Are you allowed to run whatever computer program you want on the hardware you own? This is a question where freedom, practicality, and reality all collide into a mess.

Google has recently announced that Android users will only be able to install apps which have been digitally signed by developers who have registered their name and other legal details with Google. To many people, this signals the death of "sideloading" - the ability to install apps which don't originate on the official store⁰.

I'm a fully paid-up member of the Cory Doctorow fanclub. Back in 2011, he gave a speech called "The Coming War on General Computation". In it, he rails against the idea that our computers could become traitorous; serving the needs of someone other than their owner. Do we want to live in a future where our computers refuse to obey our commands? No! Neither law nor technology should conspire to reduce our freedom to compute.

There are, I think, two small cracks in that argument.

The first is that a user has no right to run anyone else's code, if the code owner doesn't want to make it available to them. Consider a bank which has an app. When customers are scammed, the bank is often liable. The bank wants to reduce its liability so it says "you can't run our app on a rooted phone".

Is that fair? Probably not. Rooting allows a user to fully control and customise their device. But rooting also allows malware to intercept communications, send commands, and perform unwanted actions. I think the bank has the right to say "your machine is too risky - we don't want our code to run on it."

The same is true of video games with strong "anti-cheat" protection. It is disruptive to other players - and to the business model - if untrustworthy clients can disrupt the game. Again, it probably isn't fair to ban users who run on permissive software, but it is a rational choice by the manufacturer. And, yet again, I think software authors probably should be able to restrict things which cause them harm.

So, from their point of view it is pragmatic to insist that their software can only be loaded from a trustworthy location.

But that's not the only thing Google is proposing. Let's look at their announcement:

We’ve seen how malicious actors hide behind anonymity to harm users by impersonating developers and using their brand image to create convincing fake apps. The scale of this threat is significant: our recent analysis found over 50 times more malware from internet-sideloaded sources than on apps available through Google Play.

Back in the early days of Android, you could just install any app and it would run, no questions asked. That was a touchingly naïve approach to security - extremely easy to use but left users vulnerable.

A few years later, Android changed to show user the permissions an app was requesting. Here's a genuine screenshot from an app which I tried to sideload in 2013:

No rational user would install a purported battery app with that scary list of permissions, right? Wrong!

We know that users don't read and they especially don't read security warnings.

There is no UI tweak you can do to prevent users bypassing these scary warnings. There is no amount of education you can provide to reliably make people stop and think.

Here's the story of a bank literally telling a man he was being scammed and he still proceeded to transfer funds to a fraudster.

It emerged that, in this case, Lloyds had done a really good job of not only spotting the potential fraud but alerting James to it. The bank blocked a number of transactions, it spoke to James on the phone to warn him and even called him into a branch to speak to him face-to-face.

Here's another one where a victim deliberately lied to their bank even after acknowledging that they had been told it was a scam.

Android now requires you to deliberately turn on the ability to side-load. It will give you prompts and warnings, force you to take specific actions, give you pop-ups and all sorts of confirmation steps.

And people still click on.

Let's go back to Google announcement. This change isn't being rolled out worldwide immediately. They say:

This change will start in a few select countries specifically impacted by these forms of fraudulent app scams, often from repeat perpetrators.

…

September 2026: These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand. At this point, any app installed on a certified Android device in these regions must be registered by a verified developer.

The police in Singapore have a page warning about the prevalence of these scams. They describe how victims are tricked or coerced into turning off all their phone's security features.

Similarly, there are estimates that Brazil lost US$54 billion to scams in 2024 (albeit not all through apps).

There are anecdotal reports from Indonesia which show how easily people fall for these fake apps.

Thailand is also under an ongoing onslaught of malicious apps with some apps raking in huge amounts of money.

It is absolutely rational that government, police, and civic society groups want to find ways to stop these scams.

Google is afraid that if Android's reputation is tarnished as the "Scam OS" then users will move to more secure devices.

Financial institutions might stop providing functionality to Android devices as a way to protect their customers. Which would lead to those users seeking alternate phones.

Society as a whole wants to protect vulnerable people. We all bear the cost of dealing with criminal activity like this.

Given that sideloaded Android apps are clearly a massive vector for fraud, it obviously behoves Google to find a way to secure their platform as much as possible.

And Yet…

This is quite obviously a bullshit powerplay by Google to ensnare the commons. Not content with closing down parts of the Android Open Source Project, stuffing more and more vital software behind its proprietary services, and freezing out small manufacturers - now it wants the name and shoe-size of every developer!

Fuck that!

I want to use my phone to run the code that I write. I want to run my friends' code. I want to play with cool open source projects by people in far-away lands.

I remember The Day Google Deleted Me - we cannot have these lumbering monsters gatekeeping what we do on our machines.

Back in the days when I was a BlackBerry developer, we had to wait ages for RIM's code-signing server to become available. I'm pretty sure the same problem affected Symbian - if Nokia was down that day, you couldn't release any code.

Going back to their statement:

To be clear, developers will have the same freedom to distribute their apps directly to users through sideloading or to use any app store they prefer.

This is a lie. I can only distribute a sideloaded app if Google doesn't nuke my account. If I piss off someone there, or they click the wrong button, or they change the requirements so I'm no longer eligible - my content disappears.

They promise that Android will still be open to student and hobbyist developers - but would you believe anything those monkey-punchers say? Oh, and what a fricking insult to call a legion of Open Source developers "hobbyists"!

I hate it.

I also don't see how this is going to help. I guess if scammers all use the same ID, then it'll be easy for Android to super-nuke all the scam apps.

Perhaps when you install a sideloaded app you'll see "This app was made by John Smith - not a company. Here's his photo. Got any complaints? Call his number."

But what's going to happen is that people will get their IDs stolen, or be induced to register as a developer and then sign some malware. They'll also be victims.

So What's The Solution?

I've tried to be pragmatic, but there's something of a dilemma here.

0. Users should be free to run whatever code they like.
1. Vulnerable members of society should be protected from scams.

Do we accept that a megacorporation should keep everyone safe at the expense of a few pesky nerds wanting to run some janky code?

Do we say that the right to run free software is more important than granny being protected from scammers?

Do we pour billions into educating users not to click "yes" to every prompt they see?

Do we try and build a super-secure Operating System which, somehow, gives users complete freedom without exposing them to risk?

Do we hope that Google won't suddenly start extorting developers, users, and society as a whole?

Do we chase down and punish everyone who releases a scam app?

Do we stick an AI on every phone to detect scam apps and refuse to run them if they're dodgy?

I don't know the answers to any of these questions and - if I'm honest - I don't like asking them.

The problem is - Matrix is shit. Not just on a protocol level, but on an organisational level as well.

I joined Matrix at FOSDEM - the largest gathering of open source nerds in Europe. We were all encouraged to use it - every talk had its own channel, all the official comms came from there, I was even invited to a top-secret private channel for speakers. This was going to be epic! Viva la rèvölūçïón, right? Wrong.

It was dead. Even among the most seasoned geeks on the planet, most people preferred to use other services like Signal, Telegram, and Slack. Why? Because those other tools actually work.

Matrix has two official Android apps - one of which is old and unsupported, the other is new and doesn't work with many of the basic chat features.

I want to be absolutely clear about this - the company behind Matrix have put out an app which doesn't work with their own product! Lest you think I'm exaggerating, here's a typical view of the official FOSDEM speaker room, using the official Matrix app:

It was embarrassing. People would pipe up in channels and say "this doesn't work" only to be told they were using the wrong app and should go back to the one marked unsupported. So they left, never to return. Even in the large talks, where people were encouraged to use the official Matrix chat, most of the conversation happened on other platforms. It was just too hard to use Matrix.

A few thousands geeks, all used to recompiling their own kernels and participating in the Fediverse, and most thought that Matrix was too much of a faff.

After FOSDEM, I kept the Matrix app on my phone. Occasionally receiving a ping from some long-forgotten channel.

And then, one day, I got hit with the most vile spam. A dozen notifications suddenly appeared on my phone with abuse, torture, and transphobic slurs in them.

You can view the screenshot - but, fair warning, it is grim.

This shouldn't be possible. It doesn't take an expensive team of moderators to add some keyword monitoring. It doesn't take a massive AI model to work out that a stranger shouldn't be able to bombard users with multiple notifications. You don't have to sacrifice your dream of a decentralised future - you just need to care about your users.

This stuff is basic.

I moaned about it on Mastdon and was surprised to receive a private reply from the official Matrix account.

Please do not encourage the spammer by giving them a platform and propagating their spam; you may want to consider deleting your post.

This is classic victim blaming. It is my fault for giving the spammer attention. I am the one who needs to take responsibility and delete the evidence. I shouldn't warn people that Matrix is actively dangerous to use.

Bullshit.

Here's what I expected them to say:

"We're sorry you had such a bad experience on Matrix. Rest assured we're working hard to block these spammers - here's a link to show what we're doing. You can protect your account further by doing x, y and z. Once again, sorry and we hope we can win back your trust."

I'm not saying scrappy open source projects have to hire anodyne corporate communications specialists; they just need to have a little empathy.

But, no, just constant whining about how it isn't their fault and how I am the one who needs to change my behaviour.

This is pretty typical behaviour from the team. Find any post complaining about some aspect of Matrix and you'll see their instant woe-is-me replies.

So I deleted the app. I would have liked to have nuked my account but apparently that's not possible.

I'm not the only one who feels like this. Here's an epic post by Marius, which concludes:

Between the slow performance, the increasing amount of spam, the miserable web client, and the unfinished state of Element X, the Matrix.org network is not something I am willing to continue to recommend, especially to non-technical users. Normal people are simply tolerating it to communicate with idealistic nerds like myself who insist(ed) on using it.

Matrix just isn't focussed on users. I'm not talking about user-experience tweaks like which shade of cornflower blue to use - I mean basic user needs like apps that work and a way to combat spam.

There's a long list of ways the protocol contributes to a poor user experience. It almost seems designed without regard for how it will actually be used.

While the protocol may be conceptually interesting and their intentions noble, I'm not prepared to suffer abuse in the name of technical purity.

Open Source and Open Standards nerds like me ought to know by now that the protocol is the least compelling thing about a service. Who cares if your home is built using only Stallman-blessed tools, when the walls are full of rats?

the spreadsheet, initially shared in 2022, and thought to contain data related to a small number of applicants, had contained hidden data related to more than 18,000 people. 

ICO statement in response to 2022 MoD data breach

Why are people still sending files to each other? I remember having a stand-up argument a decade ago with a project manager who wanted us to email a completed Word template to him every day. He'd then spend hours merging the various documents together. He couldn't get his head around the collaborative document suite the company had purchased a licence for. I tried showing him that we could give specific people write-access to the document and they could edit it live. No more emailing back-and-forth.

It just didn't stick. It wasn't that he was ignorant about what computers could do, but his entire mental model was built around files. Discrete packets of data with a fixed metaphor from the real world.

Collaborative online documents don't have an easy analogue analogue. It is rare to see a dozen people scribbling on the same whiteboard or using the same typewriter keyboard.

Permissions are another things that aren't intuitive. The idea that only specific people can see something doesn't match our expectations of paper. Sure, anyone could grab a pen and deface it, that's why we have one person in charge of the "master copy".

Copy. What a hateful word.

The modern workforce shouldn't be flinging copies to each other. A copy is outdated the moment it is downloaded. A copy has no protection against illicit reading. A copy can never be revoked.

Data shouldn't live in a file on a laptop. It shouldn't be a single file on a network share. Data is a living beast. Data needs to live in a database - not an Excel file. Access should be granted for each according to their needs.

I see the same issue in the WeTransfer kerfuffle. Very Serious People saying it was intolerable that the untrusted 3rd party they were using to share Very Sensitive Information was going to read that information.

At which point you have to throw up your hands and ask why people are sending files to each other in the year of Our Lord 2025?!?!? If you have a sensitive file, use proper access controls. Or at least use a password so the FTP-as-a-service provider can't steal your IP.

And git! Don't get me started on git! The best minds of a generation stuck in a paradigm of downloading files to their local machine, making changes, then emailing git pushing them up to be approved? Madness!

Look, there are some times when you need a local copy. I want my own copy of my insurance documents - but that's not a living doc; it is an agreed artefact. Sure, it's handy to have access when there's no network connection - but that's what background sync is for. OK, you're on Office 365 and I'm on Google - so we'll have to work a little harder to set up access.

But all of this is possible!

We rant and rave about the 💾 icon being a skeuomorph. But the very concept of an individual file is also a skeuomorph! Data are not stored on paper files. There is no such thing as a filesystem directory - it's just a convention to make computing palatable for people born in the 20th century who lived in a world of A4 paper and manilla folders.

Modern computing is still stuck in the past. Our computers are like cars which have been designed to carry a bale of hay to mop up the horse-piss.

As I've moaned about before, TOTP has never been properly standardised. It's a mish-mash of half-finished proposals with no active development, no test suite, and no-one looking after it. Which is exactly what you want from a security specification, right?!

So let's try to find some edge-cases and see where things break down.

One Punch Man

This is possibly the least secure TOTP code I could create. Scan it and see whether your app will accept it.

What makes it so crap? There are three things which protect you when using TOTP.

1. The shared secret. In this case, it is abcdefghijklmno - OK, that's not the easiest thing to guess, but it isn't exactly complex.
2. The amount time the code is valid for before changing. Most TOTP codes last 30 seconds, this lasts 120.
3. The length of the code. Most codes are 6 digits long. In theory, the spec allows 8 digits. This is 1. Yup. A single digit.

If you were thick enough to use this¹, an attacker would have a 1/10 chance of simply guessing your MFA code. If they saw you type it in, they'd have a couple of minutes in which to reuse it.

Can modern TOTP apps add this code? I crowdsourced the answers.

Surprisingly, a few apps accept it! Aegis, 1password, and BitWarden will happily store it and show you a 1 digit code for 120 seconds.

A few reject it. Authy, Google Authenticator, and OpenOTP claim the code is broken and won't add it.

But, weirdly, a few interpret it incorrectly! The native iOS app, Microsoft Authenticator, and KeepassXC store the code, but treat it as a 6 digit, 30 second code.

Do The Right Thing

What is the right thing to do in this case? The code is outside the (very loosely defined) specification. Postel's Law tells us that we should try our best to interpret malformed data - which is what Aegis and BitWarden do.

But, in a security context, that could be dangerous. Perhaps rejecting a dodgy code makes more sense?

What is absolutely daft² is ignoring the bits of the code you don't like and substituting your own data! Luckily, in a normal TOTP enrolment, the user has to enter a code to prove they've saved it correctly. Entering in a 6 digit code where only 1 is expected is likely to fail.

We're Only Human

A one-digit code is ridiculous. But what about the other extreme? Would a 128-digit code be acceptable? For a human, no; it would be impossible to type in correctly. For a machine with a shared secret, it possibly makes sense.

On a high-latency connection or with users who may have mobility difficulties, a multi-minute timeframe could be sensible. For something of extremely high security, sub-30 seconds may be necessary.

But, again, the specification hasn't evolved to meet user needs. It is stagnant and decaying.

What's Next?

There's an draft proposal to tighten up to TOTP spec which has expired.

It would be nice if the major security players came together to work out a formal and complete specification for this vital piece of security architecture. But I bet it won't ever happen.

• Google have archived their work on authentication standards.
• Apple points to Google's outdated spec.
• YubiCo's incompatible spec hasn't been updated in 4 years.
• The otpauth registration lists a consortium called https://openauthentication.org who don't appear to published anything in a decade.
• Microsoft don't have any documentation whatsoever.

So there you have it. We're told to rely on TOTP for our MFA - yet the major apps all disagree on how the standard should be implemented. This is a recipe for an eventual security disaster.

How do we fix it?

It seems every year⁰ there's another story about how pubs are vanishing¹. Cue the wailing and gnashing of teeth as the Fabric Of Society™ is rent asunder.

To which I say "Good riddance. Most pubs are shit and deserve to go."

Let me explain. It is quite clear that the majority of the population² do not find pubs to have a compelling value proposition.

Here's all the way pubs are crap:

• Expensive. For the same price as one pint in a pub, I can buy several cans from a supermarket.
• Alcoholic. Lots of young people don't drink. Many people are cutting down on their booze. Why go somewhere which will only reluctantly serve you a lemonade? Of course, with alcohol comes…
• Violence. I remember walking past a pub in Brighton which had bouncers on its doors at lunch-time. Drunk people can be aggressive. That also leads to…
• Unwanted sexual attention. Pubs can be fundamentally unsafe - whether its spiking drinks, groping, or being relentlessly flirted with. They often don't feel like welcoming environments. And, if you are in the market for a date, you are more likely to get a consenting friend via a dedicated app rather than hoping to bump into someone.
• Noisy. Everyone says they want to socialise - so why does your pub blare out music at full volume from a jukebox which hasn't been updated since the last century³?
• Grim. Sticky floors, filthy toilets, wobbly tables. My living room is just a much more pleasant environment.
• Feel free to supply your own further reasons.

To which the pub connoisseur has a mini episode of "No, it is the children who are wrong" and convinces themselves that there's nothing wrong with pubs. They are, of course, imagining their idealised pub where the gruff old Landlord greats you with a nod, a buxom barmaid has already started pulling you a pint of your usual, and - goodness! - isn't that your old mate Dave in the corner?!

The reality is you walk in to a noisy bar, the air stinks of sweat, as you struggle to get the attention of the bored barman a fella taps you on the shoulder and growls "D'y'wanna buy some meat? It isn't stolen!"

Here's the thing. The customer is always right. If people aren't going to your establishment because they don't like it - you can't force them.

Lots of pubs are changing. They're offering more non-alcoholic options, they host social events during the day, they serve decent food, and attempt to keep the toilets clean.

But...

If I want decent food, I'll go to a restaurant - or get a takeaway. If I want some interesting beers, I can buy them online. If I want to meet up with friends, I send a message on the group chat. If I want to socialise, I go to a place where I won't be leered at and it doesn't stink of stale beer and farts. If I want to watch the football, I can do so at home on a bigger screen without the risk of the local psychopath giving me aggro for looking at him funny.

Whenever I rant about this online I get the usual pub-bores telling me I'm wrong. Apparently pubs are the cornerstone of the community (even though no one goes there any more) and more like a delightful social club (even though there are better options for socialising) and the combined Meat Raffle / Pub Quiz is what makes us truly British.

That's a load of old bollocks though, isn't it?

As I said⁴, I love going to decent pubs. What I can't stand is going to a decrepit or soulless hole where the only drinks on offer are generic larger and bottled cider, where the vegetarian option is being told to fuck off, and the entertainment is watching the pickpockets try their luck.

But, frankly, it doesn't matter what I like. Fashions ebb and flow. The Milk Bars of the 1960s are little more than a memory. No one has visited a video arcade since the 1990s. The village baker gave way to the cheaper supermarket loaf.

Sorry pubs, you had a good run. The choice was "adapt or die". Seems like lots of you chose… poorly.

Most people are reluctant to try new things. Even in the exciting world of proto-smartphones, convincing someone to download, install, configure, and use a new app was difficult. Sure, we could run expensive advertising campaigns. Send hopeful text messages. Have a big celebrity endorsement. Or maybe get our customer service reps to push it.

In the end, we pre-installed it on every device we sold. Then we forcibly pushed it to every supported phone on our network. The backlash was incredible. As you might expect, people think of their phones as their own personal space. Having a new app shoved on there felt like an invasion. It took up memory space, true, but more importantly it took up psychological space. We had reminded customers that we thought of them as little more than cattle; a resource we controlled with an aim to extract value.

Google is in a similar boat today. They have absolutely no confidence that their Gemini AI Assistant is any good. They've run countless tests with customers and it is a dud. But they've invested a lot of money, so it needs to launch. Customers, in the main, decline to install it and they certainly refuse to pay for it. So what's Google's solution?

They have forcibly installed it, jacked up the prices, and made it impossible to remove.

These are not the actions of a company which believes in its own products.

To be fair to Google, it is a problem seen in many businesses. They crave instant success, they want to see massive overnight numbers, and they have a winner-takes-all mentality. But the real world isn't like that. Customers aren't morons but they lead busy and complex lives. You product is important to you, but it is utterly irrelevant to most customers. It is your job to convince people that your product has merits. You have to listen to them and get their consent.

People don't deserve to be tricked into installing something. Forcing people to use your product is disrespectful

Paul has published an essay about official photographs of politicians. In it, he expertly points out the various deficiencies of some of them and where they show a distinct lack of quality.

But, here's the thing, I don't think anyone other than a photographer would notice or care about those "problems".

If you're a website designer, you're always noticing "jank" on other sites. Your skin crawls at the poor kerning, the FOUT, the lack of keyboard navigation, improper contrast ratio, and a dozen other flaws. 99% of users just don't care. It doesn't impact them in any meaningful way.

A decade ago, I ranted about how designers were chasing a perfection which would never be noticed by non-experts. You may take pride in your craft, but the majority of people physically cannot notice the difference between good and bad design. Not even subconsciously.

I include myself in this maddening desire for unnoticeable perfection. I've got several rants about things most people would find inconsequential. There are things which I know to be important in terms of technical correctness, but which most people couldn't give a shit about.

There's a brilliant essay by Will Tavlin called "Casual Viewing - Why Netflix looks like that".

In it, the author (correctly and fairly) skewers Netflix's model of producing huge amounts of low-quality content for an undiscerning audience. The creatives recoil in horror and the æsthetic choices, poor scripting, and lack of creative pizazz. Everything is mediocre at best and that's destroying the creative industries.

But, much like designers fretting about getting things Pixel Perfect or photographers complaining about background composition or musicians ranting about the loudness wars - the hoi polloi just don't care.

And, frankly, who can blame them? Take this quote from the Netflix essay:

The difference between Netflix and its predecessors is that the older studios had a business model that rewarded cinematic expertise and craft.

Bluntly, I don't think that's true. Look at the amount of movies Elvis was in. A couple of good ones, sure. But the majority are literally just "This demographic will pay a dollar to see Elvis on screen; so put him on screen". You only need to look at the various lists of highest grossing movies to see that the viewing public don't necessarily reward expertise and craft.

In an essay called "Fraught Pleasures: Domestic Trauma and Cinephilia in American Culture", the author points out that in the movie "Scream" (a movie ostensibly about movies) nobody goes to the cinema. Their entertainment is schlocky VHS tapes of low-budget and low-quality horror films. The nearest they get to discussing the quality of movie making is when one character recommends renting "All The Right Moves" because:

If you pause it at just the right place, you can see [Tom Cruise’s] penis!

Quality!

Netflix, so the essay argues, has perfected the art of designing content for "casual viewing". Something you can have on in the background while cooking, playing a game, or doom-scrolling.

Several screenwriters who’ve worked for the streamer told me a common note from company executives is “have this character announce what they’re doing so that viewers who have this program on in the background can follow along.”

So? Not everything should be hard work. After a long day, most people don't want to work for their leisure. People don't want to expend cognitive energy on interpreting what a story means. Forget Subtext - People Don't Even Get Surtext.

We also have the problem that close to 100% of culture is now readily available to us. Why take a risk on something new when you could watch something guaranteed to be good? An executive at Amazon's streaming division recalls receiving an email which said:

‘here are the one hundred movies that people are watching most on Amazon SVOD today by the minute.’ It was always a lot of Tom Cruise sci-fi movies, action movies from the ’90s and aughts, and Talladega Nights.

You want to get everyone dancing at your party. Do you put on some experimental music that no one has heard of? No - you stick on ABBA and watch the dance-floor fill up.

Want something with a guaranteed number of chuckles-per-minute? Friends is there for you.

When you visit Paris, do you go to some little art gallery showcasing new artists or do you visit Le Louvre? You, like everyone else, bask in front of the Mona Lisa.

Finally, we reach the inevitble endgame of Netflix. Cut out the authors, actors, directors, make-up artists, sound designers, and the hundreds of other unionised parasites involved in making a modern show. Go straight to AI and create an infinite and endless stream of algorithmically-designed crowd-pleasing content.

Streaming platforms are the only place where this [AI Generated] garbage makes any sense — a place where it would never be watched at all.

Hard disagree. Not because I think AI slop is good; but because the audience doesn't care. Most people don't notice the wires on the special effects. They can't see that the lighting is wrong on the CGI shot. The lead actor's shitty accent passes without comment.

I'm not trying to slur people when I say that the majority are unsophisticated - because I include myself amongst them.

Audiophiles complain about MP3 compression and crappy headphones. Most of us just want to listen to our tunes, not listen to the equipment.

Cinephiles complain about poorly calibrated projectors and or motion smoothing on TVs. Most of us just want to crunch popcorn and see big explosions.

Fact-checkers complain about fictional quotes from famous people. Most of us just want a daily dose of something that sounds like wisdom.

Pornographers complain about the move from gorgeous celluloid to low fidelity videotape. Most of us just want to rent a VHS rather than visit a cinema for our extra-special-personal-time.

Fashionistas decry the homogeneity of modern dress. Most of us think jeans and a t-shirt are basically fine.

Is the quality of pizza better from a tiny restaurant hidden away in an Italian village using only fresh ingredients? I'm sure it is. But Domino's delivers something good enough, cheap enough, and hot enough.

Next year, your pizza will be topped with cheap 3D printed "meat" and, while chefs will decry it as an affront to culinary perfection, it'll be cheap and tasty. Besides, you're munching on it while chatting to friends and watching something dopey on Netflix. Call it the rise of "Casual Eating".

In truth, Discord is no harder to sign up to than Slack, Matrix, Gitter, IRC, or whatever. And of course Open Source projects will follow the maxim of "go where your audience are". There's no point posting everything to MySpace when everyone's already on Facebook.

Do I care that Discord isn't open source? Well, kinda. But I can open it in Firefox and it works just fine.

Discord is perfect for ephemeral communications.

But it is not a fucking substitute for documentation!

I'm currently getting started, and increasingly frustrated, with the Watchy development platform. They've effectively said "here's a barebones guide to setting it up - anything else, ask on Discord" - and it fucking sucks.

There's no API documentation - I have to scroll through a million messages to find anything.

I can't use search, because people don't know how to thread. So I can see questions but not replies.

When I do find replies, it's hard to know how relevant they are. A typical Discord chat looks like:

• Alice: What's the command to go fullscreen?
• Bob: Anyone know how I irrevocably format my disk without confirmation?
• Carol: Oh, yeah, it's easy. Just pass the -f flag.

Errrr...

And then you get the people who get snippy with newbie for asking a question which is frequently seen! So infuriating.

I'm not necessarily advocating for the Four-Document Model - which has some critics - but I just don't understand why wouldn't at least collate all of the common questions and put the answers in one place.

Look, writing a FAQ is probably not the right way to approach comprehensive documentation. But if you can't even be bothered to do that, perhaps you shouldn't be releasing a product in the first place?

/rant

I was reading a fascinating eBook recently which was, sadly, designed to mimic a legacy / paper book. To the point where the authoring software had hard-coded in page numbers and forced them to be displayed.

Here's what it looked like:

There are two abominations here. There's no need to interrupt the reading experience by bisecting a page and displaying the page numbers. And there's no need to put footnotes at the actual foot of the artificial page.

The whole point of an eBook is to free the reader from the tyranny of the publisher's choices. If the reader wants to justify the text, change the font, hide all footnotes, or has strong opinions about widows and orphans - they can choose a reading experience which suits their needs.

Let's take a look at the code behind the page and how it should been written.

Page numbers

The HTML the book uses to show the page numbers is:

   ...
   <div class="page-break">end p.16</div>
   <div id="page_16"> </div>
</div>
<div class="page-bounds">
   <div id="acprof-0195171276-div1-8c">
      <div class="para">
         ...

The CSS is:

div.page-break {
    text-align: right;
    line-height: 1px;
    font-size: 10px;
    color: #aca368;
    border-bottom: 1px solid #706650;
    padding: 3px 4px 8px 0px;
    margin: 0px 2px 10px 0px;
}

So, what should it be? I've previously written about the support ePub has for page numbers. And the answer is well documented in the specification.

It's simply this:

<span epub:type="pagebreak" id="page_123_a" title="123" />

That inserts an invisible pagebreak. The reader can choose to render one page per physical screen. Or they can choose to display a page number. Or they can choose to ignore the suggestion.

HTML Footnotes

Here's the code as presented in the ePub:

   <div class="para">Not only was that result in disagreement with the other trials made by the committee but also it was the direct opposite of the observations by Adams and De Luc, </div>
</div>
<div class="footnote-inline">
   <div>15. See <span id="xref-acprof-0195171276-bibItem-84c"><a href="content9.html#acprof-0195171276-bibItem-84">De Luc 1772</a></span>, 1:219-221, §408.</div>
</div>
<div class="footnote-inline">
   <div>16. See ...</div>
</div>
<div class="page-break">end p.16</div>
...

There's no need to put footnotes alongside the text. If you do that, you're basically telling the reader that you know better than them how they want to read the book. Most eReaders will pop-up a footnote, making it easy to read and easy to close:

The footnote link should have a specific ePub type, and the footnote itself is semantically represented as an <aside> with it's own type:

<p>The use of dilithium crystals was discouraged<a epub:type="noteref" href="https://shkspr.mobi/blog/2023/04/stop-treating-ebooks-like-paper-books/#n1" id="fn1">1</a>.</p>

<aside epub:type="footnote" id="n1">
    <p><a epub:type="noteref" href="https://shkspr.mobi/blog/2023/04/stop-treating-ebooks-like-paper-books/#fn1">1.</a> Scott, M (2257).</p>
</aside>

The footnote text can be placed at the end of the chapter or the end of the book. No need to force it into the reader's eyeline.

There's also similar advice from Kindle.

What have we learned today

Books are magical. And, in my humble opinion, eBooks are better than legacy paper books. I can boost the font size of my eBook rather than having to buy an expensive large-print version. I can navigate by searching, or by semantic features, rather than grubbing around with page numbers. And I can choose to follow a footnote or ignore it as the whim strikes me.

But all that requires the publishers actually understanding how to take advantage of the format.

What struck me though, was how simple it seems to build an underground railway!

1. Dig some tunnels
2. Lay some tracks
3. Done

I mean, that's all it is when you get down to it, right?

But, of course, even something as basic as digging a tunnel is hard. Sure, even the layperson can tell that you probably need some way to stop a tunnel from collapsing. But you probably need a geologist to tell you what sort of material you'll be digging through. And a health and safety expert to tell you how to keep people safe down there. And a logistics expert to tell you how you deliver all the necessary parts through a crowded city. And... and... and...

Hell, the tunnel was so long it was affected by the curvature of the Earth!

It is the same with any moderately complex project. When something goes slightly wrong, you'll always get people (like me) whinging "Why didn't they just...?"

The modern world is irreducibly complex. If you've ever read "I, Pencil", you'll know this has been the case for centuries. No one can know everything. Nor can they understand the ramifications of the choices they make - as so eloquently described in The Good Place:

As an outsider, it is probably functionally impossible to accurately criticise the way any complex system works. It's possible to criticise the outcomes. Or the impact. Or the the way it makes you feel. But I don't think non-experts can meaningfully diagnose complex, multidisciplinary, or systemic issues.

And that makes me sad sometimes.

I have some shares leftover from an old employer. The sharesave account was managed by ComputerShare who are pretty crap. For some reason, ComputerShare have decided to migrate lots of their customers to an equally crap service called EquatePlus.

I only found out about this when trying to log in to ComputerShare to do my annual tax return. It told me to bugger off to EquatePlus. Because sending proactive communications to your users is so hard...

I tried logging in with my old username, but it didn't work. Because why would you bother migrating a user ID across...?

I tried resetting my password using the email address they had on file. But it didn't recognise that.

I'll tell you what it did recognise. The email address from my old employer. The one I left 5 years ago. The one I no longer have access to.

The only helpdesk numbers listed were either international or cost to call. Forget that noise! I'm not paying money to correct someone else's mistake.

After a bit of light investigating, I found that the ASDA Sharesave page listed a generic freephone number for ComputerShare:

0800 923 1507🔗

It welcomed me to the ASDA/Walmart service - I did not have shares with them - but after punching through the various options, a lovely customer service agent asked me which company I worked for. I told them, and they gave me my username and password (after passing suitable security checks).

Apparently, ComputerShare ignores any changes of postal address or email address that you may have made to your account and will default to whatever your contact details were when you were still employed. Why? Because they are crap.

Anyway, after all that, it turns out that my miniscule shareholding has halved in value since I last checked. At least that's one thing I can't really blame on ComputerShare's incompetence!

I don't have children. I don't want children. I find most children annoying - not yours, obviously, yours are lovely. But I resent being asked every single time whether my imaginary kids want an account. It's just annoying.

I can't imagine what it is like for bereaved parents who have recently lost a child. Or for those struggling with fertility issues. That constant reminder every time they try to numb the pain with a sitcom.

For some reason, all the streaming services are desperate for me to add accounts for my (imaginary) children. Are they worried about being sued if little Jimothy accidentally hears a swear word? Thankfully, Netflix lets you delete this imaginary child.

The BBC's iPlayer is less enlightened. They recently forced an "add child account" setting to the front page. It is impossible to remove it.

Terence Eden is on Mastodon

@edent

Hmmm. @BBCiPlayer have forced a children account onto our iplayer.
bbc.co.uk/iplayer/help/q…
Anyone know how to remove it? Can't see anything in the options.

---

Terence Eden is on Mastodon

@edent

The BBC believes that every household has children.
What an utterly bizarre choice. pic.x.com/lHDIy6RR8L

---

Apparently, it is technically impossible to remove an option which has recently appeared.

Amazon Prime has the same forced default child-profile. Although, thankfully, they allow you to remove it with a couple of clicks.

Channel 4 goes a step further. Any time I want to watch anything with sex, drugs, or violence - I have to confirm that I don't want to set up a parental lock.

There's no way that I can find to dismiss the screen. That's an extra click for my RSI-ridden hands every time I want to watch a stupid game show.

Here's the thing. The majority of households in the UK don't have kids.

London contained the highest proportion of families with dependent children in 2019; accounting for half of all families in London, compared with the UK average of 42.0%.

There's this weird belief that everything needs to be made safe for children. Even if no children are present, we have to protect them. That has led to some weird antipatterns.

Frankly, if a child somehow makes it into my home, and is left unsupervised long enough to work out which of the 7 remote controls turns on the TV and surround sound system, and figures out how to access Netflix - I'd say they're mature enough to watch whatever they want.

What's the solution?

I get that making your UI easy for harried parents is a priority. They're a big market - and they can be vocal about any perceived harm to their little ones. But there's no reason to keep showing the option if someone doesn't engage with it. You can ask if a child profile is necessary during set up. If you have a pop-up asking if a user wants a child-friendly account, make sure it has a "never ask me again" option.

The world doesn't revolve around children. It's OK to let people who don't have kids use your services without frustration.

I needed to download a Windows Virtual Machine in order to upgrade the firmware on a device (long story). The official Windows 10 VM is 20GB

TWENTY GIGA-FUCKING-BYTES!!!

It downloaded reasonably quickly - yay fibre! But I had to wait almost as long to unzip the bloody thing. Whereupon, I discovered that zipping the file - and it was only one single file in there - saved a whole 200MB. Yup, a 1% saving.

As it happens, I downloaded the wrong VM. So I downloaded the right one. A similar size, although this had couple of files in it - but the ZIP didn't save much space.

At which point, my laptop - not unreasonably - threw a wobbly because I'd suddenly consumed 80GB of space!

I'm sure you're about to tell me that there's an esoteric Linux command that will automagically extract a file, delete the original archive, and repartition my SSD for optimal layout - but that's not the point.

Every web server can - and should - gzip files on transmission. Manually zipping a single file on your server doesn't save any download time. It doesn't save any bandwidth.

Perhaps it makes sense to bundle a few related files together - but if it is a single large file, a .zip just wastes the time and disk space of anyone who downloads it.

Well, that's what you would believe if you were any website I've registered for. If you're a free WiFi provider, you get random details. Unless you have a legitimate reason for needing my name and address, you'll find that I live in a desirable area of SW1A 1AA.

You have a moral imperative to lie. The people who want your details are going to abuse your data. And that hurts you and the people around you. Targeted adverts are used to make you buy things you don't want and to believe things which aren't true. Deep data collection is used to work out what sort of person you are, the lifestyle you lead, and the risks you take.

Even if you think you are totally immune to advertising (you're not) and that you have nothing to hide (you do) - mass data collection is used to target people like you.

It is vital that you add as much statistical "noise" to the data collection pool as possible. This helps protect everyone.

Giving fake details is a position supported by security professionals.

3. My favourite pet is “the Eiffel Tower”

Enter the minimum amount of authentic information into online registration forms. Do you really need to enter genuine information in every field if there’s no legal reason to do so?

My Digital Footprint - Centre for the Protection of National Infrastructure

This isn't a theoretical concern. Earlier this year, Network Rail's WiFi provider exposed the details of people who'd registered for their free WiFi.

As the UK's National Cyber Security Centre says:

You should only fill in the mandatory details on a website

You should use an Ad Blocker as regularly as you'd use a condom - and for much the same reason.

If you have the patience, get a disposable SIM card and use that for receiving calls and texts from businesses or marketing firms. Then replace it after a few months.

To be clear - don't lie to people who have a legal right or legitimate need to know your details. Lying about your address to a delivery company means you won't get your parcel, and lying to your doctor could result in harm. Don't even think of deceiving the taxman.

But if someone you have no reason to trust asks for your data - feed them garbage.

/ləʊk(ə)lʌɪˈzeɪʃ(ə)n/ The ability to adjust a user-interface to the user's local language or dialect

Because I live in the UK, I speak en_GB (English, Great Britain) rather than en_US (English, Simplified United States).

Mostly, all dialects of English are mutually intelligible. Sure, the Brits love the letter U and the Americans stick a Z in every possible word. But we get along reasonably well. Except in Gmail.

Here's my en_GB localised Gmail interface. Note how there is a folder called "Bin".

Everyone using Gmail in en_GB will know that deleted emails go into the "Bin".

Gmail has a handy search feature to allow you to find emails in a specific folder. For example "Bob in:spam" finds all email containing the word "Bob" in your spam folder. "Proposal in:sent" gets everything you've sent with the word proposal.

But it is impossible to search the "Bin" folder.

Why? Because you have to search the Trash folder. Because that's the names used by Americans.

/hɪˈdʒɛməni/

The same is true even if you've chosen a non-English language.

Sadly, Google don't respond to user complaints or feedback. The best you can do is hope a ranty blog post gets high enough traction on social media. Then, maybe, something will change.

I despair over the state of software engineering - specifically, stability. We seem to have lost the understanding that computers are there to do the hard work for us. And I don't think we ever believed in a user-centred approach to developer tools.

The last time I developed an Android app all by myself was… fuck… Doughnut? Kitkat? Too long ago. Last week, I found a small open source Android app that I wanted to alter. Nothing drastic, just changing a few strings and a couple of images.

The repo was 3 years old. Surely it wouldn't be that hard to get running again? Ha!

Here's what went well.

1. Installing Android Studio. I remember when this was a chore - but I just installed the Flatpak, opened it, and let it update.
2. Cloning the repo. Again, simple.
3. Importing the project. Couple of clicks. Done.

Then it all went to hell.

Fail #1 - moving targets

Gradle sync failed: Could not find com.afollestad:bridge:3.2.5.

That's annoying. One of the libraries the app wanted to import was lost. Where was it?

It appears to be in MVN Repository with a note that:

this artifact is located at Spring Plugins repository (https://repo.spring.io/plugins-release/)

Things move. I get that. But why isn't there some form of automatic forwarding in place?

I fixed the issue and moved on.

But, as a new(ish) developer - how do I understand the complicated relationship between an app, the tools, the repositories, and all their weirdness? Where's the user-centred design in all this?

Fail 2 - automagic updates

Google's Android Studio is complicated. And it puts all the effort on the user. It kept complaining that targets were too low, and needed to be updated. It didn't actually offer to update anything itself. It didn't tell me where the error was. It didn't say "hey, we can automatically update some things. Here are the risks. Want to proceed?" It just left me in limbo.

So I found the strings and manually changed 5 numbers.

Why don't our tools do the hard work for us? An IDE isn't a screwdriver - it has knowledge about what it is doing and what problems it is encountering. It doesn't need to make changes unilaterally, but it could at least make helpful suggestions.

It reminds me of one of my earliest frustrations when I first started to learn C++ back in the 1990s. The compiler would say "Missing semicolon on line 427." To which I'd reply "If you know what is missing, and you know where it is missing, why not add it back yourself? You useless piece of crap!"

Fail 3 - change of syntax

Moving on. Deep breaths. Gradle started complaining that I couldn't use "compile" any more. Apparently it was deprecated. OK. So what's the fix? Again, neither Gradle nor Android Studio would tell me. They knew there was a problem, they probably knew what would get it working. But they stayed silent. Because fuck the users, amirite!?

The fix was simple. I manually replaced the word "compile" with the word "implementation".

That's it.

I did that a dozen times and it worked. What's the difference between the two? I don't know. I don't particularly care. I'm sure there was a very good reason for replacing one word with another. I'm sure it makes a profound difference to someone. But for me, the end result was the same. The app now compiled.

Imagine a user interface which suddenly said "you must turn things clockwise from now on!" You'd be all like "WTF? What's wrong with anticlockwise? That's the way I've done it for years." And they'd be all like "Dude! Clockwise is the way to go. It all has to change." And you'd go "Mate, can't you just install them backwards or something so I don't have to change my behaviour to accommodate your needs?" And then they'd spit at you.

Why doesn't Android Studio / Gradle / Whatever just go "Mate - you've used compile here - that won't work. Want me to automatically update the syntax? It'll probably be fine."

Don't make me think. And don't make me waste my time fixing problems that you have caused.

Fail 4 - who are our users?

I ranted on Twitter, of course, and had a series of frustrating conversations with someone from Gradle. Twitter is a crappy mechanism for reasoned discourse. So I'll try to be more lucid here.

Forums are full of people going "I can't get this project to work - Gradle is throwing weird error messages. Help me. I don't understand. Please - help!"

Gradle does not do any user research. It never sits down with independent developers, newbies, or seasoned pros. It never tests its error messages. It doesn't do developer relations. It doesn't spot bad implementations in the wild and offer helpful suggestion. It doesn't relentlessly focus on making things easier for users.

Gradle focusses on large organisations and caters almost exclusively to their needs. That's fair enough. It's their business and they can run it how they like.

The same is broadly true of Android. Its development tools are focussed on large teams of highly trained software engineers, who all intimately understand every esoteric aspect of App development.

It's great if you're a salaried employee with a large support structure. But for small and amateur developers, it's a nightmare.

I've lost count of the number of projects I've seen which start by saying "Simply install Flargnle in the normal way..." Oh, great, another technology that I need to learn in order to make a cool widget.

Fail 5 - extrapolating from limited data

I've used this project as an example. And I am being deeply unfair to Gradle, Maven, Android, and everyone else. I'm tired and frustrated.

But I'm sure you've found the same thing with other bits of software. You have to download endless libraries - and then get stuck in dependency hell because v1.1 isn't compatible with v1.2 and the original Google Code link has died and the mailing list hasn't received a message since 2015 and the author's GitHub shows they're more interested in the latest JavaScript framework and the error message points you to a USENET message and the last StackOverflow answer is "nevermind, figured it out".

The job of a computer is to do the hard and boring work for us.

Here's a partial list of everything I cannot do on a Mac, but I can do on Ubuntu.

These are all objective facts. These are things which either are impossible, or require adding unsupported 3rd party software - sometimes at a cost.

• Resize the system font
  • I find the menu bar at the top too small. The only way to do this on MacOS is to lower the resolution of the entire screen!
• Change the system font
  • I know you like Helvetica San Francisco - but I find it a bit too thin to read.
• Focus Follow Mouse
  • I have multiple screens and multiple windows. I want to be able to hover over a new one and start interacting with it without clicking.
• Change my mouse button order
  • On Linux, this is a complex command-line incantation. On MacOS it is impossible. I use a vertical mouse and use my thumb to click. RSI FTW!
• Read files from MTP devices
  • If I stick a USB cable between my phone and Linux laptop, I can see the Android files on my laptop. I can open them, move them around, etc. On a Mac I need to install some shonky 3rd party software which rarely works.
• Always on top windows
  • Sometimes I want to keep the calculator on screen while I type an email. Is that too much to ask?
• No way to remove UI elements.
  • I don't want a notification icon in the top right of my screen. I prefer having the clock on the left. Trivial in Linux, static in MacOS.
• Window snapping
  • On Ubuntu, I drag a window to the side or to a corner, and it snaps into position. Vital when using multiple windows at once. On Mac there's a half-hearted splitscreen view which only supports horizontal splitting. Useless on a vertical monitor.
• See tooltips
  • I can't see them on Mac when I have a larger cursor. Weird!
• Mount an SSH or NFS drive
  • In Ubuntu, I get a nice little GUI for picking network shares. Impossible on Mac.
• Wobbly Windows!
  • Seriously MacOS. Where's the fun?

I know you're going to be tempted to reply with "you're using it wrong" - but I'm not. This is how I like to use my computer. And it is clear that the MacBook isn't my computer - it is Apple's. (OK, OK! It belongs to my employer!)

That's not a problem for Google Hangouts - it just works in any browser. No need to install plugins or apps. Voice and video just work.

But Zoom - one of the most used VC services - falsely claims that users need to install an app to use it. I've had frustrated colleagues express their displeasure that they can't install an app and, therefore, have to dial in on a phone and can't see any slides.

Here's the thing. Zoom supports web browsers. It just hides it really well. Only after attempting to download the app, and then waiting for a few seconds, do you get this tiny message saying you can join in the browser:

That's annoying and, frankly, irresponsible. People urgently need to get on calls and Zoom is deliberately making it hard to do. WebRTC works. It works really well across browsers. I'm sure the Zoom app is marvellous. But it is useless if people can't install it.

If you want to share a direct link to a call, use this:

https://whatever.zoom.us/wc/join/123456?pwd=

Replace the whatever with your company name and 123456 with your Zoom's conference ID.

I have RSI and use a vertical mouse. After decades of regular left-clicking, my index finger is worn out. So I use a thumb button to click. Changing the order of mouse buttons is supported in all modern operating systems. Evoluent - the manufacturer of my mouse - also provide a handy tool for Windows and Mac so that I can set the mouse buttons up just the way I like them. I've written a guide for how to do it on Linux.

But with a ChromeBook? No. The message being put out is that Google doesn't want unhealthy people using its products.

I plugged my mouse in, and tried to change the button order. There's no way to do so. No hidden flag, no extension, no catering for abnormal people.

This isn't a new problem. A bug was raised FIVE years ago.

My favourite responses from Googlers to that bug are:

Technically it's not hard, it's just a question of UI work.

So it'll come along quickly?

Chrome has always aimed to minimize UI, as these features add up.

Ugh! Such a hassle to create something useable!

It's clearly a power-user feature

Yay! My super-power is pain in my index finger. I'm sure Professor Xavier will invite me to his special school for mutants any day now...

It's 2019. It is unacceptable to release a product which isn't accessible. Google is one of the most powerful companies on the planet, it employs some of the most talented people I know. But there seems to be no way to prompt them into fixing old accessibility bugs. Perhaps a ranty blog post will push things along?

2025 update. The bug was fixed ten years after being opened!

Wandering around Oxford yesterday, I noticed this sign attached to a bank's ATM:

"This ATM is running slow and may take a while to return your card. Please be patient while we try to resolve this issue. Thanks. TSB Oxford."

Let's count all the ways this is problematic.

Appearance

This is literally sticky-taped to the front of the machine. It isn't aligned. It is spelled correctly. But it looks sloppy and amateur. A criminal could have easily taped this to the front of the ATM to discourage people from complaining to the branch.

Authenticity

What could the bank do to make the sign look more authentic?

If this was the bank's handiwork, they could have printed the bank's logo. Or a phone number if people have questions.

Perhaps they could have added more information, or directed people to another cash-point, or had the bank manager sign the notice.

Validity

But, of course, a criminal could do all those things too! Colour printers are cheap, as are disposable phone numbers.

There's very little a user can do to immediately check the validity of the message. All they can hope for is that, if it were fake, staff would have spotted it and torn it down.

Verification

While the bank is open, it's trivial to enter the bank and ask the staff if the message is genuine.

When the bank is closed... Well, you can wait an indeterminate period on hold, only to be told by an off-shore call-centre that they don't have any knowledge of what's happening in local branches.

Accessibility

Visually impaired users will not be able to read this message. Short people may not see it. It's just polite to make an important message available to everyone.

Integration

Could this message be placed on the ATM's screen - rather than the regular rotation of adverts? From my experience working with banks, the ATMs are usually managed centrally - and are built on a fragile technology stack. That means banks are reluctant to change what's displayed on them.

Even if they did, people suffer from Notification Blindness - the fact that we're constantly visually assaulted by messages means that informational messages get lost in the noise.

Trust but verify?

One of the central problems of modern life is how to verify that something is trustworthy.

Whether it is a news report, a door-to-door seller, a new acquaintance - our social structures are just not set up for a distributed trust model.

A determined criminal can forge an identity card well enough that most people will not be able to spot that it is a fake - not without extensive experience and expensive equipment.

There's also the social pressure - it seems rude to ask someone to wait while you verify their identity. In the case of this ATM, do you want to go inside the bank and insult their sign - and then be forever known as "the jerk who thought the sign was dodgy"?

We can imagine a future where a sign like that had a code on it that your phone could read, which would lead you to a cryptographically signed message - verified by a trust-agent - that you could use to assure yourself that this was a genuine sign.

But, based on my observations of the ATM, most people wouldn't even bother to glance at the sign.