a href="https://ublockorigin.com/">uBlock Origin</a> and <a href="https://sponsor.ajay.app/">SponsorBlock</a> to protect their web browser, and then set up a <a href="https://pi-hole.net/">Pi-hole</a> to reduce badvertising outside of the confines of the open web. The better citizen sets these same protections up for their family, and supports and contributes to the development of better tools. And they pay for services when to do so is not just to feed the beast.</p> <p>Now, while this equilibrium persists on the net, in real life the badvertisers have been taking advantage of just as many technological improvemements: internet control and management; high intensity LED illumination; pervasive video, animation, and sound; smartphone and facial tracking and many more advantages alike. Our cities are being turned into a dystopian nightmare - as shopping moves online: MORE ADVERTS to sell you on existing shops; when there’s a funding crunch in local government: MORE ADVERTS to bring in the revenue; when that isn’t enough: MORE ADVERTS just for the sake of it. And with all this new technology, these ads aren’t just some posters or billboards, but rather aggressive and intrustive screens that sap the real life from the city; replacing it with an artifical reminder of the corporate landscape you live in.</p> <p>Blocking ads may work online, but unless you spend your life in VR goggles, one cannot apply technical solutions alone. But don’t tell yourself that you can’t block adverts in real life - just think about how the ads got there. The good citizen in real life fights the planning applications for new adverts; they tell their local politicians about the damage badverts cause; they fund <a href="https://adfreecities.org.uk/">campaign groups</a> to tell others the same. Make a conscious decision to avoid adverts, and enjoy your life more. Do the science that explains to advertisers exactly why these badverts don’t help them sell. Technologists too: use the benefits of modern technology to multiply your effort, shut down the adverts sooner.</p> <p>Above all else, don’t take advertising as a given. It’s your choice, and you can help choose <em>no</em> for your city.</p>

Following on from my post yesterday about an edge case in YouTube, I thought I’d write about a class of edge cases perhaps even more strange that I’ve been exploring recently:

<p>Following on from <a href="drinking-from-the-firehose-youtube-music">my post yesterday about an edge case in YouTube</a>, I thought I’d write about a class of edge cases perhaps even more strange that I’ve been exploring recently:</p> <p>Search engines are a fact of daily life for most of the population nowadays. Google (sub your preferred provider) is an extension of the brain, imagined as giving you access to the sum of the world’s information at the click of a button. But a search engine isn’t just a Ctrl-F for the internet with a nice interface and ads; rather it’s a tremendously complicated system with lots of features and interactions between those features. And all you need to explore the system yourself is some well-tuned search queries.</p> <p>I recently had an epiphany: search engines are designed to find you results for <em>something</em> and that’s a job they perform well. But there’s nothing stopping you from searching for <em>nothing</em>! And the search engines will still give you results!</p> <p>And what results they are - have a go on the links below:</p> <p>An empty query on DDG: <a href="https://duckduckgo.com/?q=%2B&quot;&quot;">https://duckduckgo.com/?q=+””</a><br /> A different empty query on DDG: <a href="https://duckduckgo.com/?q=(&quot;&quot;)">https://duckduckgo.com/?q=(“”)</a><br /> An empty query on Google: <a href="https://www.google.com/search?q=(&quot;&quot;)">https://www.google.com/search?q=(“”)</a><br /> An empty query on Google News: <a href="https://www.google.com/search?q=%22%22&amp;tbm=nws">https://www.google.com/search?q=”“&amp;tbm=nws</a></p> <p>And have you ever thought about doing an <em>anything but</em> search? Normally you can add negations to the end of your search term to remove unwanted results, but there’s nothing stopping you from having a search term consisting entirely of negations!</p> <p>Here’s one on DDG: <a href="https://duckduckgo.com/?q=-&quot;an+entirely+negated+query&quot;">https://duckduckgo.com/?q=-“an entirely negated query”</a><br /> On Bing: <a href="https://www.bing.com/search?q=-%22an%2Bentirely%2Bnegated%2Bquery%22">https://www.bing.com/search?q=-“an entirely negated query”</a><br /> And on Google Books: <a href="https://www.google.com/search?q=-%22nothing%2Bto%2Bsee%2Bhere%22&amp;tbm=bks">https://www.google.com/search?q=-“nothing to see here”&amp;tbm=bks</a></p> <h2 id="commentary">Commentary</h2> <p>Google appears to have some half-effective filtering for these empty search queries so you’ll mostly get the same two YouTube videos as a result - is this an Easter egg? Although Google News and Books don’t have any filter, and you do get some odd results there!</p> <p>DuckDuckGo doesn’t appear to have any filtering at all, although it’s obvious just how much DDG relies on Bing’s whitelabel product for its results by looking at how similar the two are.</p> <p>If you can think of a deeper reason for these results, please do leave a comment and lets try and explain some of the mystery away.</p>

Nowadays YouTube is a great place to listen to music, because everything is there. There’s such a wide selection of to listen to - seriously - the permissive ask-for-forgiveness1 bazaar means that if you search for it, it’ll be there. Make your own playlist, and when it’s time to add something new to you, it’ll be there. Alternatively, just be guided by the flow and don’t worry about where it’s all coming from. For all the perils of YouTube’s arbitrary Copyright system, the variety of music it allows is certainly a benefit. When videos are allowed by default, and the normal punishment after detection of your copyright infringement is a few cents from ads going to the labels, you get channels like ultradiskopanorama uploading rare classics that were never going to go on a service like Spotify. ↩

<p>Nowadays YouTube is a great place to listen to music, because everything is there. There’s such a wide selection of to listen to - seriously - the permissive ask-for-forgiveness<sup id="fnref:1" role="doc-noteref"><a href="#fn:1" class="footnote" rel="footnote">1</a></sup> bazaar means that if you search for it, it’ll be there. Make your own playlist, and when it’s time to add something new to you, it’ll be there. Alternatively, just be guided by the flow and don’t worry about where it’s all coming from.</p> <p>And to that point, discovery is where YouTube really excels - The Algorithm knows what genres you like, and what you’ve listened to before, and there’ll always be an old favourite ready to listen again or something new, but familiar, to experience for the first time. Training time is minimal, because The Algorithm is a simple beast really (do you really think AlphaGooYou is going to waste resources on a complex model).</p> <p>That said, sometimes you just want a change, and it’s hard to switch off completely. If you log out and clear your cookies, you’ll get music, sure; but it’ll be the worst dregs of contemporary nongenre, optimised for the dying radio sector. Not worth it! What you need is a quick way to jump out of your filter bubble: a random mode, a shuffle play, to say. And floating there in the aether, an odd edge case at the margins of the beast, it actually exists:</p> <p>Here it is, the snappily named: <a href="https://www.youtube.com/playlist?list=UUkeVFb3rrRYgcmcD1F8Bsag">“Uploads from Various Artists - Topic”</a> Playlist. 20000 entries, all songs just recently uploaded to YouTube in the past week or so. Go ahead: break into a brand new song with 0 lifetime views!, Enjoy a random cyrillic-lettered song you can’t understand!, Use it as an infinite radio - whole new songs being added faster than you can listen to them!</p> <p>Although I don’t completely understand why this exists, it seems to be a quirk in the YouTube partner music upload programme: music rightsholders (or those who purport to be) can upload music to YouTube<sup id="fnref:2" role="doc-noteref"><a href="#fn:2" class="footnote" rel="footnote">2</a></sup> in bulk and these are arranged into “Topic Channels” for each artist. These “Channels” inhabit the half-space between a real channel and a playlist - you can subscribe but there’s no real person on the other side of the curtain; certainly there’s no community there. And it seems, on one end or the other, that in the absence of any better information everything just gets unceremoniously dumped into the “Uploads from Various Artists - Topic” topic channel playlist.</p> <p>Either way, it may be quirk, and an odd one at that; but it’s fun and it should be saved. Please don’t take it away, oh wondrous BigTech…</p> <h2 id="footnotes">Footnotes</h2> <div class="footnotes" role="doc-endnotes"> <ol> <li id="fn:1" role="doc-endnote"> <p>For all the perils of YouTube’s arbitrary Copyright system, the variety of music it allows is certainly a benefit. When videos are allowed by default, and the normal punishment after detection of your copyright infringement is a few cents from ads going to the labels, you get channels like <a href="https://www.youtube.com/user/ultradiskopanorama">ultradiskopanorama</a> uploading rare classics that were never going to go on a service like Spotify. <a href="#fnref:1" class="reversefootnote" role="doc-backlink">&#8617;</a></p> </li> <li id="fn:2" role="doc-endnote"> <p>These videos always have “Auto-generated by YouTube” in the description, and all have their comments turned off (sadly a recent change). <a href="#fnref:2" class="reversefootnote" role="doc-backlink">&#8617;</a></p> </li> </ol> </div>

Recently, I was involved in a discussion about AB-1346, a routine decision of the California Legislative Assembly. The bill was passed in October 2021, and requires the California Air Resources Board (CARB) to put in place regulations restricting emissions from new Small Off-Road Engines (SOREs). Not being a Californian - indeed as I am living in the UK and not a USAian at all, this may seem somewhat an odd topic to write about. Nonetheless the bill is generating quite a lot of fuss online and I thought it would be interesting to explore the topic in a little more depth.

<p>Recently, I was involved in a discussion about <a href="https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202120220AB1346">AB-1346</a>, a routine decision of the California Legislative Assembly. The bill was passed in October 2021, and requires the California Air Resources Board (CARB) to put in place regulations restricting emissions from new Small Off-Road Engines (SOREs). Not being a Californian - indeed as I am living in the UK and not a USAian at all, this may seem somewhat an odd topic to write about. Nonetheless the bill is generating quite a lot of fuss online and I thought it would be interesting to explore the topic in a little more depth.</p> <p>While the new law itself is quite light on detail, it links in to an interesting technological transition that’s currently ongoing and rapidly speeding up: the technological obsolescence of small engine-driven machinery, in favour of electrically operated machinery, powered by batteries.</p> <p>The law has widely been reported as a ban on electrical generators for home use in California, and resultantly the bill has attracted a somewhat disproportionate level of attention from the press and public in this regard. Many people in California and throughout the USA are, or perceive themselves to be, dependent on generators to supply their electricity (at least for some of the time).</p> <p>While this level of attention would be reasonable if the bill did <em>in fact</em> ban generators; the bill does not, <em>in fact</em>, ban generators. In fact, the other market segments affected will have much more impact on the day-to-day life of Californians.</p> <p>What the bill does do, is to give legal force to new <a href="https://ww2.arb.ca.gov/rulemaking/2021/sore2021">rules currently being made by CARB</a>. If these rules are adopted as proposed, emissions standards for SOREs will be raised to technically infeasible levels from 2024 onwards, effectively prohibiting production of SOREs for the California market. Generators are included in this, although they will not be completely restricted until 2028. Existing equipment will not be affected by these rules, however - Californians’ generators will not stop suddenly stop working when the clock strikes midnight on the 1st of January 2028, nor will the police go about rounding up outdated generators.</p> <p>Even in 2028 and afterwards, if somebody wants a new portable generator, they will be able to get one. Both used generators, and new generators bought directly from other states, will still be available; additionally some manufacturers will be able to use accumulated emissions credits to legally sell noncompliant generators.</p> <h2 id="why-are-small-engines-so-good-historically">Why are small engines so good, historically?</h2> <p>Removing SOREs from the market will be a historic and tremendously significant occasion, as they have been a fixture of domestic life for going on 70 years, powering all manner of essential tools: from chainsaws, lawnmowers and leafblowers to pressure washers, arc welders, plate compactors - and indeed, portable generators. All these categories would not exist as they do today without the SORE to give them rotational energy, mechanically converted by their mechanisms into useful work for the home and the job.</p> <p>Would you bother mowing the lawn once a week if you had to push the mower yourself, instead of riding along in comfort while the SORE does all the work for you? What would you do without a chainsaw as a tree surgeon? Or without an arc welder as you’re building the new oil pipeline that inches its way across the landscape?</p> <p>SOREs are convenient, portable and powerful. Pour in some fuel, pull the cord and away you go. Maintenance is easy, if you can be bothered, just top off the oil every so often, and switch out the carburator gaskets and spark plug when they wear out. If you can’t be bothered, for not many dollars somebody else will do it for you; if even that’s too complicated for you then you can just throw it away and buy another - small engines are cheap enough that you can afford it.</p> <p>SOREs are the safe bet. They can operate in harsh conditions without a blink - hot, cold, wet, dry? No bother. What about infrastructure - all you need is a can of fuel, and as an American, you can trust in the supply of petrol for your SORE. The government fights wars for your right to burn oil. No matter who you are or what you do, or where you are in the country; there’s nothing better than a SORE by your side.</p> <h2 id="or-maybe-not-there-are-downsides-too">Or maybe not, there are downsides too!</h2> <p>When you snap out of your American dream, you realise that your suburban paradise is more like a suburban prison. The car in the garage is not a ticket to freedom, but a shackle to the petrol pump and a life doomed to sit in traffic; the 30-year mortgage not independence but dependence on the market and maintaining your income; and that pristine green lawn is not the status symbol it once was. It must be fertilised, pesticised, mown, leafblown, edged and watered, taking up hours of your time and many of your dollars.</p> <p>And all that mowing belies one of the problems with the SORE. When every identical house in every identical cul-de-sac with its identical green, manicured lawn has its own mower running for hours a week, that’s a lot of fuel being burned by SOREs in a relatively small area. And that’s not good. The SORE is a noisy, smelly and inconvenient machine. When incessant droning of the neighbours’ leafblowers just won’t shut up when you want to relax, and when the smog hangs in the air like a foul blanket over the city for days on end, you realise that you have a problem. And it’s a big problem too; reading the scientists’ reports about just how many people are dying of this gives you a shock. And then you realise that the carbon dioxide being pumped out of these engines isn’t that benign either.</p> <p>The truth is that SOREs have a lot of tradeoffs in their design. They may be cheap, lightweight and powerful, but because of this they are designed to be crude and simple machines. There’s no budget (economic, weight, or engineering complexity) for anything more than the bare minimum. They pass out exhaust gases unfiltered, and burn through fuel at an astronomical rate.</p> <p>In the case of two-stroke engines, even the minimum of pollution control isn’t possible, because of the total-loss lubrication strategy. Engine oil is mixed directly with the fuel and passed through the combustion chamber. The partially burned results are apparent as smoke, full of the worst kinds of pollutants. But when you need an engine small enough to fit in your chainsaw, even the complexity of valves and a sealed crankcase is too much - two stroke it is, consequences be damned.</p> <p>In the old days, cars and lorries emitted these kinds of pollutants too (and in aggregate, far more than SOREs): unburned hydrocarbons (HC), carbon monoxide (CO) and plain soot; but nowadays the law mandates that this is not the case. Modern cars (as designed) emit almost undetectable quantities of these pollutants, thanks to the catalytic converter, ECU and fuel injection (among countless other technologies). But this is possible because the tradeoffs are different for large and expensive car engines. If adding fuel injection is necessary to pass smog, of course that will get done, but it would probably have happened anyway once consumers realise it is more reliable and leads to lower fuel costs.</p> <p>It’s only now that cars have got to be so good that SOREs are the next biggest issue to fix.</p> <p>And it turns out that SOREs are a bit of a pain sometimes too. When the carburator needs to be rebuilt every year (or more often!) because of the new type of petrol with ethanol in it, that gets old fast. And when your nice new car always smells of fumes from the infuriatingly leaky (supposedly anti-leak!) mechanism in the fuel can, you’d really rather not have to carry petrol about quite so often. And when the power goes out and society is falling apart, when are you going to get the petrol for your generator from anyway - it’s not like you can store it for more than a few months without it going off after all. Maybe there really is something better than a SORE?</p> <h2 id="what-are-the-alternatives-to-small-engines">What are the alternatives to small engines?</h2> <p>Luckily there are now better alternatives to SOREs in many instances. Efficient and powerful permanent magnet AC motors now exist which are far lighter than SOREs, and when combined with Lithium batteries can be just as, if not more, compact and portable. Electric chainsaws are now more popular than engine-driven models for the home market, and many areas mandate the use of electric leafblowers already out of concern for noise pollution. Electric lawnmowers are competitive with petrol-powered ones, and even large lawns are suitable for self-charging robotic mowers, which not only cut out the SORE, but much of the labour too.</p> <p>Larger and mobile machinery is just as suitable for battery-driven operation, with few exceptions, owing to the breakneck pace of development in the battery and electric car industries.</p> <p>Even portable generators have been replaced by Lithium power packs for many uses - where only moderate power is needed and recharging facilities are easily to hand hand they are invaluable. And since they have no hazardous fuel nor any exhaust they are safe to use indoors. And for backup power after the Big One, or the next storm, Lithium provides an answer too. Solar panels on the roof and a Powerwall in the garage mean you can be totally self-sufficient, no generator needed.</p> <p>And more high-tech innovation does look to be on the way: fuel cells powered by methane or hydrogen gas are already available and this segment is currently undergoing a frenzy of investment. Generators and power packs using the technology are sure to come on the market before too long.</p> <p>All that said, there are still many market segments that are best served by SOREs at the moment, and it certainly is taking a gamble to say everything will be good by 2024-8. The alternatives are typically significantly more expensive than SOREs, and while price-conscious consumers can be served by the pre-2024 used market, prices will no doubt increase for all market participants.</p> <h2 id="back-to-the-rules">Back to the rules</h2> <p>Looking back to CARB’s proposed rules, we need to read them in more detail to understand the reasoning for the change. Looking at the <a href="https://ww2.arb.ca.gov/sites/default/files/barcu/regact/2021/sore21/isor.pdf">Initial Statement of Reasons</a>, CARB explains its remit and how current healthy pollution limits are being exceeded in California, and what it plans to do about that:</p> <blockquote> <p>The California Air Resources Board (CARB or Board) is responsible for protecting the public from the harmful effects of air pollution through the development of programs that reduce the emissions of specific pollutants and their precursors. Several areas within California exceed national ambient air quality standards (NAAQS) set by United States Environmental Protection Agency (U.S. EPA) for both fine particulate matter (PM) with diameter of 2.5 micrometers or smaller (PM2.5) and ozone.</p> </blockquote> <blockquote> <p>Meeting these public health goals requires phasing out the use of internal combustion engines in both on-road and off-road applications and adopting zero-emission technology.</p> </blockquote> <blockquote> <p>Governor Newsom’s Executive Order (EO) N-79-20, issued September 23, 2020, (EO N-79-20) orders CARB to develop and propose, “Strategies, in coordination with other State agencies, the U.S. EPA, and local air districts, to achieve 100 percent zero-emission from off-road vehicles and equipment operation in the State by 2035.”</p> </blockquote> <blockquote> <p>Even so, in California, SORE emit more NOx and ROG [Reactive Organic Gases] than light-duty passenger cars, both in summer and annually. Without additional regulation, SORE will emit 1.8 times the amount of summertime NOx and ROG that California light-duty passenger vehicles emit in 2031 (CARB, 2020 and 2021b).</p> </blockquote> <p>The pollution figures may seem high, but these are justified by the extremely poor performance of SOREs, high relative usage and extremely good performance of modern cars.</p> <blockquote> <p>The Proposed Amendments would accelerate the transition to ZEE by setting evaporative and exhaust emission standards to zero for new SORE (engines or equipment produced for sale or lease for use or operation in California), except engines used exclusively in generators, for model year (MY) 2024 and subsequent model years. Implementing emission standards of zero [0.00 grams of hydrocarbons (HC) + NOx per kilowatt-hour, or g·kWh-1, for exhaust emissions and 0.00 grams per test for evaporative emissions] does not necessarily mean that all new sales of small off-road equipment would be ZEE. Banked emission reduction credits could be used to offset emissions from SORE for up to five model years after the credits were generated. Also, engines or equipment emitting below 0.005 g·kWh-1 or g·test-1 could be certified to meet emission standards of zero. However, staff believes that it is unlikely that engines or equipment meeting emission standards of zero will be manufactured. It is more likely that manufacturers will use emission reduction credits in the near-term to offset emissions from SORE while the credits are available.</p> </blockquote> <p>The way that CARB is going about this is admittedly odd, but also quite appropriate in a way: nobody would have thought that the appropriate level of pollutants would ever be set to zero when pollution first became an issue. But they gave CARB the right to regulate the emissions, and zero is a perfectly appropriate number to regulate it to, given today’s environmental and market conditions.</p> <p>Have a read of the proposal yourself, the introduction is quite comprehensible and there’s lots of evidence of the real work done by CARB later on. Although at &gt;400 pages you might not want to read the whole thing!</p> <h2 id="conclusion">Conclusion</h2> <p>Anyway, to sum up, it’s certainly an interesting time in the small off-road equipment market, and probably a good place for a startup manufacturer of electric equipment, and quite possibly for the consumer as well. As an existing manufacturer of SOREs, maybe not so much. That’s no death sentence though, although there’s no time to spare, the incumbents have strong R&amp;D departments and the state is setting them off in the right direction.</p> <p>A lot of the lobbying against this change is surely coming from these manufacturers, with the scaremongering media and religious generator users coming along for the ride. But there are legitimate complaints, due to the very short timescale for the phaseout of non-generator SOREs and the increased cost of generator alternatives currently on the market.</p> <p>It’s clear that this will be good for the health and welfare of Californians, and that existing generator users have nothing to fear from the change, but rather they can expect benefits from the new and innovative products that California will be producing in the near future.</p> <h2 id="related-note">Related Note:</h2> <p>With all this new battery-operated equipment coming on the market soon, there needs to be a big push for a consistent and repairable battery standard. Vendor lockin, battery cost and safety all need to be improved. Existing proprietary batteries - where the options are an overpriced and unrepairable original battery or a dangerous cheap clone are not the solution. A well-designed open standard is needed so that consumers can choose batteries that are compatible between all their equipment and can buy high-quality third party batteries.</p>

Email privacy is dead, confirmed for the umpteenth time. In this post I present the SOILED-PRIVACY attacks (Systemic Online Information Leakage using Email+DMARC against Privacy). These are two reflected attacks against email infrastructure allowing an attacker to access private knowledge about a target user, transparent to mail forwarding, mailing lists, and web services.

<p>Email privacy is dead, confirmed for the umpteenth time. In this post I present the SOILED-PRIVACY attacks (Systemic Online Information Leakage using Email+DMARC against Privacy). These are two reflected attacks against email infrastructure allowing an attacker to access private knowledge about a target user, transparent to mail forwarding, mailing lists, and web services.</p> <p>Many email users choose to use an address under a generic domain under the control of a commercial email-service provider, their ISP, or a cooperative operator; however there is also a large proportion of email users that choose an address under a domain they or their organisation owns. There are many advantages to using a domain under your own control, including (but by no means limited to): portability between email service providers; increased personal or corporate branding potential; and improved user choice or privacy as a result of self-hosted infrastructure.</p> <p>However, a custom domain also necessarily entails some privacy downsides: as there is a trivial mapping between personality and domain name, it is possible for any person or service sending mails to an address under the domain to identify its owner. Depending on the use case of the emails being sent, this may not be a particular problem or may even be an advantage. However, in many cases this is a serious downside - very often users do not want to be identified personally by all the services they use or content-providers they subscribe to. These downsides have led to the development of various workarounds to protect user privacy. Such workarounds include:</p> <ul> <li>Anonymous or single-use forwarding addresses.</li> <li>Mailing lists not publishing lists of recipient addresses.</li> <li>Web services proxying user-user mail (e.g. with a web form or forwarding address).</li> </ul> <p>Users of custom domains have come to trust that these are effective at protecting their private activities, and limiting their trust boundary to the forwarding address operator, mailing list service or trusted web service rather than having to trust the whole of the internet or all other users of the services they use. The attacks presented mean that the above workarounds are not effective solutions and do not provide privacy of recipient, and therefore should not be used without either user knowledge of the attacks or relevant mitigations being applied.</p> <h2 id="dmarc-defective-by-design">DMARC: Defective by Design</h2> <p>DMARC is a internet technology that aims to combat email forgery and reduce the incidence of spam being sent with forged From addresses. It achieves this by standardising a DNS TXT record that can be attached to a domain by its owner. A server that receives an email can fetch the record for the domain in the From header of the email. DMARC gives the receiving server guidance on what to do when DKIM and SPF checks fail - to delete, quarantine (typically place in the spam folder), or to do nothing. Although DMARC has been subject to valid criticisms (particularly because it breaks many existing mailing lists and forwarding systems), it is a valuable tool in the fight against forged transactional email and spam.</p> <p>As well as giving guidance to receiving servers, DMARC also establishes a feedback loop: receiving servers are encouraged to send reports detailing successful and failed forgery checks back to a location nominated by the owner of the From domain. In theory, this allows email senders to track down and fix errors in the infrastructure causing unwarranted SPF or DKIM failures.</p> <p>However, in practice this opens up significant privacy issues which have not been communicated properly to the internet at large. I quote from the DMARC specification, RFC 7489:</p> <blockquote> <p>When message-forwarding arrangements exist, Domain Owners requesting reports will also receive information about mail forwarded to domains that were not originally part of their messages’ recipient lists. This means that destination domains previously unknown to the Domain Owner may now become visible.</p> </blockquote> <p>The attacks presented in the next section exploit this <em>specified behaviour</em>, which is inherent to DMARC aggregate reports sent by a very large proportion of email service providers. The providers sending these reports vary in size from individuals’ personal mail servers to behemoths like GMail and yahoo. Forensic reports are even worse, again quoting from the specification:</p> <blockquote> <p>Failed-message reporting provides message-specific details pertaining to authentication failures. Individual reports can contain message content as well as trace header fields. […]</p> <p>although the [format] used for failed-message reporting supports redaction, failed-message reporting is capable of exposing the entire message to the report recipient.</p> </blockquote> <p>Luckily very few email providers send DMARC forensic reports, for obvious reasons: not only the breach of privacy inherent in sending detailed reports but also the potential for amplified (or even self-reinforcing) backscatter DDoS attacks and the cost associated with significantly increased processing effort on their own machines.</p> <h2 id="attack-1-reflected-self-exfiltration-using-aggregate-dmarc">Attack 1: Reflected Self-Exfiltration using Aggregate DMARC</h2> <p>This is the simplest case, when an attacker arranges that an email is sent with their domain as the From, and elects to receive DMARC aggregate reports. The attack email (which can have any content or none, and could even be rejected by the server per DMARC rules) is sent to an address that does not personally identify the victim, but forwards to a domain that does. This could be a mailing list, anonymous forwarding address, or web service.</p> <p>When the victim’s domain’s mailserver receives the email, and dutifully returns the DMARC aggregate report, their personality will be revealed.</p> <h3 id="example-1">Example 1:</h3> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>malicious@attacker.example -&gt; xxx@mailinglists.example -&gt; itsme@alice.example </code></pre></div></div> <p>The attacker sends an email to a mailing list submission address, <code class="language-plaintext highlighter-rouge">xxx@mailinglists.example</code>. The attacker does not know what the recipients of their mail will be, because the mailing list does not publish subscriber information. The attacker’s email is forwarded to <code class="language-plaintext highlighter-rouge">itsme@alice.example</code>, an address that identifies the victim, Alice.</p> <p>The receiving server for <code class="language-plaintext highlighter-rouge">alice.example</code> then send a DMARC report to the attacker, identifying <code class="language-plaintext highlighter-rouge">alice.example</code> as the sender of the report. The attacker now knows that Alice subscribes to the target mailing list.</p> <h3 id="example-2">Example 2:</h3> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>malicious@attacker.example -&gt; totallynotbob@gmail.com -&gt; hi@bobworld.example </code></pre></div></div> <p>The attacker sends an email to an unknown address that does not identify the victim, here <code class="language-plaintext highlighter-rouge">totallynotbob@gmail.com</code>. This mail is then forwarded to <code class="language-plaintext highlighter-rouge">hi@bobworld.example</code>, an address that identifies the victim, Bob.</p> <p>The receiving server for <code class="language-plaintext highlighter-rouge">bobworld.example</code> then sends a DMARC report to the attacker, identifying <code class="language-plaintext highlighter-rouge">bobworld.example</code> as the sender of the report. The attacker now knows that <code class="language-plaintext highlighter-rouge">totallynotbob@gmail.com</code> is actually Bob.</p> <h3 id="example-3">Example 3:</h3> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>malicious@attacker.example -&gt; potato on InnocentWebCommunity.example, via web form -&gt; contact@charliesplace.example </code></pre></div></div> <p>The attacker sends an email to <code class="language-plaintext highlighter-rouge">potato</code>, a user on InnocentWebCommunity, via the web form on <code class="language-plaintext highlighter-rouge">InnocentWebCommunity.example</code>. The email is sent by the web service to <code class="language-plaintext highlighter-rouge">contact@charliesplace.example</code> with its <code class="language-plaintext highlighter-rouge">From</code> header as <code class="language-plaintext highlighter-rouge">malicious@attacker.example</code>. <code class="language-plaintext highlighter-rouge">potato</code> is not an identifiable username and the malicious attacker wants to find out their real information.</p> <p>The receiving server for <code class="language-plaintext highlighter-rouge">charliesplace.example</code> then sends a DMARC report to the attacker, identifying <code class="language-plaintext highlighter-rouge">charliesplace.example</code> as the sender of the report. The attacker now knows that <code class="language-plaintext highlighter-rouge">potato</code> is actually Charlie.</p> <h2 id="attack-2-forwarded-reflected-exfiltration-using-aggregate-dmarc">Attack 2: Forwarded Reflected Exfiltration using Aggregate DMARC</h2> <p>In this case, similar to Attack 1, the attacker arranges that an email is sent to the victim with the attacker’s domain as the From, and elects to receive DMARC reports for that domain.</p> <p>The attack email must be sent to an address that does not personally identify the victim, but that forwards to an address with domain that does. The difference in Attack 2 as compared to Attack 1 is that this identifiable-domain address then forwards the email on again, to another provider that sends DMARC aggregate reports.</p> <p>Since the personally-identifiable domain forwards the email, the IP and domain of its mailserver will become visible in DMARC reports sent by the ultimate receiving server back to the attacker.</p> <p>This is the more complicated case, which is not relevant to as many email users as Attack 1, but has been mitigated by very few third-party email-service providers, if any.</p> <h3 id="examples">Examples</h3> <p>All the examples for Attack 1 apply for Attack 2, when a final forward to <code class="language-plaintext highlighter-rouge">example@gmail.com</code> is performed by the personally-identified domain.</p> <h2 id="are-you-vulnerable">Are you vulnerable?</h2> <ul> <li>If your email addresses are only under generic domains, you are not vulnerable.</li> <li>If all the servers processing email for you do not send DMARC reports or participate in feedback loops, you are not vulnerable. (but you can’t assume things will stay this way)</li> <li>If you do not forward emails <em>from a custom domain</em>, and the servers processing mail for you anonymize DMARC reports, you are not vulnerable. (This applies to <em>most</em>, but not all, custom domain users on commercial mail hosts, and means Attack 1 is less potent than it might otherwise be.)</li> </ul> <p>Otherwise, if none of the above apply, you may be vulnerable. You should review your email pipelines and ensure that the appropriate mitigations, some of which are detailed below, have been applied.</p> <h2 id="what-can-you-do-about-this">What can you do about this?</h2> <p>The only foolproof method to avoid these attacks is to use a generic domain (e.g. hotmail, aol, etc.) to receive your email, and not to forward any mail to a custom domain once it is received.</p> <p>If you use your own domain, do not automatically forward mail from this domain. If you do need to forward mail in this situation, make sure you forward to a server you control and trust not to send DMARC reports.</p> <p>If you control your own mail servers, disable all DMARC reporting or delivery feedback loop mechanisms.</p> <p>If you don’t control the servers that receive your mail, switch to ones you do control or ask the server owner to disable all DMARC reporting and to not participate in delivery feedback loop mechanisms.</p> <h2 id="commentary">Commentary</h2> <p>The fact that this perfectly simple and obvious privacy leak has been standardised and adopted by the vast majority of email service providers (even many of those that cry about ‘protecting your privacy’) is rather mind-boggling.</p> <p>This speaks to the general state of affairs around email privacy - it’s basically an impossible task to fully protect yourself; without significant behaviour changes, and deep knowledge of the operation of all components in the email pipeline there are just so many holes that patching one makes little difference.</p> <p>My opinion is that there is a fundamental problem in the ecosystem: email standards are too complicated, and have not been designed with privacy in mind. When problems with existing standards have arisen, the solution seems to have been adding additional complexity layers on top of the existing ones.</p> <p>Unfortunately this is a problem of interoperability as email is a federated system which has developed over time; standards developers have attempted to keep backwards-compatibility when writing new standards but the negative effects of some of these decisions look rather more evident in hindsight than they might have appeared at the time.</p> <p>I don’t have any solution for this problem, nor do I believe switching to some alternative ecosystem is a good idea: if email didn’t work <em>ok</em>, then it wouldn’t be so successful as it is. Nevertheless, it’s sad that things are as bad as they are.</p>