Firesheep, enterprise software and other broken models

There has been a lot of fuss about FireSheep, a browser plugin that show how easy it is to intercept packets on the internet, and masquerade as someone else. The idea is nothing new: EtherPeg—which intercepts wifi traffic and shows the JPEGs and other images passing by—is over 10 years old. Annalee Newitz wrote a Wired story on people packet sniffing in coffee shops back in 2004.

The underlying design of the internet means that you don't know who will be able to see any packets you send. If you care about not being snooped on, you need an encrypted connection from your computer to the one serving you at the other end. The best way to do this on the web is to use HTTPS, which all browsers support, and most servers support with configuration changes. It's not perfect, but it's good enough.

However, much of the advice following on from FireSheep was misleading or outright wrong. I saw several articles saying:

• Avoid Open WiFi
  
• Turn on WPA encryption
  
• Use a VPN to tunnel the traffic into a server elsewhere

These techniques may protect for a while against those nearby you in the Caf?, but by not securing the whole connection, they just change who is able to intercept your communications.

The security model here is the firewall one - the notion that there are trusted networks and untrusted networks, and as long as you're inside a trusted one, you'll be OK. This is an obsolete worldview. When computers were large fixed physical entities with software controlled by a specialist, and networks were wires under their control too, this had some correspondence with reality, but it was always tenuous - others within the firewall could be running compromised machines; outbound connections could still leak data.

If you VPN into a company or service to mask your outbound connections, that endpoint is an attractive point of attack, as it has collected a set of people who think their data needs securing. There's a clear example of this in this NYT article about a hacker who lured his friends to use an FBI VPN to track them down and arrest them.

This worldview connects with two other themes. The US Government is trying to pass a law requiring ISPs to enable your communications to be intercepted. The UK government is also working on legislation on retaining all email and web traffic. Similarly, many companies monitor internet traffic within and leaving their secure networks for legal compliance and employee monitoring. Such mandated backdoors, like the VPN tunnel, become attractive targets for other bad actors - remember the Greek government being spied on through a legally mandated interception backdoor in the phones they used?

This week, I spent a couple of days at the Enterprise 2.0 conference, hearing how open standards like Activity Streams and OpenSocial are being used to bridge separate business information systems both within and between companies, with OAuth used to enforce corporate policy.

This seems anathema to old-line IT managers who assume that they dictate who gets to see what, but the pragmatic realisation that many business people have more powerful and connected computing devices in their pockets as phones than on their desks from corporate IT was in evidence at E2.0 at least.

This brought to mind the great conversation we had with Josh Klein on TummelVision last week, discussing his book Hacking Work - breaking stupid rules for smart results:

one of the most common hacks we found: jumping IT’s firewall and working around their restrictions and tools in open computing environments, then bringing the work back over the firewall and presenting it to bosses as if the corporate tools had actually been used.

Ben Horowitz's article on enterprise sales in TechCrunch today tries to justify corporate practices, even as he recognizes the inversion of the innovation flow.

What this misses is the underlying economic justification for the existence of a corporation in the first place - the economic theories that build on Coase's work saying that firms exist because transaction costs are lower within them than external transactions mediated by the marketplaces. Pettifogging internal purchasing rules should be subject to this test: does the internal transaction cost of approving and purchasing something exceed the value of the thing being purchased?

Reading Ben's explanation of how corporate salespeople help institutions negotiate their own labyrinthine processes, I couldn't help but be reminded of John Hagel's Big Shift model, (also discussed on TummelVision), which continues to show a declining return on assets for corporations.

The challenge we have on the web is to maintain the kinds of open-to-all interoperable standards that empower us to work round these creaking bureaucracies. If we delegate our online identities to a few firms operating proprietary APIs, that they can revoke access to, or decide who can call them for reasons of corporate strategy, the lowered transaction costs suddenly get very high again.

Doc Searls's work on VRM (this week's TummelVision) is all about making sure that we can retain agency over our own information. I expect to discuss this in depth at Defrag next week.

Geek Cinema: 'The Social Network' vs 'The Man in the White Suit'

I recently watched a film that dramatically evoked the disruption caused by geeky inventors, the difficulties they have getting funded, and the forces that combine to oppose them in the name of the status quo.

Sadly, this wasn't at last night's showing of The Social Network, but watching the 1951 Ealing comedy The Man In The White Suit on my phone while flying home.

The Social Network has zinging dialogue, tilt-shift rowing at Henley, and has lawyers as its most sympathetic characters. Most of its humour comes from heavy-handed prefiguring of Facebook's eventual success; clearly you can't spoil the ending, so the trailer just recaps the whole film:

The opening hacking scene, dramatized almost verbatim from Zuckerberg's blog at the time, is perhaps the best 'using a computer' scene in a movie yet - Mark should get a screenwriting credit. But the mythical girlfriend who dumped him and his reactions to that - 'cyberbullying', seeking fame, plaintively hitting refresh on the friend request - that frame the film are a disappointing narrative touch that duck the chance to try to explain his real motivation. Apart from the lawyer, all the women in this film are purely sex objects - when Zuck is asked 'What are the girls going to do?' and replies 'Nothing', that's clearly Sorkin talking.

In contrast, The Man in the White Suit has Alec Guinness inventing a monomolecular fibre that can't break and naturally repels dirt. To do this he has to get to work into labs at textile factories under false pretenses, and when he eventually succeeds, provokes a hostile reaction from both the factory owners and the unionized employees, who want to suppress his work. If you haven't seen it, Amazon and Netflix have it.

Here, the motivation to invent something new and exciting is expressed well, and the technology behind it is plausibly explained. Guinness inspires Joan Greenwood with his idea, and she researches it and champions him to get his work funded. The women in this sixty-year-old film are well-drawn characters, with motivations of their own. They are peers and colleagues to Guinness's Stanley, not sex objects; indeed that is directly challenged. The film is stronger and more emotionally powerful for it.

Both films capture the ascetic geek intensity and focus well, but Sorkin and Fincher want to tear it down, whereas MacDougal and MacKendrick see the Innovators Dilemma clearly 45 years before Christensen did. As Lessig says, The Social Network portrays a legal system that preys on invention, not supporting it; the Man in the White Suit has the inventor's notebooks establishing rights that he needs to be paid for.

Conversely, to get his invention out to people, Stanley needs to convince the very industry he is disrupting to adopt it, whereas the existence of the Internet and it's open protocols mean that Zuckerberg was able to get his idea adopted by thousands with a small loan from a friend.

Technology has made a lot of progress in 60 years, but judging by this new film, law and women's roles have gone backwards.

The Slutsky vanishes - Google Instant has a smutty mind

At the Google Instant Launch on Wednesday, I ran into my former colleague, the writer and internet famous video star Irina Slutsky. We sat together, and so naturally when we were trying out Google Instant during the launch, I tried typing her name in. And an odd thing happened - Google whited out the Instant search results.

Irina asked about this, and Johanna Wright of Google replied that they white out some words related to sex and hate speech, in case inappropriate results appeared for people who weren't expecting it. 'Slut' is one of these words, but it is not clear at all why 'Slutsky' is.

I already wrote about my concerns that Google's predictive words could narrow the range of searched-for terms into clich?s - that as you type Google, in Stoppard's words, is

announcing every stale revelation of the newly enlightened, like stout Cortez coming upon the Pacific — war is profits, politicians are puppets, Parliament is a farce, justice is a fraud, property is theft… It’s all here: the Stock Exchange, the arms dealers, the press barons… You can’t fool Brodie — patriotism is propaganda, religion is a con trick, royalty is an anachronism… Pages and pages of it. It’s like being run over very slowly by a travelling freak show of favourite simpletons, the India rubber pedagogue, the midget intellectual, the human panacea…

At least these suggestions are based on integrating over the text of the web; the words that get the silent whiteout treatment seem to have been chosen by a committee though, and clearly an American one at that, as it whites out 'ass' but not 'arse, 'shit' but not 'shite', 'slut' but not 'slag' and so on (I didn't type every smutty British slang word in, life is too short).

However, the modern-day Bowdlers at Google don't white you out based on what you type, but on what they predict you're going to type.

If I type 'blue-footed' - it predicts I'm typing 'blue-foooted booby' and as 'boobies' is an Official Google Smutty Word, my search goes white (in fact 'blue-foo' is enough).

Similarly, typing 'turn again d' implies 'turn again Dick Whittington', and 'dick' is a an Official Google Smutty Word.

The same is true for Irina -so shocking is her last name that all you have to type is 'irina sl' and the Google whiteout erases her from results.

Weirdly, if you type 'who killed cock' it is completed to 'who killed cock-robin' with a hyphen inserted, which implies someone has edited the auto-complete list manually.

My worldview and sense of appropriateness is probably close enough to Google's committee that I'm not going to be too bothered by this, but I do wonder about them deciding what the norms of speech are for everyone in the world.

If Google predicts your future, will it be a clich??

I wonder if Michael Frayn saw the launch of Google Scribe today, and smiled to himself. In 1965, Frayn wrote a book The Tin Men, which featured a mechanism that wrote newspaper articles by joining together clich?d phrases through a small number of rules.
There's an explanatory extract from it in this discussion of why you should avoid clich?s when writing Poetry.

He opened the filing cabinet and picked out the first card in the set. Traditionally, it read. Now there was a random choice between cards reading coronations, engagements, funerals, weddings, comings of age, births, deaths, or the churching of women. The day before he had picked funerals, and been directed on to a card reading with simple perfection are occasions for mourning. Today he closed his eyes, drew weddings, and was signposted on to are occasions for rejoicing.
The wedding of X and Y followed in logical sequence, and brought him a choice between is no exception and is a case in point. Either way there followed indeed. Indeed, whichever occasion one had started off with, whether coronations, deaths, or births, Goldwasser saw with intense mathematical pleasure, one now reached this same elegant bottleneck. He paused on indeed, then drew in quick succession it is a particularly happy occasion, rarely, and can there have been a more popular young couple.From the next selection, Goldwasser drew X has won himself/ herself a special place in the nation’s affections, which forced him to go on to and the British people have clearly taken Y to their hearts already.
Goldwasser was surprised, and a little disturbed, to realise that the word “fitting” had still not come up. But he drew it with the next card — it is especially fitting that.
This gave him the bride/bridegroom should be, and an open choice between of such a noble and illustrious line, a commoner in these democratic times, from a nation with which this country has long enjoyed a particularly close and cordial relationship, and from a nation with which this country’s relations have not in the past been always happy.
Feeling that he had done particularly well with “fitting” last time, Goldwasser now deliberately selected it again. It is also fitting that, read the card, to be quickly followed by we should remember, and X and Y are not merely symbols — they are a lively young man and a very lovely young woman.Goldwasser shut his eyes to draw the next card. It turned out to read In these days when he pondered whether to select it is fashionable to scoff at the traditional morality of marriage and family life or it is no longer fashionable to scoff at the traditional morality of marriage and family life. The latter had more of the form’s authentic baroque splendour, he decided.

George Orwell, in Politics and the English Language, described this way of writing:

As I have tried to show, modern writing at its worst does not consist in picking out words for the sake of their meaning and inventing images in order to make the meaning clearer. It consists in gumming together long strips of words which have already been set in order by someone else, and making the results presentable by sheer humbug. The attraction of this way of writing is that it is easy. It is easier—even quicker, once you have the habit—to say “In my opinion it is not an unjustifiable assumption that” than to say “I think”. If you use ready-made phrases, you not only don't have to hunt about for the words; you also don't have to bother with the rhythms of your sentences since these phrases are generally so arranged as to be more or less euphonious. When you are composing in a hurry—when you are dictating to a stenographer, for instance, or making a public speech—it is natural to fall into a pretentious, Latinized style. Tags like “a consideration which we should do well to bear in mind” or ”a conclusion to which all of us would readily assent” will save many a sentence from coming down with a bump.

Clearly, Google Scribe has been trained on the vast corpus of English language text that is also used for Google Translate to come up with plausible sentence fragments. Equally clearly, that means it is bound to be plucking phrases that have been written before out of the web for you, and favouring those that have been said most often. It won't come up with a crisp, resoundingly clear phrase for you, unless it has already been said many times before.

The most likely words to follow “clocks were” now, according to Google, are “striking thirteen”. I hope Orwell would appreciate the irony.
Now, this is amusing in itself, but it is also indicative of a wider problem. If you've done much web searching for, say, home maintenance tips, you'll see a lot of prose that has either been written by a machine of this type, or by poorly paid human writers who use a very similar compositional process. We have a kind of mutated Turing Test going on all around us, where robotic writers are trying to convince robotic readers that they are human, and their stilted prose is worth presenting to the real people searching. Of course, the robots are searching too, to get the source material that is fed into their word mills to create this shambling facsimile of human prose.
It may be impressive that computers can now write bad prose like so many people do, but I do wonder about Eric Schmidt's grand vision of Google predicting what we will want to do before we think of it ourselves. Will it in fact be what we wanted, or will it be a mishmash of expected behaviours, that we'll regret on our deathbeds?

1. I wish I'd had the courage to live a life true to myself, not the life others expected of me.
This was the most common regret of all. When people realise that their life is almost over and look back clearly on it, it is easy to see how many dreams have gone unfulfilled.

A scene in Tom Stoppard's The Real Thing sums this up well:

He’s a lout with language. I can’t help somebody who thinks, or thinks he thinks, that editing a newspaper is censorship, or that throwing bricks is a demonstration while building tower blocks is social violence, or that unpalatable statement is provocation while disrupting the speaker is the exercise of free speech… Words don’t deserve that kind of malarkey. They’re innocent, neutral, precise, standing for this, describing that, meaning the other, so if you look after them you can build bridges across incomprehension and chaos. But when they get their corners knocked off, they’re no good any more, and Brodie knocks corners off without knowing he’s doing it. So everything he writes is jerry-built. It’s rubbish. An intelligent child could push it over. I don’t think writers are sacred, but words are. They deserve respect. If you get the right ones in the right order, you can nudge the world a little or make a poem which children will speak for you when you’re dead.

People are used to typing questions into a box on Google and getting a machine's suggestions. Increasingly though, they're typing emotions into a box on Twitter or Facebook, and getting a human response instead.

Welcome Apple, seriously

Yesterday's update of iTunes added Ping, a music-focused social network. When I tried it out early in the evening, it had Facebook Connect enabled, and both imported friends from Facebook, and notified me when new ones joined. Shortly afterwards, Mark Zuckerberg joined, and shortly after that the Facebook connection was missing.
This morning, neither company is talking on the record, though Kara Swisher reports that Steve Jobs complained about 'onerous terms' from Facebook.

This naturally reminds me of the problems we had with Google Friend Connect, where Facebook's accusation of a ToS violation was never backed up by an explanation of what would not violate the terms, leading to the "Data Roach Motel" accusations at Supernova. The underlying issue is whether you should give another company veto power over your application. Last time I wrote on this, it was Apple's veto I was warning about, though at the same time Apple was trying to avoid giving Adobe veto power over their platform again.

The thing is, we have been round this cycle before, and the answer is known too - the way to interoperate with another company without having to have a business agreement with them is to use open standards, not proprietary APIs.

Apple knows this - they have helped lead development of HTML5 and WebKit, along with many other standards in the past, including podcasting and MPEG4. Facebook knows this too, and they have been strong supporters of OAuth and Activity Streams, and even of Portable Contacts, when it's them doing the importing.

Clearly it good for us as users to be able to delegate our contact lists to an existing source - this weeks launch of conference sharing site Lanyrd shows that. It's also in our interests to be able to propagate the actions of playing, liking and purchasing music, videos and anything else between sites of our choosing, so that we can share with our friends, and so we can get more useful recommendations for the future (at minimum, not suggesting things we already have).

This was the core of the discussion at the VRM Workshop last week in Boston - that we should control over who sees what about us, and I think that with these common standards we can solve both problems - the individuals get to save having to re-enter their information everywhere, and control what flows to where, and the companies get the ability to interoperate without bizdev and single source lock-in. Activity Streams (and the associated standards they build on) are our best hope for this.

Steve Jobs and the Curate's Egg

The word 'curation' has become popular recently in the tech world to describe what I call mutual media - the way, by reading many things and passing on a few of them, that we mediate the world of information for each other. As m'colleague JP Rangaswami says, "Curators add to relevance by stripping away the irrelevant and the unneeded and the shoddy."

However, there is a move to co-opt this useful term into a new form of centralised control. Sarah Rotman of Forrester defines 'curated computing' as:

A mode of computing where choice is constrained to deliver less complex, more relevant experiences.

Given Forrester's background, expect this 'curated computing' idea to be used to justify IT departments preventing corporate users from using applications they choose any day now.

At the D Conference last week, Steve Jobs embraced this term, referring to a 'curated app store'.

This definition moves the idea of curation from democratic to hierarchical - our choice becomes take it or leave it. As Jobs said

Things are packages, of emphasis. Some things are emphasised in a product, some things are not done as well in a product, some things are chosen not to be done at all in a product.

This reminds me of the classic 'Curate's Egg' cartoon:
Bishop: "I'm afraid you've got a bad egg, Mr Jones";
Curate: "Oh, no, my Lord, I assure you that parts of it are excellent!"

When choosing what features go into Apple Products, of course Jobs gets to decide this; it is indeed a great skill. However, when offering technology platforms for others to build businesses on, this is more problematic.

While talking about Flash on the iPad, Jobs said:

A more popular developer environment was HyperCard, we were OK to axe that[...] Hypercard was huge in it's day because it was accessible to anybody

Indeed it was - many people miss it; Dale Dougherty says he wants a HyperCard for the iPad. I don't think he does.

When Steve Jobs's Apple cancelled the HyperCard in QuickTime project, all the people who had built businesses on it could do was plead with Apple, to no avail.

As Jobs himself says, we have a platform to build on for the future - it is HTML5. It's an emerging standard that is not under the control of any one company, but is built on the Web as agreement. And even Steve Jobs can't stop it.

Dandelions and Viruses

Last week, Betsy Aoki tweeted:

Sick visual around how content is passed around - organic=dandelion, and then the spam marketing campaign (cancery clumps) #w2eless than a minute ago via webBetsy Aoki
BAoki

This intrigued me, as I had used Dandelion and Virus analogies talking about the social web 2 years ago and used these pictures:

Organic dandelion versus virus

And here's Paul Yiu's slide Betsy was looking at (number 8 in this deck):

Looks like a case of metaphors converging.

Live Waving the Google I/O Keynote

Google I/O starts today in San Francisco, but they've already exceeded the capacity of Moscone West, so even Google execs can't get in today. If like me you're watching remotely, here's the live stream. Me, Gina Trapani, Adam Pash, and Leo Laporte will be live-waving it here (and on their sites).

If you want to join in a free-for-all wave chat, try this one:

Jeremy Hunt hates the Digital Economy Bill - will he block it?

I watched the Digital Economy Bill Second Reading debate yesterday, along with enough other twitter users to make #DEBill a global trending topic and many MP's names UK trends as we discussed it.

It was an interesting debate to watch, with good contributions from many backbench MPs who had clearly been listening to all sides of the discussion.

However, no amendments were moved - that happens today. Due to the 'washup' procedures in Parliament the Conservative front bench has an effeitive clause by clause veto over this bill. As Jeremy Hunt described the bill as:

"a weak, dithering and incompetent attempt to breathe life into Britain's digital economy.[...]We have examined this Bill clause by clause, and we agree with the hon. Gentleman that it could have been massively improved had this House been able to give it proper scrutiny in Committee. The Government have had plenty of opportunities to allow such scrutiny, and it is a matter of huge regret that we have not been able to provide it.[...]I want to say plainly to the Government that, while we recognise that some parts of the Bill will have to be let through if we are to avoid serious damage to the economy, other parts of it are totally unacceptable, and we will use every parliamentary means at our disposal to remove them.

Peter Luff put it more strongly:

Nevertheless, this is the most profoundly unsatisfactory constitutional process I have engaged with in my 18 years in the House. In his opening remarks the Secretary of State promised my hon. Friend the Member for Maldon and East Chelmsford (Mr. Whittingdale) that he would write up a list of precedents, but I do not believe-I could be proved wrong-that there is a single precedent for giving a major and controversial Bill a Second Reading once a general election has been announced. It is a scandal that the House is being asked to agree that tonight.

I have given the matter careful consideration and I make this commitment: if there is a Division, I will support the Bill because, under a true constitutional process, it deserves a Second Reading; it does not, though, deserve what will happen to it thereafter. However, I broadly support the aims and objectives of the Bill and will vote for its Second Reading should there be a Division-but I shall do so under duress and protest, because I hate and loathe the process in which I am forced to participate.

Adam Afriyie summed up:

It has been a very interesting debate, with a single theme unifying the contributions from Back and Front Benches across the House-that the Government appear to be rushing through an important piece of legislation without due scrutiny in the House of Commons. After 13 years of digital dithering, this Bill is all they have to show on the digital front. It is a missed opportunity of massive proportions. Not only is it discourteous to rush such a significant measure through Parliament in the dying days of a failed Government, but it is also incompetent.

Now given these opinions, they should use their veto wisely to get rid of the muddled clauses.

The new clause 18 is most egregious and is simplest to remove - all it does is handwave about how the Secretary of State can make some rules that then have to go before Parliament anyway. It's making up a new process that is almost as complex as passing a bill properly, but with upfront constraints.
Dump it, promise a copyright reform Bill.

The existing clause 18 is clearly bonkers, as it doesn't define 'internet location' or any of its terms, and surely violates the 'mere conduit' principle.

Clauses 10-17 have mushroomed into a complex parallel court system, with a presumption of guilt, not innocence, and an appeals model. They now have (thankfully) added the need to pass a resolution through both houses for all regulations.

Jeremy Hunt, cut the Gordian (Gordonian?) knot. Drop these rococo clauses and propose a sensible copyright reform bill for the next Parliament that reforms copyright and the net sensibly.

The Statute of Anne, the Digital Economy Bill and the Red Flag Act

This week marks the Tercentenary of the 1710 Statute of Anne - the world's first Copyright law. It also marks the first discussion of the Digital Economy Bill in the Commons. And in 1865, the Locomotive act was being discussed in the Commons too. How do they compare?

The Statute of Anne opens like this:

Whereas Printers, Booksellers, and other Persons, have of late frequently taken the Liberty of Printing, Reprinting, and Publishing, or causing to be Printed, Reprinted, and Published Books, and other Writings, without the Consent of the Authors or Proprietors of such Books and Writings, to their very great Detriment, and too often to the Ruin of them and their Families: For Preventing therefore such Practices for the future, and for the Encouragement of Learned Men to Compose and Write useful Books;

In other words, its goal was to prevent those who have Printing machines from exploiting the creative Authors. Sadly, this aim went astray over the years, with Macaulay opposing extension in 1841 by saying:

At present the holder of copyright has the public feeling on his side. Those who invade copyright are regarded as knaves who take the bread out of the mouth of deserving men. Every body is well pleased to see them restrained by the law and compelled to refund their ill-gotten gains. No tradesman of good repute will have anything to do with such disgraceful transactions. Pass this law: and that feeling is at an end. Men of a character very different from that of the present race of piratical booksellers will soon infringe this intolerable monopoly. Great masses of capital will be constantly employed in the violation of the law. Every art will be employed to evade legal pursuit; and the whole nation will be in the plot. On which side indeed should the public sympathy be when the question is whether some book as popular as Robinson Crusoe, or the Pilgrim's Progress shall be in every cottage, or whether it shall be confined to the libraries of the rich for the advantage of the great grandson of a bookseller who, a hundred years before, drove a hard bargain for the copyright with the author when in great distress?

The Digital Economy Bill is full of language designed to chill the self-publication that empowers authors online.

To me it most resembles the 1865 Locomotive Act, which attempted to protect the horse and carriage trade from meachanical locomotives by requiring that each one was preceded by a man on foot, 60 yards in front, carrying a red flag, and that speeds be limited to 4mph in the country and 2 mph in town.

The Digital Economy Bill, like the Locomotive Act, seeks to prevent what is in its title by constraining it to the limitations of pre-existing businesses that lobby the hardest. It should not pass.

Further Reading:

• Digital Economy Bill the Final Countdown - last plea to MPs before wash up by Lilian Edwards
• Call Your MP
• Three reasons why the Digital Economy Bill will damage British biz and what to do about piracy
• BBC: Call for 'fuller' debate on Digital Economy Bill
• The Digital Economy Bill: Thinking further about copyright by JP

The BPI's China-like clauses in the Digital Economy Bill

In January, Bono from his self-described bully pulpit in the NY Times, called for China-style net censorship to protect 'over-rewarded rock stars':

[...]the people this reverse Robin Hooding benefits are rich service providers, whose swollen profits perfectly mirror the lost receipts of the music business.

We’re the post office, they tell us; who knows what’s in the brown-paper packages? But we know from America’s noble effort to stop child pornography, not to mention China’s ignoble effort to suppress online dissent, that it’s perfectly possible to track content.

Rebecca MacKinnon today released her prepared Congressional testimony on the effects of Chinese net-blocking - I recommend reading the whole thing, but as the British Phonographic Industry took Bono up on his challenge, and wrote internet blocking by BPI fiat into the UK Digital Economy Bill, I thought I'd look at the parallels. A previous draft of the Bill compared poorly to Magna Carta; how does it line up against Chinese practice?

Rebecca MacKinnon:

Filtering or “blocking:” This is the original and best understood form of Internet censorship. Internet users on a particular network are blocked from accessing specific websites. The technical term for this kind of censorship is “filtering.” Some congressional proceedings and legislation have also referred to this kind of censorship as “Internet jamming.” Filtering can range in scope from a home network, a school network, university network, corporate network, the entire service of a particular commercial Internet Service Provider (ISP), or all Internet connections within a specific country. It is called “filtering” because a network administrator uses special software or hardware to block access to specified web pages by banning access to certain designated domain names, Internet addresses, or any page containing specified keywords or phrases.

Digital Economy Bill, Clause 18:

18 Preventing access to specified online locations for the prevention of online copyright infringement
In Part 1 of the Copyright, Designs and Patents Act 1988, after section 97A insert—
“97B Preventing access to specified online locations for the prevention of online copyright infringement
(1) The High Court (in Scotland, the Court of Session) shall have power to grant an injunction against a service provider, requiring it to prevent access to online locations specified in the order of the Court for the prevention of online copyright infringement.[...]
the Court shall order the service provider to pay the copyright owner’s costs of the application unless there were exceptional circumstances justifying the service provider’s failure to prevent access despite notification by the copyright owner.

Note the insidious allocation of costs there, which is designed to ensure that ISPs block access or remove content on accusation, before an injunction is applied for. Here's Rebecca again on how this works in practice in China:

Deletion and removal of content: Filtering is the primary means of censoring content over which the Chinese government has no jurisdiction. When it comes to websites and Internet services over which Chinese authorities do have legal jurisdiction – usually because at least some of the company’s operations and computer servers are located in-country – why merely block or filter content when you can delete it from the Internet entirely? In Anglo-European legal parlance, the legal mechanism used to implement such a system is called “intermediary liability.” The Chinese government calls it “self-discipline,” but it amounts to the same thing, and it is precisely the legal mechanism through which Google’s Chinese search engine, Google.cn, was required to censor its search results.[7]

All Internet companies operating within Chinese jurisdiction – domestic or foreign – are held liable for everything appearing on their search engines, blogging platforms, and social networking services. They are also legally responsible for everything their users discuss or organize through chat clients and messaging services. In this way, much of the censorship and surveillance work is delegated and outsourced by the government to the private sector – who, if they fail to censor and monitor their users to the government’s satisfaction, will lose their business license and be forced to shut down. It is also the mechanism through which China-based companies must monitor and censor the conversations of more than fifty million Chinese bloggers. Politically sensitive postings are deleted or blocked from ever being published. Bloggers who get too influential in the wrong ways can have their accounts shut down and their entire blogs erased. That work is done primarily not by “Internet police” but by employees of Internet companies.[8]

The language of clause 18 reflects this implied goal of "self-discipline" too:

(2)(b) the extent to which the operator of each specified online location has taken reasonable steps to prevent copyright infringement content being accessed at or via that online location or taken reasonable steps to remove copyright infringing content from that online location (or both),
(c) whether the service provider has itself taken reasonable steps to prevent access to the specified online location,

(3) An application for an injunction under subsection (1) shall be made on notice to the service provider and to the operator of each specified online location in relation to which an injunction is sought and to the Secretary of State.
[...](4)(b) the owner of copyright before making the application made a written request to the service provider giving it a reasonable period of time to take measures to prevent its service being used to access the specified online location in the injunction, and no steps were taken,

The Chinese government has also used its control over the domain name system to block dissent. Here's Rebecca's summary again:

Domain name controls: In December, the government-affiliated China Internet Network Information Center (CNNIC) announced that it would no longer allow individuals to register Internet domain names ending in .cn. Only companies or organizations would be able to use the .cn domain.[16] While authorities explained that this measure was aimed at cleaning up pornography, fraud, and spam, a group of Chinese webmasters protested that it also violated individual rights.[17]

Authorities announced that more than 130,000 websites had shut down in the cleanup. In January a Chinese newspaper reported that self-employed individuals and freelancers conducting online business had been badly hurt by the measure.[18] Later in February, CNNIC backtracked somewhat, announcing that individuals will once again be allowed to register .cn domains, but all applicants must appear in person to confirm their registration, show a government ID, and submit a photo of themselves with their application. [19] This eliminates the possibility of anonymous domain name registration under .cn and makes it easier for authorities to warn or intimidate website operators when “objectionable” content appears.

Up to now, the UK registrar has been broadly neutral and independent of the Government, but Clause 19 of the DE Bill grabs new broad powers:

19 Powers in relation to internet domain registries
After section 124N of the Communications Act 2003 insert—
“Powers in relation to internet domain registries

124O Notification of failure in relation to internet domain registry
(1) This section applies where the Secretary of State—
(a) is satisfied that a serious relevant failure in relation to a qualifying internet domain registry is taking place or has taken place, and
(b) wishes to exercise the powers under section 124P or 124R.
(2) The Secretary of State must notify the internet domain registry, specifying the failure and a period during which the registry has the opportunity to make representations to the Secretary of State.
(3) There is a relevant failure in relation to a qualifying internet domain registry if—
(a) the registry, or any of its registrars or end-users, engages in prescribed practices that are unfair or involve the misuse of internet domain names, or
(b) the arrangements made by the registry for dealing with complaints in connection with internet domain names do not comply with prescribed requirements.
(4) A relevant failure is serious, for the purposes of this section, if it has adversely affected or is likely adversely to affect—
(a) the reputation or availability of electronic communications networks or electronic communications services provided in the United Kingdom or a part of the United Kingdom, or
(b) the interests of consumers or members of the public in the United Kingdom or a part of the United Kingdom.
(5) In subsection (3) “prescribed” means prescribed by regulations made by the Secretary of State.

In other words, the Secretary of State gets to decide what counts as misuse, and reputational damage. Clauses 20 and 21 give further powers to take over management of a registry and change it's constitution, again by fiat.

What else does China do? It selectively disconnects people from the net. Here's Rebecca again:

Localized disconnection and restriction: In times of crisis when the government wants to ensure that people cannot use the Internet or mobile phones to organize protests, connections are shut down entirely or heavily restricted in specific locations. There have been anecdotal reports of Internet connections going down or text-messaging services suddenly not working in counties or towns immediately after local disturbances broke out. The most extreme case however is Xinjiang province, a traditionally Muslim region bordering Pakistan, Kazakhstan, and Afghanistan in China’s far Northwest. After ethnic riots took place in July of last year, the Internet was cut off in the entire province for six months, along with most mobile text messaging and international phone service. Nobody in Xinjiang could send e-mail or access any website – domestic or foreign. Businesspeople had to travel to the bordering province of Gansu just to communicate with customers.[20]

Internet access and phone service have now been restored, but with severe limitations on the number of text messages people can send on their mobile phones per day, no access to overseas websites, and even very limited access to domestic Chinese websites. Xinjiang-based Internet users can only access specially watered-down versions of official Chinese news and information sites, with many of the functions such as blogging or comments disabled.[21]

Clause 10 of the Digital Economy Bill makes Localized disconnection and restriction possible through 'technical obligations' imposed on ISPs:

10 Obligations to limit internet access: assessment and preparation
After section 124F of the Communications Act 2003 insert—
“124G Obligations to limit internet access: assessment and preparation
(1) The Secretary of State may direct OFCOM to—
(a) assess whether one or more technical obligations should be imposed on internet service providers;
(b) take steps to prepare for the obligations;
(c) provide a report on the assessment or steps to the Secretary of State.
(2) A “technical obligation”, in relation to an internet service provider, is an obligation for the provider to take a technical measure against some or all relevant subscribers to its service for the purpose of preventing or reducing infringement of copyright by means of the internet.
(3) A “technical measure” is a measure that—
(a) limits the speed or other capacity of the service provided to a subscriber;
(b) prevents a subscriber from using the service to gain access to particular material, or limits such use;
(c) suspends the service provided to a subscriber; or
(d) limits the service provided to a subscriber in another way.

These clauses are in the Bill as it currently stands. They are not scheduled to be debated properly in the Commons. Harriet Harman, as leader of the Commons gets to decide if they are debated. The Open Rights Group has ways to take action, including writing to Harriet Harman and joining the protests in London on Wednesday 24th March.

Steve Jobs calls HTC Great Artists?

In 1996, in Bob Cringely's documentary Triumph of the Nerds, Steve Jobs said:

Picasso had a saying, he said "good artists copy, great artists steal". We have, you know, always been shameless about stealing great ideas.

Here's the video:

Today, Apple's press release says:

“We can sit by and watch competitors steal our patented inventions, or we can do something about it. We’ve decided to do something about it,” said Steve Jobs, Apple’s CEO. “We think competition is healthy, but competitors should create their own original technology, not steal ours.”

Apple has suffered through many patent trolls over the years, and should understand how software patents limit innovation, indeed their consistent position on supporting Open Source Codecs in HTML5 has been that they are afraid of patent lawsuits. So this action can only be seen as an attack on innovation.

Twitter Theory applied to Google Buzz

I wrote a post last year about Twitter theory, and presented on it too so I thought I'd compare how Google Buzz fits in with them or not.

Flow

Buzz is a flow but it does show an unread count, and it's in your email inbox so the implicit pressure to read is there. You're not cued to dip in and out. Also, all replies come to your main inbox, privileging them over the flow from those you chose to follow.

Faces

There are faces of people next to the root Buzzes, tapping into the subtle nuances of trust we all carry in our heads, but not by the replies, making those 'comments from strangers' even more alien.

Phatic

The phatic feel of Twitter is partially there, but at the launch there was much talk of Google 'hiding the irrelevant' so the social gestures where we groom each other may be tidied away by an uncomprehending machine.

The replies from faceless strangers flooding your inbox if you respond to anyone with a large following will put people off interacting socially. The feeling of talking intimately to those you know is replaced by something closer to the 'naked in the school lunchroom' nightmare.

Following

Buzz does pick up Twitters asymmetric following model, and indeed adds a way to create private Buzzes for small groups, both key features. However, these are undermined by the confusing editing process. The Follower/Following editing is only in pop-up javascript dialogs on your Buzz in gmail and Google Profile pages, and because of the auto-follow onboarding, rather opaque. The groups editing is in Google Contacts, but that doesn't show the Followers, Following, Chat Friends, Latitude or other subgroups. There is also no way to see just conversations with those groups.

The overall effect makes it feel more like a Mornington Crescent server than Twitter. I made a Mornington Crescent Buzz account; it seems to fit.

Publics

Twitter's natural view is different for each of us, and is of those we have chosen. We each have our own public that we see and we address.

The subtlety is that the publics are semi-overlapping - not everyone we can see will hear us, as they don't necessarily follow us, and they may not dip into the stream in time to catch the evanescent ripples in the flow that our remark started. To see responses to us from those we don't follow, we have to click the Mentions tab. However, as our view is of those we choose to follow, our emotional response is set by that, and we behave more civilly in return.

Buzz reverses this. The general comments from friends are in the Buzz tab, but anyone can use '@' to mention you, forcing the whole conversational thread into your inbox. Similarly, if you comment on someone else's Buzz, any further updates to the web show up in your main email inbox. The tragedy of the comments ensues, where annoying people can take over the discussion, and their replies are privileged twice over those you choose to follow.

This is the YouTube comments problem yet magnified; when all hear the words of one, the conversation often decays.

Mutual media

By bringing in Twitter,blogs, Google Reader shared items, photos and other Activity Streams feeds, Buzz has the potential to be a way to connect the loosely coupled flows those of us who live in the listening Web to the email dwellers who may left behind. By each reading whom we choose to and passing on some of it to others, we are each others media, we are the synapses in the global brain of the web of thought and conversation. Although we each only touch a local part of it, ideas can travel a long way.

If the prioritisation of secondary commentary and poking over collated ideas can be reversed in Buzz, this could be made to work.

Small world networks

Social connections are a small-world network locally strongly-connected, but spreading globally in a small number of jumps. The email graph that Buzz taps into may be a worse model of real world social networks that articulated SNS's like Facebook, but it could be improved if the following and editing models are fixed.

Buzz's promise is that it builds on Activity Streams and other open standards, so it could help encourage others to do this better.

Standards are the links of the Social Web

Mike Arrington wrote a plea for better social software on Sunday:

The online social landscape today sort of feels to me like search did in 1999. It’s a mess, but we don’t complain much about it because we don’t know there’s a better way.

Everything is decentralized, and no one is working to centralize stuff. I’ve got photos on Flickr, Posterous and Facebook (and even a few on MySpace), reviews on Yelp (but movie reviews on Flixster), location on Foursquare, Loopt and Gowalla, status updates on Facebook and Twitter, and videos on YouTube. Etc. I’ve got dozens of social graphs on dozens of sites, and trying to remember which friends puts his or her pictures on which site is a huge challenge.

What enabled Google to solve the search problem was a common standard for expressing pages and the links between them, so that they could index the webpages and derive a metric for which ones were more important. They didn't do this by replacing the web with a structured database that they curated, they worked with the standards in use to make sense of it.

To solve the social conundrum we need the equivalent - agreed standards in widespread use so that we can generalize across sites. Fortunately, we have these. We have OpenID and OAuth for delegated login; we have XFN, other microformats and Portable Contacts for public and private people connections; we have Feeds and Activity Streams for translating social actions between sites.

This enabling social infrastructure means that we'll be able to have a new generation of sites that enhance our web experience through social filtering without our connections being centralised in a single company's database.

Once we get used to the experience of being able to delegate login, personal connections and activity updates, we'll look askance at developers who insist we create yet another profile and invite all our friends by email to experience their site; it'll be like a website without links.

iPad is the web made physical

What I wanted from the iPad—a very high-pixel-density HD screen in a small device—didn't happen. But in the commentary of my techie colleagues like David, Alex and Tim, I'm seeing another disappointment. They're saying 'this isn't a computer like I grew up with'. It's not the generative machine that can be bent to our will to do anything, it's a display device.

Now this is true, but it reminds me of programmers complaining about the Web, as opposed to native applications. The Web is something that started out as a display medium, but is now the platform we all expect to build our applications on, precisely because it is an abstraction that comes between us and the particular hardware our users are running. The web is an agreement on how to phrase things.

The iPad picks up this agreement and delivers on it in a new form, but exceptionally well. When the iPhone was launched, I said that the web was the one standard even Steve Jobs can't ignore. This is reinforced by the iPad - it opens with web browsing, and the Book format adopted, ePub, is built on HTML.

I would prefer it if anyone could distribute native apps for the iPad, but we all can create websites.

The big difference the iPhone brought, and that the iPad builds on is the pervasive ability to zoom in and out easily. I think that this will lead to a change in how we think about user experience, with the deep zooming experience we are familar with from Google Maps and now Prezi becoming natural in more and more apps.

Audio, Video, HTML5 and standards

The chaps at Mozilla, Christopher Blizzard and Robert O'Callahan reopened the HTML5 <audio> and <video> debate yesterday, with a spirited defence of their decision to support only the patent-unencumbered* Ogg format and Vorbis and Theora codecs in Firefox releases as part of their HTML5 support.

Now, I understand their motives here - back when I was at Apple, I spent a big chunk of time trying get permission to add support for Vorbis to QuickTime, but didn't manage to get it past Apple management's fears. However, all the browsers I use now claim to support HTML5 <audio> and <video>, so I thought I'd try it out. I made some simple test pages using mp3, .au and WAV files, to see how they were supported.

What I found was a bit disappointing - it seems that the way that the spec is written, you can support <audio> but no file formats or codecs at all (my Droid does this), and if you can't play the file you're not supposed to show the fallback HTML contents

This means that Firefox, Droid won't show the link to the audio file below:

though browsers that don't support <audio> at all will. Here's the markup:
<audio src="http://homepage.mac.com/kevinmarks/dystopia.mp3" controls><a href="http://homepage.mac.com/kevinmarks/dystopia.mp3" type="audio/mpeg"> Looking Up From Dystopia </a></audio>

However, if I use a direct link or an embedded <iframe>, Firefox will use available plugins to play the file (both Flash and QuickTime happily play mp3's). Thus using <audio> give me less compatibility with current browsers.

On phone browsers, odder things happen - iPhone gives a clickable button for the <audio>, but auto-loads an <iframe>; Droid ignroes iFrames, Palm Pre doesn't have <audio> but <iframe> behaves like the iPhone.

Smarter behaviour with declarative audio would be nice here.

*Submarine patent trolls keeping periscopes down may exist.