Miriam Schwab @ #WCUS:

Why is cryptomining from websites bad? Because it eats resources, plus governments shouldn’t be cryptomining.

Magic Cart: Going on for last three years, no one knows origination, attack ID’s third-party scripts on websites and then hacks scripts.

Magic Cart hacks scripts for the purpose of skimming credit card information.

Content security policies: white-list sources via browser header, if a source is not white-listed, it can’t be installed. Applies to trackers and other third-party web scripts like Google Analytics or Google Fonts.

Demonstrating code snippets which implement content security policies, will share slides later.

Includes log of violations of content security policies. I’m going to love looking at this code.

If you research content security policies online, not a lot of upp-to-date information, CSPs have been around since 2012.

W3C’s docs critiqued as being illegible, especially for those who speak English as a second language. Agree. Internationalization FTW!

Google is “do-as-we-say-not-as-we-do” with regard to its CSP docs V. what it does with its Google Analytics and other scripts.

Keeping up with what’s been added to pages manually is hard. Use Scrict Dynamic CSP instead. One policy across multiple pages.

Google has tools for CSPs: Strict Dynamic Test Bed, not sure of accessibility of tool will need to check later.

CSP can be added using meta tag or in theme’s functions.php file. Also .htaccess. Use these if you don’t want to work with browser headers. Probably can stick this in custom functionality plugin too.

CSP Mitigator from Google: Check http response headers, if no CSP present, will alert. If CSP present but there are problems with it, tool will offer suggestions.

There are also WordPress plugins for this, not recommended because some are out-f-date, but easy way to get started.

report-uri.com: Alternative to CSP Mitigater, useful if you have issues philosophical with Google.

Google’s resources making it possible for more people to implement CSPs.

Now demoing offline copy of White House website: No CSP, which means things can be injected client-side.

For the blind people playing at home, the injection to the Freedom scientific website changing the site tagline to “Too expensive products for the visually impaired” was a result of no content security policy being present on the site. Not from speaker, my own injection of another example.

Today marks the two hundred and ninth anniversary of the birth of Louis Braille, the inventor of the system of dots which bears his name and has enabled blind people all over the world, including myself, to read and write. This day is commemorated as World Braille Day, and in appreciation of the gift loaded with opportunities braille has provided me, I wanted to write a short note of thanks and gratitude as my Ultimate Blog Challenge post for today.

I’ve been a braille reader since about the age of five, and shortly after that, a braille writer. Braille was how I and my fellow students in the classes composed only of blind children I attended in my early school years learned to read, write, spell, and do math. I still enjoy reading braille whenever I can, using a braille display, and I honestly can’t conceive of my life without it. Braille has enabled me to contribute to the world around me, as well as cook, write code, and read for pleasure. Braille has made it possible for me to more concretely retain knowledge. I can learn by listening to either a screen reader or to an audio book, but there’s nothing quite like reading and then digesting as opposed to a near constant stream of spoken words that are coming in while the last ones I may have heard are still in the process of being internalized.

Several of the things I am sentimentally attached to involve braille: The box of birthday cards from my grandma which all have their messages in braille; the little porcelain shoes I received as a gift from Rian Rietveld at the final WordCamp U.S. with their attached note in braille; the purse charms I bought myself last year from elegant Insights Braille Creations with their embossed braille phrase. For me, nothing preserves memmories quite like braille does.

So, thank you, Louis Braille, for the privilege of being able to read and write, and thereby contribute to my world. Thank you for the enjoyment, and the ability to read when the power’s out, and the ability to capture memories in a way that will outlast almost every form of technology. Thank you for everything.

Statue of Greek god Apollo on display in the Walters Art Museum.
Today’s Ultimate Blog Challenge post will be a quick one, because it’s been a very long day with very few spoons and I’m very tired. The prompts for today revolve around the people we admire in either our personal or professional lives, but instead of focusing on who I already admire, I wanted to write a bit on where I think we need to be headed if we want to become people and a profession that people who are not part of our “in crowd” can trust when we make promises, (explicit or implicit), regarding improving their lives and not screwing them up. This is more of a meditation than anything else, so it’s a bit rambly.

Every day, I come across articles in my various news feeds about the latest moral or ethical outrage in tech. They’re usually different kinds of moral or ethical outrages, but I think they all stem from the same root problem: Arrogance on the part of the tech industry. I think, as a general rule, our industry tends to not think about the negative effects the things we create can have on society in general and the lives of individuals in particular. We tend to view the idea of tech taking over everything as a good thing, we assume that whatever we’re creating is part of that goodness, and when someone does bad things with it, we come back with something along the lines of “We can’t control what people do with our stuff.” We pretend that the things we create are neutral and that we as an industry are a shining city on a hill, when really neither of these beliefs are true at all and are prime examples of our telling ourselves what we want to hear and believe instead of acknowledging the realities of the situation: Technology is not neutral, we have a lot of power over society and over individuals thanks to tech being as pervasive as it is and getting more pervasive by the day, and while we can’t prevent every bad actor from using what we create, we could work a lot harder to make it more difficult to do horrible things with our creations. We’re not building neuclear bombs, after all.

If we want to become an industry the public can trust, we need to get our stuff together, and we can start with stripping away the arrogance. I’m thinking of a certain type of founder here, but really, we’re all susceptible to it. It’s really easy to convince ourselves that we’re drowning in awesome sauce, that everything we do has zero ethical problems, but that’s mostly because we generally refuse to consider ethics in tech, and so since we’re not considering it as a discipline, there must not be a problem. But ignoring a problem doesn’t mean it doesn’t exist, and the longer we continue to ignore this as an industry, the worse it’s going to get. And eventually, as people become more technologically literate, they’ll begin to look more closely at what we do outside of code as well as inside it. We cannot continue to freewheel through people’s lives, reduce them to one-dimentional users, and then walk away from the consequences that inevitably result from our actions. None of this is to say that the things we create are evil by default. I still believe that we can do a lot of good in the world. But we need to concentrate on making sure that we’re actually creating things that are beneficial, and guard against our creations being used for evil as extensively as we can. In short, we need to grow up and start demonstrating that we have the capacity to act ethically and responsibly.

Amanda standing outside while it snows
The Ultimate Blog Challenge presents so many opportunities to get to know other people and build relationships with them, and the best way for this to work for everyone is for all of us to be as human as possible with each other. I think this is why one of the starting posts is an introduction.

I personally find introductions where I have to say nice things about myself hard to write, but another one of my 2018 goals is to do more self-promotion while not becoming annoying or conceited about it, so here’s my introduction to the rest of the participants of the January 2018 Ultimate Blog Challenge.

My story on the web begins with a course on HTML I took as part of my computer science studies back in 1998. It was my favorite part of that year’s curriculum, and I spent the rest of my school career and early work years tinkering with web technologies. I use a piece of technology called a screen reader, because I am totally blind. This meant that I needed to make sure that my web tinkerings had an accessible result, because if they didn’t, I myself would not be able to use them. So along with experimenting with things like HTML and CSS, I used tools like Bobby along with manual testing with my screen reader to make sure that I could use what I created.

In 2005, while I was trying to solve the problem of displaying the Hebrew date on my very simple blog, I ran across WordPress. Never having used free licensed open source (FLOSS) software before, I assumed that WordPress was going to cost me and that the plugin I needed was going to cost me further. This was not the case. So after work one day, I decided to go through the famous five-minute install, and I had WordPress up and running on this site, which at the time was my personal site on the web.

During the day I went to work at my job, and after work I experimented with WordPress. This included hacking themes and plugins, breaking things, and learning how to fix them.

Then, one day when I went into work, I found that the software I needed to use to do my job became completely inaccessible. This meant that I literally could not do my job. There were some attempts by our operations manager at the time to try to get the software fixed, but since the call center I worked for didn’t have control of the software, those efforts amounted to something along the lines of “we’re terribly sorry our software doesn’t work for you, and here’s this other blind guy who works for the same call center you do, and this other one who works in-house with us, and maybe you guys can come up with a work-around.” Spoiler alert: We didn’t.

When the effort to get the software I needed to use to do my job proved unsuccessful, the next option according to the call center was to terminate my employment, hand me a severence package, and send me on my way. Of course I was deeply unsatisfied with this option, because I had done nothing to warrant termination, and a severence package wasn’t going to make the fact that I was going to be out of a job any more palatable. Fortunately, I had a supervisor who was willing to go to bat for me like nobody’s business, along with a systems administrator who was willing to bend the rule about low-level employees not having anything but restricted internet access on their work stations.

So because I wouldn’t agree to the termination and severence package, and because the call center I worked for didn’t want a discrimination lawsuit on their hands, I spent my last two years at that job hacking on WordPress for eight hours a day.

In mid 2007, I accepted a tech support role with Freedom Scientific, a veteran provider of assistive technology for individuals with blindness, low-vision and learning disabilities. This was my first position involving remote work, and I continued to hack on WordPress after work while supporting users of Freedom Scientific software by day, assisting with installing their flagship product, Jaws for Windows on individual machines, as well as configuring license servers to work with various corporate and government firewalls and networks. My duties also included supporting users of notetakers such as the Braille ‘N Speak, which you can see demonstrated in the below video.

Things were going great until I received an email one Saturday morning from my manager at Freedom Scientific letting me know that my hours had been reduced to zero, and that once I sent my phone and other equipment back I would receive my last paycheck. I now had a ton of free time on my hands, and no income. I applied for Social Security Disability and waited for that to kick in, while living off the six months’ worth of pay I had saved. I also decided to go back to school to obtain various Cisco and Red Hat certifications. I thought that these would be my way back into the workforce. I was very wrong.

As I began taking courses for my certifications, I learned that the certifications themselves were completely inaccessible. This meant that I could take courses all day long, but I couldn’t pass them because the certifications were required as part of the final grade. My GPA tanked, I lost my financial aid, and everything started cascading down from there. My health took a turn for the worse and I was diagnosed with Lupus eventually, I was evicted from my apartment, and I moved to Augusta, Georgia because my friends Wil and Denise offered me a couch and a roof over my head.
I was still hacking WordPress through all of this. It was the only stable part of my life. I wanted to help make it more accessible for people with disabilities, so I googled WordPress and accessibility and stumbled on the WordPress Accessibility Team in 2012. I was elated that it existed and joined up. Shortly after that, I finally got my own place to live, and started thinking about what I was going to do with the rest of my life in regard to work. I thought I could build things with WordPress for a living, but wasn’t sure if anyone else was doing it. I had heard stories, but figured they were one-offs and assumed given my recent string of failures that I could never pull it off.
I had begun listening to podcasts by this point, so I started looking for WordPress-related ones. I stumbled on the Drad Cast. I was expecting it to be full of technical things, but not very entertaining. Wrong again. I loved it. It was WordPress, beer and hilarity all rolled into one. And they talked about security as well, which is another subject I’m passionate about, along with accessibility. When the Drad Cast announced that WordSesh was going to happen, I was stoked. It was twenty-four hours of WordPress crack, and it was completely online. This was good because travel was out of the question. I made sure to tune in and stayed up the entire time listening to and absorbing WordPress knowledge. I also started interacting with WordPress people on Twitter, and learned about the wider community and how awesome it was. A couple of months after that I started using Genesis, which made WordPress development quicker as far as the front end is concerned. And I was still contributing as part of WordPress Accessibility. Things had finally started to pick up.
In 2014, I filed for incorporation in Georgia, and Customer Servant Consultancy became an actual entity. It was the name I had been operating under since I started building things with WordPress for other people and I was glad to make it official. It was also around this time that I started building internal systems with WordPress to manage projects and customer relations. Since WordPress is open source, and becoming more and more accessible by the day, I was able to gain more independence because I wasn’t at the mercy of web and application developers who know nothing about accessibility. I could build it myself as long as I had the time.

Fast forward to 2018, another year full of promise and potential. The internet is ever-changing, and the WordPress community is going strong. I never expected to find my nitche through a random web search so many years ago.

It’s time for the January 2018 Ultimate Blog Challenge, and I’m jumping in with both feet. I wanted to write a quick post both as my first post for the challenge and as my first post of 2018 to explain why.

Several of my goals for 2018, (goals mind you, not resolutions, simply because I don’t like all the social baggage that comes with that term and I also hate conformity), revolve around my websites. I’m working on aligning my personal and professional site (this one) with the principles of the indieweb, and part of that effort involves writing less content specifically for the various social media silos and more on my own sites, which then gets syndicated to social media silos. I thought that joining with a group of people who are similarly interested in bolstering the presence of their own blogs would be a great way to help accomplish this, as well as build some new relationships. I’ve also got a ton more writing to do for the WordPress with a Screen Reader series, and writing shorter posts each day will exercise the writing muscles I need for that series. I’m looking forward to reading what everyone else has to write, commenting on those posts, and adding my own posts to the effort.

If you want to join us, you can visit the Ultimate Blog Challenge website, and sign up for yourself. There’s also a Facebook group as well as a Twitter hashtag you can follow to read submissions from other participants. I’m looking forward both to my part in the challenge, as well as interacting with everyone else. Welcome to 2018, everyone.

This post originally started as a Twitter thread. Since those can be difficult to read in some circumstances, and since this content is I think valuable for more than just WordPress Twitter, I’m spooling it up and re-sharing as a complete post. I’ve also added a link and a video to this.

OK third-party WordPress, we need to have a come to Jesus meeting about your accessibility flare. The day I hoped and prayed would never arrive, and which I feared would get here despite my wishes, is here. People and organizations who choose WordPress because of its power and flexibility, and yes, because it can often be easier and less expensive to use than creating a custom solution, are being served with demand letters regarding the accessibility of the websites they build. Websites they build with our themes and our plugins. I have two clients in my cue right now, both within a matter of days, who find themselves in this position, and they’re lawyers have already responded to the demand letters agreeing to terms. This is good for business, for obvious reasons. But it does not make me happy at all. Not one bit. The fact is, I want people to build accessible websites because it’s the right thing to do, not because they have to be sued into compliance or bullied into same. We, as software creators, have a responsibility to ensure that we don’t put them in this position, whether the plugins they use or the theme they use are premium or free. The resources are out there for you to learn how to write accessible code and how to design accessibly. Trust me, this is not some sort of “Hey your stuff sucks, hire me and I’l help you fix it” marketing campaign. I want you to fix your stuff, regardless of whether or not I get anything out of it. I want people who use WordPress to be able to rest assured that, when they build with our stuff, they are building things that are inclusive of everyone, without having to ask. I want people to be able to build accessible websites without having to hire someone who specializes in accessibility to do it for them. I do not want some momblogger to be served with a demand letter, only to find that the site they built with a $100 theme and some free plugins is now going to cost them thousands of dollars any way they cut it. The only people who really win in these senarios are the lawyers sending the demand letters. There’s consequently a backlash brewing in the legislature, which if successful, will further punish people with disabilities by restricting the already-limited solutions we have for resolving accessibility complaints. And make no mistake about this, people with disabilities are not at fault for wanting their civil rights to be upheld. Accessibility is a civil right. This talk explains.

WordPress now powers close to 30% of the web, or even if you don’t like that stat, still a sizeable portion of it. With that kind of reach comes responsibility. We can say all we want that it’s the responsibility of the people building the websites to look after accessibility. That’s fair when the only people building websites are web professionals. But web professionals are far from the only ones building websites. We, as people who build for WordPress, are not responsible for what any other platform does. But we are responsible for what we do. And we build plugins and themes like it’s going out of style, which people then download and use to build websites. We have an obligation to ensure that we don’t expose them to risks like this without their knowing it. In a lot of these cases, if some small organization or business gets a demand letter, their only recourse is to take the site down, since they could never afford to spend thousands of dollars on a custom website in the first place. That means their voice goes silent. We are in the business of democratizing publishing. That also extends to building the actual website. And the thing is, this is completely unavoidable, and by unavoidable, I don’t mean in exchange for people with disabilities putting their civil rights on the back burner. This situation should not be happening, and we, as the creators of this software, have an opportunity to help stem some of this, and a responsibility to do so. I am serious. I do not want to see another urban clinic, or another non-profit, or another momblogger, served with a demand letter and faced with a bill in the thousands of dollars for fixing it because they chose WordPress instead of a custom solution. Of course, I will fix sites, switch out plugins and themes, ETC. But this is not the way accessibility should be mainstreamed. Bringing the legislative hammer down on people with disabilities is not the answer. Waiting on the Department of Justice to get its act together and settle this is also not the answer. But third-party WordPress, this game where accessibility is a nice-to-have or an afterthought is over. With or without my help, start getting your crap together. Seriously. And yes, Envato, this especially includes you, because let me tell you what’s happening. Someone wants/needs to build a website, and so they go looking for the perfect theme. So they google, and they land on ThemeForest, and find the perfect theme with all the right features, pretty demmo, all that. They then buy it and set it up, caring nothing about proper theme architecture, bundling plugins, none of that. And then, they get served with a demand letter or lawsuit. And they don’t care how the theme was built/what makes up their website. They care that they were able to spend $50-$100 and have a presence on the web. And Envato, the majority of those sales are going to you and your authors. So I do not care if you have to make a mandatory rule stating that no theme can exist on your site without following the WordPress theme accessibility guidelines, do it. I don’t care if you then have to take those theme guidelines and apply them to the front end of the plugins your authors bundle in. Do it. Obviously this goes for the rest of you too, but Envato is huge in this. So once again, get your crap together, do your f*cking jobs, so your users don’t walk into this unaware.