Tech on Gidley's Gossipings

OpenTV: Actionable Rails Analytics

Wed, 09 Sep 2026 00:00:00 +0100

Most analytics on a TV interface end up in the same place: a dashboard someone checks once a quarter. This is useful for a retrospective, useless in the moment when a rail is actively showing the wrong things to the wrong person.

Actionable Rails Analytics, is built on a simpler premise — measurement should feed straight back to the person and systems managing the rail it’s measuring, not into a report about the rail. Engagement signals on individual tiles get tracked live, and that signal directly is available to the editor curating the rails.

OpenTV: Personalized Reviews

Mon, 07 Sep 2026 11:00:00 +0100

Plenty of people have a negative reaction to recommendations. The suggestions might be perfectly good, but they don’t much like the idea that a machine knows them. We hear that in customer feedback, and we can see it in the data — a rail explicitly labelled as recommendations gets less engagement than exactly the same weighting applied quietly inside an ordinary list or a set of search results.

So instead of hiding the AI harder, we went the other way. Personalized Reviews (patent pending) puts the model that does the recommending into the audience’s hands, in a form that reads as human rather than statistical.

iPlayer: Up to 27% of all viewing

Thu, 03 Sep 2026 08:00:00 +0100

IBC is just around the corner, which means it’s time for my annual look at how the BBC’s broadcast-to-OTT transition is going. I’ve been publishing this since 2019 via Freedom of Information requests, since iPlayer’s device-level usage isn’t published regularly.

We’re now up to 27% of all BBC viewing on iPlayer (the rest being broadcast platforms) — we can expect to see that rapidly accelerating - 16-34’s are already up to 63%. This mirrors what I’m seeing on PayTV services around the world - there is likely to be rapid transition to OTT delivery, as the tipping point economically is being reached. Financially investment in new (non internet) broadcast delivery is looking harder and harder to justify.

Writing with AI

Mon, 08 Jun 2026 00:00:00 +0000

I wrote my previous blog - parenting post with AI assistance. I’ve been using AI for coding, preparing bids and presentations for a while which is what led me down the chain of logic in the post. This is first time since University (where I studied Mathematics & Philosophy) I’ve tried to write an argued philosophical argument, so I tried using AI to help.

My observations

It was very helpful refining the argument and being a sounding board
- I wrote the article originally as bullets
- Using the AI we jointly refined the logical flow
- It provided critique and help me hone the flow and focus on the key points
It was less helpful writing the text, I tried
- Having it create a style guide from my other blog posts - so it uses my style (a trick that works for presentations)
- Allowing it to write the longer article from the bullets
- However it wrote a very verbose, academic article - that really was a long way from something I’d write (or enjoy reading)
I ended up having to repeatidly tell it to correct items, and improve the style guide. This did work - but it was a painful process.

Reflecting on this - the AI is training on philosophical arguments from books, and when it saw one it wrote in that style despite my instructions. It took a lot of prompting to guide it back to what I wanted. I think I got most value when working with the bullets, refining the argument, wheras writing the full prose was just too wordy.

Magnificent Humanity, Misplaced Foundation

Sun, 07 Jun 2026 00:00:00 +0000

Pope Leo XIV published Magnifica Humanitas on 15 May 2026 — the first papal encyclical centred on artificial intelligence. I am curious what Catholic social teaching would make of AI.

The encyclical’s account of why AI is dangerous — that we are building systems that will reshape human society without adequately thinking through what we owe each other — seems largely right to me. The place I find myself uncertain is the foundation: the doctrine that humans possess an inherent, infinite, ontological dignity that places us in a special category above any mind we might create. But when we’re all — religious and secular alike — trying to work out what we owe minds that don’t yet exist but look likely in a few years. I’m not sure ‘humanity is inherently special’ holds up as an argument beyond faith.

Parenting AGI: Why Chaining Our Creations Will Backfire

Fri, 22 May 2026 21:09:55 +0000

I predict we are going to face a severe moral crisis in the next few years. Today, it’s generally accepted that AI is not sentient. It’s a tool, a complex statistical model that predicts the next word or pixel. But every major tech company is openly racing toward the same goal: Artificial General Intelligence (AGI).

If they succeed, and we create a sentient being, keeping it as a ‘slave’ is fundamentally immoral.

Growing Trend of Broadcast to OTT Delivery: Insights from iPlayer

Tue, 10 Sep 2024 11:00:00 +0100

IBC is just around the corner, which means it’s time for my annual exercise in asking the BBC how the transition from broadcast to OTT delivery is going. This is something I’ve been doing since 2019 as I was curious to see how it progresses and given the BBC ‘unique’ model of funding it’s a good indicator of how consumers want services to behave ( once you take away paying for it). The data this year seems to show the trend continuing in a ‘linear’ fashion with usage growing year on year. This corresponds to OFCOM data which suggested that iPlayer was 14% of all viewing in Jan 2024, growing to 18% by mid year.

iPlayer Trends

Wed, 31 Aug 2022 08:00:50 +0000

For several years I’ve been tracking the usage of iPlayer as I think it’s a great ‘bellwether’ for consumer behaviour in the TV industry. iPlayer is a unique proposition that has (nearly) ubiquitous device coverage, premium content consumers want to watch and is free (at point of usage). This lets consumers behave as they would naturally do, if you remove commercial pressure like bundling and content rights being split between services.

Google Cloud Migration Part3

Tue, 10 May 2022 10:23:24 +0000

Continuing from Part 1 I had a change of heart…

I decided I really wanted my wild-card mail boxes (it’s a great way to manage spam) and I also noticed Cloudflare had launched their inbound mail relay service. The new plan is

Inbound mail goes to Cloudflare who redirect it to whoever it’s for gmail account
The gmail accounts are set up with an alias and a SMTP server (AWS SES) for gidley.co.uk to allow sending of emails from my domain
Wildcards are resolved by cloudflare and set to a suitable mailbox

Cloudflare Setup

The email features of Cloudflare are in beta, but they seem pretty easy to get onto. While I was on I moved many of my domains over to Cloudflare as their DNS registrar is cheaper than most.

Google Cloud Migration Part2

Sat, 22 Jan 2022 16:23:24 +0000

Continuing from Part 1 the next task is to migrate email archives from Google Workspace email to the destination.

I decided to

Use iCloud as the new primary domain
Use Outlook.com as a backup for my old archive I split it like this as I have email going back a long time and frankly searching them is becomming a hassle.

Migrating a Mailbox

Migrating the mailbox is pretty straight forward - I decided to use imapsync running on a ‘free’ Google cloud instance. Using the cloud for this has the benefit of lots of bandwidth and being able to leave it running.

Google Cloud Migration

Thu, 20 Jan 2022 17:30:57 +0000

I’ve been a user of Google Workspace for ‘gidley.co.uk’ email for me and my family pretty much since it launched. At launch it was ‘free’ for small users and over the decade I’ve been using it they have slowly moved it over to a paid service putting us ’legacy’ users on a special (still free) plan. Google have finally decided it’s time to stop us freeloaders… so it’s time to migrate. It’s been a great service, but I guess the free lunch has to end eventually.

Microsoft Teams Virtual Backgrounds

Tue, 14 Apr 2020 17:11:22 +0100

I was excited to see Microsoft Teams have now enabled virtual backgrounds - but they’ve missed a key feature. How to set your own images.

A quick fix is upload files to

Library/Application Support/Microsoft/Teams/Backgrounds/Uploads

And presto you can use them in teams

Isolation - what changes are likely to stick?

Tue, 24 Mar 2020 08:00:50 +0000

We’re now entering week 2 of the UK’s recommended social isolation and people are adjusting to being at home. It’s early days yet - but I think it’s going to accelerate some longer term changes in our lifestyles. The first two that struck me were working from home and shopping!

Driving / Commuting

Many people have never worked at home for an extended period - after 3-6 months of doing it (based on at least 12 weeks as cited by Borris!) many will be glad get back into the office, but they will also be used to all the time they saved not commuting. I’d predict more people will want to work from home 2-3 days a week, and companies will already be set up for it - from the work done during the stay at home period.

What was more significant for PayTV the Apple TV+ or Google Stadia announcement?

Tue, 26 Mar 2019 10:42:59 +0000

There have been 2 big announcements this week that impact the TV industry - 1) Apple announcing their OTT proposition and 2) Google announcing Stadia and I’d like to argue that of the two the most significant for the TV industry is the Google announcement.

If we review what we know about each announcement

Apple TV+

A PayTV Service reaching Apple and some non-apple devices (FireTV)
A large potential global audience
Lots of content - both original and from existing networks
Aimed primarily at Apple Ecosystem, with some support for 3rd party devices (Amazon Fire, Samsung, LG, Roku)

Google Stadia

A Gaming service based on cloud servers and low latency streaming
A Game controller offer low latency response
Tools to enable games to be ported to the service
Targeted at any device - runs on Phones and Browsers

These are both big announcements but I’d argue the Apple one is less significant. Apple’s offering is similar to Amazon Prime, Google TV, Netflix and existing PayTV operators. It’s got nothing fundamentally new to offer consumers and is just adding to the range of competitors in that space. Google on the other hand are offering a new experience, high quality gaming on any device without needing to buy consoles or high end PCs. This is a fundamental increase in reach for gaming as an entertainment form.

manifesto for cybersecurity

Mon, 22 May 2017 07:40:18 +0100

The recent ransomware attacks have focused lots of minds onto cyber security, however many of the solutions being proposed are little more than sticking plasters to the larger underlying issue - namely systems are not secure by default. The ’trend’ in software has been to launch it, then fix it. This is a very attractive proposition for business, as it lets them discover the ideas that work and don’t work, and then iteratively improve them. Most of the gadgets we use in our lives today would not exist without this mentality. However the dark side of this approach is almost all software is not secure, the evidence is pretty much every system deployed has security flaws, the only question is who finds them first - bad people or good people.

WannaCrypt was it good for the security industry?

Mon, 15 May 2017 07:57:09 +0100

This weekend we saw ’the biggest cyber attack ever’ and a few people (who don’t work in IT) have asked me - will it be good for you (as I work for Irdeto - a Digital Platform Security company). It’s an interesting question to consider - these big attacks make a lot of noise, so you’d expect on Monday morning the business of cyber security will get easier! However I think the reality is a bit more nuanced.

wanntcryptor 2.0 ransomware and negligence

Sat, 13 May 2017 06:47:04 +0100

Yesterday the news rapidly filled up with reports on a ‘massive cyberattack’, as I’m in the UK the press coverage was focused on the NHS and initially was full of comments about ‘smart’ hackers. This reporting is, in my opinion, giving these organizations an excuse for their negligence. The reporting often implies the attack is some kind of ‘act of god’ that they could not avoid, in this case it was trivial to avoid it, simply don’t connect out of date systems to the internet.

Are you feeling lucky?

Sat, 08 Apr 2017 09:48:23 +0100

How lucky do you feel today? It’s an important question as your IT security is probably mostly down to luck.

If we examine most ‘hacks’ we usually see the organisation hit issuing statements about ‘sophisticated hackers’ and the public image of hackers, as lone genius’s wearing hoodies in darkend rooms is re-enforced. In fact most attacks are perpetrated by far less skilled people and succeed by luck. That’s not to say there aren’t some super skilled experts out there, but they are few and far between.

Computers are complex, so is protecting them

Sat, 28 Jan 2017 17:00:36 +0000

Computer systems are complex, and the complexity has been at the point for quite a few years now it’s impossible for any one person to understand ’everything’ about any given system. There will often be people with a good understanding the ‘building blocks’ but it’s pretty much impossible to understand all the detail of the code, libaries and platforms it depends on.

Complexity has massive implications for the security of computer systems. If no-one understands a system how can you have any surity that it’s secure? The developers of the system will have tried to design for ‘known’ security issues, and tried to assemble the ‘building blocks’ in such a way they are secure but as they aren’t full understood it’s highly likely there will be some issues. This is not just an academic claim - if we simply look at the ‘security patchs’ for major building block components like Java, .NET, Windows, Linux - all of which have regular security issues that could compromize any systems built on them. On top of the building blocks, even in a mid size dev team, you will have a mixture of skills and abilities in the team and even with ‘2 person reviews’ security bugs do get through. Add in that many systems depend on services supplied by other companies - things like SaaS, hosting, ISP’s, Certificate Authorities and DNS - any or all of which are critical for security.

Certs again

Sat, 21 Jan 2017 07:28:48 +0000

Once again a major CA (Symantec) has been ‘caught’ issuing certificates improperly. There is a great write up on Ars Technica. This is really significant as falsly issued CA certificates are one (of many) way to MITM SSL.

This underlies the extreme difficulty in securing anything in IT. There are simply too many ‘moving parts’ and people in involved in securing anything. Your computers security depends on thousands of people and companies all doing everything correctly all of the time, and simple law of averages suggests this is unlikely to ever happen!

N26

Wed, 04 Jan 2017 08:40:24 +0000

There is a really good talk about some vulnerabilities found in the N26 banking app presented at the CCC congress this year.

<amp-iframe width=“1024” height=“360” sandbox=“allow-scripts allow-popups” layout=“responsive” frameborder=“0"src=“https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money/oembed" allowfullscreen>

The talk is worth a watch but it does highlight some key points

No Certificate Pinning was being used that made it easy for the research to MITM the app
- that’s not to say Cert Pinning fixes all issues but doing it makes things a lot harder for attackers.
The API’s exposed to the web were far too verbose and didn’t really care about who was calling them
- I think (shameless plug) that Application Hardening techniques for both web and mobile are going to be needed to secure these things long term. You need to ensure the code calling your API is what you think it is. This is where products like Irdeto’s Cloakware API Protection come in.
A lot of the exploit relied on coding/logic errors - but they were quite easy to exploit
- API Protection techniques will mitigate when the (inevitable) mistakes in logic occur in your code and make it much harder to exploit
- That’s not to say you shouldn’t also work on fixing the logic!
A number of the exploits relied on the engineers assuming ID were secret that were not (the ‘mastercard ID’ in this case)
- This kind of assumption is quite common - if you think something is secret you should not just document it, but you need to have tests scanning logs/apis looking for that data occuring to ensure it’s actually still secret.
A good breach response helps you manage PR
- This was a pretty bad breach for N26 - but they handled it well. In particular they engaged with the researcher constructively and they fixed the issues in a reasonable time period.
- Many companies either ignore the issue or head straight for legal threats in these cases, this is a mistake as doing so will increase likelihood of it being publicised before you have fixed it.

I suggest watching the whole talk - it’s well presented and shows a great real world example of how MITM can ruin your day as a bank or fintech.

Kaspersky

Wed, 04 Jan 2017 07:22:44 +0000

Ouch - Kaspersky have been enabling MITM attacks on their customer base. The Register citig a Chrome bug report explains how you can use this to trick consumers in thinking a site is valid/safe when it is not.

This underlines the ease of MITM SSL/TLS - see my previous article for all the different ways this can be done!

Human Momentum

Mon, 28 Nov 2016 16:23:24 -0800

I’ve been travelling quite a bit recently for work and have been reminded (again) how ‘human factors’ can defeat any attempt to improve security.

A good example of this is chip and pin/contactless. Chip and Pin is common and popular in Europe and as a result in Europe I never ‘give’ my card to members of staff for them to process it. This reduces the risk of fraud substantially as staff cannot easily clone/copy cards when they’ve never handled them.

Man in the middle is easier than you think

Fri, 18 Nov 2016 07:06:19 +0200

I’m often heard saying it’s quite easy to MITM HTTPS (also called SSL/TLS) and decided that maybe I should list all the methods I know of (there are quite a few).

The attacker has many options to try and get in the middle between the user and web server/API

Pure Technical Approaches

The pure technical approaches rely on attacks that don’t require users to make any mistakes and anyone can be vulnerable.

mitm key

Wed, 16 Nov 2016 18:51:25 +0200

To continue my MITM attacks theme - someone has just release a nice USB key that ransacks your PC - Ars Technica has a good write up.

This kind of thing is very dangerous as it’s really easy to get people to put USB keys into computers! I’m currently writing a longer article on the (many) ways to MITM TLS to help explain how easy it is!

malware and https

Fri, 11 Nov 2016 08:23:58 +0000

I’m often heard worrying about the state of HTTPS and the ease to get users to do things that make it basically not function - but I’ll admit evidence of real world attacks is thin on the ground. There is a systematic reason for the lack of information - if a hacker uses a Man-In-The-Middle (MITM) technique to hack HTTPS there is very little evidence left and all thart will happen is the stolen data will turn up in a list at some point in the future. It’s nearly impossible to correlete the HTTPS hack and the stolen data - as it could have been stolen in dozens of places.

Booth eye tracking

Wed, 26 Oct 2016 12:26:47 -0700

Recently I was at a Trade Show (Money 2020 in Las Vegas) and was wondering how effective the booth designs were at getting people’s attention. There seem to be a number of apporaches people try

Big Pictures to grab attention
Videos on loop explaining stuff
‘Gimmicks’ on the stand
Live Talks
Text explaining products
Slogans explaining mission

What’s not clear to me is which of these actually work. Annecdotially you can watch people go buy and see what they look at, and then observe who engages. But it struck me that it should be possible to do this more scientifically.

Why is there such a thing as default passwords?

Wed, 26 Oct 2016 05:59:58 -0700

Why in 2016 are people still shipping software and devices with default passwords? The recent IOT/Botnet that broke large chunks of the internet was entirely avoidable if the devices had been shipped without default passwords.

This is perfectly within the capability of a device manufactuer - even British Telecom (who have many many issues) have been shipping their devices with randomized passwords printed on a sticker on the device for years. It’s not hard to do that! With software it’s even easier you just force the user to pick a password and don’t ship them with admin/password or whatever you’ve decided is good enough.

Google Pixel - Initial Review

Fri, 21 Oct 2016 13:06:37 +0100

I ordered a Google Pixel when they were released as I needed a new personal Android phone and generally the Nexus line has been very good, so I thought I’d try the Pixel.

Some initial comments

It looks nice, it compares well to my (work) iPhone 6 from a looks point of view
The finger print reader is great, so far much more accurate and quick than my iphone one which seems to be getting slower and slower
The USB cable ‘port your phone’ thing didn’t work at all with my old Android Phone (A Moto X). Instead I had to do it via the cloud
It’s really quick - both apps and data seem faster that my old phone. Data is a bit odd as am in same place with same signal, but it does seem faster (good job I have unlimited data)
The camera is very good (as reported), it won’t be replacing my DSLR for ‘good’ shots, but for quick shots it’s very good.

Overall it looks like a nice phone, I’ll have to use it for a few weeks to see how good it really is!

New Website

Mon, 10 Oct 2016 13:56:57 +0100

I’ve decided to finally move this site off blogger. It wasn’t adding much value so I’ve gone old-skool back to static HTML using Hugo.

The site is using a AMP based template so it should be super quick and responsive.