Werd I/O

I like mail-in ballots because I can do my research as I go, on my own time, in my own environment. To me, it feels a lot closer to giving the process the time and attention it deserves.

I filled in my Pennsylvania primary ballot this morning. I’d never been a British voter (I’m not a British citizen), so moving to the US represented the first time I could actually vote for my representatives in the country I lived in.

Primaries are sort of a funny idea: you pledge yourself to a party ahead of time, and that party affiliation is public. It seems to me to be a little counter to the idea of a private ballot, which is the cornerstone of free and fair elections, but that’s the system we have. If you’re a registered voter for a party, you can vote in its primary, which helps to select which candidates will actually make it to the general election.

I already knew how I’d cast my vote for the big-ticket item — the President of the United States — but I had very little idea about down-ballot candidates like the Attorney General or the Treasurer. So I sat down with my laptop and, person by person, checked them out on:

• Ballotpedia
• Spotlight PA
• WHYY (my local public media station)
• Progressive and restorative justice groups like Reclaim Philadelphia
• Their own websites
• A general Google News search

Rather than look to a central party recommendation or trust one set of endorsements, I prefer to form my own opinions, triangulating between sources that care about the same things I do. I explicitly seek out criticism, including from the opposition party and opposing points of view, because even if I don’t agree with someone’s political position, they may bring up flaws that a candidate’s own party would not highlight.

And then I seal it up in an envelope and send it off. It feels good to vote. It feels important to vote (particular in this era). I’ll be crossing my fingers for the most compassionate, inclusive, peaceful outcome from our set of possible outcomes in November.

So much of what we build on the web is about connecting people.

It is impossible to connect people effectively without paying attention to social justice and equity.

Otherwise we’re just connecting the privileged with the privileged, creating ever smaller networks of influence, and learning nothing new.

Solidarity with the 28 Google workers who were fired for protesting Project Nimbus this week. Anonymous Google and Amazon workers described the project as follows a couple of years ago:

Project Nimbus is a $1.2bn contract to provide cloud services for the Israeli military and government. This technology allows for further surveillance of and unlawful data collection on Palestinians, and facilitates expansion of Israel’s illegal settlements on Palestinian land.

I have never worked for Google or Amazon, but I would like to think that I would have protested too.

There is nothing honorable about supporting your employer as it commits or facilitates human rights violations. Protesting is the ethical thing to do, particularly when you hold deeply-held beliefs like these:

We cannot look the other way, as the products we build are used to deny Palestinians their basic rights, force Palestinians out of their homes and attack Palestinians in the Gaza Strip – actions that have prompted war crime investigations by the international criminal court.

Human rights should always trump business.

Further to that, apparently some of these 28 workers hadn’t even protested — they’d just associated with the people who had:

Yeah, this was retaliation, like completely indiscriminate—people who had just walked by just to say hello and maybe talk to us for a little bit. They were fired. People who aren't affiliated with No Tech For Apartheid at all, who just showed up and were interested in what was going on. And then security asked to see their badge and they were among the 28 fired.

Not a good look, to say the least. The same goes for the scores of tech workers who — on a cursory glance of social media — seem to have been derisive of the protests. Shame on you.

From the OpenJS Foundation:

The recent attempted XZ Utils backdoor (CVE-2024-3094) may not be an isolated incident as evidenced by a similar credible takeover attempt intercepted by the OpenJS Foundation, home to JavaScript projects used by billions of websites worldwide. The Open Source Security (OpenSSF) and OpenJS Foundations are calling all open source maintainers to be alert for social engineering takeover attempts, to recognize the early threat patterns emerging, and to take steps to protect their open source projects.

Vigilance is good, and it’s worth heeding the advice and paying attention to the evidence presented here. The XZ Utils backdoor was a smart attack that very nearly caused havoc.

I think it’s also worth pointing out that we know about the exploit because it was in an open source project. Andres Freund was debugging a server resource issue when he uncovered the issue. Because the project — and its downstream client — were open source, he could investigate and find the intrusion.

It’s not clear how this would have panned out if this had been proprietary software: particularly on a team that was resource strapped or moving at speed. The same social engineering exploits that allowed Jia Tan to become a maintainer of the XZ Utils project would also see someone hired as a contractor by a tech team. If I was a nefarious actor who wanted to place an exploit in an important software library, that’s exactly what I’d do: go send someone to join the team as a contractor. While there are mandatory identity verification procedures for full-time employees (which we can certainly argue the pros and cons of), contractors have no such requirements.

I bring this up because all the advice I’ve seen to date has been directed at open source maintainers. Again, this is smart and good and should absolutely be heeded — but there’s a world of other software out there that is also critical infrastructure and which doesn’t enjoy the sunlight of open source projects. This isn’t an open source software problem; it’s a software problem. Everyone should be vigilant, regardless if there are eyes on their source code or not. And perhaps we should be even warier of projects whose code we can’t audit ourselves.

I hate writing resumés. There’s always been something about the format that never really sat right with me; each entry presents work I’ve done, sometimes representing many multiple years of my life, without explaining the “why” or the through-line of how I got there. It’s always felt to me like they’re missing the fundamentals of the human being behind them — the values and mindsets of the living, breathing person you’d actually be hiring.

On top of that, mine was stuck in a document, when all of my work is on the web.

So I set out to rewrite mine, make it web-first, and turn it into something that I feel like actually represents me and my career. You can check it out here: I gave it its own subdomain at resume.werd.io.

The default version now displays my career in chronological order, each life event building on the next, and includes things that, while not technically being work, informed the work I’ve subsequently done. You’ll find stuff like the electronic hypertext magazine I built as a teenager and the popular meme site I built at university, which wouldn’t normally find their way into a standard resumé, but do help define my expertise and how I approach projects.

From that page, you can flip to a more traditional reverse-chronological resumé that omits the non-employment content and removes unnecessary description. Because it’s an edited-down version of my story, rather than a collection of bullet points, it’s probably better than any resumé I’ve had in the past. It’s web-first but there are a few print-only CSS rules in there to make sure it prints or turns into a PDF really nicely. It’s also nicely responsive, so it displays well on both a laptop / desktop and a phone.

Behind the scenes, here’s how it works:

• Each element of my experience is a standalone HTML snippet file of the form startyear-endyear.html. Some are annotated to be “narrative-only”, which means that they won’t show up in the traditional view. The engine I wrote for this will also omit any entries marked “traditional-only” from the narrative view, but in practice I didn’t use that.
• In narrative view, the engine reads the files in alphabetical order. In traditional view, the engine reads them in reverse-alphabetical order. The effect is to order the entries chronologically or reverse-chronologically as described.
• Educational entries are marked as such. In narrative view they’re placed into the main flow; in traditional view they’re displayed at the end of the document.
• In narrative view, any HTML element with a class traditional is marked as display:none in order to hide it; in traditional view, any HTML element with a class narrative is hidden. This allows me to mix narrative content in with more traditional resumé content and only display them in one view.
• Everything is marked up with the h-resume microformat.

The most important thing for me was being able to write my story as a story, and then edit down accordingly. I’m pretty happy with it! Let me know what you think.

Syndicated to IndieNews

So, let’s get this out of the way first: I drive a Tesla Model 3. Yes, I know. And yes, even though I bought it a few years ago, there was plenty of evidence of the CEO’s bad behavior and of poor conditions in the factories. And I let my desire to drive an electric car override all that, and it was a poor decision, and now I’m stuck with it because it was also a very bad financial decision and it’s depreciated at such a rate that the diff of the value of the car and the remaining value of my car loan are not in a good place. It was silly. Can we just accept that? Okay, thank you. Moving on.

This month Tesla switched Full Self Driving (FSD) on .. as far as I can tell, every single car. It’s normally a five figure software-only upgrade, which you can pay for up-front or at the ongoing subscription price of $199 a month. But usage of the feature has been low, perhaps in part because if you’ve spent $40-90,000 on a car, spending another five figure sum is annoying, and perhaps in part because people generally value their own lives and the lives of the people they love. So now, for this month only, it’s free, and Tesla can juice their numbers.

And, yes, I tried it.

And let me be clear: nope. Nope nope nope nope nope nope nope.

I’ve rarely been so frightened behind the wheel of my own car. As an experience it ranks right up there with driving that one stretch of the 880 where you’re supposed to go at 45mph and everybody drives twice that, the time I was riding in a Lyft and was jackknifed by a tow truck, or that one time I was driving on the 101 North and a tech bro Lamborghini shot out of the Highway 12 offramp and came within two inches of hitting me, spun around in the road, and careened off into the distance.

To be added to those heart-stopping experiences soon, I have to surmise, is being hit by a Tesla in Full Self Driving Mode.

Unlike my Lambo encounter, I was driving at 25mph down my local road to the store. On this 10 minute drive (5 minutes there and back), my car clung surprisingly close to cars parked on the side of the road — but more importantly, I had to intervene once because, on a stretch of road that had been coned off and narrowed into one lane for both directions, it felt like the car was driving directly into an oncoming vehicle. It’s possible (and, in fact, quite likely) that the car wouldn’t have smashed into the oncoming Subaru. But it felt like it was about to, and I had no desire to make it a scientific test. FSD requires you to keep your hands on the wheel — a lean-back experience this is not — so safely intervening was very natural. The car then asks you to leave a recorded message explaining why you intervened, and the struggle is to use words instead of screaming over and over.

What’s particularly surprising to me is that FSD wasn’t just downloaded to my vehicle — it was switched on by default. At no point did I need to agree to the terms and conditions. All I needed to do was enter a destination into the navigation and pull the gear stalk down once (as if I was simply changing into another gear), and off it went. Autopilot, which is what Tesla calls its cruise control feature, is engaged in a very similar way, so I can see a world where a driver might even switch it on unintentionally.

So would I pay the money for it? Fear on this level seems like a pretty poor use of $12,000 or $199 a month. You can rent a horror movie for $2.99, and paying attention to America is free. But clearly I was curious. Genuinely, if the technology improved to the point where I didn’t feel like I was probably going to die, I would happily sit inside a self-driving vehicle. Less so, perhaps, for going to the store, but definitely for road trips. (Can you imagine an autonomous RV? It would cost an arm and a leg, but if I had the money, I would 100% use one to get across country.) Right now, though, I would rather pour vinegar onto my eyeballs. For those readers who don’t need to think hard about dropping $12,000 — I am not one of them — I would encourage you to spend the money on more caviar or whatever. This ain’t it.

I made some updates to ShareOpenly this weekend:

• The design now puts the shortlist of social networks you’re most likely to share to at the top.
• Firefish and Misskey are now supported.
• There are now instructions for adding “share to” ShareOpenly links to your site.

I also added “share this post” links to the byline of every post on my site, including on the homepage and from indices.

Support for more social networks, as well as a universal share icon, are in the works.