Re: Technology Bill of Rights

*** Disclaimer as to the tone of this response ***

Sometimes people misread the tone of a blog post, response, or comment. Since I don't have an expertly-developed tone, I'll make it clear: I'm nice. I respect other peoples' thoughts and the opinions of those that I disagree with. If you feel I am being nasty, just pause and re-read the sentence. Imagine someone smiling. There you go.

I recently read an interesting blog post by Paul Venezia about a Technology Bill of Rights. While the post makes some great points and is great for initiating dialogue, I think that some of Venezia's ideas are woefully mislead.

To begin with, I disagree with the notion that a Technology Bill of Rights is necessary, and in fact that it would be a good idea. When a nation needs to address the issues of a changing society, there are generally three options.

1) We predict the future and write laws based on that. If that were possible, the founding fathers would have already made laws about blog posts :)

2) We make new laws every time something changes. This is the general approach that our government takes, and it is the approach that is implied by a Technology Bill of Rights.

3) We take the laws that were created centuries ago in the Bill of Rights and decide their interpretations through the courts, like we were meant to.

This third approach is the one I recommend. As I will note later, I think most of the issues that Venezia addresses in his post can be handled by interpreting and/or enforcing current law.

Venezia lists six articles as possible starting points for a Technology Bill of Rights. In my opinion, he's on the right track with most of them. But, here are my qualms:

Article 1. Any individual shall be able to choose anonymity when posting to Internet sites. This is the one I most strongly disagree with. If people were forced to embarrass themselves in angry, misguided comments (as Venezia comically points out :) ) I would agree. But people are not forced to participate in online community activities, they make a choice. If they make the choice to go ranting in comments, they should make the choice to read the privacy policy of the site they are posting on. Should sites perhaps be required to accurately enforce their own privacy policies? I could see how that could be reasonable. But by no means should web sites be forced to provide anonymity to any user who wants it. Web sites should be able to do what they want!

Anticipated counter-argument: nobody reads privacy policies. Well, nobody asks for the nutrition facts at McDonalds, either. That doesn't mean we make McDonalds illegal just because most people don't know how to protect themselves from it. People make choices!

Article 2. No network provider may constrain or restrict access to the Internet in any way, shape, or form other than agreed-upon access speeds. I have a kind-of complicated view on Net Neutrality, but I'll just say I agree here since I mostly do.

Article 3. No individual shall be held liable for effects of malware or malicious code unknowingly run on a personal computer. Agreed, but this issue doesn't need its own law--it needs a court decision. In the American court system, the prosecution must be able to establish intent. The case of Julie Amero that Venezia mentions is something that never should have happened. It was an example of a mishandled trial on both sides (the prosecution and the defense), and luckily it was overturned. But still, we don't need to pass a law making citizens "not liable" for malware running on their computers. If all citizens were totally not liable, this would mean that, in order for a prosecutor to prove the intent of a hacker who installed malware intentionally on his own computer, he would literally have to prove that the hacker "knew" that the malware was installed, which would be impossible. Sounds like a can of worms to me.

Article 4. A company that produces and sells closed source software for use on computers shall be responsible for the security of that product, and a user has a right to seek damages in the event of a failure to secure their product. Companies are already liable for whatever they sign a contract to be liable for. If a consumer wants total liability protection from a software producer, they simply need to find one that will offer it. As with Article 1, this is a blanket law that isn't needed. Consumers need to take responsibility for who they sign up with and what those people are liable for.

Article 5. Any software or hardware used to conduct or support laws and public policy shall be open-source. Actually, I love this one. The point about the breathalyser is dead-on. Good call.

Article 6. Any media content legally purchased by an individual shall be available for private use on any device, at any time. This one falls into the same category as Articles 1 and 4. If consumers don't want DRM on their music, they don't have to buy from iTunes! CDs still exist. And so do other online music stores that let you download actual MP3s. If DRM continues to get out of hand, the free market will handle it because consumers will cut out of places that abuse their customers' loyalty.

I hope everybody will read Venezia's article. It's really well-done. Though I disagree with lots of it, I appreciate Venezia's open-minded tone and general desire for more openness. I just hope that people can see openness through a broader lens, as I feel I have presented it here.

Peace!

Secure AJAX calls without SSL

I recently spoke with an individual who was very upset that his password had been sniffed because he was using a web application that didn't offer a secure connection via HTTPS. I began to think about how the developer of that web app must have felt: either waste money on an SSL certificate for this dumb site (which doesn't even store any personal data) or incur the wrath of angry customers whose passwords get sniffed by pranksters.

During the conversation with this angry individual, I zoned out and decided to think about how I would approach this problem as a developer. Certainly, not all sites need secure access via HTTPS, but wouldn't it be nice for small sites to have encrypted form submissions and AJAX calls?

After some thought and some Googling, I did bit of work on this issue for fun. I have affectionately named the fruits of my efforts RSAJAX.

I'm a big fan of getting to the fun part. Here's a demo.

I am using several open-source libraries here. Proper attribution will appear in a more-descriptive write-up I will be doing tonight. I literally just finished it up five minutes ago, so I'll probably be cleaning and tweaking it too.

Update: A web page is now available that gives more information on RSAJAX. Check it: http://www.andrewpeace.com/rsajax/

The process here is actually very basic, even for somebody like me who isn't into crypto. All you need to understand are the basics of public-key encryption (specifically, RSA) and private-key encryption (specifically, RC4). Just Google it...

The server generates a private and public RSA key, the latter of which is shared with the client-side via a regular AJAX call. The JavaScript then generates an RC4 encryption key, which is a simple matter of generating a random 256-character-long string. JavaScript then encrypts its RC4 key with the server's public RSA key, and sends it to the server, where it is decrypted with the private RSA key and stored.

From that point on, making a secure AJAX call is simple. First, JavaScript encrypts any values being sent to the server using the public RSA key. Once the server receives an encrypted value, it decrypts it with its private key. This is exactly the same thing that happened when the client's RC4 key was shared with the server.

When the server is ready to respond, it encrypts its response via RC4 using the client's key, which it has stored. Upon receiving the AJAX response, the JavaScript can then decrypt that value using its RC4 key.

Shazam! Encrypted on the way up, encrypted on the way down.

If you are wondering why this process involves both RSA and RC4 encryption, there are good reasons for it. I'll get in to those when I do my next write-up. Anyways, I may swap out RC4 for something a bit stronger.

The Andrew Peace Scavenger Hunt

Recently a friend [1] remarked that I can be really hard to get a hold of. I spend a lot of time working and taking walks, I rarely answer my phone, and my text message replies are often cryptic or unrelated to what was asked. If you need to find me for some reason, just follow these steps:

1. Check my Facebook status. You can often determine my location just by interpreting my most recent status. If it says something about death, guns, or sex, it's probably a Marilyn Manson lyric. That means I'm on a walk. If it rhymes or contains funny names ("Attend the tail of Sweeny Todd, his skin was pale and his eye was odd") it's a show tune. This also means walking. In general, if it makes no sense it's probably some sort of song and that means walking. If it contains funny characters or academic-sounding words, that means I've been programming but became frustrated and decided to go on Facebook for a minute and then take a walk to clear my mind.

2. I hope you're the kind of person that reads ahead, because I actually deleted my Facebook a couple days ago. I realized that the only time I use Facebook is when I want to check out the inappropriate photos that hot Northeastern girls post when they're hung over, and it kind of creeps me out. Nobody that I'm really friends with uses Facebook anymore[2].

3. Check the futon in Wabisabi (that's what I call my apartment). That's where I like to do programming. Don't give up if I'm not on the futon, just check around. It's a pretty small place but there are lots of nooks and crannies. My roommate found me sleeping in the bathtub once, and that's not a joke. You may want to try and locate my black beanie with a Google logo on the side. If it's not there, it's probably cold enough that I need to wear it while I'm walking.

4. Check the time. If it is a weekday between 7AM - 7PM I am working or riding to/from work. After 7PM is when I usually take a walk. For weekends, it is a bit different. I should be sleeping until about noon, so you're out of luck until after then. Past noon, you can start by checking Park Drive or the Fenway area in general. That's near where I live, I walk there a lot.

5. Check my Twitter. No reason, really. Just thought it would be fun.

6. Go to the Subway on Boylston and ask them if they've seen a funny-looking character who ordered a Spicy Italian with lettuce, cucumber, and spinach. If they remember me, you're on the right track. Search for a trail of cookie crumbs near the door. If you find a trail but end up loosing it, don't worry. That probably just means I've gone on an after-dinner walk.

7. If you found the Google beanie in step 3, take a picture on your cell phone and send it to me. I may interpret this as a ransom demand and set up a secret meeting time and location. The only thing is that sometimes if I'm walking I don't feel my phone vibrate, so it's 50/50.

If you've followed those steps and have come to the conclusion that I am working or on a walk, you're screwed and I probably won't be getting back to you.

Notes:

1. Actually, a mop
2. Don't be confused: if you are a hot Northeastern girl, you are my friend automatically

Teaching Programming

I think there is a lot of debate about how programming should be taught, and I think the debate basically centers on how to teach it to freshmen in college. I say "I think" because I don't really know anything about this. But, it's been my MO lately to talk about things I know nothing about, so eff it.

The complicated thing about this (as I perceive it) is that there don't appear to be only two sides, because there isn't only one issue. There's the issue of functional versus imperative programming style. Then there's a several-way split about historical versus newer versus popular programming languages. It seems there's even a debate about what kinds of programs to begin teaching with.

Well, here are my thoughts. Someday when I have influence we can look back on this and decide it's smart. And by then I will have changed my mind.

Some principals

Agreed: choosing a language based on its historical significance (C++) or its usage in "the field" (Java) is BS. If teaching were about practicing for the real world, high school teachers wouldn't make you read Jane Eyre and write analytical essays on it. Very few people end up actually writing analytical essays about literature for a living.

Granted, it's different in programming. Java is very widely used and lots of languages are similar to C/C++. But I think it's assumed that, if we can figure out how to teach programming well, we can either teach how to write Java/C later or we can depend on the student to pick it up when they need to.

Wait, how is that different? Anyways...

Starting out writing GUIs is ridiculous. That means no making desktop calculators until semester two. It is a waste of time to start out writing GUIs just so students can feel like they are actually doing something cool. You won't be successful in programming unless you think that figuring out how to write a tough function is cool, sorry. And anyways, the time spent writing that calculator is mostly spent learning how to use the particular GUI library you have chosen, which seems like a big waste.

Functional versus imperitive? One, then the other. And it doesn't matter the order, in my opinion. Having a good understanding of loops and having a good understanding of recursion are both really important. I think a really effective programming program (sorry, trying to refrain from saying "computer science program") stresses that recursion and iteration are both commonly-used tools, both simple once you get to know them, and both dangerous in different situations. Of course, it seems the most reasonable way to teach both is to chose one, teach it, and then teach the other with the first in mind.

On object-oriented programming: definitely leave that junk for later. Understanding object-oriented paradigms is obviously important, but for people who are trying to understand for the first time how to make computers do stuff, it's a mind fuck.

Tests on paper. I actually don't think this is debated too heavily, but it's worth saying. At Northeastern, I've realized that writing a program on paper during an exam can only be done if you have learned how to program. More on this later.

My perspective

I have a fairly unique perspective on this issue given my age and lack of time spent in the real (or academic) world. I've had the opportunity to semi-teach some material from Northeastern's CS program, which uses SCHEME and focuses on functional programming to begin with. The first time, I was teaching it to seventh graders after school. Don't ask. The second time, I was tutoring freshmen CS students at Northeastern, grading their homework, and proctoring their lab exercises.

I like Northeastern's program a lot, and it's at least tripled my skill at programming in my first two years. But I had been programming for years before going to college, so learning in SCHEME was both easy for me and really different and interesting. So, I don't know how it felt for newbies (or, how it felt for the newbies after they learned SCHEME and went to try something else).

One thing I learned from watching freshman (a full year younger than me!) and seventh graders writing SCHEME is that new programmers are good at remembering keywords. I don't know how many times I went over to help a student who had written simply (define or in the body of their function (cond (uhm, I'm sure somebody will yell at me for calling those keywords, but you know what I mean). I'm not exactly sure what this keyword-recognition ability means to a programming program, but it exists.

The other thing I learned, as I mentioned before, is that on-paper quizzes and tests are great for teaching programming. Programming homework assignments and projects is supposedly good practice, so fine. But college students cheat. You simply can't write a program down if you don't know how to program. On another level, even for students who don't cheat on homework, getting a program on paper is a different experience than coding it on your computer where you can get in the habit of testing it every fifteen seconds. Paper doesn't compile code (yet).

The Language

I think it's Python.

I swear it's not because it's trendy! It's just the language that best fits how I think programming should be taught.

For one, you can easily teach iteration and recursion in it. Both the functional and imperative programming style come very easily in Python. In fact, I would have chosen Perl were it not for the fact that in Perl you can't pass functions by their exact name. There's no funky syntax involved in Python.

Again, I loved learning SCHEME at Northeastern. But aside from the iteration thing, here's my main beef.

I think that students can pick up programming faster if the syntax they are using is just right. There are too many parenthesis in SCHEME. Sure, it's beautiful to me. But to a first-time programmer, I think it helps to see some colons, some equals signs, and some keywords. Like return, for example.

Python programs can really look any way you want. If you want to start by teaching functional style, do it. If you want to start by teaching iteration, start writing loops. The only thing that Python forces on you is good indentation practices, and I don't think anyone's complaining about that. What better way is there for freshman to learn good style than to program in the most inheritly stylish language out there?

I feel like if my Northeastern professors read this they would probably beat me with a keyboard for not sharing their obsession with SCHEME, and that's fine. They have a great program and I think it's okay for them to defend it (as I've seen several do in heated conversations). All I'm saying is that I think some of my classmates and I could be even better programmers right now if we had begun learning in Python and had learned iteration early on.

Then again, I know nothing about this.

The problem with Linux

A few months ago I mentioned to my non-techy roommate that I was downloading Windows 7 Beta for a friend. His response was: "Sweet! Illegally?" Of course, he didn't know that Windows 7 Beta was a limited-time free (uh, beta) release.

Then last night I mentioned to my roommate that I was downloading Ubuntu 9.0 (or, as I referred to it for his sake, "a new Linux"). His response again: "Sweet! Illegally?"

Normal people do not realize that Linux is free. Because I was so miffed I didn't go into a discussion with him, but I bet my roomate did not realize that, in fact, everything I use on my computer I use without paying for. Of course he is aware of Firefox and programs like Pidgin, but has he been thinking all this time that I edit Office documents on a paid-for Linux office suite? Does he think I bought multimedia tools and quality disc-burning software? When he sees me working, does he think that Gedit and Eclipse are Microsoft products? What must he think when he sees me creating graphics in GIMP??

I am aghast because I am like every other geek. I didn't understand that normal people don't understand. No wonder people get pissed when I can't help them un-crash their Vista machines! They don't get that this is different.

Why Linux is only for geeks

Windows and Mac users will never know that Linux is bomb because they will never use it. They will never use it because the idea of installing a second OS does not fit into their minds. I don't mean to say they're stupid. What I mean is that, to most people who use computers, new things run as programs. Linux is a new thing to most people, so in their minds it must be a program that they can uninstall from Control Panel if they want. That's how normal people think, and that's fine. We just need to realize it.

We need to get normal people using Linux somehow. They will be generally unimpressed by the operating system itself. After all, normal people don't care about being able to write shell scripts or easily set up web servers. They will, however, be into all the free stuff. My guess is that they would also be impressed by the package managers included with most Linux distributions, with a little work. More on that later.

The problem is that Linux is an operating system, not a program, so they will never be able to see this neat stuff. At this point, the real geeks out there are screaming at me that Wubi is the solution. For those who don't know, Wubi allows you to install Ubuntu on Windows, as a program. If this is your solution, you are missing the point.

The issue is not that Linux cannot be a program, but that it is not really a program and is an operating system. There is a barrier. People won't start using an operating system within an operating system that already satisfies them.

Fixing it

Faster, sleeker, slimmer. This is why Firefox is slowly gaining market share with normal people. When I say to normal people, "Ah, I see you're using Firefox" the number one response is "Yeah, it's a lot faster". What they mean is, "Yeah, it's a lot faster than Internet Explorer" or more importantly, "Yeah, it's a lot faster than the built-in way to do the same thing with Windows".

One thing normal people certainly do understand is doing something different if it is faster, sleeker, and slimmer. This has been proven by Firefox (beats IE), Facebook (beat MySpace), Gmail (beat HotMail), and a myriad of others. I think Linux already has a pretty good leg up on this one. I could trick anyone into thinking that my junky laptop has 4GB of RAM because of the performance I get from Ubuntu. When I'm on my XP partition, it's as if there is no RAM at all. (I have 2GB, I believe).

The Linux community is smart, and geeks can push it to the limit. If we want Linux to be noticed for its speed, it's got to have some sort of speed. I say, keep it up.

Programs! Find, install, uninstall! Of course, Linux already does this very well. However, programs like Synaptic package manager need some changes to appeal to the normies.

First of all, there needs to be a version that gives less information. Normies don't want to know which dependencies have just been resolved. Ubuntu (and maybe other distros, I don't know) has been doing this for a while with the Add/Remove application off the Applications menu. It's Synaptic manager except more easily browsable, and it's an incredible start.

But it needs to be more. I'm thinking something along the lines of the Android apps market, which is extremely addicting. It's very graphical and there are thousands of options. Like iTunes for programs. We need to go there.

Free is cheaper than whatever the price of Windows is. Why is there not a popular company that is willing to market low-end laptops that come with Linux? And by market I don't mean Dell selling machines on linux.dell.com. I mean commercials on TV where they say, "Hey, this laptop is only $600 and it does all the cool stuff you want, and it's fine even though it's not Windows. See?"

I suppose this is not exactly a problem with the Linux community, but more a problem of markets. But still, it's not like we have no resources. People can get their startup Web 2.0 sites funded, so why can't someone start selling Linux machines? Like speed, price is a game-changer for normal people. Obviously, Linux has the price issue down pat. The only reason that's not recognized is that companies don't sell hardware with Linux on it.

Additional thought: there is enterprise-level software that runs on Linux. Enterprises use that stuff. They also like cutting costs. Where are the people going, "Hey, enterprises/businesses, buy hundreds of really cheap computers that easily integrate with all your other stuff and perform all your business functions!"

A start

I think a good start to all of this is as simple as me clicking "Publish Post" and starting that conversation with my roommate. I'm a geek, but all geeks are semi-normal on some level, and we retain the power to connect with other humans (most of us do). Until some things start to come together for Linux, the best thing to do as I see it is to keep the conversation up.

Normies?

I just realized that at some point in this post I started using the phrase "normies" to describe normal people. Normies?

Actually, I like it.