Phil Windley's Technometria

« November 2004 | Main | January 2005 »

December 28, 2004

Getting Ready for Next Semester

I spent the morning getting the Web site and course projects ready for Concepts of Programming Languages next semester. I love that class. This afternoon, I'm headed up to the Capitol for a meeting.

1:36 PM | Comments () | Recommend This | Print This

December 27, 2004

The Philippines Contemplating a Step Towards Greater Connectivity

Thomas Barnett would call this article about a bill before the Philippines' Congress to reclassify VoIP an impending "rule-set rewrite." If you follow Barnett at all, you'll know that he places countries in what he calls the Gap or the Functioning Core. The Gap is the set of countries who are disconnected from the functioning Core in many respects. The Philippines is inside the Gap.

This bill represents a change to the laws of the Philippines that would make it easier for network provides to offer VoIP phone services in competition with established telecom providers. Monopoly telecom providers are one problems that Gap countries face. Telecommunications are expensive and often shoddy. This bill represents a small step in connecting the Philippines. Don't expect the telecom providers with franchises to take this lying down. I've set up a Google news alert to try to follow this bill and see what happens.

One of the reasons I like reading things like Barnett's The Pentagon's New Map and Bobbitt's The Shield of Achilles is that the give me a framework for understanding events like this Philippines telecom bill. Without that framework all this news is just so much noise washing over you. With a framework, it starts to paint a picture.

1:03 PM | Comments () | Recommend This | Print This

Open Source Audio

Jon Udell has create a podcast he calls open source audio. In it, Job gives us a tour of the Internet Archives open source audio collection and introduces us to OddioKatya and other WebJay's. Jon asks the question:

What if there were a significantly large space of alternatively licensed music floating around on the Internet? Music that was explicitly intended to be shared.

One of the things that the music industry has failed to capitalize on is the kind of collective discovery that is one of the foundational pillars of blogging. Blogs are a way of building awareness around interesting ideas. Flickr is doing that with photos. There's no good way to do this with most music. When I was a kid, we spent countless hours talking about what music was good and playing it for our friends on our 8-track players (yes, I'm that old). My teenage son does the same thing now, with his local friends, but he has plenty of friends on the net as well and music isn't part of their collective experience. This is a huge opportunity wasted.

Jon also points to Chris Armstrong's Long Tail article from Wired. The idea is that Amazon and other Web sites enable sales of material that have a limited audience. I was out looking at sales rank at Amazon the other day to a number of books. Try it for some of the books in your library. I was fascinated to see how popular (or unpopular) some books are that I've loved.

Jon did a great job on this Podcast; its content is good and its well delivered. Listen to it.

12:38 PM | Comments () | Recommend This | Print This

Evelyn Slammed By Tidal Wave

Evelyn Rodriguez, whom many in the Utah Tech community will know for her work organizing several events on Web Services over the last few years, was on a boat in Thailand when the tsunami struck. She's in the hospital for what appear to be minor injuries and is well enough to blog. I'm glad she's OK and wish her well in getting all her belongings, including her passport back.

11:43 AM | Comments () | Recommend This | Print This

December 24, 2004

More Flying Photos

If you like pictures of flying, I've posted a batch from the flight Steve and I made this morning. I flew both directions since I don't get out as much as I'd like.

2:43 PM | Comments () | Recommend This | Print This

December 23, 2004

Cell Phone Fan Learns Some Lessons About Blogging

A few days ago, the Cell Phone Fan blog posted a wildly off-target post about the arrogance of alpha-bloggers. He specifically attacked Doc Searls. Now, he's aghast that people are reading and responding to his post. Welcome to the blogosphere!

What's really interesting is that Doc linked to his post and now Cell Phone Fan wants Doc to remove the link. That's not how it works. You don't get to decide who links to or reads a public entry. If you put it on your blog, then its fair game. Lesson number 1 of writing a blog.

The sad thing about this is the Cell Phone Fan has it all wrong. First, blogs are not about fame for deeds like writing code, they're a method of transmitting information. I read Doc's blog because I like how he thinks and appreciate how he's challenged my thinking on a number of levels. I'm not alone. That is one of Doc's many contribution ands its valued by the people who read his blog.

The irony is that Doc is one of the nicest guys I know and that is the basis for much of his popularity. Cell Phone could learn some lessons there as well.

11:33 AM | Comments (1) | Recommend This | Print This

December 22, 2004

Adobe Fallout and Resolution of Adobe Download Manager Problems

Saturday, I complained that Adobe had sold me a piece of software and then failed to deliver. The problem was the download manager dumped core as soon as it started up. I sent an email to Adobe support and got back a long list of instructions. They didn't help. Here's my second note to Adobe:

No joy. I followed these instructions. The ADM downloads and when I launch it, it says "Safari, IE, and Mozilla must quit to run this application" I say OK, it kills the browser windows, runs the installer (which installs ADM as Applications:Utilities:Adobe Download Manager), and then launches ADM. Almost immediately, I get "ADM has unexpectedly quit. Submit a report?" I'm running OS X 10.3.7.

Adobe responded with a note that was so general that I wondered if they any idea of the history:

Hello Phil,

Thank you for contacting Adobe Customer Service.

It could be that there are download managers within the browsers that you have mentioned that could be conflicting with the Adobe Download Manager.

It appears your order for the Photoshop Elements 3.0 has been 'requested' as you have begun the download.

I am re-enabling the product. The download manager should be replaced with an updated version and the download should proceed accordingly.

I hope this information helps to resolve your issue with downloading your Photoshop Elements 3.0 to your computer. If the issue is not resolved please call the customer service number below for more immediate service.

For more information on Adobe¨ products or services please visit us at: http://www.adobe.com or contact Adobe customer services at 1 (800) 833-6687. Customer Service Representatives are available 6:00am-8:00pm PST, 7 days a week.

Best Regards,

Jacqueline S.
Adobe Customer Service

I struck out on my own and found out that not only does the ADM install itself in Applications:Utilities, but it also puts a plug-in in ~/Library/Internet Plug-ins. I deleted both the ADM application and its plug-in and, viola, things works. Apparently ADM can't deal with an old version of its own plug-in and doesn't overwrite it or check it. So, I'm in business, three days later, no thanks to Adobe Support.

3:45 PM | Comments (1) | Recommend This | Print This

Using Virtualization in Software Testing

The January 2005 issue of Dr. Dobb's Journal contains an article (unfortunately not available online) by Sam Tregar on using Perl and VMWare GSX to test builds of Krang. Rather than having a large farm of machines with various versions of perl and the OS on each machine, he used VMWare to build all of these environments on a single machine. A set of Perl scripts called Krang Farm that controls VMWare and automates the building and testing on each environment. He uses GSX since the personal version of VMWare isn't scriptable. GSX and ESX provide Perl and Com APIs that you can use to control the virtual machines.

Besides scriptability, one of the key features of VMWare that makes this application a perfect use of virtualization is VMWare's non-persistent mode. In non-persistent mode, any disk actions are simply forgotten when the machine is halted and the image returns to its original state. This is a great feature in a testing environment, where you always want to start in a known-good state.

The why comes down to this simple analysis:

• Building and hosting a farm of six machines costs $18,000 in capital expenditure and another $14,000 per year in operating costs (mostly hosting). Each new environment requires another machine which adds $3000 to the capital costs and $2400/year to the hosting bill.
• The virtual farm costs $6775 in capital costs and $2400 per year to host. Adding a new environment is free.

Moreover, the virtual solution is more flexible since new environments can be created at the drop of a hat whereas adding a new machine requires planning, staging, and deploying real hardware.

The downside is the rather obvious point that the virtual solution doesn't scale as well as the hardware solution. In this application, it doesn't need to. Your milage may vary.

Another use Sam gives for the farm, which is not yet implemented, is testing upgrades. Pretty easy to have an environment that represents each version of your software and automatically apply upgrades to them as part of your regression testing.

This is a great article on using virtualization as part of a software testing environment--made even better by its hands-on nature. If you do software testing and haven't started using virtualization, this article will help you understand why you should.

3:20 PM | Comments () | Recommend This | Print This

December 21, 2004

Omniture: On-Demand Web Analytics

I spent some time with Omniture this afternoon. I knew these guys pretty well when they were MyComputer.com. Omniture (nee' MyComputer.com) has always been in the ASP space (now called "on-demand applications") and they were one of the early innovators. I remember seeing Josh James at least a dozen times on the plane between SLC and Silicon Valley in the old days. I didn't really believe that the ASP model would work for analytics then, but now its the only model I can imagine using. I'm not alone in that--many Fortune 500 companies use Omniture and an on-demand application model for analytics.

The biggest reason this model is a winner in analytics is what's called "global roll-ups." By that, I mean that Omniture and other on-demand analytics tools allow Web sites on multiple hosts and with different domains to be treated as a group and analyzed as a group. At iMall, we spent a lot of time building tools to create analytics from dozens of hosts and domains. If I were making that decision now, I'd just use Omniture or something like it.

A recent Jupiter Research study asked CIOs what web site technology they were going to deploy in the next year. Web analytics was first with almost 60%. Search technology was second with 52%. This isn't too surprising--people need to measure things to justify ROI.

I've used Webstat.com to track visitors to this blog and my UtahPolitics.org blog for over a year now. The idea is the same, but Omniture is much more sophisticated. They're customer list reads like a who's who of online companies. The sophistication is based on custom variables that are put on pages so that Omniture can segment traffic according to things that aren't typically part of a standard Web page request.

Omniture's reporting it really impressive. When you see how they generate fallout reports on custom tracks through a site, you'll understand why they have the customer list they do. This kind of information is pure gold and not something you get from run-of-the-mill Web analytics tools.

Understanding behavior relies on not just seeing what visitors do, but also understanding the changes in behavior in the context of what is happening on the site. Say, you're drop-off rate decreases. You'd like to know why. That implies that the Web analytics ought to be tied into the content management system in some way, or be able to track changes on the site to show behavior changes in light of site changes.

Omniture doesn't really solve this problem (one of the downsides of on-demand models), but they have a tool called A-B comparison. The tool lets you pick a date range and show metrics from those dates side by side. To see the behavior in light of page changes, you'd have to encode those changes somehow in the page variables. This may not be manageable for random page changes, but its very manageable in a situation where you can randomly show different users different pages and use A-B comparison to measure the response to those pages.

I was surprised to find out that Omniture doesn't yet have a way to feed real time analytics information out to their customers. Right now, its pretty much their dashboard or nothing. I'd like to be able to take their data in real time and combine it with data from my business in something like Iteration. That's the future of business intelligence and a critical feature for any company hoping to sell me analytics of any kind.

I suspect that Omniture is trying to figure out how to provide the data and still provide sufficient value that they don't get disintermediated. The answer is to not provide raw data. Instead, provide report building tools that allow me to create custom data feeds that merge, filter, and sort the raw data into custom reports that come across as XML instead of HTML.

I haven't really followed Omniture for a couple of years, so its was good to catch up with the company and their technology. Another positive data point in the on-demand application space.

6:26 PM | Comments () | Recommend This | Print This

Interview for Marketplace on Corporate Blogging

I was interviewed yesterday by Bob Moon of the public radio show Marketplace. The topic was using blogs inside the corporation. The show will probably air sometime this week, I'll link to it once it does.

11:28 AM | Comments () | Recommend This | Print This

BYU Tie to Discovery of Google Flaw

One of the students at Rice University who discovered the security hole in Google's desktop search tool was a recent graduate from BYU's M.S. program, Seth Nielson, who's now pursuing his Ph.D. at Rice with Dan Wallach (of eVoting fame). Apparently, the flaw was found as part of a class project at Rice. Google was immediately notified and given a chance to fix the flaw before the problem was made know publicly. Reportedly Seth has been offered an internship at Google this summer. :-) Here's a technical report (PDF) that gives the details.

11:09 AM | Comments () | Recommend This | Print This

Customer Interaction Hubs and System Integration

Customer interaction hubs is the term Gartner coined (and now Forrester and others are using) to describe the integration of every customer interaction system under a single, unified strategy and vision. I wrote about customer interaction hubs, or CIHs, in a Connect Magazine column earlier this year. I think they define an important next step in enterprise systems.

A recent article in CRM Daily, asks if the customer interaction hub is within reach. One thing I've believed for some time, and the article points this out as well, is that a CIH is not something you buy from a vendor, it follows from a strategy and results from integrating myriad systems into an infrastructure that flexibly meets business needs. Interestingly, that same sentence is something I've said about digital identity infrastructures. Furthermore, I think the methods that are used to create digital identity infrastructures are the same ones you need to create a CIH inside of your company. The real winners in the CIH space won't be product vendors (although they'll do alright), it will be the systems integration companies that help companies create and execute a CIH vision.

9:28 AM | Comments () | Recommend This | Print This

OSBC2005: A New Twist

Matt Asay, cofounder of the Open Source Business Conference, writes that he's "reclaiming the conference from the sponsors:"

This year, the Open Source Business Conference has made a conscious decision to seek less sponsorship money. Our goal is to deliver cutting-edge content on open source trends and how they affect the enterprise, both CIOs and vendors to those CIOs.

Our keynotes have been solicited based on their intelligence and insight, and not on their ability to pay. That's why we have Jonathan Schwartz (President and COO, Sun Microsystems), Marten Mickos (CEO, MySQL), Larry Lessig (Author, Free Culture and professor at Stanford Law School), Geoffrey Moore (author, "Crossing the Chasm"), and others keynoting. Others will be announced soon, including some high-profile speakers that will surprise many because of their seniority in the industry, among other reasons.

There will be no vendor pitches from the OSBC pulpit in 2005. We're reclaiming the conference from the sponsors. It will be more like DEMO or D or OSCON, and less like Linuxworld (vendor exhibition) or the various CIO conferences (which are really just glorified vendor pitches).

From IT Manager's Journal | Open Source Business Conference, 2005: What price integrity?
Referenced Tue Dec 21 2004 07:35:33 GMT-0700

This is partly in response to some criticism from me after last years conference. In all, I thought the conference was great and it looks like Matt is taking steps to capture some new energy and make it even better this year. If you're interested in how business can use and profit from open source, this is the conference to attend. You won't be disappointed.

7:42 AM | Comments () | Recommend This | Print This

December 20, 2004

The Price of Enterprise IT

Large organizations create enterprise IT infrastructures that are homogeneous in the extreme. This is a form of self defense. It's hard to support users when there's no boundaries, not to mention more expensive. There's a hidden cost to this however. Here's a quote from a recent article on the reluctance of IT vendors to put Firefox on the desktop when they sell to corporate IT department because of this very issue:

Mike Hong, manager of Special Purpose Systems Inc. (aka Computers & Applications), a Bellevue custom solutions provider, said, "Nobody wants to put something on, whether free or for a price, unless someone asks for it," Hong said.

"Corporate America is sometimes used as a guinea pig when new technology comes out. IT departments have been used for that and have run into problems and spend times fixing errors and bugs, and most of them are shying away and waiting until everyone has run through it and taken the bugs out," Hong said. "A new technology is not necessarily what corporations really want. Consumers want new toys, but corporations don't want them. They have to expense for bugs, for support and for implementations," he said.

From Resellers Not Embracing Firefox Despite Its Popularity
Referenced Mon Dec 20 2004 14:56:59 GMT-0700

The interesting thing to note here is that corporate IT users are unable to use many of the more innovative products and applications that consumers use everyday. Does this put them at a disadvantage? Maybe. A better moral, perhaps, is that if you're an IT vendor hoping to sell to the Fortune 2000, then you're better off with a hosted application than with something that has to be downloaded and installed. Touching the desktop is becoming more and more difficult everyday. Bypass that and you're more likely to make the sale.

4:21 PM | Comments () | Recommend This | Print This

Short Takes on Python, Surveillance, and iPod Tax

Some short takes on news from the end of last week:

• Dana Blankenhorn asks whether to teach his son Python or Java. He got a lot of comments. Almost everyone brought their crusader's sword and shield. As someone who's been in these discussions since the mid 80s (although then it was Pascal or Scheme), I can tell you that everyone will have an opinion and facts to back them up. I offer my two cents: Don't teach him a programming language; teach him to program. Grab a copy of Structure and Interpretation of Computer Programs and DrScheme. If he works his way through that, he'll be able to pick up Java or Python and make them work without much trouble.
• A recent Slashdot article makes much of the fact that new USPS stamp machines take your picture when you buy stamps and asks the question: "As the cost of cameras and digital storage approaches zero, is it inevitable that every machine you interact with will take your photograph and store it?" The answer is "yes."
• Canadians have been paying a $25 tax (that's roughly 50 cents American) on every MP3 player to pay musicians and record labels for the copying that would occur when the devices were used. A Canadian judge has thrown that out saying that "MP3 player fees did not seem to be supported by the letter of the law." So, its back to Parliment.

10:07 AM | Comments () | Recommend This | Print This

December 18, 2004

I'm Pissed Off at Adobe

I wanted to buy Adobe Photoshop Elements this afternoon to do some photo editing. I went to Adobe's web site and went through all the steps necessary to purchase it. When I was done, it told me I had to be in Internet Explorer for the download to work, so I quit Safari and started up Internet Explorer and started the download. It doesn't actually download the file, it downloads the "Adobe Download Manager." Upon installation, the thing fires up and just dumps core. The little Apple "the application unexpectedly quite" message pops up and its all over. Rebooting doesn't help.

That was bad enough, but what really made me mad was that their site had nothing but rudimentary help on downloading stuff you've just purchased (like how to start your browser) and nothing of any sophistication. So, I just found the form to send in a help request. The form made me fill out about two dozen fields, most of which were completely irrelevant to the problem (like what time it occurred). To add insult to injury, they couldn't even pre populate it with things they already knew (since they made me log in). This is not the way to sell things online.

3:59 PM | Comments () | Recommend This | Print This

December 17, 2004

Strategic Planning and Tactical Deployment in the Applistructure

One of the big complaints around enterprise applications has always been their large monolithic nature. Deploying these applications is so difficult that its the stuff of legend. Large businesses exist simply to integrate them into the enterprise and make them interoperate with legacy applications. When I was CIO for Utah, we started a project to put in SAPs payroll system. We had to hire Cedar to install and customize it for us.

Meanwhile, another development is enterprise applications is on-demand services like Salesforce.com. The great thing about on-demand applications is that they can be deployed tactically. An SVP of Sales with a corporate AMEX card can order up Salesforce.com on his lunch hour and have his team using it the next day. Nothing to deploy and, more importantly, no painful interaction with the CIO.

Enterprise applications like SAP, PeopleSoft, or Siebel, on the other hand, are strategic in nature. To deploy one, you have to plan (a lot), budget, initiate a project, and assign people. Of course, if you're successful (and I stress if), you have automated major parts of your business, cut your operations costs, and increased your ability to monitor your business. You may have also just set in stone the business process that the SVP of Sales wants to change the week after the project ends.

Right now, Salesforce and its competitors are a small part of overall enterprise application space. CIOs tend to view them with interest, but don't pay much attention to them. I think that's going to change. To understand why, let me differentiate strategic planning from strategic deployment. Large monolithic enterprise applications are both strategically planned and strategically deployed. The problem with the SVP of Sales just ordering in Salesforce.com over lunch is that while the deployment is easy (call it tactical), the planning isn't there. Pushed to its extreme, you end up with a hodgepodge of automated business processes that don't work together.

Enterprise applications vendors are providing Web services interfaces to smaller and smaller pieces of their applications. Consequently, these applications start to look like infrastructure. Some people are calling them "applistructure." This applistructure represents large chunks of business processes just waiting to be put together in interesting ways.

To make use of this applistructure, there are two things that have to happen. First, vendors need to create business models that allow smaller parts of their large applications to be heated up on demand. We also need to see an increase in the number of business processes that are available in the on-demand model. Right now, you're pretty much limited to salesforce automation, some call center services, and payroll. There will be more.

Second, and more importantly, organizations need to be able to create strategic plans for their business that don't revolve around a deployment project. Many IT shops use system deployment as their chief organizing principle and that's a mistake--it usually doesn't serve the business. IT shops need to plan around business needs. This is just another way of saying that IT organizations need strong enterprise architectures. Enterprise architectures provide a context within which various groups can quickly and flexibly deploy IT services. Done right, an enterprise architecture allows decentralization of the deployment without a concomitant degradation in interoperability. This creates a way for tactical deployments to be driven by strategic goals and the result is a more flexible IT organization that's aligned with business needs.

1:54 PM | Comments () | Recommend This | Print This

Dave McNamee's Re-Entry

Dave McNamee has re-entered the blogosphere.

7:52 AM | Comments () | Recommend This | Print This

December 16, 2004

CIO Resolutions for 2005

Gartner came up with a list of their top 10 CIO resolutions for 2005:

1. Create alternative plans for the unpredictable year.
2. Decide whether they want to be technology managers or business managers with IT knowledge, and invest in the appropriate skills.
3. Use regulatory compliance demands to invest in related, strategic areas.
4. Get the IT staff media-ready and try to foster external public relations.
5. Drop "on time and on budget" as a key performance indicator for IT staff, noting that this a basic requirement. Set new performance indicators above and beyond that.
6. Get hands-on experience on some new key technologies.
7. Combat IT complexity by creating simplification policies.
8. Elevate business process thinking to the management level, by deciding the process first and applications second, for example.
9. Build a relationship and collaborate with the human resources director on strategy for IT staff changes.
10. Critically review the capability of your IT organization and it leaders.

This is from a story in InfoWorld out today. Most of this seems like the same old stuff, but a few of these did catch my eye.

Number 3, using regulatory requirements to enable investment in related areas, is a critical way for CIOs to get things done that usually get swept under the rug. An example is data architecture development--you can never find the money to do that. To make this work, however, you've got to have a strategy in place to begin with. This is great way to accomplish long term objectives from short term requirements.

Number 6 is also something most CIOs could stand more of. CIOs desperately need to understand new technologies, but have a tough time finding the time to do more than read a few magazines in the bathroom. A few suggestions: First, keep reading this blog. :-) More seriously, create an informal advisory board of a few people who are keeping up with the trends and take them to lunch once a month or so. Send them a nice Christmas present next December. Another approach is to do something more formal such as hiring a consultant or two and make them your private tutors. Meet with them once a month for a few hours and have them come prepared to teach you about something you need to know but haven't had the time to keep up with.

The last resolution is always important, but may be crucial this year. As the tech economy heats up (and I'm seeing plenty of signs that it is), good people are going to get harder to find and some of your good people are going to leave. Proactively managing staff issues and upgrading where necessary will save some headaches down the road.

4:50 PM | Comments () | Recommend This | Print This

December 15, 2004

Hollywood Wants BitTorrent Dead

A Wired article today has the bold headline Hollywood Wants BitTorrent Dead.

In the United States and the United Kingdom, the Motion Picture Association of America, the main lobbying arm of U.S. film studios, filed civil lawsuits against more than 100 operators of BitTorrent "tracker" servers that point to locations where digital files of movies, music and other content can be found.

From Wired News: Hollywood Wants BitTorrent Dead
Referenced Wed Dec 15 2004 19:27:05 GMT-0700

BitTorrent is a protocol that can be used to transfer large files. Clients are simultaneously servers so that the originator of a popular file doesn't have to pay the full cost of its distribution. More importantly, the protocol's performance improves as its popularity increases since there are more servers to take up the load. This makes it an important technology for distributing everything from podcasts to Linux ISO images. This analogy might help explain:

One analogy to describe this process might be to visualize a group of people sitting at a table. Each person at the table can both talk and listen to any other person at the table. These people are each trying to get a complete copy of a book. Person A announces that he has pages 1-10, 23, 42-50, and 75. Persons C, D, and E are each missing some of those pages that A has, and so they coordinate such that A gives them each copies of the pages he has that they are missing. Person B then announces that she has pages 11-22, 31-37, and 63-70. Persons A, D, and E tell B they would like some of her pages, so she gives them copies of the pages that she has. The process continues around the table until everyone has announced what they have (and hence what they are missing.) The people at the table coordinate to swap parts of this book until everyone has everything. There is also another person at the table, who we'll call 'S'. This person has a complete copy of the book, and so doesn't need anything sent to him. He responds with pages that no one else in the group has. At first, when everyone has just arrived, they all must talk to him to get their first set of pages. However, the people are smart enough to not all get the same pages from him. After a short while they all have most of the book amongst themselves, even if no one person has the whole thing. In this manner, this one person can share a book that he has with many other people, without having to give a full copy to everyone that's interested. He can instead give out different parts to different people, and they will be able to share it amongst themselves. This person who we've referred to as 'S' is called a seed in the terminology of BitTorrent.

From Brian's BitTorrent FAQ and Guide: What is BitTorrent?
Referenced Wed Dec 15 2004 19:30:47 GMT-0700

If you read the Wired article, you'll see that what the MPAA went after was something called tracker sites.

BitTorrent, eDonkey and Direct Connect allow millions of internet users to share copies of movies, music, software and games. The services don't host the files themselves; instead, they point users to other users who have the files available for sharing. In BitTorrent's case, users tap tracker sites that keep dynamic lists of where files are stored and available for download. The MPAA is trying to cripple BitTorrent and its peers by suing people who host the tracker servers. Because of its efficiency in helping users handle very large files -- such as digital copies of feature-length films -- BitTorrent has attracted the enmity of Hollywood.

From Wired News: Hollywood Wants BitTorrent Dead
Referenced Wed Dec 15 2004 19:38:08 GMT-0700

This makes it sound like tracker sites are analogous to the search server in the old Napster, but that's not really the case. The tracker is similar in that its the only centralized piece in all of this. It serves a different function, however. The tracker is a server that coordinates the trading of the various bits of the file. Trackers do not have any knowledge of the content of the files and aren't used to find the original file. Their limited duties make them fast and able to support large numbers of users with limited bandwidth. Note that unlike Napster, there's not just one tracker. Every file being distributed could, potentially, have its own tracker.

If you read the article without a clear understanding of what a tracker does, its easy to think that the MPAA just went after "the bad guys" and that trackers being used to legally coordinate the distribution of other material could remain untouched. But how can you tell which is which? It would seem to me that someone running a public tracker is in the same position as an ISP or common carrier. They don't know the content and therefore can't be held responsible for it.

7:49 PM | Comments () | Recommend This | Print This

December 14, 2004

Sleepycat Releases Next Version of DbXml

Sleepycat Software has released Version 2.0 of their XML database. Here's what the announcement said:

Berkeley DB XML is a native XML database engine for use within your product. Made available as a C++ library with language bindings for Java, Perl, Python, PHP and Tcl Berkeley DB XML integrates directly into your application, it is not a standalone database server. Berkeley DB XML provides XQuery access into a database of document containers. XML documents are stored and indexed in their native format using Berkeley DB as the transactional database engine. Berkeley DB XML is one of the most sophisticated and reliable native XML database engine available today. The important new features and benefits of Berkeley DB XML 2.0.7 include:

• XQuery 1.0 and XPath 2.0 (July 2004 draft)
• Node or whole document based storage
• Optional document validation
• Sophisticated document indexing to speed query access
• C++, Java, Perl, Python, TCL and now PHP APIs
• Command line access to document repositories

I've used an earlier version this database in several projects and have really liked it. Its not a standalone server, so its really a great way to add lightweight persistence to an application without the set-up hassles of MySQL or some other DB server.

10:20 AM | Comments () | Recommend This | Print This

Gillmor Gang on Digital Identity

Doug's posted the digital identity show we recorded on The Gillmor Gang last Friday.

7:49 AM | Comments () | Recommend This | Print This

December 13, 2004

XmlHttpRequest and Dynamic Web Pages

In case you were wondering, Gmail and Google's new suggest feature use something called XMLHTTPRequest along with DHTML to perform their magic. I believe Canyon Bridge is using these technologies, but have a complete toolkit that makes generating these kinds of Web applications easier. Maybe we're about to see a renewed interest in building richer Web applications? One can only hope.

10:48 AM | Comments () | Recommend This | Print This

Mike Leavitt to Head HHS

President Bush has announced that he will nominate Mike Leavitt as Secretary of Health and Human Services. I have to admit that I didn't see that one coming at all.

10:08 AM | Comments () | Recommend This | Print This

December 11, 2004

Small and Large Scale Connectivity

Lately I've been grabbing everything I can about Thomas Barnett's new book The Pentagon's New Map (PNM). I bought the DVD from CSPAN and watched it with my sixteen year-old son who thought it was "very interesting."

In the Nov 5th edition of the Gillmor Gang which I remixed, Jon Udell pointed out how much of Barnett's language is taken from, or at least parallels, the language of IT. Words like rule-sets, system administrator, connectivity, and so on lace his speech.

This morning, I was reading in PNM and came across this passage (page 53):

Let's not kid ourselves, most of the rule-set changes proposed since 9/11 focus on war and the military management of "empire." ... [T]he rule-set reset we seek is far larger than simple keeping the barbarians at the gate, which--frankly--is what virtually every discussion of "American empire" is really about. In effect, America's avowed goal should be extending our culturally neutral, rules-based "civilization" called globalization, because if we do not all live on the same basic rule-set, there will always be a globalization hierarchy by which some rule and others are ruled.

Later, Barnett talks about isolationism (page 159):

The more mainstream response from the right focuses on the notion that shrinking the Gap is simply too big a problem for the United States to take on--militarily or otherwise. Instead, they bluntly advocate a sort of civilizational apartheid that strikes me as the mirror image of what I believe many violent anti-globalization forces would also prefer--including Osama bin Laden. Rather than fix the Gap, these respondents prefer segregation. The most common way this gets expressed is the idea that if America would only end its dependence on foreign oil, illegal narcotics, and cheap immigrant labor, we could just build a but fence around this nasty neighborhood called the Gap and now have to deal with it anymore.

What struck me about these passages (and many other similar ideas) is how not only the language, but indeed, many of the concepts and drivers parallel those faced by IT.

One of my favorite themes is how new models in IT, such as Web Services, change the nature of the IT security landscape in fundamental ways. In fact, its the primary motivator in my upcoming book on Digital Identity and, I believe, lies at the heart of the increased interest in that topic by many. Here's what I wrote a year ago:

In his book, "The Age of Access," Jeremy Rifkin argues that economic shifts over the last several decades have given rise to a regime where anonymous transactions are nearly impossible. In a service-based economy, digital identity matters; I have to know who you are in order to sell you access to my service. Since these services are increasingly delivered over digital networks, businesses need reliable, secure, and private means for creating, storing, transferring, and using digital identities. Understanding how your organization will manage and use digital identity is a crucial part of your business strategy.

In addition to identifying customers so that you can sell them services, business have an increasing need to identify employees, systems, resources, and services in a systematic way to create business agility and ensure the security of business assets.

In the past people have thought of security as an edge game. Given a firewall and access control to the network, we can do a reasonable job securing a business. However, the economic shifts spoken of above have driven the need to integrate systems, not only internally, but with trading partners and customers as well. This has been fueled by XML and the creation of standards for exchanging data and the increasing trend to decentralized computing embodied in Web services. This trend has a huge ramification for business security: we can no longer treat the edges of the network as a secure perimeter.

When integration is driven by business, rather than IT needs, security policies need to talk about documents, data, actions, people, and corporations instead of machines and networks. This security model is infinitely more complex than the old "secure perimeter" model. But even if you define your policy, how do you ensure that it is properly implemented across dozens or even hundreds of systems and at the same time control access to fields of a database or paragraphs of a document?

From Phil Windley | Business Driven Identity Management
Referenced Sat Dec 11 2004 15:08:59 GMT-0700

In many ways, even the motivations are similar, albeit vastly different in scale. Business are increasing their connectivity to outside partners, suppliers, and customers in an effort to increase productivity and, ultimately, profits. While Barnett is talking about security and war, over and over, he states that the motivations for seeking greater connectivity are nothing less than prosperity for a larger portion of humanity.

I think the parallelism between motivations and techniques goes well beyond just a simple borrowing of IT terms. The parallels are structural and stem from the universality of connectedness as a modern expression of the ideals that have not only been the foundation of this nation, but the basis of our commercial advantage and might. The loose coupling of 50 states into a federation that embodied many of the ideas of connectivity (free borders, no interstate tariffs, and so on) is now becoming an organizational principle in the small as we increase the connectivity of one business with another, as well as in the large as we define globalization.

Over a year ago, I wrote this in response to the World of Ends article that Doc Searls and Dave Weinberger wrote:

World of Ends piece what Doc Searls and Dave Weinberger just published. In the end, that's about connectedness too and I think many of the issues they talk about apply regardless of the "connecting" system that you're talking about. For example, when Barnett talks of harmonizing a country's internal rule set with that of other nations, he's really talking about laws, protocols, agreements, processes, and other things that have direct analogs in what makes the Internet special as defined by Searls and Weinberger.

To take this one step further, I believe that the three virtues that Searls and Weinberger ascribe to the Internet apply just as truthfully to the global economy:

• No one owns it
• Everyone can use it
• Anyone can improve it

Read their words and substitute "global economy" for "Internet" and you'll find some interesting points. For example, I think that principal four provides real insight: Adding value to the Internet lowers its value. How do people attempt to "add value" to the global economy? One way is by regulating it or trying to tweak it in some way to benefit their country over others.

From Phil Windley's Enterprise Computing Weblog
Referenced Sat Dec 11 2004 17:21:27 GMT-0700

4:41 PM | Comments () | Recommend This | Print This

Say Hello to Your New National ID Card

I've maintained for some time that Congress was unlikely to create a national ID card and instead force standards upon the states that created a de facto national ID card using driver's licenses. Last week's bill overhauling national intelligence did just that:

The intelligence bill, which stemmed from recommendations of the independent commission that investigated the 9-11 attacks, requires the U.S. Departments of Transportation and Homeland Security to establish minimum identification standards for drivers' licenses and other state-issued identification cards. If a state's license does not meet the standards in two years, federal agencies will not be allowed accept it as valid identification for such purposes as boarding airplanes and many other common transactions of daily life.

The bill also sets a two-year deadline for states to conform with minimum standards for birth certificates. Those will be set by the U.S. Department of Health and Human Services.

The intelligence bill would require that each license include a digital photograph of the holder as well as the holder's full name, date of birth, gender and drivers' license or personal identification number. While some states already meet all these requirements, others do not. States also will be required to meet stiffer standards for the documentation they accept as proof of identity from license applicants, for the processes by which they verify those documents and for the means by which licenses are issued.

From News: Drivers' Licenses to Face New Federal Standards - Dec 10 2004 04:01AM
Referenced Sat Dec 11 2004 15:00:20 GMT-0700

There would have been a huge uproar if Congress had passed a national ID card program. This will sail by with nary a whimper.

3:03 PM | Comments () | Recommend This | Print This

Small Shop SANs from Dell and EMC

Since I finished setting up the SAN on the virtualization testbed we're putting together in my lab, this review of small EMC SANs from Dell caught my attention. It used to be that SANs were the provence of large IT shops; I bought my first SAN in 1999 and it was a half million dollar investment. That's no longer true. I have an EMC CX300 in my lab that I bought from Dell along with a couple of 4-way Dell 6650s with 16 Gb of memory each. Along with an 1850 server we use as a controller, a network switch and a fiber channel switch, the entire set-up was well south of $100K--very much within the reach of many small IT shops.

2:50 PM | Comments () | Recommend This | Print This

Google Suggest

Give Google Suggest a try. Very interesting.

2:35 PM | Comments () | Recommend This | Print This

December 10, 2004

Interview Day

I just got off the phone with Blake Harris who's writing a story on blogging in the public sector for Public CIO. We had a great chat about the uses of blogs in state and local government. I pointed him at the blogs of the Chief of Police and City Manager for Eden Prairie, MN. These guys are still at it and their blogs appear as great as they did when I first saw them. Makes you want to visit.

Just before that I was the guest on this week's edition of The Gillmor Gang. We talked about federating digital identities. There are some interesting models developing and we're seeing some real competition in business models for networked identity with Identity Commons, Sxip, Shibboleth, and Ping ID. You'll notice that I don't place Liberty Alliance of WS-Federation in that list. That's because I don't see them as business models, but more as technology platforms.

2:42 PM | Comments () | Recommend This | Print This

December 9, 2004

PubCookie

If you've got multiple Web servers (IIS or Apache) and you'd like users to be able to authenticate on all of them from a single authentication source (like LDAP or NIS), then Pubcookie, a system open-sourced by the University of Washington, might be what you're looking for. This page shows how it works.

9:24 AM | Comments () | Recommend This | Print This

December 8, 2004

VMWare's RSS Feed

I just got the EMC SAN up and running on the VMWare cluster in my lab today. Coincidentally, I noticed on Steve Holden's weblog, a link to VMWare's RSS feeds. The RSS feeds are actually provided by Simplefeed. You can select the content you want in your feed and then it creates a custom feed for you. Pretty cool. I like it much better than signing up for an email dump from them.

5:33 PM | Comments () | Recommend This | Print This

Rapid Application Development Environments on the Web

The Dec 6th Gillmor Gang features Ray Ozzie and Peter O'Kelly on the 20th anniversary of Notes. I expected it to be a retrospective of sorts, but instead was treated to a number of thought provoking ideas as Ray reviewed some design decisions and how they would play out today.

One thing that caught my attention was all the discussion of Notes as a rapid application development (RAD). I've never used Notes so I wasn't aware of that aspect of the platform. Rapid application development was one of the appeals of the early Web for me. I've never been much for coding GUIs and so the idea of a browser that took care of all that was immediately appealing to me. Write some script on the Web server and you've got an application.

Ray talked about how Notes started out as a RAD for business users to build tools they couldn't wait for the IT department to build for them, but over time it migrated to be more about "professional" development in IT departments. It occurred to me, as I listened to Ray that we've done the same thing on the Web. J2EE and other frameworks are large heavyweight tools for building enterprise-scale applications. Part of the appeal of PHP is as a counterweight to these heavyweight development frameworks, but PHP's really only lightweight in comparison. You still have to know enough to run a MySQL database and write code.

Maybe this is the appeal of things like Kwiki and JotSpot to me. I just open up my browser and I'm building something. For some time, I've been contemplating a Wiki-like tool that serves as a RAD environment for simple Web applications. JotSpot and other Wiki tools are moving in that direction as well. Even so, there's plenty of additional room for innovation in that space.

9:57 AM | Comments () | Recommend This | Print This

December 6, 2004

Laws of Identity and Symmetric Relationship Treatment

Kim Cameron continues to explore Laws of Identity. He points out that this is not some philosophical exploration, but one bent on creating a practical basis for a universal identity system:

I'd like toÊtake a moment to look at what I'm trying to achieve with thisÊexploration of the Laws of Identity.

I've pointed out already thatÊour discussion hereÊis not about the "philosophy of identity" - which is aÊcompellingÊbut entirely orthogonal pursuit.

Instead, I am trying to revealÊthe set of "objective" dynamics that willÊconstrain the definition of anÊidentity systemÊcapable ofÊbeing widely enough accepted that it can enable distributed computing on a universal scale.Ê I doÊnot propose my lawsÊas "moral imperatives", but rather asÊexplanations of dynamicsÊwhich must be mastered to craftÊsuch a universal system.Ê

From Kim Cameron's Identity Weblog
Referenced Mon Dec 06 2004 10:14:34 GMT-0700

This practical basis is the reason for their appeal to me. His first three laws are:

1. Law No. 1: The Owner Decides - Technical identity systems MUST only reveal information identifying a user with the user's consent.Ê
2. Law No. 2: Minimal Disclosure - The solution which disclosesÊthe leastÊidentifying information isÊthe mostÊstable, long-term solution.
3. Law No. 3: The Fewest Parties - Technical identity systems MUST be designed so the disclosure of identifying information is limited to parties having a necessary andÊjustifiable place inÊa given identity relationship.

I think you'd agree that these are pretty practical. I posted an example of why Law No. 2 is important last week, relating it to the security principle of least privilege. So far, the most controversial law of the three seems to be No. 1. That's probably because so few identity systems abide by it.

Equally problematic is getting a handle on what the user's rights really are with respect to identifying information. Let me give an example. Suppose Kim walks into convenience store and purchases a bottle of soda. Later, I come in an ask the clerk "Did Kim buy a bottle of Coke earlier?" Does Law No. 1 preclude the clerk from telling me without Kim's assent? Many would say yes, but in fact, that transaction is jointly owned by the two parties to the transaction. The transaction is not strictly speaking identity information, although it certainly does tell us something about Kim, the transaction is better thought of as relationship information.

Here's another look at that same scenario. Suppose, I go up to Kim after he's been in the store and ask "Did the store sell you a bottle of Coke?" Does Kim have the right to tell me? Practically speaking the store doesn't mind, but suppose they did. The transaction has as much identity information about the store as it does about Kim. Relationship data links two or more identities, telling us something about each of them.

I believe that much of our talk about identity, and about privacy, is confounded by our collective myopia concerning relationships, or data about how identities are linked. When we look at it from just one side, we're likely to mistakenly build systems that asymmetrically protect relationship data. These systems are inherently unfair and thus prone to controversy. So, I'll add something that I think needs to be in Kim's laws:

• Treat Relationship Data Symmetrically - Relationship records (i.e. records that link one or more parties) MUST be treated symmetrically for the identity system to be fair.

10:42 AM | Comments () | Recommend This | Print This

December 4, 2004

Flying to Richfield

Steve and I flew down to Richfield for breakfast this morning. It was a beautiful, cold morning. We left in the dark and arrived there just as the sun was coming up as we got to Richfield. The temperature was -4F. Bob, who works at the airport on Saturday's, cooks breakfast for anyone who flies in. Here are a few pictures of the trip.

10:16 PM | Comments () | Recommend This | Print This

December 3, 2004

How To Make a Podcast

Yesterday I posted my first podcast. I thought I'd take a minute to write down how I did it for anyone else so inclined.

Equipment

After asking some friends for advice (like Doug Kaye, Thanks Doug!), I used the following equipment:

Behringer Eurorack UB802, an inexpensive 6 channel, 2 mic input mixer.

• Behreinger Eurorack UB802 mixer. This is an inexpensive mixer with two mic inputs. Both have phantom power, which is needed to power the mic I used (see below). I spent about $45 on this. There are other options, like the UA-25 USB Audio and MIDI interface which goes direct to USB, avoiding lots cable woes. Its much more expensive and is not a mixer, but its also compact and runs off USB power. Perfect for mobile use. I may pick one up yet.
• Griffin Technology iMic USB Audio Interface. This is not strictly needed if your machine has a line-in port. In any event, I like it because I use USB as a poor man's Powerbook dock and this eliminates two cable plugs.

  Behringer B-1 Studio Condenser Mic

• Behringer Studio Condenser Microphone. This is a great mic at a great price. I picked mine up in Orem for less than $90. Its not portable, as you can see from the picture. It comes with a case, shock mount, and wind sock. The stand, I picked up at Radio Shack. I was a little worried about noise from the floor and desk through the stand, but it doesn't appear to be too big a problem. A more portable option would be something like the Shure Sm58.
• Bose Quiet Comfort Headphones. I already had these. You don't need noise reduction for this application. I do think that closed air (i.e. covers the ears) do better at preventing feedback and are more comfortable.
• An Apple Powerbook (1 Ghz with 1G of memory).

All in all, I spent about $150 on equipment I didn't have. You could get by with a cheaper mic that plugs directly into the computer, but I tried that and you can definitely tell the difference. I figured it was worth the $150 to sound a little better since I sound bad enough as it is. :-)

Software

The software set up that I used was Dave Slusher's recipe for OS X podcasting at Evil Genius Chronicles. Dave's recipe is good. I had a few comments:

• Soundflowerbed seems to be very touchy. You use it to get the audio from the Soundflower channel you've set up as a sound bus out to the headphones. I had to start and stop it multiple times to actually get it to route sound and it crashed at times.
• There was a delay from the mic to the headphones that made speaking difficult since you don't hear yourself until a little while after you speak. Consequently, I turned off the headphone feedback when I was speaking. This was OK for soliloquy, but wouldn't work for an interview on the phone.
• Audacity works well, but has a steep learning curve. For someone who's never edited sound before, it was an interesting experience. I'm not above paying money for something if its easier to use. Suggestions?

The one thing I used that's not on Dave's recipe was my hacked version of ListGarden. I used that to create an RSS feed with the enclosure. I could have just put it in my regular RSS feed using Radio, but I decided to create a separate feed for podcasts and ListGarden makes that really easy.

Technique

Here was my technique. Feel free to critique if you've got suggestions that will help be do this better.

1. Load the full Gillmor Gang into Audacity. Listen to it and make comments to myself on a label track.
2. Go back and re-listen to interesting bits based on my comments. Record the response to them right there on a separate track.
3. For each clip (I had 4 or 5), duplicate the original Gillmor Gang track and then cut out the right piece.
4. Order the tracks vertically in the order I want to put them in the finished piece. Audacity makes reordering tracks difficult unless I missed something.
5. Move them in time so that they follow each other. This is easier to do my compressing time a lot, getting them mostly right, and then expanding time to fine tune the placement.
6. Delete unwanted tracks, edit the ID3 info, and export as an MP3.

As I mentioned yesterday, recording this took me about four hours. Dave Slusher took me to task in response to me saying "Recording is hard because when something goes wrong, pretty much the only choice is to start again. You can't easily go back and change one sentence or remove a mispronunciation (at least I can't).":

What the? I do this every time I ever record one. In fact, in tonight's episode I removed about 4 minutes of coughs, stammers and false starts into topics that I decided to abandon. That's over 10% of the final result. This suggests that the real core is in the last part, the "at least I can't" bit. I'm curious to find out what Phil's setup is. Is he using a tool that doesn't have a waveform editor? If so, he could easily use Audacity for free anytime and would have that capability. Or, is this just a case of failing to RTFM? Folks, you can in fact edit the audio, remove mispronunciations or even insert new sentences in place of burbled or erroneous ones. I do it all the time...

From Evil Genius Chronicles - No Honor Amongst Systems
Referenced Fri Dec 03 2004 10:28:27 GMT-0700

I'm sure Dave's right, but its just felt like I was swimming in molasses and faced with the prospect of inserting some material in the middle of another clip and removing and repairing several verbal bobbles, it just seemed easier to rerecord it to me. Certainly, as I gain experience with Audacity, that wouldn't be the case, but I don't think you can argue that its as easy as cleaning up text. Text has some very nice properties.

That said, audio has other properties. Doug talks about IT Conversation's ability to give you back bookmarks on audio clips so that you can reference them in a blog. That's nice for somethings, but I wanted to say what I was thinking, not just write them. That's the beauty of podcasting.

10:19 AM | Comments () | Recommend This | Print This

December 2, 2004

Phil More Gang No. 1, A Podcast

Have you ever listened to the Gillmor Gang and wished you comment on something that was said? Me too. As I listened to the November 5th edition, just after the 2004 presidential election, I kept thinking of responses or comments I'd like to make. I decided I'd do just that. So I cut some clips from the show and added my two cents. The result is my first podcast, which I call the Phil More Gang No. 1. The RSS, which I created with my hacked up version of ListGarden is available, as is a link to the plain old MP3 file. (Warning: this is about politics, not technology.)

I did this for the experience, more than anything. It was a lot of work and even so, the production quality is lacking. Something that would have taken 15-20 minutes to write as a textual blog entry took the better part of four hours. Some of that was my unfamiliarity with the tools, but a lot of the time was taken with listening, marking, cutting, splicing, and, of course, recording. Recording is hard because when something goes wrong, pretty much the only choice is to start again. You can't easily go back and change one sentence or remove a mispronunciation (at least I can't). I'll do a post later to talk about the tools and technique I used.

6:50 PM | Comments () | Recommend This | Print This

December 1, 2004

Why Do We Blog?

Frank Paynter at asked about 3 dozen people why they blog. Their answers are at Sandhill Trek. I said:

I blog to be part of a community of people whom I respect; I want to understand their thinking and I want them to understand mine. I blog to be part of the conversation. I blog to remember. I blog to refine my thinking. I blog because I don't think I really understand something until I write about it.

But there are much better answers than mine in Frank's post. Go read it.

7:44 AM | Comments () | Recommend This | Print This