Orcmid's Lair

Republishing before Silence

2010-05-01T01:26:00.001-07:00

The nfoCentrale blogs, including Orcmid’s Lair, were published through Blogger via FTP transfer to my web sites. That service is ending.

Then there will be silence as Blogger is unhooked, although the pages will remain.

No new posts or comments will work until I updated the web site to use its own blog engine. Once that migration is completed, posting will resume here, with details about what to know about the transition and any breakage that remains to be repaired.

Meanwhile, if you are curious to watch how this works out, check on Spanner Wingnut’s Muddleware Lab. It may be in various stages of disrepair, but that blog will come under new custodianship first.

… And It Came to Pass

2010-04-17T11:15:00.002-07:00

Prophets in Their Own Lands

Back in February, I posted “Document Security Theater: When the Key is More Valuable than the Lock.” I was objecting to a technique, now being immortalized in open-document formats such as ODF and OOXML, whereby a hashed copy of a password is stored in the document such that it can easily be retrieved and used to attack the password itself. As explained there, the value of the password is not in being used to overcome the protection of the document against alteration – that is easy to do without ever bothering to know the password. The value of the password is that it is a memorable secret of the password holder and it needs to be protected (i.e., disguised) because it is also used for a variety of valuable purposes.

The failure to achieve a separation of concerns is probably a tip-off here. Either way, the exposure of hashed copies of passwords is not a new issue. There are available expert reports that identify the flaw. Attacks on passwords whose hashed copies are known have been popular since the first widespread Internet worm was released against unprotected systems. For example, the Unix /etc/passwords file with its hashed copies of passwords was commonly readable by all users and certainly anywhere once a root password was compromised. That users had the same passwords on different systems made leap-frog attacks from system-to-system particularly promising. It is like watching an elaborate arrangement of dominoes fall.

Encouraging Gullible Conduct

My argument then was that it is folly to increase the complexity of hash coding and believe that the password is thereby protected against discovery by a determined attacker. The defect in reasoning is in the assumption that the remedy to attackable hashed password copies is to use a “stronger” hashing technique. It does not make a memorable password stronger, and there is effectively a (disguised) copy of the password in plain sight. Having the copy and knowing the hashing technique allows that still-weak password to be attacked about as easily as it ever could be.

Systems which use password hashing as a way of not keeping passwords around in plaintext also arrange to secure the hashed copies against discovery. Once the hashed copies are known, discovery of the password is becoming child’s play, especially for memorable passwords that are reused by the password holder as a matter of convenience.

We’ve all learned by now that convenience trumps security, right? My objection is against willfully pandering to that conduct. You can imagine my dismay when my efforts to end that perpetration in the ODF specification were rebuffed by this argument:

“The justification for stronger algorithms than SHA1 is that many users use the same passwords for multiple tasks. So, it is worth to protect the key. Since we explicitly added the [SHA256 and stronger hashing methods] attributes to ODF 1.2 on request, we should not revert this.”

That is precisely the reason we should “revert” that so far draft-only provision of ODF 1.2.

Reality Will Not Be Fooled

Last week, there was announcement that some servers at Apache.org had been attacked and compromised. I saw notices such as ZDNet’s “Apache.or hit by targeted XSS attack, passwords compromised” and PCWorld’s (via Yahoo) “Apache Project Server Hacked, Passwords Compromised.” I didn’t read the articles, since it was about an all-too-common sort of break-in. What I didn’t appreciate was that the attackers stole lists of user names and their hash coded passwords.

What finally caught my undivided attention was the 2010-04-13 James Clark tweet, “Ouch. Hashed copy of password compromised for all users of Apache hosted JIRA, Bugzilla.”

The notice at the Apache Foundation cannot be clearer: “If you are a user of the Apache hosted JIRA, Bugzilla, or Confluence, a hashed copy of your password has been compromised.” And, of course, if we are putting hashed copies of passwords in plain site, it doesn’t need a hacked JIRA, Bugzilla, or Confluence configuration to get it. Even scarier is this observation: “JIRA and Confluence both use a SHA-512 hash, but without a random salt. We believe the risk to simple passwords based on dictionary words is quite high, and most users should rotate their passwords.”

What more do we need to know?

It is time to stop putting lipstick on what we know to be a pig.

I believe that this situation, for documents, arose through an over-constrained problem. We’ve been blinded into thinking that the safety of keys used for conveniently removing document protections is improved by strengthening the hashing for copies of those keys. All this does is encourage folks to be careless in the choice of passwords for this mundane purpose. We must find a way off that slippery spiral.

The intriguing problem is how to preserve the convenience of protection removal for document authors without subjecting their convenient, memorable password to discovery by attacking the plain-sight hashed copy. Is there a way out of the current awful practice? And if so, what do we do to overcome perpetuation of the flawed approach that is already in place?

[update 2010-04-17T19:09Z I broke up the first paragraph because it did not flow well. This allowed me to embellish the situation with more unpleasant historical facts. It is appalling to see how many years it’s been known that disclosure of hashed copies of passwords is a practically-attackable vulnerability]

Amaze Your Friends: Datamine Unlimited Statistical Nonsense

2010-04-16T12:40:00.001-07:00

In today’s Techflash Research post, Todd Bishop wonders why it is that Seattle is only #14 as a “Mac Metropolis.” (The catchy term is used in the report summary that Bishop links, and it is hard to resist repeating even if that is not what the report is about.)

First off, the Apple Market Ranker analysis that Experian Simmons summarizes is about owners of Apple products, not Macs. The basic question is, if you scratch a resident of one of the 206 Designated Market Areas (DMAs – don’t you just love being sliced and diced by market analysts?) in the United States, how likely is it that they will own or use an Apple Product: an iPod, iPhone, or Macintosh computer.

OK Ed, Let’s Wow ‘Em with the Numbers

The most impressive number that I see is that fully 21.6% of all adults nationwide own or use one of these products. I don’t know about you, but even if the iPod dominates the “ground truth” behind this statistical estimate, I am impressed. I’m sure that Apple stockholders smile and rub their hands in glee over what the iPad launch may do to these figures. For Apple executive management, on the other hand, I would consider this a cause for concern with regard to the prospect of market saturation. The iPad would be urgently-welcome as well as a potential market broadener.

In the San Francisco – Oakland – San Jose DMA, the gravity well of Silicon Valley (the red giant) and Apple (the blue dwarf), the figure is 32.3%. This is transformed into the wonderful statement that the adult residents of this DMA are 49% more likely than the average adult American to own or use at least one of these products. Well, sure 32.3/21.6 = 1.495 so we see where that more-dramatic figure pops out. If this were an election we’d say that Silicon Valley leads the nation by 10.7 points, but I guess that is not so sexy. I’m not sure what any of this numerical magic tells us, but let’s play along with the idea that it provides something useful for people who worry about life in the DMAs and how we might discretely dispose of our incomes.

The analysis continues through the top 10 DMAs (4 being in California) by this measure of Apple friendliness, with Boston (the Semiconductor East) at a close second and with Las Vegas at 27.9% as number 10. Starting with number 3, San Diego, we are told the populations of these DMAs (and the full report lists them all). For example, #4 New York weighs in with 30.4% of nearly 16 million adults and an observation about the observable presence of the iPhone. In contrast, the 8th and 9th ranked DMAs have adult populations of less than a million each.

Those Modestly Successful Puget Sound Folks

If you go through the registration to download the full report and find out about the Seattle-Tacoma DMA, you’ll see that we are #14 with a population of 3.6 million adults. A mere 27.4% are estimated to be Apple users (26.9% above the national average, if that fills you with regional pride). The largest DMA of those closest to the national average (and why not proud of it?) is #57, St. Louis Missouri, with 2.4 million adults and 21.5% estimated Apple lovers. For perspective, I note that 152 of the 206 DMAs come in below the national average for Apple Love.

Looking at the map that is provided in the full report, the Seattle-Tacoma DMA is at the heart of an Apple Love territory that spans the Vancouver BC – Portland Pacific-to-Cascades corridor, along with the I90 wedge to Spokane. We’re among friends.

Keeping Steve Ballmer Awake Nights

It’s not clear to me what this tells us about existing markets and market opportunities. It would be useful to know what proportion of those same populations own or use any device of the kinds that Apple sells and for how many of those none (and all) of them are made by Apple. Obviously, economic conditions, educational achievement, and infrastructure in a DMA also matters. There might even be a market differentiation among liberal (the “rest of us?”) and (economically-)conservative communities.

When the unpenetrated market consists of the owners of your competitors’ products, life becomes more difficult depending on how much people do not readily churn their discretionary possessions and favored brands. Still, the king of the mountain has to always sleep with an uneasy crown. If you are a pretender to the throne, I suppose having to fear disruptive forces other than your own is a condition to look forward to.

And a Little Reality Seasoning

The ZDNet report on personal-computer sales just reached my inbox: “Gartner: Apple sells 1.4 million Macs in US; captures 8% market share.”

To explain how these numbers are so widely different than that wonderful 26.1% of adults, nationwide, it is important to understand that market share is not about what folks own or use, but what was sold. The market’s 100% is all of the sales in a particular timeframe. Because sales of personal computers in 1Q2010 are 20% better in units sold than 1Q2009, the market is spoken of as having increased by that much. Notice that the statement is not about the revenue or the profit from those sales, which might sort out quite differently.

From this perspective, Apple sold 34% more Macintosh computers, moving from 7.2% of the units sold to 8.0% of the units sold in the most-recent quarter. HP and Dell still dominate with over 50% between them but their unit sales did not grow as much as the market, which grew about 20%. The sleeplessness at HP and Dell is of a different quality than what has Apple bounding out of bed every morning. (Whether they made up for it in cash rather than volume, we won’t know from the Gartner analysis.)

To estimate the fuzz in all of this, the ZDNet article also reports an IDC finding that Apple grew its sales but lost market share against the total market (which grew more). There is not enough information to know which are oranges and which are, uh, apples, among these comparisons. It could be that Apple lost market share worldwide, since Macintosh penetration is apparently not so hot outside the United States while HP and Dell maintain their positions globally. [Update 2010-04-19T01:20Z It’s worse than that. According to the IDC Analysis, Apple doesn’t even show in the top five world-wide, and their growth in the US was below the 18.4% of the total market. An 8.3% growth in Apple computer shipments left them down from 7.0% to 6.4% of the market. IDC describes its report as counting shipments and determines market share from that.]

Perhaps the oddest reporting of these latest figures for personal-computer sales is the underplayed fact that Toshiba sales grew faster than Apple’s, taking away 4th place. Acer did even better strengthening its 3rd place position as well. These two can be credited with capturing most of the market growth between them. Although this phenomenon is noted in the ZDNet article, Apple gets the headline and the lede. Interesting, aye?

[Update 2010-04-16T22:46Z Something lead me back for a second look, adding a paragraph about the far-superior Toshiba and Acer performance as of 1Q2010. The Tablet derby through to the end of 2010 is going to be fascinating.
Update 2010-04-16T20:46Z Repairing a typo allows me to speculate even more with almost no evidence.
Update 2010-04-16T20:33Z I couldn’t resist adding the information about 1Q2010 personal-computer market volumes as evidence of how important it is to get beneath the numbers to find out what is really going on and who it matters to.]

Don’t You Just Hate It When …

2010-04-08T09:47:00.001-07:00

… You visit a site, create a comment, and

You are asked to log in and you have no idea that you have a password for the particular site.

… You attempt to register at a site, and

They tell you that your e-mail is already registered with them because they are part of a conglomeration of sites none of which you recognize at all and/or have saved a password and account entry for in your password safe.

… They prefill a form with your user name or e-mail address

But it is because you created an account on some other blog of the same service but you filed the password under the name of that other place, having no idea you were registering for wordpress or typepad all over the galaxy and actually had no intention of doing so and you don’t remember what that other place was anyhow

… They will take an OpenId

But you have to explicitly register an account anyhow, and your already-filled comment form is lost in the process.

… They insist on inviting your automatic Disqus logon if the cookie is spotted

But then you have to disable the indiscriminate e-mail river of Disqus commentary because it drowns your inbox and so, tell me again, why did I want to use Disqus?

… You can’t find your password and you seek their help

Only they clearly send you what must have been your original password in a plaintext e-mail.

This situation makes me very happy that I use a random-password generator for every new account, so that the password protects only that one logon and nothing else. I am unwilling to have the key be more valuable than the lock.

You may notice that I have stopped using Technorati tags, since they seem to have no effect whatsoever and I haven’t figured out how to have them make a difference with any alternative source of tags. I should figure out de.licio.us, I suppose, except in that case I should first figure out why my de.licio.us feed has stopped.

I also use categories, well no … I use Blogger Labels which are sort of like categories except it is hard to find out what they are and place a current list and links on my sidebar. Blogger backlinks and Blogger labels remind me of the propensity of some Microsoft developer types to do-it-their-way when there is already an established practice out there. Yes, developers just want to have fun. But inflicting their NIH syndrome on the rest of us is not OK. Go do that in the privacy of your own home, please.

For the labels, I think I will periodically post a message that simply goes into every category I have used (Windows Live Writer knows what they are), so I can remind myself not to make up more and maybe even prune the list where I tend to always use multiple labels in combination.

Aren’t you happy that I have spiffed up this blog to the point that it serves as an invitation to my regular blogging on whatever strikes my fancy in the moment? Just wait, there are five more blogs and I have a great deal of pent-up blogging from my 18 months nose-down in document-standards work.

Blog Template Unification: Template Trickiness

2010-04-07T16:00:00.002-07:00

In Orcmid's Lair: February Frights Redux: Unification for Creative Destruction, I commented that I am in a death match between decline of my web-development machine and May 1, 2010, when when Blogger ceases publishing via FTP to my own domain and hosting service.

The laptop is now on life support and, so far, has not entered a vegetative state. But it can't sit up and stand on its own any longer.

Meanwhile, I have been working to unify my Blogger templates around one single "classic" layout. That has been interesting.

Testing Without Ruining the Blog

For dressing-up the sidebar and tidying up some aspects of the blog posts, I was able to confirm template changes using the template-preview provisions of Blogger.

Straightening Out the Archive Structure

It became trickier when I decided that each blog's archives should be in a separate folder. Orcmid's Lair wasn't done that way. Its archive pages were at the same level in the blog folder as the main page and some supporting items. Fortunately, I discovered that the archive-list pull-down would automatically change to reflect the new location once I said archives should go into a separate sub-folder. Then all I had to do was move the existing archive pages to the sub-folder to make the pull-down be true.

I now must remember to republish those few pages that have an older version of the pull-down. In this case, the blog is a little-bit broken, but easily fixed.

Being Conditional About Comments

The next tricky business was creating more cases that were conditional on which page was being generated.

In the past, I had full comments show up everywhere there is a copy of the related post. I decided to simplify and have comment detail only on the individual post pages. The version of an article on the main blog page, and in archives, provides a count and a link, but no comment content.

This became tricky to test because the template preview mechanism only shows what happens to the main page. To see what happens to posts, I must install the template and create a post or repost to see the effect on the individual post itself.

I can cause a repost, usually, by adding a comment to the post. If necessary, I can also change the conditionality to see what everything on the main page, but that is not a complete verification.

And Then There’s Backlinking

Even trickier was seeing how support for links would work. Blogger has a feature called backlinking that will report about other blogs that link to this one.

I don’t think it is exactly a track-back mechanism. I'm also not not sure how it works for blogs that are published via FTP.

To test whether backlinking is operating, despite Blogger indicating that my blog is backlink-enabled, I need to create a blog post that links to another of mine, and see what happens. That is the provocation for this particular post.

Also, I am using the BlogThis! pop-up that is provided if the "Create a Link" link is followed from one of my blog posts. This seems to be one way for Blogger to notice that a link to a Blogger-generated post is being made. Once this post is up, I can also recall it into Windows Live Writer and see whether I could have done it from there too.

Next Attempt

Well, BlogThis! does an awful formatting job. I recalled the post into Windows Live Writer to touch it up as well as see if there is any special indication that this post is linking to another. I don’t see anything.

I’ll repost now and then see if I have to publish from Blogger itself to have backlinking be noticed.

Oh, and By the Way

While I have been rooting around in tweaking the individual blog items and how comments and backlinks appear, I noticed another problem. The permalinks on comments don’t work. I have attempted to use an alternative way for creating the backlink, but there is something not happening. I will have to look at the source-code of the generated HTML pages to figure this one out.

OOXML Implementation: Can Expectations Ever Trump Reality?

2010-04-04T22:59:00.001-07:00

Technorati Tags: open standards, Microsoft, OOXML Format, ISO/IEC JTC1 SC34 WG4, IS 29500, ECMA 376, OOXML strict, OOXML transitional

I was startled to see the level of passion in Alex Brown’s 2010-03-31 post, Microsoft Fails the Standards Test. Alex has two concerns: (1) dwindling OOXML standards-maintenance attention and resources; and (2) Microsoft silence with regard to implemented support for the strict level of IS 29500 and any retirement of the transitional level as the only level supported in Microsoft implementations of OOXML.

Perhaps the most level-headed analysis is the “Wow” from Andy Updegrove in his 2010-04-01 post, Alex Brown: “Without action, the entire OOXML Project is now surely headed for failure.”

For me, the most peculiar aspect of the reactions I see is not that Alex has the concerns he announced, but that others treat his expression of concern for the future as a declaration of the actual present. Furthermore, these observers who proudly pontificate that there is no action, there will be no action, and there was never going to be any action, excitedly congratulate Alex on having awakened from being hood-winked. It is as if nothing has happened since 1998 and the book is closed on Microsoft forever.

Expectations Against Observable Reality

I want to look at just one part of this situation: expectations around IS 29500 implementation in Microsoft products. The desire to have Microsoft abandon to-be-deprecated transitional provisions of IS 29500 in favor of producing only documents in the strict IS 29500 format is tied into that expectation.

I am eminently qualified to address this topic. I have no information on what Microsoft is actually doing to incorporate support for IS 29500 in its products. I have no idea what strategy Microsoft has, if any, with regard to the retirement of support for IS 29500 compliant transitional documents. Microsoft doesn’t tell me anything about product efforts and I am happy to keep it that way. Microsoft doesn’t seek my advice on the matter either. So I am perfectly positioned to speculate, with my standing as a standards, interoperability, and architectural armchair astronaut unblemished.

What I am going to report is my observation of the simple state of affairs and how difficult it is to erase the past and jump to implementations that only produce what are called strict IS 29500 documents. Expecting that to have been achieved in two years is about as unobservant as belief that all Microsoft needed to have done was adopt ODF as its native format in the first place.

Can I Has Have Me Strict Now Please?

The ISO/IEC International Standard for OOXML, IS 29500:2008, has two major levels that can be implemented. There is a strict IS 29500 format that is the subject of the main part of the specification. There is also a transitional IS 29500 format that mainly includes everything allowed in the strict format along with some other provisions that it was agreed would be retired but retained now for compatibility purposes. The idea was that there would be come a time when consumers might accept transitional documents but the routinely-expected output would be a strict IS 29500 document. The strict-transitional differentiation and the notion that production of non-strict documents would be discouraged for new documents was a creation of the DIS 29500 Ballot Resolution meeting in February 2008. It was ratified in the approval of DIS 29500 as an International Standard on April 2, 2008.

In IS 29500:2008 as it was first published in November, 2008, the set of strict documents is essentially a subset of the transitional documents. In addition, it is the transitional documents that include the most provisions of ECMA-376:2006, the specification supported by the already-distributed Microsoft Office System 2007 (and any Office 2003 configuration, like mine, to which the OOXML Compatibility Pack has been added). Various translators also accept or emit ECMA-376 documents. The .docx, .xlsx, and .pptx documents that are growing in numbers every day in production use satisfy the provisions of ECMA-376:2006 and tend to use transitional provisions of IS 29500 rather than preferable strict counterparts.

There is already a legacy situation with OOXML concerning the need for products to support ECMA-376:2006 in the documents that are accepted and produced.

Well, Not So Fast, Sparky

In addition, SC34 WG4, the standards-development working group that maintains IS 29500, has now created a situation in which there is more than one strict IS 29500.

As part of the early maintenance work, some found it disturbing that there was no way to differentiate provisions of ECMA-376:2006 from IS 29500 transitional and of IS 29500 transitional from IS 29500 strict. The same namespaces were used for all of them. This issue was being addressed before the ink was dry on IS 29500:2008. In 2009, the SC34 WG4 arrived at a set of amendments, most of which were designed to separate the namespace used for the strict provisions of IS 29500 from the namespace used for transitional documents with their additional/alternative too-be-deprecated provisions.

If Microsoft had already implemented a way to produce strict IS 29500:2008 documents as defined before these amendments, those documents would now be considered transitional documents. Their XML parts would employ the transitional namespaces, not the recently-adopted ones for strict IS 29500.

It has been a few months since the amendment solidified, and one would hope that Microsoft is looking at how to enact the production of strict IS 29500 documents in some customer-respectful manner. Whether that is something that could possibly appear in the soon-to-be-released Microsoft Office 2010 products is not something I will even guess about. Microsoft’s commitment to support IS 29500 is not specific on this topic, and there may be residual difficulties in how the separation of strict out from under transitional has been executed in the amendments and any anticipatory implementation work.

I can see ways to work through a gradual migration where the expected output is strict IS 29500 documents. But I would expect transitional/ECMA-676 documents to be accepted for a long time and to be produced at least as long as “Save As … 97-2003 Document” also exists.

Appendix: Arriving at Separated Strict and Transitional Namespaces: The Progression

Although it has been two years since there was agreement on what IS 29500:2008 would be, it was not until November 25 that the specifications were publicly available. In less than one year after that, amendments creating a substantial difference in the separation of strict OOXML documents from transitional OOXML documents was formulated and put out for ballot. The official Corrigenda and Addenda carrying those and other changes are not yet available to the public. Here is the progression.

ISO/IEC International Standard 29500:2008 Office Open XML File Formats. First edition 2008-11-15. This is the first official publication of IS 29500 for OOXML after the 2007 balloting and a subsequent Ballot Resolution Meeting in early 2008. The specification is in four parts:
- Part 1: Fundamentals and Markup Language Reference. This is where the strict provisions are specified.
- Part 2: Open Packaging Conventions. There are some transitional considerations in packaging. These are being treated by separate defect reports. The OPC are adaptable for non-OOXML usage.
- Part 3: Markup Compatibility and Extensibility. A set of independent features by which extensions can be added to an XML Document using a set of specific conventions that allow for graceful degradation when the extensions are not understood.
- Part 4: Transitional Migration Features. Additional features that are not included in the strict provisions. As originally formulated, the strict provisions were to be a subset of the transitional OOXML documents and all of ECMA-376 was embraced by transitional OOXML with a few deviations.
SC34 N 1246 ISO/IEC 29500-1:2008/FPDAM1, Part 1: Fundamentals and Markup Language Reference – AMENDMENT 1, 2009-08-04 available as a public 1.56MB downloadable Zip file consisting of the proposed draft amendment and the corrected (RNG and W3C) schemas.

This public document was taken to a four-month SC34 FPDAM Ballot that closed 2009-12-04.
SC34 N 1251 ISO/IEC 29500-4:2008/FPDAM1, Part 4: Transitional Features – AMENDMENT 1, 2009-08-04 available as a public 1.59MB downloadable Zip file consisting of the proposed draft amendment and the corrected (RNG and W3C) schemas.

This public document was taken to a four-month SC34 FPDAM Ballot that closed 2009-12-04.
SC34 N 1253 IS 2950099:2008 Defect Report Log [At Closure of the DCOR1 and FDAM1 Sets], 2009-08-04 edition available as a public 3.91MB downloadable PDF file.

Defect Item 08-0012 was submitted by Ms. Ruth Schneider of the National Body (SNV) for Switzerland. It was circulated to SC34 on 2008-11-03. The defect involves the inability to distinguish between ECMA-376:2006 schemas and those of IS 29500 because the same namespaces are used. From the log on this item we can see that there were many ways to deal with explicit versioning and that no reasonable solution stood out. Finally, at a meeting in Prague on 2009-03-24, a small break-out group returned with proposed requirements for any versioning solution:
- To push producers gently towards strict conformance [emphasis mine, orcmid:]
- To improve interoperability
- To do no evil to the 29500 ecosystem (i.e., files, end users, and implementations)

The option to change the namespace for strict schemas and only strict schemas emerged in subsequent discussions. It took until the 2009-06-22/24 meeting in Copenhagen to finish wading through the considerations and agree that the only change would be new namespaces for strict schemas and the associated narratives. Along the way there were was stumbling around versioning, conformance attributes, and features of transitional that had no existence in ECMA-376:2006 and were there now merely to preserve transitional as the superset. Although the final changes needed to accomplish ~~this~~ the namespace separations were contributed by Microsoft expert Shawn Villaron of the ECMA delegation ~~(and Microsoft)~~, the issues and inter-dependencies were heavily discussed among all of the WG4 participants.

In the end, resolution of defect item 08-0012 involved over 300 amendment entries in N1246 for IS 29500 Part 1 and over 200 in N1251 for Part 4. This is about 75% of all of the amendment entries in the FPDAM1 set, all on behalf of this single defect and its simply-stated disposition.

Brad Smith’s 2009-12-16 Microsoft Statement on European Commission Decision. This declaration from Microsoft establishes a “public undertaking” with regard to interoperability.   Part of this undertaking includes a Warranty Agreement covered in a 2009-12-16 Annex (downloadable Microsoft Office Word .doc file). The timing of this announcement has nothing to do with events at ISO/IEC JTC1 SC34 (and some of the “undertaking” documents were first uploaded with 2009-10-06, dates). The “undertaking” is in the spirit of the Interoperability Principles and other agreements with regulatory authorities (c.f., my 2008-02-26 Interoperability by Design post). It also puts some serious teeth into Microsoft commitments by asserting that “Microsoft will make available legally-binding warranties that will be offered to third parties.”

In my reading of the available on-line documents, legally-binding warranties are provided for an unstated fee to parties that intend to provide interoperability with Microsoft implementations of various protocols and industry standards. Under such warranties, there is assurance that successors to Microsoft Office Word 2007, Excel 2007, and PowerPoint 2007 will support IS 29500 rather than ECMA-376. Nothing in the “undertaking” distinguishes between strict and transitional provisions of IS 29500.
Subsequent Creation of Documents. There are no more-recent public documents, as of 2010-04-03. On 2010-03-05, documents SC34 N 1382 and SC34 N 1384 appeared as final FDAM1 amendment texts on the SC34 document repository. I presume that these reflect the disposition of FPDAM1 ballot comments and perhaps other feedback on N 1246 and N 1251, respectively.
New Defects from the Namespace Change. I can’t imagine that the massive changes involved in separation of strict into its own namespaces would not be accompanied by new defects, ~~especially in~~ considering how ~~the~~ dependent the transitional provisions were on the formerly-strict-but-same-namespace provisions. This seems to be borne out in the Outstanding Action Items 7-9 of the 2010-02-18 SC34 WG6 Teleconference minutes (available as a public 574kB downloadable PDF file). Although there will need to be those, perhaps other, repairs, there is probably little that would further delay an implementation being able to recognize its supported strict features under either namespace so long as the provisions are identical. Preventing the clashing of unique-to-strict and unique-to-transitional provisions will require care in all cases. I am blissfully ignorant of how the mixing of features might complicate the internal, “in-memory” document model of Microsoft and other existing products. The added complexity of testing and building a relevant document corpus for all of the use cases strikes me as seriously daunting.

[update 2010-04-05T23:41Z And I am finally scrapping all of that useless white space that was on the end of my blog text.
update 2010-04-05T23:11Z I misquoted Andy Updegrove’s blog title quoting Alex Brown and have fixed it, thanks to the good eye of Rob Weir.
update 2010-04-05T16:49Z Too be more careful when there are twoo many words to get right the first time. Sometimes, I just can’t bear it.
update 2010-04-05T15:11Z I took inspiration from Alex Brown’s comment to tidy up some wording and add an after-thought about the unseen but material impacts of a simple namespace change in a world of comingled strict and transitional features.]

February Frights Redux: Unification for Creative Destruction

2010-04-03T10:27:00.002-07:00

Technorati Tags: Blogger, computer upgrades, web development, blog authoring, Tablet PC, Windows 7, mobile working, Windows Home Server

I have moved from February Frights to April Insecurity. Here’s an update on the items that I had on my plate:

Frailty of Compagno, the web-development server, is increasing. Danger, danger … . I am operating on chewing-gum and a prayer for now. I have to do this, but figuring out staging for coming up in a reliable way on the Windows Home Server is daunting for me. More urgency is required.
I have successfully migrated Vicki onto a docked laptop. There are some software installs remaining for the Windows 7 Dell Inspiron 15, and WiFi roaming needs to be figured out. Everything is operating beautifully and I am jealous that Vicki has the most advanced system in the house at the moment. Before removing her 2006-vintage Dell desktop system, I repaved it with Windows 7 too. Worked like a champ, and we gave that system to our niece, Liza.
I rolled Quadro, my Tablet PC, back to Windows XP from Windows 7 RC1. This worked easily, by using the restore discs for the Toshiba Satellite Tablet PC. I forgot about all of the craplets that Toshiba installed on this machine. I miss the improved Tablet functionality (and 3-d chess) of Vista, but being back on Toshiba drivers and a stable configuration is worth it. I gave up on the idea of having it be my e-mail machine and attempting to have more than one version of Microsoft Office was also too painful, but Quadro is in a stable, fully-functioning state now. Of course, I am far beyond Toshiba’s 2-year update commitment and must find a Windows 7 Tablet PC replacement eventually. I figure the later the better.
Upgrading the Development Desktop will wait. There’s no technical reason to hurry and I will keep watching the desktop pricing-performance curves move. The biggie, beside running multiple VMs on a hot processor with fast RAM will be managing to drive a 36” display, once energy-efficient and affordable ones of those become available.
Moving off of FTP’d Blogger to different Blog Hosting. There has been a reprieve. Google will continue support for publishing of Blogger blogs via FTP until the end of April. I’m now trapped in two races, once against a Google deadline, once against entropy death of a frail 1998 laptop. Thanks to advice from Rob Weir and researching other ways of self-hosting a blog, I have a plan. You are seeing the early steps right here:

I am going to unify all of the blogs I manage under a consistent Blogger template set. The features and layout will be the same, with changes in color scheme and symbols only. This means that it is all going to be table-based HTML 4.01 transitional too. I fooled around with CSS-only layout enough to know that I will stick with what works and solve the CSS problem later.
The first stage is to adjust the Orcmid’s Lair template as the pattern. I am starting with a generic sidebar on the left, and some cleanup to what I call the title block at the top of the page. If I have that right, this post will drive out those changes to the main page and all posts from here on out. I will continue working on changes to the body text and comments on Orcmid’s Lair.
The next stage is to propagate variations of the unified template to all blogs. This will including Spanner Wingnut, my laboratory for experimenting with further changes. The format unification accomplishes two things. First, I have been resisting blogging over unhappiness of the formats. I wanted something more pleasant before investing in more posting, especially on Vicki’s blog and my nfoWorks: Pursuing Harmony blog. Secondly, once I have migrated Spanner Wingnut successfully, whatever I had to do to establish a new template matching my desired style can then be replicated back to the other blogs.
I want to host multiple blogs on a single web hosting account that has multiple domains implemented on a single site. I also want to retire the existing blogs in place. To continue to develop new, self-published pages on the same folder structure, I don’t think systems like WordPress will work easily. In general, I am reluctant to move to systems that generate pages dynamically and/or use directory-redirection techniques to map URLs to what the blog engine really uses. I learned a lot about exploring WordPress and more checking into Drupal also. At the moment, Movable Type looks like a better choice.
The only way to be certain that I have found a worked case is to attempt to migrate Spanner Wingnut first. Once I have a working migration that allows Windows Live Writer authoring and multiple blog hosting, I will move over the main blogs, including this one.
There will be some breakage. I will retire the current blogs “in place.” The new blogging system will generate all new pages. But the new-systems RSS feed will start anew and the archive links will not include the Blogger-generated pages. Also, comments will stop working on all “legacy” blog pages. I might find some sort of bulk change procedures to repair some of this later on, but it won’t be that pretty during the cutover. May 1 is no longer in the distant future. The big job is accomplishing migration of Spanner Wingnut and then one other.

Worst Nightmare: OpenDocument Format Embraced-Extended

2010-02-27T11:03:00.003-08:00

Technorati Tags: open standards, OpenDocument Format, Microsoft, Sun, ODF, private extensions, Boycott Novell

Once upon a time, there was a celebrated open-standards process and it brought forth OpenDocument Format 1.0, then 1.1, and some day soon, ODF 1.2. There was joy and harmony in all the lands, as dragons were driven off to lonely peaks and uncharted waters.

A great fear and moaning, even gnashing of teeth, arose as $uper $ize $oftware $ystems, Inc. ($$$$ on NASDAQ) joined the fray and raised its own banner for ODF. In early 2009, the OASIS ODF TC took fright over the prospect that $$$$ would exploit provisions in ODF 1.1 that allowed for extensions. This loophole was closed by shrinking the definition of conformance to exclude ODF 1.1-conformant extensions from conformant ODF 1.2 documents. This, along with decrying of any existing work that might be borrowed from the OOXML specifications for fear of patent torpedoes, gave solace and respite to the ODF 1.2 effort. The avaricious $$$$ dragon had been belled and kept away from sullying the open standards movement and all that portends for freedom, motherhood, civil order, and fries with that.

As the devoted mavens of the ODF TC blissfully scratch away at perfecting the careful delivery of long-awaited ODF 1.2 drafts, the foreign-elements Maginot Line is their shield. But wait, heedless of the disrepute and regulatory scrutiny that would befall $$$$ introducing private, co-opting extensions, a major new release makes its way through the low countries, summing all our fears:

Let me think about this. Today is February 27, 2010. Not only is the ink not dry on ODF 1.2 yet, the ink isn’t even wet on ODF 1.2 yet. I have no idea how one can tell the difference between ODF 1.2 and ODF 1.2 Extended under those conditions. It would all appear to be 1.1 Extended (maybe), and not in a nice way. One is not supposed to reuse ODF namespaces for any extensions. It is just like $$$$, it is said, to claim adherence to a standard based on their own premature implementation, forcing everyone else to deal with their quirks, unapproved extensions, and other deviations.

Will any of the eagle-eyed monitors and protectors of truth-through-openness notice? Will eyebrows be raised? Will the phones in Massachusetts and European Commission executive departments ring off the hook? Will voice mailboxes overflow? Will Boycott Novell churn out another 100-or-so posts linking to this smoking gun?

Maybe not:

I wonder which community member we can thank for this particular bright idea. I figure that Boycott Novell will spin this, as spin there will be, if the Novell distribution commits this same abomination by relying on the same code base. Or if the Novell distribution doesn’t. Either way, there will be much ink spilt. Or maybe not.

I knew that OO.o 3.0.1 claimed to support ODF 1.2 format. I figured that was simple competitive cluelessness. Just the same, I clung to my OO.o 2.4.1. I would not have considered installing ODF 3.2 except others on OASIS TCs are using OO.o 3.x versions and we were having trouble collaborating on documents because of version differences, apparently-known bugs in pre-3.2 releases, and peculiarities of suddenly-ancient OASIS document templates. I only kept 3.0.1 around for forensic work and was not eager to upgrade at all. Still, forensic work, and collaborating with OASIS TC peers, led me to install 3.2 on Friday, 2010-02-26. (Haven’t we heard this need-to-upgrade to get-along story before?)

I routinely set OO.o 3.x installations to load/save in ODF 1.0/1.1 format. I must have seen the 1.2 Extended option, but I was busy and I didn’t think about it much. I was doing some forensic work and making protected and signed documents with both OO.o 2.4.1 and the freshly-installed OO.o 3.2.0. Even though 2.4.1 allows digital signatures, and 3.2.0 will recognize them, 3.2.0 will not itself allow signing of a document unless it is saved in what is called OO.o 3.2.0 ODF 1.2 format. So I did it that way for the protected spreadsheet I wanted to save out of 3.2.0. I did not and will not swallow the ODF 1.2 Extended pill. My 3.2.0 is now reset to Load/Save in ODF 1.0/1.1 format and it will stay that way. And I will only use it for document forensics work (and for shared-document authoring under duress).

Continuing these 1.2 claims is now at the level of travesty at worst, self-satire at best. I suppose it demonstrates that cluelessness is alive and well and thriving. I’m not putting up with it. If this mockery is in plain site, what is there that is not so easy to see?

It’s not clear what I should install on the machines of family members who only need a basic office-document software suite that will import and export Microsoft Office compatible documents. If KOffice provides an honest and good-enough independent implementation, I may start recommending and supporting that. I suppose $$$$ has no interest in putting a stake through the heart of these shenanigans, letting us and the various regulatory authorities scratch our heads and ponder just exactly what we have become willing parties to.

It has been observed that human institutions have a tendency, over time, to turn into the problem they were created to solve.

It is said that warfare teaches the victor that violence works. I say that warfare teaches the vanquished that violence works.

Have you ever noticed that our fear and distrust of others gives us permission to be what we are afraid they are?

Maybe it was ourselves we didn’t trust all along?

Abstraction: Einstein on Mathematics+Theory+Reality

2010-02-21T20:22:00.001-08:00

Technorati Tags: Albert Einstein, physics, formalized theories, interpretations of theories, reality, abstraction, models of theories, empiricism

[update 2010-02-23T19:46Z I had to change the title of this post. My narration below revealed to me that theory is the statement (a claim) that connects the logical-forma mathematics to features of reality, and is therefore the statement of the theory that posits the validity of interpretation that connects to a model in reality (not of reality, so far). I’m also fixing a typo while I’m here.]

The abstraction of formal theories away from any appeal to nature is a theme for me. I claim that it gives us a powerful way to appreciate nature. I find it indispensible in teasing out what makes computers useful and what part software developers play in having that work for us. To my great pleasure, this is not a new or particularly radical notion at all, although relatively new to me. Albert Einstein had his own appreciation.

“It is mathematics which affords the exact
natural sciences a certain measure of security,
to which without mathematics they could not attain.”
-- Albert Einstein, 1921, p.28

In 1921, Albert Einstein, then 42, gave an address in which he explained what was necessary for him to appreciate about the difference between mathematics and theories about the physical universe in order to formulate the theory of relativity. He began by pointing out a peculiar situation around the applicability of mathematics to practical affairs.

“An enigma presents itself which in all ages has agitated inquiring minds. How can it be that mathematics, being after all a product of human thought which is independent of experience, is so admirably appropriate to the objects of reality? Is human reason, then without experience, merely by taking thought, able to fathom the properties of real things?” [1921: p.28]

For Einstein, this is not a question; he will answer the second question in the negative. His analysis of the first question is foretold with this response:

“As far of the laws of mathematics refer to reality, they are not certain; and as far as they are certain, they do not refer to reality.” [1921: p.28]

He gives credit for clarity on the matter to the introduction of mathematical logic or “Axiomatics,” put this way:

“The progress achieved by axiomatics consists in its having neatly separated the logical-formal from its objective or intuitive content; according to axiomatics the logical-formal alone forms the subject-matter of mathematics, which is not concerned with the intuitive or other content associated with the logical-formal.” [1921: p.28]

At the time that Einstein speaks of this as such a powerful innovation, Whitehead and Russell’s Principia Mathematica has only been in print since 1910. David Hilbert’s famous 23 problems had just been announced in 1900 when Hilbert had already made a formal axiomatization of Geometry and demonstrated its completeness. In contrast, Kurt Gödel was about 15 when Einstein gave this talk. Alan Turing was 9. (My mother was 4.)

Einstein uses Geometry to illustrate the separation between the logical-formal mathematical expression of a theory in what he termed the modern formulation:

“Geometry treats of entities which are denoted by the words straight line, point, etc. These entities do not take for granted any knowledge or intuition whatever, but they presuppose only the validity of the axioms … which are to be taken in a purely formal sense, i.e. as void of all content of intuition or experience. These axioms are free creations of the human mind. All other propositions of geometry are logical inferences from the axioms.” [1921: p.30]

This completes the separation of mathematics, expressed as applications of mathematical logic, establishing the separation of mathematics from any reference to reality:

“This view … purges mathematics of all extraneous elements, and thus dispels the mystic obscurity which formerly surrounded the principles of mathematics. But a presentation of its principles thus clarified makes it also evident that mathematics as such cannot predicate anything about perceptual objects or real objects. In axiomatic geometry, the words ‘point,’ ‘straight line,’ etc., stand only for empty conceptual schemata. That which give them substance is not relevant to mathematics.” [1921: pp.30-31]

So how is the appropriateness of mathematics to real-world matters accomplished? Einstein sees it this way:

“It is clear that the system of concepts of axiomatic geometry alone cannot make any assertions as to the relations of real objects of this kind [parts of the earth, measuring lines, etc.], which we will call practically-rigid bodies. To be able to make such assertions, geometry must be stripped of its merely logical-formal character by the co-ordination of real objects of experience with the empty conceptual frame-work of axiomatic geometry. To accomplish this, we need only add the proposition:—Solid bodies are related, with respect to their possible dispositions, as are bodies in Euclidean geometry of three dimensions. Then the propositions of Euclid contain affirmations as to the relations of practically-rigid bodies.

“Geometry thus completed is evidently a natural science; we may in fact regard it as the most ancient branch of physics. Its affirmations rest essentially on induction from experience, but not on logical inferences only. We will call this completed geometry ‘practical geometry,’ and shall distinguish it in what follows from ‘purely axiomatic geometry.’ The question whether the practical geometry of the universe is Euclidean or not has a clear meaning, and its answer can only be furnished by experience.” [1921: pp.31-32; emphasis mine]

Einstein prescribes a way, via necessarily-informal language, by which geometry can be interpreted to apply to aspects of the natural world with it asserted (the theory, in this matter) that the logico-formal conclusions of geometry are valid conclusions about the natural world. Verification of that assertion depends on experience, not anything expressed in the formal geometry.

It is in this sense that I mean Reality is the Model. Einstein suggests that one can make a theory in physics by asserting this correspondence, an interpretation, between logico-formal geometry and the natural world. For Einstein, this practical geometry (or perhaps better, physical geometry) is a completion of logic-formal geometry. I prefer to have sharp separation with physical geometry as one distinct model of formal geometry. This makes room for yet other models not tied to natural objects and essentially independent of each other. (Consider the virtual geometry of worlds that exist only in images, such as the 3D experience of Avatar.)

However applied, the critical feature of the separation of mathematical (or mathematical-logico) formulations from interpretations in nature or elsewhere is the unexpected power it provides. I shall leave Einstein with the final word:

“I attach special importance to the view of geometry which I have just set forth, because without it I should have been unable to formulate the theory of relativity.” [1921: p.33]

[Einstein1921]: Einstein, Albert. Geometry and Experience: An expanded form of an address to the Prussian Academy of Sciences in Berlin on January 27, 1921. pp. 25-56 in [Einstein1922]
[Einstein1922]: Einstein, Albert. Sidelights on Relativity. G. B. Jeffrey and W. Perret, translators. E. P. Dutton (New York: 1922); Dover edition (New York: 1983) ISBN 0-486-24511-X pbk.
Contains Ether and Relativity (1920) and Geometry and Experience (1921). Sidelights on Relativity is reprinted, with commentary of the editor, on pp.235-262 of [Hawking2007].
[Hawking2007]: Hawking, Stephen (ed). A Stubbornly Persistent Illusion: the Essential Scientific Works of Albert Einstein. Running Press (Philadelphia: 2007) ISBN 0-7624-3003-6.

Document-Security Theater: When the Key is More Valuable than the Lock

2010-02-12T21:12:00.001-08:00

Technorati Tags: security theater, OpenDocument Format, OOXML Format, cryptographic hashing, spreadsheet protection, password hashing

[update 2010-02-13T18:01Z I think one reason folks turn up their noses at MD5 hashes in these applications is the fact that MD5 collisions have been found, suggesting that it may be possible to discover different undisguised passwords that have the same disguising hash-code. (That the colliding undisguised keys are unlikely to be plaintext that anyone could successfully enter at a keyboard is not considered.) Similarly, there are demonstrations of SHA1 collisions, so folks want to start using SHA256 and even stronger hash-encoded disguises.

[The problem with all this is that the possibility of a collision has nothing to do with keeping the original password secret. Even worse, the kind of lock I’m talking about doesn’t need knowledge of any password whatsoever, so finding a collision for the same disguised-password value is irrelevant and a complete waste of time, even in perpetuating a deception. (For interesting deceptions, it is easier and more fruitful to hack an open-source document processor to allow back doors for that purpose).

[That reports of hash-code collision successes inspire fear that these document-change protections are now compromised is yet-another consequence of it all being theater in the first place. These protections have always been compromised, and moving to XML-based documents has made the vulnerability trivial to exploit. All else is illusion.]

In a Nutshell

I’ve been noticing for at least the past year that there is an obsession with increasing the strength of hashing functions that disguise the passwords needed to protect documents against certain changes. I’m not talking about protection against the electronic document being readable and viewable, just being changed. This has come up in the maintenance of the standards for XML-based office documents, both ODF and OOXML.

The problem with these efforts is they don’t make the particular “protection” any stronger. Change-protection “locks” on documents encoded in XML are easier to pick than the cheapo lock on a teen-ager’s diary. You merely need the hacker equivalent of a paper clip. Someone has to be determined in order to do this, but it is not difficult and a knowledgeable youngster (the teen-ager’s kid brother) can do it.

Put simply, the effort to strengthen these document-change protection locks by improving the disguising of the key that must be matched is misguided because

The lock is no better
It is foolish to use any kind of key (in the case of electronic documents, a digital password) that may happen to be more valuable than the lock it “protects”

Improving these lock protections establishes the appearance that it accomplishes something (else why do it and add it to a list of improvements). But to knowingly give assent to such a charade raises professional-ethics concerns for me. I would hope that it is an ethical concern for all of us who have some responsibility for the impression that is given by making such “improvements,” especially when it is simply pandering to the requirements of those who are mistaken in the belief that more must be better in this particular case.

What’s the Story?

When people talk about wanting greater cryptographic security around those change-protection locks, what is it that the cryptography is protecting?

The basic approach is to invest more computational effort in making a cryptographically-formed disguise (a “hash”) of the password that serves as the digital key to the lock, not the lock itself. Going from a technique known as MD5 to SHA1 is one stage of greater complexity. Going from SHA1 to SHA256 would be another, one that there is now clamoring for. Whatever the level of encryption (hashing) sophistication, the disguised version is stored right in the document, with the expectation that office-document software won’t release the protection unless an user submits a password that hashes to the same disguised form.

In the case of XML-based documents, the protection is as easy to overcome as it always was. The only element that appears to have increased protection is the password that is the key to the lock, even though the key isn’t really needed if someone is simply interested in overcoming the protection.

If the key is so valuable, why is it being used this way? It’s disguised form (that cryptographic hash code) is as easy to recover from the document as the lock is to overcome. In fact, it can be misappropriated and used on a different document without even knowing the password that it disguises. It can even be removed (releasing the lock), the document altered, and the lock then restored with the same disguised key put back in place. And in no case is it necessary to know the password that the disguised form goes with. Such a maneuver could be used to deceive the key-holder that their password has been compromised. It could even be used to claim that the key-holder created the changed document or another one. Any of these deceptions should be quite successful against someone who has naive faith in the “security” of the document change-protection mechanism.

If the key is so valuable, is there really any improved safety in using stronger cryptographic technology to keep it hidden? I don’t think so. Not only does it really not strengthen the lock, It can be attacked the same way that hash-coded password disguises are always attacked. By successfully guessing the password using a plaintext attack system.

Although it takes a little longer to repeatedly test the hashing of guesses when a stronger hashing method is used, there is no hurry. Once the disguised password is in an attacker’s possession, there is more than enough time to try plaintext guesses against it, over and over again. After all, the document owner is likely to believe that the key must be held indefinitely in case it is needed to ever unlock the document protection to permit changes. Of course, this attack is only interesting to an attacker who believes that learning the password will assist in obtaining something more valuable (including carrying out a deception that ~~demonstrating~~ appearing to demonstrate knowledge of the password would facilitate).

Having thought about this for a while, I have concluded that it would be better to use randomly-created password-disguises directly and never remember them, since it is not difficult to open the lock without one. It would also frustrate a plaintext attack in infuriating ways. I’m surprised that there are not simple utilities around to remove and then recreate randomly-keyed locks on such documents already. That way, there is no secret to be divulged by anyone attacking the disguise, because it doesn’t disguise anything anybody is remotely-likely to have as a password.

Hmm …

I’ve been sitting on this for some time. Lately, I’ve though of doing a little screen-shots demonstration of how easy it is to overcome and then replace protection with the original or a new disguised password (such as a random disguise that probably has no discoverable plaintext to attack).

I was prompted to post this first part by a tweet from James Clark, leading me to this great June 19, 2008 Ben Adita blog post, “Don’t Hash Secrets.” Note that some of the improvements that Adita mentions (using a “salt” in particular) are not that difficult, although they do prevent use of a pre-hashed dictionary of ~~lots of~~ likely passwords. The salt has to be known, along with the disguised hash though, so it just makes a plaintext attack harder, not impossible. Also, the use of HMAC doesn’t accomplish much when the only data to hash is the undisguised password. Whether it is worth the effort of a concerted attack simply depends on what an attacker believes is the value of the secret password. The best precaution is to use worthless passwords.

The reason I am confident about randomly-created password disguises is that there is a lot of predictable structure in the computer-stored plaintext password that the hash-code is derived from. Randomly created strings of bits that can be checked to ensure such predictability is lacking won’t be data that is ~~can be~~ enterable into the computer as plaintext. Hash that. Or just use the random bits as the disguise on the good chance t~~here’s~~ no discoverable plaintext ~~that~~ hashes to it anyhow. Even if there is discovery of a plaintext, it has nothing whatsoever to do with the user who set protection on the document.

[update 2010-02-13T19:29 Emphasized that a deceiver need only appear to know the password, not actually have discovered it, with that sufficient to accomplish some exploit or even deceive someone into disclosing the password.
update 2010-02-13T18:10 I added the connection to fears over MD5 and SHA1 collision prospects to the misdirection that this theater perpetuates. I also took the opportunity to tweak some (but surely not all) ill-chosen phrasings.]

The February Frights Begin

2010-02-02T11:35:00.000-08:00

Technorati Tags: Blogger, computer upgrades, web development, blog authoring, Tablet PC, Windows 7, mobile working, Windows Home Server

My computer infrastructure seems to be falling apart. February is going to be the month in which I have to fix it. I always fear infrastructure changes and computer upgrades and conversions. And the price of procrastination is that pay-me-later comes due, with interest. Here’s what it looks like:

The invalid, my web-development server, the vintage-1998 Dell Inspiron 7000 laptop, Compagno, is on its last legs. I need to offload everything to the Windows Home Server, including Visual Source Safe (VSS) integrated with Internet Information Server (IIS) via FrontPage Extensions. I have been avoiding that. I can’t any longer. (Hmm, I mean that my laptop is an invalid, not that it is invalid. Tricky that.)
I need to migrate Vicki off her Dell desktop onto her new Inspiron 15 Laptop with docking for printer, LAN, keyboard+mouse, audio, and 24” widescreen monitor. This also means moving Office 2003 from her XP SP3 configuration to the Laptop’s Windows 7, finding counterparts for the applications that currently work for her, including FrontPage 2002 (see 1, above).
My Tablet PC has been running Windows 7 RC1 and that is about to expire. There is no reason to use one of my Windows 7 upgrades on that machine because the manufacturer stopped providing the needed drivers before Vista. I could reinstall Vista (and play 3D chess again) maybe, or go back to Windows Tablet PC Edition 2005. This is all a holding action until I figure out what is a decent Tablet PC upgrade path that doesn’t cost a fortune.
I have ambitions to replace my Desktop system with a hot multi-core Windows 7 64-bit kit. I want to use virtual machines for other operating systems and multiple versions of office productivity software for exercising ODF and OOXML implementations and their inter-conversions. I can also do better at development of software for multiple platforms this way. This is not something I’m in a hurry for, because I have to deal with my critical peripherals (HP Scanjet 7400C and E-MU 1820m) being supported. This should be on the end of the list.
TODAY, after not noticing all this time, I received this happy e-mail from Blogger:

“[W]e will no longer support FTP publishing in Blogger after March 26, 2010. We realize that this will not necessarily be welcome news for some users, and we are committed to making the transition as seamless as possible.”

Of course, all of the transitions are to Google hosting of one kind or another. These all involve changing the domain name. I use FTP publishing in Blogger because I already have the domain names for my blogs, and far more, and changing domain name and/or hosting is not the kind of transition that works for me. What I need to do is disintermediate from Blogger.

I desire a way to bring up some sort of blog publishing function, still usable with Windows Live Writer, alongside my existing blog directories on the servers where my blogs are now published via FTP from Blogger. I can then make a side-by-side transition from using Blogger as the intermediary for publishing to using a more-or-less direct self-hosted publishing mechanism.

That is probably workable, and something I had always meant to do. Now I have an incentive I can’t ignore.

Of course, I have no idea what I am going to do about comments on those blogs. I think about Disqus, but not real hard. We’ll see.

And I still use Technorati tags despite every indication they are absolutely useless.

But hey, I am driving out yet-another change to my Blogger template with this post.

Microsoft Office 2010 Coming to Our House

2010-01-06T14:16:00.001-08:00

Technorati Tags: Microsoft Office, Office 2010, Tablet PC, SOHO Computing, Dekstop PC, Windows 7, Microsoft Works, FrontPage, OneNote

I just noticed the reaction to the new Microsoft Office 2010 packaging and price structures in posts by Mary Jo Foley and Ed Bott. Although I despair over being a Microsoft outlier-customer with the disappearance of some of my favorite products, the moves in Microsoft Office packaging and availability may be just the ticket for our household. The announcement is particularly interesting because our Office 2003 installations are a little long in the tooth and it would be good to upgrade, especially as we move to Windows 7 64-bit configurations over the next several months. (Our first Windows 7 64-bit machine is Vicki’s new laptop and it is clear that is the migration path throughout the household SOHO network, despite the need for at least two more hardware replacements.)

Our Long Microsoft Office Romance

I operate a Small-Office, Home-Office (SOHO) wired network. Both Vicki and I are devoted to Office 2003 on our individual business desktop and laptop machines. I obtained the two requisite Office 2003 Professional copies by adroitly paying $99 each with one-day workshops included. (Actually, the software was given out as premiums for attendance at the two $99 workshops. I doubt there will be such an opportunity again although I am on alert.)

I happily install OO.o on family-member machines where there is limited need for Microsoft Office capability beyond occasional import/export of simple documents in the big-three formats, Word, Excel, and PowerPoint. That doesn’t work here because of personal preferences and, most of all, because of Outlook. (We each rely on FrontPage too, and that is a more-difficult problem.)

Office 2010 Seductiveness

We are devoted users of Outlook and have no desire to change that. There are Outlook 2007 features that I want and I’m sure Outlook 2010 will improve on that. I was despairing of what it would take to have us both move up to a current Outlook, with or without upgrading the rest of Office. (I also have technical reasons, in my work on the OOXML and ODF standards, to have multiple versions and beta releases of Microsoft Office and ODF-based office-productivity suites lying around, a challenge that is leading me to put a heavy-duty virtual-machine configuration in my near future. That outlier requirement will also improve my ability to develop for multiple platforms.)

If there is reasonable $199 download-pricing for download editions of Office 2010 Home & Business, our SOHO computing needs will be satisfied by two copies, one for Vicki's business use, another for mine. (I may have to go the $249 package route to have it on my laptop plus desktop, while Vicki consolidates into a laptop-only-plus-network computing life, something I should be considering as well, now that I look more closely.) This will also go well with our finally upgrading to Windows 7 64-bit Home Premium (Windows 7 Ultimate for my technical needs) on all non-server machines.

An Appealing Starter Case for All

Although I probably won't run into it myself, the Microsoft Office 2010 Starter edition via OEM installations would also eliminate the need to install OO.o on new machines for relatives, except to the degree they prefer to have it for whatever reasons that matters to them. It should now become unnecessary to purchase a richer version of Microsoft Office simply to handle occasional Word and Excel interchange plus ~~and~~ PowerPoint ~~document interchange~~ viewing. Likewise, nothing more may be needed for modest ODF interchange needs down the road.

Goodbye Microsoft Works

It looks like the Microsoft Works and Office Home and Student trial-edition crapware can be gone for good. (I am wistful about the disappearance of Works, because it was all I needed on MS-DOS and early versions of Windows. I gave up on Microsoft Works when it became more important to have what employers and clients used along with some peculiar outlier importance of Microsoft Office in my support of document-management technology.)

Meanwhile, Vicki has no tolerance for Microsoft Works (and may be unhappy adjusting to the Office 2007-introduced user interface too). I still have some old archives in Microsoft Works documents that I had better find out how to upgrade before they are no longer readable anywhere, too.

Hello OneNote

And finally, I note the prevalence of OneNote in the Office 2010 packaging. I have withheld my use of OneNote on other than Tablet PC applications because of its narrower availability and the absence of a public standard for the format.

I stopped using OneNote on the Tablet PC on realizing that I don't go through the extra effort of transferring OneNote-authored material to non-OneNote machines and the material I have is now locked-in on the Tablet. Later Tablet PC note-taking was done with Windows Live Writer instead. With OneNote now a stock component of Microsoft Office, I can reconsider my use along with the SOHO upgrade to Office 2010 (perhaps including a Windows 7 Tablet PC if I can find a reliable and economical OEM source).

Update 2010-01-06T22:30: I was over-eagerly expecting the Office 2010 Starter to include some form of PowePoint. That is not the case, but I presume viewers will still be available for download.

New Issues to Contemplate: It seems that affordable laptops don’t have provisions for easy swapping in as desktop machine by using an external monitor, closed cover, and external keyboard and mouse. However, a tablet PC can operate flattened out in tablet mode while slide out of the way in an appropriate “docked” arrangement. I must look into that. Until I started writing this post, I hadn’t looked at having a laptop rather than desktop as my all-purpose machine. This is really about having Outlook running in only one place and being able to travel with it.

In non-Outlook work, server-mediated replication and synchronization is workable. I need to explore that much more carefully. Figuring in an eventual upgrade to a 30” monitor for desktop work may also create some conflicts with the most external monitor that a laptop/tablet is likely to support. I will still need a desktop system so smooth choreography of any dance between desktop and laptop needs to be understood better.

2010: You Say Two Thousand Ten, I Say Twenty Ten

2010-01-02T11:53:00.001-08:00

del.icio.us Tags: Blogger, Orcmid's_Lair, blog_maintenance, 2010, system_incoherence

We all say Happy New Year!

This first post for 2010 brings more blog-template cleanup. I need to post something to confirm that the template is working, and here it is.

I moved the change history of the template, a long comment, to the end of the template page so that it should not interfere with blog-page loading (so much). You should not observe any evidence of this unless you View Source on the blog page.
The sidebar Atom Feed link stopped being filled in correctly by Blogger. I have no idea how long that has been going on, although there are ways to check by looking at old posts. I simply replaced the special template codes with the correct absolute links.
I added an Associated Sites list of links as a companion to the Associated Blogs list. I removed Associated Blogs that I do not author. I am not sure what to do for links to blogs of friends now. Something else is called for.
I don’t know what happened with Technorati and I don’t know how to fix it. But using Technorati tags doesn’t seem to be useful. The Technorati insert on the blog sidebar has gone invisible and I have no idea if it has any function. I am going to attempt to use de.licio.us tags and see what that accomplishes.

I am making these adjustments to this, my longest-standing blog, so that I can then ripple the same adjustments to other blogs. That will induce my priming the pump with a new post on each of those as I proceed.

Update 2010-01-02T12:47: Well, I have no idea how making del.icio.us tags accomplishes anything. Perhaps I need a place to “ping.” What I do know is that although Windows Live Writer things comma-separated tag lists are sufficient, del.icio.us doesn’t deal with spaces or “+” as space at all. That’s why you see the wonderful use of “_” characters in this repost. I think I still don’t have it figured out. I’ll settle for this serving as an example of system incoherence, for now.

Annual Dusting and Cleaning

2009-12-19T17:49:00.001-08:00

Technorati Tags: Blogger, NetworkedBlogs, Facebook

I am working at having everything of mine present on Facebook, but without Facebook having sole custody.

This is part of my desire to be present and reachable via Facebook without having my attention on Facebook. Since everything I maintain outside of Facebook is entirely public, I don’t mind Facebook exposing that same materials. I won’t be giving Facebook applications any way to modify any of my content (e.g., on my Flickr account), so I am not to nervous about this.

I am more nervous about my Facebook presence simply not working the way I would like.

Today I am tidying up the Orcmid’s Lair blog with some links to additional blogs recently added to the stable.

I am also experimenting with a widget for Networked Blogs on Facebook. I am not all that confident that it will provide an in-profile presence for my blogs. That is why it is an experiment.

Here goes …

On Facebook: Just a Little Bit Pregnant

2009-12-06T17:22:00.001-08:00

Technorati Tags: Facebook, social networking, Kyte.tv, Pandora, Flickr, orcmid, Linked-In, Twitter, social grid, presence, attention, Windows Live, Skype, Fishbowl

Grudging and Limited Acceptance of Facebook

I still don't like Facebook.

I don't like how it works. For example, I just typed an 1883-character message that it didn’t tell me was over the 420-character limit until I had typed all of it and then attempted to “share” it. Clearly, Windows LiveWriter, where I am now, is affordance for me, just as MediaWiki is my preferred vehicle for wiki-organized material.
I don't like the way the Facebook organization stumbles blissfully into iffy business practices and remains indifferent to the uproar each new excess provokes.
I don't like how I can't organize my attention very well. I don’t want to keep my eye on Facebook. I find the river incoherent and discordant. (I am learning that Disqus comment streaming is more distracting but I solve that by shutting off e-mail tracking. It is unfortunate that they make it an all-or-nothing choice. OK, nothing it is.)

I first reactivated my account because I wanted to lock up “orcmid” as my name there. Lately I have begun maintenance on the account because I have acquaintances who are devoted to Facebook as their social-connection point. If I want to see their pictures, find a way to contact them, etc., I need to maintain a Facebook logon. That is part of the viral nature of Facebook, of course. I'm trying to stay just a little bit pregnant here and it is very awkward.

Having Presence Without Attention

Today I noticed that if I want to be social-network-visible the Facebook devotees among my acquaintances, I must maintain a Facebook presence by which folks can at least find where my attention really is. I want to offer them Facebook presence and connection to where my attention and efforts are placed, without demanding that I also put much attention on Facebook itself. Ideally, Facebook friends can see into my public world without leaving Facebook.

I started by figuring out how to disengage from Facebook applications and then look for ones that make my preferred locations available on Facebook too. (That’s how I found out that I must de-authorize applications that I no longer care about, not just remove them from my Facebook page. Another “there they go again” moment.)

My Twitter stream now appears on my Facebook stream. My Pandora profile has been there all along. Reviewing Pandora showed me how seldom I listen to Pandora these days: I didn’t realize the desktop Pandora fixture was an Adobe AIR application until it asked to update when I checked it just now. It works better than my large random play list in Windows Media Player and I’m back. Windows Media Player is still my favorite for album play and all of my AmazonMP3 downloads.

My Flickr Photostream, Photosets, and new Flickr Posts now show up on my Facebook profile page. I used the My Flickr application because it works well enough with only read-access authorization to my Flickr account. I had wanted to use Flickr Photosets but that one required authorization to updated Flickr; I am not prepared to risk so much.

I wanted to have my blogs appear on Facebook too. I thought they had in the past, but I can’t find how I might have done it. The most appealing application, NetworkedBlogs, has a complex authorization process requiring me to add a script to my blog-page template (just as Technorati does). I wouldn’t mind updating the templates, but that immediately moved having blog presence to a back burner.

I suppose that I might want to find a connection between Facebook and LinkedIn as well, just to complete the picture.

FriendFeed is so far lost in my history that it’s of no interest whether I can have it visible on Facebook. And now that not only I but Microsoft itself have abandoned Soapbox, I have some blog pages that deserve to be updated. Orcmid’s Flying Kyte is still operating and available on my Facebook profile and I should make better use of it.

I have nothing on Windows Live to connect to Facebook. My Windows Live usage is entirely on the desktop applications. I have abandoned Windows Live as a social presence and I should decommission Orcmid’s Live Hideout at some point. The sharing of contacts is not something I want to do, probably because Microsoft Outlook remains my hub for connectivity with contacts and it is not a list I would share into the cloud.

That’s the status of my effort so far.

Oh yes, then there’s FishBowl client as an alternative interface (thanks to Wendy White). Not sure I need an easier way to root around in Facebook, but I will check if it make my presence maintenance better. Or is this indeed the road to perdition? Stay tuned.

Dealing with Expectations of Facebook Friends

I have 11 friend requests and I don't want to connect them and establish an expectation that this is a place where my attention can be obtained.

I haven't found a good way to explain that, and I must remember to put whatever explanation I do use in a computer note that I can copy and paste instead of recreate each time. For the form letter part. Then I can add just whatever personal part I want.

In case you are wondering: If someone wants my attention or would like to be more connected, I recommend Twitter direct messages to orcmid. Directs arrive in Twitter (if I'm online), in my e-mail (whether I am or not), and on my cellular phone (likewise). E-mail is my preferred medium because of the asynchrony and absence of message-size limit. Also, I am not paced by my inbox. I check for new mail only when I am ready for it.

For folks who want to chat, Skype works best for me (and I am orcmid there too). I can also do audio and video (see, I really am in my robe and pajamas) over Skype. If you are the linked-in sort, you can find me there too. I don’t multi-task all that well, and paying attention to open chat windows is not a strength for me. I find asynchronous connectivity and the written word preferable, with Twitter being expedient, not immediate, for me.

Mornings in the Temple of Perpetual Reconsideration

2009-10-31T12:18:00.001-07:00

Technorati Tags: civil society and democracy, Seattle, Washington State, King County

In a fit of governmental economy and limelight avoidance, King County in Washington State has gone to mail balloting exclusively. For this election day, Tuesday, November 3, 2009, Vicki and I have already mailed in our ballots. We waited for the televised debates for Seattle City Mayor and King County Executive to be held, considered that we then knew enough, and submitted our ballots.

Waiting for Election Day is Different Now

An odd peculiarity of mailing in our ballots is, now that we’ve voted, it doesn’t matter what happens between our mailing and the official end of voting on November 3 (although ballots with acceptable postmarks will continue to be accepted and processed). What’s missing beside the ceremony of voting is the ceremony of knowing what the results are. We have to wait. We are lame-duck voters and there is no value in paying attention to the still-continuing campaigns for the various contested seats.

What’s not missing is the continued arrival of robocalls telling us how important our votes are and what scoundrels the opponents are. There is also no letup in the delivered mail pieces that continue the bickering. I assume this is all targeted to the large undecided numbers that are sufficient to sway the election one way or the other. A just-arrived attack piece was surprising to me and I almost wanted to reconsider a vote already cast. Anti-candidate material tends to lower my stock in the attacker, not the victim. In this particular case, I rationalized that the attack piece was appropriate.

Stamping out the Party Line

The current election is the first one under a spanking new primary and election approach. All of the positions up for election are supposed to be non-partisan. However, there are certainly party endorsements, and the Governor, a Democrat, has made her preferences known in the election for Seattle Mayor and King County Executive.

The way the new system works here, until overturned by a court appeal as had our previous efforts at electoral reform, is that when there are fewer than three candidates at the primary election, they automatically advance to the general election. If there are three or more candidates, the top two at the primary advance to the general election. There is no party registration in Washington State, and any primary voter selects among all of the candidates. This led to the incumbent Seattle Mayor failing to advance to the general election, the final contest being between two candidates who have never held public office. As a referendum on the mayor, this does say something.

This system can lead to a general election where the two candidates are aligned with the same political party. That happened in one district here.

Reconsider This!

As part of our shared Western-States distrust in government, we have an initiative and referendum system that is designed to hamstring government as much as we want. Fortunately, the legislature does have the power to declare a fiscal emergency and ignore some of the contradictory stuff that gets passed this way until it can be thrown out in the courts.

This election, we have an example of a way that the people can preempt the legislator without throwing the rascals out. It is possible to petition that a passed legislative act be submitted to the voters for approval. In the past legislature, a comprehensive civil union law was passed that provides all of the benefits accorded to married folks to civil unions among unmarried seniors, gays, lesbians, and other flavors. This grants everything that civil law can grant short of calling it marriage. The legislation is quite extensive in terms of all of the various laws that are adjusted.

Referendum R-71 to have the electorate affirm (or disapprove) this legislation was placed on the ballot by petition. Although it is in the nature of this kind of referendum that it follow the wording of the law, so a yes vote will affirm the law, an no vote will repeal it. The petitioners were interested in the repeal, but unlike Proposition 8 in California, it takes a win by the No Votes to accomplish that. It will be close.

An interesting sidelight is that people in favor of the legislation demanded that the names of the petitioners be released to the public, with the clear intent of outing the signers of the petition as bigots. This request and the refusal of authorities to comply has made its way to the U.S. Supreme Court which has issued a stay on the release of the names. I didn’t need R-71; I am happy to vote to affirm it. However, I am not at all keen about releasing the names of petition signers. To do this in the name of freedom-of-information is an indirect assault on the secrecy of the ballot, considering the chilling effect it can have on the petitioning for referendums and initiatives on controversial matters. We do not have to account for how and why we vote a particular way on some measure, and it is frightening that we would have to do so as signers of petitions. And the automatic presumption that the signers are bigots and they are to be hounded is itself a despicable act. I’m against it.

One of the more common use of initiatives is the constant attempt to throttle government spending by denying the ability to raise taxes except in very difficult ways. These are often passed concurrent with other initiatives that require additional spending for something people want, usually more bigger better highways in support of an unrepentent suburban lifestyle. It would appear that the public is tiring of this game, since the tax-restriction measures haven’t been doing very well and at the local and regional level, Seattle voters seem quite willing to tax themselves for initiatives that are important to them. This election will let us know if that is a sustained ~~train~~ trend despite the current economic difficulties.

The Institution of Reconsideration Reconsiderations Reconsidered

One problem with initiatives is the constant reconsideration of legislative action and of previously-approved initiatives. There’s seemingly no bound on the number of times one can go to the polls to stop something that has been approved and re-affirmed any number of times before. This happened with the Seattle Monorail Project where the voters had to constantly reapprove that which they’d approved before, over the same entrenched objectors. The nay-sayers finally prevailed, and I confess the Monorail Project authority did break faith with the public in what allowed for its undoing. In some sense, that was a victory for this process, but I fear it is simply institutionalized and we are unable to deal with major development issues because of it.

In many ways, the Seattle City Council and Mayor elections are a referendum on the now-funded and approved tunnel project for replacing the decrepit Alaskan Way Viaduct running above the Seattle waterfront area. It is true that, when a preference poll was placed on the ballot, the voters indicated that they wanted a less-expensive non-tunnel solution and there were State funds in hand for that. That was before the economy tanked last year. Now we have an agreed tunnel replacement for the viaduct, and funds are committed for this too. There are complicated arrangements between the State, with its responsibility for the tunnel as part of a State arterial highway, and the City and its responsibilities for surface and breakwater improvements related to the seismic vulnerability of the area.

We are, of course, nervous about the prospects of this project costing far more than the allowances provided for it, and that was made an election issue. Here the Governor also stepped in, endorsing the candidate who favors getting on with it and making it work, not going into our pattern of never-decided decisions that have needed infrastructure development impeded at every turn.

From my perspective, the nervous opposition is too strident and pays no heed to the strides made, within Washington State, in having major transportation projects come in on time and under budget, with the right scrutiny for intervening when a project seems headed off the rails.

Since it is the issue that some campaigner have staked their election on, I have obliged them. No one who is negative about the current tunnel project has my vote.

Friday Cat Photo: Flying Cats

2009-10-30T22:11:00.001-07:00

Technorati Tags: cats, Friday cat photo, paper bag, rubber stamp

This image of flying cats came into our house on a paper bag from a local produce market. We have no idea what’s behind this.

Friday Cat Picture: The Return of Shmoo Cat

2009-09-05T13:03:00.001-07:00

Technorati Tags: cat, cats, Friday Cat pictures, West Seattle

I started calling a neighborhood cat the Shmoo Cat based on this encounter back in April, 2005. She wanders through the yard from time to time, moving furtively when she sees me. That is not the case for Vicki.

Sometimes the cat sits on our back steps, provoking a small amount of excitement from our indoor cats. The cat will move away if anyone comes out, but she will return to Vicki’s call. She’ll also accept a dish of water from Vicki as a neighborly offering.

Productivity: This Is Not a Kanban

2009-08-23T21:23:00.001-07:00

Technorati Tags: productivity, personal kanban, kanban, agile Jim Benson, David Anderson, GTD, TRO

Since I cleaned up my work space somewhat last March, my attention to productivity techniques and management of my commitments has spiraled into nothingness. My open loops are more prevalent and more open than ever. I stopped working through the startup for Totally Relaxed Organization and I haven’t opened my TROG Bar in months. My only Getting Things Done practice is to empty my in box (except there are 56 orphan items there right now). It’s been so long, I completely forgot that I was ever participating in a Zen Habits Monthly Challenge.

Here Comes the New Methodology, Just Like the Old Methodology

I’m going through self-help productivity techniques the way others go through weight-loss programs. And with no better results.

My devolutions is so complete that my entire structure for managing commitments has degenerated into pages in a notebook (#63 in the current series) and an accumulation of Post-It notes of random incomplete tasks.

The small white note with the checkmarks was created on a hotel-room notepad in London last May. I’m still carrying it around along with my morass of open loops.

There are other places where I keep commitments tucked away on my computer. They are also shuffled around and ignored.

I Will Be Fooled Again

I rarely examine any of these items with critical concern for how the tasks are actually to be accomplished. I’d have to face up to their not being done while I am busily not doing them instead.

And now there’s Personal Kanban. I’m a fan of David Anderson, although I have no opportunity to apply any of the agile management methodologies. Although I appreciate that kanban methodology has been a powerful instrument in the work of teams, I mostly just glance at the various accounts. The lingo is mysterious and the application seems even more out of reach in my personal situation.

That changed when I saw twitter updates from David Anderson and then Jim Benson on the possibilities of a Personal Kanban. I began to follow along and browse through Benson’s series of blog posts on the topic. My buddy Bill Anderson and I created weekly (weakly) checkpoints on taking steps to understanding the kanban methodology from a personal perspective.

The Essential Reality Check

I see appealing features after an initial look at Personal Kanban. I want those features in raising the bar (now so low) on my personal productivity and effectiveness.

I also realize that my application of Personal Kanban is doomed to the dustbin of forgotten methodologies. The common factor in the recurring result of my experience is me. Not the methodologies.

To have a different result, I must work differently.

Where I Stop

After a few hours and days of mixed success, I stop looking at the structure that holds my current commitments. I just don’t look there to true myself up. I indulge distractions and eventually the new methodology has disappeared. Lately, I seem to end up in worse shape than before I began.

But before that point, I stop in another way. All of the recent methodologies I have examined start with housecleaning followed by housekeeping. I take out some trash, but never all of it. I cling to it and don’t let it go. Or, I don’t want it but cleaning it out is overwhelming and I never create an occasion for accomplishing that. Or I clean up piece-meal, insisting to myself that when I get things organized, I can then be organized. Mostly, I get distracted from all of this and eventually forget to clean up the mess, which remains in its piles around my office and elsewhere in the house.

Being Slimy

I was in a conversation on how I am the poster-child for methodology failure. Here are my other indulgences:

I’m lazy and fearful
My ambitions are greater than my capacities and my stamina, but I hold onto too much anyhow; I take on more faster than I complete what I already have on my plate.
I procrastinate and lie to myself and others about it.
I make commitments and create no structure whatsoever for fulfilling on them.

OK, Where From Here?

It was suggested that someone needs to take a kanban board down and hit me over the head with it. I need to be the one to do that. Plus empower others to be ruthless with me when I go off the track.

I am going to apply Personal Kanban in my life. It will be fun to deal with the details of the techniques. But the real accomplishment will not be in messing around in the technical and conceptual nuts and bolts. It will be my stepping beyond my automatic approach and having Personal Kanban win for me.

If I fall down, I will get up and keep dancing.

Sympathy Strike: Don’t Gag the Net

2009-07-14T16:04:00.001-07:00

OK, considering the usual loud silence on this blog, posting an image calling for a blogging strike today is a touch contradictory. I will say just a litle more. The badge calls for an Italian blogging strike today. Posting the badge instead of a normal post declares a raising of the blog’s voice against the alleged gag law being proposed in Italy. I won’t go into the details, or consider how much this might be an over-reaction. Hey, it’s a sympathy strike.

Back to the usual tomorrow.

I Blog, Therefore I Am

2009-06-19T17:43:00.001-07:00

Technorati Tags: Orcmid's Lair, Professor von Clueless in the BlunderDome, Numbering Peano, Pursuing Harmony, Spanner Wiingnut's Muddleware Lab, Orcmid's Live Hideout, blog themes

This is different than my main blogs. I wanted to experiment with Windows Live and have a blog that employed the features and organization of Windows Live blogs. I have since become disenchanted with having a blog that is not on a server that I manage. Thanks to the capabilities of Windows Live Writer, I can successfully lift the posts from the Hideout and repost them in the place that is more-appropriate for me.
This is different also. This is a sandbox blog that I use only for trying things out. It is different in style but it serves me as a way to try out various changes before introducing them on one of my current blogs. My four main blogs have the following descriptions:

I have six blogs to my name, where I set the purpose and content of the blogs. These are various expressions of me.

There’s one other blog that is an expression of my partnership with Vicki and her vocation as a potter, Millennia Antica: The Kiln Sitter’s Diary. My presence is as web master and technical support, along with contribution of my perspective on some of the activities that I participate in. But the purpose of that blog is to be part of Vicki’s expression of her vocation and love for pottery.

Amma Vicki and the Monks

2009-06-19T14:20:00.001-07:00

Technorati Tags: Amma Vicki, Victoria E. Hamilton, Satguru Bodhinatha Veylanswami, Sadhaka Tejadevanatha, Bothell WA

On Wednesday, June 17, 2009, Bodhinatha came from the Kauai Hindu Monastery to the Hindu Temple and Cultural Center in Bothell, Washington. The visit (pdf) is part of travels that will end up in Edmonton, Canada.

It is a rare treat for Amma Vicki, as she is known (scroll to the bottom), to visit with members of the monastery family at times other than her annual visit to Kauai. She is always hopeful to learn whether son Senthilnathaswami is along on the journey. She was delighted to be able to see Bodinatha and Tehadevanatha on this particular visit.

Although I have met Bodinatha, I had not heard him speak to a Hindu gathering until Wednesday. The subject, “Passing On Our Hindu Tradition” dealt with the challenges of Hindu grandparents and parents living in the West and raising children in the midst of Western cultures and schools. For a non-Hindu, I found the explanations and suggestions direct and remarkably gentle.

Let It Rain, Let It Rain …

2009-06-18T14:27:00.001-07:00

Technorati Tags: Seattle, weather, rain, drought, Summer

[Update 2009-06-19-08:47 –0700 (pdt) Let this be the end of silliness about rain-free-days records. There was a steady though light rain overnight. This morning at 07:15 the streets and grounds were wet except inside the drip line of some heavily foliaged trees. The rain has changed from light sprinkle to mist now, with the morning temperature just crossing 60F (15C). The forecast is for occasional light rain through Sunday, 06-21. This may not assuage the agricultural concerns.]

[Update 2009-06-19-01:54Z I got it all wrong. The first paragraph has been corrected based on information from King5.com for 2009-06-18.]

As of some time overnight on June 17-18, we had officially gone 29 consecutive days without rain, ~~breaking~~ tying the May-June ~~1951~~ 1982 record for such events. [The longest dry spell is the 51 July-August days in 1951.] For some reason, a local television station news team thinks that is exciting. Not at summer water rates and what it costs to sprinkle a lawn to keep it from going dormant, the dry-weather response here. Of course, in brushlands and forests there is even more to be concerned about.

The rainfall that we drove through yesterday afternoon did not count. The test is weather or not a sensor at the Seattle-Tacoma airport detects measurable rainfall. This shower we ran into was while driving on the I-90 floating bridge toward its connection with I-405 and our continuation North to Bothell, Washington. The rain did manage to make drivers nervous, apparently because most knew the roadway can be dangerously slippery when wetted for the first time after a long dry period and accumulation of surface oils and greases.

Cloudbursts and lightning strikes in the mountains to our West and East also don’t count as an end to our dry spell. (Can you say “forest fire?” Sure you can.)

Now, how the heck will we convince tourists and other visitors to stay away because they think the sun never shines in Seattle?

The Fate of Microsoft Outlier Customers

2009-06-14T12:42:00.001-07:00

Technorati Tags: Microsoft, Encarta, OneCare, Money, software longevity, trustworthiness, Maps, Works, MSN

I recently noticed that three of my favorite Microsoft products are to be no more: Windows OneCare (why are they still selling it?) , Microsoft Encarta, and Microsoft Money. That was striking for me and I have created a contingency plan for each of those products.

On reflection, it is not a new thing for various Microsoft applications to transmogrify and eventually disappear. Although I have never had an interest in Flight Simulator, I am still a devoted user of Microsoft FrontPage. If Microsoft Works were as clean and simple as the MS-DOS version, I would still use it. I have also used a variety of picture editors and photo editors that were bundled in various Microsoft products and that seem to come and go with each new computer system and occasional Microsoft Office upgrade. Some day, I suppose I will have to do without Windows Live Photo Gallery and Windows Movie Maker, especially as future versions/replacements demand hardware capabilities I don’t possess.

Now, Microsoft is not making a fortune for me as an occasional upgrader of these products (though I quietly paid my OneCare subscription renewal each year). It is interesting that not until the abandonment of FrontPage was announced did I begin to feel the squeeze and the lack of an appropriate replacement for abandoned Microsoft products. (E.g., Expression Web is both more and less than what suits my current web-development practices.) Now I now need to look for three more substitutions and also look at long-term measures for protecting my systems and my electronic financial records as well as maintaining my web sites. For the three latest-discontinued products, I find that I have three different contingency measures in place.

Wait, I Like Encarta

When I read that Encarta was to be no more, I resolved to go find a copy of the latest version. I have a version completely installed on my hard drive and it is a handy reference. I confess that I mainly use the dictionary (the default setting for the Encarta Search Bar kept handy in my Windows XP task bar). The encyclopedia is handy but it doesn’t get searched by Windows Desktop Search (a little incoherence there) and I find myself on the web (and Wikipedia) more often than in Encarta because that’s where Windows Desktop Search (and now bing) lead me best.

I’m currently running version 14 (Encarta 2005) and I actually had one monthly update that I didn’t install until last week. The reluctance to update has to do with needing to be administrator when I do it, and I usually forget Encarta updates when I am running as administrator for other maintenance purposes. It is a demonstration of my unnoticed waning interest that I didn’t know I had one update left from 2005.

Nevertheless, I wanted to have the latest and greatest if there were to be no more. Unfortunately, the latest version seems to be Encarta Premium 2007 and it is still pricey, even though pro-rated refunds were cut off on April 30.

I settled for the less-expensive Britannica 2009 Deluxe with the hope that the included dictionary and thesaurus is as easy to use as the one I am abandoning from Encarta.

Not Money Too. No, Not Money!

The shocker for me is last week’s announcement that Microsoft Money will also be no more. I checked, and my oldest Microsoft Money backup is dated 1999 and it has entries from 1998-01-01. I tended to hold onto versions of Microsoft Money. I didn’t switch to Money Plus 2007 until the version I was running under Windows 98 couldn’t be installed on Windows XP as I was off-loading the Windows 98 machine at the end of 2007.

I don’t like Money Plus 2007 as much as the older pure-desktop versions. The change of the user experience to one with integrated web features is mostly a nuisance. The software performs more slowly and I don’t do those on-line things. But I like the reports and the extensive history of purchases (and depreciation records) is important for me. I prepare my tax returns from records maintained in Microsoft Money, and I have had some success balancing my bank accounts using downloads that Money will rely on. (The experience is rather variable and I often simply balance statements manually instead rather than deal with what it takes to correct for a failed automatic account update.)

I discovered that my version of Money Plus “expires” ~~in September~~ at the end of November. Ones activated this summer will have support extended through January, 2011.

It seems like a no-brainer that what I want to do is install another downloaded version and continue to use it until I have a satisfactory replacement. I will also want to keep a copy around as long as possible to enable my use of existing records. I will need to discover how to export some of those for use in other products, or as spreadsheets that I can preserve in OOXML/ODF.

So I have another Money Plus Home and Business download and a product key for it. I will install it at a point this summer when I am carefully backed up, exported, and ready to risk an upgrade.

Goodbye OneCare, It’s Been Good to Know Ye

Microsoft OneCare arrived at just the right time for me. I had tired of Norton Antivirus upgrades and a growing drift from what worked just right for me starting before Norton/Symantec Systemworks and going back to a time when there really were Norton Utilities. I valued the simplicity all-in-oneness of OneCare for the following provisions:

Annual support on up to three SOHO computer systems (exactly what I had that needed the protection around here)
Constant nagging and support for regular backups
Outgoing firewall protection

It wasn’t the most wonderful product, but it was also steadily improved over the time I used it, right from the beginning of its availability. It did deal with my dominant computer security concerns.

OneCare also provided me with a great source of system-incoherence anecdotes, and I must recount some of those while I can still capture screen shots of the experience.

Actually doing backups onto DVDs was not the most exciting experience, as much as OneCare made that possible. Once backup functions were taken over by WHS, the cleverly-named HP Mediasmart Server (with its Windows Home Server version of Windows Server 2003) now on the network, that difficulty was mitigated and there are now automatic, incremental backups every night.

Still, OneCare works well and effortlessly for us, even if it reports that backups are woefully out of date (a new little incoherence on how OneCare has forgotten WHS is on the job).

It was also great that Microsoft announced that all OneCare support agreements will continue until their expiration. That means mid-September 2009 here.

On the other hand, the promised Microsoft replacements for OneCare are not in sight. I believe the last promise was for around August. I am beginning to squirm.

There appears time to find an adequate substitute, taking into consideration that Microsoft will offer some sort of solutions for some unknown degree of protection where I find it the most valuable for the computers here. Unfortunately, it is not clear that there is a decent non-Microsoft product that works here, regardless of the high reputation a number of Antivirus producers have achieved. The low reputation that is Microsoft’s automatic prize is apparently more myth than reality in my experience. On balance, OneCare works better than anything I have attempted to replace it with.

Here’s how my search is working out so far.

Since OneCare is to be no more, Windows 7 beta and Windows 7 RC not only had no provision for it, those releases were actually hostile to OneCare. So on Quadro7 I have been going through trials of other Antivirus products, partly to determine a good candidate to be installed uniformly on all of the systems here. None of the products tried so far seem to integrate well with Windows 7, which has apparently changed the rules enough that AV producers are having some difficulty. In particular, I have not found an AV product (even the Windows 7 directed beta releases) where Windows 7 reports that it is protected and the Windows Home Server concurs in reporting that my systems are protected.

Having tired of Symantec (and enjoying the liberation that OneCare provided), I haven’t gone back. My latest experience with McAfee was on WHS and that led me to prefer no AV there instead. (That experience also led me to be more cautious about the judgment of folks at Hewlett-Packard and the trial installations they chose to push to WHS.)

Meanwhile, on Quadro 7 I have gone through one trial of Kapersky and another of Trend Micro. I actually bought a retail copy of Trend Micro but Windows 7 chokes on that. Instead, I now possess an useless license since the Trend Micro beta for Windows 7 won’t accept the older-product registration code except when it installs as an update, and that doesn’t work on Windows 7. I’m moving on to F-Secure’s beta for Windows 7 right now and the trial lasts out past August. With luck, I might have a consistent Microsoft solution to deploy across all of the computers here. And if not, I will need to find a product that has an affordable multiple-machine license (as Trend does) and that doesn’t require me to use a web site to know my status (as McAfee Total Protection does).

There are clearly interoperability issues here, and the level of coherent integration is a challenge. It is a challenge for Microsoft too, but as one might expect, OneCare integrates more cleanly and, apart from an apparently-inescapable level of Microsoft paternalism, works most consistently and coherently than anything else I have attempted to use in its place.

Update 2009-06-15-04:06Z Correcting an expiration date for Microsoft Money.

Just a Little Bit Facebooked

2009-06-13T21:13:00.001-07:00

Technorati Tags: Facebook, social computing, social grid, social silos, orcmid, internet surveillance, privacy

When I said “I will Facebook no more Forever” in December 2007, I meant it. I really meant it.

On the other hand, I knew that Facebook actually maintained my account and all I needed to do was log back into it to have it operating again. There is evidently a full nuclear destruction available, but I didn’t go that option. I also didn’t discard my Facebook account password.

I recall being given a similar reassurance by an AOL telephone representative as I was cancelling my long-standing CompuServe account, the first place “orcmid” was ever seen in public. (The AOL-ized webified CompuServe was not the CompuServe that I devoted so much time to at the end of the 70s. It seems I am constantly ending up in the demographic that is no longer the one of a long-time vendor’s keen interest.)

At 10:00 this morning, I was noticing all of the folks on Twitter going on about having gotten their user-friendly Facebook name, or about someone else getting it first.

Oh oh, “What about Orcmid?” I say to myself at least ten hours after the name-claiming frenzy began. Well of course “orcmid” was available. I now have it.

I am not back on Facebook. Yes, my account is active again, but I am not back.

All this means is that when others talk about their Facebook page, or photos on Facebook, or anything-else Facebook, I can go look, because I have an account.

I am not attending to my Facebook page, I am not posting on folk’s walls, I am not friending anyone and I am ignoring mail that comes in saying so-and-so has friended me.

This is entirely an account of convenience. I am only a little bit Facebooked. Honest. I caught it from a toilet seat.