The Lurker

The real problem with Apache

posted by ajf on 2011-11-25 at 07:55 pm

Most of the discussion of this criticism of Apache by Mikeal Rogers has focused on the merits of git, which I think misses the bigger picture.

To me the interesting thing here is that, never mind "community over code", Apache appears to value bureaucracy over community:

Prior to this migration I brought up, on more than one occasion, the topic of git with ASF members and was told that the real barrier was just getting someone to maintain the server and that there was no policy barrier that required subversion. Once a project actually attempted to resolve this by maintaing a server and migrating their project to git they were hit with a whole new slew of requirements along with reasons they should be outright denied the right at all.

[...]

After a fierce battle CouchDB has been allowed to begin the move to git. The process appears to be going well and is being led by committer Paul Davis.

Enter PhoneGap. The PhoneGap project has been on GitHub for quite a while and already contains an enviable list of contributors. The project has been very successful and the move to Apache is a result of Adobe's recent acquisition of Nitobi, creators of PhoneGap.

By ASF regulations the project must spend time in the "Incubator" even though it has already proven itself as a technology and as a community to the rest of the world. The project requested git as its version control rather than subversion, for obvious reasons. The request was met with some hostility and new pressure has now come down on the CouchDB "experiment".

It sounds awfully like some within Apache are more than willing to disrupt an existing developer community for the sake of shielding Apache from the need to adapt.

I've long been amused by the warning in Apache's Incubator process against "excessive fascination with the Apache brand", since so many of the projects going through that process seem to be driven there specifically by some corporate sponsor's desire to find someone "respectable" to catch their code once they throw it over the wall. When this happens, it seems more like spin: we're not abandoning this software, we're contributing it to a serious open source community. It's hard to see any tangible benefit to PhoneGap contributors or users that would derive from joining Apache.

Related topics: Mindless Link Propagation Rants

A typical morning on Melbourne's train network

posted by ajf on 2011-02-11 at 05:05 pm

As I arrive at North Brighton station one of Metro's friendly staff announces that the next train will arrive in five minutes. Apparently I blacked out for a little while, because the train arrived before I'd even managed to open my newspaper — still, it's not as though I want to complain about not having to wait for a train.

The journey is uneventful until we pass through Richmond station. Incredibly, the train proceeds directly to Flinders Street without a lengthy delay somewhere near the arse end of Federation Square. I'm on platform 13 at about 8:36.

It's a short walk to platform 10, where the 8:40 Werribee train waits. Things are going really smoothly today.

But don't worry: we can fix that.

As I'm walking toward my carriage, the display goes blank. Another friendly microphone-wielding customer service gentleman confidently confirms that this is, indeed, the 8:40 Werribee train. He proves to be absolutely correct.

But not yet.

As I board, a different announcer declares that the 8:40 Werribee service will now depart from platform 12, right next to the train I'd left five minutes earlier. By the time I get back there, the train has arrived, and when I board the driver confirms that he is heading to Werribee — but not until network congestion clears up ahead. But before he can even finish saying so, yet another helpful Metro employee has boarded the train to share his idea about getting around the congestion: we can all, passengers and driver alike, get out of this train and return to the other one back on platform 10.

Oh, and as my train approaches Footscray station, it's starting to rain. If that train had left on time, I'd've been dry in the office by now.

We are all button-mashers now

posted by ajf on 2010-12-05 at 09:08 pm

One of the highlights of YOW Melbourne last week was Guy Steele's talk on designing algorithms for parallelism. He started with a punch card he'd written in the 1960s, which dumped the machine's memory, walking us through the series of contortions required to load it as a debugging tool — limited to one card, self-modifying code to produce 16-bit values in memory which couldn't be read from the 12-bit card, determining experimentally that the hardware permitted "getting away with" certain undefined operations, reading from the address containing an instruction because that instruction happens to be represented by a useful number, and so on.

Steele called it the dirtiest code he had ever written. Not only did later hardware require fewer such "dirty tricks", tools that improve developer productivity — macro assemblers, garbage collection — sometimes take away the degree of control that made many of those tricks possible.

But then I stumbled on this interview from a couple of months ago compares things he has created with HTML5 to games developed for the Atari 2600 (my emphasis):

Something else that took me a while to internalize: you have to accept that with Web development, anything that's worth anything will be a hack. Not just prototyping; production code as well. That's hard to swallow when you're used to proper, clean, sterile programming. [...]

And eventually that battery of hacks in your sleeve might make you stand above. My crude and jaded metaphor of Web development is button mashing when playing video games. Everyone hates button mashers, but working with cutting-edge Web really is flying blind a lot of the time — you're trying out all sorts of things that sometimes don't logically make a lot of sense. But they somehow work. If you get used to that mentality and you get familiar with those hacks, you will train your instincts to know which buttons to mash first, and give yourself more buttons as well.

We're not talking about programs restricted to eighty 12-bit columns, we're not talking about getting the most out of early, primitive gaming hardware like the 2600, we're talking writing code for enormously complex machines, conforming to specifications that require millions of lines of code to implement.

Can somebody explain to me why the fuck this is considered acceptable?

Having spent the last eight months working with a team of people producing a high-quality applications for mobile phones, it really pounds home the feeling that writing a browser-based application is like tying your hands behind your back and trying to type with your molars.

Related topics: Mindless Link Propagation Web Rants

On what "the market" wants

posted by ajf on 2010-11-03 at 12:01 am

And I thought I was cynical:

The markets want money for cocaine and prostitutes. I am deadly serious.

Most people don't realize that "the markets" are in reality 22-27 year old business school graduates, furiously concocting chaotic trading strategies on excel sheets and reporting to bosses perhaps 5 years senior to them. In addition, they generally possess the mentality and probably intelligence of junior cycle secondary school students. Without knowledge of these basic facts, nothing about the markets makes any sense — and with knowledge, everything does.

What the markets, bond and speculators, etc, want right now is for Ireland to give them a feel good feeling, nothing more.

[...]

In lieu of a proper budget, what the country can do — and what will work — is bribe senior ratings agencies owners and officials to give the country a better rating. Even a few millions spent on bumping up Ireland's rating would save millions and possibly save the country.

Bread and circuses for the masses; cocaine and prostitutes for the markets. This can be looked on a unethical obviously, but since the entire system is unethical, unprincipled and chaotic anyway, why not just exploit that fact to do some good for the nation instead of bankrupting it in an effort to buy new BMWs for unmarried 25 year olds.

Not quite everything you need to know

posted by ajf on 2010-10-12 at 11:37 pm

John Gruber on the relationship between Telstra and Apple:

There you go. He thinks his carrier is Apple's customer. Thus the conflict, because Apple treats iPhone owners as its customers.

As Gruber would have it, the tension between phone carriers and Apple is over whether the carrier or the customer should have control over the device in that customer's pocket. That is disingenuous.

Here's the real bone of contention: Telstra believes Telstra should control what you can do with your iPhone. Apple believes Apple should control what you can do with your iPhone.

You'll notice the customer doesn't get the final word in either vision. Gruber doesn't care because he happens to think (like a hell of a lot of satisfied customers) that Apple's walled garden is particularly nice.

There's a very straightforward litmus test here: when Apple stops actively seeking to prevent iPhone users installing software other than via the iTunes Store, on that day they can be said to be putting the customer's interests first. Not before.

HTTPS certificates are bullshit

posted by ajf on 2010-10-08 at 09:43 pm

National Novel Writing Month is imminent. I don't write fiction; for me, NaNoWriMo is just an annual reminder that I neglect my blog. I file this rant under "shit that is stupid that I cannot possibly hope to do anything about".

In an interesting discussion of decentralised addressing (as an alternative to centralised DNS), Daniel Kahn Gillmor writes (ending with slightly less emphasis than I'm using here):

If they're looking for John Smith because the word on the street is that John Smith is a good knitter and they need a pair of socks, they can just examine what information we each publish about ourselves, and decide on a sock-by-sock basis which of us best suits their needs.

But if they're looking for "John Smith" because their cousin said "hey, i know this guy John Smith. I think you would like to argue politics over a beer with him", then what matters is the introduction.

This is how HTTPS should work:

I have an existing relationship with a bank. My trust in them is based on the relationship I have had with them for a decade or two.
I want to use Internet banking services, but there are two vital precautions I need to take. Anyone could be observing the traffic between my computer and my bank, and use what they observe to steal my money. Encryption prevents the "man in the middle" from reading the data travelling between me and my bank. But, more subtly, an attacker could manipulate the network to force my web browser to connect to a hostile server instead of the bank's server. It is obvious to everyone who has used Internet banking that I need to prove to the bank that I am the customer I say I am, but it is equally important that the bank's web server proves to me that it really does belong to the bank. We need mutual authentication.
I get, from the bank itself, both my credentials and some means for my computer to verify that the web site it is communicating with really is the bank's. Perhaps they post some sort of token to me, much as they handle credit and debit cards. Or if I don't trust the post, I could go into a branch and collect something in person.
I go to the web site, and my computer is able to confirm that I have an encrypted channel that really is reaching the party I trust.

But this is how HTTPS actually works:

I have the relationship with a bank, and I want to use their Internet services.
The bank issues credentials I can use to prove my identity to them.
I then tell my web browser to go to my bank's web site. To determine whether or not it really is the right site, the server sends a certificate asserting that one of several dozen organisations I have no relationship with and therefore no particular reason to trust has verified that the site belongs to my bank. (Who creates this list of organisations? The company I already trust to provide the web browser itself. So the scheme — a word that sits uncomfortably close in the dictionary to "scam" — is not completely without merit.)
They perform this "verification" by charging the organisation in question nine US dollars. (OK, some of them charge more than that, and others charge less.)
When it is pointed out to these organisations that there is absolutely no reason to believe the certificates they issue, they introduce a new product called "Extended Validation", where "Extended" means "this time, we actually fucking do what we spent the last ten years lying about doing".

SSH uses a different method:

The first time you connect to a server, SSH shows you the server's "fingerprint", giving you the opportunity to confirm that the server really is the one you were trying to reach.
If you confirm that the fingerprint is the right one (and here the SSH process falls down; mostly people don't know what the fingerprint for a new server should be, so they just assume it's the right one), your SSH client remembers that server's identity for you.
When you connect to that server in future, your SSH client is able to determine that the server is the same one that showed you the initial fingerprint.

Supporters of HTTPS claim that their method is better, because even the first connection is verified by an organisation they trust. But consider the real risk that people actually face:

You have an existing relationship with Bank X.
Whenever you to go the Bank X web site, your browser checks the certificates, which confirm that the web site belongs to an organisation called "Bank X".
Later, by accident, or due to malicious tampering with the network, or because you click a misleading link in a phishing email claiming to be from Bank X, you click on the link to your attacker's web site.
Your web browser checks the certificates, and confirms that the web site really does belong to an organisation called "BankXX". It does not know the one thing you really want and need to know: that "BankXX" is just an attacker who has nine US dollars, and has nothing to do with the "Bank X" you have visited in the past. It does know, and could but does not tell you, that it is a party you have never communicated with before.

What you want is to know that, after a trusted introduction, that you are still communicating with the same party that you were introduced to. What HTTPS gives you instead is an assurance that the party is who they claim to be, even if that claim has been crafted to deceive you into thinking it is another party.

On the eve of the federal election, one thing is quite clear: Australia is irredeemably fucked

posted by ajf on 2010-08-20 at 10:08 pm

One of the founders of the Australian Sex Party quotes advice he received from a prescient Don Chipp:

The first thing you've gotta give it a name that no-one forgets. And make sure to stay true to your core issues, which are censorship and personal freedom. In the years ahead, Labor and Liberal will desert that whole area because they're being increasingly infiltrated by church and morals groups and the Greens will probably go the same way as they get bigger and start to take on those kind of trappings. For the next twenty years Australia is going to need a really strong civil liberties party.

At the close of the most disappointing election campaign in my lifetime, I find the policies and priorities of the governing party and the opposition abhorrent and embarrassing. Instead of trying to inform the public and persuasively argue for what they stand for, today these parties are trying to guess what will appeal to the masses. I see no cause for hope that it will be different in the future.

I have given up.

The Great Australian Internet Blackout

posted by ajf on 2010-01-26 at 09:29 am

The Great Australian Internet Blackout is a protest against the federal government's ineffective, wasteful and dangerous proposal to censor the Internet.

Related topics: Mindless Link Propagation Web Politics

Rights inhere in people; they are not granted by governments

posted by ajf on 2009-11-17 at 10:43 pm

These are all activities that are illegal for individuals in the real world so why ask governments to give people the right to do them virtually?

I don't think that anyone who believes that rights are something we have to "ask governments to give people" understands democratic government, let alone is fit to serve in one. Sadly, these are the words of South Australian attorney-general Michael Atkinson.

I mean, I'm offended by the insulting terms in which he describes people who play games. I'm troubled that he believes that 62% of Australians in these gaming households "say the classification of a game has no influence on their buying decision" somehow proves that games which would receive an adult classification if one existed must be banned (when if anything it proves that Australians have so little confidence in the OFLC that it may as well be abolished). And I'm almost embarrassed for him that he thinks a Leisure Suit Larry game is something serious people should be concerned about.

But all of that is trivial compared to what truly scares me about Atkinson: a man responsible for upholding the law in an Australian state believes that freedom is defined by things he hasn't decided to prosecute anyone for yet.

Related topics: Mindless Link Propagation Politics Games Rants

Inverted thinking

posted by ajf on 2009-08-26 at 08:15 pm

What is it about Mirror's Edge that inspires people to defend it on such contrived grounds? A lot of reviews acknowledged the game's potential but called out its flaws — in particular, that the game is both repetitive and very short (a very unfortunate combination).

The first aggravating essay I encountered about the game is Persuasive Games: Windows and Mirror's Edge, which argues that these mundane concerns are not sufficient to respond to this game. In fact, such failings somehow become virtues because asking that a game does exactly what its player expects risks eliminating the possibility that it might offer a new way of understanding the world.

In other news, down is up.

And again, today Digital Déjà Vu somehow argues that being forced to replay the same sequence of game over and over again is not using checkpoints as a crutch to string out more play time from as little original level content as possible, but an opportunity to realise a time travel fantasy: whenever we lose, we get to go back and try again, never having to live with failure or regret.

Buerkle even compares the experience to Groundhog Day —

There's something immensely pleasurable about this experience - going back and reliving the same moment over again. And over again. And over and over, until I get it right. It's Groundhog Day.

— which suggests that he has forgotten about Phil Connors' innumerable suicide attempts. (Note to the author: in Groundhog Day, we're watching Phil; when we play a game, we are Phil. If I want to kill myself, the game is a failure.)

More importantly, he misses the point that the pleasure of replay only comes when you want to play again. I've greatly enjoyed replaying Deus Ex several times over the years; it's a classic, and every time I constant find something new or something brilliant that I'd forgotten. Repeated failure, on the other hand, is nowhere near "immensely pleasurable". It turns a game into a chore.

Yes, it's satisfying to beat a frustrating game despite its flaws. But that experience doesn't make turn those flaws into virtues.

Related topics: Mindless Link Propagation Games Rants

All timestamps are Melbourne time.