security research, software archaeology, geek of all trades
226 stories

Sewer Socialism | Itinerant Urbanist

Sewer Socialism | Itinerant Urbanist:

Sewer Socialism

Read the whole story
2 days ago
Mountain View, CA
Share this story

Webcomics Binge Read: Homestuck

1 Comment

I’m fit. I’m hydrated. This is it. Today I begin reading the entirety of Andrew Hussie’s Homestuck. Launched in 2009, Homestuck ended this April as one of the most wildly successful and passionately loved comics online. I knew something was going on when my college-age cousin came home with a full sleeve tattoo of Homestuck fan art, and I didn’t know what it was, Mister Jones.

I’ve previously attempted the archives twice and been forced to retreat over a trail of dead sherpas. But this time it’s do or die.

I dedicate this ascent to Jason Thompson, whose 48-hour Naruto binge read ( stands as an inspiration to all archive trawlers.

Here goes.



  • Homestuck was the fourth comic Hussie serialized on his website, MS Paint Adventures. Previous comics were scripted on the fly by taking suggestions from readers, and the early installments of Homestuck carry over the audience-participation element. But by this point Hussie’s fanbase was too big for the interactive element to remain workable, and it was mostly abandoned within the first year. Homestuck opens with a PC-game prompt asking you to enter a name for the protagonist, but you don’t actually get to choose one. He’s John.
  • Old-school video games form the central aesthetic, from the pixilated art to the game-based ways the characters interact with their world. For example, John and his friends have to handle items by turning them into “captchalogue cards” and placing them in an inventory. This gets confusing when they start playing a video game with its own rules within their already video-game-based world.
  • In the opening pages, Hussie plugs merchandise for his previous MS Paint comic, Problem Sleuth. I respect the hell out of that.
  • Hussie and I share a love of bad movies in general and the work of Nicolas Cage in particular. I didn’t know this when I mentioned Con Air in my own comic, and now all the nerds think I was making a Homestuck reference. Nic Cage exists beyond our petty mortal webcomics world, people.
  • “You pull up to your COMPUTER. This is where you spend most of your time.” John spends the next 50 pages IMing his online friends while making half-assed efforts to leave his room and check the mailbox. The narration isn’t kidding around here.
  • Okay, the plot. John receives a video game called Sburb for his thirteenth birthday. As he and his online friends Rose, Dave, and Jade begin toying with Sburb, they discover that it allows them to manipulate reality. It’s unclear whether they’re surprised by this. They’re already living in a world where objects can be turned into punchcards.
  • “You decide to space out on the computer for a while before doing anything important.” I’m going to keep track of every time there’s a line like this. God is telling me something.
  • As Homestuck goes on, it incorporates more and more multimedia elements. Panels consist of animated gifs, while big events are full Flash-animated cutscenes. You get the option of reading the characters’ online chatlogs, which you’d better do or the story will make even less sense. There are musical interludes and minigames. There are links to other websites. I get the feeling that, for Hussie, this formal experimentation is the most interesting part of comicking.
  • Several hundred pages in, John uses some of the peculiar machinery burped up by Sburb to create a glowing blue apple, and then a meteor crashes into his house. It doesn’t make any more sense in context. End Act One, and whew.



  • John’s neighborhood has been demolished and his house teleported to a void. According to Rose, who is still able to text him, similar disasters are striking Sburb players around the world. We get flash-forwards to a post-apocalyptic future where a mysterious figure, the Wayward Vagabond, relays commands to John in the past. Got all that? Good. We’ll check back in with the plot later.
  • Mordicai Knode, in an article for, wrote, “Homestuck is the first great work of genuinely hypertext fiction.” (Thanks, Wikipedia.) I guess he’s never heard of a little thing called Shelley Jackson’s Patchwork Girl. There: now I can say that taking a class called “Hypermedia and Phanopoeia” in college in 1996 was in no way a waste of my parents’ money.
  • The thing is, I suspect Knode is right. There’s a good chance Homestuck will be admired by future generations and I will look laughingly blinkered for kind of not getting it. I accept this and embrace my fogeyness.
  • Homestuck features a webcomic-within-a-webcomic, Dave’s deliberately bad comic Sweet Bro and Hella Jeff, with its own hideous website and buggy archives. It’s first linked to during a scene where Dave is reading another webcomic, a takeoff of previous MS Paint series Problem Sleuth. (“Even though the adventure began recently, it’s already over 3000 pages long. You just don’t have time for this bullshit.”) This is some Italo Calvino shit up in here.
  • Holy crap, Topatco actually sells all the self-consciously terrible merchandise advertised on the Sweet Bro and Hella Jeff site. I hadn’t realized Homestuck fandom had gotten that out of control, even after seeing my cousin’s tattoo.
  • John, the narrator, and the mysterious figure from the future are all arguing with each other in the narration text. This is pretty great if you’re into metafiction and read all the footnotes in Lanark: A Life in Four Books.
  • Or, all right, all the footnotes in Infinite Jest. I’m trying to prove that my junior year abroad in Dublin to study Irish and Scottish postmodernism was also a sound long-term investment.
  • Wouldn’t it be great if you were transported to another dimension where everything worked like Minecraft? No, it wouldn’t, because it would take ten million steps to walk up a flight of stairs and you’d have to keep stopping to fight pixilated monsters. And that’s why video games are the worst.
  • The cross-cutting between multiple characters at different points in time reminds me of my second-favorite video game ever, Day of the Tentacle, the sequel to Maniac Mansion. My favorite video game ever is Maniac Mansion.
  • The plot isn’t important, anyway. Homestuck is more about the innumerable jokes, digressions, weird conversations, and running gags Hussie can spin off each new incremental progression in the action. Right now, for instance, Dave is trying to shove a puppet down a garbage disposal, but is hamstrung by the fact that he can only give himself orders using a limited number of letters. This has been going on for pages. In the words of Enid Coleslaw, the movie version with the troubling sexual attraction to Steve Buscemi, it keeps going from bad to good and back around to bad again.
  • The animated cutscenes are getting more ambitious. The artwork remains at the same level of one-step-up-from-stick-figures sophistication, so Hussie wisely puts his effort into choosing strong images and cutting them together effectively. Like a good low-budget anime series, Homestuck does a lot with limited resources.
  • Act Two closes with a lengthy visit to the future as the Wayward Vagabond tries, sort of, to escape from his underground fallout shelter. He finally succeeds in launching the shelter into the sky and flying away on top of it, and it’s a beautiful scene. Like if they made an eight-bit NES game based on a Studio Ghibli movie. That never happened, right? The closest we got was Little Nemo: The Dream Master.
  • The clinical term for attraction to Steve Buscemi is “Busexuality.”



  • Hussie has teased the first on-panel appearance of Jade, the most recalcitrant member of the SUBRB-playing gang, for a long time, and now she finally appears. She’s cute. She even gets a little introductory minigame where you can make her play a flute, a testament to Hussie’s ongoing efforts to see how multi he can make this media.
  • Speaking of, an increasing number of pages are full-on animated sequences. Is Homestuck technically even a comic? Was it ever a comic? Or was it always one artist’s personal sandbox game sprayed with a thin veneer of comic-ness? This is when I really need the ability to pull Marshall McLuhan out from behind something.
  • First mention of the Trolls. These are the characters with candy-corn devil horns you see 300 teenage girls cosplaying as at anime conventions. I’d gathered that much about Homestuck from the lady internet before starting this binge read.
  • The lady internet is also where you learn which male Avengers should be making out, besides all of them.
  • “Oh look, there’s some more mad science crap over here.” This specifically refers to the underground lab Rose has found herself in, but it could apply to a lot of Homestuck.
  • Right, the plot. At the moment, each of the kids is penetrating an inner sanctum where he or she may hope to find answers, or possibly just more machines with overly complicated interfaces. For Rose, it’s an underground laboratory hidden beneath her cat’s mausoleum. For Jade, it’s the bottom floor of her island super-science tower. For John, it’s his father’s room, which he’s been kinda sorta trying to get into since the comic began. Dave is unavailable. Outside, the world is still ending.
  • None of them learn much, but Rose gets a kitty, so that’s cool.
  • Throughout the comic so far, much the action involves characters avoiding adults and looking for places to plug in their laptops. I’m starting to understand why it has a huge Millennial fanbase.
  • With Act Three, I’m starting to enjoy Homestuck. I’m not sure if it’s because the comic’s getting better or because it’s trained me to follow its peculiar logic and pace, like that fungus that makes ants climb trees so it can burst out of their heads and spore.
  • At long last, the kids have succeeded in booting up a second copy of Sburb, which should allow all four of them to play. Since turning on Sburb seems to trigger a meteor apocalypse, this seems like a bad idea, but they worked awfully hard to do it. And Jade says maybe Sburb didn’t cause the apocalypse; it was just a coincidence. So, um, go kids? And so long, Book Three.



  • A 200-page digression into the Problem Sleuth-like webcomic-within-a-webcomic. I take back everything I said about getting into the rhythm of Homestuck. This is cruel.
  • So this sequence follows the Midnight Crew, a group of toughs who previously appeared in Problem Sleuth, as they assassinate a bunch of green guys who all have different time- and probability-based powers. It’s a neat concept, albeit probably only here because Hussie hit a block on Homestuck and needed to switch to something different for a while.



  • John has crossed into a dark universe with luminous mushrooms and rivers of oil. Rose has entered the equally mysterious Land of Light and Rain. Jade and Dave are setting up their video-game server. That these three plot threads are treated as equally interesting, with a slight evident preference for the server stuff, sort of sums up Homestuck.
  • With the time travel and all the alternate-universe variations on the base setting, this is starting to remind me of Legend of Zelda: A Link to the Past, which was a boss game.
  • Every time I think I’ve finally got a rough idea what’s happening and I’m starting to get into the story, it cuts to, say, a past version of one of the post-apocalyptic survivors delivering a parking citation to an imp queen in an evil castle, and I’m like DAMMIT HOMESTUCK.
  • Sometimes Homestuck is fun, and sometimes it’s like watching someone else play a deliberately frustrating 1980s text adventure game. Which I guess could also be fun, if you’re drunk. I’d better get drunk.
  • Roughly 80% of the characters exist to provide exposition to the other 20%, and I still have no idea what the living hell is going on.
  • “YOU STARTED SOME [line break] SICK FIRES BRO” No hate, but some of these panels seem cynically designed to be lifted for social media gifs.
  • In the Homestuck universe, Internet trolls are aliens from another planet who also play SBURB. There are twelve of them, they communicate over IRC even to each other, and each has a different irritating way of typing wrong. I am not liking the Trolls so far.
  • The Trolls expend enormous effort to manipulate John into flying a jetpack. There’s sort of a reason, but it mostly happens because it makes a cool gif.
  • Happily, John is saved by the power of friendship. Anime is a huge influence on Homestuck.
  • I am so drunk now.
  • A wild cartoon Andrew Hussie appears to recap the plot and clear up points his readers were probably arguing over in the forums. (“John… accidentally prototyped the sprite with his grandmother’s ashes, transforming it again. This prototyping had no effect on the enemies, since he was already in the Medium, and the kernel had already hatched.” Oh, well, then.) For you, constant readers, I read all 5,590 words.   I now hate you all and have a slightly less murky idea of how time loops work.
  • John enters Rose’s room. This is worth noting because it’s the first time, thousands of pages in, that any of the four protagonists have met in the flesh. It would be kind of a big deal except Rose sleeps through the whole thing.
  • Did I mention that in addition to all the different realms and planets and time periods there is also a dream world with its own laws of reality? I only mention it because now one of the characters has turned into a pony and another into a hat. I think. Goddamn it.
  • Now John is making baby clones of himself and his friends that are destined to go back in time and become them. Okay, fine, that makes a kind of sense, and Andrew Hussie is good at drawing babies.
  • No lie, I laughed at the big Nic Cage-themed animated cutscene.
  • Crap’s getting real now. There’s a war breaking out, asteroids descending, armies of little blobby people getting mowed down by a giant demon clown, the whole nine yards. The main characters all get cool battle outfits, so you know it’s serious. Most important, Homestuck is only seven acts long, so I should be over halfway through by now.



  • Turns out the later acts are so long they get split into multiple parts. GODDAMN IT HOMESTUCK.


Part Two to follow…

Read the whole story
15 days ago
If you have been wondering what the deal is with this Homestuck thing but are reluctant to invest the time in reading the entire gigantic archive, consider reading this summary instead.
Mountain View, CA
Share this story

Brand New Subway

2 Comments and 9 Shares

Whoa, this is the coolest! Jason Wright's Brand New Subway allows players to alter the NYC subway system as they see fit. You can start with existing maps and the choices you make affect ridership and the price of a Metrocard.

Players can choose to start from scratch or one of several NYC subway maps (including present-day, maps dating back to the early 1900s, or maps from the future). They can build new stations and lines to expand the system to new areas, or tear it down and redesign the whole thing. The game intends to evoke an imaginative spirit, to empower people to envision transportation according to their needs and desires, and to arouse the fun of tinkering with maps.

This project is an entry in The Power Broker Game Design Competition, the goal of which is to adapt Robert Caro's The Power Broker into a playable experience. Wright explains how his game hits the mark:

Bottom-up vs. top-down design. Moses was infamous for his top-down approach to urban planning. He held "the public" as a concept in high regard while simultaneously showing contempt for the individuals who made up that public, in the form of arrogance, spitefulness, and an utter lack of concern for the millions displaced for his expressways and parks. Later on in his career, as the span of his projects increased, Moses would make monumentally important decisions about the fate of a neighborhood without once setting foot there. He was known for building 13 bridges and hundreds of miles of parkways despite never driving a car.

Although Brand New Subway might appeal to someone who enjoyed SimCity but who has never set foot in New York City, it's targeted primarily at those who actually ride the subway and who might feel invested in what they design. In that regard, it inverts Moses' paradigm by encouraging players to improve on transportation in their own neighborhoods and in ways to which they have a personal connection.

I reeeeeeally didn't want to spend the rest of my day playing with this, but that super express train from Manhattan to JFK isn't going to build itself! (via @byroncheng)

Tags: cities   Jason Wright   NYC   Robert Caro   Robert Moses   subway   The Power Broker   video games
Read the whole story
22 days ago
22 days ago
Mountain View, CA
Share this story
2 public comments
21 days ago
This is a browser game, for folks who are maybe giving this a miss because they think they need a platform to play it.
Portland, OR
19 days ago
I could spend endless hours and days messing with this. But then I get so eye-twitchingly angry about the vast underserved swaths of the city, and it stops being a fun game.
23 days ago
This is wonderful.... but somebody please hide this from me.
New York, NY
18 days ago
Whoa. I've never gotten much into sim games but I love maps and public transit and this sounds really awesome.

Frequent password changes are the enemy of security, FTC technologist says

3 Comments and 4 Shares

Shortly after Carnegie Mellon University professor Lorrie Cranor became chief technologist at the Federal Trade Commission in January, she was surprised by an official agency tweet that echoed some oft-repeated security advice. It read: "Encourage your loved ones to change passwords often, making them long, strong, and unique." Cranor wasted no time challenging it.

The reasoning behind the advice is that an organization's network may have attackers inside who have yet to be discovered. Frequent password changes lock them out. But to a university professor who focuses on security, Cranor found the advice problematic for a couple of reasons. For one, a growing body of research suggests that frequent password changes make security worse. As if repeating advice that's based more on superstition than hard data wasn't bad enough, the tweet was even more annoying because all six of the government passwords she used had to be changed every 60 days.

"I saw this tweet and I said, 'Why is it that the FTC is going around telling everyone to change their passwords?'" she said during a keynote speech at the BSides security conference in Las Vegas. "I went to the social media people and asked them that and they said, 'Well, it must be good advice because at the FTC we change our passwords every 60 days."

Cranor eventually approached the chief information officer and the chief information security officer for the FTC and told them what a growing number of security experts have come to believe. Frequent password changes do little to improve security and very possibly make security worse by encouraging the use of passwords that are more susceptible to cracking. The CIO asked for research that supported this contrarian view, and Cranor was happy to provide it.

The most on-point data comes from a study published in 2010 by researchers from the University of North Carolina at Chapel Hill. The researchers obtained the cryptographic hashes to 10,000 expired accounts that once belonged to university employees, faculty, or students who had been required to change their passcodes every three months. Researchers received data not only for the last password used but also for passwords that had been changed over time.

By studying the data, the researchers identified common techniques account holders used when they were required to change passwords. A password like "tarheels#1", for instance (excluding the quotation marks) frequently became "tArheels#1" after the first change, "taRheels#1" on the second change and so on. Or it might be changed to "tarheels#11" on the first change and "tarheels#111" on the second. Another common technique was to substitute a digit to make it "tarheels#2", "tarheels#3", and so on.

"The UNC researchers said if people have to change their passwords every 90 days, they tend to use a pattern and they do what we call a transformation," Cranor explained. "They take their old passwords, they change it in some small way, and they come up with a new password."

The researchers used the transformations they uncovered to develop algorithms that were able to predict changes with great accuracy. Then they simulated real-world cracking to see how well they performed. In online attacks, in which attackers try to make as many guesses as possible before the targeted network locks them out, the algorithm cracked 17 percent of the accounts in fewer than five attempts. In offline attacks performed on the recovered hashes using superfast computers, 41 percent of the changed passwords were cracked within three seconds.

A separate study from researchers at Carlton University provided a mathematical demonstration that frequent password changes hamper attackers only minimally and probably not enough to offset the inconvenience to end users.

Over the past few years, organizations including the National Institute of Standards and Technology in the US and UK government agency CESG have also concluded that mandated password changes are often ineffective or counterproductive. And now, thanks to Cranor, the FTC has also come around to this thinking. But don't count on everyone doing away with regular password changes.

"I'm happy to report that for two of my six government passwords, I don't have to change them anymore," Cranor said. "We're still working on the rest."

Read the whole story
25 days ago
Reminder: frequent password change policies are cargo-culting some guesstimates from 70s mainframe operators worried about physical security against on-site attackers (

The landscape has changed dramatically in the last half century and we desperately need to move on.
Washington, DC
25 days ago
Mountain View, CA
Share this story
2 public comments
25 days ago
My name are all on cryptokeys. I rarely change password unless forced to, but then I use a password manager and "random" generated password..
Idle, Bradford, United Kingdom
25 days ago
Password manager and random passwords here as well.
25 days ago
I'm sure my bank and other irritating websites will take this to heart right away
Earth, Sol system, Western spiral arm

Making America: Langston Hughes and the RNC

1 Share

Back when Donald Trump was not even the certain nominee, I heard the slogan “Make America great again.” And a voice whispered in my head, “America was never America to me.”

Such are the perils of an education: put in demagoguery and get out Langston Hughes. Let America Be America Again is the poem I mean, and it’s well worth reading in its entirety. Please do. And at the time I thought: we’re going to need something to get us through this RNC. We’re going to need Langston Hughes.

Friends, I had no idea.

I had no idea that we were going to see so many more shot in the streets this summer even before the protests during the convention start. (I hope for peace and free speech this week. I hope. The rest of this year–and some of our country’s history with political conventions–makes me very nervous.) But there’s Langston Hughes, with his stanzas reminding us that it’s like this, we’ve been here before. The Thirties were like this, the Sixties. We’re like this. America is this. We can’t say we didn’t see it coming. If we didn’t see it coming, it’s because we didn’t look.

And–one of the reasons I love this poem. One of the reasons I wanted to talk about this poem, about all of his poems. Is that it is so much more passionately patriotic than the slogan. “Make America great again” is beaten any day by “The land that never has been yet–and yet must be.” Who loves you more? The person who wants to restore you to your high school glory, or the person who thinks you can be better than you’ve ever been? Who believes in you more? The person who thinks you’ve peaked or the person who thinks you have far to go?

I know two women who had strokes in middle age. For a lot of people, that would be it, a clear sign that whatever they did next would be lesser-than, a decline. One has gone on to change how she does her visual and tactile art form for the better. The other has built on a career of being a great storyteller to find ways to be a great wordsmith as well–to find ways to make lightning bugs into lightning. Neither one did it by pretending that bad things never happened, that her health was perfect. As an individual, as a people–you can’t. You make a better way forward–you approach a dream–by acknowledging that the bad things have happened. That they have happened to you. That they are a part of you. Langston Hughes has to acknowledge enslavement of Black Americans and dispossession of the Native Americans from the land. He has to acknowledge class inequality and gangsterism and greed as part of American history. Because if he doesn’t, he can’t see his way around them to the bigger dream past them, without them. There is no Golden Age for Langston Hughes to hearken back to because he’s willing to work to build one that’s never existed before. And when he describes the dream as almost dead today, he’s willing to tell you who’s almost killed it and how.

There’s going to be a lot more about that as I read and blog about his collected poems this week. Langston Hughes has a lot of punches not to pull and a lot of beliefs he will come right out and tell you in words, not sideways or sneakily. Like: “LIBERTY!
True anyhow no matter how many
Liars use those words.” (That’s from In Explanation of Our Times, which talks about people with no titles in front of their names getting to talk. Which is going on now too I think. And how they–and Langston Hughes–would not shut up.)

And that’s worth talking about this week. Every week. But this week in particular. So come on ahead and join me, blog about it, tweet about it, whatever you like. That’s the only way we get there from here.

Read the whole story
40 days ago
Mountain View, CA
Share this story

Sourcing bridges

1 Share

So… I am thinking of a new piece for a specific site.  As per my usual working methods, before I dive down my own rabbit hole too far, I want to hear from you.  In this case I’m asking very early on in my process, well before I go down my own rabbit hole. Answer any and all questions you would like.  Please pass on this post to others, especially anyone in North, Middle and South America, and in particular anyone from Buenos Aires.  I would love to hear your responses to any or all of the questions.

What is a cultural bridge?

What do you think about the relationship between North and South America?  What do you think should be addressed?

What does a cathedral mean to you?

A warehouse?

A distribution point for food for an entire country?

What does Buenos Aires mean to you? (please say if you live there, have visited there or have never been there).

Read the whole story
50 days ago
Mountain View, CA
Share this story
Next Page of Stories