Moving day

Back in 1993, I took the radical (at the time) step of requesting a new domain, strom.com. I say request because back then there wasn’t any actual “purchase” – the internet was still relatively new to the general public, and all it took to become master of your domain was a simple email request, which was satisfied within minutes. Let us pause to remember and honor these simpler times.

As you well know, over the 32 years I have used that domain for my own promotion and business. But the time has come for me to sell the domain. And for those of you that are thinking about doing this, I am writing an article about the experience for the Internet Protocol Journal. I found that it wasn’t a simple or straightforward process, and my goal with this article is to help you think it through before you finalize your own domain sale. To help with my reporting, if you have sold or bought a domain name and want to share your own lessons learned, I would love to hear from you.

BTW, my new email is david@webinformant.com. Please change your address books now.

This isn’t the first time I sold my digital assets. In 2020 for IPJ, I wrote about selling an unused IPv4 address block. The process for selling a domain is both more complex and also depends on your particular situation, which I will get into in my article. I was lucky enough to have a short last name, to only use it for my domain, and for having chosen a dot com, which is still the most marketable suffix. For years I regretted that I didn’t own davidstrom.com – that would have been a better choice for my brand, but not as fungible as just my last name. Why? It turns out “strom” is used in a variety of non-English languages and a variety of businesses. One advantage to owning my own name is that I got to come across many other namesakes whom I have e-met or met f2f over the years, along with composing a column with one of them who is a conservative blogger.

I began this transition last year, when I was contacted by a domain broker that I have known for many years. Before I could even begin to contemplate selling, I first had to take stock of my entire digital footprint. That first step was to examine my password manager, which had more than 500 login accounts, many of which used my strom.com credentials as their username. Weeding through that collection was very time consuming and tedious. It would have helped things if before I started the weeding, I had picked what my new email address was going to be. Well, nobody is perfect. I am sure some smarter person would just program something in Python or some AI tool, but I did it the old fashioned manual way of logging into a site, finding where I had to change my user name, and then coping with the flurry of emails confirming that this change was anticipated and not some North Korean hacker that was attempting to use my identity for ill-gotten gains. The good news is that I was able to eliminate more than 150 unused logins.

This part of the migration showed me (and by extension, now you) how brittle our email infrastructure is. I know: tell me something that we don’t know. Some of the login changes required confirmations from both the old and new email address. Some of the logins used a non-email username but hide the email address used to send notifications somewhere in their settings screens. Of course my initial pass through my password vault I forgot about those. For example, with one account (my cell provider), I needed to call them to change my email address. On the phone.

Email addresses also lurk in various dark corners of your digital infrastructure for less obvious notifications. For example, LinkedIn has primary and secondary email addresses, and I forgot to change the latter one, and as I was writing this also remembered that I also had to change the link to my new website.

I am glad now that I took the time and effort to go through all of this. One interesting fact: unlike moving my house, moving my website required no actual transportation of the bits themselves. Thanks to how my hosting provider Pair.com originally designed things, the move was accomplished with a few phone calls and simple commands to link the old website to the new domain. To some of you, that seems obvious, and you are probably smirking as you read this. But to me it was a revelation, and I am thankful that the Pair support folks had the patience to walk me through things.

So moving forward, strom.com will soon be something else and someone else’s property entirely. Part of me is somewhat sad, as I have had that domain for so long, along with a trademark for the webinformant name that I also got back then. (These email newsletters began a year earlier, in 1995.) That reminds me about a story that I can tell you about that name. When I got my mark, I had no idea that it would become a point of contention with a publishing firm that had already begun a series of other “informants.” They contested my mark, claiming that it interfered with their own. I forget the exact legal back-and-forth that I had to go through, but eventually it was a moot point: the company moved on from publishing, as far as I can tell.

The week where I nearly fell victim to scammers

Last week I was under attack., and it was completely my own doing. I nearly fell victim to two separate and independent scams. And while I pride myself on recognizing and avoiding these things (perhaps too much, given these situations), it just shows you how anyone can be manipulated.

Let’s talk about the one involving a major sale of Taschen art books. You have seen these coffee table beauties, they typically are quite expensive and cover a wide range of art (including movies and art posters). There was an ad running through my Facebook feed (a sample shown below) that promised all sorts of things, such as “to make room for new editions and updated print runs, we’re clearing a limited selection of archive titles from our warehouse.” Clicking on the ad’s “Shop Now” buttons brought you to an attractively designed page that showed book covers and sale prices that were around $5 a book. There were several warning signs that I ignored, because I was so excited about getting some bargain books: First, paltry descriptions. Second, the domain was a .shop one that didn’t seem to have any relationship with any Taschen brand itself. And the FAQ page looked like it had been written with AI, certainly not on the level of quality that I knew this publishing house was known for.

Now, you can find these books in many used book stores, and they go for at least $25 a piece . But I was blinded by the bargains and so I proceeded to order three books. With shipping, it came to about $30 total. Enter my credit card, and wait — the card was rejected. The name of the vendor was khdfaienceflume. The company was based in Hong Kong, and the purchase was originally in HK$. Okay, something phishy here. I went back and looked up the domain, where I found it was registered a week ago. (Big red flag.) Taschen is based in Germany, btw. So i was saved by my credit card company’s fraud screen. I should have seen these warning signs, and should have followed the cardinal rule: if someone is selling something so cheap that is too good to be true, it probably is.

My second scam was a lot more involved, and it took me a week to figure it out. I got an email from Deven saying that “he was on Spotify and came across my2023 podcast interview.” He claimed to be able to help place me with interviews on other “big-name podcasts,” and mentioned the names of some of his clients that he has helped in the past. None of the names meant anything to me, but I figured what the heck and booked some time with him the following week. All seemed on the up and up until I started getting more than a dozen messages and texts suggesting that I watch some of his promotional hints and tips to making more money doing podcasts, leading up to the day of our eventual virtual meeting. I was starting to get annoyed, but I was eager to hear more about his “sure fire methods.”

Again, I was blinded by the “make money fast” message and missed a few of the cues: some slight misspellings in his messages, the lack of any actual pricing for his services (other than hints that he was expensive), and a failure to check out any of the “big name” clients. I actually connected to the pre-arranged meeting but Deven was a no-show. Then I started investigating: After checking into his clients’ websites, they all shared a common thread: they make a lot of money, they don’t show pricing, and they also don’t have contact info. It all was an elaborate hoax. (You can see a partial screenshot of one of these clients here.) All of the clients had very attractive websites that reflected a lot of time to create their own testimonials and detailed strategies on how they can help you “earn seven figures.” Yeah, right.

I am not sure how Deven was going to get my money, but once again, a major fail.

So: take a moment before you get sucked into the phishing vortex. And let my experiences in Scamville be a potent lesson to you. I n the meantime, I guess I am back to browsing the used book stores in person too.

At least Clippy was cute

I was not a fan of Microsoft’s Clippy. But I was waxing somewhat nostalgic about the little paper clip reading all the negative reviews of Microsoft’s latest foray into helpful assistants, its AI-based Copilot. David Linthicum wrote today on LinkedIn about the enterprise backlash, saying, “The company’s decision to introduce new licensing models, charge premium prices for AI features, and encourage hardware upgrades created deep skepticism.” He cited its intrusive design, general unhelpfulness and AI hallucinations, and evidence that just a small percentage of adoption by Office users as major obstacles and says it is a cautionary tale: Microsoft needs to listen more and impose less on its users.

The Rise and Fall of Clippy: From Microsoft's Bold Vision to Internet LegendSome wags (including Marc Benioff) have called Copilot Clippy 2.0. I don’t think that is a fair fight. We should at least bump up the version to 10.0. In many respects, Clippy was ahead of its time (read this historical look back to see why this author called it cutting-edge AI for 1996.)

I haven’t spent much time with Copilot, because I would rather do my internet lookups when I need them, not be distracted by some automated nag. True, Copilot can generate a lot of text with just a simple request. But a lot of AI slop, as it is called. Does it do a better job than Clippy in understanding context? Yes, but it still interrupts the creative flow, or at least my creative flow.

Over the many decades that I have become a not-so-famous writer I have learned how do my searches for the data and links in my stories. Now I type in complete sentences, rather than find three unique words that will drive better results. (That reminds me of What3words.com, which is a fascinating site, but I digress. See how annoying interrupting things can be? Sorry.)

So at least Clippy was cute. It had its detractors too, but also fans such as this short video that showed its future that is surprisingly fresh for something done a decade ago.

And for those of you who want to reanimate Clippy, here is some code that will bring it back to your desktop.

I will leave you with some words of wisdom from a colleague, Theresa Szczurek, who talks about finding joy and fear in AI in her latest newsletter: “You choose when to use AI. You decide where it adds value. You define ethical boundaries. You determine how it supports — not supplants — your strengths. AI is one tool among many. You are still the strategist. The leader. The creator.”

The future generation of news looks very different from today

A new research report from a combined effort of Financial Times Strategies and the Knight Journalism Lab at Northwestern University is now out. Entitled “Next Gen News” it describes a very different future for the way news is gathered, packaged, and consumed. And if I haven’t grabbed you in the seconds it took to read my lede, then too bad and so sad for me.

The report is the second such effort from this collaboration and uses online surveys of 1,000 subjects in each of five countries: Brazil, India, Nigeria, the UK and the US. They also took more in-depth interviews of 84 random subjects aged 18-28, and 19 news producers across the world drawn from both solo creators and larger news sites. The 80-page report is well worth your time, and shows what is happening in the world of news. Some of it is obvious, but a lot of it isn’t, and the insights will surprise you.

If you have never heard of Lisa Remillard, The Pudding, Morning Brew or Climate Adam, then you need to pay a lot more attention to this report and the market that they represent. News sites are embracing novel ways to attract, orient and engage readers. Sites are tailoring their content to produce a mix of sources, notifications, story types and ways to adjust their algorithms to provide the best engagement. That much you probably know, but there are many tips and tricks on how to get from the old news world to the modern era.

To that end, they identify seven different modes of engagement, as shown in the diagram below.

For example, the sifters can scroll through a list of news items. They have about two seconds for video and maybe 15 or so seconds for reviewing the text to select the stories or topics that breakthrough. Seekers use overall websites to guide their discovery process. Each of the seven modes is explored in detail, with numerous examples from sample websites from the five countries.

One of the interesting things is how different the news environment is across the world. Nigeria, for example, is the most digitally engaged country, for example. The study’s authors explain why they picked the places they did, and document who they did additional interviews at length.

The challenge for modern news producers is that there is a broader definition of what news is for modern readers. It can contain civic info, but it also has a personal impact on the reader and is both entertaining and non-fiction. The researchers found that the best producers have turned the trad journalism model on its head: they start from being distributors, master the language and style of their platforms and design their content so it can travel across their own news ecosystem. Being distribution first means that engagement isn’t just a by-product of solid journalism but built-in up front. Publishing is the start of a conversation between the site creators and readers, not the endpoint of what was once the legacy process. The old news style began with an idea and then worked through research and writing the story and ended with distribution. The modern workflow starts with distribution and then tests several ideas before moving into editing and publication, all in the service of community engagement.

No longer are news producers trying to shoehorn content into a distribution platform (like TikTok or YouTube), with results measured in page views or likes. Instead, the content is designed to be native to a platform in terms of style, focus, and news content. And forget about the inverted pyramid scheme for writing stories: there are numerous examples of what next-gen news uses, such as building recurring inside jokes to make complex topics more approachable.

This means that the modern newsroom is filled with what the researchers call “full stack creators.” This doesn’t mean that they know everything from HTML to Cursor, but that they have a mix of skills including on-camera presence, visual storytelling, script writing, being able to package the product with descriptions and thumbnails, and understanding the basic analytics that will be used in their stories. That is a tall order. But wait, there is more: the modern newsroom needs to be a working, cross-functional pod that can cover multiple platforms too.

Back when Twitter was still a trusted breaking news source, we had to learn the ins and outs of socializing our content. And to some extent, this is still the case, just now the socializers are just one of the seven modes mentioned earlier. But now the producer has to start with the assumption that they have to build content that people actually want to share with their peers, and understand how different platforms distribute their shared content. To be effective, this content has to resonate emotionally, be simple to grasp, and easy to report. Seems obvious, right?

Not mentioned in the report is that content creators have to navigate the dangerous waters of AI and understand that traditional SEO and being an “influencer” are both dead concepts. Cybersecurity expert Daniel Miessler recently posted that “The main viable path for knowledge worker professionals is to start seeing themselves as free agents. And to start behaving that way in terms of how they present to the world. It’s about to be essential that you’re visible, that you have a portfolio of work you can show/talk about, that you have a domain. A website.” Everyone will be an influencer, and its our job as scribes to find, target, and feed our particular audiences.

FIR B2B #159: A tale of two newspapers

Paul Gillin and I are back with this episode after the recent events of the massive layoffs at the Washington Post and the LA Times, the shuttering of the Pittsburgh Post Gazette  and funding cuts at NPR. We describe the continuing train wreck of daily news there and contrast the Post’s approach with what has been going on at the New York Times digital property. The Times diversified its revenue stream beyond its core newsgathering with purchasing gaming, cooking, and sports-related content. Post’s owner Jeff Bezos didn’t diversify or even keep the news core. Part of the digital newspaper problem is that its ad revenue model is gone, as search traffic has dried up thanks to AI chatbots. Compounding this is that overall monthly visits to the Post’s website is down from 60M (in 2022) to 40M visits last year, and subscriptions are dropping too. We contrast the Post and the Times business models.

On our latest 17 min. podcast, we talk about some signs of success with subscriptions for smaller, more targeted sites, such as 404Media, which shows that a small group of independent journalists can keep quality high and report on significant stories. Also, individual creators (such as Mr. Beast and Mark Rober) can build a brand and attract significant audiences (Rober has more than 70M subscribers, for example) on YouTube and TikTok.

If you want to also listen to Marty Baron, former editorial director of the Post, here he is talking to Tim Miller about his thoughts on the decline of his former employer.

Beware of OpenClaw, a new AI tool and potential threat

When I began writing about the potential dangers and benefits of AI a few years ago, I quickly came to the conclusion that the two are very closely tied and both directions present new challenges for enterprise IT managers. The latest development of Clawdbot (AKA Molt.bot or now called OpenClaw) are a very instructive case study. So what does it do, and what is the threat?

Basically, it is a powerful way to automate your digital life using a variety of AI agents. It is an AI-based assistant, and its use is spreading like wildfire. The top line is that OpenClaw is taking over — Token Security has found it has collected more than 60,000 Github reviews and nearly a quarter of its enterprise customers are using it and running it mostly from their personal accounts. They say “It is also a security nightmare, with exposed control servers that can lead to credential theft and remote execution over the internet.” This is no Chicken Little deal — “This rapid adoption signals a significant shadow AI trend that security teams need to address immediately.”

Here are two places that provide a deeper dive: First is security blogger Samuel Gregory, who has an excellent 15 minute demo video where he says “If you don’t know what you are doing, you can cause a lot of damage.” He shows you some of the guardrails you need to install, explains a bit of the bot’s history, and is well worth watching. But many of his suggestions mean you have to do a lot more work to isolate the bot from your online life — which shows quite starkly the tradeoff of security with ease of use.

Shelly Palmer, who actually uses the tech he writes about has this post where he documents what it took to get it up and running across his digital life. The bot connects his Slack, iMessage, WeChat, and Discord accounts. He has spent several hundred dollars in tokens to fine-tune it, and says it costs him anywhere from $10-$25 a day — “the bot just eats tokens.”

Part of OpenClaw’s problem is that you can run it on your local hard drive, but that it sends its feelers deep into your corporate SaaS infrastructure. For this to work, the bot needs access to your accounts and credentials. The bot’s website (mentioned above) is proud of this connectivity, saying up front that it “Clears your inbox, sends emails, manages your calendar, checks you in for flights. All from WhatsApp, Telegram, or any chat app you already use.” A story in El Reg goes into further details about the security implications. Not surprisingly, as they mention, “Users are handing over the keys to their encrypted messenger apps, phone numbers, and bank accounts to this agentic system.” Gulp.

The bot has its own package registry where you can download various “skills” as they are called to do various tasks for you. This sounds great until you realize — as this one researcher describes (sorry it is a Tweet, forgive me), there is absolutely no vetting, and 100% chance that something you have downloaded has evil intent.  Daniel Miessler Tweeted this warning shown below on how to harden any Clawdbot implementation. But many of the fixes depend on personal choices deeply rooted in the realm of Shadow IT. The issue is that it is easy to install, but difficult to install securely, something that many users might not realize in their joy of having a clean inbox and automatically delegating their mundane tasks.

Image

(Another excellent analysis of security issues can be found here.)

SOCPrime used its own tool to find users who have jumped on the Clawdbot bandwagon, and I am sure other threat intel tools will soon have similar posts.

“Yes, there are real issues: plain-text secret storage, misconfigured admin UIs on the open internet, and a skills ecosystem where people blindly install untrusted code,” says Matt Johansen. So keep your eyes open, scan your networks for the appropriate indicators, and educate yourself and your end users on what they are doing and how they do it more securely.

When spreadsheets first entered businesses, I recall how hard IT had to work to stay ahead of our users who were enamored with the new tech. But that was a single piece of software. With OpenClaw, we have an entirely new layer of digital infrastructure, and one that is complex and could be costly as well as open up multiple security sinkholes. Proceed with caution.

I have too much security today

This morning, I had three tasks to complete that involved using various web sites. First, I had found an old recall on a part to my Cuisinart food processor. The recall notice cited a web page that (I assume) was such an old reference that the page has since evaporated.  Then I was trying to review the latest charges on my credit card. And finally, I wanted to pay a doctor bill online. Each of these tasks would have taken minutes to accomplish. Instead, the elapsed total time was several hours.

Now, I am not one of those Gen Z’ers that would rather text (or use the web) than talk to an actual human being in real time. Nevertheless, that was going to be how I would solve the Cuisinart Challenge. While the URL for the recall wasn’t in service, they had provided a phone number in the recall notice.

So I called the number and I was told all lines would be busy for the next five minutes and if I wanted them to call me back, just press 1, which I did. A few minutes later I got  my calll back. Once the support person took down my info, it quickly processed and a new part was promised within a few weeks. Excellent service: I think I bought that appliance probably 17 years ago.

Next, on to checking my credit card. I called the bank, they started to walk me through the process, and then we both realized that I was using a “secure” browser (Opera Air) that I remembered had some odd quirks, particularly because it blocks ads and popups. Sure enough, once I brought up Chrome, I was off to the races and able to login without any problems.

That made me think my doctor’s bill was suffering from the same condition, so I tried that in Chrome and hot diggity, problem solved and I could pay my bill just in time for lunch. So much for my morning.

Now, you might ask why am I using Opera Air? I got tired of all the popups and effluvia that I was experiencing with Chrome, and also annoying with the Googleplex in general. (Yes, I know, Opera is based on the Chrome code base, but that is just the way the modern browser worlds operate these days — with the exception of Safari and Firefox. Even Microsoft uses Chrome for Edge nowadays.)

Is there such a thing as using too much security? No. But there is a constant trade-off among security, privacy, and usability. It is a three-way tug-of-war. And the more you tug on one of the three legs, the more the other two will give way.

Coming f2f with a nuclear missile

Last week I happened to be on a vacation in Tucson and stopped by a rather unique museum. Those of you who are long-time readers will recognize this as a feature, not a bug (see my work on the St. Louis AquariumNSA’s museum, UX museum design, and the Lincoln presidential library). I went to the site of the last Titan Missile silo.

Titans were first created to launch a massive retaliatory strike back in the 1960s. Each missile contained a single 9 megaton warhead, perhaps the biggest bomb ever deployed. (By way of comparison, the original blast over Hiroshima was 15 kilotons.) They were designed to be launched within a minute or so after receiving the go-code. Three locations were picked, each field containing 17 silos that were essentially self-contained underground environments consisting of a dormitory, a control center and the silo itself. In the mid-1980s, all of the other silos were completely decommissioned and made inoperable.

The museum contains the last remaining silo that has a missile in it (minus propulsion and the warhead of course). If you take the tour you spend about an hour underground seeing it up close as well as witnessing a simulated launch sequence with some of the original control gear.

Now, I thought I knew a lot about nuclear missiles, but I found the experience both fascinating and chilling, especially as we seem to be talking about them more often these days. One fact that I learned is that the Titan collection would be launched entirely when the order was given: that meant that all 54 of them would be airborne at once. Whether life on Earth could survive that combined blast isn’t clear, it reminded me of the “Doomsday Machine” that was popularized in the 1960s — of course, that machine was automated. To launch each missile required two human operations to go through a sequence of authentication steps (double-keyed locks, one-time passcodes and the like) to verify things. The movies represent this sequence in spirit. In reality – at least in our simulation – is very involved with multiple steps, which makes sense.

One of the reasons the Titan was decommissioned was the era of a single big bomb per missile evolved into having one rocket with multiple smaller warheads, which is what the vast majority of the world’s some 12,000 weapons look like today. Another point in Titan’s disfavor is that it doesn’t make sense to have much in the way of land-based weaponry, since they are essentially sitting ducks for the enemy to target. Most of today’s weaponry is mobile, based in subs or on planes, such as the UK or France.

But whether you count by warheads or rockets requires a lot more nuance. China, for example, has a huge stockpile, but fewer weapons that are ready to launch. And I would argue that another aspect that doesn’t get much discussion is the world’s 400-plus nuclear power plants that are scattered around 30-some countries. While these plants are doing something useful – producing electricity – they are also sitting ducks for enemy targets. Russia has specialized in this arena, sadly. About a year ago, the Chernobyl nuclear power plant was targeted by Russian drones that punched a hole in its protective roof. Some have said it was an accident, and Russia denies they fired anything, both not very credible statements.

As you might remember, the damaged reactor was encased in a huge building with several layers of steel and concrete, designed to keep the escaping radiation inside and away from humans. To my way of thinking, this was the second time a nuclear strike was used in warfare. The first was an earlier Russian missile fired at Ukraine’s nuclear power station. Why no one is making a bigger deal out of these events is curious.

After my friend and I did the Titan tour, we decided to watch Dr. Strangelove to see how accurate their depiction of nuclear warfare was. While the exact details differed, the movie has held up well over the years, and I would recommend you screen it too.

When is the cell phone age of consent?

I realize that I am not using the term precisely, but you most likely understand the meaning. You could interpret my question as asking, at what age as parents do we provide cell phones for our kids? I asked my readers to share their own experiences, and most opted to remain anonymous, so I will refer to them with descriptors to distinguish them. In addition to the age of consent, I also asked other details about their kids’ usage and what controls they used to formulate their family phone policies.

The Fortunate family has two boys that are now in college. They got their phones when they were 12. “We trusted our kids and never had a problem,” at least to their knowledge. They initially used a Verizon blocking and monitoring phone app. They never had access to their kids’ phones and “on the whole it wasn’t a problem.” That is why I call them “fortunate.”

The Strict family also has two teen-aged boys (19 and 12), both of whom sort of got their phones when they were 12. The older boy “has only an Instagram account now but rarely uses it (mostly just to see occasional friend’s posts). He has the right priorities and values, and we don’t need to stay on top of this for him at all—he limits himself.” The younger boy is why I say “sort of” because his device is a locked-down iPad, which also comes with usage limits (“we collect it at night, and he’s not allowed to get it until all homework and other responsibilities are completed”). What is more significant is that “he has learned to bypass the controls on his school Chromebook and knows where to find unblocked games — that’s a big enough headache for me frankly.” Oh, and the parents are keepers of the passwords too.

The OnRamp family has a boy and a girl that got their phones between 16 and 18 (and are now in college). “I would caution any parent who would allow a phone prior to age 16,” they said. “Our kids needed an on ramp, you can’t just lock them down and then cut them free in an instant.” This family saw the need for phones at discrete moments, such as when traveling. But having an on ramp also meant restricting social apps or with a lot of oversight or forbidding them in places such as their bedrooms, when the phones would be relegated to a charging shelf. They also recognize that they didn’t do as good a job at teaching them other worries such as doom scrolling or going down rabbit holes, because “any content consumption can be addictive.”

When my cousins had teen girls, they got their first phones both at age 12 (they are now 19 and 21). They had access to their AppleIDs and PIN codes so they could monitor which apps they had, and also banned phones at their dining table and collected them at night.

One reader has four daughters from 4 to 10 years old, call them the Home School family. He said, “I can’t imagine ever giving them cell phones, and believe strongly in parent/child attachment.”

Several readers were pretty vocal about not allowing cell phones in the classroom. Of course, that places the responsibility on each teacher to detect usage, which can be an issue. But then this is just another part of their responsibilities.Many years ago, I taught a high school networking class for 10 boys. The class was done in a hard-wired network lab (wifi hadn’t yet become popular or available in the school). When a student was giving me problems, I would unplug their computer. That public shaming seemed to work for me — and the related peer pressure for them as well.

Others suggested buying phones without any internet data plans or GPS-enabled watches, such as from Mint Mobile, Gabb.com, Bark.us or Tello.com. These vendors have a wide range of products and Gabb has an impressive amount of content that can help you pick out the right piece of tech for your kids.

However, like any blocking or protective tech, these solutions may create additional problems. The Contract family used the Bark.us app and did help out in one situation, but he grew tired of its frequent and buggy updates, and discontinued its use last year. They also made their kids sign a multi-page cellphone agreement, which he has agreed I can share with you here. This might work for you, but I think many of you would find this level of pseudo-legality a bit much. Another source worth exploring is Delaney Ruston’s blog (she has interviewed many families for her documentary films about family tech use), and this post goes into great detail about how to formulate your family’s phone policies.

Another reader, we’ll call him Childless Man, says that “if I had had a cell phone when I was 12 to 15, I would have gotten myself in lots of trouble. I can’t be the only kid who’s libido was running overdrive!”

Finally, there is the Watch family, with two daughters 8 and 11. So named, because they have focused on getting watches rather than phones, at least initially. “The Apple watch is great, because when it is not paired to a phone it cannot access any apps.” They also manually add contacts to the watch so they can control who their girls communicate with, and are the keepers of the passwords too. “The watch is restricted to contact with mom&dad only after 8:30pm and is also on “school mode” during the day. Our kids’ schools are also complete black holes of cell service.”

I originally thought about this topic in terms of kid’s social network usage, but as I was corresponding with you all I see that I haven’t really understood the breadth and depth of the issue. Yes, we can try to block TikTok, Facebook, and Instagram. But what about YouTube, Discord, and playing online games? And kids are clever at getting around app blockers, as I mentioned with the Strict family earlier. I probably will have more to say about this topic and welcome your input as always.

So what can you glean from these examples? There is no perfect solution, and the important thing is to match your level of expertise (many of the families cited here are from parents who are computing professionals) and also the kind of kids you have and how they develop and what tech their peers are using. (To that end Ruston pointed me to the Waituntil8th.org, which promotes parents to act together to wait until eight grade before giving their kids phones.) That shows that your policies and restrictions will of course change as your kids grow up. Thanks to all of you who answered my query, and if you want to share your own experiences, feel free to comment here or send me a private message.

How not to repurpose an old laptop

For the past six or so years, I have had an HP Elitebook laptop that I have carted around the world a few times, upgraded it a few times eventually to Windows 11 — amazingly, Microsoft still supports the thing. (It runs an Intel i7 and hads 16GB of RAM, so it is a pretty solid machine even now).

But it was showing signs of age (aren’t we all?): the sound, which used built-in B&O speakers, was no longer working and a few other quirks with the bundled HP security software that I was tired of dealing with.

Perhaps you are in a similar situation, or your business is in a similar situation. Read on, and learn from my many mistakes. Even though I have been working with PCs since the mid-1980s, there is still a lot I can learn.

What pushed me from “thinking about getting a replacement” to action was this security warning about this aging fax modem driver file ltmdm64.sys that could cause problems. I thought — ok, I am a security expert, let’s see if I have this file on my laptop. A quick search using File Manager brought up nothing, but then I realized that FM doesn’t tell you about system-level files. I rooted around some more and saw it eventually lurking in some dark Windows directory, but of course I couldn’t rename it or delete it. And this is a feature, not a bug, because the last thing I would want would be to have some malware get ahold of that directory and cause even more damage.

Enough already. But before I buy something new, I wanted to see if I could repurpose my laptop and install a less complicated OS that I could manage. Easy, I thought: Almost all of my use is through browser-based tools. And since I run my email through Google’s servers, I figured to start first with ChromeOSFlex. Unlike other OS’s, you don’t download an .iso image file and then use that to make a bootable USB drive. Instead, you have to go to the Chromebook Recovery Utility’s download page and download and prepare the bootable image that way. This utility is a browser extension. That should have been a warning sign.

There are two ways you can refresh your PC with a new OS: run the “live boot” from the USB drive, which means nothing gets put on your hard drive (in case something goes wrong) or to do a fresh install, in which case you destroy the (in my case) Windows files and start anew. Being a careful person, I choose door #1 and did the live boot.

Now, I have all sorts of security things on my Google account, including a Yubico hardware key, passkeys, an account password that is a complex string of numbers, letters and symbols (more on that in a moment). I also had one must-have browser extension — the Zoho Vault password manager. I thought having a Google OS would be a good thing. I was wrong.

The problem with ChromeOS is that it is not quite an OS — it is really Android that has been heavily modified and stripped down. You’ll see why in a moment.

Within short order I got a working system, the Zoho stuff worked just fine and I was ready to throw caution to the winds and do the great big wipeout and install ChromeOSFlex for real. Got everything flowing just fine, or so I thought. Then I shut down my machine for the night. Big mistake, as I found out the next day.

The problem is when ChromeOS boots up, it doesn’t quite know your keyboard driver. So the password that you type in doesn’t quite match. It didn’t help matters that my password contained a series of ones and zeros and the letter O and L. It wasn’t easy to figure this all out.

So Google kept saying I had entered a bad password. I eventually figured out when it is initially booting up, it doesn’t recognize my passkey, or my Yubico key. I don’t know why. And Google has made running ChromeOS that requires a boot password, so I was kinda stuck.

Now I had A Project. Over the past week, I have downloaded all sorts of Linux-flavored OSs. All had issues, until I downloaded Mint Linux. Twice — for some reason, the download didn’t take the first time around. I needed a ISO writer called balenaEtcher to create a bootable USB drive from my Mac. Eventually, I got things working, although I would have liked for Zoho to support an Opera browser extension on Linux, but they don’t have one, so now I am using Firefox for my web browser the moment.

What works:  have sound once again, and my Yubico key and passkeys work just fine.

What doesn’t quite work: the control of the fonts inside the browser, or at least I haven’t figured out where that particular control is.

Lesson #1: Don’t do the complete wipeout until you have rebooted your old laptop a few times.

Lesson #2: If you have a critical software component (in my case, the password manager), make sure it supports your OS and browser version. This is why you try out the live boot option.

Lesson #3: Make sure your OS will run on your particular chipset, particularly if it isn’t a 64-bit Intel CPU. Read the fine print.

Lesson #4: If you have hardware keys or other USB things that you want supported, particularly test them on the live boot before committing to the total wipeout.

Lesson #5: Know your tools. ISO boots are a strange sub-culture. Make sure you have a sufficiently large USB thumb drive that can contain the boot image. Make sure you find a program that will create a bootable USB from your downloaded ISO file.