It took me a couple months to stop thinking about layers.

My first move toward ergonomics was a Keebio Fourier 40%. It had been a few months before that when I started using Colemak on my laptop keyboard; I did that using Windows keyboard settings, and I was taking notes in meetings, so whenever I couldn’t keep up, switching back to QWERTY was a hotkey away.

After switching to the Fourier, and iterating many times on the QMK settings, that was the month or two where I had to think through all the control keys, symbols, and function keys I was typing. I didn’t quit typing on other keyboards, although I typed on my Fourier as much as possible; and I have not ended up forgetting anything I learned before.

I’m now on the precipice of moving from a 4x6 Dactyl Manuform to a 4x5 Splaytyl (if I can find those dang parts and get the thing built!) and that’s too small to have things like Tab, Enter, or the backslash on the home layer. I’m nervous. I’ve tried making a 4x5 layout for the DM, but haven’t ended up sticking with it. I couldn’t really get used to keys that are physically there, not doing anything.

A name I’ve seen in connection with this issue is Obtainium. From a cursory look, it appears this just streamlines checking for and getting apk’s from GitHub release pages and other project-specific sources, rather than adding any trust. So maybe it just greases the slippery slope :)

Security guidelines for mobile phones, and therefore policies enforced by large organizations (think Bring-Your-Own-Device), are likely to say that one may only install apps from the platform-provided official source, such as the Play Store for Android or the Apple App Store for iOS. You might say it’s an institutionalized form of “put[ting] too much trust in claims of authority.” Or you might say that it’s a formal cession of the job of establishing software trustworthiness to the platform vendors, at the mere expense of agency for users on those platforms.

People are not taught how to verify the authenticity and legitimacy of software

Rant: Mobile computing as we know it is founded on the rounding off of the rough corner of user agency, in order to reduce the amount users need to know in order to be successful, and to provide the assurances other players need, such as device vendors, employers, banks, advertisers, governments, and copyright holders. See The Coming War on General Computation, Cory Doctorow, 2011. Within such a framework, the user is not a trustworthy party, so the user’s opinion of authenticity and legitimacy, however well informed, doesn’t matter.

I got a Keeb.io kit and soldered it myself, and then I’ve handwired a Dactyl Manuform and (halfway) a Splaytyl. I love how many people can build you a 3d-printed keyboard these days, but I’m already equipped and experienced to do it all myself.

I’ve been using a tshort dactyl manuform 4x6 for 5 years now, having never planned to use it for even 1 year. I only commonly use the two innermost thumb keys; I didn’t think I would like the thumb cluster from watching a video of someone typing on it, and I indeed don’t like the thumb cluster. The switches are Kailh Brown; one of them started to stutter and I replaced it with … a TTC Brown or some such.

I’ve printed, but not finished, a Splaytyl. I think it’s going to feel nice, but it’s only 4x5, and I’m nervous about not having Tab and Enter on the base layer.

Colemak DH represent!

They are made (I think) to be implementable - even, to give implementors some flexibility. Then everybody goes and buys a tool to do it, and not that well. I thought 15 years ago that security configuration was a (voluminous) subset of system configuration and system administration, ripe for automation and rigorous documentation - not something to pay a different vendor for. But the market says otherwise. When you can split some work across a whole team, or even into a separate company, instead of glomming it into one job, that’s worth money to businesspeople.

There are many ways to be more selective about from whom to accept email. SPF, DKIM, DMARC, and various blacklists are among them. They are supposed to make life harder for spammers. But they have also made running a mail server something that few dare to try anymore. Setup is not easy, but getting blacklisted is, and it causes silent delivery failure, and takes days of work to fix.

As a result, most of the email is run by Microsoft and Google. But that didn’t stop phishers. They just go after people at smaller companies where security isn’t as tight yet, and then they’ve got valid Microsoft accounts to send from. Liars and Outliers by Schneier is about this sort of dynamic.

As for PKI: If I may assume you to be, or have been, affiliated with an armed service – Whose property is your CAC? And why did you use a pseudonym to make this post? (I mean to be pithy, not sarcastic.) I think Liars and Outliers by Schneier is all about this sort of thing - but I didn’t get much of it read before it was due back at the library.