Everything In Between

If your project so much as pretends to have a profit motive, I will tell you to go fuck yourself and your project.

How to: Securely configure Mac OS X for network packet sniffing with Wireshark

leave a comment

If you’re anything like me, you often run into a computer problem or five that could be diagnosed more quickly by taking a peek at activity on the network. The best general purpose tool for inspecting network activity has gotta be Wireshark. It’s an industry-standard, open source packet sniffer that you can use for fun and profit.

Installing Wireshark is easy enough since various installers are probably already available for your system. Some builds for Mac OS X, however, expect you to run Wireshark from an admin user account in order to actually capture network packets. Although it seems the official Wireshark package recently lifted the requirement of an admin user, its Mac OS X readme used to say:

On Mac OS X, the BPF devices live on devfs, but the OS X version of devfs is based on an older (non-default) FreeBSD devfs, and that version of devfs cannot be configured to set the permissions and/or ownership of those devices.

Therefore, we supply a “startup item” for OS X that will change the ownership of the BPF devices so that the “admin” group owns them, and will change the permission of the BPF devices to rw-rw—-, so that all users in the “admin” group – i.e., all users with “Allow user to administer this computer” turned on – have both read and write access to them.

Using your computer day-to-day as an admin user is generally a very bad idea because it means one wrong click has a much greater chance of causing problems. Instead, I use a “standard” account and would recommend you do the same. Moreover, if you’re using an unofficial Wireshark package on Mac OS X, such as one obtained through MacPorts (as I am), then you may not even have Wireshark’s startup item. This will likely result in a common “no capture interfaces available” error in Wireshark itself.

Most of the solutions on the Web will also just tell you to chmod the /dev/bpf* devices. That’ll work, but you’ll have to chmod them after every reboot. To fix that, you can mimic Wireshark’s own startup item with a Mac OS X launchd job. Here’s one minimally modified from a MacPorts patch for this issue:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Label</key>
	<string>org.macports.wireshark-chmodbpf</string>
	<key>Program</key>
	<string>/bin/sh</string>
	<key>ProgramArguments</key>
	<array>
		<string>/bin/sh</string>
		<string>-c</string>
		<string>/usr/sbin/chown root:wireshark /dev/bpf*; /bin/chmod g+r /dev/bpf*</string>
	</array>
	<key>RunAtLoad</key>
	<true/>
	<key>KeepAlive</key>
	<dict>
		<key>SuccessfulExit</key>
		<false/>
	</dict>
</dict>
</plist>

Save the above property list as a file named org.macports.wireshark-chmodbpf.plist (or something equally meaningful to you) and place it in your Mac’s /Library/Documents/LaunchDaemons folder. Unlike the original MacPorts patch and the old Wireshark package, this job changes the group ownership of /dev/bpf* to a group named wireshark.1

All you have to do is create a group named “wireshark” on your Mac, and add any user you want to give packet sniffing permissions to it. Once that’s done, load the launchd job by opening the Terminal and running the following command as an administrator:

sudo launchctl -w load /Library/LaunchDaemons/org.macports.wireshark-chmodbpf.plist

This way, only users in the “wireshark” group will be able to read from the BPF devices in Mac OS X, and you can still use your Mac as a non-admin user while packet sniffing.

  1. As of this writing, the official Wireshark package for Mac OS X will create a group named access_bpf for this purpose, basically equivalent to what I’ve named my wireshark group. []

Written by Meitar

July 15th, 2014 at 12:31 pm

Never have a career.

leave a comment

You are a multiplicity. […] The one and the many are not opposed to each other, okay? You can have one thing that is a multiplicity. A multiplicity. It’s such a strange phrase, “a multiplicity.” You’re a one thing that’s many things. You don’t have to add all up. “Who am I, REALLY?”

This is what a lot of capitalism, for want of a better word, wants from you: What am I gonna be? I’m gonna be…a CHEF! I’m gonna be…a MARKETING CONSULTANT! Right? “What am I gonna be?” Such a ridiculous question.

The question is what are you gonna do, today? What are you gonna do tomorrow? What are you gonna do for a year? What are you gonna do?

You don’t have to be something. What ARE you? “I’m a, a…I’m a financial analyst!”

“You ARE a financial analyst?” Aren’t you, like, ten million things? One of them happens to be “financial analyst” because, in capitalism, they make you work 60 hours a week? They really want you to be just one thing. They don’t want the financial analyst who comes in and he’s also smoking a spliff, listening to music, and writing an Opera, and doing all the other things he likes to do. Right? He has to be ONE thing.

So, these idiotic questions like, “What am I gonna do? What am I gonna be? What’s my career?” Right?

Career is the most insidious, evil question. Never have a career. Who wants a career? It’s the worst thing. Like, what am I gonna devote my entire life to that’s gonna make someone else a whole lot of money? That’s what the question is. Remember those questions that are on the [chalk]board on Tuesday: “What’s at stake? Who pays?”

The question, “Who am I? What am I?” It’s a ridiculous question. You’re a multitude. You’re many, many things.

Daniel Coffeen, in “Rhetoric 10: Lecture 8,” February 13, 2008.

See also:

Written by Meitar

June 19th, 2014 at 11:30 am

Posted in Crosspost,Maybe Maimed

Tagged with ,

New “Support Circle” feature in Predator Alert Tool for Twitter helps cyberbullying targets get help from friends

leave a comment

Tonight’s update to the Predator Alert Tool for Twitter adds a feature inspired by the award-winning Circle of 6 anti-violence iPhone app to help cyberbullying targets call for help when they need it:

This screenshot shows a small excerpt from a four hour long cyberbullying dogpile by @nullvoid9 on Twitter, with the new "Get help from your Support Circle" link under their tweet.

Your Support Circle are other Twitter users who you know and trust to publicly back you up when you’re getting bullied on Twitter. When you’re enduring cyberbullying on Twitter, you can use Predator Alert Tool for Twitter to get help from your Support Circle in one click. Everyone in your Support Circle receives a Direct Message asking them to help you, with a link to the harassing messages.

Just the other day, I was harassed on Twitter for more than 4 straight hours by a clique of pop social justice cyberbullies. As a result of that, I spent all night yesterday and all day today trying to come up with more ways to literally encode anti-bullying mechanisms into the technology that I use. As I said then:

[I]f we want to meaningfully address #cyberbullying we need to:

  1. build communication tools for target(s) & supporter(s) to connect, FAST.
  2. Change the way we think about abuse and #cyberbullying (and violence) from “a thing bullies do” to “an experience that a target endures,” and
  3. nurture mutually meaningful relationships w/other individual people (as opposed to “support causes for demographics”).

For me personally, this means continuing to literally encode these goals in Predator Alert Tool code. You can help by sharing ideas with me. Until you have an idea to share you can also help by sharing links to work I already did to encode ideas by @unquietpirate & others in code. Those links are easy to find on the Internet, e.g., on LifeHacker and at [my homepage], maymay.net.

The “Support Circle” feature I added to Predator Alert Tool for Twitter today is part of me enacting goal number 1: build communication tools for target(s) and supporter(s) to connect, fast.

As usual, sending me bug reports and feature requests are both equally appreciated, as are donations of food to keep me hacking.

Written by Meitar

June 16th, 2014 at 1:17 am

Predator Alert Tools for OkCupid, Facebook, and Twitter featured by LifeHacker.com

one comment

The Predator Alert Tool for OkCupid was featured on LifeHacker’s “After Hours” sex and dating themed site:

Predator Alert is a userscript, which means you’ll first need to install Tampermonkey for Chrome, or Greasemonnkey for Firefox, and then install Predator Alert. Once installed, the add-on will prompt you to log in to your profile, and walk you through a number of questions related to consent and sexual violence. By answering the questions, the tool gets visibility into the answers other users provide to the same questions, and it’s able to use their answers to raise the red flag if it finds someone dangerous. There’s a detailed installation guide and walkthrough here, and more detail on the nature of the questions at the link below.

Once you’re all set up, the tool does the rest of the work for you. As you browse OkCupid, the tool will visually highlight any user’s profile that’s answered those same questions in a concerning way (namely, one that implies that at worst, they have or are willing to sexually assault someone, or at the very least don’t care about the other party’s consent.) Similarly, each time you open a user’s profile, the tool snags the user’s profile picture and runs it through the United States’s Sex Offender Registry (via CreepShield.com) for facial recognition matches. It’ll display the match percentage next to their profile, and you can click it for more information[…].

[…]

Hit the link below to download, and read more about the methodology behind the tool. You can also grab it for other networks as well, including Facebook and Twitter.

Predator Alert Tool for OkCupid | Maybe Maimed but Never Harmed

Check out my blog’s Predator Alert Tool tag for lots more, including screenshots of the tools in action.

Written by Meitar

June 12th, 2014 at 11:33 pm

Why a “Predator Alert Tool” for Twitter?

leave a comment

Despite many “anti-bullying” campaigns, online harassment and cyberbullying are prevalent behaviors. Most anti-abuse efforts fail because they tend to focus on appeals to authority. The now-ubiquitous “Report Abuse” buttons on social networking websites like Twitter are one such example, yet their ubiquity have not curbed the behaviors or harm they purport to address or mitigate.

We believe these efforts have failed because cyberbullying and online harassment are cultural, not technological, problems inherited from a society where coercion and abusive behavior offline are normalized. Abusive behavior is no more successfully mitigated in the physical world through appeals to authority than it is likely to be mitigated in the online world through the same sorts of appeals. This is doubly true in an environment where the biggest “bullies” are the authorities themselves:

People who are being abused have no recourse, because the systems that are supposedly set up to help them actually harm them further. Victims of domestic violence who call the police are often jailed themselves, because the police are required to arrest somebody and choose to arrest the ‘hysterical’ victim over the seemingly ‘calm and rational’ abuser. When I was in grade school, this happened on a regular basis: Kids threw rocks at me, and then I got sent to the principals office, because I punched one of them. It didn’t matter that I punched them because they were THROWING ROCKS AT ME. It happens at all scales, including and especially on the Internet.

@maymaymx, Predator Alert Tool for Twitter developer

To put it less diplomatically, the Internet has been doing “report abuse” wrong because its admins are corrupt. The “Report Abuse” button should go to the rest of the user community, not just the site admins.

Predator Alert Tool for Twitter is the Twitter part of an Internet-wide anti-abuse effort to change the way people think about bullying, violence, and abuse. Rather than creating an opaque appeal to authority that silences people (such as current “Report Abuse” forms), it sends a radically transparent and contextualized signal boost to friends and supporters of the person who bullies and abusers target. Using Predator Alert Tool for Twitter, the targeted user can ask for help and support at the same time as they are alerting the rest of the Twitter user community about behavior they have experienced as abusive.

I began writing some further concept documentation for Predator Alert Tool for Twitter, because I don’t sound enough like a broken record for most people to even begin to understand what the hell I’m doing, yet. It’s really lonely being so (intentionally) misunderstood.

Written by Meitar

June 5th, 2014 at 1:28 pm

How Twitter “protects you from abusers” actually protects abusers

leave a comment

If you ever needed more proof that “the Internet is doing ‘report abuse’ wrong because its admins are corrupt,” here is a perfect case study.

Today I received the following email from Twitter:

Hello,

We have received a second complaint from an individual that your account, @maymaym, is in violation of the Twitter Rules (https://twitter.com/rules), specifically our rules regarding targeted harassment and abuse.

At this point, we have removed your account from Search.

Please be aware that continued abusive behavior may lead to your account being permanently suspended.

Thank you for your cooperation.

Thanks,

Twitter Trust & Safety

System Reference: ref:00DA0000000K0A8.500G000000Opgu6:ref

Here is my response, posted here because I’m sure I’ll need to refer to it later:

Hi,

Please be aware that the reports you are receiving about my account are from people who have specifically targeted my account in abusive ways. The tweets of mine they have reported to you are responses to tweets from them that are, themselves, abusive. I realize you are probably “just doing your job” but you should perhaps consider asking yourself whether or not the way you are currently doing your job enables or mitigates abusive behavior on your service.

Are the people whose accounts I have interacted with also being threatened with suspension? If not, can you explain why your enforcement of your Twitter rules is arbitrary rather than uniform?

Here are screenshots of the interactions in question along with links for your convenience:

There are, of course, many other examples. Since you are Twitter I know for a fact that you have the capability (even if you don’t have the desire) to actually examine the full context and history of the conversations excerpted above. The question is, since you have this capability, why aren’t you using it? Or, if you are using it, what reasoning have you used to determine the “abusive”-ness of the behavior involved, and, again, why in such a one-sided fashion if indeed it is so one-sided?

If Twitter, in fact, operates under a “whoever reported abuse first wins” model of moderation, perhaps Twitter should update its TOS to reflect its actual stance and not hollow populism?

Cheers,
-@maymaym

For those of you who still want to follow me “on Twitter” after I eventually get banned, you can do so here or here. (I told you these networks are already censored. Note especially how Tumblr censors you to protect rapists.)

See also:

Written by Meitar

June 1st, 2014 at 2:37 pm

Posted in General

Tagged with , ,

The real reason people are starving is because we think they deserve to.

leave a comment

My friend Ethan made an amazingly awesome online food map and I got quoted in this article about it:

Considered an anti-consumerism movement, dumpster diving, bin raiding or “skipping” as it’s known in England, where dumpsters are called skips, is said to have its originated with the Diggers, a group of 1960s artists and activists who lived in San Francisco’s Haight-Ashbury district and distributed rescued food on the streets.

Who are today’s divers? Meitar Moscovitz (screen name MayMay), a traveling software programmer, says he lives on the road and depends on FallingFruit for “literal sustenance.” His best find so far was around $100 worth of recently expired cheeses.

“It’s been amazing to realize that wherever I am, food is not far away,” says Moscovitz. “My situation may seem unusual at first, but a lot of people I’ve met dive.”

Definitely check out the article and for real definitely check out FallingFruit.org/dumpsters itself. But I just wanna correct the record that, while I’m sure one can get “$100 worth of recently expired cheeses,” I never have and I don’t know where that came from. Here’s the email exchange I had with the piece’s author, Lori Rotenberk:

Hi Lori,

My friend Ethan wrote me recently letting me know that you’re looking for a perspective on FallingFruit.org for Civil Eats.

Basically, I’m “the information age equivalent of Johnny Appleseed,” by which I mean in I travel the country writing free software for good people. I live on the road, and I don’t have a job, which means FallingFruit.org has been an incredible source of literal sustenance. It’s been amazing to realize that where ever I am, food is not far away. My situation may seem unusual at first, but a LOT of people I’ve met dumpster dive, or garden, and they’ve been similarly thrilled to find a resource as global and important as FallingFruit.

We’re all so used to being bombarded by cultural messages of scarcity, but FallingFruit is a window onto what I’ve come to understand as a fundamental tenet of nature: there is abundance in simple things. It saddens me to see people go hungry, and then be blamed for their inability to get food because they lack money, when the fact of the matter is that there is more than enough food to go around.

People are not starving because they do not have the money to pay for food. People are starving because we lack the decency to ensure no one needs money to eat. Falling Fruit is a way to show people just how true that is.

Thanks for writing up the project! I’m glad to see it gain more exposure!

Cheers,
-maymay
Maymay.net
Cyberbusking.org

On May 15, 2014, at 12:49 PM, Lori Rotenberk wrote:

hi maymay — i need your real first and last name, age and town where you are diving

do you dive and where and what have you been able to get to eat via dumpsters?

Hi Lori,

Well, maymay is my real name but if you’re asking for my legal name it is Meitar Moscovitz. :) I’m currently 29 but I began diving at 26.

I first started diving in Washington, DC (well, technically Arlington, VA). But, as mentioned, and I know it’s somewhat unusual, I travel a LOT. Like, I’m in a new town every month, and haven’t stopped moving around since 2011. So I’ve also dived in towns like Middletown CT, Boulder CO, and Corvallis OR.

Mostly the food stuffs I find and keep are plastic-wrapped goods like frozen burritos (Trader Joe’s is notorious for over-plastifying its food, but that means it’s easy to process [clean] after diving for it) but FallingFruit has some fantastic grocers’ dumpsters. A friend of mine in Eugene talks about the BEST cantalopes he’s ever had being from an organic grocer’s dumpster. Produce is harder for me to store because I live on the road and don’t have a fridge. Sometimes I can even get relatively fresh pizza from the back of semi-local chains like American Dream Pizza in Oregon.

So, I guess you could say the range of food is anything other people are throwing out, which turns out to be most food you can imagine. :)

Cheers,
-maymay
Maymay.net
Cyberbusking.org

See also:

Written by Meitar

May 27th, 2014 at 3:49 pm

Predator Alert Tool for Twitter is here.

one comment

I released the code for my proof-of-concept and first functional prototype of the Predator Alert Tool for Twitter to the public domain. If you want to try it out yourself, you can use the public Predator Alert Tool for Twitter facilitator at https://pat-twitter.herokuapp.com. I’ve seeded it with a demonstration warnlist called “Reputation-addicted putzes” onto which I’ve placed the Twitter accounts of @JillianCYork and @CharlieGlickman, as starters. Here are some screenshots.

  • This screenshot shows the Predator Alert Tool for Twitter displaying a "Predator Alert" from a public warnlist on the user profile of @JillianCYork, who was added to the list "Reputation-addicted putzes." in the current version 0.1 of PAT-Twitter.

    This screenshot shows the Predator Alert Tool for Twitter displaying a “Predator Alert” from a public warnlist on the user profile of @JillianCYork, who was added to the list “Reputation-addicted putzes.” in the current version 0.1 of PAT-Twitter.

  • Using Predator Alert Tool for Twitter, any and all links to the profile, tweets, or lists of a user who is on a Predator Alert warnlist you've subscribed to are redboxed. In infamous Predator Alert Tool style, click through to their profile to view the alert's details.

    Using Predator Alert Tool for Twitter, any and all links to the profile, tweets, or lists of a user who is on a Predator Alert warnlist you’ve subscribed to are redboxed. In infamous Predator Alert Tool style, click through to their profile to view the alert’s details.

  • The Predator Alert Tool for Twitter is distributed to users through "facilitator" websites that keep copies of public data (and only public data). These facilitators also allow you to browse public warnlists and view alerts attached to specific Twitter user accounts. These alerts can not be removed or edited, ever.

    The Predator Alert Tool for Twitter is distributed to users through “facilitator” websites that keep copies of public data (and only public data). These facilitators also allow you to browse public warnlists and view alerts attached to specific Twitter user accounts. These alerts can not be removed or edited, ever.

Feature requests, patches, and bug reports for Predator Alert Tool for Twitter are welcome. Copying is encouraged. Don’t trust me; run your own server for your community and add me to as many warnlists as you want.

Just as before, I welcome your anger, too.

Written by Meitar

May 22nd, 2014 at 7:05 pm

Unlike Twitter itself, Predator Alert Tool for Twitter is a private-by-default, public-by-effort application.

leave a comment

I’m still hacking away on Predator Alert Tool for Twitter, but I’ve just finished putting some final wax and polish on the user interface for warnlist privacy options. What’s really exciting about this is that, unlike Twitter itself, in Predator Alert Tool for Twitter, “private” actually means what it says on the tin.

When you make a “Private” Twitter list, Twitter claims that “only you can access this list.” But we know that’s not entirely true. Twitter themselves can also always access that so-called “private” list. Moreover, if your Twitter account gets hijacked by someone else, they can also access that list.

In contrast, when you make a “Private” PAT Twitter warnlist, not even Twitter themselves, nor anyone accessing your Twitter account can access that list. That’s because the warnlist you make private never leaves your Web browser.

Predator Alert Tool for Twitter is a private-by-default, public-by-effort application in the sense that when you mark some of your data "private," it never leaves your Web browser without your knowing about it. Not even Twitter can read your private lists. Because that's what privacy is supposed to mean.

What’s important to understand here is that when you “delete” something from a service like Twitter or Facebook, you’re not actually deleting anything. All you’re doing is asking them, to please not show that to anyone anymore. But those companies still keep a copy of the thing you supposedly “deleted.” Y’know, for their records. They’ve been doing that ever since the start. And if you thought you had embarrassing photos on Facebook, have you checked FetLife lately? Yup, FetLife is even worse in this respect.

Another consideration showcased in the Predator Alert Tool for Twitter screenshot shown here is the notion of “data portability,” or the idea that “you can take your data with you wherever you go.” That’s why each warnlist you make also includes an “Export” button, which gives you a plain text file containing a backup of your warnlist’s data, including all of the Predator Alerts you added to it. If you use multiple browsers, you can export a list you created in Mozilla Firefox and import it into Google Chrome, for example. And when you do that, it stays in that browser.

You can also use the “Export” feature to share warnlists in a truly private fashion, such as by sending the exported list to a friend over encrypted email. Of course, your privacy is ultimately your responsibility. The point here is that Predator Alert Tool for Twitter is designed to help you maintain that privacy with as little effort as possible. Inversely, the MO of sites I’m building Predator Alert Tools for, like Twitter, Facebook, FetLife, and OkCupid are all about violating your privacy.

So, there’s that.

For a higher-level overview of the upcoming Predator Alert Tool for Twitter, see my user interface preview. And, as always, donations (especially of food) are appreciated. Okay, back to work I go.

Written by Meitar

May 19th, 2014 at 6:47 pm

Artist devises face mask of his own face, makes many copies, sells them at cost, all to protect the residents of his home city of Chicago from surveillance

leave a comment

When you wear these ["URME Surveillance"] devices the cameras will track me instead of you and your actions in public space will be attributed as mine because it will be me the cameras see. All URME devices have been tested for facial recognition and each properly identifies the wearer of me on facebook, which has some of the most sophisticated facial recognition software around.

Artist Leo Selvaggio of Chicago, IL lives in one of the most surveilled cities in America. I spent only several weeks in the city, but I was utterly spooked. My hometown of New York City is quickly becoming a similar dystopian future.

Rather than sabotage surveillance cameras, which I fully support, by the way, and have wanted to start a campaign around for a while, Selvaggio invites “the viewer to consider the malleability of their own identities by misrepresenting and corrupting” his own:

I have been interested in thinking about identity as data in the face of social media and how this “data” is tied to the larger context of surveillance and its effects on how we perform those identities in public space.

This feels a bit like a remix of that famous penny arcade aphorism:

Normal person + Anonymity + Audience = Total Fuckwad

Of course, Penny Arcade’s Greater Internet Fuckwad Theory (more academically known as the online disinhibition effect) has been thoroughly disproven, yet it’s still used as an excuse by companies like Google and Facebook (and, not incidentally, your local police department) to pin your legal identity to every action you take. Danah Boyd rightfully calls the insistence on this identity pinning “an abuse of power” on the part of these companies, but she stops short of accusing the police and the government of doing the same thing, even though they obviously are (which betrays her own bias, but that’s neither here nor there).

Put bluntly, anonymity is not the magical X factor that turns ordinary gold-hearted citizens into Total Fuckwads. Those commenters were already Total Fuckwads.

Given that, I think Selvaggio’s greatest threat comes not from someone “corrupting” his identity, but from The Powers That Be who will make him into a criminal for helping others temporarily abandon their own. The writing is on the wall: helping other people use your own identity online (such as by sharing your HBO password) is in fact already a felony.