Scripting News

It's a security issue, folks

Tue, 01 Jan 2008 21:06:15 GMT

In 1980, I signed a deal with a company to market a product I was developing. The contract required me to turn over the source code, which I did. One day I went to a meeting at the office of the company, and there on the product manager's desk, next to a door that opened to the outside, was a floppy labeled "Dave Winer's source code" in big letters.

If you own a Mac you may soon find out what that felt like.

It's amazing to me that the tech blogosphere doesn't treat Apple's policy re broken hard disks as the huge gaping security hole that it is.

Think about it. We worry about bad people getting their hands on little pieces of data that, when added together, give them the power to be us in banking and credit transactions.

Think about what you would do if your laptop was stolen.

Well, if you own a Mac and its hard disk goes bad, and you make the mistake of bringing it to Apple for service, you will turn over all that data to Apple. Not "may" or "might" but "will." What Apple in turn does with that data is none of your affair. They don't sign anything or offer any guarantees that they won't sell the disk to a data miner. Think it can't happen or that it's unlikely? I don't gain much comfort from your feeling of security.

I've been writing about this issue since December 22. Usually when I write something critical of Apple, the results are mixed. Some people are supportive, but far more people attack. This time the ratio is very different. Almost everyone who has commented gets that there's a huge problem here.

Some say that other vendors do this too. That gives me less comfort, not more. That means there's no escaping this crazy way of treating user's confidentiality. Ultimately it hurts the vendors because people can't use their computers for things the manufacturers say we can.

Further, it's got to be an issue for the banks, brokerage firms, credit agencies. If you are a newspaper and you employ reporters and they use a computer, how exactly are you guarding the confidentiality of your sources? If you're a confidential source, don't you have an interest when the reporter gives their computer manufacturer all their data to do with as they please?

Imagine what you would do if it turned out there was a bug in a Netgear or Linksys router that allowed, under special circumstances, a mailicous person to gain access to the full content of your hard disk at any time. Would you have a problem with that?

This is worse than Microsoft's neglect of malware that got me to stop using their computers. In that case it was Microsoft being neglegent. This time Apple itself is the source of the problem. It's as if they planted a virus in their operating system that entitled them, under special circumstances, completely out of your control, to gain access to everything on your disk, with as much time as they want, with no way for you to prevent or even detect the intrusion.

See also: My letter to Steve Jobs.

Re yesterday's post, Apple does not have a store in Shanghai. I assume the customer is sincere, he thought he was at an Apple-owned store. Here's a picture of the place he probably went to. BTW, I'm 100-percent sure that the store in Emeryville is owned by Apple. You can find it on Apple's store website.

Cole: "Apple sent me my new hard drive and instructions stating that I had to send the old one back within 10 days to avoid being charged $250."

Chuck Shotton says that Apple used to return failed drives with sensitive data for an additional cost.

Going to the top

Mon, 31 Dec 2007 22:34:22 GMT

A screen shot of an email I sent to Steve Jobs at Apple.

Marc van der Chijs: "Dave, what happened to me at the Apple Store in Shanghai is even worse. They tried to recover my data, but did not have another HD to put it on, so they copied it onto one of their store computers. Two weeks later I came back to the store and to my big surprise I found all my data still on that computer. Every customer had access to it! No apologies from Apple of course."

Full text of the email I sent.

Holy Hannah it's a Morning Coffee Notes podcast!

Mon, 31 Dec 2007 17:31:26 GMT

The last podcast of the year, for sure, it's a tutorial on the meaning of the at-sign in Twitter for Dave Sifry. Maybe I got it wrong? If so, post a comment here.

Fix on Feeds page

Mon, 31 Dec 2007 13:07:59 GMT

I fixed a maor bug on the Feeds page in FlickrFan.

You don't have to do anything to get the update, other than leave the app running.

The new version is 0.34.

Sorry for this bug. Glad to have it fixed.

Office and conference FlickrFans

Sun, 30 Dec 2007 16:57:13 GMT

I don't have an office, and I'm not running a conference, so I hope to hook up with someone, hopefully in the Bay Area, with either of these, to try some experimentation with FlickrFan.

First a little background...

My first glimpse of how wonderful news photography and screen savers are together was when I visited Andy Rhinehart at the Spartanburg Herald-Journal on 2/15/05. He had to go to a meeting, and left me in his office to check email, update my blog using my laptop. HIs PC of course went into screen saver mode, and started showing pictures of various political leaders in meetings around the world and sporting events, people digging out of snow storms. It didn't take long before my eyes were fixed on his screen.

Later I found out that everyone at AP does this too.

If you have a folder of new pictures on your LAN it makes a fantastic source of distraction. But it's different from video because it's silent. You can have a conversation about what's on the screen without interfering with it, or try to have a conversation about something else entirely.

This is something we noticed about podcasting too, that sometimes less is more.

Because there is no video you can: 1. Use your eyes for something else, like driving, walking, doing housework. 2. Use your imagination in ways you can't with video, imagine what the speakers look like, where they are, who else is there. Once your imagination is activated in one direction it goes off in others.

So photocasting or picturecatching, whatever it ends up being called, has a similar "less is more" dimension.

So then I tried an experiment, I put an early version of FlickrFan on a 46-inch screen in my den, and when people would come over to visit I'd leave it running and we'd talk about whatever we were going to talk about, and I wasn't surprised to see the attention drift over to the TV. It's captivating.

So I'd like to try it in two new venues to see what happens.

1. In a reception area in an office. Imagine one of the buildings at Microsoft. Or a doctors office, or the lobby of a VC firm. Install a big flatscreen TV on the wall, with a Mac Mini behind it, with a net connection, and let it run. See if people don't gravitate to it. See if people don't want to have meetings in the lobby. (I think some might.)

2. At a conference, like Demo or Davos, scatter four screens around the main lobby (not the meeting room), with one Mac driving them all or each with its own Mac Mini. Again see how it affects the dynamic. You might want to show pictures taken at the conference for a unique recursive effect. Or just use the AP news photo feed. Either would be sufficient to learn how it works. I bet we would learn a lot.

Let me know if you decide to give it a try, and by all means please blog about your experiences, share what you learn with the rest of us.

Playing with Photobucket

Sun, 30 Dec 2007 16:26:47 GMT

Apparently Photobucket supports RSS (good).

They use media-rss (also good).

But they seem to only provide thumbnails of the photos, which is not good (if true).

Here's the RSS feed for my newly created Photobucket account.

Update: James Holderness says a link to the full-size image is there.

Insightful review in Wired News

Sat, 29 Dec 2007 19:38:17 GMT

Michael Calore at Wired News writes about something I do too, and love.

Wired News: "The first time I ran it, I let FlickrFan pull just AP photos, then I sat back and watched. I run two monitors here at my desk at Wired, so I can see two photos from the news agency side by side. This makes for some fantastic juxtapositions -- like a picture of Bhutto smiling on one screen and her coffin being hoisted by mourners on the other, or of Iraqi children playing soccer on one side and a center ice scrum from an NHL hockey game on the other."

It's a fun game to play in the living room with just one monitor, but with two (Macs work very cleanly with multiple montors) you get some special kind of magic.

People who focus on the software miss the point. It's about the photography. The software just facilitates.

Update: A Flickr set that illustrates.

A feature a day...

Sat, 29 Dec 2007 17:33:27 GMT

I'm going to try to add one feature to FlickrFan every day.

Today's feature: How to find a user's feed, if they have one.

Bottom-line: On the public list, there's now an XML icon next to every user who has a feed, who hasn't opted-out.

Thanks Lifehacker!

Sat, 29 Dec 2007 17:55:54 GMT

A simple no-nonsense writeup of FlickrFan. Thank you.

However, the product does much more than what they say.

We'll continue explaining and enhancing the product here.

Pride of Cucamonga, Day 2

Sat, 29 Dec 2007 18:56:30 GMT

Still listening to this classic Dead song.

And writing about it on Twitter...

It's an MP3 that I ripped from the Mars Hotel album. Which I bought on CD many years ago.

I've listened to this track about 1000 times. When I play it it puts a smile on my face. Because Cucamonga is a place with no pride, imho.

It's a joke, kind of like Truckin makes fun of New Orleans, a town that done the Dead wrong, once, a long time ago.

Now if it were on vinyl I would have wore it out a long time ago. I'm sure there was a copy of the song on the disk Apple stole from me.

There you have it RIAA. You can go after Apple. I'll support you because they stole from both of us. They have no right to listen to PofC.

I imagine Steve Jobs and Phil Schiller sitting around smokin a doobie listening to Phil Lesh sing, thinking "Dave has good taste in music."

BTW, Cucamonga is a suburb in southern CA. Near Ontario. Probably very non-descript. Might have been interesting 70 years ago.

And that's your bedtime story for Saturday, boys and girls. Have a nice day, don't hit your brother (or sister) and be nice to the sitter!

Update: Frank Zappa lived in Cucamonga.

Flickr search for Cucamonga. Lots of hits!

Recommendation for Flickr

Sat, 29 Dec 2007 04:38:47 GMT

I've been emailing today with photographers who use Flickr to manage their sets and collections. They like it that people can view their pictures publicly, but they want to control how they're used. RSS, used as a way to distribute pictures, is a new idea for many of them.

Based on these conversations I think it's important that they have a way to:

1. Turn off the RSS feed for their pictures.

2. To have their pictures not included in RSS feeds based on tags and searches.

3. To include their pictures in RSS feeds, but only links to them, and the titles and descriptions, but not as enclosures.

Of course this recommendation isn't just for Flickr, it's a good idea for any photo-sharing site.

FlickrFan, day 2

Fri, 28 Dec 2007 08:00:00 GMT

Good morning, lots of discussion on many weblogs about the new product, FlickrFan, announced here last night.

I'm going to write about it here, a lot, over the coming weeks and months, but first I wanted to link to some of the comments about it.

Michael Markman: How to Use FlickrFan with AppleTV.

Don Park: Dave's New Thingy.

Rex Hammock: Dave's cool new thing.

I guess it's a "thing" eh?

Phil Jones: Platform Wars.

Michael Gartenberg: FlickrFan first thoughts.

Scoble (yesterday): The MacMini HDTV revolution.

Fred Wilson and Bijan Sabet have been using the software for the last month or so in a variety of forms.

Loren Feldman marks the moment in history.

Om Malik came for a visit last month, we took a walk in the hills, and of course I talked about FlickrFan and did a demo.

There were other articles and reviews, you can find them on TechMeme or Technorati. One thing I've learned is that takes a bit of time to find the right mix of personal pics from Flickr and news pics from AP. It's an unusual app because whole families can use it, and they have different preferences and expectations. The tech blogosphere tends to rush to decide about things. I find they sometimes miss the mark, widely and I was sure this would be one of those times, which is why I didn't roll it out the usual way.

I wanted to get a base of users going, and learn and evolve the software, so far it looks pretty good, so the next step is to evaluate, listen, fix the most serious bugs I can find, think, and then move forward.

Watch this space (below) for new features and fixes...

Change Note #17: List of newly-installed FlickrFans.

End of year links

Fri, 28 Dec 2007 23:41:11 GMT

NY Times list of buzzwords of 2007.

Washington Post: "The RIAA's legal crusade against its customers is a classic example of an old media company clinging to a business model that has collapsed."

Twitter down?

Fri, 28 Dec 2007 19:38:28 GMT

It appears Twitter is down.

Couldn't come on a worse day. All the support concerns and links to blog posts are now flowing through email. Oy. We've gotten hooked on this technology and when it's gone, it hurts.

It's back up now.

Pride of Cucamonga

Fri, 28 Dec 2007 18:46:39 GMT

Oh, oh, pride of Cucamonga

Oh, oh, bitter olives in the sun

Oh, oh, I had me some loving

And I done some time

Beautiful song, can't get it out of my head!

New product release today

Thu, 27 Dec 2007 16:41:14 GMT

Ladies and gentlemen, boys and girls...

It's with much anticipation that I say this.

I have a new product that may be familiar to those of you who used Radio 8, and in other ways may be completely new.

The idea is simple.

There's a convergence between big screen high-definition televisions, and photography as an Internet based activity.

The purpose of this product is to smooth that convergence, to make it easy to set up a connection between the Internet and your television. To allow photography to come into your living room in new, powerful and easy ways.

Think of it as the networked living room and you'll understand the vision.

Some of the work I've done is technical, some is user interface, and some is working with media organizations to try to create a comfort level, or at least a spirit of Let's Give This A Try.

In the latter case, it's much like working with the NY Times to get their news headlines and summaries to flow through Radio's RSS aggregator in 2002. Only this time we're working with photographs, and we think, the best news photographers in the world. And the pictures are beautifully high-def, they look really great when displayed on LCD and plasma screens. I use it with my 52-inch Samsung and 46-inch Sony. Of course what looks great on a wall, also looks great on a 15-inch Macbook or 24-inch iMac.

And while we connect those pros with your TV, it's equally important that we connect your friends and families too. One of the early testers found the pictures that Doc Searls uploads to Flickr a great revelation. Me too. That's because Doc is not only a great photographer, he's also a great story-teller. I find that I can follow the lives of far more friends visually than I can through text messages (which I love to do too!).

Viewing great photos on bigscreen TVs, desktops and laptops -- that's one focus, but not the only one.

I wanted to provide a complete two-way tool for people who love Flickr, as I do.

Why Flickr? Well, they've got this great thing called an API. It makes it possible for people like me to make software that runs on a desktop computer that does things like automatically backing up your new photos every night, and providing a drop-folder on your desktop for quick uploads. (It understands tags too, it's incredibly simple.)

We also made it easy to post pictures you like to Twitter. Why Twitter? It's that API thing again. They made it easy for us to love them. I wish more network service developers understood how powerful this outstretched hand is.

But that's not all!

Not by a long shot.

The reason all this will be so familiar to Radio 8 users is that it builds on the same engine, the one that was released as open source in 2004. So I've been working on other tools to drop into this base platform and once we have a good-sized base of people using it for "really simple photos" on the desktop, there will be other tools. And because it's an open platform, other developers can do the same. Not saying they will, but they can.

Anyway, I'm in the last stages, preparing the download site, and a FAQ, and tweaking the installer.

One caveat, the first beta release is Mac only. That's because I'm doing all my work on the Mac, and this is a one-man show. Later we will work it out for Windows too, and with a bit more work and a bit more luck, for Linux.

It should be ready before the sun goes down today.

Phil Windley: "The XBR4 already has a DVI input, so hooking up ought to be a breeze and getting good pictures on the thing would be wonderful."

I want to know the intent of the product

Thu, 27 Dec 2007 00:09:56 GMT

I've been saying this ever since I started blogging.

When you have a product to announce, start a blog (if you don't already have one) and announce it.

Before there were blogs, I wished Infoworld or PC Week would give space to the lead developer of the product, whether he or she is a marketer or technical, even the CEO if they wouldn't assign a former reporter or ad guy to write it, and tell us what you meant when you designed this product. Who were you thinking of and what would they do with it. And where does it go? What does 2.0 look like if it's 1.0 or 3.0 if it's 2.0.

I like it when people like Zuckerberg, Andreessen or Canter write a blog post that tells you without pulling any punches what the intent of the product is, in their own words. I'd like to hear what they said to the team that worked on it. I'd like to use my imagination. That's why I don't like Steve Jobs' keynotes, he's telling you what Eddie Haskell would say about the product to Mrs. Cleaver.

You never get the intent when it's filtered by the press. And many of the people that call themselves bloggers, love them and bless them, aren't anything like bloggers, and they're everything like the bored hired writers that used to work at CNET and Fortune. In fact, many of them are exactly like them (because they are them).

We live in the age of DIY, that means if you have something to say, just say it.

PS: Here's a picture of three child actors from Leave It To Beaver, taken when they're in their fifties. From left to right, Eddie Haskell, Beaver and Wally. Time Waits for No One.

Blogger of the Year

Mon, 24 Dec 2007 18:36:56 GMT

There was a time, a long time ago when I thought we'd have awards here on Scripting News. I'd nominate several blogs in different categories and the readers would vote and we'd have winners, and could celebrate, and prepare for next year, with some idea of what we value in blogging.

But the first year I did it, 2001, there was a huge outcry of anger at my hubris in thinking I could play a role in defining some form of blogging excellence. The anger was so loud that we only did it that once.

We're getting close to the end of another year, they go so fast these days, one of the last things my departed Uncle Ken said to me was that it gets ridiculous near the end, time runs so fast, it's December just after it's January and then of course it's January again, until there's no more time.

This morning I was doing some work at my desk in the upstairs study, looking out over San Francisco Bay and the Golden Gate Bridge in the distance. On the stereo I'm listening to old George Harrison tunes, and decided to catch up reading Naked Jen's blog. After reading the last three posts, my eyes welled up, and my heart so proud of her for being so true to herself and sharing so much of her feelings so nakedly, at the very same time just by coincidence Harrison's All Things Must Pass is playing.

Sunrise doesn't last all morning
A cloudburst doesn't last all day
Seems my love is up and has left you with no warning
It's not always going to be this grey

How funny. These are exactly the words I want to say to Jen. I've been where you are, honey. When it feels so bad you don't know how you're going to go on, one foot follows the other anyway, at first you're just going through the motions, but then, you start to heal and without marking it with any special ceremony, you find life is flowing. You still miss what you lost, of course.

Daylight is good at arriving at the right time
It's not always going to be this grey

Truth is, while it feels like you're stopped, you never really are as long as your heart keeps beating and you keep breathing. You want to stay where you are, but you don't, you can't.

I've often described Jen to others as the perfect blogger. What she does is exactly what I hoped people would do with the medium many years ago. Holding Hands in Cyberspace. Not being celebrity, just being yourself. A new form for a human body, not only intellectual or physical or emotional, all those things and more. Something new.

So I'm giving an award this year, Blogger Of The Year to the person who I feel exemplifies the best of blogging.

Not because she's sad, or hurt, rather because she is herself.

Holiday greetings!

Mon, 24 Dec 2007 02:18:52 GMT

Tomorrow and the next day are big Jewish holidays, it's the time when we all go out for Chinese or Indian food, and talk about anything but Baby Jesus. On Christmas Day I'm going to Santa Cruz to hang with Naked Jen, who has a tradition of seeing three of the movies that come out for the holiday, and then we're going out for a Jewish celebration probably with Chinese or Indian food.

To celebrate the holiday I've brought back the photographic Scripting News banner. It chooses a random graphic every time I update the home page. I may have some fun with a CGI script that chooses a random graphic every time you refresh the page. Let's see. (Update: done!)

In 2004 I recorded a podcast for the holiday that was the telling of O Henry's sweet story of love and generosity, The Gift of the Magi. I was reminded of it seeing several interviews with Carolyn Kennedy, the daughter of President Kennedy and Jackie O, who wrote a book about Christmas that included this story. It seems appropriate tonight to link back to the telling of the story. I was in Seattle when I recorded it, about to leave for Florida. It was the year of podcasting.

Speaking of podcasts, I just listened to a podcast of today's Meet the Press interview with Presidential candidate Ron Paul. What a refreshing person to be running for political office. He's very intelligent and talks back when Russert tried to corner him. I probably won't ever get a chance to vote for him, and I don't endorse him as a candidate, but I do endorse listening to the podcast. It's excellent politics. Refreshing.

What I learned about security, privacy and Apple

Sun, 23 Dec 2007 19:09:55 GMT

First, thanks for the great comments on yesterday's post about Apple and the hard disk of my MacBook. People were universally positive and helpful, and I can say I really learned some really important things as a result of the discussion.

First, the cost of the data on the hard disk swamps the value of the value of the disk and even the value of the computer. There was source code on the computer, and other information, which if it fell into the wrong hands, could cause some serious problems for me.

I have no agreement with Apple that covers the security or privacy of the data. As far as I know they think they own the contents of the disk as well as the disk itself. The experience I had with them actually makes me think they probably do feel its theirs. This from a company that takes the security of its own private information very seriously, they seem to have almost no regard for the security of its customers' information.

You have no control over when a hard disk will crash, or any foreknowledge of when it's even likely to crash. So there's no way to protect against this kind of security issue. And that's what it is. What kind of sense does it make to invest in firewalls, and of what value is Apple's claim that Macs are inherently more secure, when all the data on one of my computers is now completely out of my control forever?

I'm not so concerned about the privacy issues, but I could imagine that other people might be. And if identity thieves are not aware of this backdoor way to get access to private information, how long before they are? Security experts always warn us that obscurity is not a good strategy for security.

So what to do?

Basically I've given up on trying to get Apple to do the right thing and give me my disk back. Some people at the Emeryville store are well-itentioned, and are just naive about the problems that can come when you trust people with all your data. Others just don't care. Either way it seems unlikely that I'm going to get it back, and even if I do, it's been out of my control for too long.

I'm going to go through the tedious job of changing the passwords on all my sensitive online accounts. That was overdue anyway. And next time a laptop blows its hard disk, I'm either going to replace it myself and shred the old disk, the same way I'd shred any sensitive documents before throwing them out, or just throw away the whole computer. I know this isn't green, but there seems to be no other course that's anything close to secure.

And always be aware that you could lose a laptop, or it could be stolen. So far it seems that this is not yet an identity theft concern, but you can't be sure, and it won't be long before it is.

Thanks again for all the good info, advice and vibe.