He’s gone. We won’t have to wake up in the morning and wonder what nonsense, malice, or criminality he got up to in the meantime. I’m sure much will be said about him in the years to come but, today, I’m content to simply join America’s collective sigh of relief.

Four years ago, I wrote:

Trust strikes me as the far more insidious concern. Trust may have been eroding before Trump, but he willfully accelerated the process. I have no doubt that he will continue to sow distrust in our government and media institutions throughout his tenure. This is a poison that will linger, harming our country long after Trump is gone: depending on how far one travels, one may never quite return from the dangerous road of distrust.

Yesterday’s violent insurrection, or something like it, was written in the stars. What the road looks like from here, I can only guess.

Happy new year? I think so. It’s hard to imagine 2021 faring worse than 2020. But between the United States’ political instability and the arrival of the new more contagious coronavirus variant, I won’t be shocked if the first half of 2021 has some twists and turns in store.

Notes on the Apple + Google Contact Tracing Partnership

On Friday April 10, 2020, Apple and Google announced a partnership to provide new tools on top of which comprehensive at-scale digital contact tracing solutions can be built.

The primary contributions are a bluetooth and a cryptographic specification, plus the promise that these specifications will be implemented on tens of millions of mobile devices by very early May, 2020. I expect the number of supporting devices to reach the billions in the months following. Scale is essential in any successful tracing solution; as a result, any viable solution going forward will probably need to utilize these specifications. I’ll be surprised if any competing proposal achieves the necessary scale.

While their specifications are an important piece of the puzzle, Apple and Google have not built (and do not seem to want to build) a complete solution for digital contact tracing. Instead, they’ve focused on the low-level question of how mobile devices will interact with one another to exchange anonymized data that can — in tandem with both apps and data services presumably built by others — be tied back to an infection and scored based on time and distance of exposure. The details of the underlying protocols are not specific to COVID-19 and should provide a foundation for future epidemics.

The current specifications appear to strike a balance between privacy and anonymity and the need to share diagnostic information with arbitrary third parties. In the assumed common case where the mobile device’s owner remains healthy, no identifiable information of any kind is obtainable by any third party, including the operators of back-end data services and the developers of contact tracing applications. (Contact tracing applications can of course explicitly ask for PII and can share this information with data services, but the Apple + Google protocols themselves stay silent on this point.) On the other hand, in the assumed rare case where a mobile device’s owner gets sick, that owner voluntarily shares cryptographic identifiers associated with the specific days when they might have been contagious. With access to these identifiers, owners of mobile devices that were within Bluetooth range of the symptomatic individual can rank the severity of their exposure without the ability to determine the infected individual’s identity. In addition, it is not possible for data service providers to determine which set of users may be at risk; the information necessary to make this determination lives on, and never leaves, the at-risk mobile devices.

Because the Apple + Google partnership does not provide a contact tracing app or a contact tracing data service — and because these are necessary components of an at-scale solution — there are many open questions about how digital contact tracing will work in practice.

For instance: it is unclear who will be allowed to ship applications that use these new protocols. Will Apple and Google limit access to public entities, select private partners, or will they open the floodgates wide?

It’s also unclear who is likely to operate back-end data services in practice. The Apple + Google design naturally lends itself to the creation of federated rather than centralized data services. We might expect multiple or even competing services to emerge. To achieve scale, these services will need to speak with one another; with what schema and semantics will this conversation take place?

Griefing is also an important consideration in the development of apps and data services. If anybody can press a button that says “I have COVID-19” then anybody will, including the uninfected. Apps and services may need to place hard restrictions on who can share what the protocol calls “diagnostic keys”. As a simple example, an app may allow an individual to share their diagnostic keys with their doctor but only allow authorized medical professionals to share the diagnostic keys with participating data services.

There are many other important factors to consider. On the technical front, well-known cryptographers have begun to ask pointed questions about the chosen cryptographic scheme and its real-world privacy considerations. On the privacy and policy front, there are many deep and complex issues to tackle. Perhaps the best discussion I’ve run across in the context of the United States comes from a recent Lawfare Podcast episode that dives deep on the question of whether contact tracing is a privacy threat.

The Imperial College of London recently published a very sobering paper modeling the progression of the coronavirus pandemic under varying degrees of social distancing. Bill Gates chimed in on his recent Reddit AMA to say that he thought the model’s underlying assumptions were too pessimistic based on more recent data from China; Gates’ own Institute for Disease Modeling is working on updated models based on the latest data, from which we will learn more soon. Trevor Bedford showed optimism in a different direction, suggesting that we should immediately launch the infectious disease equivalent of the Apollo Program. The Bill & Melinda Gates Foundation appears to be heavily investing in this direction.

Regardless of the specifics, the “good” outcomes from the best projections our science can give us today are still calamitous. And that’s if our federal government gets its act together. Our government should long ago have:

  • Used emergency powers to demand the production of PPE and lifesaving medical equipment like ventilators
  • Ramped up production of COVID-19 test kits to astronomical scale and clarified the decision-making for its distribution
  • Activated the National Guard and erected temporary triage and treatment centers in key geographies
  • Enacted many trillions of thoughtful economic stimulus
  • Clearly messaged the danger of the moment and the need for everyone to strongly distance themselves

That’s at the very least! The one ray of hope right now is the evidence that China and South Korea have substantially beaten back COVID-19 through aggressive testing and shoe leather contact tracing and quarantines. At the moment I see little reason to hope that, when we get past the next 8-12 weeks, we will be in a position to do anything like the same. And, because of that, more people will die.


The COVID-19 pandemic is a once-in-a-century world altering event. It’s a juggernaut that has, and will continue to, exact an immense human and economic toll. I’m still trying to wrap my head around it.

The next few months feel like a maze with high walls. No way to see around; the only way out is through.

After that, there’s another even fuzzier period of time before vaccines become widely available. I assume we’re talking a year or two, which means COVID-19 will be a threat for a long time to come.

Stay healthy. Stay safe, my friends.

I made the mistake of saying something non-snarky about COVID-19 on Twitter this morning:

Collective action is hard. It’s Seattle’s moment to decide the path ahead.

This seems straightforward: our behavior, right now, can meaningfully alter outcomes in the Seattle metropolitan region. I’m impressed with the measures King County public health has taken so far, including yesterday’s request that all employees who can work from home should work from home. I was happy to see Microsoft and others in the tech community quickly follow suit.

My statement also came with a retweet of Scott Gottlieb arguing that we need to go further. This led to a tart reaction from a fellow traveller in the local tech community:

People need to stop confusing “first US outbreak” with “only fucking place we are testing because we said fuck waiting for those test kits”

There are several things to tease apart here.

First: yes, Seattle has a better grasp on its situation than probably any other region in the US because smart researchers in our area effectively worked around the CDC. We’re apparently both lucky and good.

Second: as of relatively recently, we are not the only region in the US to test for the new coronavirus. Community spread has been detected in CA, OR, NY, NJ, RI, and NC. I don’t know the status of testing across the US. Based on news reports, it sounds like it’s vastly too little. But it’s also not zero.

Third: we have more confirmed COVID-19 deaths in Washington State than anywhere else. Even given lack of testing, it seems unlikely that 10 deaths have been missed in some other region. As a result, I think it’s fair to assume that while there are plenty of undetected infections across the states, Seattle (and perhaps the Bay Area) are further along than most. (It also won’t be surprising if a major metro, like New York or Houston, spikes beyond us sooner rather than later.)

Finally: at least one Twitter reply described Gottlieb’s thread as “extremely dangerous”. I suspect we read it quite differently. I read it as an argument that Seattle should seek assistance from the federal government, and that the federal government should tie such assistance to the enactment of even sharper measures to curtail the spread of the disease. Gottlieb appears to argue that Seattle should go first because, by luck of the draw, all eyes are on us. This all seems sensible to me and I generally agree with it. On the other hand, if Gottlieb intended to suggest that the federal government should seize control of public health response in the Seattle region, or that Seattle is the only region for which measures must be taken… well, no, I wouldn’t agree with that at all.

:: audio

That feeling when it’s nearly 2020, you head to the studio without an objective, and you realize that — apparently! — you’re still thinking at least a little bit about Thievery Corporation.

Ah, well. Better luck next time.

It’s impeachment day for Donald Trump. In case my politics aren’t already plain: I believe it is necessary to both impeach and remove Trump from office.

Removal is unlikely to happen in practice, of course. This fact should be the final nail in the GOP’s coffin. For it, they must suffer an ignominious electoral defeat in 2020.

Shortly after Trump took office, I wrote:

Trust strikes me as the far more insidious concern. Trust may have been eroding before Trump, but he willfully accelerated the process. I have no doubt that he will continue to sow distrust in our government and media institutions throughout his tenure. This is a poison that will linger, harming our country long after Trump is gone.

I hope he leaves well before 2021. Regardless of when he goes, we have a lot of difficult work ahead of us.

:: audio

My blog has been quiet of late — any summer away from the command line is a fine summer, in my book — so here’s an interlude from an “unfilmed film” to fill the space:

I had a great time at the IndieWeb Summit in Portland this weekend. Thanks to Aaron, Tantek, and Tiara for organizing a fantastic conference!

For Sunday’s “hack day”, I (1) enriched this site with microformats and (2) added support for both inbound and outbound webmentions. I came very close to adding full micropub support via the IndieKit OSS project but, alas, I discovered a couple blocking bugs along the way. Perhaps I’ll have a chance to issue a pull request soon…


Kimberlite is now called Glow; the new glow.fm website is live!

I’m excited about this project on two fronts.

First, the people: Amira Valliani is Glow’s co-founder and CEO; Brian Elieson is co-founder and CPO. They’re both fantastic. Without Amira and Brian’s tireless efforts over the past half a year, Glow simply wouldn’t exist today.

Second, the principles: Glow is the rare business that embraces podcasting’s distributed nature. As a result, Glow can provide powerful tools to podcasters without standing between them and their listeners. Embracing podcasting as it is, not as a b-school grad might wish it would be, eliminates entire categories of problematic outcomes like walled gardens, privacy-violating advertising, and experiences that require listeners to download an unfamiliar podcasting app.

If you’re a podcaster and you’re interested in direct monetization, say hello.

:: audio

A while back I stayed up late listening to Autechre, contemplating their utter disinterest in humanizing the sounds of machines or in producing legible musical forms. It inspired me to make a wall of machine sound, too.

:: audio

Here’s a trio that does not exist, conjured from the immense sound library that is Native Instruments’ Komplete. I programmed the drum track and performed the Rhodes and bass tracks live.

The value of today’s music software bundles is incredible: a few hundred dollars buys more sonic possibilities than one can explore in a lifetime, including — it would seem — the possibility of a jazz trio that doesn’t exist. 

Modular Pocket Operator

Teenage Engineering builds zany music machines. Their synthesizers create all manner of sonic mayhem and they’re weirdly beautiful objects to boot.

One thing I particularly admire is TE’s anti-emphasis on usability: their devices are intentionally — almost gleefully — obscure. A good deal of brute exploration is often required just to figure out what the buttons do. It feels like music-machines-as-puzzle-box shouldn’t work, but it does: there’s a certain delight as serendipitous discovery gives way to mastery.

The upcoming modular pocket operators look ridiculous:

Teenage Engineering Modular Pocket Operator 400

If you haven’t seen them, the original pocket operators are also wacky fun. They look like a crossbreed between old-school four-function calculators and Nintendo’s handheld Game and Watch devices from the early ’80s:

Teenage Engineering K.O. Pocket Operator

What’s not to love?