Leaked Windows Code

This is not fresh news (can’t really say new news…), but here are my thoughts on the subject:

  • *yawn*
  • There will continue to be much speculation about the ramifications of this leak (real? by Linux fans? publicity stunt? Will someone release a new OS based on this code??). However, the speculations will rapidly die out, as already evidenced by the drop-off of interest in this subject, less than a week after the release of a small portion of Win2000/WinNT code.
  • *yawn*

In other words, a lot of sound and fury, signifying nothing, really.

However, I did read one remarkably clueless comment on the matter that’s worth repeating – from Dave Winer, who should know better:

Everyone’s so worried about the Microsoft source leak. “It could open new security holes!” they say. But check this out, the source for Linux, a popular Microsoft competitor, has always been available, and this is promoted by its advocates saying it makes Linux more secure, not less. More programmer eyeballs looking for bugs. Maybe some white-hat types will try to check in some fixes for Windows 2000? Stranger things have happened.

Dave Winer

Yes, stranger things have happened, but consider the following:

  • Linux code is spozed to be out in the open; Windoze code is not
  • Linux code has a process for anyone to submit bugs; Windoze does not (in the traditional, OS build sense). Exactly where will these White Hats check in their code?
  • Submit a Windoze bug fix? Go to court – you’ve just admitted to working with trade secrets/copyrighted code or what have you

While I understand what Winer was trying to say, it really didn’t make a whole lot of sense. To me.

Standards – But for Content

A short note about how the Internet has, to a degree, supplanted dead trees appeared on Dave Winer’s site on Wednesday (02/11/2004). Picked up and expanded on by Jessica Baumgart, it’s not an extensive exploration, but it does raise some interesting points, and dovetails nicely with my previous entry on the death of Webmonkey.

Read the referenced articles for more details, but a summary:

  • Winer believes that CD encyclopedias (and, by extension, dead-tree references) are pretty much being taking over by online tools/references.
  • Baumgart – who appears to be trained as a librarian – disagrees somewhat, pointing out the following issues with digital publications:
    • Link rot – What was there yesterday to refer to may be gone today. Unless you lose/damage the book/CD, it’s probably accessible to confirm/reference.
    • Links may change; books/CDs can’t – This is a strength and weakness of the Web (and all digital media, to a degree). While it’s nice to be able to go back in and fix that typo on a Web site – impossible in a published book – how does a user know what else has changed, even it there is a updated notice (which, in itself, is rare).
    • What’s the source? – While the digital tools out there allow virtually anyone to publish, that doesn’t mean that everyone should or that – especially – everyone who publishes is an expert. Old media usually goes through some sort of vetting process; this is rarely the case (percentage-wise) for online publishing.

Other questions that were not addressed include the following:

  • If the owner of valuable online resource (let’s use Webmonkey as the example) goes belly up, what happens to that resource? Similar to the link rot issue, it differs because it’s not just a case of an expired/changed link, it’s a case of expired/changed site. It’s as if a library of single-copy editions burned up. With old media, if some publishing company goes out of business, users still have those hard copies on their bookshelves.
  • Old media has established channels for distribution; on the Web it’s mainly word of mouth. Each has merits – and this is not the time or place to compare them – but there are a lot of good/bad sites/books seen/missed because of distribution methods. I’m not weighing in on the merits of either; I’m just saying they differ and that’s a point to ponder.
  • The preceding point – as brought up (obliquely) by Baumgart – leads to the issue of trust. You found a site with the information you were looking for. Can you trust this information? If it’s old media, today you have a better idea of how to answer that question. New media? Fuggetaboutit.

While I do believe that new media is getting more and more powerful and useful – and trustworthy (i.e. there are resources that can be associated with a known, fairly consistent point of view) – I don’t think this means old media is dead.

Winer writes the following in his note:

Who needs an encyclopedia on a CD-ROM when you have the Web at your fingertips? Someday some kid is going to ask you What is Encarta? That might be where you end up going today

Dave Winer

This is a dangerous statement, but at least he appends a “might be” to it all.

Did radio kill books? No.

Did radio change the perceived value of books (plus or minus)? Yes.

Did TV kill radio? No.

Did TV change the perceived value of radio (plus or minus)? Yes.

Did TV kill movies? No.

Did TV change the perceived value of movies (plus or minus)? Yes.

Did VCRs/DVDs kill movies/TV? No.

Did VCRs/DVDs change the perceived value of movies (plus or minus)? Yes.

One can make the same arguments for a plethora of media, but a medium rarely dies – its audience/marketshare changes. For example, TV and radio are different. I listen to music and NPR on the radio; on TV I watch things. Different. Books != audiobooks, even with the same content. Different experience.

One notable exception to this is the VCR: The DVD is virtually the same as a VHS tape, only so much better. So that is one media that I would gladly give up (and, for the most part, have).

So, in a strange way, there are two standards operating for every medium:

  • Trust: This encompasses trust such as that given to the Oxford English Dictionary vs. mywords.com, as well as longevity (info will be available from stable source) and voice (the ACLU site and RNC sites may differ in points of view, but the first will be left-wing; the latter right-wing so when I read I understand the implied bias).
  • Delivery: Web: Search engines/use sites that find a lot of, frankly, questionable links but allow keyword searches around the world; highly targeted products (books/CDs/newspapers) that lack some of the flexibility but are highly vetted and usually well-written.

This is a tough subject to nail; more later.

Monkey Pox

While there is not yet any definitive confirmation, this news.com story strongly hints at what we’ve all known for some time: Webmonkey is poised to make the transition from a highly endangered species to an extinct one.

Update 02/15/2004: This rumor, while not official (by the company), is re-inforced by Webmonkey senior editor Michael Calore

Update 02/17/2004: Wired is running an obit for Webmonkey today. So it’s officially official.

I’ve written several times in the past about the declining value of Webmonkey, and I stand by those stories. However, it’s never pleasant to witness the passing of something that – at least for a time – had a great impact on life.

Think of it this way: Bob Hope stepped out of the spotlight years ago, but his death last June was (Hope fan or not) certainly not a joyous occasion, and it made one pause and think about Hope and his impact on the world.

The same it true of Webmonkey. While – like Hope’s movies/TV shows – Webmonkey will probably never fade away completely, it will never be the same.

Webmonkey will probably remain up in a static, still-here-to-reference form (much like another lamented loss, Suck.com), but the stream of new material just won’t be coming any more. In the past, that would have been a huge loss, but – over the last few years – the stream has turned into a trickle.

Regardless, it’s a loss, and – perhaps more importantly – a reason to look back and acknowledge what was. Let’s call the following my own Monkey Bites:

  • First and foremost, the code samples. Written in a “cookbook” format, for the most part (“Here’s how to make X using Y and Z”), the code samples were lucid, clear and more frequently than not would cause one to begin coding even before finishing said article.
  • The hip, droll text. From the author bios (“Paul Boutin is a technologist and writer who discovered the Internet in 1980 as an MIT freshman and hasn’t slept since.”) through the story contents (“Since PHP is my bag (it’s cheap and easy, just like me!),….”), the breezy verbiage set the tone for the article a whole: No frills; highly accessible.
  • A focus on tech, not politics. In an online world of highly-opinionated slashdotters, Mac zealots, Linux evangelists, MS bashers and so on, Webmonkey didn’t really care about these pseudo-divisions. Articles were written with the understanding that just about every task could be done many ways; the given article was one of those. Period. No muss; no fuss. Don’t think using mySQL on Windows for a guestbook application is a good idea? You might want to sample [this] or [that] article. If you think it’s worth a shot, read the rest of the article and draw your own conclusions.
  • Written by geeks for geeks. This is important. Unlike many tutorials and books, it didn’t try to do everything – it assumed the reader had basic skills (which, of course, varied by given article). For example, if the article was about using PHP to build a database-driven whatever, it didn’t try to teach SQL (or the specific SQL syntax for a given database). Articles would give links to other articles when there was a potential for more information needed, but it didn’t attempt to embed all this. This was/is crucial to keeping the articles focused, clear and concise (example: For the preceding example, why write a sample query in detail, when “Select * from myTable” will do? )

And – whatever else you might say about Webmonkey – give it this: It had a good run.

What the Internet Is/Isn’t

An old article got an new audience over the last couple of days thanks to a Slashdot post and a couple of other well-placed links. I first read it sometime last year; it’s currently marked as last modified almost a year ago. I had forgotten about it, too, so a re-read (and now blogging about) was helpful.

The article title and deck sums it all up:

World of Ends

What the Internet Is and How to Stop Mistaking It for Something Else

– by Doc Searls and David Weinberger

Now, you can argue with this or that point in the article, but it pretty much lays out – in broad strokes – just what it this wacky Internet thingee is all about.

If I had to sum up the contents of what the article says, it would be the following four points:

  • The Internet is not a thing, it’s an agreement
  • The Internet is not TV (any more than TV is radio, for example)
  • The Internet is intentionally stupid. This makes it fault-tolerant and does not impose or imply any specific rules beyond IP
  • All value is added at the edges: I.e. the IP protocol is there; the rest is building on this tool/agreement

Sounds simple, but – in the mad, pre-2000 rush to, uh, monetize the Web (a flavor of the Internet) – a lot of companies tried to force non-Net business models onto the Web in hopes of leveraging successes they have had in other media (such as advertising or music sales).

And a lot of these efforts are continuing (MPAA, RIAA..), and – to be generous – they haven’t fared so well. The companies that took advantage of the Internet for what it is (think Amazon, Symantec, Google, for example) have done well.

The article would be a good benchmark for any company of any size to use to compare against its Internet business plans.

Will it save a bad plan, guarantee success for a good plan?

Of course not.

But it’s another tool to use to see if you/your company in a way that makes sense for the medium. It can help raise some red flags that can then be addressed before it’s too late.

The Clubies

This is my own award program, designed to identify the newbies to clues in their own specific field.

It’s not an annual award.

It’s not a good thing.

It’s just some venting over numerous issues I’ve been suppressing over the last [insert given time span]. It’s designed to those who refuse to surrender to – often even acknowledge – reality. Sometimes that’s brave: fighting the good fight et al; sometimes its misdirected effort. Yes, history will tell. That’s for historians.

And the Clubie (?) Goes To:

  • The RIAA: Get over it folks, the business model has changed. While I agree that Napster, Kazaa and other P2P (or whatever) Net delivery systems can be what I consider stealing, I don’t appreciated the DRM systems that treat everyone as pirates. Example: I bought a CD. I can play it on my CD player (my stereo’s); I cannot play it on my computer (hooked up to the Internet or not; it may be my only “stereo system”). That’s just one example; there are many. As a writer/photographer, I understand – and am unsettled – by the whole digital way of doing things. But, while it erodes some old rights, it creates new opportunities. Right now, the RIAA is the maker of buggy whips who refuses to see the auto – or wants to tax it out of exisitence. The buggy whip industry died; some buggy whip makers adapted. Bad for the industry; agreed. So was the ocean-going ships to American Indians (for example). It happened. Hurt many. Helped many. Cannot legislate it out of existence/pretend it is not inevitable. That’s the cluebie part.
  • MPAA: All that separates the MPAA from the RIAA (I hope I have the acronyms correct) is bandwidth, which will be here shortly. Soon, a movie will download as fast as an MP3. Again, get over it: This is reality. And people will pirate; others will just want to transfer from home machine to their laptop for personal use. Adapt or die. This is a business model change, not just some black hats tossing pranks.
  • Cell phone companies (connectivity): When are they going to learn form the well-established Internet example? People want: Connectivity with all (not just the own network for pics and cheap calls, for example); flat rate. No calculations; no waiting until 7 or 9 to call; no worries about sending your Mom a baby pic because she may have changed providers…..
  • Cell phone companies (phones): When ya get the whole “I can actually use the phone well for speaking” concept down, well, then give me more features. Not before (yes, I win a Cluebie for not understanding/not agreeing with the market…)
  • ISPs: Comcast just updated its download speed – for no fee – but the upload speed is capped at a very low rate. Why? There is dark fiber all over the place; make full, non-metered user a selling point. Also, Comcast has – in some reported cases – told users to cut back usage…without telling same users what the cap was. Huh?
  • IM: As in Instant Messenging tools. This is another example of throw-back pre-Web silliness, when a lack of inoperability at least made sense: Since you were dialing into, for example, Prodigy’s server, you could only e-mail other Prodigy users – not, for example, CompuServe users. As the two companies’ servers didn’t talk to each other. As SMTP grew and the Web connected all, this went away. Except for IM tools. Sure, I can IM anyone anywhere – using a tool tacked on top the Internet Protocol – in the world, but only if they also have the same IM (AOL, MSN, Yahoo….) tool. That’s so stupid; it’s like saying I can call anyone in the world…as long as they have the same brand phone or phone provider that I do. IM is a tool that is designed to facilitate communication (the M = “messenger”, right?), yet it is explicitly designed to restrict any communications to one maker’s tools. That is so assinine and Internet-phobic that it’s hard to really comment clearly on it.

Oh, plenty more to come, but some things seems so silly to me so often…

The HTTP Dance

As I’ve noted in previous entries, running an Internet-facing Web server (shared, dedicated, sitting in your basement, whatever…) is a great thing.

Basically, you own a JIT publishing system. Toss some blogging tools on top of this, and you can immediately put out in front of a good percentage of the world your thoughts/creations/data and get an overwhelming amount of feedback about same (via e-mail, comments, server logs and and so on).

But the JIT publishing world, as with any world, is a world of give and take.

Recently, during my data diving exercises, I found someone who was requesting – every five minutes – my blog’s Picture of the Day. Since this rotates daily, the extra 287 daily hits were just eating up my bandwidth (it was pulling the full-sized picture, not a thumbnail). It is obviously a script, as it runs exactly every five minutes, with only a an occasional difference of a second (network traffic).

And – obviously – since this picture is the only request made – the person is pulling my photos and doing something with them. There was no request for robots.txt, so it’s just a simple script on a CRON.

I couldn’t get a server name or trace to the site (was a DSL connection; could be a home or business), so I couldn’t get an address to e-mail the person (this has happened before).

So, I have to block the user.

So, I hacked out a mod_rewrite files to stick into a .htaccess file. Tested it locally, it worked fine. Allows only my site (“myServer”) to request any images; give others a default image:


RewriteEngine on

RewriteCond %{HTTP_REFERER} !^$

RewriteCond %{HTTP_REFERER} !^http://myServer/.*$ [NC]

RewriteCond %{HTTP_REFERER} !^http://myServer/.*$ [NC]

RewriteRule .*\.(gif|GIF|jpg|JPG|png|PNG)$

http://www.littleghost.com/images/incorrect.gif [R]

This – of course – bombs my actual site when I move it over there (500 error). This site runs Unix with what appears to be a highly customized variant of Apache.

I write/call/talk to Customer Care (what a contradiction in terms), and am told – after several escalations – that my code is fine, it “should work”. So why doesn’t it? They can’t and won’t say.

OK.

So they have one of these control panels for the site. So I decide to block this one user’s IP address just on the affected directory (do as little harm as possible).

The for ends up generating a .htaccess file, which looks like the following (Note: I’m masking the actual user’s IP address with “X” to protect the guilty…):


AuthType Basic

allow from all

order allow,deny

deny from XXX.XXX.XXX.30

This looks a hell of a lot different from what Customer Service said should work, but … whatever.

And I watch my logs. It works – the call is made and 403s out.

About an hour later, I check again…the script/user has changed the IP address, so I’m forced to change the “deny” to include the entire C block: “deny from XXX.XXX.XXX” (note the entire C block is unspecified, meaning “all”). I don’t like to do that – that means 1,000 IP addresses are now blocked from this directory, but…whatever.

This did work and has help up for the last couple of days. But I still wish a couple of things:

  • I had more control over my shared hosting (so I could just plop that tested mod_rewrite and be done with it). At the same time, if I had more control, there would be more upkeep.
  • I wish there was a less draconian way to fix this problem. Ideally (in this case), I could block just this single image for this user/C block, but I have to block at directory level.

Sure, I could always just ignore all this – and I’m sure I’m getting pics stolen all the time (as I’ve mentioned, this is not the first time), but it’s a way to protect myself and learn a bit about this process in case it really becomes important to protect myself/my site.

So that’s good.

But it is a tango….

Why the Grammys Don’t Matter

I’ve been saying for years that the Grammys – the award program for (basically) American popular music – don’t mean squat.

Every year they roll around again, and – again – I’ll have to say that they don’t mean squat.

Maybe I’m just getting old and crusty, but it seems as though each year reduces the relevance of these awards. While the same can be said – to a degree – about the Oscars, it’s the Golden Globes and other Oscar pretenders that are closer to the Grammys than the Oscars. The Oscars seem to try to reward on merit, not politics. (Yes, they fail miserably sometimes, but we all do…)

While all awards have political agendas and are, to a degree, popularity contests as much as a reward for skills/hard work and so on, the Grammys are probably the worst.

Take this year’s Grammys (presented on Feb. 8, 2004) – look at the awards granted.

Now, I’m not as wired into popular music as I was in the past, and my past wiring has always been incomplete, at best: My tastes are more eclectic, for better or for worse. I just like what I like, not what’s in high rotation at the Top40 stations.

Whatever.

But look at the awards:

BEST ROCK PERFORMANCE BY DUO OR GROUP

“Disorder In The House,” Warren Zevon and Bruce Springsteen

I love Warren Zevon; I have liked Springsteen since the late 70s – Springsteen’s concert I saw at Cornell as part of his Darkness on the Edge of Town tour is still my all-time favorite concert.

But this collaborative work is, at best, fun and interesting.

It’s not award-winning, unless it was a pretty bad year for Rock Duos.

Or unless one of the award winners is dying now/died this past year…. Yep, Warren is gone with The Wind.

And look at other posthumous winners in other categories: Zevon again for Contemporary Folk album, Johnny and June Carter Cash for some other efforts.

I’m all for giving folks their due, and sometimes when one dies the music begins to emerge- and the masses begin to discover it for themselves (think John Lennon after he was shot; the rather sudden ascendancy of Peter Sellers as a comic genius after his death, and so on).

But come on. What about Emmy Lou Harris (sp?) – she had a great album this year, as did Lucinda Williams that probably should have beat out Cash. And – as I’ve written – the Zevon album was brave and poignant, but not even his best work (and he’s never really been Grammy material. While outlandish in his own way, he was not much for the recognition).

I dunno. Maybe it’s just me, but for a body that gave some sort of major award to Milli Vanilli, well, need I say anything more??

Data Diving Continued – mySQL Issues

Another trend I see in referers is people goggling for info about OSS databases, of which I often write/rant about.

One of the search engine queries I see most often is looking for the concat function in Postgres.

Which is another reason mySQL is not a good database.

Following are the methods of concatinating strings (strings “foo” and “bar”) in three common databases:

MYSQL:

select concat(‘foo’,’bar’) from table

MS SQL SERVER

select ‘foo’ + ‘bar’ from table

POSTGRES

select ‘foo’ || ‘bar’ from table

(Result for all three will be ‘foobar’)

I’m not certain, but I think Oracle concatenates the same way as Postgres.

Notice that mySQL has a function (the concat() function) rather than an operator (|| or +). While you can argue the reletive merits of each – both for speed and for perceived friendliness – you have to admit that the mySQL implementation is different enough from other databases and languages to make it damn near impossible to figure out without a manual.

I remember when I first was working with mySQL and needed to concatinate. No other database language – or programming languages – uses a function for this. So I attempted to add these two strings together with all sorts of operators: +, ||, &, &&, . (like Perl and PHP) and so on.

Then I RTFM, and ran across this wacky function.

Oh well, it works, but still…just not professional feeling, as it’s so different from all other scripting languages I use. Just odd and unsettling.

And if people are hitting Google trying to figure out the Postgres concat function, it means that they’ve learned SQL with mySQL, which is as far from ANSI-compliant as any common database.

And so – in the folks’ minds, this type of function is a standard SQL type function.

But it’s not…

Again, not a deal-breaker, but is odd enough to mess people up in the beginning (either learning mySQL after using more advanced databases, or moving to an advanced database from mySQL) and continue to annoy long after that.

Data Diving

Coming from a background that includes print publications (magazines), the ability to gather data about a Web site’s use is so refreshing.

Back in the print days, an effort was often made to find out just what the readers really wanted, as well as give a balance of what the readers wanted vs. what they needed.

However, this was usually an anecdotal method – talking with readers at trade shows or on the phone (for whatever reason) and trying to get some sense of what’s working and what isn’t. Gives one an idea, but not exactly science.

Even the more empirical efforts – readers’ surveys – suffered from not one but two Achilles’ Heels:

  • Small sample size, and
  • People lie on any survey – intentionally or not. Get over it.

So, at best, we were shooting in the semi-dark over what readers wanted/needed. Which is frustrating.

With the Web, however, the reality is often the inverse: Via user comments, e-mails and – especially – server logs, there is a mass of data that clearly states what the user actually is seeking out. The trick, of course, is to cut through this mass of data to identify the nuggets.

This comes to mind because of the Top 10 lists I’ve added to the site. The referers are particularity fascinating:

  • First off, the Top 10 area gets more referrer traffic on my site than any area besides the blog (after the blog proper, the Gallery section gets the most overall traffic).
  • Big surprise: The top referrer – by a wide margin – is Google. Duh.
  • The most frequently searched-for item that users hit my Top 10 list for is the author Robert Coover, whose Pricksongs and Descants is listed in the Short Story list. It’s most frequently a search for Coover and/or his story The Babysitter. I don’t know if it’s because not many people know Coover – so there are only a handful of places to find him compared to, say, John Updike, or if there is a greater interest in Coover than I’m aware of. Interesting.

Data diving. It’s not just for breakfast anymore.

The Shortest and Longest Month of the Year

February – even without this year’s Leap Day – is always the longest month of the year, at least in these latitudes.

Past the looking for a White Chirstmas and sloughing through an inevitability of a cold, snowy January, February leaves us looking toward Spring.

Which just ain’t coming.

That said, here are some things to do to help pass the time:

  • Watch Groundhog Day – You don’t think that Bill Murray can act? Watch this and enjoy. And you think your job is boring and repetitious?
  • Wonder just what the heck SCO is talking about – In light of the appearance of/threat of the myDoom virus, SCO (note the new URL) has been giving conflicting stories (here, here and here) So what really is the story over there??
  • Get over it – Spring is well from sprung. Do all those indoor chores you shun when it’s too hot or too nice outside to stay indoors.