No changes for the June 2025 slightly scary dumb password report. Most notable this month is a sharp drop in access attempts, just 24% of the volume in May, although the diversity of passwords has only dropped to 64% of last month. This corresponds with my theory that spikes in December and April/May correspond to bored university students with nothing better to do than turn into script kiddies and try to wreak a little havoc. This theory has nothing to do with my personal experience as a bored university student. [cough]
I’ve replaced valid login user names with {username}, and names of the site with {site}, old compromised passwords with {compromised} and malware with {malware}. There were also a large number of seemingly random hex strings logged on one site. They’re pretty boring so I’ve collected those as one entry. If you think your username followed by a special character and a year is a secure password, you might be in for a shock. Actually, your user/site name followed by anything is a really bad idea.
These are failed password attempts across my WordPress websites. None of my sites are particularly popular. The amount of real traffic they get is small. So if you have a site and think hackers are ignoring it because few would care, think again. Every site on the net gets attacked like this. Every single one, including yours!
This applies to a lot of sites running on a a freemium business plan (for those unfamiliar with the term, a freemium model is when a service offers basic access for free, and then tries to up-sell you on premium features).
Most people are probably familiar with the concept: some new site shows up. It’s pretty cool, it’s free. You start using it. As you do, it’s constantly reminding (or outright nagging) you that there are lots of extra bonus features that you could get if you just sign up for a monthly fee (and get two months free if you sign up for a year!).
In an ideal world, those extra features are compelling enough that lots of people sign up. The company starts making money, investors are pleased. But then growth starts to level off, and although those paid users keep the company afloat, investors aren’t there for just a good deal, they want growth. They want to push to an IPO so they can cash out!
What’s a company to do? Easy, tap that free user base. The way most do this is to start clawing back on what’s free. For example, the unlimited length video calls that you signed up for are limited to an hour. Then later 30 minutes. And then ten. That’s enshittification.
Some users grudgingly switch to the paid model, investors are satiated for the moment. But all those other users start looking around for an alternative, and growth stalls again. Now the service gets sold to some bigger enterprise, folded in, and the free service either gets more crippled or discontinued. Remember when Slack was cool? Yeah. That.
For me, most of the time the cost of a subscription is just not something I’m willing to pay. Usually that’s because I don’t use the service enough to justify the cost, and sometimes it’s just because I’m a tightwad, and sometimes the pricing is so ridiculously high that it’s laughable. “Get this insight that might be meaningless for only US$249/mo?” No thanks.
What’s ironic is that often I’d be more than happy to pay something that gives the company a decent margin on the free stuff, but that option is almost never present. What if I have absolutely no use for those freemium features but I value the service enough that I’d like to see the services I have stay in place, instead of being eroded in a thousand cuts?
I’m going to use The Story Graph here as an example. I need to stress that this is an example. I am not picking on a site that I am actually enjoying. If anything, I’m looking for a way to help that fits my needs. StoryGraph plans are far more reasonable than most freemium sites. Their “plus” plan isn’t that expensive, just US$5/mo, or $50 per year. For that I get:
Invest in a Goodreads alternative not owned by Amazon. Hey that sounds great! I can really get behind that, although the use of “invest” here is disingenuous. “Fund” is more like it, unless someone plans to send a share certificate.
Custom Charts. Nah, couldn’t care less.
Extra Stats Filters. Nope. Don’t give a damn about my reading stats, either. Just want to track some books and maybe get some recommendations that don’t suck.
Compare Stats. Still don’t care.
Exclusive Charts. Zero interest.
Shape the roadmap. Be an unpaid focus group. Nope.
Priority Support. I don’t know how to break it to them, but nothing about my reading is mission critical. Take a couple of days to get back to me. Whatever.
(Unspoken) Get rid of the constant prompts to upgrade. Well, maybe not rid of them, but less frequent would be nice.
So there it is. The only thing I want is to see this site keep doing what I’m getting on the free plan. To take a chip out of Amazon’s dominance of the bookselling space. But that’s only worth about $15 per year to me. Do I have that option? Nope.
Truly, the fact that there’s no “just help us stay afloat” option makes me think that enshittification or sale is inevitable, and because of that, I’m actually more hesitant to put too much of my time into it. Pervasive enshittification has made me cynical. This is also why I have donated to my Mastodon instance, FreeCAD, LibreOffice, novelWriter, PHP, and others: I want them to be sustainable.
Changes for the May 2025 slightly scary dumb password report are fairly minor. I’ve rearranged the columns to put the frequency and ranking information first, and I’ve truncated really long passwords to make the layout work better. These truncations are marked with [cut]. The number of attempts is up from last month’s 5,375 to 5,695 attempts with 470 unique passwords, fewer uniques than last month. A new attack this month was was one attempt to inject some Java to expose /etc/passwd.
I’ve replaced my login user names with {username}, and names of the site with {site}, old compromised passwords with {compromised} and malware with {malware}. There were also a large number of seemingly random hex strings logged on one site. They’re pretty boring so I’ve collected those as one entry. If you think your username followed by a special character and a year is a secure password, you might be in for a shock. Actually, your user/site name followed by anything is a really bad idea.
These are failed password attempts across my WordPress websites. None of my sites are particularly popular. The amount of real traffic they get is small. So if you have a site and think hackers are ignoring it because few would care, think again. Every site on the net gets attacked like this. Every single one, including yours!
Cleaning up from an ice storm is a more involved process that it might seem at first. That’s not a surprise, but the extent has been larger than expected. What I didn’t expect is that ineptitude in another country would add even more complications.
I’ll start with the reasonable part. That Ego chainsaw that I was waiting on a month ago took nearly four weeks to arrive. That’s no surprise. I’m certain that the demand for chainsaws of all types spiked the day after the storm passed. The saw finally arrived last week and with other stuff going on it took a couple of days to get through the instructions, because nobody wants to accidentally sever a femoral artery. Then it took a bit of time to get over the intimidation factor of using a tool that can do something like that in a second. A nice day arrived so I put chainsaw oil in the unit and donned protective chaps and got them adjusted, then safety glasses, a hard hat with a screen and ear protectors. Then I found some smaller downed branches to start applying my new knowledge of how to cut trees. Finding a little success there, I carried on with larger branches. For years, I’ve been using a bow saw to cut off tree branches and break stuff down, and much of what I’ve learned doing that (thankfully without serious injury) works just as well with a power tool. there are two huge differences between an electric chainsaw and a gas powered one. Most notably, ear protection isn’t really required. The amount of noise it makes is minimal. Then there’s the ease of starting it. No jerking on cords and tweaking chokes to get it running. No either leaving it running while moving things around or trying to restart it each time. Push a button, squeeze the trigger, it runs. Just another reminder that powering things through an engine that has to contain powerful explosions is silly.
Two days later and we’ve got about ten piles of stuff broken down into pieces that are small enough to move.
Part of an apple tree downed by the storm, cut up.
Branches of a cedar tree
The plan is to break down much of this wood for use as kindling. We’re going to have a lot of it when we’re done, so it made sense to get a rack for that purpose, and here’s where we get into politics. We found a supplier of “outdoor stuff” and a rack that looked like it would meet our requirements. I placed the order. The next day we got a tracking number and a “guaranteed” delivery date. This highlights one of my common complaints about online stores: as soon as a shipping label is generated, the order goes into “shipped” status, but really it can take days before the order is actually prepared and shipped. Take the tracking number over to the shipping company’s website, and you get “we don’t have that package yet”.
But carriers aren’t perfect either. When the package didn’t show up and the carrier still didn’t have any information the day after the promised delivery date, I reached out to the vendor. As it turns out, the item was out of stock and I got a refund and profuse apologies. But I still need a rack, so I went to Plan B, returned to their site and discovered that almost everything they sell is now out of stock. Now why would that be? Because everything they sell is made in China and this company probably brought product into the US first, then shipped it up to their Canadian warehouse, and thanks to the current administration, China isn’t shipping anything to the US. My hope is that we’ll soon see the US cut out of this process, with direct shipments to Canada, but like anything else, that’s going to take some time.
On to plan C, where we find a supplier who still has stock and get some kindling racks on order. This is successful.
After hauling all suitably-sized branches up to the garage, I put the chainsaw and a log splitter to use to cut everything up into kindling-sized pieces.
Wood for kindling, some split, some not.
[That gas tank was to get a gas-powered generator running when the power was out. Naturally it wouldn’t start. Internal combustion engines suck.]
Split wood, ready to move
And finally I stacked them in our new “Plan C” rack:
Kindling on a rack.
By the time we’re done, I expect that rack to be filled to capacity, and we have a second one just like this one that we’ll use for smaller pieces.
Then we’ll be ready for Step Four, which will be call in the professionals to handle that Mulberry tree and several others. In turn that will require another round of long splitting and kindling-making. By the time fall arrives, we might even have the whole mess cleaned up!
Recent Comments