📚 The Coddling of the American Mind

    Read: The Coddling of the American Mind by Greg Lukianoff and Jonathan Haidt


    My Reading Highlights and Notes

    INTRODUCTION The Search for Wisdom

    Read More →

    🔒 OSS backdoors: the folly of the easy fix - lcamtuf’s thing

    Even when it comes to lesser threats, the bottom line is that we have untold trillions of dollars riding on top of code developed by hobbyists. The companies profiting from this infrastructure can afford to thoroughly vet and monitor key dependencies on behalf of the community. To be sure, a comprehensive solution would be a difficult and costly undertaking — but it’s not any harder or costlier than large language models or self-driving cars.

    🔒 Guest lectured again. Had to be remote because COVID. The professor has a habit of getting a shot when I have a funny line on the slides.

    Last time I was doing code/bug examples and my slide said “what could go wrong?”

    This one is talking about rules of engagement and responsible disclosure.


    🔒 23andMe wants us to accept new terms that change their “Dispute Resolution and Arbitration” process. I wonder what might have spurred that change?

    How many of these can you answer about the bioregion where you live?

    It seems appropriate that these questions came up (during my daily highlights review) on a colonial holiday. May we re-orient ourselves to deep connection over superficial exploitation.

    1. Point north.

    2. What time is sunset today?

    3. Trace the water you drink from rainfall to your tap.

    4. When you flush, where do the solids go? What happens to the waste water?

    5. How many feet above sea level are you?

    6. What spring wildflower is consistently among the first to bloom here?

    7. How far do you have to travel before you reach a different watershed? Can you draw the boundaries of yours?

    8. Is the soil under your feet, more clay, sand, rock or silt?

    9. Before your tribe lived here, what did the previous inhabitants eat and how did they sustain themselves?

    10. Name five native edible plants in your neighborhood and the season(s) they are available.

    11. From what direction do storms generally come?

    12. Where does your garbage go?

    13. How many people live in your watershed?

    14. Who uses the paper/plastic you recycle from your neighborhood?

    15. Point to where the sun sets on the equinox. How about sunrise on the summer solstice?

    16. Where is the nearest earthquake fault? When did it last move?

    17. Right here, how deep do you have to drill before you reach water?

    18. Which (if any) geological features in your watershed are, or were, especially respected by your community, or considered sacred, now or in the past?

    19. How many days is the growing season here (from frost to frost)?

    20. Name five birds that live here. Which are migratory and which stay put?

    21. What was the total rainfall here last year?

    22. Where does the pollution in your air come from?

    23. If you live near the ocean, when is high tide today?

    24. What primary geological processes or events shaped the land here?

    25. Name three wild species that were not found here 500 years ago. Name one exotic species that has appeared in the last 5 years.

    26. What minerals are found in the ground here that are (or were) economically valuable?

    27. Where does your electric power come from and how is it generated?

    28. After the rain runs off your roof, where does it go?

    29. Where is the nearest wilderness? When was the last time a fire burned through it?

    30. How many days till the moon is full?

    The Bigger Here Bonus Questions:

    1. What species once found here are known to have gone extinct?

    2. What other cities or landscape features on the planet share your latitude?

    3. What was the dominant land cover plant here 10,000 years ago?

    4. Name two places on different continents that have similar sunshine/rainfall/wind and temperature patterns to here.


    🕊️♻️ Good workshop on Climate Anxiety, Hope, and Resilience this morning. #MennoCon23

    Once again I made the call to reorient our conferences and districts to our watersheds.

    The White River Alliance is issuing an urgent action request to protect Indiana wetlands. This is important for flood & drought management, ecosystems, biodiversity, and much more.

    A surprise amendment aimed at further reducing protection of wetlands in Indiana was added to unrelated Senate Bill 414 yesterday (March 22).&10;Ironically, this amendment to SB 414 comes only a few months after the Indiana Wetland Task Force issued its report emphasizing that Indiana could not afford to lose any more wetlands.&10;Our state legislators need to hear from constituents who want wetlands protected. Please reach out to vour state representative as soon as possible, and urge them to OPPOSE this legislation or to remove the wetland language.&10;This bill could be considered by the full Indiana House as soon as Monday, March 27, - so time is of the essence!

    Positive legislative update courtesy of White River Alliance, regarding HB1639.

    📚 2022 Book Review

    Welcome to my yearly summary of books!

    Table of contents:

    • Intro - my process and tools
    • The Books - which books I recommend
    • Analysis - some introspection and goalsetting
    • Previously - links to prior years

    Note: I will use Bookshop affiliate links when available, throughout this post. You don’t have to buy from my bookshop, but if you do, I put that money back into more books.


    I use and recommend Libby for getting ebooks and audiobooks from the library. Most books I borrow digitally, but there are exceptions:

    • Books I plan to re-read
    • Deluxe or art-filled editions
    • Books I will use as a referenrce
    • Books I enjoyed and want to keep around

    For those cases, I get physical editions via Bookshop. And lest you think I don’t really do physical books: my household has 15 brimming bookshelves.

    I take copious highlights and notes, and save them to Readwise. Here’s how. Highlights and notes are especially important for me with digital books, where spacial-temporal recollection is not as easy, but spaced-repitition and note-linking can make up for it (and then some).

    I track my reading in The StoryGraph. I prefer it because not Amazon and because it incorporates some data elements other than ratings which are useful for describing and finding books. I’m hoping’s bookshelves feature continues to improve, so that I could rely on book tracking directly in my blog, as well. (Today, it doesn’t handle book search well nor let us use our own Bookshop links, but we’ll see what the future holds.)

    I keep my to-read/wishlist as a Bookshop list, for ease of sharing and gift-giving.

    The Books

    Let’s start with the recommended ones, collected in this Bookshop collection or visually:


    And here are all the books I read, individually, and in reading order (within rating):

    ⭐️ ⭐️ ⭐️ ⭐️ ⭐️ :

    • The Six Deaths of the Saint (Into Shadow #3) - Alix E. Harrow (see also)



    👎 (authors and links removed because I feel bad about even putting these in, but wanted to show the broader view):

    • Keeper of the Lost Cities (Keeper of the Lost Cities #1)
    • Tell the Machine Goodnight
    • The Prophet
    • A Calling for Charlie Barnes
    • The School for Good Mothers
    • The Garden (Into Shadow #1)

    Did you read anything I did? What’d you think?

    Based on looking at my list, is there anything you’d recommend?


    This was an mixed year for reading goals. I exceeded by book goal (55 out of 53) but missed by pages goal (15,868 out of 17,500). I’ll go for 60 books next year, but keep the 17,500 page goal.

    Similar to my normal ratio, I read 63% fiction this year:

    fiction v nonfiction

    I continue to add to my intentionality in reading, seeking a variety of voices, formats, styles, etc. With such a long list of things I’d like to read, I’m also trying to be wiser about what I should read sooner than later such as things related to health or permaculture.

    Here’s to a good year of reading!

    Previously 📚:

    🔒 A Mental Model for Cybersecurity Operating Modes

    A person in risk & security can generally be thought of as acting like one of the following:

    • Engineer
    • Analyst
    • Influencer

    Interestingly (and helpfully), this is independent of official title. You’ve probably met engineers whose main operating mode is as the advocate, or leaders who act more like high-level analysts, or ops or risk analysts who focus on building capabilities.

    Like all models, this has limitations, but it is useful. It can help you think about what’s missing, where strengths are, what structure should look like, etc.

    H/T to David Ames who introduced me to this concept, though with a different name for the third role.

    🔒 The presenter is handing out Security Buzzword Bingo cards for this next keynote. 😆

    Want to contribute to the White River Report Card?

    Being Wise with Readwise

    This post is about how I make the best of, a service that works with your notes and highlights to enhance recall, reflection, inspiration, and creation.

    If you don’t already use Readwise, I highly recommend it! You and I both get a free month with my affiliate code. As you can see, I use Readwise consistently:

    I will cover:

    • Getting Things In: making all your highlights and notes available
    • Making Highlights and Notes: tips for capture and organizing
    • Getting Things Out: making backups and data available in your notes system
    • Working with Ideas: making the most of your highlights and notes

    Getting Things In

    My first principle for Readwise is:

    Send Everything In

    In other words, I want all my reading notes and highlights to end up in Readwise. I even want to supplement my notes and highlights with those that others are making! The system grows in value as more of your important items are included, both because of your ability to search the content and because of the network effects from different notes being available together. (We’ll explore this more in Working with Ideas).

    Here are the steps:

    1. Connect All Your Services

    Once you have an account, head to the import page and turn on connections for any services you use.

    For me, that means:

    • all the places I read digital books (Kindle, Apple Books, Libby, and Kobo)
    • all the places I read things other than books (Instapaper/Pocket, Twitter, Medium, Web Highlights, Inoreader/Feedly, and the new Reader service from Readwise)

    You might use other services and want to connect other them as well. Some additional examples:

    (Side Note: Some of the connectors might even inspire you to try a new service, so Readwise has started partnerships offering discounts on services.)

    2. Import Other Highlights

    Not everything has a connector, yet. Even so, there is still probably an option to get those highlights and notes into Readwise. These options are also found on the import page.

    For physical books, I use the mobile app (iOS, Android) and its OCR to import from my notes and highlights. Another alternative is the CSV or Email import option. I always add the location or page # field, because the structure and order of the highlights is often helpful later on (for context, etc.)

    There are other non-connector imports as well, such as pdfs, Scribd, O’Reilly, Google Play Books, and “my clippings” for direct files in your Kindle.

    You might even use the API to meet your needs:

    “Our API supports creating, fetching, and updating highlights on behalf of the user.”

    3. Get Other People’s Highlights

    What if I finished a book a while ago and didn’t take highlights or notes? What if I listened to an audiobook? Maybe I just want to see other Readwise users’ highlights?

    In these cases, you can use the “Supplemental Books” feature, also found on the import page.

    Note: if you connect Goodreads in Step 1, everything you finish in Goodreads will automatically get added as a supplemental book in Readwise.

    I do not use Goodreads anymore, so when I finish a non-fiction book where I didn’t take highlights or notes, I head over to the Supplemental Books tab and add the book. If no other Readwise user has made highlights, yet, I make a note in tasks to try again later.

    In later sections, we’ll talk more about how these supplemental books are part of the ecosystem.

    WARNING: some publishers lock down how much you can highlight and export from a book. This is not a Readwise problem, but it does affect Readwise. Just in case I run up against limits, I make a habit not to make really long highlights nor to over-highlight a book. These are generally good practices, anyway, as they limit your highlights to readable sections and just the really good stuff.

    Making Highlights and Notes

    The second principle for Readwise is:

    Start Simple

    This section will includes tips for how to use more advanced highlighting and note-taking features, but you can ignore it entirely or start using the tips as they help you. You might have a finely-honed method that you don’t wan’t to disturb. That’s fine: start there. Come back here went you want to use new features or enhance your process.


    When you’ve highlighted & annotated a long document or book, you’ll automatically have all those notes available to you, whether in the collection on the web, in daily review, or in your exports. But if you’re like me, you’d like to have a bit more structure, when you are looking at the overall document highlights.

    This is where headings come in.

    Headings allow you to structure your highlights at three different heading levels. A common pattern is to call out a Part as heading level 1, a Chapter as heading level 2, and a Section as heading level 3. Then, you’ll have a nice table-of-contents and structure for your notes.

    To use this organizational structure, add a note of “.h1”, “.h2”, or “.h3” to the highlight that you want to turn into a heading. The period before the “h” tells Readwise to treat your note as a tag, not your commentary, and it then processes the highlight as a heading instead of a normal highlight.

    Here’s an example from Lean Software Development where I used heading 1 for chapters and heading 2 for agile Tools and “Try This” activities.

    Note: I generally avoid using heading 3. It is often too much. Make the choice based on your document and whether you’ll get value out of it.

    WARNING: this is one area of Readwise that has some bugs remaining. Because the header tags get applied a special way, it’s important to enter the tags accurately and in order as you work through the document. I have some books where the heading structure is messed up and it’s not something you can fix fully in the web app. When this happens, you can delete and re-synch your book or document highlights, but this is a pain if you’ve already edited (with tags, commentary, etc.) the comments within Readwise, or already returned the digital book to the library. Hopefully this is something they are fixing in in the new Reader experience.

    Want to know more about headings? See their blog post on headings if you would like a more detailed explanation.


    You already learned about a special tag: headings. There’s another special tag: concatenation.

    Have you ever found a long chunk of text but really just want parts of it? Concatenation lets you highlight that way. Use “.c1”, “.c2”, “.c3” etc. notes to build a highlight that combines them. Readwise will show ellipses between the parts in the final highlight. (Read their blog post about concatenation here)

    Normal tags are created the same way as the special ones: while highlighting, add a “.” note, followed by how you’d like to tag the highlight. For example, I use “.i” for “inbox” and “.d” for “definition”. You don’t have to use shorthand, though! Your tag can be a word (or hyphenated words), but don’t add spaces or you’ll have just completed the tag and started making a normal note.

    Tags will be visible anywhere you are reviewing the tagged highlight, such as during daily review or when reviewing the document. From the web, you can also go to tags , see your tags, and see all the highlights with that tag.

    Note: as with headings, I recommend you don’t go overboard here. It’s easy to waste a lot of time on tags you won’t use. It’s easy to add them later, so feel free to be sparing.

    Sometimes, you don’t know you want to tag something while you’re highlighting, but later you decide to in one of these situations:

    • you’re reviewing highlights from a document or your daily highlights
    • a theme has started to emerge in your highlights
    • you’re researching a topic within your notes

    That’s fine! You can easily add tags during daily review (“T” if you like keyboard shortcuts) or when reviewing a document. I do a lot of each of those bullets above. I now use “mental-model”, “health”, “coaching”, “reflection”, “security”, “attention”, “resilient”, and “curious” heavily, but often later, during review.

    Final tip on tags: tag conversion.

    Remember how I said I use “.d” for definition? Those actually show up in my tags as “definition”, because I converted (merged) the tag. From the tag view, click the ellipses on a tag and rename, and all once-and-future uses of the old tag will become the become the new tag. So while reading I enter as “.d”, but I get “definition” in my highlights and notes. It’s a nice time-saving trick.

    WARNING: I don’t know if there is a way to undo tag conversion. I don’t see one in the web interface. I’d suggest being double-sure before you go about this.

    Getting Things Out

    Ok, so you’re now an expert at making good highlights, tags, and notes, right? But maybe you have a favorite notes system, or you’re worried about your data. For either (or both) reasons, you’ll want to sync your highlights outside of Readwise.

    The third principle for Readwise, then:

    Sync Your Data

    Head to the export page. There, connect your note-taking system(s) of choice, or wherever you’d like your highlights & notes to land. I have the following enabled for various reasons:

    • Evernote
    • Obsidian
    • Roam

    …but you can add others like Notion or RemNote.

    Note: this is one of the other reasons you may not want to go overboard with tags. Once your notes are syncing into one of these systems, you may decide you want to tag within your note system instead of in Readwise. Before you make that call, make sure you understand how your system handles syncs from Readwise. I still use 10–15 tags when highlighting or in Readwise, and then use wiki-style links within my notes system to cross-reference certain topics. (More on that in Working with Ideas.)

    It’s also a good idea to backup any important data occasionally (and these highlights and notes are important, or you wouldn’t be making them!). The syncs you setup are a soft backup, but you can make a more direct one via the CSV or Markdown export, as well.

    Note: you can also export just one document as markdown, when you need it. Head to browse and from the dropdown on your document, choose “Export Highlights”.

    Another Note: At this time, we cannot export highlights from Supplemental Books. You only get your own highlights. Bummer! There are probably some very good reasons for this, though, such as not getting junk into your notes that you didn’t vet first!

    Working with Ideas

    Ok, so you have a collection of highlights and annotations and it’s backed up and available in your notes. So what? It’s no good to you if you don’t do anything with it! With that in mind, I’ll share the ways that I get the most out of what I put in.

    Daily Review

    Here’s my fourth principle for Readwise:

    Never Miss a Review

    While you’re still building the habit, you can use this common habit-building rule, instead:

    Never Miss Twice in a Row

    The Daily Review is the cornerstone of the value I receive from Readwise. Head over here to configure your review.

    Here’s my basic setup:

    • Sent every morning at 7
    • Max out (15) highlights per day
    • Blended old/new recency rate
    • Bonus highlights off (I have other good recommendation sources)
    • Quality filter off (I’d prefer to fix it)
    • “Normal” frequency for books, articles, tweets
    • Slightly-lower frequency for “supplemental books”

    You, of course, can tune these settings to suit your needs. If you’re just building the review habit, you may want to start with fewer highlights, for example, to make it easier to build the habit.

    During the daily review, I’m doing a few things:

    1. Increasing retention of key points
    2. Adding tags when I see themes emerging
    3. Cleaning up and annotating
    4. Getting inspiration
    5. Making the highlights “talk to each other”

    Retention (#1) happens naturally through the process, but I accelerate it. When I come across a challenging highlight or something that caught me by surprise, I hit the feedback button and choose “soon” or “later” instead of the default “someday”. This means I’m going to see that highlight again sooner.

    And though my overall review frequencies are balanced, I do sometimes select the dropdown on a highlight and “show this doc more often” (or less often), to tune the amount of highlights I am seeing from a certain book or article.

    I mentioned adding tags (#2) in Making Highlights and Notes. This normally happens when I’m noticing topics that I’m highlighting frequently, or which are becoming a common topic in my reading or research. I am very interested in attention and focus, so I have started tagging items related to those topics. I also read things related to health and longevity, so I have started tagging items with actionable advice. I also have two themes that are very important to me: curiosity and resilience, so I have developed tags related to those. You will come up with your own themes!

    Cleaning up and annotating (#3) can be:

    • removing bad or no-longer-useful highlights (using the “discard” button)
    • fixing highlight or note errors (it happens, especially if they are ones you put in by hand or OCR, see Getting Things In)
    • making highlights within the highlights (use double underscores around the part you want to highlight)
    • adding new commentary

    A common example would be when I don’t remember the context of a highlight, so I add a short note about what it means (perhaps after visiting the document highlights to see the surrounding highlights and structure).

    Tip: Don’t feel bad about discarding highlights, especially from Supplemental Books, where they are someone else’s highlight. Discards don’t fully go away. Your discards go into a category named as such, and can be recovered. I’ve got 1276 discards!

    Regarding inspiration (#4), some highlights will make me want to start a blog post or put a task on my planner/calendar. Let your highlights provoke you!

    The last topic, highlight-collision (#5), is perhaps the most important, and is the reason why I max out my review to 15 highlights. I’m not just reviewing 15 highlights…I’m reviewing 15 highlights together. That means great chances for serendipity. Sometimes highlights will reinforce one another. Sometimes they will be in tension. Sometimes they will interact in such a way as to spark a new idea. These are magic moments. Dig in to what you are noticing. Add notes (either in the highlight or in your own system) about their interaction. Write a blog post. Make some art. Invent something. Run with it. Feel free to tell me what you learned or created.

    If you practice zettelkasten, evergreen notes, or a related system, this moment of organized serendipity is a good time to write connecting comments or notes. I use backlicks in Obsidian to accomplish this.

    Book Review

    When I’ve completed a work of non-fiction (or even a work of fiction where I took more than a handful of highlights), I like to make sure all my notes are in order. I go back to the web view and check my structure (remember Headings?), my highlights, notes, and tags.

    This is a good way to refresh myself of everything in the book, and is a jumpstart on spaced-repetition/retention. I may add Supplemental Highlights if I want to see what others highlighted, too.

    This is also a good time to write a book review, even if it’s a short one.

    Play Favorites

    You may have noticed during your daily review, or book review, that you can mark a highlight as a favorite. Go ahead, do it!

    Sunday Daily Review collections are special, and will contain only favorites. This is a good way to keep coming back to the highlights that are very meaningful for you. This leads us to…

    Show Your Work

    You can also let people subscribe to an email with a sampling of your favorites, one or more collections of tags, some combination of these, or all your highlights. Mine is set to a weekly broadcast with a sampling from my personal favorites and reflection questions.

    But what I like even more than the subscription is the share button. When you are reviewing a highlight, hit the share arrow, and you’ll be presented with a few options to present an elegant version of your highlight, like this highlight I have tagged as “reflection”:

    I often share this way during the Sunday Favorites Daily Review (like these). I also find these shares to be a fun way to place a highlight into my notes, especially if I’m collecting a few highlights on a topic.

    Finally, if the notes system where you are highlighting your notes supports it, you can publish your highlights there, as well. All of my highlights are currently public, via Obsidian.


    You’ve hopefully picked up four principles:

    1. On input: Send Everything In
    2. On highlighting: Start Simple
    3. On output: Sync Your Data
    4. On usage: Never Miss a Review

    I hope these will help you make the most of Readwise and help you with recall, reflection, inspiration, and creation.

    This was already very long. Here are some advanced topics I didn’t cover:

    • Themed Reviews
    • Flashcards
    • Metadata
    • Document Tags
    • Reader!

    Contact me if you’d like to discuss any of these.

    🔒 Spouse: “So, is the…shell4k doing better?” 😆

    Note: the previous big deal vulnerability was Log4j or Log4Shell, the newer less-big deal was Spring4shell.

    predictably, petro lobbyists are pushing for expansion, instead of embracing the opportunities for more renewables and electrification

    letters from the White River Alliance regarding Indiana legislation affecting water:

    Week in Review 2021-12-10....err 2021-12-16

    I started writing this on Friday the 10th, but am just now posting, because…

    🔒 The Log4j issue is really bad. Security and engineering teams are scrambling to protect against attacks. The best teams started last week or weekend, but many organizations waited until Monday or later to get going. The vulnerability is once again hitting the hard problems of inventory management, 3rd-party software component management, and vendor management. I don’t think I’ve seen something this bad in 20 years of being a security practitioner. The vulnerability is easy to exploit, has the worst kind of impact (it runs the attacker’s code), and is present in many common technologies. In addition, there have been several follow-on problems identified, such as additional attacks, or weaknesses in the fixes for the attack! If you’d like a laugh instead of cry, check log4j memes.

    ⚽️ After a really great start to the Premiere League (where they were recently top of the table) and Champions League (where they are reigning champions), Chelsea are leaking goals and struggling at this point in the seasons. 3-3 vs. Zenit in the CL means they take 2nd spot (below Juventus), but are on to the round of 16 and matched up with Lille. They got a little lucky in the Leeds PL game to win 3-2, but tied 1-1 in what should have been an easy win at home against Everton.

    🛩 I recently had my 2nd business travel since “the beforetimes”. I tested when I got back and am luckily safe. I welcomed my new team members (direct and indirect reports) and honed 2022 strategy with the leaders on my team. It was good getting people together, but still feels a little strange getting back to it! In other work news, I also got the promotion I had been hoping for, bringing me to only 1 to 2 levels below my internal customers and working peers 😆. (Outside my team, I primarily work with SVPs and VPs, and am now an AVP.) Joking aside, I am thankful for the support of my leaders, who have shown trust in me and helped find funding and assistance for the important initiatives I’ve been pushing.

    📚 My spouse and I registered for a new library. To be honest, we mostly did it to have another library in Libby/Overdive, but it turns out the library is lovely, too. There’s no public funding in the town for a library and kids had to pay high fees to get access to a library in one of the neighboring towns. So, one family donated the land, funds for the building, and funds for the initial collection of materials. The library stays afloat with donations and a modest yearly fee for patrons. We were charmed by the library, especially their themed puzzle 🧩 collection that you can borrow like books!

    🌟🎄 I’m looking forward to a break, soon. We’ll be hosting my spouse’s side of the family, again. All (who can be) are vaccinated (and boosted) and we will be testing before we get together. We have folks with compromised immune systems and/or who are too young to be vaccinated, but we are being safe for each other. We’re very much looking forward to time together, as there has been so little of that in the last two years.

Older Posts →