Search Results: "ema"

18 November 2006

Martin F. Krafft: Online in the skies

I am sitting on Singapore Airlines flight SQ 25 from Frankfurt to Singapore and have wireless connectivity, reasonable for SSH usage. The service provider ConnexionByBoeing is phasing out of business, and in a move to appease the passengers, made the service free of charge in October, throughout the end of the year. This is definitely a first for me, to be able to "surf" several thousand metres above the ground. And while it certainly makes the next twelve hours seem like a lot less [*], I do wonder whether I'd even want broadband on every (long-distance) flight. Flying has always been relaxation to me, time off to read or watch movies I'd otherwise never see, to sleep, dream, stare at clouds, talk, think, be, drift. With the Internet available, work could creep into this time for those who lack control over their use of time. While I tend to disagree that I fall into this group, my dear friend Hanspeter seems to think otherwise. And isn't it great how in such situations, denial does nothing but reconfirm the position of the proponents? It's like smoking, which I do on the occasion. Tell someone that you're "only an occasional smoker" and you'll likely earn an expression of pity and averseness as your peer marks you down as a smoke addict.
[*]

Singapore Airlines is making this a very enjoyable experience. Asian hospitality really amazes and captures me every time. I only wish I had more time than a few days in Singapore.

We're flying in a Boeing 747-400, either very new or completely redone. The in-flight entertainment spans 80 on-demands movies, 90 TV shows, about 200 audio CDs, and several documentaries and live news channels. Add the Internet and those long hours are history.

Ross Burton: Contacts 0.2

Although I'm announcing Contacts 0.2, I hardly did any of the work on it. Brace yourself, Chris and Thomas have been very busy. Updated packages are already in Debian. Have fun!

17 November 2006

David Welton: Padova Hacking Society

I couldn't think of a better name, so that's what I came up with for a "cross-platform" group including a variety of people who are knowledgeable in different fields. Thanks to Matteo, we had our first meeting yesterday for (what else, being in Italy), pizza and beer. I continue to be very impressed by the amount of technical talent here in Padova. It is a university town, but it's only got about 200,000 people. At our dinner yesterday, we had guys from OFBiz, Mono, FreeBSD, and various other open source projects, as well as people expert in C, Perl, Python, Ruby, Java, Erlang, and counting myself, Tcl. Furthermore, the guys from the nascent startup seesaw.it were there as well. It was a lot of fun to meet up with people to talk tech in person. Even the level of diversity lead to some heated debate at times, I think I much preferred it to a monothematic event. With age, I tend to get less excited about things, and realize that it's all fascinating and worth knowing, and just wishing I had more time to soak up knowledge in the many fields that interest me. Hopefully, we'll be able to repeat the event sometime soon.

Evan Prodromou: 26 Brumaire CCXV

I've been pretty interested in making Web sites WebSoftwareFriendly for a while, so I'm pretty psyched to see that Yahoo and Microsoft have embraced the Google Sitemaps format. They've started a site for the format, http://www.sitemaps.org/ , which lists out the protocol, which seems to be unmodified from the original Google version. Sitemaps have been a necessary part of Web sites for years. Netscape -- back when it was a browser -- had an RDF-based sitemap format that had a brief flare of popularity just before Netscape went into its weird late-90s spiral. Then RDF people got really abstract and academic, and decided that sitemaps weren't what RDF was all about, and RDF sitemaps were forgotten. So sitemaps went off the air, and we've had to wait for a standard on the idea until today. Yahoo lets you submit sitemaps today, as does Google; Microsoft Live supposedly will support it sometime in 2007. One thing that's interesting is a new "ping" protocol, for when the site is updated. I'm not sure how well it works or if it's even implemented, but it's interesting to see it working. I think the weak part of this whole thing is that site owners have to submit sitemaps to each search engine; it would be nice if there were some sort of discovery, like an HTML <link> element, so that other types of Web software besides the big search engines would benefit. tags:

Knowing when to hold 'em From O'Reilly's wrapup of the Web 2.0 Summit, I got a good link to some other Evan's Knowing When to Hold Em. It's a little discourse on the growth of Web 2.0 sites after they've been acquired. Evan Williams, the author and the guy who sold Blogger to Google, knows whereof he speaks. He has some graphs that show traffic for various Web 2.0 sites sloping precipitously upwards after their sale to some big company. The implication being, I guess, that the sites would have been more valuable to sell later. He also points out that few of the sites have benefited visibly from being acquired. I'm not sure the argument makes sense. Traffic is a cost centre as well as a potential source of revenue for companies. Keeping servers up, running, and cogent is hard work. Most small Web sites have been throwing labor and cash into their sites for a while, and the ability to keep such a site going into the Alexa top 100 is beyond most small companies. Paying for a lot of servers, developers, designers, sysadmins and bandwidth for another couple of years may make the site bigger and more desirable for acquisition, but it's a big risk to take. My favourite part of the discussion is that my friend Kevin Fox shows up at the end with some good points about when and how to invest. tags:

Free Software Java I've been programming in Java off and on since the first beta versions of the VM and JDK in 1995. The language has always had a certain cachet with the Open Source set -- the free-as-in-beer tools, good documentation, and cross-platform compatibility made it an Open Enough system, roughly equivalent to proprietary C compilers shipped with every Unix variant. Its release was roughly synchronous with the growth of the Web, and Java applet support in Netscape made the first round of rich client applications conceivable, if not exactly elegant. And then Java grew onto the Web server; and into other parts of the network; and then all of a sudden everything had to be Java. The system grew from this nifty little tool to The Enterprise Solution For Your Enterprise. Serious people worked on Java. I worked on Java when I needed to be serious. Java stopped being fun. Early efforts at getting Open Source Java VMs and development kits working were pretty successful, but they just couldn't catch up with the rapid pace of development on Sun's core product. But inclusion of the language in the Gnu Compiler Collection, the great JBoss J2EE system, the growth of Apache's Jakarta project, and the growing Java Community Process made Java less and less a regular product, built in a silo behind a corporate firewall, and more of an Open-Source-y project. So I guess it was inevitable that Sun would either Open Source its codebase, or end up irrelevant. They probably squeezed just about all they could out of it without going Free, so that's pretty impressive. I think Free Software advocates are supposed to be grateful about this; my main reaction is: why did you put everyone through all this crap for so long? You've wasted 12 years that could have gone into making Java really incredible. We'll see what happens. My main interface with the JVM for the last year or so has been through scripting languages like Rhino JavaScript engine (very fun) and Pnuts. Who's got time for Java programming any more? tags:

Biella Coleman: The Politics of (lyme) bacteria

Recently I read an amazing review of patient advocacy and health (counter)movements by Steven Epstein from the STS program at UCSD. It is still a draft but bound to be published in the New Handbook of Science and Technology Studies and when it is, anyone who works in this area will gain so much from reading the review. It was stunningly broad yet highly specific. He is able to synthesize an enormous literature on patient advocacy, a field that has seen a blizzard of activity, especially in the last twenty years. Along with providing points of entry and departure into the field, he also examines who the burgeoning interest in the field of STS. What I found interesting is that there is very little work being done on a topic I happen to know a lot about, lyme disease and whose politics I have been following since at least 1999. I am not sure why the lacuna but it is an odd disease dripping and screaming with controversy and seems to stand apart from many illnesses, in part because of its odd dual existence. On the one hand, it is an illness that the medical establishment totally recognize as real (and thus in some respects is unlike the class of syndromes from MCS to chronic fatigue, which another STS researcher, Joe Dumit provocatively describes as illnesses you have to fight to get ). But that is only half the picture because mainstream medicine tends think that lyme is not only easy to diagnose but also to treat, so much so that if a person thinks they have lyme (even after a round of antibiotics or lacking diagnostic markers), the are either seen as suffering from something else (and usually then told they have one of those highly contested syndromes), or more often just crazy. So it exists dually: at once recognized but only narrowly, so that in another form, that of chronicty, lyme cannot exist. It is this dual quality of lyme that defines and shapes its politics and just recently, new developments have fueled the controversy. Namely it follows from the Infectious Diseases Society of America new guidelines for the diagnosis and treatment of lyme, published last month. In a nutshell, they basically re-reduce lyme to a very easily diagnosable and treatable illness, calling for even more strict guidelines for its diagnosis than now exist. They sanction a small range of blood tests and thus totally nullify the role for clinical diagnosis, which even the CDC had acknowledged as vital in times past. Unsurprisingly this has thrown the chronic lyme community in a total tizzy and they have not taken this sitting down. A petition has been launched and protests have been planned. And amid the controversy, politicians have already heard the call to arms. In the state where lyme is a famous entity for it was first discovered there, Connecticut, its Attorney General is calling for an anti-trust investigation into the Infectious Diseases Society of America, in essence for using their clout and prestige to legitimate a gold standard in diagnosis and treatment, when it seems far from obvious that this should be the standard. According to the LDA press release:
The national non-profit Lyme Disease Association (LDA), representing more Lyme disease patients than any organization in the United States, applauds Connecticut State Attorney General Richard Blumenthal for beginning an investigation into the Infectious Diseases Society of America (IDSA) Lyme disease guidelines development process. In an unprecedented move, the Attorney General’s office filed a Civil Investigative Demand (CID) to look into possible anti-trust violations by the IDSA in connection with exclusionary conduct and monopolization in the development of the Lyme guidelines
What I find so interesting is that this latest chapter in the grungy and torrid politics of lyme encapsulates the very nature of the politics of lyme, which really is about the agency of bacteria and in the Latourian sense. If Pasteur had to put a lot of effort into making credible the bacteriological model of disease as Brunto Latour covers in The Pasteurization of France and if there was plenty of future prostelyzing needed to bring credibility to the bacteria to more general publics, as Nancy Tomes illustrates in The Gospel of Germs, well now, I think we are in an era where we think we have such intimacy with the biological ins and outs of bacteria, it is almost impossible for the scientific community to imagine bacteria as such complex organisms that they can be in fact very difficult to diagnose, eradicate and treat. It is just no longer part of the basic conceptual universe of most doctors and medical researchers to think of bacteria in this way. The LDA press release acknowledges this very fact in the following way:
The October 2006 guidelines do not acknowledge that a complex bacterium such as the Lyme disease spirochete could possibly survive in the body and the brain, evading the immune system and short-term courses of antibiotics.
For many lyme researchers and doctors, since lyme is a bacteria and we know how to treat those pesky critters, it is frivolous to even imagine or contemplate otherwise. I would call this a hubris that arises not from the arrogance of doctors and the medical establishment but following the heels of success that medicine has indeed had with conquering the bacteria with antibiotics. Even new forms of poweful and highly resistanant TB are still treatable with a potent cocktail. That is, at a cultural level, I understand the blinders. At a political level, however, because people are suffering and because it is plausible that lyme can exist chronically, it is imperative to unseat this cultural comfort borne from past success to get the ball of research rolling anew. I think bacteria (and parasites for that matter as a recent smattering of articles demonstrate) are a lot more savvy creatures that should be treated as novel, wondorous creatures, once again. I would dare say the medical establishment, by refocusing energies on that which they think they have solved, would find themselves quite surprised. updateHere is an article discussing the issues.

Erich Schubert: Apple spam

One more reason not to buy Apple: they spam. Yesterday and today I received Spam from "insideapple.apple.com". The same mail twice I think; and to the same old old email address. I can even trace back that they bought the email address from the old uni.de student portal site (which has since been sold or relaunched, I don't know). I unsubscribed yesterday, but received the same mail again today. Apple, thats NOT the way to go.

Steve Langasek: On setting and meeting goals, and statistical fun

While NMUing plays an important part in getting us to a release, as shown by the thousand or so fixed-in-NMU RC bugs that we recently cleaned up the BTS state on, it's evident after doing this whole release-managing thing for a while that there is a very high (non-linear) correlation between the age of an open RC bug and the likelihood that a release manager is going to have to touch it at some point in order to get it fixed. By and large, maintainers really do a good job of fixing their own packages, which is probably something we don't say enough - maybe 75% of all RC bugs, I'd guess, will (or would) get fixed by maintainers in the first week without anyone needing to poke them about it, and of the remainder, probably another 80-90% get taken care of by BSPers and serial-NMUers like bug-a-day mascot Steinar Gunderson. That's why I'm not bothered overly much by the idea of full-archive searches for hidden RC bugs, like Lucas's piuparts tests, affecting the release timeline, because I know that 95-98% of those bugs are going to be gone two weeks after they're filed anyway, especially when they're no-brainer fixes to maintainer scripts or dependencies. But then that leaves the other 2-5%, which are the ones nobody else has fixed. And why hasn't anyone fixed them? Because they're the hard ones, of course... So although I follow the debian-bugs-rc list and occasionally swat a few non-bugs closed to save the maintainers time, and also provide some nudges when it looks like a package is causing RC bugs to be filed on other packages, my goal for the last full week of my Dunc-Tank contract was to get the count of etch RC bugs unfixed in unstable that are 20 days old or older down from around 50 to under 30. This seemed a reasonable goal, since it had been at 80 the week before, and it would go a long way towards helping the real blockers on the release. Initially I was aiming to bring down the count of RC bugs unfixed in testing that are 20 days old or older to this number, but quickly realized that this wasn't going to be realistic because it depended too much on the autobuilders all operating optimally and there wasn't time to both help fix 20 of the hardest RC bugs and handhold 60 RC bugfixes into testing in one week. In the end, we did miss this lesser target by a day or two. Still not a bad week's work, given that I'm pretty sure I fixed about 20 of these bugs myself in that time period (through NMUs, removals, and analysis+downgrades) and they seem to average 3 hours of work for a fix. And we've been holding at or below 30 on this list of bugs since then, so we're successfully keeping up with new bugs aging past the 20-day mark, which is also a good sign. Unfortunately, I seem to have left myself to fix the alpha Xorg 7.1 bugs on my own time. :) By now the announcement has made the rounds that the release team doesn't think we can hit the Dec. 4 target date because more time is needed for a final release candidate of the installer. Does that mean that RC bugs were the wrong thing to be focusing on for the past weeks? Well, no; if you want one place in Debian where Brooks' Law holds, I think you'll find that getting a d-i release out is it, and we still have a hard road ahead to make sure we do get our other RC issues sorted out in the same time frame. The installer just happens to put a lower limit on a release date, we still have an opportunity to screw it up from there. ;) At least the statistics suggest that we're going in the right direction. Only 13% of RC bugs fall into the "20 days or older and unfixed" category. Half of all RC bugs over 10 days old have a fix of some kind in unstable, and 64% of all reported RC bugs are less than 10 days old. We'll see whether this graph backs me up on this in a couple more days.

16 November 2006

Russell Coker: biometrics and passwords

In a comment on my post more about securing an office someone suggested using biometrics. The positive aspect of biometrics is that they can't be lost, no-one is accidentally going to leave a finger or an eye in their car while they go to a party while other authentication devices are regularly lost in such a manner.

The down-side is that having your finger or eye stolen would be a lot less pleasant than having a USB device, swipe-card, key, or other security device stolen. I think that it's good to have an option of surrendering your key when under threat (for the person who might be attacked at least).

Rumor has it that some biometric sensors look for signs of life (EG temperature and pulse), but I believe that these could be faked with a suitable amount of effort. A finger attached to a mini heart/lung machine should make it possible to pass the temperature and pulse checks (although I don't think that I have access to any data that is important enough to justify such effort on the part of an attacker).

One thing that biometrics could be useful for is screen-blankers. It would be good to be able to have a screen-blanker for your computer that operates when you go to get a coffee. For a period of 10 minutes after leaving a biometric method could be used to re-enable access. After that time a different method would ave to be used. This gives the convenience of biometrics for when you need it most (the many short trips away from your computer that you make during the day) but removes the benefit for an attacker who might consider removing part of your body. Also I am not convinced in the general security of biometrics. There are claims that you can make a finger based on a fingerprint which can fool a biometric sensor. If those claims are correct then a biometric sensor would still work for a coffee break (presumably you are not far away and will be back soon, and other people are in the area). The coffee break security is usually to prevent casual snooping such as colleagues who want to see what was on your screen but not actually do anything invasive to get it. Another benefit of biometrics for a screen saver is that although I trust people in the same office as me (whichever office that may be) not to try anything when they might get caught I still don't want them shoulder-surfing my password. Replacing the trivial authentication cases with a fingerprint reader would prevent that.

In the KDE 1.x days I had a shell script launched when the lid closed on my laptop which would lock the screen (the screen-saver ran in the background and a signal could make it lock the screen). This meant that I could merely close the lid of my laptop to lock the screen, this is fast and easy and also is not immediately recognised as locking the screen. Some people get offended if you lock your laptop screen when in their presence as they think that you should trust them enough to leave your most secret data open to them (generally people who aren't serious about computers - I'm sure that the same people would happily lock their diary if I was ever in the same room as it). Being able to lock the screen in a non-obvious way is a security benefit.

Regarding the comment about using a USB device to store passwords, there are two problems with this, one is that all passwords will be available all the time, this means a program that is permitted to access password A would also be given access to password B. The other is that the passwords can be accessed easily. The ideal solution is to have an encryption device that uses public key cryptography and stores the private keys on the device with no way of removing them. It would also permit the user to authorise each transaction.

I would like to see a USB device that stores multiple GPG keys and implements the GPG algorithm (with no way for anyone with less resources than the NSA to extract the keys). The device would have a display and a couple of buttons. When it is accessed it would display messages such as "signing attempt on key 1" and allow me to press a button to authorise or reject that operation.

This means that if I insert the key to sign an email I won't have a background trojan start issuing sign and decrypt commands. The only viable attack that would be permitted is the case where I want to sign a message and my message is sent to /dev/null and a message from an attacker is signed again. The non-arrival of my original message would hopefully alert me to this problem. I am not aware of any hardware which supports these functions.

Also I have just received a couple of RSA SecurID tokens as a sample. An RSA representative phoned me to ask about my use of the tokens, I said that I am an independent consultant and I have been having trouble getting my clients to accept my recommendations to use such devices and that I want to implement them on a test network so that I can give more detailed advice to my clients and hopefully get them to improve their security. For some reason the RSA rep found that funny, but I got my sample hardware so it's fine.

Michael Janssen: Quickie Hack: Online X-mas list

It's getting around that time of year when kids start singing little annoying songs and thinking of the toys that they will be getting in slightly more than a month. In my family, when everyone gathered for thanksgiving, the younguns were expected to have a list which could be disseminated throughout the family with everything they wanted. This avoided some of the more clich gifts such as sweaters and socks. But who's to say that grownups can't have a little fun as well? It's rather easy to use del.icio.us as a holder for your whole Christmas list. If you find something you want, just add it to your del.icio.us bookmarks with a special tag - I'm using “xmaslist2006”. Using del.icio.us gives you a few advantages over the traditional list: Things on the list need not be completely techie - if you're just looking for a nice sweater, you can add a general page or a representative item with a comment on it. Perhaps include your sizes as well, especially for items which come in a large number of sizes like pants. With any luck, you'll get just what you want this year.

Benjamin Mako Hill: Dare to DReaM?

I went to a talk today by Sun scientist Susan Landau on Sun's DReaM/Open Media Commons DRM system that I've mentioned in the past. Landau used a variant of these slides to do a rough overview of the Sun system and the problems that it is trying to solve. Halfway through her talk, Landau showed a slide titled, "Users Matter: Creative Commons." Elaborating, Landau mentioned that she had been talking to a number of people -- both at CC and outside -- about the possibility of using DReaM to enforce the terms of CC licenses. I interrupted Landau to point out that CC licenses had an anti-DRM clause that, as far I knew, would make her system unusable on CC content. The CC anti-DRM clause, plus the resistance of the CC and iCommons community to accept parallel distribution language, are why it's impossible to play CC-licensed works on an unmodified PlayStation or XBox (these systems only play signed disks) -- even if you include an unencumbered copy alongside! Landau reassured me that I must be mistaken and that she had talked about DReaM in depth with CC leadership, lawyers, and technical advisory board members and she was sure her system was at least possible. Puzzled, I shut up. For most of the rest of her talk, Landau talked about fair use and how a DRM system might go about respecting it. In his qualified endorsement of the DRM system, Lessig mentioned that DReaM, "would be implemented to allow individuals to assert 'fair use,' and unlock DRM'd content, with a tag to trace misuse." At the time, I had a hard time imagining how fair use could be built into such a system -- separating fair from unfair use is remarkably resistant to technical solutions. Even bright light cases like verbatim copies every page of the Encyclopedia Britannica might be fair use if I were to make them into a paper m ch bust of Johann Gutenburg or use them to wallpaper a gallery wall. Landau's acknowledged the trickiness around fair use and suggested a compromise:
By default, works might be encumbered in the ways and to the degrees that the copyright holder wish. However, users could petition for an unencumbered "fair use copy" by identifying themselves and then checking some boxes and explaining (briefly) why they think their use for the work qualifies as fair. Once they've done this, the system would present the user with an unencumbered, watermarked, and fully traceable piece of media.
Conceivably, requests would be subject to some sort of review (at the very least to prevent automated requests) and non-fair uses of watermarked goods would be strictly tracked. If a "fair use" copy is found in the wild, the watermark would be traced and the originator would be held liable. Of course, anonymous fair use becomes impossible but, as Simson Garfinkel pointed out at Landau's talk, users may have a right to anonymous speech and to fair use but not to anonymous fair use. "Fair" enough. It is perhaps important to point out that DReaM does not currently implement this "fair use" system and that, one can only assume, the vast majority of DReaM users (e.g., Hollywood movie studios and their ilk) would have no little interest in giving their users a blanket ability to make "fair use copies" and would in most cases choose not to enable such an option. But let's return to the issue of DRM enforcement of CC license terms. While I was initially quite confused by the idea of DRM enforcement of CC license terms, it made much more sense when I looked at the CC anti-DRM clause itself:
You may not distribute, publicly display, publicly perform, or publicly digitally perform the Work with any technological measures that control access or use of the Work in a manner inconsistent with the terms of this License Agreement.
The emphasis (mine) points to the crux of the issue. The CC anti-DRM clause only blocks technological measures that overstep the boundaries set in the rest of the licensee. For the free licenses, that's a wide boundary that leaves little room for DRM. But as I've pointed out before, CC is a lot more than just free licenses. Landau mentioned that her group was primarily interested in using the DReaM system to enforce attribution and non-derivative work clauses in CC licenses -- a wise choice as non-commercial use is hard enough for humans to discern. As a result, the DReaM system might be used to make it impossible to remove attribution from CC works or might block modification to works marked as "ND." The catch that led me to believe that CC license blocked all DRM was the fact that I didn't think it would be possible for a DRM system to respect fair use. After all, each CC license includes an explicit affirmation that, "nothing in this license is intended to reduce, limit, or restrict any rights arising from fair use." The question that the possibility of a CC DRM scheme like DReaM hangs on is: to what degree does Landau's suggestion live up to the fair use legal bargain? Landau pointed out that a number of lawyers including Pam Samuelson and CC's technical advisory board and legal staff have been generally positive about her fair use permission-asking compromise. Honestly and on CC's own terms, it's hard to see why they wouldn't be. The loss of anonymous fair use was only ever a right we enjoyed by a fortunate accident. Watermarks are only there to "keep honest people honest." If you are not doing anything wrong, what do you have to hide? But DReaM enforcement of CC licenses is a bad thing and the bad taste that it inevitably leaves in many commoners mouths is not hard to explain:
  • Many commoners are not comfortable with the idea of DRM because it shifts power over users' computing devices away from the users and makes computers obey the will of a copyright holder. That's true of DReaM just as much as as it is of Apple iTunes or Microsoft DRM.
  • Many commoners are not completely comfortable with all CC licenses, so the idea of technical protection measures enforcing these terms, even those allowing for fair use lines and in line with the will of the author, is seen as dangerous.
To solve the first issue, CC needs a more strongly worded anti-DRM clause -- ideally one tied to a parallel distribution clause. To solve the second, we will ultimately need a new banner under which only truly free cultural works will reside. Susan Landau doesn't have it easy but she does seem to have the genuine best interest of consumers and users at heart. That's more than I can say about the vast majority of people in the DRM business. She's trying to walk a fine line and she's almost certainly being abused and heckled by folks in the industry who call her "communist" and by folks like me who feel that she's sacrificing essential principles in an attempt to compromise. The one thing we all agree on is that the ground she's treading is mine field. Yet while I sympathize with her, I must speak out against both her and DReaM. A DRM compromise at this stage would be insanity. This is a fight we have to win.

Zak B. Elep: Ubuntu-PH Release Party for 6.10 (Edgy Eft)



Last night I called Ubunteros nearby Manila for the Edgy Eft (belated) release party at the Coffee Bean and Tea Leaf at Greenbelt 3. Little did I know that there will be a lot of folks coming from the just-concluded FOSS@work workshop joining in the fun, thanks to Yolynne Medina and Eric Pareja. Diane Gonzales and I got to the venue first, then followed by the FOSS@Work folks. Dominique Cimafranca, Migs Paraz, Ranulf Goss, Jopes Gallardo, and Joel Bryan Juliano were there too, and all in all we were easily the noisiest group in the coffee shop, seemingly occupying the entirety of the place. I originally planned to move the group to have dinner somewhere, but along the way everybody seemed to forgot dinner and we quite engaged in talking to everyone else. It was terrific. The 2 boxes of Edgy ,K,Ed Ubuntu CDs I brought were easily given away to everyone; we even had them exchanged and autographed (naks!) reminiscent of what Ealden and I did last February when Mark came here. As a finale, we had a group photo of everyone with their CDs; Dominique remarks that in his informal’ study, more and more women prefer Ubuntu (and I sure do think he’ll be blogging more about this soon. ;) Needless to say, the above photo doesn’t do great justice to what happened last night; it came from my elric which I didn’t get use much as a camera since I too was happily chatting away. That said, I expect RJ Ian will be posting his photos from his brand-spanking-new Kodak camera to the Ubuntu-PH site once he gets back to Mindanao with Yolynne and company. I also think the FOSS@Work folks also have their own photosite or wiki to post more photos, which we’ll be seeing sooner. Jerome Gotangco and Ealden Esca an, the guys whom we all owe Ubuntu-PH to, were unfortunately unable to attend last night, as Jerome was off to Cebu to participate in the ICT congress there, while Ealden was quite busy at work. Hopefully they (as well as last night’s attendees!) can attend the next Release Party for 7.04 (aka Feisty Fawn,) and hopefully it will be just as fun, and be more meaningful if more Ubuntu-PH folks get involved in its development! Update: Yolynne and RJ just posted pics fresh from their arrival to home. Expect more pics later, nicely tagged too…

15 November 2006

Russell Coker: economics of a computer store (why they don't stoc...


In some mailing list discussions recently some people demonstrated a lack of knowledge of the economics of a shop. Having run a shop for a few years (an Internet Cafe) I have some practical knowledge of this. I will focus on small businesses in this article, but the same economic principles apply to large corporations too.

When running a shop the main problem you have is in managing stock. There are two ways of getting stock, one is to have wholesalers give it to you for a period in which you can try to sell it and you pay for it when it's sold, this is probably quite rare (I don't know of an example of it being done - and probably no retailer wants to talk about it in case they lose it). Often retailers consider themselves to be privileged if they are permitted to pay for hardware one month after they receive it! The more common way of getting stock is simply to buy it and hope you can sell it in a reasonable period of time (often the wholesaler will offer to buy the stock back at a 10% discount if you can't sell it).

To buy stock you need money, this can come from money that has accrued in the business account (if things are going really well) or from a mortgage taken out by the business owner if things aren't going so well. For small businesses things usually don't go so well so the money used to buy stock is borrowed at an interest rate of about 7% or 8% (I'm using numbers based on the current economic conditions in Australia, different numbers apply to different countries and different times but the same principles apply). The ideal situation is when there is money in the company bank account to cover the purchase of all stock, this means that the cost of owning stock is that you miss out on the 5.5% interest that the money will get in a term deposit.

Almost all stock has a use-by date of some form. Some items have a very short expiry (EG milk used to make hot chocolate in an Internet cafe, some have a moderate expiry date (computer systems become almost unsellable in about 18 months and lose value steadily month after month), but in the computer industry nothing has a long expiry date.

Let's assume for the sake of discussion that you want to run a small computer store that is open to passing trade (this means that you must have stock for an immediate sale). Let's assume that all items of computer hardware lose half their value over the period of 20 months at a steady rate of 2.5% of the original price per month (I think that most computer hardware loses value faster than that, but it's just an assumption to illustrate the point).

The next major issue is the profit margin on each sale. If you can make a 20% profit on a sale then an item that has lost 10% of it's value while gathering dust in your store will still be profitable. However the profit margins on computer sales are very small due to having a small number of major manufacturers (Intel, AMD, nVidia, ATI, Seagate, and WD) that have almost cartel positions in their markets and there being little to differentiate the stores apart from price. I have been told that 3% profit is typical for retail computer hardware sales by the small companies nowadays! Now if the stock will lose 2.5% of it's value per month, you pay 0.5% interest per month and you make a 3% profit then if an item remains in stock for a month then you lose money. So on average (by value) you need to have stock spending significantly less than a month in your store. Cheap items such as low-quality cases and PSUs can stay in stock for a while. More expensive items such as new CPUs and the motherboards to house them must be moved quickly.

What's the first thing that you do to reduce stock? You can keep stocks low, but there is a limit to how low you can go without losing sales. The next thing to do is to not stock items that customers won't often buy or items where there is a similar item that you can stock as a substitute. The classic example of this is hard drives, a customer will want a certain capacity for a certain price - if their preferred brand is not in stock they will almost always take a different brand if it has the same capacity at the same price. Stores often advertise prices on multiple brands of hard drive in each capacity, but often only try to keep one brand in stock.

Of course this is a problem for the more fussy buyer. If you want to buy two identical parts from the same store on different days you might discover that they don't have the stock on the second day and that they instead offer you something equivalent. Not only do retailers have issues with managing their investment in stock but wholesalers have the same problem. So if a retailer runs out of WD drives and discovers that their preferred wholesaler has also run out of WD drives then they just buy a different brand - most customers don't care anyway.

There are some companies I deal with that have a business model based on services. One of them sells hardware to customers at cost, but charges them for the time spend assembling them, transporting them, etc. The potential for a 3% profit on the hardware isn't worth persuing, they prefer to just charge for work and also save themselves the sales effort. Another company I know operates almost exclusively on the basis of ordering parts when customers request them (but still make a small profit margin on the sales), this means that the customer can be invoiced as soon as the hardware arrives. The down-side to this is that wholesalers have the same stock issues and they sometimes have excessive delays before the wholesaler can deliver the hardware.

Dell is the real winner out of this. As they operate by mail-order they don't need to have the stock immediately available, they have a few days to deliver it which gets them time to arrange the supply. They can also have a central warehouse per region which reduces the stock requirements again. A 3% profit on items that rapidly decrease in value makes it almost impossible to sustain a small business. But an organization such as Dell can sustain a successful business at that level.

Of course the down-side for the end-user is that Dell doesn't want to have too many models as that just makes it more complex for the sales channel. Also they have deals with major suppliers which presumably give them deep discounts in exchange for not selling rival products (this is why some brands of parts are conspicuously absent from Dell systems).

10 years ago there used to be a small computer store in every shopping area. Now in Australia there are a few large stores (which often only have a small section devoted to computers) and mail-order. There seems to be much less choice in computer hardware than there was, but it is much cheaper.


PS I've attached a picture of day 39 of the beard.

Steve Kemp: I could kill, but I don t care about it

I’ve significantly updated the code behind the Debian Administration website over the past few days. Now: I still need to decide whether to open up the inter-user messaging system, and implement a few more tweaks and fixups. But these are pretty trivial to do, it is more a matter of deciding whether they are appropriate things than actually writing the code. All of this work combined with travelling a fair amount recently has left me behind on several fronts though. I’m going to dedicate tomorrow to catching up on the biggest outstanding issues, but I’m not sure how far I’ll get. Being behind on things actually makes me feel pretty good, I’m no longer on as many critic paths as I was a few months ago, so whilst getting behind is frustrating and annoying it doesn’t affect quite so many people/projects/packages/things. Either way better to be happy and behind than the reverse .. ObXen: The xen-hosting setup managed to reach an uptime of 100 days. I’m obviously not geeky enough; powers of ten remain much more significant to me than powers of two! Actually I take that back: I can recite powers of two to rediculous degrees and disassemble x86 and z80 hex dumps into opcodes with a fair degree of accuracy .. About time I got more practised at patching binaries; although its hard to find GNU/Linux software which requires serial numbers ;)

Biella Coleman: Stuck on the technology of yesterday

So I am in Alberta, Canada but I decided not to get a local phone number mostly because I have a VOIP phone that works fine and it lets me call Puerto Rico for free, and allows my sister call me for free too. But not having an Alberta 780 area code can be quite problematic at times and the latest chapter in the confusion has come from trying to get the IBM warranty folks to accept that you can call from Alberta with a non Alberta area code and realze that even if they accept that, the computer is the one wearing the pants and thus making the decision…So even if you convince them that new technologies make this possible, the transaction is still sabotaged because in the end, they rely on computer to get the actual service repair person to call you and the computer relies, and can only rely on the area code., who can only see that an area code 773= USA, so then it gets a US rep to contact you back after the initial phone call. Here is an IRC transcript discussing the confusion, which I think is pretty amusing: m: they are so confused
m: the guys says “what province are you in?” I say “Alberta”
m: and then he gets my number and he says “You aren’t in Alberta, sir”
m: and I say “Yes I am, my phone number is a US phone number, but I assure you, I am in Edmonton, Alberta right now”
m: and he says “Are you a canadian citizen?”
m: and I say ‘no, do I need to be, in order to be in Alberta?” and he says “The problem is, you are actually in the US right now”
m: I AM NOT IN THE USA
biella: heh
m: so I had to say “You realize that cell phones and voip technology allow you to roam outside of the USA and still use the same phone number?!”
b: and then what?
m: well he said I needed a canada number or their system would send it to the states
m: regardless if thats where my address is
m: their computer is too smart
micah anyways
biella: or not smart enough Well, we are now using my office number so hopefully all will be OK.

MJ Ray: Business: Email, sigs and signing

Ian Rawlings wrote in an article in uk.comp.os.linux that:
"There was a legal precedent set in the UK a little less than a year ago, in which the company's name and contact details in an email signature were taken as sufficient identification of the company for the contents of the email to be acceptable as a contract [...]"
and then helpfully provided some references about it. The headline on Disclaimers could make emails into contracts [The Register] seems a bit off. Even the article ends:
"The end result of this could be that people who include a signature and disclaimer at the bottom of their emails might actually be making themselves more liable than people who just send one line emails."
Note the might there. It's quite a leap, isn't it? Mehta v J Pereira Fernandes SA [2006] EWHC 813 (Ch) (07 April 2006) appears to have ruled that headers were not a sufficient signature, rather than that a plain text signature block (sig) is sufficient. Have I missed a key point here? AFAICS, the ruling contains the following key general points:
"28. I have no doubt that if a party creates and sends an electronically created document then he will be treated as having signed it to the same extent that he would in law be treated as having signed a hard copy of the same document. [...]"
"30. [...] if a party or a party's agent sending an e mail types his or her or his or her principal's name to the extent required or permitted by existing case law in the body of an e mail, then in my view that would be a sufficient signature for the purposes of Section 4. [...]"
I doubt that a sig is quite the same as a hand signature, as it doesn't necessarily 'serve as a method of authentication' as required by the Digital Signature Directive ( 1999/93/EC, Electronic Signatures Regulations 2002), but there are times when it could bind one to things. Essentially, using a sig is like using headed paper, not like hand-signing. Parts of the ruling (para.19) seem to argue that automatic insertions make things carry less weight AFAICT - does that hint at how futile those forced stupid disclaimers would be if relied upon in court? Does the same automatic-or-decision point also mean that using a electronic signature tool (gpg or whatever) selectively helps it carry more weight than signing everything automatically? I don't agree it ... signs death warrant for Digital Signatures [Financial Cryptography] Interesting questions. Anyone know if the answers are decided yet?

14 November 2006

Erinn Clark: I'm so country, y'all

If anyone knows where to buy grits and/or collard greens in the Bay Area, the home of godless, gritless liberals, please email me. I've tried TJ's, Safeway, and Whole Foods with no luck. Thanks!

13 November 2006

Mike Hommey: Trademark vs Copyright

Today, Sun Microsystem announced that Java is going to be free, released under the GPL. That’s amazing news, but I’d like to talk about another thing here. Duke, the Java mascot, is also being freed, under BSD license. Sun Microsystems is proving here that a trademarked logo can be free as in speech. The Mozilla Corporation could take a lesson, here.

MJ Ray: Chain Emails: Parcel Delivery Services

I've seen the Parcel Delivery Services email hoax twice in the last few weeks. Premium telephone services regulator ICSTIS issued a press release debunking it on 1 November 2006:

"This is in fact an urban myth. It is not possible for a GBP 15 charge to be made on connection."
I added a new tip about telephone number warnings to my email page.

Nacho Barrientos Arias: Debian NM process movements

I was approved by Debian NM FrontDesk team today, then, only one step remaining to dispatch my application. I hope to be DAM approved soon, go go! :) By the way, tomorrow I will have a skills test to get a driving license, wish me luck!

12 November 2006

Biella Coleman: The Limits of Technological Uses

In the past and for my hacker course, I have taught Paul Ceruzzi’s History of Modern Computing but the book was a little too dry to fly high with first year students but thanks to Joe Reagle’s excellent syllabus on the Impacts of Technology, I read a short but very sweet (and teachable) piece by him entitled An Unforseen Revolution: Computers and Epectations that not only gives a window into the early history of the computer but provides a very nice conceptual entry as to why it is hard for inventors of a new technology, such as the computer, to foresee and fully come to terms with its future uses, full range of capabilities, and utlimately its impact. Basically the context of invention combined with the training of inventors (which in this case, the first American digital computer, the ENIAC was invented by a physicst and an engineer for mathematical computing) stitches and thus initially limits the vision (and thus use) of the technology largely to its original purpose, while precedding technologies provide the conceptual juice drunk to understand the meaning of new technologlogies. So while today we clearly think of computers as a meta-machine, that can be whatever-machine-in-the-world-we-so-desire (so long as someone programs it to be that machine), in its time, with people so accustomed to machines as having one function, the cultural imagination was stuck. As Ceruzzie humorously conveys, a machine having such general capabilities seemed absurd, like a toaster that could sew buttons on a shirt. But the computer was just such a device; it could do many things its designers never anticipated. p. 126 With the passing of time came new innovations (Ceruzzi identifies new developments in programming as key in this regard) and use in new settings (notably businesses), the stitches were loosened and finally unraveled so that the computer came to take on the meaning it has acquired today. One perennial topic of inquiry in the field of STS concerns how particular contexts and other factors shape new meanings, visions, and uses, or just limit them, along with unearthing the labor that goes into making new inventions or scientific theories more generally accepted. This is a great little piece to teach incoming students about some of these concerns in STS, and without a lot of heavy-handed anything. And to make the project of teaching really fun, add this short clip from the Muppets, where Dr. Bunsen Honeydew totally ignores the Very Large Gorilla about to gobble him up because of his blind faith in technology.

Next.

Previous.