A knife... a real knife... like the metal kind

Last night, on my United flight from Dulles to Portland, with the 1st class dinner, I was given the typical cloth napkin with the cutlery rolled up inside. When I unrolled it, I found the normal 2 metal forks and a metal spool as usual. However, instead of getting the little silver plastic knife that I've gotten since 9/11, I was given a real, metal knife (pictured, quite badly, to the left).

I looked to the left and right to see if the other passengers were also getting a metal knife -- they were, so it wasn't some accidental fluke.

I presume the FAA has removed the restriction on metal knives -- something long past due as they airlines have had bulletproof (not just knife-proof) doors on the cockpit.

Tags : travel / faa / united

When is a rebate not a rebate?

When I purchased my cool Samsung Blackjack phone, Cingular had a rebate program in place offering a $100 rebate if you bought the phone and signed up for the data package.

I took them up on the offer, followed all the directions and sent in my rebate form the next day. This is the step that the cynical Conor (me) believes they hope you won't do (so they get the benefit of offering the rebate without having to give you the cash -- and it's your fault since you didn't follow through). Of course, being the pedantic person that I am, I *always* fill in the form and send it in just to make sure they pay up.

Well, today -- approx 6 weeks later, I receive the "the rebate". I was expecting to receive a check like any other rebate program that I've ever participated in. A check that I could exchange for cash at my local bank, or just deposit into my account.

However, that wasn't to be. Cingular sent me a "Rewards Card". This is a Visa debit card that supposedly carries the value of my rebate.

Perhaps I'm over-reacting, but I'm not at all happy with this. In fact, I'm downright pissed. This is some form of bait-and-switch that should be illegal. When you offer a rebate to your customer, you should provide them with a CASH rebate, not a debit account that they somehow have to figure out how to use.

For the smart ones out there who were thinking, just use the card to get cash -- no dice. I thought the same thing, but alas the rules include:

Your card is valid only in the U.S. and may not be used for cash withdrawals or at any cash dispensing machine.

It's even invalid at the gas pump. If you want to use it to pay for gas, you have to go inside the station and wait in line.

And, of course, it expires in a relatively short period of time.

What are the problems with this debit card model?

• Cingular hopes that this is another deterrent for the user getting the full value of the rebate. At the minimum, it will slow down the transfer to cash to the user as the user finds ways to make use of the debit card until it is used up.
• Most facilities are not setup to allow you to mix multiple payment methods, especially online merchants. This means that to get the full value, you have to find a collection of things that add up to the exact amount of $$ on the card (the card even prohibits you from adding $$ to increase it's value up to a value you would want to spend.
• Cingular hopes that nobody will be able to use up the exact amount ($100 in my case) and so they will profit from the remaining cents left on the card. The only way to totally use it up is to find a friendly merchant who will let you use multiple cards on the same purchase).
• I'm sure there's some slice of the transaction fee paid by the merchant that somehow makes it into Cingular's pocket (yes, cynical Conor strikes again).

In fact, as I was writing this blog entry, I went to Amazon to try to use up the entire value of the card right away. However, I ran into that "single card" problem for a purchase (so my $100.75 purchase wouldn't work as it was 75 cents over the value of the card). I ended up spending $92.86 of it (just couldn't find something worthwhile to purchase for $7.14 and so I have to remember the card and the amount so that if I do end up making a purchase again, I can use up the rest of it... Perhaps some candy at the local grocery store).

Can you tell that I really hate the idea of this bait-and-switch reward card vs getting the rebate check? Cingular you should listen up -- this is the kind of thing that Elliot Spitzer likes to go after.

Tags : Cingular / rebate / ripoff / Visa / Samsung / BlackJack / Spitzer

Gadget of the week #11

I've finally upgraded my "old" Motorola Razr (which I had been pretty happy with) and found the first Windows Mobile based phone that I actually like. I've tried several other WM phones including the Motorola MPx200 and MPx220, as well as an iPAQ H6315, but my new phone puts them to shame.

So, what did I buy? The Samsung Blackjack.

It took me a while to decide on which phone... I've looked at a number of them over the past few months and decided on the Blackjack for several reasons including:

• It's on my provider (Cingular) so I don't have to pay the premium for an unlocked phone without subsidy.
• Its small and light, but still has a full qwerty keyboard (though my big fat thumbs are still getting used to it).
• It has data push available for email so I can set it up to get email from work (haven't done so yet, but one of my compatriots at Intel has gotten this done).
• It felt nice in my hands.
• I got it for a good price!

I've been very happy with it since I bought it. It's worked pretty much anywhere I've tried even internationally (though there's an update for it that I've yet to load that is supposed to fix problems with some international access).

Of course, once I bought it I had to go and get the typical set of accessories. I started with a belt clip leather case. I bought the one from Cingular since I wanted one right away (though since it had a plastic clip, I knew it wouldn't last long) -- then when I got home ordered a good one. My case of choice for any device is the case made by Nutshell. They claim their cases are "tough as nuts" and they are. I've had several for different devices and they have never broken in any way -- meanwhile the Motorola case from Cingular broke within 4 days (the clip broke off). See the pics below for the case.

Of course, I had to get my Gadget-of-the-Week-#5 Gomadic power/sync tip:

Which works like a charm, of course.

My other modifications include:

• A replacement home screen. I didn't like the options that I had built in, nor was I able to find any that I liked that I could download, so I bought a copy of Home Screen Designer 2.0 and made my own. You can see it pictured above (although pictures of the phone screen just don't seem to come out very well). If you like it and want to use it yourself, you can download it from here. I will not support it, I will not provide you with any form of help installing it, and I will not provide any form of renumeration if, when you install it, it causes your phone to go up in flames (in other words, you're on your own).
• I installed a good Irish ringtone -- a midi rendition of "The Sally Gardens" (an Irish Reel).
• I figured out (with the help of the web, but I can't find the link anymore) how to configure it to work as a data modem for my PC (and so far Cingular does not charge me for the data minutes). The one sad thing there is that I was unable to get it to work via bluetooth. I was only able to get it to work via the USB cable and I guess I can live with that. I've used it a few times with decent success.
• I figured out (again with the help of the web) how to substantially lengthen the battery life at the cost of slower connectivity. I'm not sure if I'll keep it that way once I get email push enabled (if I do), but for now, my battery can last several days without a problem -- before this fix, even the extended battery was wearing down by the end of a day.

I'm very happy with the phone -- been using it for a month or so at this point and it's held up great. I'll probably try to install the upgrade at some point soon as I have a trip to Brussels scheduled for next week.

Tags : gadget / Samsung / BlackJack / Motorola / razr / mpx200 / mpx220 / h6315 / Windows Mobile / Smartphone / Cingular / Nutshell

Bizarre Circumstances

Clearly the boy has missed his calling (or at least he can give up his day job anytime).

Tags : identity / humor

A useless process

A few weeks ago, Microsoft, IBM and a number of their closest friends started the Technical Committee (TC) creation process within OASIS for the WS-Federation specification. As has been typical with the submission of the various WS-* specs to OASIS and the W3C, they proposed a charter that was an extremely ratcheted down requirement to publish the input document as close as possible to its current state (and they've gotten better with the ratcheting with each subsequent submission).

So much for the cooperative standardization process

This time, what was somewhat different than many of the previous WS-* submissions is that the functionality proposed in WS-Federation has substantial overlap with an existing standard specification which was approved as a standard more than two years ago -- SAML 2.0.

OASIS's TC creation includes a comment period which, in this case, was used by a number of OASIS participants including the likes of Nokia, France Telecom, Sun, Fujitsu, Oracle, and Neustar.

Many of the comments questioned the overlap in functionality between the 2-years-ago-standardized SAML 2.0 and the proposal.

The response to this input is recorded here. If you want the cliff notes version all you need is:

No changes to the proposed WSFED TC charter are required.

The only winning comment was Frederick Hirsch's comment about spurious characters in the charter -- this resulted in an agreement to remove them from the final charter document.

So, while there is a comment period, the proposers for the TC don't have any obligation to accept, listen to, or even pay attention to any such comments. In the session in which the comments are discussed, only the proposers can provide input, the commenters can't argue their case, nor can they do anything to impact the outcome of the treatment of their comments, even if they are being totally ignored.

OASIS and its members would be better served by a process that has some useful purpose. Asking people to provide comments and input that can be out-of-hand totally ignored is wasting their time in putting the input together, wasting the proposers time in having to organize and participate in the review meeting where they can simply ignore all input, and wasting the rest of our time in un-beleivably reading the out-of-hand dismissal 31 separate times.

So the official call for participation has been released now. The WS-Federation TC is forming under what many view as a flawed charter and a flawed standards process. Perhaps the not-so-nice response to this not-so-nice process would be to join the TC and to simply vote to block forward movement of the spec until these issues are resolved. Yeah, that's the nuclear option, but perhaps it's time to throw down the gauntlet and somehow drive some convergence in this market rather than continuing to drive separation.

Clearly I'm speaking, even more so than normal, from my non-PC personal point of view.

Tags : identity / WS-Federation / OASIS / Microsoft / IBM / Nokia / Oracle / FT

Making an MP3 CD...

I was on a long trip this past weekend through the mountains of Pennsylvania where there was little to no radio station coverage and it kept changing as I drove through one location to another. I had made a similar trip a week ago with a rental car from Hertz which was configured with a Sirius satellite radio receiver and it was one of the first times I really appreciated the benefit of such a device. However, I don't make this trip all that often to justify the cost of subscribing to the service.

My car, a Chevy Colorado pick-up truck, has a 6 disc CD player so I could, and did, use some audio CDs to fill in with some music, but the number of tracks is quite limited even with 6 potential discs (although I only had one disc with me).

I tried using my FM transmitter for my iRiver Clix, but depending upon where I was, the chosen frequency kept getting overridden by an outside transmitter and I had to keep moving the frequency around -- not a good thing to do driving along at 70-75MPH.

My car's CD player does support the ability to play MP3 data CDs, giving me a 10x improvement in audio quantity, so I set out to create a disc that I could use in the car with my best music. Of course, it can only play MP3 formatted files, not WMA formatted files.

My media player of choice in my computer is Windows Media Player (WMP) and I rip my CDs in 160kbps Windows Media Audio (WMA) format. I have taken great pains to go through my entire collection of music and rate each song and wanted to use some automatic playlists to select the best of the best music for my new CDs (e.g. all 4 or 5 star rated songs). That's where the problem started.

First off, WMP seems to only want to create discs that are either an audio CD (with the standard audio format and thus about 80 minutes of music on a 700MB disc) or it can create a WMA format data disc which has good compression (close to 800 minutes) but unfortunately can't play in my car. I was unable to find a way to get WMP to burn a CD in MP3 format, nor a way to get WMP to generate a directory of MP3s from one of my playlists. Some research on the web indicated that I may have gotten this capability if I purchased the Windows XP Plus! Superpack, but I didn't have that nor did I want to purchase that.

I have Roxio Easy Media Creator 7.5 (yeah, I probably should upgrade to version 9, but they ticked me off when I bought version 7 less than a month before 7.5 came out and they didn't want to give me a free upgrade to 7.5) installed and tried to use that (which does have the ability to create an "MP3 disc" -- which I'm pretty sure is exactly what I'm looking for. However, it was unable to take WMA formated files as input nor was it able to use one of the WMP playlists.

I also have iTunes installed which is able to import WMAs and is able to store files within it's library in MP3 format, but it too appeared to be unable to use a WMP playlist as input to specify the files to copy/convert, nor was I able to find a way to get it to generate an MP3 disc (audio disc yes, backup disc -- whatever that is -- yes, but MP3 disc apparently no).

However, this motley collection of tools, along with some shell scripting, was able to accomplish the task at hand. The steps are shown below:

1. Create a directory containing the WMA files that I want to have on the MP3 disc. This was necessary so that I didn't have to manually select each song that I wanted to import into iTunes, nor re-generate my ratings/playlists within iTunes because I imported the entire WMA collection. I saved a WMP playlist containing the files of interest and ran the following script within cygwin:
   

    grep "\.wma" "$OLDPWD/mylist4.wpl" \
            | sed -e 's;.*"M:.My Music.;;' \
                  -e 's;"/>;;' -e 's;\\;/;g' \
                  -e "s-'-'-g"          \
                  -e "s-&-\\&-g"         \
            | cpio -pdm /cygdrive/d/data/tmp/music
   

   This reads the specified WMP playlist (mylist4.wpl in this case), uses SED to convert the XML into a list of files (XSLT is probably the right way to do this as the file was XML, but a) I don't have XSLT installed and b) the XML was simple enough to do this all with the SED script), and uses CPIO to copy the WMA files to a temporary directory.

2. Import the files in the temp directory into iTunes. Be sure to change the preferences setting within iTunes to tell it to import the files in 128Kbps MP3 rather than the default AAC format.
3. Use Roxio's Creator Classic utility to burn an MP3 disc, selecting the iTunes collection as the source (I had no other music in my iTunes installation so this made it pretty easy -- I didn't have to go poking around selecting files to include on the disc.) The default iTunes music directory in my install was "My Documents\My Music\iTunes\iTunes Music".

I presume that someone, somewhere has an easier way to do this and I would love to hear about it as I presume I will need to do this again. It's a shame that WMP didn't offer this capability directly as it certainly has the necessary codecs and could have done so -- but I presume they are more interested in spending time on their hateful DRM stuff.

UPDATE - after all this, I find out that it is only the single-disc player for my car that includes the ability to play MP3s. The 6 disc changer does not have this capability. So it was all a waste!!!

Tags : windows media player / wma / mp3 / Roxio / iTunes / Hertz / Sirius / XSLT

Ad Blocking

I've known about the Firefox adblock plug-in for a long time, but have resisted installing it. For the most part, I think that sites I visit have a reasonable case for showing advertisements (to pay for the thing that I'm going to view or use). I don't mind that they make money. And, I don't mind getting ads that are related to what I'm doing, so it was sort of a win-win for everyone.

However that changed today... Over the past few weeks I've been poking around on my system when it would go slow. Of course, Outlook was frequently to blame. But there were times when I could not attribute the problem to Outlook and looking in my task manager, I found that it was Firefox that was using up the CPU -- 15 to 20% of it, even when I was doing nothing.

Some experimentation found that there were several adds running on different sites that were flash based and were eating away at my CPU.

So, I installed the plug in, restarted Firefox, and went to the pages that had the ads in question and easily blocked them. I'll continue to allow ads that aren't hungry consumers of my CPU (for the reasons I gave earlier), but nobody has the right to put an ad on my system that has a measurable impact on the performance. Ad writers, take this to note... Stop with the flashy, high load ads lest we block them all.

Anyway, thanks a bunch to the Adblock Crew and Michael McDonald for making this great plug-in available.

Tags : Firefox / Flash / ads / Adblock / Outlook

Planet Earth

The Discovery Channel has started running an 11 part miniseries titled "Planet Earth", narrated by Sigourney Weaver.

We enjoyed watching the first 3 episodes (thanks to Tivo!!!!) which aired on March 25th. The show will continue to air on Sundays through April 22nd.

It's a great show and I recommend it as breathtakingly entertaining (and even educational) for the entire family.

Tags : Planet Earth / Discovery Channel

Free Software Update

Back in Dec, I wrote about the Almost Free Software offers that I kept receiving in the mail and how it clearly wasn't a smart or good deal. Since then, the parties pushing their "Downloadable Software" have gotten even more aggressive (I'm getting probably twice the number of offers today) and they have varied their approach considerably.

I still get the emails that have the list of software offers for like $79. I also get emails with images such as the one below:

Or

Or:

Or:

Office 2007 is available for enterprise users from November 30, 2006. The end user version is available from the beginning of 2007. The 2007 Microsoft Office System, also known as Microsoft Office 2007, is the most recent version of Microsoft's productivity suite. Formerly known as Office 12 in the initial stages of its beta cycle, it was scheduled to be made available to volume license customers on November 30, 2006, with general availability following in early 2007. Office 2007 contains a number of new features, the most notable of which is the entirely new graphical user interface called the Ribbon, replacing the menus and toolbars that have been the cornerstone of Office since its inception. Office 2007 also includes new applications and server-side tools. Chief amongst these is Groove, a collaboration and communication suite for smaller businesses which was originally developed by Groove Networks before being acquired by Microsoft in 2005. Also included is Office Sharepoint Server 2007, a major revision to the server platform for Office applications, which supports "Excel Services", a client-server architecture for supporting Excel workbooks that are shared in real time between multiple machines, and are also viewable and editable through a web page. While Office 2007 includes many new features, one has been removed entirely: Microsoft FrontPage is no longer being developed; its successor is the Microsoft Expression line of products. Microsoft Office 2007 Enterprise
Retail Price $899.00
Our Price $79.95
You save $819.05

Or:

Downloadable Software (DS) is a rapidly growing company with a high quality software. You've come to the right place if you need professionally implemented programming solutions for your usage. Thousands of contented customers have already benefited from our software and solutions. Hundreds are joining this community every day.
We deliver superior software products and services that empower our partners and customers to dramatically improve their development, deployment, integration and management of quality applications all over the world.

Most popular OEM products:

Microsoft Windows Vista Business
Retail Price $299.00
Our $79.95

Microsoft Office 2007 Enterprise
Retail Price $899.00
Our $79.95

....

These offers come from all kinds of people (most likely falsified) with subjects tell me that Carysoft, michelsoft, Jefferysoft, Jinnysoft, sanitysoft, etc., etc. have great "80% offers off MICROSOFT/ADOBE SOftware". I've even gotten some "sóftwáre dównIóád cóúpón" (again, the special characters are an attempt to squeeze by spam filters).

The domains/hosts where you are asked to go include:

• www.sobaka-oem.com (currently the most popular)
• daikal2.eu
• www.laga-soft.com
• cl.rmsofto.eu
• lloemd.eu
• buratinopedorino.eu
• nasdaqkrutchert.com
• kozel-oem.com
• ektroem.com
• kvaka-soft.com

What should you do?

Stay away from those sites. As Robert Heinlein often said: TANSTAAFL -- Their Ain't No Such Thing As A Free Lunch. If it sounds too good of a deal, it is too good of a deal.

I haven't dug deep enough into the site to figure out if they are just trying to steal your identity or to sell you bogus software, but I'm convinced that it's one or the other.

Tags : scam / spam / identity theft / rip off / tanstaafl / microsoft / adobe / vista

Liberty's Advanced Client Trusted Module

Last week, the Liberty Alliance announced the release of the initial draft of the Advanced Client Technologies (ACT) specification set. I mentioned it as well last week.

One component of the Advanced Client Technologies that may be less than obvious is the Trusted Module (TM). The TM should not be confused with the Trusted Platform Module (TPM) whose specifications have been released by the Trusted Computer Group -- the two modules do very different things, although I expect that some TM implementations will make use of a TPM to enable their trustedness.

The TM doesn't stand out so well since there is no "Trusted Module" specification in the specification set, although there is discussion about the TM in the Advanced Client Technologies Overview. That is, in part, because the TM isn't a service itself (although it does make use of other services such as the IdP service).

However, the TM is one of the more useful components included in the Advanced Client Technologies specs and was driven by a number of valuable (from a personal and a business sense) use cases which called for the following capabilities:

• The TM can act in the name of the (Identity Provider) IdP for SSO and Web Services transaction identity assertions.
• The TM can locally validate user credentials (username/password, smartcard, biometric, etc.) and assert the identity of the user based on the local validation (to the IdP and/or to relying parties (RPs)).
• The TM can perform these tasks when "offline" or otherwise disconnected from the IdP (sometimes out of a choice for privacy reasons).
• The solution must allow for, document, and support a model that does not inadvertently require the creation of a correlation handle for the user's identity across multiple providers. This requires interesting solutions when you take into account that an entity that is likely to be per-user will be participating in signed transactions.

Essentially in this model, the TM is a local beachhead for IdP delegated functionality. The reasons why an IdP might want to support this model include (in no special order, nor intended to be totally inclusive):

• Security - allowing verification of credentials locally, without the need for network transmission nor network storage of the credential verification data decreases the likelihood that such data will be stolen (especially an issue when considering biometric data given that the user typically can't change their biometric data).
• Load distribution - the identity related transactions are distributed out to end-user systems rather than having to rely on a central server for every transaction.
• Privacy - allowing the TM to perform SSO operations reduces the visibility of the IdP into exactly what the user did when since the TM can do so without involving the IdP (assuming, of course, that the IdP has allowed the TM to do so).
• Availability - the user is able to actively assert their identity, even when the IdP is not available (e.g. because of maintenance downtime, connectivity issues, or even remote site access).

All-in-all, this TM provides a substantial package of powerful technology that will improve the overall identity meta-system. I look forward to seeing some of this stuff hit the street.

Tags : identity / liberty / Liberty Alliance / Advanced Client / Trusted Module / delegation / TCG / TPM / TM / privacy

Keylogging & Security

In Identity X-File 0x01, Pam writes about a story in the UK where a 6 year old was able to bring in and install a hardware key logger on an MP's computer in the House of Commons (it was part of a BBC experiment).

I assume a physical keyboard logger like this could still be used to steal an IdP username & password, even with all the secure desktop stuff that the CardSpace client has built in…

Essentially what a key logger does is use a Man-In-The-Middle attack to capture all input to programs and applications (including login screens) on a computer. The captured data is then analyzed to pull out useful information such as login credentials, credit card numbers, and other such valuable information.

If the primary concern is login credentials, the "easy" answer is to move to some form of strong authentication that requires hardware assistance (such as a smart card or biometric reader). These usually have communications protections in them to protect against MITM attacks. This isn't so easy to implement across a number of vendors (especially if you try to do it without identity federation networks such as those discussed by the Liberty Alliance's ID-FF and OASIS's SAML 2.0) and, even if you were to do so, the non-credential data entered by the user would still be subject to loss (such as the content of all typed emails, documents, etc.).

I did stumble across one amusing way around loggers (but, IMHO, opens all kinds of other problems) which uses a screen based keyboard to enter your data by clicking on buttons -- theoretically this is less likely to be picked up by loggers. The problems with this model include:

• While you click on the keys, your credentials are displayed plain-text on the screen so anyone looking over your shoulder would get them.
• You are trusting that the party that manages that page is not going to add anything to that page to log your entries (and without looking at the code, there's no easy way to do so).
• The site is unencrypted, so anyone looking at your network traffic can get the data
• The way that you then copy the data to the appropriate application is via the Operating System's copy/paste routines, something that is frequently available to any application and so subject to attack.

I wouldn't recommend using such a solution. Just too many weaknesses for me.

The ultimate answer for key loggers is a Trusted Path (sometimes called "Secure Path"). The trusted path ensures that the user is talking to the application that they think they are talking to (i.e. that there's no MITM listening in). Microsoft talked about doing this in their Next Generation Secure Computing Base (NGSCB) (code-named Palladium), which, at one point was to be part of Vista. However, only a limited set of the NGSCB functionality made it into Vista - the BitLocker drive encryption component.

This problem isn't small and isn't easy to solve, especially when you consider the need for being able to replace keyboards (because they broke, because you want to try a more ergonomic version, etc.). If you make replacement easy, you make MITM easy. If you protect against MITM, you end up making it hard for your users to easily work with their systems (increasing IT maintenance cost).

Tags : key logger / Microsoft / Palladium / Vista / Trusted Path / Secure Path / MITM / NGSCB / SAML / Liberty / Liberty Alliance / ID-FF

Vonage One Year Later

Last year, after one outrageous long distance bill from AT&T for a call to a hotel in Rome, I bit the bullet and jumped into the VOIP world. I signed up for 2 lines from Vonage with unlimited long distance within the US and very reduced charges for international calls. Seemed like a great deal.

I wasn't worried that much about the bandwidth as I have a T1 line with 1.5Mb bi-directionally that spends most of it's time very idle, so bits weren't a problem. I also figured that in this case, contrary to my norm, I wasn't going to be on the bleeding edge as VOIP had been around for a while and should have had many of the kinks worked out.

However, that wasn't to be the case and today I took the first steps to move back to the POTS world. Which isn't all that hard as I hadn't gotten rid of our primary line. My reasons for the switch back include:

• Voice quality - we continuously had voice quality problems. First with an annoying echo when calling certain numbers -- worst being my wife's cell phone which made the line pretty useless. Then with people not being able to hear us and having to regularly fall back to our POTS line so that they could. If it was just one call or one party, I could have worked around it, but it was consistent with many people.
  
  And yes, I worked with tech support at Vonage (including their first level support in India and in several cases with their second level support that seemed to be in the US). There were 4 separate times where I worked with them for like 45 minutes to an hour as they tried one thing and another and required me to go down and reset the switch manually.
  
  I should have recognized that there would be this kind of issue when their documentation was very clear about "many problems are solved by just power cycling the switch" -- I don't think I've ever power cycled my POTS phone and yet it seems to just work.
  
  In any case, we never got the audio problems fixed... they would get better for a little while or to a particular number, but shortly, I'd end up with what?... What did you say?... Can you speak louder? (yes, they asked *me* if I could speak louder).
• Even when we didn't have audio quality problems, we had bandwidth issues (yes, even on a T1). As soon as I started downloading a big file -- and in todays world of sending around multi-megabyte attachments, this wasn't exactly under my control -- the call started cutting out. Even when we downgraded the audio bandwidth to their lowest setting of 30Kbs which, of course, made the audio quality problems worse.

So I guess I will have to wait a bit further before joining the VOIP revolution.

For now, I've signed up with Verizon's Freedom plan giving me unlimited long distance in the US for a good bit more than what I would pay Vonage ($44 vs $25) and with a few less services, but I have a phone that just works and I don't have to spend lots of time explaining audio to them or go down to my basement to reset the device. I've kept one of my Vonage lines, but downgraded to their $15 plan to deal with transferring back our registered numbers at school and such. Once the switchback is complete, we'll just get rid of that too.

I have friends who have no problems with Vonage. Perhaps they have a better switch... Perhaps they talk to people with better hearing... Or, perhaps their just more willing to deal with the problems. I don't know.

Tags : voip / vonage / verizon / At & T / pots

Ignorance exposed

In Oh, the humanity (not sure exactly who it is, the blog post is attributed to "economist.com") it is clear that the author has never experienced the pleasures that come from being an elite member in an airline frequent flyer program.

I've never seen anything quite so blatantly designed to appeal to the self-absorption of an the emerging upper-middle class. Are those of us who—please, have a hanky ready before you read this next—have absolutely no elite frequent flyer status at all really expected to wail in sympathy at this? That seems a bit rich, particularly if we happen to be (as we so often are) holding the paper in front of us as we shift helplessly from foot to foot on the four-hour airport security line.

As my 13 year old daughter, Lauren, would say "you're just jealous!"

I'm not responding at all to your complaints about the NY Times (even though, as a youngster, my first real money making job was door-to-door selling subscriptions to the paper where I typically earned $100/week back in the mid '70s -- pretty darn good salary for a teenager back then) - just to your clear lack of experience with privilege and its loss.

It's been less than a month since I lost my United Global Services Status and I already miss the fact that a human would answer the phone when I called them, or I would be met upon arrival at LHR to be escorted to my connection, etc., etc..

Perhaps I too am unreasonably crying, but once you experience these things, it is hard to go back.

Tags : economist / frequent flyer / United Airlines / UAL / LHR / Global Services

Liberty's Advanced Client Technologies

Today, the Liberty Alliance announced the availability of the public draft release of the Advanced Client Technologies specification set.

This is personally pretty important for me because:

• it is closely related to the Identity Capable Platform research work that I'm doing at Intel (which we demonstrated at the RSA Security Conference in a joint proof-of-concept with British Telecom & Hewlett-Packard)
• I was the editor of each of the specifications (with lots of great contributions from several other Liberty members -- even Paul, if you can believe that)
• I was quoted in the press release :-)

The advanced client work is some pretty cool stuff where we are taking the next step in the evolution of powerful client capabilities including:

• Trusted Module - the IdP can extend itself onto the user's device in a trusted way so that the user's device can act as an extension of the IdP and assert the user's identity independently of an active session with the IdP (for privacy and/or connectivity reasons).
• Provisioning - functionality can be provisioned over-the-air (or over-the-wire) in a trusted fashion with full life cycle support. So Trusted Modules can be provisioned to devices already in the field.
• Service Hosting/Proxying - enabling connectivity challenged devices to be the primary host of services (such as my PDA being my "official" contact book service) while providing a more stable network visible proxy to provide access to that service's data through either local hosting or proxying request to the client service.

This draft release is being done much earlier in the spec evolution process than Liberty has typically done in past specification releases as part of our attempt to be much more open in our specifications development process. I hope that you take some time to look at the specs and provide feedback and/or input. I would recommend starting with the Advanced Client Technologies Overview before digging into the other specifications.

The only negative in all of this is, as Paul surmised, I was unable to figure out a way to insert my blog url (http://conorcahill.blogspot.com for those few that don't know) into either the specs or the press release. I'll have to see if I can get that error fixed in the next release.

Tags : identity / Liberty / Liberty Alliance / Advanced Client / Intel / HP / BT

Flight Connection Pain...

After my Liberty TEG meetings last week, I spent the weekend visiting some of the relatives in Ireland. Since that obviously wasn't a part of my business trip, I purchased the tickets to go from London Heathrow (LHR) to Dublin (DUB) independently of my business travel tickets.

In this case, I decided to use British Midland (BMI) since they are a member of the Star Alliance (hoping my status in United would help) and they were a few (like 10 or 20) dollars cheaper.

Well, that was a mistake that I soon found out when I got to LHR to head over to DUB. We had finished the meetings a bit early (around noon) and with a quick drive back to London, I was in the airport at 1 and asked if there was an earlier flight that I could get on. There was. At 5:40 PM. But to get on that flight I would have to pay an additional £200 (about $400), just to get in a few hours earlier. I decided to pass.

Next came my return flight. I was flying BMI to LHR and then United to Dulles. United is a member of the Star Alliance, of course. But BMI refused to check the bags through to Dulles. They would even refuse to check the bag through if the connection was a BMI flight. So, I had to pick my bags up in London, totally exit security and then walk over to Terminal 3 and come back in through checkin and security as if I was originating in London (could not use the flight connection center which makes this much easier). This was NOT a fun experience -- but, if it does happen to you, be sure to take one of the baggage cart and put your bags on there for the walk over. Even with wheeled bags I found the cart much easier for the long trip through the tunnels connecting the terminals (and, unlike most airports in the US, the carts are free).

Next time, I will use Aer Lingus. I've used them before and done the earlier flight (yeah, they did charge me £25, but that's much more reasonable) and they do check the bags through for me on the return. I won't get United miles (I'll get American instead) and I won't get my Star Alliance Gold treatement (that only allowed me to use the priority check-in and boarding), but I will get a much, much more reasonable airline.

Tags : travel / BMI / UAL / Aer Lingus / lhr / dub / Dulles / bmi

Mail Fraud

This week I've been off in the UK (in sunny, friendly Ipswich which is northeast of London) attending a Liberty Alliance Technology Expert Group (TEG) face-to-face meeting. Paul and I have been giving one of the other attendees (who works for Sun, but shall remain nameless) a hard time the entire week about an interesting work item that we want him to take on.

We discussed talking to his boss offline and having our management board reps approach his boss as well and clearly had him worried about the possibility.

So I used my mail server to forge a note from his boss stating:

Hubert,

Robin has advised me that he can no longer participate as the co-chair of the PPEG group within Liberty. Given that Sun needs to maintain it's visibility Liberty for our customer base, Eve and I have spoken and it seems that you would be an ideal candidate to step up as the next Chair of the TEG.

We need to talk further when you're back in town.

Bill

We thought about talking directly to Bill afterwards and getting him in on it so he could send a note to the nameless one with a "Why haven't you responded to my mail?" -- perhaps he will read this and do so :-).

Moral of the story: Don't believe email, especially if the sending server isn't within your own domain. George says there should be a thunderbird plug-in that will red-flag any email coming from one of my cahillfamily.com domain, but I pointed out that I host like 15 or so domains for friends, so I could easily work around such a restriction.

Tags : identity / fraud / Liberty / Liberty Alliance

GPS, timezones, and patents

I've had a lot of experience using my cool gadget-of-the-week Nuvi 670 on trips over the past 3 weeks (east coast US, west coast US, Bristol UK, and Ipswich UK -- yes, all of that in the past 3 weeks!) and techie though I am, I am still quite impressed by how well it works, especially with all the roundabouts in England.

However, one thing that bothers me with this unit is that the time continuously is reported as my originally configured EST/EDT. So, upon arriving in the UK yesterday, the anticipated arrival time in Ipswich showed as 5AM rather than 10AM.

Why doesn't the unit automatically adjust the clock for the local timezone (or at least have an option to do so)? It's not like the unit doesn't know where I am at any given moment. It's not like the timezone maps are all that complicated -- hey it has *road* maps and speed camera POIs which I'm sure are much more variable and complex.

Looking at Garmin's web site I found the following timezone FAQ:

Q. How do I get local time displayed? What about daylight-saving time?

A. GPS units operate on UTC time. UTC is the Universal Coordinated Time or Greenwich Mean Time (GMT). You can input a local offset (or difference) from UTC so that the unit will display your local time. This option is located under the unit's operational setup. A chart is provided in products' owner's manuals to help you select the appropriate offset for your area. If needed, the chart will also show the UTC offset during daylight-saving periods. New Garmin GPS units allow you to select the time zone you are currently in or select a time zone for a projected location by selecting from one of eight U.S. time zones or 24 international time zones. You may also turn an adjustment for daylight saving to auto, on, or off.

So, no mention of automatic adjustment.

Given that this is such an obviously useful feature, I wondered if the reason for the lack of the feature was because of our oft-maligned patent system. A quick search in the US published patents turned up a patent #5,089,814 assigned to Motorola:

A portable receiver has a time of day clock and receives a signal indicative of the location of the portable receiver. The portable receiver has a memory which has a plurality of locations with corresponding time zones. Upon reception of the location signal, the receiver determines the time zone of the location and the time zone of the time of day clock. The time of day clock is then adjusted to correspond to the time zone of the location. The location signal may also be used to adjust the operating frequency of the receiver.

This feels like another one of those patents that don't rise above what one would consider the non-obviousness bar, but which made it through the patenting system anyway. No offense meant for Motorola or for the inventors as this is how the patent system works and if you don't play the game according to the rules set by the US PTO, you loose.

Note that I have no clue if this particular patent is the reason or even if that patent would really read on GPS systems (the patent was developed for paging systems, not GPS systems), but given the obvious match of GPS and automatic timezone adjustment, I have to assume that there's something holding back that feature and the most likely culprit is our patent system.

Tags : gps / timezone / Garmin / Motorla / patent / Nuvi 670

No Child Left Behind

The No Child Left Behind (NCLB) program holds schools responsible for the progress of each student's education. At first glance, this seems like a good idea and, of course, nobody wants to have children grow up without getting an adequate education.

However, education, especially for younger students, is not something that is completely in the hands of a school. The formula for success of a student's education includes the student themselves as well as the student's family. The NCLB program makes no allowances for the fact that while the school is doing all that they can to help educate the child, the child may not care or, in some cases, their family may not care and may even stand in the way of their child getting adequate assistance.

In Virginia, each year schools use the Standards of Learning tests to measure the progress made by students. The problem here is that the student has no skin in the game until they get to high school. In Middle School, if the student passes or fails, it doesn't matter. They are still promoted to the next grade -- the test is just used as a measure of the school's performance. This lack of skin in the game means that some students, once they recognize this, don't study or otherwise help prepare themselves for the test and when taking the test, don't even try to do well.

Family life, which has the biggest impact on student success, is not considered at all in NCLB. In fact because of the segregation of student groups, traditional minority groups which have a strong cultural drive for education (Chinese, Indian, Japanese, etc.) are purposefully prevented from raising the bar for all minorities. Parents have a responsibility to their children to help them learn the value of a good education and to help them get a good education. With NCLB, Parents who don't do this, who sometimes even make it hard for a student to succeed have no repercussions.

This is coming to a head now because of this formerly little known provision requiring "Adequate Yearly Progress" (AYP) for all groups -- not just the school as a whole. This means that if any of the subgroups don't make adequate year over year progress, the school can be subject to corrective actions. Even the best of schools can be subject to this. Recently the Washington Post ran a story about some good local schools that were taking seemingly drastic moves to meet the requirements for AYP. From the article:

The principal of Earle B. Wood Middle School in Rockville gathered teachers and handed out a list of all the black, Hispanic, special-education and limited-English-speaking students who would take the Maryland School Assessment, the measure of success or failure under the federal No Child Left Behind mandate.

Principal Renee Foose told teachers to cross off the names of students who had virtually no chance of passing and those certain to pass. Those who remained, children on the cusp between success and failure, would receive 45 minutes of intensive test preparation four days a week, until further notice.

Apparently some are concerned about doing this, but, given the position that these schools are in with limited funds, limited time and so much on the line, I think it's appropriate for them to target their resources where those resources will have the biggest impact. However, I don't think that the school should be put into this position. There needs to be a better way than putting everything on the school.

So where does all this leave us? First off, I think that there should be some way to make the students and the parents responsible as well. I'm not sure exactly what to do, but this can't be done just by the schools. The solution has to include families and students.

Tags : education / NCLB / No Child Left Behind / ayp / Adequate Yearly Progress / school

Seat Selection

While I was arranging a future trip to Portland (where my office is), I selected the exit row aisle seat (11C) on the Airbus A320 that would be used for that flight. You can do that (select exit row seating) when making reservations on a United Airlines flight if you are at a Premier Executive or higher level in their Mileage Plus program. I think this is one of the more valuable benefits of being a Premier Executive.

Anyway, later, when the trip was ticketed by our travel department, I went to look at my seats on United's web site and found:

Note that some crazy person had apparently selected the exit row middle seat right next to me, even though there were exit row window and aisle seats still available all over the place. What kind of nut was that. So, I changed my seat to 11D (the aisle seat on the other side of the plane) and went onto the next leg of my trip.

When I later returned to check on the seat, I found:

The idiot had followed me. I had a plane seat stalker...

After switching back and forth a few times and finding that the seat next to me kept being occupied by my stalker friend, I figured out that this is United's way of ensuring that somebody else doesn't sit in the seat next to me until and unless the flight is filled above some level of capacity.

I had heard that they do this, but this is the first time I had some reasonable amount of proof that it actually occurs (surprising that it took me more than a million miles to figure this out, isn't it). My understanding (rumor level only) is that this happens (on purpose) for 1Ks and above.

Of course, this is all probably moot since I'll probably be upgraded before I actually get on the plane :-) -- as evidenced by my Traytable pictures.

Tags : travel / United Airlines / ual / Mileage Plus / 1K / Premier Executive

Delegation, Impersonation, and downright access

This discussion is going on and on and people are talking about it from all points of view (including Kim, Pete, Dave, Paul, and Eve, who apparently started it all in a conversation with Jim). The conversation seems to be arguing about technical issues, but in reality it is mostly a semantic argument rather than a technical one.

From what I can gather, I think all of the parties agree that:

• The user can give permission to an entity to do "something" for the user at some later point in time.
• When this "something" occurs, the entity initiating the "something" needs to be identified as well as the user for whom the "something" is taking place.
• When this "something" occurs the user does not need to be physically present, online, or otherwise directly involved.

The points of disagreement seem to be in the area of how to refer to this taking place and whether or not this is supported by one protocol or another. I'm not married to the terms "user-not-present" (which is, physically true, by the way) nor the term "on behalf of", although I do think that both apply to this case. I'm also OK with the term "delegation".

One thing that hasn't been clearly discussed here is the case of real impersonation. There are real world cases where impersonation takes place, such as when an administrative assistant performs some tasks in the name of his boss (like sending flowers to my wife :-) ). I certainly don't want those flowers to indicate that they came from my admin. However, I still think that case is rooted in my admin authenticating as himself to a provider where I have granted permission for him to act in my name (perhaps for a particular set of tasks), so this seems like the same ultimate use case (me defining permissions on some resource I control).

So the last part in the discussion is onto the protocols. I can state unequivocally that Liberty ID-WSF does in fact fully support this use case and has explicit definition of all the parties involved in a transaction. Liberty also provides for the means for collection of the permissions necessary for the transaction as well as a means for an entity to indicate to the service provider that they intend to invoke a particular request later in a context where the user will no longer be present (so that the service provider can prompt for any necessary permissions from the user). At Liberty, we painstakingly walked through the entire use case and all of its related messages to ensure that the system would work in that case.

I do not understand how this same (or similar) sequence would be done using the WS-* family of specifications. I am sure it could be done, but I believe anyone doing so would be doing a one-off solution that would not interoperably work with anyone else's one-off solution as the protocols don't dictate a standard way to do this (yet). I would like to be wrong here and call on the WS-* guys to stand up and point out how this could be accomplished in a standard way that is expected to be interoperable.

Tags : identity / liberty / Liberty Alliance / WS-Trust / delegation / SAML / impersonation