Out of the way

Every so often I join another "social network" service. In general, I find they are not that sociable...

Read more...

Ben Buchanan, just quietly, is a great bloke. As well as being a choice companion for sharing a beer or three, nice guy, and champion of accessibility and other good things, he has actually done some really basic practical stuff that takes time to show results. And recently he announced something really cool...

Read more...

Gregory posted a bunch of photos, wondering what they actually were. I finally made some time to go through them and label some. We used to talk about having a system that would let a blind person ask a number of different people to describe things. So, here it is (although we haven't yet automated the process of extracting a handful of descriptions, that has been done by people who build CAPTCHA-busting software).

So, if you wonder what a blind person does with a camera, the answer seems to be "same as everyone else - take some great photos and some dreadful ones, and show them to people".For some of the shots, the fact that the camera is a cheap nasty one is actually a bonus - it creates a real mood. For others it is a big shame, because they would be cool with a little higher quality.

Anyway, if you have time to describe a few photos, I am interested to see how other people go about it in practice... Maybe something really useful can be built out of this.

Err, that's meant to be Bangalore, the first place I have ever been in India.

Read more...

Well, virtually. For some reason the world still likes a lot of things on paper, written out hte slow way. I had to write up some expense claims, and I had to use a spreadsheet.

In the past I have used OpenOffice (for compatibility or for actual spreadsheeting, although there is no reason I can think of why I don't just have a widget that does it). But on Mac it requires X11, and I haven't yet installed that (since I didn't need it for anythng else yet - Amaya has "gone native", and I don't use a terminal often enough to need anything special).

So I decided to try NeoOffice. The OpenOffice team are now actively working to port to Mac native, and I look forward to them doing so. In the meantime, this is the branch of the project taht happens to meet my needs. Like all open source projects, you get a lot of duplication of relatively scarce effort. But for someone who uses even open office formats under duress, I'm bascaly bound to take the thing that interests me now. If I was going to make a serious contribution to anything, it would be to something that started by massively simplifying the data, and making it easier to re-use. OpenOffice went one step down that road, but it's still way too heavy for me.

But how is NeoOffice? So far, so good. Integrates nicely with my system, runs at a reasonable speed (on a great big monster macbookpro I would hope so - I suspect it might not be quick so snappy on my old machine), and lets me do my work. I guess I won't ever notice a lot of differences - I basically only use the spreadsheet, and on the rare occasions I accept a powerpoint presentation I look at it in NeoOffice.

Best of all, it came as a torrent. So as well as getting it effectively, I can contribute something

Microsoft recently announced some stuff about how they would handle accesskey and keyboard shortcuts in IE7 (so being opinionated in this fieldI commented - apparently before my good mate John Foliot).

What they choose to do is sometimes important. The fact that they aren't considering site-specific preferences except for "some future version, perhaps" only matters to their users - it is a convenience or accessibility functionality.

But their implementation of accesskey, which was also followed by Mozilla, causes problems for everyone. Because IE has such a large market share, things that cause sites to break in IE are not acceptable for many site designers. Making a page that causes the browser to behave in unpredicted ways and breaks the predicted functionality isn't helpful. So people are going to avoid using accesskeys that conflict with normal IE behaviour.

This is good of them, unless you are one of the people whose life would be made a lot easier by good shortcut navigation around websites. (On average people are not, like me their life will be unaffected or made just a little bit easier, but nobody who reads this blog is average, right? ). Being an international product with various localisations means that a lot of the keyboard gets used up. For many years now, authors have been trying to find the keys that cause the least conflict with bad browser implementations, instead of suggesting something that is actually memorable.

(Of course authors making better use of the rel attribute to support very highly predictable navigation would be nice, too. The fact that not all browsers have good support for it isn't much of a reason not to use it, since unlike accesskey it doesn't do funny things even to browsers with poor or no implementation).

So I would love to believe that Microsoft are going to improve their implementation in IE7, and Mozilla their next version, to something that reduces the damage to the accessibility of the Web. (Yes, I do mean something like what Opera does for accesskey). It should not be difficult for them to move to the approach of having a pass-through key instead of just changing expected browser behaviour (without any warning, at the moment).

This implies changing the way part of the user interface works for people with disabilities. In general this isn't considered a brilliant idea. On the other hand the people who want to use accesskey are not getting any support, because authors avoid using it. At least some of those people would be heavy keyboard users in general, so having their browser functions vanish on them will be a frustration too. It will cause a few authors a little pain. Those who have been helpful enough to have implemented access keys and then realised that they needed to do more work to explain what is happening in IE and Mozilla/Firefox will have to change their text that says

press alt+key to go to this link

to take account of the fact that there are different implementations out there. It seems a relatively small price (if somewhat unfair) for a relatively big improvement.

Opera 9 includes support for BitTorrent, a file-sharing protocol.

No, it isn't a piracy tool, except in the sense that any other technology (disc drives, photocopiers, pencil and paper) is. It's a way of moving large popular files around the Web that is more efficient than the traditional HTTP. (For small files, that only one or two people are interested, it isn't more efficient. Using the right tool for the job is a big part of technology).

The rough idea is this. You have a very large file, and thousands of people are going to want it. So you split it into bits, and as soon as someone gets a bit they share it, so you don't have to be the primary source for that bit any more.

In traditional HTTP, they each connect to your server, and get the whole file from you. If you have a limited bandwidth, or a limited nummber of connections available (and in general, you do), this means people have to wait until others are finished.

Imagine that you have a thousand page manuscript you're trying to sow to a dozen friends, and you have to photocopy the whole thing, page 1-1000, in a single copy, and take it to the first person before you can start again. And that they can't share any of it, either.

In BitTorrent, you hand out a bit to each of the people on the list, and they can re-copy that bit, hand it to others on the list, so the strain on your photocopier is reduced massively. And because people can be getting a dozen pieces at once from different places, they get it faster.

The nice thing is that a connection doesn't have the same maintenance cost as a photocopier. The cost to any person of sharing a bit of their connection is usually trivial, if any, and the processor power (you don't have to think about anything to make this happen, the machine does it for you ) really is almost free.

Obviously for a small web page, or something that only one person wants, the extra effort of splitting it up and reassembling it isn't worthwhile.

So where do you find torrents? Well, you can get one from Opera that's a video of a talk I gave recently. But if that doesn't sound very interesting (other people say it's good, but to be honest I only got it to test torrents ) you might like to look at the music and trailers from SXSW this year - lots of music and film trailers, made available by the artists.

Warning: These are big files. the film is 557MB - a CD full, one of the biggest downloads I have attempted.

On the other hand, I will be sharing it too, when I am connected.

http://torrent.ibiblio.org/ is another source for a variety of legal downloads - an efficient way to share software and other large popular files.

Like photocopiers, people probably use this to share stuff that isn't theirs, in breach of copyright. Like photocopying, please don't. If you think copyright laws suck, vote. If you think somebody should give away their copyright material, ask them too. Same goes for their car - the fact that you find their keys on their desk doesn't mean you have discoverer's rights to take their car...

I did a quiz that mediumgeek pointed to, on "what religion is right for you"?

It seems a bit odd as a quiz - I wonder how well it really works. Anyway, the results I got are as follows:

Religion	Appropriateness?
Buddhism	67%
agnosticism	67%
atheism	63%
Paganism	58%
Satanism	54%
Christianity	50%
Judaism	46%
Hinduism	42%
Islam	42%

I guess it is food for thought. Or maybe it just means I am trying to avoid working some more this evening... I actually wonder about these quizzes. People love quizzes, and I don't know why, although I enjoy them too. But it frustrates me when people use them for things I don't like. Tickle.com was the one that really bugged me - I did an IQ test one day because I was feeling uninspired, only to discover that it's just a teaser for a matchmaking site that collects a lot of information about you.

I'm inclined to be less than completely forthright when I find myself being pushed into things like that. Which is probably not a great thing, but I find it rude to be sucking people in without being clear about what you're selling.

But then, I guess someone who is selling me a perfect romance, or a dirty weekend, or the one true religion thinks that they are doing what is right and important...

Sir Tim Berners Lee has finally climbed down from using cool editing tools. Anne, one of the compulsive (and widely-read) bloggers from Opera pointed me to Tim's blog.

An interesting first entry - it is about the read-write Web.

When I went to work at W3C I decided to stop messing around with source-editing (I was actually using a monstrous set of Macros I had written to make a decent code authoring tool inside a de-Webised old version of MS Word, and then switched to Linux and vi). I switched to Amaya, then at about version 1.2, buggy as anything, and crash-happy. Mostly it produced valid code, and I didn't have to look at it. Editing a page meant going to it, changing what it said, and pressing save. And trusting what it did to the code.

When I started with it, the interface made no sense. Until Jim Gettys told me the secret: f2 (well, actually then it was the escape key, which I have always preferred) and ctrl-minus to select the parent or child, ctrl-j and ctrl-k to select teh next/previous element.

I have never found another editor as good. It still has buggy versions, it still has its own quirky interface, it still has no support for DOM or scripting or XSLT. It still has the best CSS editing anywhere (they updated the interface. The 1998 version was just revolutionary - there was nothing to compare for years), it still makes nice clean code without me having to look at it. It even still has traces of my work in it.

Blogging tools and Wikis are relatively painful compared to decent WYSIWYG editing. Don't get me wrong. There is nothing worse than WYSIWYG tools that can't create decent clean (X)HTML - and sadly there are a lot of those around. But I prefer to write content than think about pointy brackets, and try and read between them. It seems to me that many of the people who talk about the intricacies of markup do so because they believe that real people actually look at the stuff. My experience, as someone who has looked at masses of it, is that only geeks do that. Real people with something to say are more likely (on average) to be talking about horse-breaking, or sunsets, or recipes, or how to stop a few hundred people being pushed out of their livelihoods. I have changed lots of bits of car engine, and hacked telephones with scissors and soldering iron. But I prefer to just drive where I am going, and ring people.

And write to the Web.

The nice thing about blogging software is that it handles a bunch of tracking and semantic management things like tagging. It isn't all that flexible - it is still generally based on either a hierarchical or totally flat model, but it does make some stuff easier. Like most WYSIWYG tools - it isn't what you really want, but it does some stuff you wanted done. For that it seems people are prepared to put up with having to edit whatever particular horrid syntax the blog or Wiki uses.

We're still not at Web 1.0 (as envisioned only 15 years ago), although there are signs that we might be able to get there soon. In the meantime, it's stupid, but it works. Which means it ain't entirely stupid even as implemented.

Note: My security work has mostly been in dealing with service architectures and intrusion detection (and partly in bars, which is surprisingly similar in most of the basic concepts and approaches). I haven't got a monopoly on making mistakes, so I intend to revisit and edit this any time I learn something should be changed... (Also, it's not really necessary to be a heavy security and web geek to understand the ideas in here, I hope. Whether that makes them intreresting or not is another question).

Security on the Web is pretty important. At Opera we work hard on in, and according to Secunia (who watch over this area pretty carefully we are normally better than either Internet Explorer or Mozilla/Firefox at not exposing ourselves to new attacks, and at fixing problems fast and effectively.

The early Web didn't really address security - it left it to a seperate layer (primarily SSL - the https URIs that you often see are the most obvious example) that was developed as the need arose, and could be put in place because of the clean seperation of layers. For many years the US government stopped this being available to the whole world, but as newer and better systems became available they could be dropped into place. This seperation of layers is an important theoretical principle, with some practical benefits - you can be surer of your security when it is not bound up with every other function that you are developing, and testing is more straightforward.

As the Web has become more complex and dynamic, to offer more useful services, new types of security requirement have appeared. When pages were static, or had a simple form that could talk to the server that gave it to you, SSL was fine. "XSS" (cross site scripting) actually appeared with forms that would pretend to be one site but were really talking to another, giving, say, your address and phone number to badguys.com instead of to niceFolks.org. Technologies like Frames and Javascript, as well as offering new possibilities, made it easier for a site to pretend to be something else, and even to use a real site as a kind of "trojan horse" to fool the user into trusting it.

At the same time users have learned more about how the Web works, and browsers have developed ways of helping them check that they are not being tricked. The little yellow bit in the Opera address bar tells you who owns the site you are connected to, and how good the security is (on a scale of 0 to 3). Browsers also block the most obviously dangerous cross-site access. In general, a script from dodgyDevelop.com cannot access your information on myBank.com unless the site itself has a copy of the script that it delivers because it trusts it. When these blocks are not in place you can get the kind of problems Jim Ley has noted recently in development projects.

(Development is like this - the trick is to release a service in a way that doesn't expose other risks by getting the layers right. One of the common processes is to use expert crackers to find bugs before releasing software - this is standard QA. In the Open Source world, the theory is that so many people look at the work that problems are picked up and solved. In some cases this works well, in others not, according to the actual results).

Although this security approach is helping to keep us from being caught out by a malicious attack, it comes at a price. The idea of the Web is that you can use a service you find. Of course you need to know, when anyone in the world can offer a service, whether you can trust it. This is not new to the Web. Most people are already wary about b eing offered millions of dollars by someone they don't know who says they were stolen in a far-off country, and many are wary of giving money to people who claim to be collecting for some good cause, but can't show who they are. Trust networks are things people have in the real world, but interfaces and systems for building them on the Web are not yet mainstream, and are not necessarily simple to create at the moment. So we live with the cross-site restrictions as a simple answer, winning something and losing something.

In accessibility, I have had a long-running discussion with my good friend John Foliot about how to deal with making keyboard access better for people who need it. A key disagreement we have is on whether it is better to get rid of existing content along with broken implementations, or whether we should take an architecture that is clearly flawed, and adapt it in ways that let us keep using the existing web, at the price of taking longer to work towards the system we would like. In that case I believe that the value of the existing Web is high, and we should keep it, since we can minimise the practical cost.

In this case, the security model is not yet built into the specifications that describe how the services themselves can be built. It seems to me that we are better keeping it out - making sure that we can change the model we have now for a better one (both in actual security and in minising the downsides of the implementation) as soon as it is readily available. The idea of writing the security model we should be using into the specifications for the formats we use strikes me as wrong on two levels.

1. Using a new format specification will mean copying the security information into that specification. This seems like a bad approach
   
2. More seriously, it makes it harder to replace the model with a better one, since it needs to be teased out of the specification, and in the worst case replaced with a new set of specifications, something that takes a very long time to put in place.
   

In other words, I am worried that we are giving ourselves the relatively comforting protection of a security blanket instead of growing up and thinking about real security as adults who decide for themselves what to trust.

Comments are actively sought here. This is complex stuff, and more brains working on it is a good thing IMHO.