The end of 17070 and serious consequences

I just read a very concerning article on BBC https://www.bbc.co.uk/news/articles/ckgknm8xrgpo

TL;DR BT crossed wires and so a criminal investigation led to wrong address causing a lot of issues for innocent parties.

Police

The decision is the police did nothing wrong.

I would argue police acting solely on IP address information is negligent of the police. So I disagree with the finding. There are a lot of reasons an IP may not identify a person - not least of which is "bill payer" is not "user", and also deliberately or accidentally open WiFI, and tor proxy, and hacked routers, and so on and so on. And, of course, crossed lines happen, so IP is never definitive. They should have more evidence before taking such drastic action, in my opinion. It is almost akin to reading the "return address" on an envelope and assuming it is genuine and raiding someone as a result.

The simplest test they could have done, if going as far as visiting the property, is checking the IP address on their Internet access matches the evidence.

Update: just to be clear, we (AAISP) have a policy in response to any request from police (or anyone else) under the Investigatory Powers Act, which we would expect to almost always just be a request to identify bill payer/address, to respond (as required) but to always include a very clear statement that you absolutely cannot rely on an IP or calling number as indicating the bill payer, or even someone at the address, instigated the traffic/calls. We would aim to try to educate police in the reply. We could perhaps even get some for numbers/IPs that are not ours, and would reply accordingly. To say we have had no requests would be implausible, but ironically the legal issues means we cannot say if we have had requests or not, which is, itself, somewhat crazy.

Crossed lines

But let's consider how crossed lines happen - it is simple, and literally crossed lines where one pair of wires is on wrong port on the DP.

So why was a crossed line not identified?

17070

BT engineer calling 17070

It used to be pretty easy to tell a line is crossed, pick up the phone and call 17070 and it reads your number. Also calls cost, and a wrong itemised bill arriving is a clue that your line is not being used by you.

However with broadband and fixed costs, and so on, it is very easy for two lines to have working broadband on the same ISP, that works based on circuit and needs no login (or router auto configures based on circuit when first connected). And with dynamic or CGNAT you cannot tell you have the wrong IP even.

So customers cannot tell, but this is actually a bigger issue for BT.

The telephone side is gone, and now it is broadband only.

We had a case at the pub with two lines and one was jumped wrong, and BT had no means to tell which line was which now there is no dial tone on the line. As an ISP on site (rare) I was able to confirm which physical line went off when unplugged. But BT need to be able to identify a line - how are they not screaming at management about this now?

So what instead?

So what BT need is a way to identify lines now. And actually it is not as hard as it sounds.

The way broadband works is using PPPoE over DSL. The same is true for FTTP now (PPPoE Ethernet on ONT).

PPPoE has a handy identifier which is sent before any sort of login. Without knowing the ISP or login details a hand held test device for DSL or FTTP working could show the ID it sees.

These IDs are not very exciting at present - my DSL here has acc-aln2.ag

But it could not be hard to make that a circuit ID, or a complete port ID of some sort that the BT engineer can identify. I mean it would be ideal if the full circuit ID in BT, but even just cab27-port43 it would help the BT engineer a lot and avoid crossed lines and a range of other errors.

BT could even expect other ISPs that use BT wiring to have a similar scheme, why not?

It seems to me this should be a standard for such services, and BT engineers test kit should be able to show it. This are only going to get worse as more and more phone lines are phased out.

So I wonder if BT will consider this?

Oh, Amazon, you are crazy

They have lost a shipment from us, it seems, although getting a straight answer is not easy. They got it, but no more. What is annoying is I am 99% sure it showed the items as "found" and then changed to "0 found" - I may be wrong.

They state the shipment is eligible for investigation from 12th Oct, but no link to do that and opening tickets they kept saying it is not yet eligible yet. Latest was again insisting I check what the shipping page says and wait for that date. It still says 12th Oct. So I, er, checked the shipping page, waited (it is 13th already) for 12th to pass, and well, got back to them. What the fuck?

So finally a chat and they are talking of a claim - well I want to know if they have lost them first, but they would not answer and closed chat.

They then said for a claim they need loads of stuff including our purchase order from manufacturer, picking list, invoice, manufacture stamp or signature, all sorts.

They seem unable to cope with the fact that we are the manufacturer! So we have no shipping details of this product to us, or purchase order, or any such stuff.

They want a "picking list" for sending to Amazon. Well, I did not make one. But it seems they are happy for me to now make one! Well only if it is dated before we shipped, so I had to make one. Then it needs to be signed, FFS, so print, sign, and scan! Why! How is this a sane process?

I pointed out if I do not meet their criteria for a claim, I bet I meet the criteria of a county court.

Now, in next chat they are saying they will investigate. But only if they have documents for a claim.

At one point they say they need "Shipment or purchase order ID", after some to and fro, they want an Amazon shipping reference number. I was confused, how is that related to a "purchase order ID"? He sent me a screen shot. It is an Amazon reference, it seems.

So, err, I replied, "OK the Shipment or purchase order ID is 3IC25SUG"... Done... I mean, wow!

I had to make the "packing slip" at least three times to add more on to it. Apparently simply stating things on the chat does not count!

And then they want proof of delivery, so screen shot of the Amazon shipping page showing the tracking and receipt of the item getting to Amazon, from Royal Mail and Amazon point of view.

Bear in mind, all of this is in the context of a ticket about a specific shipment - such that he could get that screenshot to send me. So he has all of this information visible to him. I am sorry but this is really FUCKING STUPID, in so many ways.

However, lesson learned, next shipment I'll take pictures before sealing boxes. Maybe even a video with taping up and applying RM postage label.

Update: They agree lost, and agree to compensate, but some made up value that is not even the cost of the bare circuit boards!

Update: And I now feel this is even more special to be honest...

I sent a copy of the invoice for the circuit boards. Their response (though they did not actually email, just changed status on ticketing) is they cannot verify that this is for the item. The invoice lists the PCB file AUDIO_1. Well, it would. No reason for it to relate to the product listing name. They really do not cope with the concept of us being manufacturer.

The work around, suggested by Amazon agent, is change the listing to have AUDIO_1 in the title so it matches. Which means they are basically trusting me to say it is AUDIO_1, which is what I said in the first place when sending the invoice. But they may trust me if I change the name on the product title on their system! How is that remotely sane!!!

Update: They say they have accepted my evidence, which shows how much for the PCB, yay. They have revised the amount they are reimbursing to an amount that is around £3 LESS than the cost of the PCB. They keep referring to their "policy", one that clearly states that they will reimburse what it costs (not some random amount that is less). They won't explain their maths.

Update: They now show all the missing items as "located", yay, but oddly not in stock for sale or even "inbound".

Update: Apparently stating "Units located" is "not incorrect"!!!

LED Strips

There a lot of options for colour LED strips.

I am talking pretty much entirely about 5x5mm individually addressable full colour LED modules on a 10mm wide flexible PCB with leads at each end. But even being that specific there are a lot of choices!

These things basically...

Covering/backing

Start with something simple - these strips often have options.

• Black or white strip supporting the LEDs.
• A domed flexible clear covering that is generally pretty waterproof.
• A rectangular sleeve enclosing the string, which is more waterproof.

This is really a simple choice. I have some on a door frame which are the domed covering, because the strip or chips would snag otherwise. I have some on a shelf (image above) with no covering, as out off reach. You need to consider this if putting in some sort of diffuser, e.g. an aluminium strip with plastic cover - where no covering in the strip itself helps much under the diffuser. A diffuser is usually a good idea.

Now, some do come in a diffuse housing, which can be a good compromise. Bear in mind that any covering or enclosure makes cutting to length and joining harder. The simplest is the bare strip with LEDs on it (and the pads between them) allowing easily soldered joints to another strip. There are clips you can get but I do not recommend them - soldier it.

Note - the adhesive backing is pretty universally crap, not bad on aluminium, but on wood, etc, not good. I'd think about some nice 3M tape.

Density

Again a pretty simple one - how close the LEDs are - and that varies.

1. Close together is great for sheer amount of light, and using inside any sort of diffuser strip as you can hide that there are individual LEDs.
2. Close together means more LEDs and so more power needed.
3. Close together adds to the cost.

Voltage

This is a bit more complex. The main choices are 5V, 12V or 24V. I am generally working towards 12V these days (with per pixel control on a WS2815).

1. 5V can mean notable voltage drop on long runs, meaning power feed in at extra points. 12V can run longer and typically the modules can work on much less than the full 12V if they are per pixel 12V.
2. 12V and 24V can be multiple pixels on one controller, e.g. 3 RGB pixels on one controller in a row are controlled together as the 12V is split over them. This is pretty shit, to be honest. It is not always the case, and WS2815 seem to be ideal with single 12V working pixels separately addressable.
3. Higher voltage is lower current and can be a smaller power supply and less heavy duty power leads.

Current

This is one of the big issues, and not as simple as it looks - the LEDs do not use a lot of power, but there are a lot of them. Higher voltage means you can work with lower current. But you have to be careful, even with 5V DC levels, if you have hundreds of amps available - that can be nasty stuff (not that is unlikely to electrocute you, but can burn and melt stuff - a short at that power can melt copper wires).

The other issue, apart from not wanting to handle large currents (for which higher voltages help) is the power supply itself. A high current power supply is bulky and expensive.

A big challenge is working it out - and this can easily go wrong. There are guides and tools and data sheets. But you can easily find you are massively over specifying your requirements. As with any modern electronics, LEDs are getting more efficient and so lower power - the guides for 10 years ago do not apply now.

You also have the option of not lighting all LEDs full white all the time. So depends what you want. In practice you probably do want almost any system to work at all LEDs on full - but not always!

In short, my recommendation is to test the strips you are using, get a current meter, a strip and set to full power all on. Measure it. Note if can change on temperature, so leave a little overhead. But that tells you what you need.

Bear in mind voltage drop is also a thing - all white on a long strip could have more than enough current from the supply but still fade and lose colours at the end due to voltage drop - sometimes you need extra power feed in along the strip(s) to fix that. This is were 12V can help if the pixels can work down to half that (as seems the case) you can tolerate a lot of voltage drop.

I have a fence where along side the chain of strips I have a thick copper power pair, which taps in at each strip join. That works a treat as the thick copper power cable is low resistance and allows the current to get to the whole strip. The same power supply, which clearly has enough power, could not work the whole chain from just one end as the voltage drop would kill it after about the second strip. Bear in mind, whilst the data has to connect at one end, the power could always connect in the middle of your set up.

Never forget - power ends up as heat and has to go somewhere.

Colour options

There are two main colour options.

• RGB - the simplest type - full colour using Red, Green, and Blue
• RGBW - an extra 4th White LED.

There are some RGBWW with two different shades of white as well, but rare.

the main advantage of RGBW is that the extra white LED is usually very bright (and often available in a specific shades of white), but is also one LED, using less power than combining RGB to make white. Yes you can go overkill and try RGB and W for even more bright and even more power usage.

The general idea is if the strip it to be functional lighting as well as pretty effects, RGBW helps allowing the white to be lighting. You also often want to consider higher density of LEDs in such cases.

Chip type

There are a few chip types, and many odd chips that are compatible. There seem to be some subtle differences in the data sheets but in practice they all work the same way.

• WS2812 is the main one, simple RGB 5V
• SK6812 is another one, typically the order of colours is different in the data sent
• WS2815 is the one that does RGB but using 12V
• There are new WS2815 that are 12V and RGBW

Timing

Rarely an issue, but worth considering - each pixel on a strip takes time. So the maximum update rate of a whole strip depends how many pixels. Each bit is approx 1us long, so each colour is 8, and each RGB is 24us. That means 100 RGB takes 2400us or 2.4ms. RGBW is 4 colours, so takes longer. As you can see, once you have hundreds of pixels the refresh rate can come down and start to be more noticeable. The answer is more separate strips working in parallel if your controller can do that. I'm practice, it is rare for many hundreds of pixels and rare that the refresh rate matters that much. But bear in mind on large installations. 

Duff pixels

One of the reasons to look at the chip type is the WS2815 has a backup data line. The way this works is the data daisy chains from one module to another - any break, or any failed module means the whole of the rest of the strip dies. The WS2815 has a cunning plan - a backup data that goes directly on to the next pixel. The idea is that if a module fails, the next LED picks up the backup line, and delays one pixel, meaning it works and so does the rest of the strip. Only if two adjacent modules fail does the rest of the strip die. This is an excellent innovation, and I definitely recommend it.

Recommendation

The recommendation is simple...

• For density - decide what you need.
• For covering and strip PCB colour - decide what you need.
• Recommend WS2815 RGBW 12V strips - only now available in 2025.

The reasons are simple.

• 12V working is less current, so smaller power supply.
• 12V allows more voltage drop, so longer strips just work.
• WS2815 backup data allows a duff pixel.
• RGBW allows more powerful white at lower power.

(I have some of these latest strips on order).

Update:

I have the new WS2815 12V strips. 96 LED/m. They state 23W/m (so around 2A/m), but tests are fun.

I usually expect each LED (R/G/B/W) to use power, so red is half yellow and a third of RGB White, but same as W White. But now.

Measuring a 100 LED test gave me roughly 1A for red or green or blue, but also 1A for yellow, or cyan, or magenta, and even 1A for RGB white, and 1A for W white. I only got more (1.75A) for RGB+W double white.

This is interesting. I assume they balance the currency for multiple LEDs somehow, which sort of makes sense - you do not want yellow twice as bright as red or green really. It makes things simple as well.

Magic LEDs

There is a company called Xinglight that make some LEDs that I use. I call them magic LEDs because they are really so useful.

They cost 2p or less each, but they are RGB, so full colour LEDs. Now bear in mind some other single colour LEDs I use on some boards are more like 5p each, these are cheap.

So what makes them magic apart from they price?

• They work from 3.3V (datasheet says 3.5V min, but my tests, room temp, 3.3V just works)
• No need for extra series resistor as normally needed on an LED - no need for any extra component.
• Uses WS2812 serial coding so one can have one or more of these on a single GPIO pin.
• Full colour
• Tiny

So if I want a simple status LED on a board, this is a tiny, 1x1mm component on a single GPIO on the 3.3V supply, and just works. Yes, it is more complex than a simple on/off GPIO, but in some ways that is better is it cannot be on accidentally - it needs the correct code to send the correct sequence to light it up. If this status LED lights up the code is running, meaning it all works, boot loader, signature check on code, code running.

The small ones are 1x1mm, and are really so small. I have used for years on many designs, but it is time for a change.

Why?

These tiny 1x1mm LEDs can snag and come off the PCB very easily.

So what is the alternative? Well, they do a 1.6mm x 1.5mm version and a 2x2mm version.

My current plan is changing all my designs to the SMD1615 (1.6mm x 1.5mm) version.

It has castellated pads, so some chance of solder coming up the sides, and is not that much bigger really.

I usually pack the 1x1mm LEDs at 45 degrees, space at 2x2mm, and can do that both ways, just. The new LEDs can do 2mm spacing straight and neatly. They can fit closer, just, but not both ways if I want to make a grid.

So for single status LED - no brainer, takes about the same space, and easier as a track can run under it.

For a row of LEDs at 2mm spacing, perfect.

Indeed, almost all of my designs work, even the coaster which is 124 LEDs in rings!

Power saving on hot tub, and what not to do

I have posted much on the hot tub. It came with the house, and has been a huge lesson.

Hourly check, some heating, and 13:00 jets

I have also posted how it goes off, and how lately it is a lot better, and I think I finally have the answer.

So this is posted as a word of warning.

Saving power

Something I did early on was put the hot tub on a timer. On during day so I could use it, and on from 2 to 5am to use cheap electricity to top up. The logic of this saving time heating, vs constantly on and allowing thermostat to go on/off, is not clear, but the main saving was that it used cheap electricity at night for a big chunk of the daily usage. So even if heating as long, it was heating cheaper.

Initially this still meant a lot of use, but I have since insulated the internals (lots of pipes with no insulation in there), and moved to a heat pump (less time on, and less power used when on). But still on a timer.

Symtoms

The key problem was that every couple of months it would go off. Start going cloudy, dirty, and getting pH right was almost impossible. No, changing filter alone did not help. So I would empty, and refill, at some cost to reheat a whole tub. Some people were understandably puzzled I had this issue. I was resigned to it being just how it worked.

Obviously I had to add water due to evaporation, ensure chlorine and algicide, and change filter occasionally. But it would still go off after a few months regardless.

What was less obvious is the occasional use by someone that is not me. I would lie there and read, and it would last a few months with no issue. But some times, someone else (relative) would use. On one occasion I berated someone for leaving the tub filthy - so much so I emptied and refilled. It was dirty and cloudy after their one use. I hereby apologise, as I think not their fault.

One clue was Alice, my granddaughter, who uses it when she is here, and usually fine. But on one occasion, after the tub have been a couple months since a refill, she used it, with me as well, and she had a shower first, and I could see she had not dragged in dirt from the garden on her feet, and it was quite a short session. But after use, it was cloudy and dirty. How?

Using a timer

I believe I have solved it, and it is totally silly. Be warned!

The hot tub has water jets, as many do. And these have a lot of pipes (one reason I insulated them all). I don't use the jets when sat reading, but Alice likes them, and so do others.

The hot tub is not stupid, it runs all the water jets for a few minutes every day. In the early days this did surprise us when using it. It seems to do in the afternoon and not sure I can control when. It also has a circulation pump I can control for twice a day for the main tub.

But it has no persistent clock, so the timer meant that twice a day it started as midnight. And was not getting to what it considered afternoon. So did not run the jets, at all, ever!!!

You can imagine the effect, water in lots of pipes, never moving. Even with the chlorine and algicide, and changing filter, this did not help that water stagnating.

Even with no use of the water jets, after a few months it went off, but using the jets would just circulate that all and leave the tub dirty and cloudy. This explained why Alice, and others, using it (with water jets) made it dirty.

Not using a timer

The good news is that now I am not using a timer, it is not going off at all. Yes, I need to change the filter. If I leave it without topping up the chlorine, etc, it may go a tad cloudy, but immediately clear up when I top up (this did not work before). It just says clean, and clear, and nice.

As for cost, well, using heat pump and having battery, and the extra insulation, mean it uses way less power now, and when it does is often from battery that charged from solar, or cheap night electricity. So running 24/7 is nothing like the issue it was when I first started with it.

The house uses way more than average domestic, but even so, several months over the summer we had a negative electricity cost, even with a hot tub on 24/7.

So using a timer on your hot tub may be bad, be warned!

Working with a factory (ESP flasher board)

This is an interesting one for some people I am sure.

We (A&A) do work with (UK) factories for some of our products, and it is interesting, but we get to visit the factory and see that we are happy with how they work, and we provide ATE kit. This is Automated Test Equipment. It will flash code on to the circuit board, and run self tests. In some cases they have a number of Ethernet leads to a test switch as well so it can self test all the Ethernet ports as part of the process.

But as you may know, I get lot of small dev boards from JLC in China. These are great, but they had a few issues with placement and soldering on the main ESP32 module lately.

The solution they propose is that I order some boards with a "functional test". This means I need to make an ATE for them, and send to China. They are going to do the first batch of boards with the functional test for no extra cost, which is nice, and I am going to try and get them to bag and label as well rather than their usual foam and bubblewrap annoyance. Fingers crossed that they can do that and that it is a sane price compared to my doing it. We will see.

The big reason for this is that they don't ship the failed boards, they debug them and fix them, so I don't end up with duff boards for which I don't have the equipment or eyesight to fix. The downside is this normally has a small extra cost.

But this has meant making a Flasher board. A device that can flash code on to one of my dev boards, and report clearly a self test pass or fail. The result is this. It is useful outside of the factory, maybe flashing Tasmota on Shelly boards, or just flashing boards I get in smaller quantities here. It is neater than using command line on my computer and has nice visual feedback on progress.

USB power, and a 6 pin RJ12 or USB-A connector. In this case the 6 pin RJ12 is to a TC2030 connector which plugs in to my boards.

This trick, and a lot of iterations in the code this week, has been to make it as idiot proof as possible.

It flashes from SD card, and can update image files over the internet automatically. It allows up to 10 different flash manifests by button press. It flashes multiple files in different places. It runs the code and waits for ATE: PASS or ATE: FAIL from the device. It provides a loop back link on the TC2030 even so my boards can do a loop back test on the final connection pins as part of their self test.

I have made a video to show the factory - I really hope this is as idiot proof as I hope.

One of those days (Amazon)

I am not looking forward to another lengthy and pointless discussion with Amazon... They really are not fun.

What now?

UPDATE: SOMEONE AT AMAZON FINALLY UNDERSTOOD. PICK ME UP OFF THE FLOOR NOW...

I have listings for things like this...

It is described as "with 3 pin WAGO". The fact it has a WAGO connector is useful, as it is a lot better (in my view) that any sort of plug/socket arrangement or screw terminals, and takes less space as well. It is ideal for this sort of thing (LED strip controller).

Amazon seem to feel that using "WAGO", a trademark name, needs a letter of authorisation.

Thankfully I know someone who is good at pointing me to legislation, and, as I expected "Nothing in the preceding provisions of this section shall be construed as preventing the use of a registered trade mark by any person for the purpose of identifying goods or services as those of the proprietor or a licensee".

So, yes, I can describe the 3 pin WAGO connector as a WAGO connector. I have tweaked to be clear, changing "with 3 pin WAGO" to "with 3 pin WAGO connector", just to be extra clear. And quoted the Trade Marks Act 1994 section 10(6) to Amazon.

I do not hold much hope that this will be a simple "OK, that's fine". But they may yet surprise me. We'll see.

Update: Yep, stock replies, this is going to be a long one.

I've also added this image to the listings :-)

Finally Amazon

It seems only fair to say that Amazon have finally recognised a brand, and so we can now list products once again.

I am not sure we have resolved EAN re-use yet, but at least we can list new products, and have listed a Faikin S21 cable and case.

So well done, even if it took months, and a blog post, to get it done.

Maybe I'll try and get some of our other trademarks added!

Nice neighbourhood

I live in a nice neighbourhood. Really... Well, I thought I did.

After 4 years here this is the first time someone has literally taken a parcel off my doorstep!

Criminal video

To say I am shocked is an understatement.

I never imagined anyone would do this.

I am, however, impressed that the local police has a web page for crime reporting and it seems mostly sane!

Also impressed that they have called me for the raw video so they can try facial recognition.

QR abuse...

I'm known for QR code stuff, and my library, but I have done some abuse of them for fun - I did round pixels rather than rectangular, for example.

The latest abuse was inspired by https://mathstodon.xyz/@divbyzero

His idea was a Truchet style...

I have done some more work on the idea. For a start I did not like the harsh edges and cut circles, so made it slightly different. I also had concerns on the circle hitting the targets as this may cause timing issues perhaps.

Looks good. But I also tried larger and it had trouble reading at an angle, and I think because I had Truchet coded the alignment marks needed on larger codes.

So I made them rectangular, e.g. same code as above with alignment mark intact.

Now it reads better at an angle. (tested on iPhone camera and an app). This allows the 45 degree shown at the top of this blog post.

Do not blame me if you now have a migraine, please.

Oh, and if you are interested, this is created as a proper QR code, but with a grid of black/white circles on top... I have made a video https://www.youtube.com/shorts/9ufN2cpsbPA

Microwave plates

We have many plates.

They work as plates.

They are fine in the microwave.

But not this fucking plate.

I have blisters on my fingers from picking it up. Food was not cooked - but plate was. Still hurts like hell. 

What the fuck?!?

Stupid user interfaces

My shoes are getting a bit worn. They have lasted well. It was a big change some years ago when I realised I needed thick socks and shoes several sizes bigger - before which I was plagued with pain in my feet.

The shows I have now are indeed the ones that caused me to trip and break things! 

So get a new pair, and having shows that work, and are comfortable, I want to get the same.

Why the hell can you not get the same thing?!

Anyway, similar sounding ones, hiking shoes as it happens, but wide and size 13½, so yay.

I click Apple Pay - as that is always very quick and simple.

But no! I get told address incomplete and apparently it wants "Phonetic First Name" and "Phonetic Last Name".

What the hell is a phonetic name?

I don't have time for this, so I cancel and click "Add to basket".

I go to basket and click to pay and, well it is expensive, but I am am not too surprised really, but even then, seems a lot. So it has an "order summary", and that shows the shows and the price.

Note, no need for phonetic anything this time.

Oh fuck it - I can't bet arsed - if they fit as well as the ones I have now and last years as these have, not really an issue.

It says OK, and that is 2 pairs of shoes!

WTF?!?

• I did not order two
• I clicked "add to basket" exactly once
• The order summary did not show a quantity

Bloody stupid ordering page.

But what he hell, if they fit, then next time I will have shoes ready. I was pondering if I find shoes that fit well why not order 10 pairs so I have shoes to last probably the rest of my life, so two pairs is not really an issue.

Tindie vs Amazon

Amazon have been an interesting place to sell, and have sold quite a few things. But oddly the main thing that sells is the Faikin boards. I don't think my other products are not sellable, indeed, I have had direct sales to local A&A customers for a load of other projects, just not so much on Amazon. I generally have a policy of Tindie £ price less 10% for direct sales to A&A customers.

Amazon are making EU sales simple - Amazon buy from us and sell in EU so they sort local VAT. With Tindie the recipient gets a VAT bill on import, sorry.

I started selling on Tindie as well some time ago, and oddly the same is true - most sales are the Faikin. The main reason for listing on Tindie as well was to cover countries Amazon do not do. Well, that is how it started, but now it seems we are selling to people in EU where Amazon do sell. The main reason looks like the extras (a cable, and 3D resin case). These are extremely easy to list on Tindie, and provide a simple up-sell on the original product. They are only a few $ extra but sell well.

Amazon, on the other hand, do not seem to have an easy way to add options or link products that I can see. I will ask for help, though any interaction with seller support needs a deep breath and a lot of patience. But at present I still cannot even list a product - Amazon are actively making it impossible for me to list things, in spite of reassurances. They are insisting I am on the brand registry (something I have tried three times), and they are taking forever to say yes or no. It is odd, it is a simple thing - do I have a trademark? Well yes, there is it with my name on UK trademark web site. How does it take more than a few minutes?!

Well, being able to list the cables and case clearly is helping as Tindie sales are creeping up, and I think this month is the first month that net pay out from Tindie is more than Amazon. That is a milestone I feel.

3D resin printed case, snap together

http://tindie.uk/ if you are interested.

Scammers

OK, not too many details, sorry. I mean privacy and shit, and remote tiny tiny chance not a scam, LOL

We are always aware of scammers, and very occasionally we fall foul of them, but we are always working on improving processes and checks.

If, somehow, this is not a scam, then sorry - but a story of how not to look like a scam.

Because of a recent scam (and you have to love the gall of the guy calling up to complain his number does not work and he cannot log in) we have been extra vigilant and are all looking closely at an order that came in today.

As I say, not too many details, sorry.

So someone orders a telephone number, and we ask for payment up front. This is normal as we can only get close to checking an order is genuine by leveraging the UK banking system to get someone to send us money, even if only £1. But they refuse to send with order, though eventually, after hassling, they send payment via Wise (Both Wise and Revolut are listed on our web site as don't send money from them as we have no way to verify or refund).

So they then provide bank details for DD, and a new (company) name, and we check it matches bank details, but really no way to check it is actually them.

So what next? Well check more - this has magically changed from an individual to a company. But not a UK company. Not something we can check in any way.

Maybe check address...

Well, street view is cool, and this is it. This is not close to the company name. Maybe they work from the flat? But that would be [number]A or some such, surely.

So, really, if you are in fact running a non UK company by the name you say, from a flat over a Chinese Restaurant in Belfast, but cannot send any payment from a UK bank account but can quote one that matches your stated company name, well, sorry, we may be at the point of saying no.

And basically, we can say no. We can say we do not want your business.

I am really sorry if that really is you living over that Chinese. Get a UK bank account from which you can send money, and we can talk.

To be clear, I started my business decades ago from a house in Bracknell, and that was registered office address. But it was registered office address, and could be checked, and I could send money from a UK bank account matching my company name. So yes, a new business, and a small business, no problem. We do not want to discriminate. But scammers can piss off, sorry.

That is not how import tariffs work!

It seems Trump has started charging tariffs on small packages now, and as US does not have capacity to handle collecting the tariffs, so is expecting tariffs collected at source!

That really is not how it works. But...

It sounds like Royal Mail are going to do a pre-paid tariff option (I am amazed they are bothering). Sadly this probably means I'll end up creating a load of Tindie carriage rates to US for each tariff amount, as I don't think Tindie do a shipping rate that includes a percentage of goods price (maybe they will - I have asked them).

Just to be 100% clear to anyone in the USA who is confused, this means YOU ARE STILL PAYING THE TARIFF, it just becomes part of the shipping cost to the USA.

I feel sorry for RM trying to keep up with the changes, and we all feel sorry for people living in the USA.

https://www.royalmail.com/usapersonalupdates

First resin print failure

It had to happen, for some reason a print did not release.

This is another area where FDM and resin are very different. With FDM it keeps going and you end up with a lot of spaghetti and goo. With resin the print keeps moving up but the failed layer stays on the release film, and just gets re-cured as the print go - you end up with one aggregate layer.

So, poor out the resin (need funnel and filter) in to a bottle. Remove stuck layer, that was easy. And ready to go.

Well, not quite, for some reason it kept saying foreign material detected. I cleaned out the tray, both sides, and started again and OK. In fact, it seems once can remove failed print layer with a fingernail (in a glove) without pouring out resin even.

I have noticed a scratch on the film though, so have more coming and will have he fun of replacing the file. That may be a job for tomorrow.

I have no idea why it did not release. The print was the same as previous.

Update: sorted release film, seemed good, but had another failure - which highlights a feature of resin. With FDM a failed item would wreck the whole print, the spaghetti sticks to the nozzle, and you end up with a total failed print. With resin, one can have a partial failure, like this.

Prototype 3D

This is why I got the printer...

One of the challenges with any engineering is that no matter how much to check the design, some issue are only noticed when you finally make the actual item, and have it in your hands. This is even more true for 3D models.

I can order 3D prints from China, with a turnaround of around a week. I could print designs on my FDM printer, but not the same - especially small details like the interlocking lips on the case designs (those on the right of the image are for a Faikin). The precision needed for these is not possible on FDM.

But even simple things can catch out out. The white 1 gang back box cover on the left took a week, and on arrival I see the problems - not just the square corners that do not match the back box I have, positioning nipples in the ring are wrong so the back does not lock in the right place, and the back of the ring is 0.5mm thinner which shows on the actual print. Now I can prototype I can test with a turn around of half an hour. I can get the designs right, and then order some from China. I have white resin coming soon as well.

What is fun is that having spotted the errors in the white 1 gang plate, I fixed the design, and printed a prototype for this post. I have just checked and my fix is not correct - I see why now, and have another fix to prototype.

As you can see this saves a lot of time, and some money.

Getting the hang of it (3D resin)

I am getting the hang of it. I am sticking with the washer washable resin for now. It will be an extra step of messy to use the standard resin, and I don't have any spray bottles of isopropyl alcohol left at the moment.

The Mercury washing/curing machine was somehow jamming the stirrer, which is why it did not seem to work. It is OK now, and does a good job cleaning - which makes it much easier. It also seems I can clean with isopropyl alcohol, which dries quickly before curing and will be the same for standard resin.

I did manage to spill resin all over the machine, which was annoying, and some is still leaking out of the bottom days later! I am, however, very reluctant to dismantle it. It is working fine.

I have the air purifier now, which links in to the back of the printer with a hose, and keeps the odour down. Again, standard resin may be a different matter.

So far the printing side is click and print with no problems. The model supports are indeed a lot simpler than for FDM - just needing the smallest contact. Basically it looks like bridging is much cleaner on resin printing just needing an anchor each end where as on FDM the bridge will sag. With resin it is upside-down.

The detail is impressive. The fact that the resolution of FDM is the same as resin hides the ability for resin to produce detail that is impossible for FDM. The extruded filament on FDM has a shape and per layer texture and minimum size that make the detail impossible. The teeth on this model highlight this nicely.

Moving from FDM to resin 3D

I have done 3D printing for a long time, since the days of 3D printers being kits and burning out stepper motor drivers.

My latest 3D printer was Lulzbot Workhorse, and it is pretty good. The Bamboo ones are, as I understand it, way more impressive than that even.

But this is FDM - using reels of filament, melted and deposited. It works well. But there is another whole 3D printing world with resin printing.

My new printer is an Elegoo Saturn 4 Ultra 16K - a resin printer.

Print size

Downside number 1 is the print size, way smaller. FDM can do all sorts of large sizes, my Lulzbot is 279x279x284mm which is quite big.

The resin printer is 211.68 × 118.37 × 220 mm. The reason is the print bed has an LCD or some such that prints a layer at a time. Where as the FDM has X/Y/Z motors and is limited only by physical size. Bigger LCDs are expensive. Longer bits of metal to make a larger FDM printer are less so. 

Resolution

Upside number 1 is resolution, and this is where it gets crazy. FDM is good, but resin printers are crazy. For Z axis the Lulzbot can go down to 50µm, but the Elegoo starts at that, and can, AFAIK go down to 20µm or perhaps lower. As for X/Y, both do well, with Lulzbot down to 10µm, but the filament is a 0.5mm (500µm) nozzle. The resin can print down to pixel at 14x19µm.

The result is resin printing sharp points and groves, and features really well where FDM is 0.5mm nozzle limited, and printing with way lower layer size. This allows sharp and exact features for resin printing.

Also the print is per layer textured, the layer has a bulge in centre of filament track. Not so with resin. Vertically resin is smooth and clean. So even at same 50µm layer, resin printing is way cleaner.

Level surfaces

Another difference I was amazed to see for resin was the top edge flat surface of a print was level, exactly level, I mean shiny level and smooth. FDM has ridges and texture. The bottom not so different as both print against a base plate and tend to be as smooth as that plate.

Levelling for the start of print is important and the resin printer seems better.

Print speed

This is more of an interesting one - FDM prints depend on time to trace the print layer by layer. So more detail in any layer takes longer. Adding support takes longer.

With resin a layer takes a number of seconds, end of story - no matter what.

So a biggie is if I have a small thing to print, for FDM, if I print 5 (assuming they fit on build area) is 5x longer, or worse. For resin it is same time as same height. Uses more resin but not more time.

Similarly the complexity of a design, the detail, the supports, all matter for FDM print time, but no issue for resin.

All that matters for resin is height and layer thickness. I.e. how many layers. It is a very different way to consider complexity.

Smell

The resin printing has a smell, but very minor. I have an air filter on order, but to be honest I am not sure I need that.

Sound

Resin printing is way quieter. I like this. Really way better.

Sticky

With FDM, print finish, take off bed, done.

With resin, messier. I am working on the best way to handle this, but you remove print, it drips, take to tub for cleaning (or maybe tap for water cleaned resin), put in curing for a few minutes, remove from bed. It is more work, and more chance of stuff dripping. More chance of "mess".

Changing material means pouring resin back from tray, cleaning and new resin, maybe changing fluid for cleaning (water/alcohol), way more hassle than a filament change on FDM.

So yes, a bit more, but working on it - not sure it is a lot more hassle in the long run. The results are amazing.

Prototype

The main reason for this is prototype designs - I can order bulk resin prints from China, but they take a week. This allows way quicker design refining before ordering, and quick one-off prints.

That alone makes it worthwhile.

Interesting new scam "worry free purchase"

Ordered something online and this is on they list this...

It has a delete icon, but do it, and it re-appears.

Update: They credited the £11.99 - yay!

Seems a third party service.

Seems mandatory.

So ordered the goods, and then emailed (seller, and supplier of 3rd party service) and said under various UK distance selling directives I wish to cancel the "worry-free purchase" service as I am more than happy with my purchase to be covered by UK statutory provisions, which seem to cover all they cover on that service.

We'll see if I get a refund or I have to claw back on card.

Extra irony, their "worry-free" purchase service is causing me "worry" I would not have on any normal purchase.

OK this has worried me...

NFC reader and alarm/door entry system

A long time ago I made a door entry and alarm system. Actually my first was approx 1989 using a mag head from a Sony walkman on a block of wood on the door and a wire wrap 6502. My latest attempt a few years ago is a lot more sophisticated.

It is good, indeed, I would say it is very good. It has a lot of off line working built in but backed by internet management/control system, so designed for power and internet failure, for hours, or even days.

The NFC door control uses AES on DESFire cards, so no plain text even on RF, and challenge both ways, so super secure. It even has different keys for each card. But it scales to any number of cards, with different access levels encoded in the card so as to work off line if needed (for a configurable time).

Like I say, it is good, and we use it, and a hack spare uses it (maybe two) and several small offices.

But it is tricky to sell.

Insurance and alarm companies have stuff tied up

Perhaps the biggest issue is that insurance companies and alarm companies have some industry standards and something of a private club. Yes, we could join, I am sure, but only if I wanted to be come an alarm company. Open source stuff is not going to get in to the club no matter how good it is. This is a shame as proper (Galaxy) alarm systems can be crap by comparison, as we know because we had one, installed by a certified installer, and were robbed!

My understanding is that one of the rules (I heard from an installer) was you can't have some external indication of armed or not. This ment staff did not understand they failed to arm. It beeps in various incomprehensible ways, and shows stuff on the keypad (which you cannot read from outside when using the fob to arm), so they assumed armed when not.

My system can show such, but we go for subtle - internal lights go off when armed. I mean you would turn off anyway, but staff can tell instantly that the lobby light not going off means not alarmed. The light switch does not allow manual turn off. Simple steps but has meant that on the odd occasion of not arming (e.g. fire exit open) staff knew. This is what caused the problem on Galaxy.

I also allow a forced alarm for such cases as a last resort - where the open fire exit becomes a sensor - someone closing it would set off the alarm. This means I can set forced alarm on timer, and be alarmed if staff have missed the problem somehow and still have a working alarm (all PIRs, etc). The Galaxy, when it does not arm, does not arm, end of story. It is a compromise I suspect an official system would not allow.

So basically you need to check (and record the call) insurance are happy with no proper alarm system, etc. Seems many are, and may not even charge more, but having it on record should mean you are covered.

Monitoring

Another issue is monitoring of the alarm. We had that once at an office, and it was such a pain. And one time when we did not know then code word, they said the police would be called. The police did not turn up so I was stuck there for 4 hours on a Sunday waiting for police. Also police won't come if you have too many false alarms.

My system monitors, but messages people, several people, like me, people with access to the CCTV who can confirm it is a false alarm, and if not call the police explaining they can see the burglary in progress on CCTV. That will, I expect, get a way better response than an alarm company calling.

Also much easier to integrate to external systems - staff in office logging for fire list, etc.

Locks

Another issue is locks, and the typical internal door lock is a mag lock, which is really easy to defeat. I have found much better locks and would recommend using them - Abloy locks. These work without the alarm and use a proper euro profile lock, and can be set to open from inside regardless, but also have a load of sensors (key used, handle used, lock in/out, etc).

Opening from inside also avoids the messy "break glass" and "exit button" you typically need.

So my system has to handle everything from a simple maglock and exit button, to the Abloy with something like 5 inputs - which it does nicely now.

It costs more, but in the end it is worth it.

Professional kit

With all of the above, an alarm or door entry system can work, with insurance confirming OK, etc.

But the kit is not as professional, or is it.

When I started I had single sided copper clad boards milled and hand soldered. I have moved on to proper PCBs made in China. I have moved on through a load of connector types to WAGO PCB connectors which are just simple to use for an installer. I have added per input/output LED status on the PCB.

But still, the case is a messy 3D print on my printer. Well, now we moved on finally with high resolution, smooth, clean, 3D resin prints from China.

The wiring and connector to the NFC reader was also a concern, but ironically the leads I got made in China for Faikin boards are perfect for this, and again, professional, so making it all easy to install and just more professional.

I finally feel like I have stuff that is professional looking.

The NFC sensor on a door. It looks proper now.

I have even now designed one for a 1 gang UK pattress box.

So now I plan to list these boards and cases on Tindie soon. The NFC reader is ideal for a hobbyist working on any NFC stuff.

Ordering 3D prints

I have a 3D printer, it is pretty good, but I decided to try ordering some 3D prints from JLC.

Price

The most obvious issue is price, and actually, it is good. I have 2 part 3D printed cases for my Faikin boards for $0.47, but the postage is actually more, making $1.52 delivered, (£1.13+VAT). This is actually pretty good.

Quality

This is perhaps more important - could I have printed myself better - well NO, really NO! The quality is amazing. Resin prints are always good compared to FDM, and these are post processed with sanding.

The precision is also amazing. These designs are made with exact edges, no margins. I thought this was a good test. Well they fit smoothly, and just stick, but not very firmly. This means the dimensions of the print are, well, pretty damn exact to tiny fractions of a millimetre.

The result is quite impressive.

Improvements

My case design are auto generated from the PCB, so as to make sure they fit exactly. I have now done a load of work to tweak these, adding 0.1mm more to the edges that lock and a tiny angle to snap to place. So will be trying those. Will be interesting to see if I can make it a tighter locking edge now.

But, for now, a tiny spot of glue makes a nice case, so selling these on Tindie.

Trying 0201

I decided to take the step to move some of my PCB designs to using 0201 components.

This is basically accepting that I do not even try to solder these things now. A few years ago I started milling boards and hand soldering 0805, and then 0603. I can just manage 0402 if I am very careful. But no way I could do 0201s. These days I design boards and have them made and assembled and shipped. 

It seems JLCPCB can do 0201, so why not?

What's an 0201

Components have various size designations, sizes liked 0805, 0603, 0402, 0201, 01005 are used for standard chip type resistors and capacitors. An 0402 is 0.04" by 0.02" which is 1mm by 0.5mm. An 0201 is 0.6mm by 0.3mm which is tiny.

This picture gives you an idea - a ball point pen shown for stale (a banana would not fit), and the diagonal square things (LEDs) are 1mm by 1mm. You can see ten 0201 resistors and an 0201 capacitor.

So yes, grains of sand. The 01005 things (not doing those yet) are like dust, and there are some that are smaller!

Pros and cons

With 0402 it is possible to run a track under it, i.e. between the two pads, but with 0201, not so much. That said, I rarely ever do a track under an 0402 anyway. Sometimes larger components.

Obviously some components have to be bigger, and you end up with this crazy mix for capacitors - but that has always been the case - larger caps, higher voltages, mean physically bigger caps. But resistors are less of a problem usually - yes sometimes you need bigger ones, but mostly they can be 0201s.

The main advantage is the space saving - my PCBs are often nice and small, so this is handy.

Now, I know my colleagues doing PCB design also need 0201 caps for decoupling as they need to be physically small and close to components. Thankfully I am not doing stuff that high speed with my ESP32 modules, well, yet.

So far they are working - in that JLC seem more than capable of placing 0201.

Footprint

KiCAD has standard footprints, but interestingly I found this fun article, so trying their suggestions. Some test boards to make sure no production issues - surprisingly JLC has not specific recommendations.

GS1, scam?

You will have noticed codes on products you buy, with a barcode, these are product codes. Also known initially as UPC (Universal Product Codes), and then for Europe, EAN (European Article Numbers), and now GTIN (Global Trade Identification Number).

These are 13 digits (12+checksum), and allocated by a company, GS1.

At the beginning the UPCs were allocated on a one off basis to companies for a one off fee, but this changed and now they are allocated to companies on the basis of an ongoing rental.

Rental makes sense.

It is 12 digits, but this is some whole blocks to each organisation so not evenly spread out, and ultimately they will run out, so a system to manage these makes sense. Rental makes sense on the basis that companies will only rent as many as they need, will be encouraged to recycle from discontinued products, and the whole blocks could be re-allocated to new companies once a company no longer needs them or goes bust, etc. Obviously re-use of codes needs a sensible waiting period, and GS1 even had recommendations on that for companies recycling numbers.

Except!

Things have changed, in that GS1 no longer recommends re-cycling numbers because many platforms stick them to a product and do not update/delete that record.

What is extra odd, when querying this, I found GS1 do not re-allocated lapsed blocks to new companies.

This means GTINs are allocated as a one-off operation to companies - never recycled to new companies and not even expected to be recycled within that company!

So rental is a scam!

Rental for one-off allocation makes no sense. If the allocations really are forever, then the pricing should be for a block to be allocated. Ongoing rental is a scam as if you stop renting the numbers stay allocated. Indeed, discontinued products continue to cost you if rental.

We only have 100, and the price has doubled this year. We do discontinue products, and we tried to recycle (several weeks or Amazon support is failing to do this). So at some point we will be renting a significant number of dead codes, and it will be worth getting a new 100 block, re-allocating new numbers for current products, and stopping rental of the old 100 block.

What is interesting is that platforms like Amazon do seem to lock in a GTIN, but also they seem to not care if it is your GTIN unless there is a conflict. So if Company A got a block of numbers, paid the year, did not use them, and then ceased. Company B could use those numbers on a platform like Amazon as no chance of a clash.

Interestingly GS1 have replied to my various emails right up until I said the above, and they said Company B could face fines. I asked for legal basis for fines. GTINs are not covered by a contract with Company B (not that fines are allowed in a contract). GTINs are not protected by trademark, copyright, or patent or any other legal framework I am aware of. I mean I may have missed something, so I am happy for them to enlighten me - and asked as much - but no reply.

It seems to me, in my honest opinion, a rental arrangement for a permanently allocated resource is a scam, simple as that. If it is permanently allocated it should be a one-off fee for the allocation.

That is just my view, obviously.

The printer that just worked (and other fairytales)

I am impressed with the Canon TC-21 A1 printer. Don't get me wrong.

But it seems that Canon doing something very stupid! I have had this with many printers before.

It is telling the printer the type of paper!

Please make it simple!

Firstly there seems to be no standard such as what satin or coated actually means, or even terms like heavy/light weight.

But it does seem the printer considers the paper type (and notably the weight, and hence thickness) in deciding when the roll ends, and somehow I must have had it wrong as it ended several metres before it really did with no option to say just bloody print - I know what I am doing.

But there is one standard and that is gsm (grams per square metre), and the paper is marked with it, so why not make the paper settings on the printer also show the gsm - that way I stand some chance. Another idea may be to allow me to set the length of the roll, as that is also printed on it - or at least show the lengths for each option.

Doing the right thing

So, it is a Canon printer, I'll do the right thing and use Canon ink, and Canon rolls of paper, what could go wrong.

This is the paper.

You can see it is Canon, and is 130 gsm, 610mm wide, and 30m long, and described as "Premium Paper FSC". The FCS is just a certificate not related to type of paper though.

I have some options.

There are many more options, but they get quite specific. The only one marked "Premium" (well "Prem") looks like 80gsm perhaps. So not that. I am assuming "Coated Paper" for now, but I really have no clue at all. The options are not clear and none use the exact wording on the roll of paper itself or state 130gsm.

If you sell a printer and it has a list of paper types, and you sell paper and they have specific names for each type, why the hell not use the same terms/names in both places, please, Canon!

Quality product?

But it gets worse. The roll has to be installed with the paper pushed properly to the right hand end stop that fits in the core or the roll. It checks this (good) and even has little diagrams showing you how to fit, and lock the end stop in the core.

Except...

The core sticks out, so no way to push the end stop up to the paper edge. I tried several times, and no joy.

Only fix was a sharp knife, and finally it works.

This is official Canon paper for the printer and does not work in the printer. Really not that impressed.

Reseller?

The reseller has taken this seriously, and has pointed me to some reference information that may help.

Age verification

The Online Safety Act is in force to block porn sites accessed in the UK now. You have to prove your age.

There is even a petition to repeal and rework it. Do sign, but we all doubt it will help. Maybe if it gets to millions.

Just to be clear - this legislation does not just impact porn sites, or just adult sites, but millions of sites and services, and there are millions more that may be in scope. This is not something where one can say that compliance is a "cost of doing business" as the vast majority of sites and services in scope are not businesses. They do not have money to comply, or even to get legal advice to find out if they have to comply - get it wrong and they face huge fines. That is the crux of the petition.

Let's stick to porn sites for now.

This is a huge invasion of privacy and a largely pointless exercise as there is no real way to stop teenagers that want to access porn from doing so. In my opinion a better approach is education, and especially on the nature of porn as fantasy and fiction so young people do not get the wrong idea about healthy sexual relationships. Blocking will not work, in my view, but it creates a lot of problems.

• It does not just impact kids, it impacts everyone.
• The legislation has huge overreach causing a lot harmless sites to shutdown to avoid the burdens and risk involved. It is not even clear when it applies (what of a shared diary with my wife and nobody else? That seems in scope of risk assessments, at least, as we can each post user content the other sees, and perhaps even AV if anything we add is racy).
• It creates a norm of proving your ID, or camera access, in order to access many web sites (not just porn sites), so opening the floodgates for scammers. Even if some sites have less intrusive means (see SMS below) there will be scammer sites that insist on camera access.
• Even when not scammers it creates the risk of a huge databases of sexual preferences linked to real identities being leaked.
• Teenagers will find ways around it, and even have to help adults to do so (irony!).
• It is questionable as to the extent that porn is actually harmful in the first place, especially with associated education.
• Obviously VPNs are a way to bypass as the restrictions are country specific.

So, let's look at what has happened.

I have done a few checks, and the AV falls in to a few categories as to how it works. This is "legit" AV, scammers may be more creative... Actually I have only checked one site which seems to use "age>>go". Some other sites start by insisting on a sign up to the site and creating a login before they do any more checks, which seems intrusive.

But these are some of the "age>>go" choices...

• A selfie - i.e. allow video/camera access on your device (can you see how that can be abused), and confirm some facial expressions (open mouth). Apparently there are on-line images with expression settings to which you can easily point your camera in order to circumvent this and that is just some games, not even a site set up for this purpose, yet.
• ID upload, like wow - how can that be abused, but also selfie to match ID. No idea if that copes well with edited images in the ID. I was not going to upload an ID, sorry.
• An SMS check, sends a code and they confirm the mobile operator has no age restriction.
• A credit card check. I have not tried this, but they do know kids can have cards? Maybe kids cards are debit not credit cards and that matters somehow. It claims to be a zero value "active card check" - does that show on all card apps? i.e. borrowing a parent's card may work, and leave no trace... Again, I was not going to provide a credit card - but you can see how scam sites will abuse this.

SMS

I looked specifically at the SMS, which concerns me for several reasons. This is, however, by far the least intrusive - as no camera or images or actual ID, just a mobile number.

They take a number and send an SMS with a code to enter, and then do a check with the operator to confirm the number has no age restrictions. This may be an issue in itself - the privacy policy for mobile services can be vague, but sharing whether you have age restrictions with a third party, for a number, is not a clearly identified thing that I can see. So may, in itself, be a GDPR issue.

What they do not immediately say is they then want an email address to which they can send a code. This too is a GDPR issue, as having confirmed you (a) control the number (can get SMS), and (b) the operator confirms no age restrictions, they have no legitimate interest in knowing an email address, and no option to not provide one that works. And this was a "legit" AV site. Scammers will do way more.

What is interesting is the email address has a "remember me" option - but not clear what for. Well, the answer is that you can then verify using "login", i.e. enter the email address and get emailed a code. So the use of the mobile number has now made the email verified with no further need to use the mobile number.

Back of the bike sheds!

This is one of the concerns I had with any age verification system.

So let's assume that..

• Some teenager happens to have access to a mobile with SMS and no age restriction for some reason, or
• A sixth former that is 18 has legitimate mobile SMS with no age restriction, or
• Some guy in a dodgy trench coat has legitimate mobile SMS with no age restriction.

Can they sell (or just give) AV access to horny teenagers?

(Just to be clear, A&A numbers fail to get this to work, the SMS works, but then says you do not have access. This is no surprise as we have no system to allow some third party to check if our SIMs have age restrictions.)

Obviously they can simply provide the code sent to their mobile, and code emailed to them, to their customer to allow them access.

But actually it is even simpler.

Using the mobile number for the first step, and their customer's email address for the second step, the customer tells them the emailed code, or the supplier can tell them the mobile code, either way, but use the customer's email address. Now the customer's email is considered verified, and can be used to login in future without the need for the mobile number. It just needs access to an email address.

By using a domain and mail forwarding the customer's email can be hidden as well, allowing for some ongoing income as the supplier can revoke the mail forwarding at any time.

So yes, this now creates an opportunity for people to exploit others - even adults that want access without giving up any details! Of course those doing the exploiting can be scammy as well, they know the email address, and can even see how often it is used if they wanted.

Testing

I used a mobile (Three data SIM with no age restriction - I am an adult after all) and an email address (one of my @fuck.me.uk addresses) to get access to a dodgy site, yay! But also I can then login using just the email address.

I then did the same, using the same mobile number, but a different email address. This also worked, and both email addresses can now simply login using the email address. I can now forward the second email address to someone else and they can simply login. This has the advantage for them that the site and AV service do not have their details (mobile or real email). No, I am not going to send to a child, obviously.

Now, I do not know if they permanently allow the login or ever re-validate using SMS. It is not even clear how long a site grants access from a login (though clearly at least a day, from my testing).

More data collection

Another issue here is that it allows access to a site to be correlated. With NAT and incognito browsing it is harder to link multiple accesses to be the same person (though browser fingerprinting may allow this). But if there is a login of some sort - or some auth code from the AV service, it can allow all accesses to be linked together, even if not knowing the actual personal identity. With common AV systems it could allow multiple site's accesses to be correlated now without even the need for working cross site cookies / pixels, etc.

Update:

What is interesting is that age>>go have dropped ID check as a verification, and then a bit later dropped credit card check as well. They only have selfie and SMS now, but still - once an email address is validated you only need that working email address!

Update:

Oddly it has changed to Selfie and credit card now. There is shit going down behind the scenes.