Daniel Miessler's Blog, page 78

The Most Important Productivity Lesson I Ever Learned

Back in 2003, right after university, I read a book that completely upleveled my productivity.

The book was called Getting Things Done, by David Allen.

As the image above shows, it’s full system, but I’m going to save you a ton of time and just tell you the most important takeaway.

This is for things you’re worried about forgetting, not for creative contemplation.

Never let tasks or ideas sit in your mind without being captured.

It’s that simple. I’ll explain why.

The system I still use today

Whenever I go somewhere with both old friends and new people, my friends often start with,

Ok, check this out…

…and they look at me and have me pull out my Oxford unruled index cards, and my telescoping Space Pen.

And I do. I pull them out. Because I’ve been using the system faithfully for around 17 years.

The system itself is based on constantly capturing what needs to be done, determining if you can do it immediately, if it should be deferred, delegated, or broken into next actions.

And then you regularly check priorities and refresh accordingly.

But don’t worry about any of that unless you want to read the book and dive all the way in.

The only thing you need to remember

The entire system is based on the idea that your subconscious is built in a certain way. Specifically, it’s built to work on things that it thinks you might need later.

It’s like Clippy being annoying with the popups.

Your subconscious holds onto things it thinks you might be forgetting, and regularly interrupts you about them.

The problem with this is that people are not good at multi-tasking, despite all the hype in previous years, and we really need to be able to focus on a single task to get it done.

But if we’ve burdened our subconscious with tons of tasks that it heard and captured—but we didn’t write down—then it’ll be in perpetual state of panic about them, and it’ll constantly harrass you while you’re trying to work.

That’s the reason for the Prime Directive.

Never let tasks or ideas sit in your mind without being captured.

Capture them. Immediately.

I still keep my index cards and pen with me, because I like to draw as well as capture text, but you can use your mobile device for this as well.

That’s it. Capture. Everything. And then go back later (ever day or two), and put them into order, prioritize, etc.—using whatever system. But always keep your mind clear.

This keeps your mind available to fully immerse in your current task.

Summary


GTD is an awesome system, but you don’t need to do the whole thing.
The most important concept is that the subconscious captures any task that you didn’t properly capture, and then it occupies your mental resouces trying to process and remind you about them.
The way to deal with this is by never letting your subconsious play that role, which you do by capturing everything yourself.
This tells your subconscious to chill—because you have it handled.
This in turn lets you have laser focus when you sit down to do a given task, and you get way more done.

I don’t know all the variables involved, but I’ve used this system for almost two decades, and I have written close to 3,000 essays in that time, read over 1,000 books, and done dozens of other projects.

And I honestly credit my ability to produce this type of output—in large part—to the GTD system.

Try it.

Notes


Image from this excellent GTD summary. More

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

My Current Verdict on Nootropics

I’ve always been into vitamins. If I heard that it could make me stronger or faster, I was all about it.

I’m still all about some supplements.

But as I got older my priority moved from being strong to being smart. Back in the day the smart supplement was Ginko Biloba. I’ve probably had 30 lbs. of that stuff.

Not sure if it helped or not. Back then we didn’t really measure such things, or talk about causation and correlation. Placebo was our best evidence. Anyway.

Over the last several years some actual brain drugs have come out, and they’re a whole lot better than Ginko Biloba.

Acetyl L-Carnitine
Adderall
AlphaBrain
Amodafinil
Braingear
NueroPeak
Qualia

I’ve tried probably 10 of these (there are way more out there than I’ve listed or tried) over the last three years, with varying levels of success, and here’s what I’ve learned:

Yes, some actually work—and really well
The prescription stuff is powerful, and I recommend you get it legally through a doctor
Even the lighter, non-prescription options are somewhat effective
They affect people very differently
They all mess with your sleep


My verdict

Seriously talk to a doctor before you listen to anything I say here.

So here are my thoughts, after trying many of these over a long period.

Don’t use nootropics for more than 1-2 days at a time, with many days, weeks, or even months in-between.

I’m not talking about the prescription stuff with the lucid dreaming, but things like Alpha Brain.

The reason for this is that they make your brain active (I’m looking at you Alpha Brain), and they’ll give you lucid dreams. So you’ll spend a lot of time between being awake and being asleep.

It’s kind of fun at first, but after a while it gets annoying.

And even worse, after a few days, you will actually start feeling less sharp because… (drumroll sound)

You get dumber when you’re low on sleep.

This actually happens very quickly.

So nootropics can spike your mental performance for a day or two, if you’re getting good sleep, but if you keep taking them you’ll stop sleeping well and the net effect will be negative.

In short, sleep matters more than nootropics. Way more. So if you’re well rested, have had plenty of exercise, have had a healthy diet, and you take a safe nootropic that your (good) doctor is ok with, it is probably going to be amazing! Like some true Limitless stuff.

But don’t do it too often.

If you do, you’ll very quickly get to a place way worse than taking nothing.

Sleep, diet, and exercise are the sustainable version of what nootropics give you, and you should boost that combination very infrequently.

That’s my non-professional, non-expert summary.

Summary


Yes, they work, but only infrequently, and on top of good sleep, diet, and exercise.
When done properly, they’re pretty unbelievable.
Make sure you get the right stuff, and involve a doctor for any prescription options.
Sleep is everything. The moment you notice them messing with your sleep, it’s time to take a long rest from them.

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

The Difference Between Studio Headphones and Regular Headphones

After too many decades on this planet, I now understand the benefit of studio headphones, and what makes them different than normal (consumer) options.

My old set of Denons just died, so I decided to go with a pair of Audio-Technica ATH-M70’s.

Just to save you some time, the answer is threefold, in order of importance:

Accurate representation of the source audio
Extremely wide frequency range
Higher quality construction

Here’s a bit more on each of these.

Accurate representation of audio

Studio headphones are mostly used by professionals who need to know exactly how their audio sounds as they’re creating it.

So they can’t be getting any sort of help from the speakers or headphones.

You don’t judge voices by listening to them being auto-tuned.

Beats headphones had a reputation for being super bass-heavy, which a lot of consumers loved, but audiophiles hated.

Most headphones impart distortion—modifying the audio in some kind of way that they think makes it sound better.

So that’s the most important aspect of studio headphones: Accurate reproduction.

Frequency range

Because regular headphones don’t have much range they might not be able to detect bad things happening at extreme high or low frequencies. And those artifacts can be picked up by certain peoples’ ears, or magnified by certain equipment.

Studio headphones pull all that garbage out so you can hear it.

Construction quality

This one is minor but definitely present. Top end headphones just feel more sturdy and durable, and they’re likely to last you five years, ten years, or even longer due to their superior materials and construction.

My analysis

Analysis is a strong word; I’m a n00b.

The thing I first noticed with my new Audio-Technicas (playing the new Tool album) was an underlying hiss. That was disappointing, but as I continued to listen I immediately heard way more stuff going on that I’d not heard before.

To me everthing sounded really bright, which based on my research means my previous headphones were probably magnifying the low-end.

Listening to voice

A big reason I got these headphones is because I product a podcast, and I’m getting a bit obsessed with good voice/audio quality for the show.

One of the shows where I really like the audio is Sam Harris’ Making Sense podcast. So I listened to it with these headphones, and wow!

I could hear some clear noise in certain moments after he stopped speaking, which I think is due to a noisebridge. And my own audio sounds really bad under such scrutiny (which has caused a number of tweaks already.

In short, I am hearing way more in everything, from voice to music, than I ever have.

It’ll take some getting used to, but I doubt I’m going back.

Summary


Studio headphones are for people trying to find and fix impurities in source audio, so they focus on being able to hear everything without distortion or bias.
This includes having a much higher frequency range to find issues in strange places in the audio.
Regular headphones have a more limited range, and are generally biased towards low and high-end to give an impressive superficial sound.

I didn’t think the distinction was going to be that significant, but I was wrong.

The next time you consider a headphones purchase—especially if you’re into audio—you should explore some studio-quality options.

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

Unsupervised Learning: No. 193

.errordiv { padding:10px; margin:10px; border: 1px solid #555555;color: #000000;background-color: #f8f8f8; width:500px; }#advanced_iframe {visibility:visible;opacity:1;}#ai-layer-div-advanced_iframe p {height:100%;margin:0;padding:0}

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

The Philosophy Behind My New Product Discovery Idea

I am currently experimenting with an idea for the show that I’m calling Product and Service Discovery.

It’s pretty self-explanatory, except that I am fairly anti-ad and my show is subscriber (direct) supported, so I think the concept needs some introduction.

Basically, the idea is that I want to be able to do three things simultaneously:

Surface really cool, hand-picked products and services to readers and listeners
Avoid all the classic issues with having ads and sponsors, such as interrupting shows, having to worry about what you say, etc.
Make some money, from some of the sponsors. Maybe not the same amount as if they were a regular sponsor (because they can’t tell me what to do or how to do it), but to find a way to get some sort of support based on the fact that I’m giving them a shout-out.

I don’t think this is being done anywhere. Most content creators are fully ad-supported, and a few are member supported like I am.

But I find it extremely limiting to not be able to discover and surface cool stuff in my Discovery section. I could (and have), but there’s always a silent question when I read as an outsider:

Why did he mention that? Is he being compensated in some way?

And that’s what I want to (and need to) make very clear.

Basically, if I mention a product or service that’s not in the discover section, or that’s not in the clearly marked-up way that I use to highlight discovery, then it doesn’t matter how much I’m gushing about it—I’m not getting any money for it.

Never. Period. That’s gross.

What’s weird though, is that I will often be including products or services in the Discovery section that I am also not getting anything for.

I’m basically erring on the side of not getting paid but still surfacing really cool stuff.

But some of the things I surface there (hopefully) will eventually give me some sort of support for doing so. And I actually don’t want to call out visually which ones are which because I don’t want that to affect enthusiasm.

You should be confident that if it made it to that section, I’m all about it.

I may have worked something out with them to get supported, or I may not have. And it could be that they didn’t give anything for a while, but then they did, but they have since stopped. But I’m still talking about the product.

What it comes down to is trust. Your trust in me.

I’m telling you now, if it’s in that section I’m legit enthused about it (for real). And I’m going to spend a small amount of effort to get some support from those companies, but if they don’t or can’t pay then I might just feature them anyway.

That’s horrible business to say that in writing, but I doubt their marketing departments will read this anyway. This is for my subscribers, not them.

So that’s the deal. I’m maintaining my direct support model, keeping my complete autonomy, refusing to accept any scripts or rules, and seeing if I can get any support from companies I mention despite all those stipulations.

It’s an experiment, but I just wanted to give you all the thinking behind it in a transparent way.

Please do let me know if you have any questions or issues with this approach, or if you have any ideas on how to do it better.

Thank you!

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

My Favorite Superhuman Shortcuts

As I talked about in an earlier post, I just started checking out Superhuman. And the first thing I like to do with a new tool is learn its shortcuts.

Here are my core ones so far:

Basics & nav

This is how you search in Vim!

/ — search


shift-u — show unread


shift-s — show starred


c — compose


f — forward


enter — reply all


r — reply


shift-n — show new messages


cmd-enter — send

Unique

! — mark as spam


cmd—u — unsubscribe


cmd—; — use snippet


: — insert emoji


cmd-shift-7 — numbers


cmd-shift-8 — bullets


cmd-shift-9 — quote


tab — indent


cmd-] — increase indent


cmd-[ — decrease indent

Navigation

g—i — go to inbox


g—s — go to starred


g—d — go to drafts


g—t — go to sent

My favorites so far

My favorites out of all of these are:

/ to search

cmd—u — use snippet

g-i and g-s for nav

cmd-shift-i intro (move sender to BCC)

Overall, I really enjoy the extremely terminal-like feel to the interface.

Now lete’s see how I am getting along after a couple weeks.

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

First Impressions of the Superhuman Email Service

Like many others, I’ve been observing the hype around Superhuman for a while now. I signed up to get on the list forever ago, but forgot about it until a member sent me an invite a few weeks back.

Looks like the marketing worked.

That’s when I found out it was $30/month, which seems exorbitant in the current market. So much so that I was curious whether it was worth it.

Setup

So one thing that was interesting about the setup is that you can’t just download the client, connect it to your Gmail, and be on your way.

Sep 7, 2019 — I now think this was essential to me learning how to use it.

Nope—you have to set up a consulting appointment and have someone walk you through everything.

Having gone through it, this serves three not so subtle purposes:

It makes sure you know enough about the product to not think it sucks just because you don’t know how to use it.
It makes it feel like the product was (somewhat) customized for you, which makes you feel (somewhat) special.
It onboards you enough that you feel like you have some momentum with it already.

There’s a weird cult-like feeling to it actually. It makes people want to use it just because others aren’t, and you’ve seen behind the scenes, and you’re doing things with your email that others can’t.

Don’t underestimate how powerful this effect is.

Oh, and if someone makes fun of you for paying $30 bucks a month for it—that’s becasue they just don’t get it.

wink wink

Anyway, I see this as a massive inoculation against trying the service and cancelling. It’s almost like Elysium, where you want to stop paying the $50/month but you also don’t want to be the dumbass who stopped paying for something that actually helps.

It’s ingenious marketing.

Anyway.

The email clients

So there are two clients: a desktop client and a mobile client.

I’ve been a Spark user for quite some time, and that seems to be their main competition besides Gmail itself, so a good amount of the features seemed somewhat familiar from that.

A good example is the swiping left or right to perform certain actions.

Overall, the basic look and feel of the clients seemed very similar to Spark, with a few exceptions.

Superhuman is cleaner and faster than Spark.
Spark has more features (see above).
Superhuman is more ambitious (see below).


Superhuman is truly trying to change email

The thing that grabbed me during the consultation was that my associate was seriously versed on email workflows, and productivity research, and even pushed back on the way I was doing things.

I was like,

Yeah, I like it this way because X and Y.

And he came back immediately with,

Well, we don’t recommend you do it that way. We built everything around doing it this way instead, and I suggest you at least try it that way.

He wasn’t rude about it, but he wasn’t playing either. He was serious. He honestly believed that this way (archiving vs. leaving things in the inbox) would make a massive difference.

Part of that is just being a good account manager. You don’t want people canceling because they didn’t see much benefit. But another part seemed to be a genuine desire to see people do email in a different and better way.

I liked that.

What Superhuman does better than any other client

So here’s what I absolutely love about Superhuman.

It’s designed for keyboard interaction.

Not a little bit, but from the ground up. I can use Vim commands to navigate mail. Escape is a major player in the workflow. There’s a central command invocation interface (Cmd-K) that presents you tons of options.

And in general it’s just clearly designed to be used with high efficiency. And that combined with the philosophy of Zero Inbox, archiving vs. letting things accumulate in the inbox, etc., all make it a truly different thing.

It doesn’t feel like just a slightly faster and better Spark or Gmail. It feels different enough to be its own thing, which is admirable given how little has changed in email clients since Gmail came out.

Thoughts

I’m still in my first day, so I can’t tell you much more than these first impressions.

I’m actually already an Inbox Zero guy anyway, so that won’t be one of the switches.

Most importantly, I can’t tell you if it really will change anything about my workflow, or if it’s going to pretty much be email as usual. But I will update this post with thoughts after 1-3 weeks.

Summary


It really does feel different than other offerings.
$30 is a lot of money, so it better be a lot better.
Absolutely love the Vim-y feel to the interface.
Loved the true belief and conviction from the onboarding team.
I don’t love the sneaky lock-in techniques, but I understand them.

Ultimately, I think it’s worth trying out if you are willing to honestly try a better way of doing email.

But if you’re just looking for a better version of Spark, it’s probably not going to be worth $360/year.

See you in a bit for the update!

Update: Sep 6, 2019 — So it’s been a couple of days now and honestly it’s becoming pure bliss. The shortcuts are better than I could have imagined (it reminds me of my Mutt days), and I’ve converted to complete Inbox Zero by archiving absolutely everything. I think I’m definitely going to become a permanent customer. More updates to follow.

Update: Sep 7, 2019 — Loving the gorgeous backgrounds when you hit Inbox Zero. Here’s my summary so far, which could almost serve as a marketing line: It’s cleaner than Spark, faster than Gmail, and with an artistically minimalist design! Only thing I would like is the ability to customize some of the shortcuts, so I can make it even more like Vim. And an integrated inbox for multiple accounts. More updates to follow.

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

First Impressions with Superhuman

Like many people I’ve been hearing the hype about Superhuman for a long time now.

I signed up to get on the list forever ago, but forgot about it until a member sent me an invite a few weeks back.

Looks like the marketing worked.

That’s when I found out it was $30/month, which seems exorbitant in the current market. So much so that I was curious whether it was worth it.

Setup

So one thing that was interesting about the setup is that you can’t just download the client, connect it to your GMail, and be on your way.

No. You have to set up a consulting appointment and have someone walk you through everything.

Having gone through it, this serves three not so subtle purposes:

It makes sure you know enough about the product to not think it sucks just because you don’t know how to use it.
It makes it feel like the product was (somewhat) customized for you, which makes you feel (somewhat) special.
It onboards you enough that you feel like you have some momentum with it already.

There’s a weird cult-like feeling to it actually. It makes people want to use it just because others aren’t, and you’ve seen behind the scenes, and you’re doing things with your email that others can’t.

Oh, and if someone makes fun of you for paying $30 bucks a month for it—that’s becasue they just don’t get it.

wink wink

Anyway, I see this as a massive innoculation against trying the service and cancelling. It’s almost like Elysium, where you want to stop paying the $50/month but you also don’t want to be the dumbass who stopped paying for something that actually helps.

It’s ingenious marketing.

Anyway.

The email clients

So there are two clients: a desktop client and a mobile client.

I’ve been a Spark user for quite some time, and that seems to be their main competion besides GMail itself, so a good amount of the features seemed somewhat familiar from that.

A good example is the swiping left or right to perform certain actions.

Overall, the basic look and feel of the clients seemed very similar to Spark, with a few exceptions.

Superhuman is cleaner and faster than Spark.
Spark has more features (see above).
Superhuman is more ambitious (see below).


Superhuman is truly trying to change email

The thing that grabbed me during the consultation was that my associate was seriously versed on email workflows, and productivity research, and even pushed back on the way I was doing things.

I was like,

Yeah, I like it this way because X and Y.

And he came back immediately with,

Well, we don’t recommend you do it that way. We built everything around doing it this way instead, and I suggest you at least try it that way.

He wasn’t rude about it, but he wasn’t playing either. He was serious. He honestly believed that this way (archiving vs. leaving things in the inbox) would make a massive difference.

Part of that is just being a good account manager. You don’t want people canceling because they didn’t see much benefit. But another part really seemed to be a desire to see people do email better.

I liked that.

What Superhuman does better than any other client

So here’s what I absolutely love about Superhuman.

It’s designed for keyboard interaction.

Not a little bit, but from the ground up. I can use Vim commands to navigate mail. Escape is a major player in the workflow. There’s a central command invocation interface (Cmd-K) that presents you tons of options.

And in general it’s just clearly designed to be used with high efficiency. And that combined with the philosophy of Zero Inbox, arvhiving vs. letting things accumulate in the inbox, etc., all make it a truly different thing.

It doesn’t feel like just a slightly faster and better Spark or GMail. It feels different enough to be its own thing, which is admirable given how little has changed in email since GMail really.

Thoughts

I’m still in my first day, so I can’t tell you much more than these first impressions.

I’m actually already an Inbox Zero guy anyway, so that won’t be one of the switches.

Most importantly, I can’t tell you if it really will change anything about my workflow, or if it’s going to pretty much be email as usual. But I will update this post with thoughts after 1-3 weeks.

Summary


It really does feel different than other offerings.
$30 is a lot of money, so it better be a lot better.
Absolutely love the Vim-y feel to the interface.
Loved the true belief and conviction from the onboarding team.
I don’t love the sneaky lock-in techniques, but I understand them.

Ultimately, I think it’s worth trying out if you are willing to honestly try a better way of doing email.

But if you’re just looking for a better version of Spark, it’s probably not going to be worth $360/year.

See you in a bit for the update!

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

The Fundamental Differences Between Vim and Other Editors

I’ve been deep-diving on Vim lately, as I tend to every couple of years.

Check out my Vim 2019 Update.

In this rotation I’ve gone deeper than ever before—including going back to what makes Vim, well, Vim.

So this piece will capture as succinctly as possible what makes Vim different from other editors.

Emacs

Reminds me of Android actually.

Basically, the whole thing with Emacs is utter, complete, and absolute configurability. If you can think of it, you can have it.

That’s nice I guess, but as someone once said,

Thanks, I already have an operating system.

I don’t mean that in a purely dismissive way, even though it sounds like it. I get that it’s cool that Android and Emacs have ultimate configurability. I really do. I played in those worlds for some time myself, and it really can be enjoyable.

I just prefer an editor that can I don’t have to think about.

But what I came to realize is that configurability is inversely correlated with both intuitiveness and predictability, and I prefer those.

Vim’s intuitiveness and dependability comes from language legos

As it turns out, the reason Vim is so intuitive is because it works like a language. If you know English well, and you know how to say, “I want”, and you tend to like cookies, then you know how to say, “I want cookies.”

But if you later learn that you like cake as well, you don’t have to relearn a completely new phrase. Instead, you can just combine what you know, “I want”, with the new thing—“cake”.

That makes it so that you don’t actually have to remember that much once you know the keywords, which are:

There are others as well.

d: delete
c: change
y: yank

So those are basically verbs, and the nouns are equally intuitive:

w: word
s: sentence
p: paragraph

And then you have modifiers, like to t, and find f, which move up to and on top of the next instance of whatever you type next. So this would delete everything up to the next period (.).

dt.

Delete. To. Period.

That’s so easy to remember because we already know English, and Vim works in the same way! And the universal format looks like so:

Other editors—for whatever reason—don’t have this. They actually come up with largely independent commands for each thing, and they claim this is a strength because it’s infinitely configurable.

That’s cool. I get that. But the brain doesn’t have infinite recall, and you want your mind focused on your content—not on recalling a massive list of custom commands.

Bottom line here: Once you learn Vim you actually have far less to remember because you’re just connecting lego blocks that you already know from regular language.

Notes


I learned a lot of this over the years from a few great posts and videos. Here, Here, and Here.

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.

A Conversation with Ken Modeste

A while back I had the opportunity to chat with Ken Modeste, Director of Connected Technologies at UL, and I wanted to capture some of my takeaways from that conversation.

I had the conversation as part of the media at Blackhat 2018.

Here are some of the questions I asked:

What is the mission of UL at this point?
How does that relate to cyber?
How are you different from other organizations with similar charters?
Are you looking to do anything in the consumer space?
What projects are currently going on that you’re excited about?

First, let me say that I just thoroughly enjoyed speaking with Ken. It’s rare that I agree with someone so much on the topic of securing connected devices.

His big thing on the soul of the company was this:

We’re try to build foundations that can grow.”, which I think is exactly the right note to hit.

Ken Modeste, UL

Some of his other quotes:

You don’t wan to come up with a standard that’s 500 pages that becomes purely academic.

…and

Standards need have to have testable criteria.

…and he was quick to point out:

Test, not audit. You can audit an organization, and a process, but you can’t audit a product, you have have to validate and test the product.

Multiple areas within UL

One of the things we talked about was the structure of UL itself, where he explained there are several groups.

Finance
IT
CyberSecurity (Industrial, consumer)
ULCyber
UL CAP (cybersecurity cap)


The worst issues

I then asked Ken what he thought the worst issues were affecting connected devices, which I was curious about because I run the OWASP IoT Security project.

He gave a list that resonated quite strongly with me.

Weak or known credentials
Secure communication
No backdoors
Security configuration

He had an interesting point about this on Twitter as well, saying:

If you called these devices unsafe instead of insecure, you might have better results.

Takeaways

Ultimately what I like best about Ken is that he’s optimistic about the future.

He said that while there’s a propensity for nation states to cause some hiccups, he’s happy with how fast we seem to be adapting to problems.

He believes strongly that the best way forward is to link things to safety, because that’s something people understand.

As my final question I asked him how close are we to having a connected device safety rating on a product in the store?

He said that the problem with consumer goods is that people (companies) don’t want to cut into their small margin, and asked further if consumers would pay more for a 4 rating vs. a 3.

He prefers a binary approach to ratings instead, such as saying something more like, “X product is UL Approved”.

Don’t give the customer work, just tell them they can buy it or not.

100% agree on that, but I think there’s some room as well for a nutrition label, so maybe the answer is to have both.

Anyway, it was an enjoyable conversation with Ken, and I have honestly slept better knowing that people like him are spending their days working on this problem.

You can find Ken on LinkedIn, and on Twitter.

—

Become a direct supporter of my content for less than a latte a month ($50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.