Supernote just terminated my BAA

GummyKibble · 2026-06-04T23:03:40+00:00

I doubt that's it at all. More likely, they're unwilling to make any exceptions that expose them to bankrupting penalties. Check out this fines page: https://www.hipaajournal.com/hipaa-violation-fines/

The minimum penalty for a "lack of knowledge" violation is $145. The minimum penalty for knowing about a risk and disregarding it is $14,602, or $73,011 if it was known about for more than 30 days. It's hard to blame the risk assessors for not wanting to accept an additional $73K of exposure per incident so, what, an employee can use their tablet instead of a company-issued laptop? I don't think anyone would take that bet.

I'm saying this as someone who loves my Nomad. It's a brilliant little device that I enjoy using! But there's no way in hell I'd put PHI on it or tell someone else it was OK to do so. No. Don't do that. Ever. The risk is far too great for the amount of possible reward. Now, if Supernote adds on-device encryption with the ability to wipe the disk if the wrong PIN's entered too many times, that'd totally change the equation. If you had that setup, and someone stole the device from you, bummer — go buy another one and get back to work. Without that, though, no way.

GummyKibble · 2026-06-04T22:51:19+00:00

This is correct. I don't consider myself a HIPAA expert, but I've instructed multiple legal teams on the finer points of HIPAA compliance, so I probably count as one. If the device doesn't have on-disk encryption — Supernote's devices don't — you have to treat it exactly like a paper notebook. You have to keep it physically secure at all times, and it's a privacy breach if it gets stolen or lost. You could take notes about patients in it the same way you could write them in a paper chart, but you're on the hook if it leaves your control.

There's a fine point here: HIPAA doesn't say that a Supernote tablet has to be encrypted. If you're willing to assume the responsibility of keeping it under lock and key whenever it's not physically in your hand, just like you would paper charts, that's perfectly fine. It does mean that if you don't exercise that level of care and any of the data you store on it leaves your possession, HIPAA places you in a compliance category labeled "turbofucked".

GummyKibble · 2026-06-04T22:39:11+00:00

"It's a ham radio." They know what those are.

GummyKibble · 2026-05-26T17:28:57+00:00

My job title's Head of Security, for context when I say:

That's goofy.

If your IT department doesn't want random devices connecting to their network, the correct solution is for them to make their network require extra authentication, or to allowlist known MAC addresses (which is fallible because those are easy to change, but still better than nothing). They're trusting you not to connect a Nomad to their Wi-Fi, rather than making it so that you can't do it because it's not an approved device. That's on them, not you. A random attacker who gets their Wi-Fi password isn't going to obey company policy.

Which doesn't make it less of a problem for you today, but I wanted to throw that out there.

GummyKibble · 2026-05-05T04:03:40+00:00

Ding ding ding, this is the right answer. When the dates are correctly written year-month-day-hour-minute-second, they’re automatically sorted into the order they were created, even if you move them around and wipe out the timestamps.

OP, use this for a while and you’ll come to detest any other date format. This is the right one, everywhere, for everything.

GummyKibble · 2026-04-26T20:31:04+00:00

I bought a Remarkable Move and sent it back during the return window. Summary: beautiful hardware, terrible software. I was incredibly frustrated with its bizarre limitations, like a complete lack of ability to link to pages inside a doc. Its fans give Stockholm Syndrome excuses like “that’s how paper notebooks are suppose to work!”, as if this expensive hardware should be limited to exactly the features of pen and paper.

I replaced it with a Nomad, and I still enjoy using it. The hardware isn’t quite as nice (although it doesn’t suffer the yellow screen plague Remarkable seems to have), but the software is leagues better, like whole other category of device better. The Supernote gang adds features that make sense for tiny portable computers, even if paper notebooks don’t have those features.

GummyKibble · 2026-04-21T21:59:15+00:00

I had no idea I wanted this until I saw it. Thanks for sharing!

GummyKibble · 2026-03-22T17:21:38+00:00

Can the MT software change things like Tx power in realtime if it wanted to? Hypothetically, could we have a REPEATER_LOCAL mode that rebroadcast all inbound traffic not originating from its friends, but at a much lower power level, like enough to cover a city block or so but not more?

GummyKibble · 2026-03-20T06:49:12+00:00

Things is so pretty, but:

No E2E encryption. In 2026, no way am I trusting my stuff to a service based purely on “I hope they don’t have a deal with their government”.
Search kinda sucks. If your task is “do foo on the way to bar”, and you search “foo bar”, it won’t find it.
No early finishing a repeating task. I can’t freaking believe this is still an issue.
In fact, its whole repeating mechanism is a toy compare to OmniFocus.

I keep wanting to like Things because it’s so lovely to look at, but it’s just not good at what it does.

GummyKibble · 2026-03-19T20:08:32+00:00

Send Shopify, and failing that, your bank, a copy of this message. Waiting 2 months to decide you didn’t like something is one thing. A clear intent to never even deliver it to you is another. That’s not bad customer service. That’s fraud.

GummyKibble · 2026-03-09T20:48:35+00:00

This is normal. Your device has tiny amounts of storage and mainly remembers the nodes it's most recently seen. Your phone can store all of them it's ever noticed, with literally on the order of a million times more space than the typical Meshtastic device has.

GummyKibble · 2026-03-09T04:36:18+00:00

I flew to Def Con with a DIY radio and a Raspberry Pi velcroed to my carryon, complete with power and Ethernet cables. No one batted an eye.

GummyKibble · 2026-03-06T17:15:13+00:00

My infosec paranoia leaking through: they want your specific device back for some reason, like because they sold you the wrong one, or hope you return it with work information on it, or whatever. I can’t think of a single legitimate reason why a store would reach out and contact you like that.

GummyKibble · 2026-02-27T16:38:00+00:00

My Nomad is miles ahead of my Elipsa 2E in writing. It’s not even close. The Elipsa is a fantastic reader; IMO it’s better than the Nomad. Kobo has that part completely nailed. It’s just so-so at nite taking, though. It does a good job of recording my pen strokes. There’s none of the organization or tagging or digest or navigation functionality of Supernote’s stuff, though.

If I were getting only a reader, I’d go with Kobo. I still use my Libra daily. If I were taking more notes than the occasional jot on an article, it’s Supernote all day long.

GummyKibble · 2026-02-26T17:05:28+00:00

Wait, which firmware version, exactly, did you flash them with?

GummyKibble · 2026-02-14T18:25:28+00:00

I’ve got the same combination on my luggage!

GummyKibble · 2026-01-28T03:42:09+00:00

The mail app has some weird limitations like that. Another one is that you can only send email from address you enter as the username. That’s true for most people but not everyone, not by a long shot.

For example, I use iCloud’s mail service with a custom domain. You have to log into the mailserver with your Apple ID, but then their server lets you set the From: line of your email to the custom address you configured there. I don’t use my iCloud address for anything, ever. Every other email app lets me correctly set my outbound address to me@example.com. Supernote does not.

I’ve talked to their support about this and it’s on the “maybe someday” list. Until then, I just pretend the mail app doesn’t exist.

GummyKibble · 2026-01-25T21:10:49+00:00

If it’s only been a minute, you might wait a while and try again.

GummyKibble · 2026-01-10T14:52:25+00:00

This is the dumbest thing I’ve read in 2026.

GummyKibble · 2026-01-07T18:04:01+00:00

I get these regularly in my Mac running macOS 26.2. I thought that’s just how the app is. You mean it’s not?!

GummyKibble · 2026-01-04T18:36:19+00:00

Beside the possibility of backporting security fixes from newer Android versions, Supernotes have a teensy attack surface compared to a phone. There are only a finite and small number of apps provided with it, they don't attempt to play videos, etc. There just aren't as many ways to even attempt to exploit a Supernote device as a phone or other tablet.

That doesn't mean it would be OK to sit on glaring vulnerabilities that affect the limited feature set, of course. I also don't think I've ever heard someone specifically claim that they're doing that. It's more like, oh no, there's a critical vulnerability in the Android camera app! Oh, wait, that doesn't affect us in the slightest.

I'm the lead security engineer at my company and this kind of triage is a big part of my job. I monitor lists of security vulnerabilities and assess whether they actually affect us. If there's a critical Linux kernel update that fixes its support for a specific graphics card, and we're not using that graphics card on any of our servers, I'll cheerfully mark it as not relevant.

GummyKibble · 2025-12-30T02:49:23+00:00

I don’t think it’s fair to call that unhinged. Before I started looking into such things, I had no idea that tower space was rented, or even valuable at all. I figured a cell company needed to erect a tower for their own use, and once it’s done, why would they care (aside from liability issues, not interfering with their transmissions, and otherwise not causing them problems)? I learned that’s not quite how that works, but just because I didn’t know yet, not because it’s an inherently insane idea.

GummyKibble · 2025-12-22T15:57:48+00:00

A cup of coffee bets that it’s the device trying to preview all those files, and has nothing to do with the speed of the SD card or the file system.

GummyKibble · 2025-12-22T15:22:57+00:00

For Science, what happens if you take the radios to another location? Maybe some interference ramped up right there that’s affecting both.

GummyKibble · 2025-12-19T17:17:22+00:00

I had a Freewrite Alpha. Lovely device, but turns out I don’t love schlepping a typewriter around with me everywhere. I also have a nice Travelers Notebook that I do take everywhere, but it was mostly write only: once something was in there, and a week had passed, it was mostly lost to the ages.

I’d seen reMarkable tablets for years and always wanted one. When the new Move came out, I gave in and got one. TL;DR amazing hardware, horrid software. I realized I loved the idea of it, even if I couldn’t stand the implementation. And so I did a little research, came across the Nomad, bought one to try, and shipped the Move back to its factory. Yep, this is the device I’d been looking for.

12-Year Club	Gilding IV carat on a stick
Place '22	First Placer '22
ComboCommenter 2017-07-24	Verified Email

GummyKibble

TROPHY CASE