Let’s talk respirators!

{{previous post in sequence}}


nuclearspaceheater:

brin-bellway:

What’s a respirator?

Short version: it’s like a mask, but better. *Much* better.

Let’s put the headline news up front: if you maintain an airtight seal at all times, a P100 respirator blocks 99.97% of incoming viral particles. [source]

Yeah. 99.97%. That’s a *lot*.

(Specifically, we are going to be talking about what’s called “elastomeric” respirators. These have a base unit made of plastic and silicone, with attachment points on the cheeks for swappable filters.)

99.97%?! What’s the catch?! There’s gotta be a catch, right?

A few catches, but generally nothing dealbreaking.

The filtered air is very dry: take frequent breaks if you can to go outside (or somewhere else with clean air) and drink some water. I work 4 – 5 hour shifts for 2 – 3 straight days a week with a respirator and no water breaks, and that’s *doable* but dehydrating.

They muffle your voice a bit more than masks do. You’ll have to speak louder and probably be more careful with enunciation than usual, and talking on the phone will be very difficult.

The 99.97% figure is for *incoming* air. An elastomeric respirator does not, by default, filter outgoing air at all. This is okay for two reasons: one, since you can’t spread a disease you don’t have, protecting yourself *is* protecting others. Two, for even more protection of others you can tape a layer of cloth over the valve on the bottom of the respirator.

They cost more up-front (about USD$30 for a base unit and USD$11 per pair of filters), but they last for such a long time (more on that later) that in the long run it’s actually very economical.

So why isn’t everyone using them already?

Mostly because people don’t know about them. Cloth masks were supposed to be a stopgap measure until we had a chance to manufacture more respirators, but word never got out when the respirators had caught up. They do *sometimes* go out of stock still, but they’re very often available now.

Also, the kind of respirators we’re going to be talking about here are aimed at construction workers, which means people looking for “medical” masks tend to overlook them. But a particle is a particle, and there’s no reason you can’t use construction respirators against germs. In fact, in some ways they work even *better* against germs than they do against construction fumes.

What do I need to know about how to wear them?

First, check the fit. Take off your glasses if you have them, then put the base unit on and adjust the straps until the seal is airtight without being painful. You won’t be able to get an airtight seal if there’s facial hair in the way: you’ll need to at *least* trim it down very far, and probably shave it.

To confirm that the seal is airtight, there are two methods depending on whether the filters are attached right now.

  • If the filters are *not* attached: cover the attachment points with your palms and try to breathe *in*. If you can’t, the seal is airtight. (Except for the attachment points themselves, of course: *those* are big gaping holes in your seal if they don’t have filters on them. But we’ll be fixing that soon.)
  • If the filters *are* attached: cover the valve at the bottom with your palm and try to breathe *out*. If you can’t, the seal is airtight.

(You’ll want to confirm the seal every time you put the respirator on.)

Next, take a pair of filters and screw them onto the attachment points. (This is much easier to do if you’re not wearing the respirator while you’re doing it.) Be sure to screw them on very tightly, otherwise they might fall off. (I didn’t screw them on tightly enough my first time, and it was pretty scary when one of them fell off in the middle of a crowded restaurant. But now that I’ve gotten them on correctly, they stay put.)

Now you can wear it. If you have glasses, take them off first, then gently rest them on top of the respirator’s nose once you’ve put it on. Check the seal as above to make sure it’s airtight.

Once a week or after every outing, whichever is less frequent, wipe down the silicone (the part that sticks to your face and forms the seal) with some mild cleaning solution to keep the skin oils from building up. You can also wipe down the outside if you are concerned about fomites, but note that of the two styles of filter (more on that later) you can *only* wipe down the plastic cartridges, *not* the pink cloth circles. Here is the official manufacturer’s guide on cleaning these respirators [link]: note that “quat” is janitorial jargon for the type of cleaning solution that Lysol wipes are dipped in.

(Bonus tip: if you’re having trouble sourcing disinfectant wipes, look for bottles of “quaternary ammonium” *next* to the barren disinfectant-wipe section at the grocery store, put it in a spray bottle diluted to the level stated on the bottle instructions, then heavily spritz a paper towel with it. Voila, a disinfectant wipe!)

According to the CDC [link], the filters last somewhere between a month and a year depending on how much you need to conserve resources and how well you can avoid getting them wet or dirty. The main limiting factor on longevity is that the filters get clogged with fumes and dust from the construction work: if you’re not *doing* construction work or similar fume-heavy activities, they can keep going for ages. If you can still breathe through it and the filter hasn’t been wet, you’re good.

Where can I get them?

Depends on where you live.

United States of America:

Base unit (currently USD$27.81): https://www.amazon.com/3M-Facepiece-Respirator-Respiratory-Protection/dp/B008MCUT86

Filters:

If possible, I recommend getting them from ULine: https://www.uline.com/Product/Detail/S-20007/Reusable-Respirators/3M-7093-Hard-Shell-Particulate-Filter-P100

ULine has the water-resistant plastic-cartridge filters, is a very reputable dealer, and sells for a good per-pair price. The only trouble is that they sell 6 pairs at a time: split a pack with a group of 3 people if you can, so that each of you will have one spare set.

If you really need a smaller pack or if ULine is out of stock, you *can* get the pink-circle kind from Amazon: 3 pairs for USD$28.90 (https://www.amazon.com/3M-2091-Particulate-Filter-Pairs/dp/B00KYX8JBU), 1 pair for USD$12.80 (https://www.amazon.com/3M-50051131070009-Particulate-Filter-2091/dp/B07571LKP4).

The pink-circle filters are *not* water-resistant: try not to stay out in the rain very long or otherwise get them wet, and don’t try to disinfect them (just avoid touching them instead, and wash your hands if you do have to). Also, counterfeits occasionally slip into Amazon’s stocks: try Amazon filters on when you first get them, and if you can still smell anything through them, demand a replacement. You should *not* be able to smell anything through a true P100 filter.

Canada:

Base unit (CAD$44.19): https://www.amazon.ca/dp/B008MCUT86/

Filters:

Canada has branches of both ULine and Amazon. Read the tips I gave the Americans on filter selection: the same things apply.

ULine (6 pairs for CAD$89): https://www.uline.ca/Product/Detail/S-20007/Reusable-Respirators/3M-7093-Hard-Shell-Particulate-Filter-P100

Amazon (2 pairs for CAD$24.71): https://www.amazon.ca/Particulate-Nuisance-Organic-Release-2097PA1/dp/B007STCT00/

Amazon (1 pair for CAD$16.95): https://www.amazon.ca/3M-2097-Particulate-Filter/dp/B00328IAO0/

Other countries:

I don’t have links for these on hand. For the base unit, check your hardware and general stores for “3M model 7502 respirators”; for the filters, look for “3M bayonet-style P100 filters” and prefer the plastic cartridges over the pink circles if possible. If you can’t find any of those, try looking into other elastomeric respirators, but I don’t have any experience with other ones so you’d be on your own there. Remember that you should not be able to smell anything through an airtight P100 respirator: if you put the filters on and can still smell stuff, something’s wrong with those filters, go back to the seller and get them to either give you a better set or refund you.

Getting a respirator has been a life-changer for me, and I hope it can help you too. If you found this useful or know someone who would, please let people know.

Important correction: You can actually smell lots of things thru a properly working, plain P100 respirator, because many of the things that we can smell are gasses, which particulate filters do nothing against. This is fine for this purpose: SARS-CoV-2 and droplets that carry it are particles.

As I recall, I was surprised that you’d stopped smelling things when you got yours, but found out that the specific filters you were using were P100 filters with nuisance organic vapor filtering. These contain a relatively small amount of activated carbon which absorbs organic vapors at levels below occupational exposure limits that would require heavier vapor protection, as well as most of the vapors you’d smell in ordinary life, at ordinary concentrations.

Huh. That’s very good to know. I defer to your expertise.

(I’d seen multiple reviews saying that the *two* ways of detecting counterfeits were “suspiciously light” and “scent infiltration”, but since the intended audience doesn’t already have experience with these and wouldn’t know when one feels suspiciously light, I only kept the second one in.)

I would, in that case, recommend nuisance organic vapor filtering for the psychological benefits: respirator-specific anosmia is a great way to subconsciously reassure yourself that you’re not getting exposed to anything *else* in the air. (Admittedly this may be more of a me thing: since I’ve been using anti-pollen masks for years, I’m very accustomed to judging air quality by the amount of scent that gets through. (For pollen, the occasional whiff and a *bit* of background is generally fine, but if my sense of smell seems completely unimpaired I need to replace my mask.))

@nicdevera [link], I have occasionally tried jogging to work when I was running a bit late, and I find I can’t jog for very long in my respirator: I can’t quite get enough airflow. Biking would probably depend on how hard you’re pushing it.

(I get my exercise on a home treadmill, but I recognise that I am incredibly fortunate to have the housing space and stability for one, and also to have gotten it circa 2014 when demand was quite low and you could often pick a used one up for the price of moving it.)

It is becoming increasingly clear that I should have put this post under a read-more: not only is it fairly long, it’s going to need updates. @wingedcatgirl, @moral-autism, @sophia-epistemia, @drethelin: I don’t suppose y’all would be willing to go reblog the read-more version instead?


Tags:

#reply via reblog #covid19 #the more you know #oh look an update #illness tw


{{next post in sequence}}

Let’s talk respirators!

{{previous post in sequence}}


hunterstheorem:

brin-bellway:

What’s a respirator?

Short version: it’s like a mask, but better. *Much* better.

Let’s put the headline news up front: if you maintain an airtight seal at all times, a P100 respirator blocks 99.97% of incoming viral particles. [source]

Yeah. 99.97%. That’s a *lot*.

(Specifically, we are going to be talking about what’s called “elastomeric” respirators. These have a base unit made of plastic and silicone, with attachment points on the cheeks for swappable filters.)

99.97%?! What’s the catch?! There’s gotta be a catch, right?

A few catches, but generally nothing dealbreaking.

The filtered air is very dry: take frequent breaks if you can to go outside (or somewhere else with clean air) and drink some water. I work 4 – 5 hour shifts for 2 – 3 straight days a week with a respirator and no water breaks, and that’s *doable* but dehydrating.

They muffle your voice a bit more than masks do. You’ll have to speak louder and probably be more careful with enunciation than usual, and talking on the phone will be very difficult.

The 99.97% figure is for *incoming* air. An elastomeric respirator does not, by default, filter outgoing air at all. This is okay for two reasons: one, since you can’t spread a disease you don’t have, protecting yourself *is* protecting others. Two, for even more protection of others you can tape a layer of cloth over the valve on the bottom of the respirator.

They cost more up-front (about USD$30 for a base unit and USD$11 per pair of filters), but they last for such a long time (more on that later) that in the long run it’s actually very economical.

So why isn’t everyone using them already?

Mostly because people don’t know about them. Cloth masks were supposed to be a stopgap measure until we had a chance to manufacture more respirators, but word never got out when the respirators had caught up. They do *sometimes* go out of stock still, but they’re very often available now.

Also, the kind of respirators we’re going to be talking about here are aimed at construction workers, which means people looking for “medical” masks tend to overlook them. But a particle is a particle, and there’s no reason you can’t use construction respirators against germs. In fact, in some ways they work even *better* against germs than they do against construction fumes.

What do I need to know about how to wear them?

First, check the fit. Take off your glasses if you have them, then put the base unit on and adjust the straps until the seal is airtight without being painful. You won’t be able to get an airtight seal if there’s facial hair in the way: you’ll need to at *least* trim it down very far, and probably shave it.

To confirm that the seal is airtight, there are two methods depending on whether the filters are attached right now.

  • If the filters are *not* attached: cover the attachment points with your palms and try to breathe *in*. If you can’t, the seal is airtight. (Except for the attachment points themselves, of course: *those* are big gaping holes in your seal if they don’t have filters on them. But we’ll be fixing that soon.)
  • If the filters *are* attached: cover the valve at the bottom with your palm and try to breathe *out*. If you can’t, the seal is airtight.

(You’ll want to confirm the seal every time you put the respirator on.)

Next, take a pair of filters and screw them onto the attachment points. (This is much easier to do if you’re not wearing the respirator while you’re doing it.) Be sure to screw them on very tightly, otherwise they might fall off. (I didn’t screw them on tightly enough my first time, and it was pretty scary when one of them fell off in the middle of a crowded restaurant. But now that I’ve gotten them on correctly, they stay put.)

Now you can wear it. If you have glasses, take them off first, then gently rest them on top of the respirator’s nose once you’ve put it on. Check the seal as above to make sure it’s airtight.

Once a week or after every outing, whichever is less frequent, wipe down the silicone (the part that sticks to your face and forms the seal) with some mild cleaning solution to keep the skin oils from building up. You can also wipe down the outside if you are concerned about fomites, but note that of the two styles of filter (more on that later) you can *only* wipe down the plastic cartridges, *not* the pink cloth circles. Here is the official manufacturer’s guide on cleaning these respirators [link]: note that “quat” is janitorial jargon for the type of cleaning solution that Lysol wipes are dipped in.

(Bonus tip: if you’re having trouble sourcing disinfectant wipes, look for bottles of “quaternary ammonium” *next* to the barren disinfectant-wipe section at the grocery store, put it in a spray bottle diluted to the level stated on the bottle instructions, then heavily spritz a paper towel with it. Voila, a disinfectant wipe!)

According to the CDC [link], the filters last somewhere between a month and a year depending on how much you need to conserve resources and how well you can avoid getting them wet or dirty. The main limiting factor on longevity is that the filters get clogged with fumes and dust from the construction work: if you’re not *doing* construction work or similar fume-heavy activities, they can keep going for ages. If you can still breathe through it and the filter hasn’t been wet, you’re good.

Where can I get them?

Depends on where you live.

United States of America:

Base unit (currently USD$27.81): https://www.amazon.com/3M-Facepiece-Respirator-Respiratory-Protection/dp/B008MCUT86

Filters:

If possible, I recommend getting them from ULine: https://www.uline.com/Product/Detail/S-20007/Reusable-Respirators/3M-7093-Hard-Shell-Particulate-Filter-P100

ULine has the water-resistant plastic-cartridge filters, is a very reputable dealer, and sells for a good per-pair price. The only trouble is that they sell 6 pairs at a time: split a pack with a group of 3 people if you can, so that each of you will have one spare set.

If you really need a smaller pack or if ULine is out of stock, you *can* get the pink-circle kind from Amazon: 3 pairs for USD$28.90 (https://www.amazon.com/3M-2091-Particulate-Filter-Pairs/dp/B00KYX8JBU), 1 pair for USD$12.80 (https://www.amazon.com/3M-50051131070009-Particulate-Filter-2091/dp/B07571LKP4).

The pink-circle filters are *not* water-resistant: try not to stay out in the rain very long or otherwise get them wet, and don’t try to disinfect them (just avoid touching them instead, and wash your hands if you do have to). Also, counterfeits occasionally slip into Amazon’s stocks: try Amazon filters on when you first get them, and if you can still smell anything through them, demand a replacement. You should *not* be able to smell anything through a true P100 filter.

Canada:

Base unit (CAD$44.19): https://www.amazon.ca/dp/B008MCUT86/

Filters:

Canada has branches of both ULine and Amazon. Read the tips I gave the Americans on filter selection: the same things apply.

ULine (6 pairs for CAD$89): https://www.uline.ca/Product/Detail/S-20007/Reusable-Respirators/3M-7093-Hard-Shell-Particulate-Filter-P100

Amazon (2 pairs for CAD$24.71): https://www.amazon.ca/Particulate-Nuisance-Organic-Release-2097PA1/dp/B007STCT00/

Amazon (1 pair for CAD$16.95): https://www.amazon.ca/3M-2097-Particulate-Filter/dp/B00328IAO0/

Other countries:

I don’t have links for these on hand. For the base unit, check your hardware and general stores for “3M model 7502 respirators”; for the filters, look for “3M bayonet-style P100 filters” and prefer the plastic cartridges over the pink circles if possible. If you can’t find any of those, try looking into other elastomeric respirators, but I don’t have any experience with other ones so you’d be on your own there. Remember that you should not be able to smell anything through an airtight P100 respirator: if you put the filters on and can still smell stuff, something’s wrong with those filters, go back to the seller and get them to either give you a better set or refund you.

Getting a respirator has been a life-changer for me, and I hope it can help you too. If you found this useful or know someone who would, please let people know.

“Normies don’t know about this ridiculous-looking, uncomfortable, and unpleasant thing” is not why people aren’t using these.

Do you really, actually believe that I’m going to reach an audience of *normies* here?

Also, one of the great things about anti-ingress protection is that if other people opt not to wear it, that is *their* problem, not yours. You don’t have to fuck around with the game theory and herd effects and a-*bit*-of-anti-ingress-as-a-consolation-prize of cloth masks: it’s just “each person who wears it is one more person protected”, full stop. If even *one* person starts using a respirator because of this post, that is a job well done.

P.S. To be clear: this post was inspired by people complaining about being stuck without human contact for months and (they believe) potentially years at a time, because it was that or probably end up as a COVID vector.

Uncomfortable? Unpleasant? Compared to *what*? Not to solitary confinement.

(Ridiculous-looking, I’ll grant you, and I’ll grant that that deserved a mention.)


Tags:

#reply via reblog #oh look an update #discourse cw #covid19 #illness tw #long post


{{next post in sequence}}

{{previous post in sequence}}


f90f9ea9a89069bda9d435468a2f4a65a23c4707

collapsedsquid:

Since the beginning of 2020, customer satisfaction with scented candles has been dropping at a much faster rate compared to unscented candles.

(it’s easy to overlook the Twitter source link in the Tumblr metadata and there’s some useful context in there, so here’s another link to it)


Tags:

#followup to the previous post #which I had been wavering on whether or not to reblog for a couple days #but seeing this one made me decide in favour #illness tw #fun with statistics #covid19 #oh look an update


{{next post in sequence}}

{{previous post in sequence}}


gallusrostromegalus:

kyraneko:

gallusrostromegalus:

miswrit:

Not nearly enough “Sirius Black makes himself at home in Privet Drive because there’s nothing the Dursleys can do to get him to leave” fic out there, and it’s a crying shame.

Harry just rolling up like WHADDUP THIS IS MY EMOTIONAL SUPPORT FAMILAR HE EMOTIONALLY SUPPORTS ME BY MAULING PEOPLE WHO THREATEN ME.  And Sirus dog-charades AND THIS IS MY EMOTIONAL SUPPORT COUCH YOU CAN SIT ON THE FLOOR FUCKERS.

You know what else is good “Dudley gets on top of how fucked up his parents are faster” fic, and i feel like “Sirius Lives at Privet Drive” dovetails nicely into this:

  • Dudley, age 14 and realizing his mother’s Loving-but-Ill-advised cooking is setting him up for some serious health problems, and that he’s tall enough to look his dad in the eye now, so his previous rationale of “If he’s hitting Harry he’s not Hitting Me” doesn’t hold up now, and goes full Eye of The Tiger to cope.
  • This means Sirus gets dragged along on a lot of Parent-avoiding “Walkies”
  • So many that one evening after a fight Dudley is trying to round up Harry and Sirius for a cooldown run and Sirius groans “Oh you’re big lads you can jog to the tesco on your own.” from the couch
    There’s a hot moment of silence.
  • “He’s a Magic Dog.” Says Harry.
  • “What do you mean your dog is a 40-year-old man?”
    “What do you mean your Dad’s BFF?”
    “What do you mean convicted criminal?”
    What do you mean WIZARD HITLER WANTS YOUR HIDE??”
    “..Shit I gotta up my workout routine.”

    “You’re not gonna punch Voldermort out Dudley.”

    “Not with these wimpy biceps I won’t.”
  • Shit’s getting increasingly tense in the house so when Ron announces they have tickets to the Quidditch World Cup Harry has to ask “Hey, can Dudley come too?”
  • Dudley might be short on wizarding skills but one thing he’s learned at Fancy rich boy School is the art of Schmooze.  They meet Corneilus Fudge and Dudley charms the hell out of him. Fudge doesn’t even realize he’s not a Wizard.   Harry tries to impress upon him the ‘VOLDERMORT’S ALIVE WITH A CULT DIPSHIT” upon him and nearly ends up in tears before Dudley takes his arm and whispers “Let me Handle This.”
  • Thirty minutes later Corneilus is organizing a Task Force of Aurors. 
  • “What the fuck do they teach you there?” asks Harry.
    “Oh, buttering egos, Trigonometry, grift, the usual.”
    “What’s Trigonometry?” Asks Ron, walking with them on a field trip through Muggle London for Nandos.  Dudley’s Uncle “Gerald White” is supervising them it’s fine.
    Dudley stares for a moment.
    “You guys… are learning math, along with your Divination and Transmorfigication and whatsits, right?”
    There is an awkward silence. Even Sirius considers morphing back into a dog to avoid this conversation.
    “Oh for fucks sake.” Sighs Dudley, texting Hermionie to see if she brought her Muggle textbooks along.
  • (She Did)
  • IDK what happens when the school year starts but I love the idea of “Well some snitch (Snape) might notice if Sirus is hanging around, so instead he goes with Dudley to Fancy Rich Boy School.  Maybe they’re short a teacher there and he can reccomend his friend Remus, currently out of work for reasons that aren’t his fault…

Yassss!

  • “What’s trigonometry?” some pureblood at the World Cup asks him. “It’s a variant of arithmancy,” says Harry, who’s become somewhat adept at bullshitting translations between magical and muggle things when the incentive was avoiding Aunt Marge’s wrath.
  • Nobody’s ever heard of trigonometry except for one elderly pureblood witch, who had heard it mentioned once back in school by a classmate who went on to become a famous name in advanced and extremely theoretical arithmancy.
  • Everybody loses no time in agreeing that trigonometry must be this tremendously advanced arithmancy specialization and Dudley Dursley must be an absolute arithmancy prodigy to the point where even the arithmancy buffs don’t want to risk making themselves look stupid by asking him about his research.
  • OBVIOUSLY Dudley goes to some extremely foreign wizarding school with an advanced research program available. There can’t be many of them with an advanced “trigonometry” program like that, so nobody asks which school it is because what if there’s only one of them and they look stupid for not knowing about it?
  • Besides, Harry Potter, the Boy Who Lived, is giving him the time of day like he’s someone really important, so, yeah.
  • Oh, yeah, he’s definitely the type of absent-minded brilliance that forgets his wand regularly, head in the clouds with all those theorems.
  • Dudley actually takes up computer programming at Smeltings. He tried it out because he likes video games, and then sort of fell in love with the process, the building something up out of lines of code, the thrill of success when it works. The awestruck reactions of wizards who see a couple of his notebooks when he sits there scribbling out code on a spiralbound notebook with a ballpoint pen is almost tangible.
  • The ballpoints and the notebooks take some suspicion for their muggleness until Harry points out that you don’t need to pay attention to how much ink is left and when you need to dip it, so it’s perfect for somebody who might want to scribble out whole pages of that stuff without noticing whether they’ve run out of ink, and the notebooks have pages so you could remember where something is. Pretty soon quill-tipped ballpoints are all the rage and spiralbound parchment stacks are being sold in all the stores.
  • Somebody asks Dudley about his family history. “Oh, they’ve all been like me,” he says, “as far back as anybody remembers” and he means not-a-wizard, but everybody thinks the opposite.
  • His father is blustery and yells and prone to explosive bursts of anger, he says, and his mother is obsessed with cleanliness and etiquette, and everyone is perfectly happy to never suggest they’d like to meet them.
  • Once Dudley figures out that everyone thinks he’s a wizard, he and Harry have a solid laugh over it and Harry teaches Dudley what he’d need to know to continue the deception. Fred and George are brought into the equation and provide him with lots of cool tricks and such so that he can appear to do some small bits of magic now and again.
  • He eventually marries Daphne Greengrass, who knows about his muggleness at that point and loves the idea of getting one over on her overly bloodpurist parents without them ever knowing about it. Harry and Sirius quietly gift them Number Twelve, Grimmauld Place, and the assumption that Dudley has the sort of money that buys a historic Pureblood property as a starter home goes round and round.
  • Dudley ends up on the Board of Governors, and later Minister for Magic, and in their old age Petunia and Vernon suffer the mingled pride and fury that their son is a Government Minister and they can’t brag about it.

Two other AUs this goes well with:

  • “all the pureblood dipshits tithed thier land and holdings to Voldemort so when Harry kills him, all the assets go to him and now he owns half of wizarding UK.”
  • “early on his career as a wizard, Dudley goes to Wales to meet another Famed Arithmancer and becomes close friends with fellow videogame and rugby enthusiast Howell Jenkins.”

Tags:

#Harry Potter #fanfic #story ideas I will never write #abuse cw? #embarrassment squick? #oh look an update

Don’t use Bridgefy at protests

{{previous post in sequence}}


mostlysignssomeportents:

34b0e47a9de07ac985c1df576b2c4e53d81b7642

There are two iron laws of security that are often tragically ignored:

I. “There is no abstract ‘security’ – only security from some specific threat”

II. “There is no security in obscurity.”

Bridgefy, an app that’s been billed as a way for protesters to communicate securely, illustrates both of them.

Bridgefy is an offline messaging tool – a mobile app that uses Bluetooth to pass encrypted messages around a crowd  where there is no internet access.

It was originally billed as being useful for big festivals and concerts out in the countryside, where there were lots of people but little or no internet connectivity.

However, as protests have spread around the world, the company has promoted its product as a tool for at-risk protesters seeking to coordinate uprisings for which they might face severe retaliation, including imprisonment, torture and murder.

https://arstechnica.com/features/2020/08/bridgefy-the-app-promoted-for-mass-protests-is-a-privacy-disaster/

In April, a group of Royal Holloway researchers audited the app and found it severely unsuitable for these contexts, potentially exposing users to life-threatening hazards. They told the company about these flaws then, but have only now published their findings.

https://martinralbrecht.files.wordpress.com/2020/08/bridgefy-abridged.pdf

The researchers’ findings reveal that the threats to users from using the app at festivals are very different to the threats that protesters face in repressive regimes (“There is no abstract ‘security’ – only security from some specific threat”).

They also find that the product team made a bunch of mistakes that they overlooked, a common problem (it’s why I can’t find my own typos!) that exposed users to attacks from anyone who knew how to hunt for these errors (“There is no security in obscurity”).

For example, the app sends the ID of both the sender and recipient of every message “in the clear” (without encryption). That allows an attacker who intercepts this metadata to assemble social graphs: Alice knows Bob, Bob knows Carol.

This might expose concertgoers to some risk (for example, if Carol is arrested for selling drugs, Alice and Bob’s messages to her might put them under suspicion). But in a protest context, that exposes the whole movement to risk.

What’s more, the identifiers the app uses are tied to users’ phone numbers: an attacker at a concert would need access to a database that maps phone numbers to real identities. A state-level adversary can simply demand these connections from the phone company.

But not all the flaws in the system stem from the differences in threats at concerts and protests. Some of Bridefy’s flaws threaten users in ANY context, and stem from the developers’ own blind spots about errors in their thinking.

For example, the system doesn’t have any “out of band” way to initialize keys between users. That means that when Alice wants to send a secret message to Bob, she first announces to the whole network that she is Alice and this is her public key that Bob should use.

An attacker in the network can – rather than passing that message on – replace it with a message that substitutes their OWN key, and thereafter intercept, read, and relay all the messages from Alice to Bob (a “man in the middle” attack).

Worse than that, the actual encryption formatting used for the messages is PKCS #1, a system that has been deprecated since 1998 due to unsalvageable flaws.

The app also fails to do vital forms of input sanitization: it doesn’t check for “zip bombs” – small compressed files that, when decompressed, expand  to junk files that are millions of times larger. These bombs could crash enough devices in the network to shut it down.

Though Bridgefy has known of the vulnerabilities since April, they are only now announcing them. They attribute the delay to their fruitless internal efforts to remediate these defects, and their ultimate conclusion that their system needs to be rebuilt from the ground up.

They say they are now doing that work, rebuilding the app around the Signal protocol, which is very robust and has been widely probed to identify and shore up weaknesses.

It’s good that they’re doing this. A third iron law of security is that “Security is a process, not a product” – that is, security is always contingent, and requires constant tending and upgrading to patch newly identified defects.

We can’t and shouldn’t expect products to be perfectly secure – all we can ask is that product teams are transparent about which threats they considered in their design, how their products work, and which defects have been identified in them.

Unfortunately, while Bridgefy is doing the right thing by acknowledging these bugs, thanking the reasearch team, and fixing the bugs, the rest of their conduct is less than exemplary.

It was wrong to promote an app designed for concerts as a tool for protesters without considering the differences in the threats to those user populations.

Worse, though the team has known of these defects since April, they didn’t start correcting the record on end-to-end encryption promises until June. And, as Dan Goodin points out on Ars Technica, their messaging continues to imply that it is safe to use.

Bridgefy: even worse than previously believed.

(They lost me at “must have Internet during installation” [link]; I didn’t even get as far as security.)

((*reads articles* wait, hang on, verification is optional now? did Bridgefy become an actual functional mesh system in December and not tell anyone?? Bridgefy: *better* than previously believed???))

(((of course the *other* part of my misgivings about them were vague shady-corporation vibes, which have now intensified)))


Tags:

#promoted the above from a tag ramble because I thought it ought to be fully part of the thread #and also to be able to include that very relevant and timely link #101 Uses for Infrastructureless Computers #reply via reblog #oh look an update

{{previous post in sequence}}


brin-bellway:

rustingbridges:

brin-bellway:

rustingbridges:

not a big fan of that captcha thing where you gotta wait 30 minutes for google to decide if it wants to show you another bus

and that captcha thing where it never explicitly tells you if you succeeded or not, so you’re never sure if it’s making you do it like six times because you suck or because it’s just Like That

it reliably makes me do more on my browser With Adblock And Shit, whereas my chrome sellout browser just lets me press the button, so I figure it’s just like that

anyway with the fade out / in buses I think I noticed it doesn’t start the fade in until you focus the tab again, which is Hell

Yeah, in some ways having to do it like six times is a sign that I’ve *succeeded*: not at finding buses, but at preventing Google from tracking my identity.

I don’t think I’ve ever unfocused the tab, so I hadn’t noticed that part.

Update: on multiple occasions reCAPTCHA *has* now explicitly claimed that I failed to find all the crosswalks, and refused to let me through until I agreed to lie and say that those pictures that were clearly *rumble strips* were actually crosswalks. There was likewise an occasion where it wouldn’t let me through until I agreed to claim that an RV was a bus.

(if they’re using this as some kind of self-driving-car training program I shudder to think how that’s going)


Tags:

#AIs being Wrong on the Internet #oh look an update #reply via reblog #disappointed permanent resident of The Future


{{next post in sequence}}

{{previous post in sequence}}


moonlit-tulip:

One big problem with mystery shows, as compared with (well-signposted) mystery novels, is that they don’t give the viewers time to think things through before the parlor room scene. There’s no clear narrative break-point where the viewer knows they have all needed evidence to solve the mystery and can stop to think; even if the detective comments that they know who did it, what are you going to do, pause 3/5 of the way through the episode to comb over all the clues and discuss the mystery with your friends and so forth? That’s impossible during the initial serialized release (since TVs don’t allow one to pause), and impractical when watching via stream or disk (since it requires groups of people to take the generally-unnatural action of staying paused in the middle of an episode for an extended timespan, and that’s if they know where to pause at all).

Fortunately, there happens to exist an already-developed TV structure perfect for avoiding this problem: the structure of the 1966-1968 Batman series. Each two-episode story (which was the show’s default length, albeit with occasional exceptions (always in the longer direction, not shorter)) ends its first episode with Batman and Robin in some sort of death-trap, and its second episode starts with them escaping the trap and ends with them beating the story’s villain(s).

I’d really like to see a mystery show based on a similar structure. The default story length is two episodes. The first episode of each story ends with a dramatic reveal after which, by one contrivance or another, the audience is clearly told that the case is now solvable. The second episode then starts with the protagonists responding to the big reveal, and ends with the parlor room scene. Live viewers get a week to think through and discuss the solution between the episodes’ releases, and after-the-fact viewers get the advantage of a clear narrative break-point at which to coordinate their pausing-and-thinking, for an overall-improved mystery-solving experience relative to the current one-episode-per-story status quo.

(For bonus quality-of-life, make sure each episode is free to stream at least until the release of its associated parlor-room-scene episode, such that live viewers are on equal footing with archival viewers in terms of being able to rewatch pre-reveal episodes and refresh their memory about all the clues.)

maryellencarter replied: The 1970s Ellery Queen TV show had a point just before the last commercial break where Ellery would turn to the viewer, recap the case, and mention that it was now solvable. At original broadcast it would only have given you a few minutes to think things over, but it was sort of a thought in the same direction.


Tags:

#interesting ideas #story ideas I will never write #oh look an update #replies

{{previous post in sequence}}


sigmaleph:

shieldfoss:

korora12:

shieldfoss:

You can tell the people who hacked twitter were normies because they didn’t use Obama’s account to post about the chaos emeralds.

Or worse, posting about how someone stole his shoelaces and he can’t find them

Fuck that would have been the best

from @brin-bellway‘s tags:

#(I’ll admit I don’t get the chaos-emerald one but I do get the shoelace one)

https://knowyourmeme.com/memes/you-mean-the-chaos-emeralds


Tags:

#high context jokes #the more you know #oh look an update