To call this derivative is an understatement. But that's what this genre demands; rehash all your favourite media properties into something new. It's the literary equivalent of having your Transformers™ fight your He-Man© toys.

The plot, such as it is, features the Vogon Constructor Fleet destroying Earth due to a late beurecratic appeal, forcing people to play The Hunger Games, while a Twitch streamer narrates the action.

The protagonists in Andy Weir's books are boys who know enough science to save the day. The ones in Scalzi's books have enough pop-culture knowledge to save the day. Dinniman's has played enough loot-box gatcha RPGs to save the day.

It is mostly pretty good fun. The tropes are goofy, the gore is splattertastic and only rarely ventures into torture porn, the villains are suitably campy, and the wisecracking sidekick doesn't become too annoying.

But the prose…

Here's a classic scene from Red Dwarf which exemplifies the major problem I had with this book.

There's only so many times you can read "Then I severed a +3 damage with poison debuff while he raised a +1 shield and used his armour of holding to neutralise the attack". I find opening endless lootboxen a chore when I'm playing a game - reading 150 instances of "I got a bronze box with a cauldron of Mafeking, then a gold box with an enchanted ring, then…" just becomes tiresome.

I tried listening to the audiobook of the sequel and I just couldn't get past the endless recitation of lists about +5 to elbows and -6 to arseholes. Just unbearably tedious.

Look, I've never written a novel and doubt I could do any better. This has obviously found its fanbase but, regrettably, I'm not one. It was a fun enough read, but I'm not sure I can be bothered with a dozen more sequels of recycled plots and repetitive squishing of cackling enemies.

After several volunteer shifts over the years, I also decided to be utterly selfish and do none this year. Again, rather nice being on the customer side of the bar without worrying that I'd cocked up someone's order.

Similarly, I had thought about doing an art "thing" or building something for the badge. In the end all I did was ask my friend Skylar to set up a shortcode so people could ring 26262 (BNANA) for an audio surprise.

To be clear - you should absolutely propose a talk, pitch an installation, and volunteer. It's a great way of experiencing the festival and giving back. But I was exhausted after a 6,379 Km Interrail journey and, frankly, wanted a change of pace.

Everyone has a different EMF. I mostly went to talks and looked at cool art. Some people were focussed on playing all the games. Some gorgeous people were just there to strut about in their amazing costumes. A few people delighted in showing off all their cool toys. It really is about seven festivals in one. I'm still bemused by some of the things - I've no idea what a challenge coin is, I'm hazy about how the various puzzles work, I didn't know about the cool musicians until it was too late.

Still, I came away physically exhausted and mentally refreshed - so a success!

What Worked

• We took our Walkie Talkies. So much easier to use Push-To-Talk rather than hoping a text was seen. Worked all the way across the field.
• I took lots of Thermal Images - and people seemed to like them!
• Handed out a million stickers for OpenBenches - and met several people who'd used and enjoyed the site.
• I hired an electric van to lug our stuff. It was quick and easy to charge on the way up and back. Much more relaxing to drive than our enormous camper from last time.

What Almost Worked

• We got an inflatable tent so we didn't have to faff too much putting it up. In the end we needed a bit of help (thanks Lucy and Parker). The tent was an excellent size. The blackout stuff kept us reasonably cool and there was good airflow. But, fuck me, sleeping on an airbed in a tent in a heatwave just isn't my scene!
• Similarly, dragging our stuff from the car park to our village was a slog. Damien from Hacky Racers gave our kit a lift using his Ghost Rider go-kart which saved my aching back.
• The queue for the showers was a bit long - our village members sent back regular queue updates. Once I got in, it was pretty decent. Obviously I felt time pressure to clean up quickly, but the water pressure was decent and there was enough space to hang my pants without getting them soaked. Of course, I dropped my t-shirt into a puddle because I'm incompetent!
• It was hard to meet everyone I said I'd see there. I kept getting distracted - sorry if we were due to chat!

What Didn't Work

Some of these are no-one's fault, just circumstances. Others are just not the way I'd have done things.

• One of the food stalls served the worst veggie burger I've ever had. No sauce, no veg, no condiments or pickles. Just a bun tasting of sadness. Bleh. Rest of the food was decent for a festival.
• Given the heat it was unfortunate that the water pressure was so iffy. There was plenty to drink, but it trickled out slowly at times. Other festivals regularly water the paths to prevent so much dust from being kicked up. That might have helped here.
• I'm terrible at remembering people's names - especially if I only met them once a few years ago, or they're dressed as a Furry. As much as I love the EMF badge, I wish it were smaller, lighter, and mandatory for people to wear it in a prominent position. Ideally their forehead.
• There's a general lack of signage at EMF. The webmap was useful - but a few wayfinding posts would have helped me and others.
• It is loud. Some of the music overwhelmed the people who were speaking on stage. I guess it is hard to put soundproofing in a tent 😆

2028?

I'm still on the fence about going next time. Not because of anything the organisers did or didn't do. I just can't stand camping in an actual tent. Small camper vans are frustrating to live out of - even for a long weekend. A big mobile home is a pain in the arse to drive. Perhaps I need a glamping yurt? Or someone to chauffeur me in a tour bus?

In short, wandering in the dark and tripping over guy ropes when I'm desperate for a piss isn't the way I like to spend my time!

I'm also conscious that events like these rely on a steady stream of new blood. Having attended three in person and one remotely, I'm aware that I'm taking up space which could go to someone who would have their mind blown by the delightful madness contained in that field.

Previous years have allowed people to get a guaranteed ticket in exchange for one volunteer shift. This year you needed two shifts. I think that's a great way to diversify the festival and stop it just becoming the same faces over-and-over again.

I know that if I don't go I'll suffer from intense FOMO and will vicariously follow all the social media posts. But I don't know if that will outweigh smelling like a rancid turnip and getting stressed that the queue for the loo will be unbearable.

Let's see what the next two years brings, eh?

Photos

Anyway, here are a few of my favourite photos. Click through to see some more on Mastodon.

@Edent@mastodon.social

Terence Eden

Oh no…
#EMFcamp

---

@Edent@mastodon.social

Terence Eden

Pretty much accurate reflection of my Null Sector experience.
#EMFCamp

---

@Edent@mastodon.social

Terence Eden

I'm stuck in the composting toilets with no paper 😕
Anyone know how I use these?
#EMFCamp

---

@Edent@mastodon.social

Terence Eden

Daleks are friends, not foes!
#EMFcamp

---

@Edent@mastodon.social

Terence Eden

ALL HAIL THE BLOB ™️ It does not hurt when the proboscis descends into the brain matter. Get your blob today!
#EMFcamp

---

@Edent@mastodon.social

Terence Eden

You can use a thermal camera to see how full the #EMFCamp poo tanks are 💩

---

I didn't care for this book. It attempts to interweave botanical and cultural history with an autobiography and ends up doing neither particularly well.

For every dose of poetry about the far-flung and exotic journey of the fruit, there's a dull recitation of facts from Wikipedia. Occasionally various origin myths of citrus varieties are presented - there's no attempt to engage with them, seek out the truth, or comment on what they might mean.

Instead, the author seems more interested in inserting herself into the narrative. It's all rather uneasy. She spends a lots of times talking about hard it is for immigrants and their children. But her dad was a doctor who chose to stay in his new country, she's a fairly prominent journalist, and they spend a lot of time jetting across the world.

I know we're all fighting a battle no one else can see, but this isn't the story of someone's struggle against insurmountable odds.

There's an excruciating passage where she tries to rail against the evils of colonialism and expects her family, who grew up under colonial rule, to support her:

She set down her cup with a steady hand. ‘The British did some good things and they did some bad things,’ she said. ‘But what they did is in the past lah.’ She shrugged and picked her cup back up. ‘In Malaysia we need to think about the future.’

The author is utterly dismissive of other people's lived experience. She and I probably both agree that colonialism was a blunt and savage crime against people. But she can't let go of the fact that some people seem rather nonchalant about it.

I once asked my aunt about her colonial education, and she called it a gift.

It sort of feels like a privileged kid seething that no-one understands how hard it is to be her. I found the solipsism rather distasteful, and the lack of rigour in the botanic history left a bitter taste in my mouth.

I've been banging on about this for a while so was delighted to be invited to chat with the GeoSocial Task Force on their monthly call.

But, before I start, please remember that these proposals are not mandatory. If you don't want to share your location, then please don't share your location. This is an optional feature which shouldn't be used by people with a strong need for privacy.

We were primarily discussing the nascent Geographical Microsyntax proposals.

Firstly, I love the idea of being able to share my location. I want my friends to know I'm in town for a gig. I want people to think I'm cool because I'm seeing some experimental theatre. I want to virtue signal that I'm giving blood.

Similarly, I want to be able to find social media posts by location. What's happening right now in Paris? Did anyone else hear that sonic boom in London? Which cool people are also at this gig with me?

But, I do think these proposals have some issues which need to be addressed.

User Research

The primary thing missing from the proposal is any form of understanding what users want to do with a geotagged post.

You see a post like:

Hanging out with friends. I just checked in to Leicester Square.

What do you expect to happen when you click that link?

• See who is at the location?
• Read more information about the place being discussed?
• Find all posts at that specific address?
• Discover posts which are close to there?
• Something else?

What other things do people want to do with geotagged posts?

• Find all posts within 5Km of me?
• Discover users who have posted near me?
• Get emergency alerts for the city I'm in?
• See what's trending in a specific country?

Without knowing what people might want to do with this information, it's rather hard to design a service which meets their needs.

To micro or not to micro?

Where I disagree with the proposals is the idea of using inline text as a form of microsyntax.

Proposals like "I am in /London/ eating ice-cream" or "Checked in to Leicester Square L:N123456" fail for a couple of reasons.

Things like #hashtags and @mentions developed organically on social networks before they were eventually adopted by the platforms themselves. It is rare that a top-down diktat can be used to tell people how they should be formatting their posts.

More importantly, people are crap at formatting things consistently! Every event I go to has people using #Event alongside #Event2026 or #Event26 or a hundred variations.

Even if users could format it consistently, names are ambiguous. Is 🌐:Paris the one in France or Texas?

I'm strongly of the opinion that text is for text, not syntax.

Openness 🆚 Centralisation

Saying that you're on a specific point on the globe doesn't always provide useful information. Even with altitude, it isn't always possible to work out if your in the Starbucks or the Costa next door. Do you want to say you're in a train station, or a distinct platform, or even a specific train journey?

There are various services which offer unique IDs per loosely-defined place.

Google Maps provides a Place ID for every thing that it knows about. There's a similar service from FourSquare. But both of those are closed and proprietary systems - they can only be updated by the company that creates them.

Wikipedia's Wikidata has IDs for lots of places, similarly OpenStreetMap has nodes with names which can be used to identify locations.

But all of these suffer from the same flaw; they are centralised.

If Google kills its service then all those Place IDs die.

This has happened before. Yahoo used to run the Where On Earth IDentifier service but discontinued it.

While OSM and Wikipedia are great projects, they're still centralised. If you're banned from OSM, you can't create a new node.

So, to my mind, the primary way of identifying a place has to use a fully open, globally agreed, and unrestricted standard.

Location Plus Plus

The obvious choice is latitude and longitude as defined by WGS 84. It allows for arbitrary precision anywhere on the planet.

No one can stop you issuing lat/long just because a country is under sanctions. The standards community can't revoke your access to it. The co-ordinates are well understood by almost all software.

There are some alternatives. Google's Plus.Codes build on top of lat/long to make something more human readable. But, crucially, human readability is not the issue here. This is metadata which should never be shown to a human. If a user interface wants to format a lat/long they can do so as a Plus.Code or any other format.

GeoJSON

There are dozens of competing ways to mark up a location.

It seems sensible to me that, given most major social media protocols use JSON, adding GeoJSON would be the simplest way to add geographic information to a post's metadata.

At its most basic, a single "Point" can be shared like so:

{
    "type": "Feature",
    "geometry": {
        "type": "Point",
        "coordinates": [-0.13005,51.5103]
    }
}

It can have as much or as little precision as needed.

If the place being checked into has a name, it can also be added - this could be used for display purposes within the message

{
    "type": "Feature",
    "geometry": {
        "type": "Point",
        "coordinates": [-0.13005,51.5103]
    },
    "properties": {
        "name": "Leicester Square"
    }
}

The properties can be as complex as the sender wants. For example it could add Wikidata references, OpenStreetMap IDs, telephone numbers, or some cool new thing which hasn't been invented yet.

Here's a maximalist example of checking in to a park:

{
    "type": "Feature",
    "geometry": {
        "type": "Polygon",
        "coordinates": [
        [
                [-0.1303791,51.5099976],
                [-0.1295305,51.5100444],
                [-0.1297077,51.510947 ],
                [-0.1308786,51.5105859],
                [-0.1308893,51.5105793],
                [-0.1303791,51.5099976]
            ]
        ]
    },
    "properties": {
        "name": "Leicester Square",
        "WikiData": "Q848912",
        "OSM": "4082589",
        "GooglePlaceID": "ChIJPcTFENIEdkgR94E58rgB69o",
        "PlusCode": "9C3XGV69+4X",
        "Quinfrob": "🌐89451_𰻝",
        "address": {
            "road": "Leicester Square",
            "neighbourhood": "St. James's",
            "quarter": "East Marylebone",
            "suburb": "Covent Garden",
            "city": "City of Westminster",
            "ISO3166-2-lvl8": "GB-WSM",
            "state": "England",
            "ISO3166-2-lvl4": "GB-ENG",
            "postcode": "WC2H 7NA",
            "country": "United Kingdom",
            "country_code": "gb"
        }
    }
}

What's Next

My personal opinion is that the following needs to happen:

• Talk to some users - find out what they might use this for.
• Work with privacy advocates to reduce possible harms (for example, being able to redact a location from a previously shared post).
• Discuss with developers about how they'd work with this metadata.
• Clients should start adding GeoJSON metadata to their posts, even if it can't be displayed yet.

You can read the minutes of the meeting and I'd encourage you to join the next call.

It is wild just how confusing and complex buying a ticket can be. While some cities obviously take a user-centred approach to ticketing, others appear to take a Kafkaesque delight in a bureaucratic maze of zones, apps, and intricate restrictions.

One of the seminal texts in computer systems design is "Don't Make Me Think". Every time a service forces the user into making a decision, it is placing a cognitive burden on them. Computers' jobs are to make things easier for us fleshy meatbags.

There are some intractable problems with navigating unfamiliar spaces (looking at you Kyoto Station!) and a transport authority can't publish signs and make announcements in every conceivable language, but there's one thing they can control - ticketing.

Let me take you through some of the public transport ticket experiences I had - and explain how easy or hard they were to use.

Basel, Switzerland - free

Upon checking in to our hotel I was given a free Basel Card. It entitled me to free public transport across the city.

Zero extra cost. I didn't have to remember to take a physical card with me - the details were emailed as a PDF directly from the hotel on check-in.

I didn't have to show the bus driver when I entered a tram. If a ticket inspector was present, they could have asked to scan it.

This is close to the platonic ideal of "Don't Make Me Think" public transport. I didn't have to work out zones, fares, or timings. I didn't need to interact with people or machines. I didn't worry that I was somehow doing it wrong and was going to get shouted at.

Milano, Italy - contactless

I tapped my credit card on the reader. Whether it was a bus, tram, or metro the process was the same. Tap, wait a few milliseconds, beep. On the metro the gates opened automatically. On the tram, I just sat down after the beep.

The fares have a bit of complexity based on how frequently you travel. If you catch another bus within 90 minutes it only counts as one fare.

I didn't care because the daily price was capped.

Once I'd taken a few journeys it wasn't going to cost me any more. With a fee-free credit card it was simplicity itself.

If I had been on an extremely tight budget, I might have done some thinking - but as the daily cap was less than the price of a cocktail, I didn't bother.

Warsaw - paper ticket validation

I walked up to a touchscreen kiosk, selected the 🇬🇧 flag, and bought a 3 day paper ticket for a few € using contactless. The machine spat out a small paper ticket.

I hopped onto a tram, shoved the ticket in a slot and the machine printed a timestamp on it. Well, in theory. It didn't work the first few times for inscrutable reasons.

From then on, I didn't have to do anything. I jumped on whatever public transport I wanted. Only once did a ticket inspector come round demanding to see everyone's proof of validity.

The ticket was a slightly inconvenient size for my wallet - being much smaller than a credit card - and I think the kiosk should have validated it automatically. But, for general transport purposes, it was great at not forcing me to think.

Tallinn - scan the app

Install an app, choose ticket type, pay, done.

Every time I entered public transport, open the app, click the ticket, wave the resultant QR over a scanner.

Obviously choosing a ticket type is a little thinky. Do I want a single ticket, a day pass, something longer?

I'm not averse to installing an app when necessary. Thankfully, this transit app worked on GrapheneOS. There was an optional registration step which I skipped because I was unlikely to come back any time soon.

Riga - scan the bus

OK, this was just weird!

Much like above, install app, choose ticket, pay.

Despite buying an all-you-can-eat ticket, I still had to register on every bus/tram I got on. That meant hopping on, finding a QR code, opening the app, and trying to scan it while the driver attempted a new land-speed record.

Melbourne - annoying

We wanted to visit a mate in the suburbs of Melbs. For this we needed to buy a plastic card. We then needed to load it up with (I think) multiples of $5. Our return fare was about $7.50. So our actual journey cost something like double what the fare was.

There was no obvious way to get a refund for the credit amount, nor for the cards. So we gave them to a friend to distribute to any other tourists she hosted.

Paris - ridiculous

Fuck Paris. The only way to buy a metro ticket is to download an app. Fair enough. But, after downloading the app it tells you to install another app!

What the actual fuck? A convoluted, messy, and frustrating situation which has resulted in awful reviews for them.

Trains and metro travel require separate tickets at different prices. You can't easily hop from one to another. You need to think carefully about the route you're taking. A more convoluted route may be significantly cheaper because it doesn't involve swapping between services.

Madness!

The ticket readers use your phone's NFC chip to validate. So there's no technical reason why they can't just use contactless payment cards.

To be fair, change is coming… in 2030!

Japan

Last year we took a trip to Tokyo, Osaka, Hiroshima, and Kyoto. We picked up a physical Suica card (because the digital one only works with iPhone). We topped up the card with cash (which was a bit of a pain). An annoying start - but from then on it was seamless. The same card worked on trains, busses, and trams in all the cities we visited! Brilliant! We didn't need to think at all. Compare that to Germany where every city has its own special app and it was always a pain to remember which one to open.

I understand that Japan's public transport system now accepts foreign contactless cards - which should make things easier for travellers.

So what's best?

In an ideal world, all public transport would be free and plentiful. In our less-than-ideal reality, it seems obvious to me that public transport should above all be simple.

Tourists don't want to grapple with the complexities of zones, split tickets, random charges, and a different app for each city.

Regular travellers don't want yet another piece of plastic tat in their wallets, or to work out in advance what precise combination of journeys they need to take in order to optimise their spending.

One app is fine. Having to install a different app for each city you visit - even within the same country! - is infuriating.

Visitors should not have to think about how, where, when, or why they need to validate their tickets. Nor should anyone need to figure out which modes of transport are inclusive or not.

For the casual visitor, contactless payment with a daily / weekly cap is the simplest possible charging mechanism. It's cheaper for the cities to not have to build, develop, and support apps.

If you've come across a better public transport ticketing system - please let me know in the comments.

I'm pretty sure this book is a psyop designed to demoralise a generation of starry-eyed dreamers. It is obviously written by the same people who told us not to land on Europa. A malignant energy designed to limit the scope of human ambition and thwart our plans to colonise the universe.

The problem is, I can't find fault with any of their logic.

The Weinersmiths make a compelling case that space is much harder than any of the propagandists are willing to admit. Even if it were faster, safer, and cheaper - there's still very little point. Any of the technologies we could point at the skies would be infinitely more useful (and profitable) pointed back at our pale blue dot.

Along the way they take in biology (is it even possible to breed in space?), legality (OK, but what jurisdiction will it be under?), and moral philosophy (will we actually become more enlightened beings?)

And yet, space is cool. I know that "because it is there" isn't a logical argument; but it is a hell of an emotional pull. In amongst all their (justified) snarky cartoons are occasional pearls in the rubble:

As with the cathedrals of Earth, those of us who cast the first few bricks may not be around to see the spire placed on top, but we might nevertheless want to start building.

They excel at making the dull delightful. There are a lot of big and serious facts to get through, but they have a gift for communicating them simply and eloquently. I just wish they'd've come to a different conclusion.

Straight away you can see it is different from normal IR cameras - they tend to have a small fixed screen and a rubber button interface. This has a lush touchscreen which displays the thermal image and is used to control the camera. The screen can go bright enough to be easily visible in full daylight, and you can dim it down to something more appropriate for night-time viewing.

OK, enough waffle, time to get snapping!

Photos

Here are some shots from the camera of various bits of wildlife near me. I haven't edited these images, they're exactly what you get from the camera.

The resolution is 512x384. There's no EXIF metadata - so no location information.

There's also no in-picture thermal gradient so you can't see the exact temperature of an object. This is designed for spotting animals, not working out how hot your electronics are. The datetime is burned in to the image but can be turned off.

It has the ability to almost totally remove the background "noise" of the sky - making it excellent for spotting things on the wing.

Filesize is about 20KB per photo. So you can fit will over a million images on the ~32GB internal storage. Digital zoom goes up to 8X.

Videos

The static images don't really do it justice. It's also possible to shoot video. This gives you a reasonable idea of what you'll see on the touchscreen.

Video resolution is the same as the photos - 512x384 - and runs at 30fps. File size is around 40MB per minute. So about 12 hours of footage can be stored. I've re-encoded these videos to be smaller while keeping the same quality.

Here's a friendly fox I found - I've cycled through the various settings so you can see how they work.

Again, as with the photos, there's no metadata and the datetime is burned in. Here are a couple of cats playing around in the park.

Twisting the lens allows you to adjust the focus - it is really impressive the amount of detail it can pick up.

There's no video stabilisation (use the tripod mount if you need it) and there's no audio.

RTSP

You can also stream the video to a computer, VLC, or anything else which will take an RTSP stream.

The URl will be rtsp://[IP Address]:8554/ch0 - that will get you a 20fps stream of exactly what the camera is seeing.

Range and Detection

It reckons it'll detect a human's heat signature from around 900 metres away.

There are several modes which will let you see more or less detail. That's particularly important if you're just interested in the hottest part of the image, or if you need to photograph something against a relatively warm background.

The App

This'll pair with your Android phone using the Thermal Masters app. It's a bit of a beast - around 200MB. That's because it's the same app for all their cameras and contains PDFs for several different models. Despite the relatively high download numbers, it has zero reviews.

Like lots of software from hardware manufacturers, the app is basic but serviceable. It connects to your DV2 via WiFi. You can either be on the same network or connect the camera to your phone's hotspot.

Looking through the app's code, it appears to use OpenCV, ffmpeg, and some other popular Open Source libraries. Sadly, the required attribution is missing.

The app is great for monitoring the camera, you can zoom in on the image and fiddle with some of the settings. But you can't actually trigger a photo or video recording! That's a bit annoying.

Linux

For our penguin powered friends, this shows up as 1f3a:1000 "Allwinner Technology Prestigio PER3464B ebook reader (Mass storage mode)". It's a basic drive which lets you copy the media back to your computer via USB-C. Easy as.

Comparison

So how does it compare to the Topdon TS004 Thermal Camera? The Topdon is also marketed at the bird-spotting crowd and, on the surface, has fairly similar features.

The most obvious difference is the user interface. The TS004 is a Monocular - so you need to shove your eye into the end to see anything.

With the DV2, you've got a big screen to look at - which is generally much more pleasant. That display of the DV2 is a touchscreen which makes it pretty easy to interact with - whereas with the TS004 you have to repeatedly mash buttons to change any settings.

In terms of resolution, both have a standard 256×192 sensor. The upscaling on the DV2 is good - but doesn't fundamentally change how much thermal information there is.

But it is the thoughtful little extras which make the DV2 useful. There's a built-in laser pointer which is useful for working out exactly what you're aiming at. At the bottom is a standard tripod mount, so you can rig it up somewhere to monitor an area.

Slightly bizarrely, it comes with an optional Picatinny Rail adaptor. That screws into the side of your DV2 and allows you to add firearm accessories! So if you ever wanted to add a sniper scope to your thermal camera…

Alright, a regular range-finder will also attach to it 😆

The battery is a bit of an odd one. You can physically remove the battery and place it in its own USB charger. The battery is a 1INR22/71 which is a chunky beast. The charger comes with two slots (although only one battery is included) so you can quick-swap to a full battery if you need to. There is a USB-C port on the bottom, if you want to charge it the normal way.

With the TS004, the only way to stream video was via the app. The DV2 will connect to any WiFi network and present an RTSP stream. The built in WiFi is useful for grabbing firmware updates.

The DV2 also suffers a little from the lack of a trigger button for taking photos. When held in the hand, it feels natural to click the button under the thumb finger - instead, that toggles the laser. Taking a photo means tapping away on the screen to get to a sub-menu. Annoyingly, your phone can't be used as a remote control.

One thing in the TS004's advantage - it's lens cap is attached to the body of the unit. The DV2's is a separate rubber cap which comes off completely. Best remember to stick it in the supplied carrying case, eh?

The TS004 also has built-in animal recognition. It can detect heat signatures and tell you if they're a bird or a human. However, it always misidentified English foxes as Wild Boars! So was of limited use.

The DV2 uses AI to upscale the quality of the images rather than trying to detect what it is actually looking at.

In general, the DV2 is easier to use and produces seemingly better quality media. But having to tap the screen multiple times to take a photo or video is slightly annoying.

Price

All the infrared cameras I've reviewed have been expensive. This one is no different. At the moment it is in stock for £459.

You can use the code THERMBIRD10 for 10% off at the official store or from Amazon.com.

That's a chunk of change - but you do get a lot of tech for the price. This isn't designed for finding hotspots in your home, it's excels at picking out wildlife - and the screen is big enough for several people to gather round to see what you've spotted.

Final Thoughts

This is one of the better thermal imaging devices that I've reviewed. The large touchscreen makes it so much easier to control than anything else on the market - all the others have squishy rubber buttons. It is mostly a delight to use, if you can put up with the slightly strange process of taking a photo.

Thermal cameras are still very expensive - the sensors are low resolution and sometimes flaky. The DV2 does a great job of producing a usable images and videos.

The app is no worse than the competition. It really ought to inform users about the use of Open Source code though.

The addition of the laser pointer isn't as gimmicky as I'd thought. I've no use for the Picatinny attachment, but I can see how it could be useful.

If you want to go wildlife spotting, this is probably the device to get. It captures an incredible amount of detail and is excellent at picking up the faintest heat signatures.

It has a hefty USB-C PD (Power Delivery) port for rapid charging of my phone and laptop. Two other USB-C ports for my other gadgets. And a couple of legacy USB-A ports which were redundant. The pass through was useful for using the same socket as the hotel's TV / lamp / coffee maker.

Wherever we were in the world, I was 100% confident that I would be able to buy a replacement charger if I needed it. USB-C cables are everywhere too. What are the chances that I could find the exact charger needed for a GameBoy Colour? Or the puck for last year's Pixel watch? Or the weird barrel jack for an HP laptop?

No. One charger. One cable. One standard.

Here's everything I took which needed to be recharged.

• Phone
  • A Pixel 8 Pro (running GrapheneOS). It also has the ability to act as a power source and recharge other devices.
• Laptop
  • A Chuwi MiniBook. Small, light, decent battery.
• eReader
  • A no-name eInk device. I read a lot on holiday.
• Watch
  • A cheap but capable smartwatch. No magnetic charging dongle - just shove the cable into the body.
• Toothbrush
  • Again, a cheap and unbranded device. And, again, no charging dock - the bottom has a protected USB socket.
    
• Tracker
  • What if someone steals my bag? Hopefully the PebbleBee "Find My" device will help me recover it.
• Battery
  • Most trains, trams, and buses have USB power supplies. But sometimes you want your own hefty store of electrons. This one accepts PD charging and also outputs PD.
• Headphones
  • Some cute ear-cuff headphones. I feel a bit guilty about including these, because it is their case which has the USB-C port rather than the cans themselves.
• Bug Bite Zapper
  • This is a bit of a cheat. It uses my phone's USB port to heat up.

I probably could have gotten away with a single-port charger. The phone needs recharging every night, but most of the other devices can go days or weeks without being topped up.

As we were travelling light(ish) I didn't bother bringing the Nintendo Switch. We were in a major cities, so no need for our USB-C powered walkie-talkies. We were out sightseeing most days, so I didn't take the USB-C to HDMI adaptor which would have let us connect the laptop and phones to a hotel TV. Perhaps in the hotter countries I could have done with the USB-C neck cooler - instead I purchased a cheap USB-C rechargeable fan. Rather than bring a beard trimmer, I went to local barbers. If anything needed AA batteries, well, I could have used these rechargeable batteries.

I know there are some problems with USB-C. But the benefits far outweigh the glitches. Using my USB-C cable tester, I can be sure all the cables I have can deliver the amount of power my devices need.

There's simply no point buying any electrical gadget which uses a proprietary charging port.

You can read all my USB-C posts and all my gadget reviews.

What electrical items do you travel with which don't use the one-true-connector?

I'm not a big fan of the "Quantified Self" movement, but since buying a ridiculously cheap smartwatch, I've been interested to see just how many steps I take per day.

During our recent Interrail holiday, we travelled about 6,400 Km by train over 49 days. But how much did we cover by foot?

My watch pairs with the Open Source app Gadgetbridge rather than the crappy app made by the manufacturer. Sadly, Gadgetbridge doesn't have a simple way to export data in a usable format. Instead, it spews out a database dump and asks you to run SQL commands to get information out.

After a bit of swearing at the command-line, I got my daily step count. I didn't always wear my watch, but this is accurate enough for my purposes.

In seven weeks, I took 545,453 steps.

The average stride length for someone my height is around 80 cm.

So that's a total of about 436,362 metres

A marathon is about 42 Km.

No wonder I feel knackered. I think I need a holiday to recover!

Here's how our journey ended up:

The trip included two ferries - one overnight - which had a small Interrail discount. In total we spent approximately 40 hours on trains over a 7 week trip.

This blog post looks at the practicalities of the journey and the experience we had while travelling. You are free to decide which cities you want to visit and which you want to skip. This worked (mostly) for us - you should write a blog post about your own experiences.

London To Brussels

Eurostar St Pancras is dangerously crowded and needs tearing down. You can use RealTimeTrains to see your departure platform before it is announced - that's useful for avoiding some of the queues.

The first-class service in Eurostar is lovely (even if it doesn't get you access to the lounge). Unfortunately, you need to book vegan meals a few days in advance - a deadline I missed. The veggie option was fine though.

Made it to Brussels where we hit our first snag.

Brussels to Hamburg

We'd booked some of our tickets months in advance. What we hadn't realised is that construction work had been announced and our train would be getting is much later than we anticipated.

Neither Interrail (who we booked the seat reservations through) nor DB (who had our contact details) thought to tell us about the change in journey. Nevertheless, we jumped on a train and had a pleasant enough trip up to Germany.

The Interrail refund form is ridiculously complicated and asks for various screenshots. There really ought to be a big "DB Screwed Up" button for an instant refund. Still, after a couple of days the refund came through.

Hamburg to Copenhagen

There's a DB lounge at the station. We received suspicious stares at our Interrail passes which then necessitated deep examination of our seat reservation by two people. Begrudgingly they let us in. There were comfortable seats and some free drinks. It was mostly quiet until various children started crying.

The train was gentle and slow. 1st class got a snack included - veggie but not vegan. For the first time since leaving the UK there were passport checks which were friendly.

At one point there was a quiet announcement in German. We didn't think much of it until everyone started getting off the train. Turns out one of the carriages had suffered a failure and we were turfed out at Nyborg. Approximately 1,000 passengers attempted to board the next available train - it looked like an utter crush. So we waited for the one after that.

We were treated to a train with spectacular panoramic windows as it went over The Bridge.

A friendly guard told us where to change. Arrived a little late and filled in the Interrail compensation form again.

Copenhagen to Göteborg

The lounge in Copenhagen was basic but fine. A few bowls of fruit and a coffee machine but nothing else. Weirdly no train display.

The train had power sockets on the ceiling - along with headphone jacks! Was a little strange seeing cables dripping down from the ceiling. The 1st class seats were a little roomier than standard, but not much in it. Ticket inspector looked confused at Interrail passes but didn't challenge us.

Göteborg to Oslo

Trains were frequent enough that we didn't bother with advance seat reservations. No 1st class, but the quiet zone was spacious enough. Again, a brief glance at the tickets rather than scanning them.

I was heartily impressed to see snack vending machines on a train! Better than someone pushing a cart through I reckon.

Oslo to Stockholm

There were no signs on seats to say reserved and the service was very full. But we got our seats without a problem. There was free fruit and tea / water in the 1st class carriage. WiFi speeds were excellent.

Stockholm to Helsinki (overnight ferry)

Annoyingly, the ferry terminal is a rather long distance from the nearest tram stop which was a bit of an arse.

The check-in to the ferry warns of extra costs if you have the temerity to use the staffed counters - but the automatic check in wouldn't work with our tickets. They wanted to check that we were eligible for the Interrail discount, so we showed them the app - we didn't have to spend a travel day though. They printed out our tickets and didn't charge us extra.

The boat itself was gorgeous. Obviously not full - many of the bars were empty and the disco was dead - but surprisingly they put on a full song and dance show as entertainment. We'd made reservations at one of the fancy restaurants, which was perfectly nice. It was breathtakingly beautiful outside.

The room was basic, but much easier to sleep in than an overnight train. Unfortunately, I fucked up with the timezones. Stockholm is UTC+1 and Helsinki is at UTC+2. I set my alarm an hour too early!

The breakfast buffet was very well stocked for veggie and vegans. Massive queue before opening but not too crowded.

Helsinki to Tallinn (day ferry)

Terminal was a short walk from the tram. It was spacious and had plenty of seating. Again we couldn't use the automated check in and had to show our Interrail apps. Ferry was small but plenty of room to sit or go shopping.

Tallinn to Riga

Slightly confusing process to buy the tickets as they only went on sale a few weeks before departure. No seat reservations for the first half of the journey - we were slightly worried by the number of people waiting for the three-carriage train. In the end there was plenty of space. Again, 1st class a bit roomier than standard but not dramatically so.

The ticket inspector gave a confused look at the Interrail pass and issued us with a receipt for €0.00!

The train had an onboard ticket vending machine with contactless payments and, delightfully, some bowls of water for dogs.

We changed at Valga which was simple - literally walk across the platform to the waiting train. It was a little more crowded, but plenty of seats.

Riga to Vilnius

1st class was a bit crowded but pleasant until the boomer Brits started ignoring the quiet carriage signs. They were shut up by the guard. Complimentary sparkling water.

Vilnius to Warsaw

There is a VIP lounge in Vilnius - but it is little more than a quiet space with a loo and water fountain. All the snacks and hot drinks were chargeable. We didn't actually have access to it this trip - but the Riga to Vilnius trip did. We scanned our previous ticket reservations to get in.

We weren't able to book seats - because the service said it was sold out. However the train was half empty. No 1st class, but there was WiFi and power, so no complaints from me.

On having our tickets checked we were told that there was 1st class, but we couldn't use it with our Interrail passes. As with most European trains, announcements were in English.

The change at Mockava was easy - we walked to the next platform. We'd booked seats in a little 6 seater cabin - sadly the air con was little more than homeopathic. Even cracking open the window did nothing but waft hot air over us. Fairly full train, toilets were adequate, but the heat was stifling. Even worse, no WiFi!

The train occasionally stopped for several minutes at a time. The crew just opened the doors to let a breeze in - very little health-and-safety culture here!

Mind you, we also saw people crossing the tracks to get to their platform. Yikes!

There were passport checks by armed guards. Brief and inoffensive.

Warsaw to Berlin

Despite the extreme heat, it left on time. This 6 berth 1st class carriage was a bit bigger than the last - and the aircon actually worked.

We were treated to complementary water, juice, and a vegan snack bar! The train driver sounded their horn at every opportunity which wasn't exactly relaxing.

Berlin to München

No vegan currywurst on the DB menu any more 😭.

Annoyingly, we were kicked off at Nuremberg - despite most announcements being made in English this one wasn't, but we figured it out. A train came fairly quickly, so we weren't too late.

München to Verona

There is a 1st class DB lounge but it isn't open to OBB/Interrail scum. Luckily there were plenty of food options for vegans in station. No vegan currywurst on train but several other options.

This was one of two reservations which demanded that it be printed out onto paper and under no circumstances would it be accepted from a screen. That was a lie. Showing the code on-screen was fine.

Verona to Milan

Such a frequent service that no reservations were needed. Annoyingly, the train windows were covered with graffiti so it was impossible to see out. Ticket inspector barely glanced at our tickets. WiFi didn't work. Crowded and a bit noisy. Air con just about coped with the heat.

Milan to Basel

The Interrail app seemed certain that we had to change a dozen times for this journey. Instead, I found a direct train to Olten. The 1st class seats were massive and had a handy compartment for smaller bags. Windows were huge. Again, our passes and reservation were barely glanced at.

As we arrived in Olten there was a train a couple of platforms away which was direct to Basel. Bit of a dash to get it. No 1st class, but it was a double-decker so we got to sit upstairs, which is just as good!

Basel to Paris

The only thing better than 1st class is upstairs on 1st! Big comfy reclining seats. Packed train with not much luggage space. As ever with trains travelling to France, there were warnings about labelling luggage correctly but no one seemed to do it. Zero vegan options on board. C'est la vie!

Paris to London

What a blessing to witness so many people's first ever attempt to queue for a train 🙄

Mad queues to get in to the departure lounge - but the train departed and arrived on time. I'd remembered to pre-book a vegan option which was tasty and also included a dairy-free chocolate bar. Eurostar's WiFi is shit but 5G worked OK.

What's Next?

Doing Interrail trips like this is brilliant. The trains are usually a lot more relaxing than flying, it's more convenient to arrive in a city centre, and they're less polluting.

Would we do a trip like this again? It's certain a lot of travel. We weren't very spontaneous - most of the trip was planned out way in advance, along with hotels. Having 2-4 days in each place is like taking a series of minibreaks, which is delightful. But it can be exhausting. I don't want to complain that my diamond tiara is too tight, but there comes a point where there is such a thing a too much holiday.

We still have several more European countries to visit; although not all are easy to get to by train. Perhaps we'll fly in somewhere, take the train around, then fly back? Or spend a week only in one country?

If you have tips for further adventures - please let us know!

I hate playing competitively; it's rubbish to achieve victory at the expense of someone else. So I asked for recommendations and picked the cheapest things which looked reasonable.

Several people recommended Lovers In A Dangerous Spacetime. It's a neat little game which is just short enough to not get too repetitive. You and your friend (and, I'm pleased to say, lover) have joint control of a space ship. You fly around the screen shooting baddies, rescuing bunny-friends, and upgrading your craft. There's a lot of "You fly left and I'll shoot" and "I'll move the shield, can you fly us through the asteroid" chatter.

It works, and is fun. But after a few levels it becomes clear that there isn't anything else to it. The three different ships and various weapon upgrades give it a bit of variety, but it isn't one for playing long into the night.

I suspect it's probably better with four players - with two you frequently have to deal with your inability to move the ship and angle the shield and fire the weapons all at the same time. So it gets a bit frustrating.

It is delightfully cutesy - and I particularly loved the way the "OK" button was replaced with "YAY!". Something I think more interfaces should do.

The game was a fiver or so when I bought it, which seems reasonable enough.

Verily, some of our brethren (and sistren) be afflicted with a sinister disposition. While the righteous scroll using the thumb of their right hand - as is good and proper - an accurs'd minority swing the other way.

Look, you try writing an interesting bug report without sounding like a clanker, OK!

I try to optimise my blog as much as possible. It may not look like much, but it has got it where it counts. I've made a lot of special modifications myself to the base WordPress install.

One of those modifications is reducing the amount of JavaScript in use to the bare minimum. Everything functions without it, but there are a few places where it helps - the most notable being comments.

That's why I was distressed when a loyal reader wrote in saying there was a bug on my site. When they were scrolling the page a comment box would suddenly appear and interrupt their browsing.

I scroll my own site a lot (probably more than is healthy) so why hadn't I noticed this bug?

Because I scroll on my phone's touchscreen with my right thumb and the bug reporter uses their left. The "reply" link which was being triggered is on the left side of the page. A bug which won't be triggered by righteous people but infuriating to those who will surely be left behind after The Rapture™.

To be fair, this bug was reported seven years ago - but I guess the WordPress team have been too busy cleaning up after their mad God-Emperor to take a look at it.

Back in 2017, a developer added a touchstart listener to link clicks. I don't really understand why. At one point in history, browsers couldn't be sure if a touch event was the start of a click or a double-tap to zoom. So firing an event when a touch occurred on a link sort of made sense to avoid a 300ms delay.

But that hadn't been the case for several years - as this 2013 blog post makes clear. Even in 2015 it was no longer an issue.

So why was this lefty-baiting code added? Not a clue.

Anyway, seven years after the bug was reported I committed a fix. It isn't the most sophisticated change to WordPress - merely deleting a couple of lines. But hopefully it will stop those strange and unusual mutants from complaining that their unnatural thumb-usage is accidentally triggering unwanted events on my website.

Sadly, there is as yet no way to prevent the corrupt from using our blessed sites. The WHAT-WG haven't seen fit to take on board my suggestion of <meta handed="right"> to keep out the unwanted and polluted. So, hopefully, this change will at least prevent them complaining.

Why, yes officer, I have had a glass or two of tonic wine. Why do you ask?

Did you ever meet someone at university who'd just tried drugs for the first time? Listening to a stoner ramble on about their mystic crystal revelations is amusing for the first five minutes, but quickly gets tiresome. Wow! You got your little computer friend to automate calling your mum? Great job, mate! Can we talk about something interesting now?

Just as bad are the people telling me how bad smoking is for my health. Yes, I know! That's why I don't. Yes, I know that hanging out with friends while they smoke is bad for me - but loneliness is probably worse. In fact, you screaming about how every puff on a fag reduces my life expectancy by 37 seconds makes me want to inhale a whole cigar so I can die early enough to exit this tedious conversation.

If you want to enhance your consciousness / rot your brain with AI - go ahead. Just stop wanging on about it like you discovered the secret to eternal life.

And to the rest of you, stop pissing on people's chips. Haranguing and scolding have never convinced anyone of everything.

I can't fucking wait for this bubble to burst so we can go back to chatting shit about literally anything else.

I couldn't find anyone who'd made a QR code with an embedded UPC - so I decided to make one.

If you move your phone close to the code (so it can't see the squares in the corners) it should read the number in the 1D barcode. Zoom out and it'll read the URl in the QR code.

The QR code has a high level of error correction - which allows graphics to be placed within it, as I discussed in 2010.

The UPC has some whitespace padding around its edges - which makes it easier for some scanners to find, although not all scanners seem to accept it.

Is this in any way useful or desirable? I doubt it! I guess most point-of-sale barcode scanners are somewhat regularly updated - so they should all have the ability to scan newer codes. The embedded code destroys some of the error correction, thus making the QR code more fragile. It isn't a good idea.

Still, nice to fiddle about with something, eh?

You may also enjoy:

• A Recursive QR Code.
• Why are QR Codes with capital letters smaller than QR codes with lower-case letters?
• Or see all my posts about QR Codes since 2007!

Here's the thing. No.

All my blog posts start with a simple declaration:

<!doctype html>
<html lang=en-GB>

There's a reason for that. It is more than the language I speak; it is the culture I live in, the way that I think, and the accent I use.

When your AI bot reads this text aloud, it should do so with a British accent⁰. That's how I speak. It is OK to hear a slightly unfamiliar accent. You'll be able to figure out what I'm saying. Your world won't collapse if I don't start each sentence with "Howdy, y'all!"

But what should you do if you come across a concept you don't understand?

When The Wicked Witch of the TERFs released the first Harry Potter book "Philosopher's Stone", it was published in the USA with a different title; "Sorcerer's Stone". There were also a dozen other language changes - which caused great consternation in the fandom.

What do you think happens if Skip or Madison come across a kid eating "a sherbet lemon" or a description of Hermione's "fringe" or discover Harry wearing a jumper? Will their little minds collapse under the knowledge that people far away use different words?

No. And neither will you.

It is OK if things are unfamiliar to you.

Up until my mid-twenties, I had never seen or eaten a Twinkie. They were a cultural lodestone in a hundred books and films, but not the sort of thing I could buy locally. So I used my context clues. They seemed like an unappealing foodstuff which, nevertheless, were inexplicably popular.

As a kid, I could recite all the lyrics to Vanilla Ice's Ice Ice Baby without getting half the references. The brain is malleable and can fit in new concepts with relative ease.

So if you see a reference to Count Duckula, or hear me exclaim "Accrington Stanley!", or even blush as I describe an utter wanker - please take it as a sign that the hegemony is not universal and some people exist in a cultural milieu different to your own.

And breathe. It'll be OK.

Thanks to BookSirens for providing me with a review copy. This is an intriguing self-published novel with a backstory almost as interesting as the plot.

The story is a descent into paranoia as an author is convinced that an AI is plagiarising his work. As the madness takes over, he's forced to confront whether his creative processes are genuine or not.

It raises some excellent questions about whether AI can replicate art. It also posits some solutions for ensuring genuine human content. Without going in to spoilers, I think some of the methods the protagonist comes up with might be the only way to "prove" that a human has created a work.

The pace is excellent - with some well-placed plot twists. As with any self-published novel, it could do with a little tightening up. Some of the characters have oblique motivations which need a bit more exposition.

A note on AI use. There's a novel-within-a-novel which is genuinely generated by an AI (as the author freely acknowledges). I think this is an acceptable use of generative AI - the prose it produces is utterly risible and cliché ridden. It works as a nice contrast to the human generated text.

I suspect more and more authors will turn to AI fears just as they turned to pandemic allegories a few years ago. This is a decent attempt to capture a moment in time when authors stared into the abyss and found only themselves staring back.

Despite vowing not to read sequels of books I love, I'm constantly surprised that regression to the mean is an iron-clad law of the universe. I thoroughly enjoyed the first book in the series, so eagerly gobbled up the second. What a burlap fool I am.

What was charming and wry in The Satsuma Complex is now overdone and clichéd.

The violence, which was an undercurrent in the first book, is now too pronounced and too grim to be funny. Yet the constant tomfoolery with language undermines any built-up tension.

The language is gorgeous though. Bob Mortimer has an ability to conjure the most ridiculous similes and metaphors. It's impossible not to be entranced by his panache.

The ending is, frankly, a bit unearned and unsatisfying. It feels like a word-count limit was reached and the quickest solution was found.

Gamrombo is the consumer-facing brand of the generically named Professional Controller Manufacturer. AKA "Huizhou Ronghui Technology Co., Ltd" - there's virtually no information about them online other than paid-for reviews. Well, I bought this with my own money - so enjoy this honest review:

It's basically fine and it works on Linux.

OK, a bit more detail

The USB cable which comes with the controller is charge only - so you can dispose of it. Using a USB-C to C cable, I plugged it into to my Linux laptop and it was instantly detected. Rather cheekily, it shows up as 054c:0ce6 Sony Corp. DualSense Wireless Controller.

The PS5 touchpad was immediately usable. Single finger moved the mouse pointer, two-finger scrolling and zooming worked, clicking the pad clicks the mouse. Nice!

I popped along to hardwaretester.com/gamepad in Firefox, everything worked as expected.

Plugging it in to my Android phone also worked. So pretty handy if you want to play games on a miniscule screen.

Same with Bluetooth. I held down ⨞ and 🏠 on the controller, then connected. Everything worked. Weirdly, it wouldn't stop vibrating until I'd changed the LED colours.

Speaking of which - how much do you like garish LEDs? Tapping the light button changes the colours of the glowing rings around the joysticks. There's half a dozen solid colours or a slowly rotating rainbow effect. Or, just hold down the button to switch them all off.

As well as being cheaper than an official controller, it has more functionality. There are two programmable "macro" buttons on the back. Each can hold a sequence of up to 24 buttons pushes. Perfect if you need to record combos.

There's also a "turbo" button. You can use it to turn a long-press into a repeated-press. Perfect for saving you from RSI.

It vibrates as normal, has an inbuilt speaker, 3.5mm jack, and charges at about 2.5 Watts - all the same as a regular controller. Oh! And it paired with the PS5 as well 😆

OK, that's the good stuff. Where are the drawbacks?

Downsides

No microphone. This might be a deal-breaker for some, but I don't play any games which need it.

There is a firmware update available - but it comes as an EXE which only works on Windows a and is distributed on WeTransfer!

The icons on the buttons aren't the × ○ △ □ you'll see in-game. They are the right colour though.

Charging is only by USB. It won't work in a charging dock.

I managed to lock-up the controller. Between faffing around with Bluetooth and plugging it in to a bunch of different computers, it had a bit of a tizzy and wouldn't turn on again. Clicking the reset button using a paperclip brought it back to life.

Finally, it does feel kinda cheap. It is lighter weight and the buttons don't feel quite as "clicky" as an official controller. It isn't bad per se but it is different.

Should I get one?

It's pretty good! I've no idea how long the battery will last, or if it'll fall apart after I post this review, but saving £30 means you can spend more on games.

Here's how to successfully authenticate a JWT supplied by Auth0.

Once your user has authenticated with Auth0, they will be given an accessToken and an idToken. Only the idToken is needed for our purposes.

It will look something like this:

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImFiYzEyMyJ9.eyJnaXZlbl9uYW1lIjoiSm8iLCJmYW1pbHlfbmFtZSI6IlRlc3QiLCJuaWNrbmFtZSI6IkpvVGVzdCIsIm5hbWUiOiJKbyBMZSBUZXN0IiwicGljdHVyZSI6Imh0dHBzOi8vZXhhbXBsZS5jb20vam8ucG5nIiwidXBkYXRlZF9hdCI6IjIwMjYtMDQtMjhUMTM6NTk6NTUuNjcxWiIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJpc3MiOiJodHRwczovL2V4YW1wbGUuZXUuYXV0aDAuY29tLyIsImF1ZCI6ImFiYzEyMyIsInN1YiI6ImZhY2Vib29rfDEyMzQ1NiIsImlhdCI6MTc3NzM4NDc5NiwiZXhwIjoxNzc3NDIwNzk2LCJzaWQiOiJhYmMxMjMtNDU2LWRlZmdoaWprIiwibm9uY2UiOiIxMjM0NTY3ODkwIn0.ZgnZxOOtfczLewlm_agK6mJMYetVTZrHlBlu5qzXbADlhvZB8RraVuFKmFutLZLibMQxz_RY0oh4hRufVWDHJ0kuocW38kRHztDg7R5KOfvJEM46WW49xvhLhKprzkx9WXDDlpCRNL0QbBK2U0F1VjmRpTp1Q5cHEd8PBsa4rGAhfqudXp5JrC2Lm5e7ji0AQ_s7HJhy59b9mTb3tMqHGsrWDZS915zHPYEQtSvg5o9sSx1tCRfsyL6kdsdkaTffQjJDUrT5hpIQ-2_9tGuqioJjP4c0edQ85TaK9UnSxfzMQ8gYez963kbo_Iv1fJyaTVwXR-AVvwK-CeGJAFrheQ

Yeuch! If you stick it into JWT.io you'll see that it is Base64 encoded JSON containing a header, body, and signature. Each part is separated by a . character.

You could manually decode it, but that's a bit of a pain in the arse. So here's how to do it with the Auth0 PHP library. I'm using the Symfony one, but it should all be fairly similar.

First, import the library:

use Auth0\SDK\Auth0;

Next, you'll need to send the token to the PHP. You can do this in a header, GET, or similar:

$authHeader = $request->headers->get("Auth0-Authorization");

Then, set up Auth0 so that it can parse and validate the token:

try {
    $token = $authHeader;
    $auth0 = new Auth0([
        "domain"       => $_ENV["AUTH0_DOMAIN"],
        "clientId"     => $_ENV["AUTH0_CLIENT_ID"],
        "clientSecret" => $_ENV["AUTH0_CLIENT_SECRET"],
        "cookieSecret" => "_"   //  Dummy value.
    ]);

    $decoded = $auth0->decode(
        token: $token,
        tokenType: \Auth0\SDK\Token::TYPE_ID_TOKEN,
    );
} catch (\Exception $e) {
    error_log("Auth0 Error - {$e}");
}

The cookieSecret must be set - even though you aren't using cookies. Any non-null value is fine.

The tokenType must also be set correctly.

Assuming you all goes well, you will have a decoded object which has validated against Auth0. So how do you get the user's details from it?

Well, you could split the original idToken at the period character and Base64 decode the middle one. Try it now to see what it contains! Or print_r() the decoded token to see it in all its cryptographic glory.

The easiest way is to do:

$claims = $decoded->toArray();

Then you can access various properties by doing:

$username   = $claims["nickname"];
$identifier = $claims["sub"]; 

Perhaps there is a more official way - but I couldn't find anything in the documentation. Hurrah for reading source code!

The fact is, individuals are often targeted for espionage, blackmail, or other state-sponsored attacks.

Here's a list of some of the different advice I've received, roughly sorted into levels of suitability. Start at the top and work your way down until you reach a suitable level.

USB sticks? No thanks!

At some point, you'll be given a gift of a decorative USB pen drive. It'll either be part of a goodie-bag or you'll be told it has all of this quarter's TPS reports on it.

You should thank them for their kind gift. On your way back to the hotel, drop the stick in a bin.

There's just too much which can go wrong with a USB stick. Maybe it has a virus. Maybe it is an exfiltration device. Maybe it has extreme pornography and the police will catch you with it. Just chuck it. If anyone asks, say you couldn't get it to work and can they please email you the information.

USB Power? Play it safe!

USB powers everything from your phone and laptop, to your headphone and eReader. But USB cables also carry data. Some devices can be silently hacked by plugging them in to a dodgy power port.

Is it likely that the USB socket on the airport bus has been set up to exfiltrate travellers' data? Probably not - but why take the risk?

The best thing you can do is to always charge from your own device. Get a travel charger or, ideally, a portable battery and only use that for charging.

For extra paranoia, you can buy USB condoms and charging-only cables - but they tend to be slower at charging.

Reduce Your App Attack Surface

Do you need all those apps on your phone? Will you cope without your banking apps, dating apps, streaming apps? Each one is a potential vector for abuse.

Is it legal for you to date your preferred romantic partner in your intended destination? You shouldn't have to hide yourself, but having an illegal app on your phone is a great way to get picked up by the police.

Go through your phone and uninstall anything which isn't important to the trip.

A VPN probably draws more attention than it is worth, but browse cautiously

This is slightly counter-intuitive. Every important site on the web uses HTTPS. The really important ones are on a special list which means your browser will only use a secure connection. The chances of your data being intercepted is minimal.

But using a VPN immediately makes your traffic look suspicious and, in some countries, may be illegal.

That said, while the contents of your communications will be private, their destination is easy to figure out. Don't browse pornography or any other site which is liable to get you in trouble. This may include news sites from outside the country.

What passwords do you need?

Hopefully you use a password manager - and hopefully all your passwords are unique. But do you really need to carry around all of them? You password manager almost certainly allows you to create a sub-account into which you can deposit anything you need for your trip.

Similarly, you don't need all your MFA codes with you. If you do need MFA please make sure it isn't coming through SMS.

They're not flirting with you.

Mate, you're a middle-aged sales rep who scored a trip to a conference in an exotic country. Do you really think that pretty young thing is enthralled by your tales of middle-management?

No.

At best, the photos will be used to blackmail you. At worst the police will claim that they're under the age of consent and that will be used to blackmail you.

Laptops and Liability

Your IT team has provided you with a laptop which is encrypted and biometrically secured, right? But do you need that specific laptop?

They should grab a cheap laptop. Fill it with only the documents you need. When you get back home, toss it.

I'm quite serious, a £200 Chromebook is a cheap price to pay to prevent your secrets getting stolen or your network being infiltrated.

What Else?

Possibly you think some of these are overkill. Perhaps you think I'm not being paranoid enough. What would you add to the list?