#privacy

PII masking with Glue DataBrew — the rubric we ended up with

“A rubric that survives contact with auditors is a rubric. Everything else is a draft.”

Open-sourcing the PII Masking Starter Kit

“Get the rubric right, the rest is bookkeeping.”

Protecting device data, at rest and in motion

“Encryption at rest and in motion is the floor, not the ceiling. The real question is which data you keep readable at all — and for anything tied to a person, the answer is as little as you can get away with.”

AirTag on Atom's collar — anti-stalking vs pet tracking

“AirTag's anti-stalking features are designed to alert an unsuspecting person that an AirTag is following them. When the AirTag is on your dog who's exited the geofence, your dog gets the 'someone is tracking you' chirp. Apple's design assumes the tagged entity is a person, and pet tracking breaks that assumption in interesting ways.”

Ripping out vendor clouds — going local-first on Home Assistant

“When the internet went out during a March storm and the family's school + work calls all dropped, the lights, locks, and security alarm kept running. Local-first was an architectural opinion until the pandemic; now it's a requirement.”

Amazon buys Ring — what a surveillance doorbell does to the threat model

“A cloud camera is a camera you've agreed to let someone else watch. The footage is useful exactly because it's always recording — which is also precisely the problem. The threat model isn't the burglar; it's the terms of service.”