Non Forbes

In Montreal for Worldcon

I'm in Montreal for the next 5 days for the World Science Fiction convention. I already did 3 panels on Thursday, one more on Nanotech to do on Sunday. Great crowd of people here. Then it's back to Burning Man preparation. Due to an error we got terrible placement in the city this year but I'm working on it.

Shortly I will post new thoughts on the nature of consciousness I had after talking to Peter Watts. Watts is the author of the novel Blindsight which I highly recommend.

Amazing eclipse at Enewetak, Marshall Islands

The total eclipse of the sun is the most visually stunning natural phenomenon there is. It leaves the other natural wonders like the Grand Canyon far behind. Through an amazing set of circumstances I got to see my 4th on Enewetak, an isolated atoll in the Marshall Islands. Enewetak was the site of 43 nuclear explosions including Mike, the first H-bomb (which erased one of the islands in the chain.)

Tags: 

Two wheeled robocars and the Twill

I have mostly written about 3 and 4 wheeled Robocars, even when the vehicles are narrow and light. Having 3 or 4 wheels of course means stability when stopped or slow, but I have also been concerned that even riding a 2 wheeled vehicle like a motorcycle requires a lot of rider participation. It is necessary to lean into turns. It's disconcerting being the stoker on a tandem bicycle or the passenger on a motorcycle, compared to being a car passenger. You certainly don't imagine yourself reading a book in such situations.

On the other hand 3/4 wheeled vehicles have their disadvantages. They must have a wide enough wheelbase to be stable because they can't easiliy lean. In addition, for full stability you want to keep their center of gravity as low as you can. The extra width means a lot more drag, unless you have a design like the Aptera Motors entrant in the Progressive 100mpg X-prize, which puts the wheels out to the sides.

I recently met Chris Tacklind, who has a design-stage startup called Twill Tech. They have not produced a vehicle yet, but their concepts are quite interesting. Their planned vehicle, the Twill, has two wheels but uses computer control to allow it to stay stable when stopped. It does this by slight motions of the wheels, the same way that pro cyclists will do a track stand. They believe they can make a 2 wheeled electric motorcycle that can use this technique to stay stable when stopped, though it would need to extend extra legs when parked.

This is intended to be an enclosed vehicle, both for rider comfort and lower drag. The seat is very different from a motorcycle seat, in that you do not sit astride the vehicle, but in a chair similar to a spacecraft's zero-G chair.

In addition, the vehicle is designed to have the rear wheel on a lever arm so that it can stand almost upright when stopped and then slope down low, with the rider reclined, at higher speeds. The reclined position is necessary for decent drag numbers at speed -- the upright human creates a lot of the drag in a bicycle or motorcycle. However, the upright position when slow or stopped allows for much easier entry and exit of the vehicle. As everybody knows, really low cars are harder to get in and out of. Twill is not the first company to propose a vehicle which rises and lowers. For example the MIT CityCar plan proposes this so the vehicles can stack for parking. Even without stacking, such designs can park in a much smaller space.

Topic: 

Tales of the Michael Jackson lottery, eBay and security

I've been fascinated of late with the issue of eBay auctions of hot-hot items, like the playstation 3 and others. The story of the Michael Jackson memorial tickets is an interesting one.

17,000 tickets were given out as 8,500 pairs to winners chosen from 1.6 million online applications. Applicants had to give their name and address, and if they won, they further had to use or create a ticketmaster account to get their voucher. They then had to take the voucher to Dodger stadium in L.A. on Monday. (This was a dealbreaker even for honest winners from too far outside L.A. such as a Montreal flight attendant.) At the stadium, they had to present ID to show they were the winner, whereupon they were given 2 tickets (with random seat assignment) and two standard club security wristbands, one of which was affixed to their arm. They were told if the one on the arm was damaged in any way, they would not get into the memorial. The terms indicated the tickets were non-transferable.

Immediately a lot of people, especially those not from California who won, tried to sell tickets on eBay and Craigslist. In fact, even before the lottery results, people were listing something more speculative, "If I win the lottery, you pay me and you'll get my tickets." (One could enter the lottery directly of course, but this would increase your chances as only one entry was allowed, in theory, per person.)

Both eBay and Craigslist had very strong policies against listing these tickets, and apparently had staff and software working regularly to remove listings. Listings on eBay were mostly disappearing quickly, though some persisted for unknown reasons. Craiglist listings also vanished quickly, though some sellers were clever enough to put their phone numbers in their listing titles. On Craigslist a deleted ad still shows up in the search summary for some time after the posting itself is gone.

There was a strong backlash by fans against the sellers. On both sites, ordinary users were regularly hitting the links to report inappropriate postings. In addition, a brand new phenomenon emerged on eBay -- some users were deliberately placing 99 million dollar bids on any auction they found for tickets, eliminating any chance of further bidding. (See note) In that past that could earn you negative reputation, but eBay has removed negative reputation for buyers. In addition, it could earn you a mark as a non-paying buyer, but in this case, the seller is unable to file such a complaint because their auction of the non-tranferable ticket itself violates eBay's terms.

Topic: 
Tags: 

A standard OS mini-daemon, saving power and memory

On every system we use today (except the iPhone) a lot of programs want to be daemons -- background tasks that sit around to wait for events or perform certain regular operations. On Windows it seems things are the worst, which is why I wrote before about how Windows needs a master daemon. A master daemon is a single background process that uses a scripting language to perform most of the daemon functions that other programs are asking for. A master daemon will wait for events and fire off more full-fledged processes when they happen.

Review of Downfall / Der Untergang

Last month I released a parody video for the film "Downfall" (known as Der Untergang in German.) Having purchased the movie, I also watched it of course, and here is my review. At least in my case, the existence of the parody brought some new sales for the film. There are "spoilers" of a sort in this review, but of course you already know how it ends, indeed as history you may know almost everything that happens in it, though unless you are a detailed student of these events you won't know all of it.

Topic: 

Design for a universal plug

I've written before about both the desire for universal dc power and more simply universal laptop power at meeting room desks. This week saw the announcement that all the companies selling cell phones in Europe will standardize on a single charging connector, based on micro-USB. (A large number of devices today use the now deprecated Mini-USB plug, and it was close to becoming a standard by default.) As most devices are including a USB plug for data, this is not a big leap, though it turned out a number of devices would not charge from other people's chargers, either from stupidity or malice. (My Motorola RAZR will not charge from a generic USB charger or even an ordinary PC. It needs a special charger with the data pins shorted, or if it plugs into a PC, it insists on a dialog with the Motorola phone tools driver before it will accept a charge. Many suspect this was to just sell chargers and the software.) The new agreement is essentially just a vow to make sure everybody's chargers work with everybody's devices. It's actually a win for the vendors who can now not bother to ship a charger with the phone, presuming you have one or will buy one. It is not required they have the plug -- supplying an adapter is sufficient, as Apple is likely to do. Mp3 player vendors have not yet signed on.

USB isn't a great choice since it only delivers 500ma at 5 volts officially, though many devices are putting 1 amp through it. That's not enough to quickly charge or even power some devices. USB 3.0 officially raised the limit to 900ma, or 4.5 watts.

USB is a data connector with some power provided which has been suborned for charging and power. What about a design for a universal plug aimed at doing power, with data being the secondary goal? Not that it would suck at data, since it's now pretty easy to feed a gigabit over 2 twisted pairs with cheap circuits. Let's look at the constraints

Smart Power

The world's new power connector should be smart. It should offer 5 volts at low current to start, to power the electronics that will negotiate how much voltage and current will actually go through the connector. It should also support dumb plugs, which offer only a resistance value on the data pins, with each resistance value specifying a commonly used voltage and current level.

Real current would never flow until connection (and ground if needed) has been assured. As such, there is minimal risk of arcing or electric shock through the plug. The source can offer the sorts of power it can deliver (AC, DC, what voltages, what currents) and the sink (power using device) can pick what it wants from that menu. Sinks should be liberal in what they take though (as they all have become of late) so they can be plugged into existing dumb outlets through simple adapters.

Style of pins

We want low current plugs to be small, and heavy current plugs to be big. I suggest a triangular pin shape, something like what is shown here. In this design, two main pins can only go in one way. The lower triangle is an optional ground -- but see notes on grounding below.

Topic: 
Tags: 

Panoramas of Israel

Back in March, I took my first trip to the middle east, to attend Yossi Vardi's "Kinnernet" unconference on the shores of lake Kinneret, also known as the Sea of Galilee. This is an invite-only conference and a great time, but being only 2 days long, it's hard to justify 2 days of flying just to go to it. So I also conducted a tour of sites in Israel and a bit of Jordan.

Topic: 

The overengineering and non-deployment of SSL/TLS

I have written before about how overzealous design of cryptographic protocols often results in their non-use. Protocol engineers are trained to be thorough and complete. They rankle at leaving in vulnerabilities, even against the most extreme threats. But the perfect is often the enemy of the good. None of the various protocols to encrypt E-mail have ever reached even a modicum of success in the public space. It's a very rare VoIP call (other than Skype) that is encrypted.

The two most successful encryption protocols in the public space are SSL/TLS (which provide the HTTPS system among other things) and Skype. At a level below that are some of the VPN applications and SSH.

TLS (the successor to SSL) is very widely deployed but still very rarely used. Only the most tiny fraction of web sessions are encrypted. Many sites don't support it at all. Some will accept HTTPS but immediately push you back to HTTP. In most cases, sites will have you log in via HTTPS so your password is secure, and then send you back to unencrypted HTTP, where anybody on the wireless network can watch all your traffic. It's a rare site that lets you conduct your entire series of web interactions entirely encrypted. This site fails in that regard. More common is the use of TLS for POP3 and IMAP sessions, both because it's easy, there is only one TCP session, and the set of users who access the server is a small and controlled set. The same is true with VPNs -- one session, and typically the users are all required by their employer to use the VPN, so it gets deployed. IPSec code exists in many systems, but is rarely used in stranger-to-stranger communications (or even friend-to-friend) due to the nightmares of key management.

TLS's complexity makes sense for "sessions" but has problems when you use it for transactions, such as web hits. Transactions want to be short. They consist of a request, and a response, and perhaps an ACK. Adding extra back and forths to negotiate encryption can double or triple the network cost of the transactions.

Skype became a huge success at encrypting because it is done with ZUI -- the user is not even aware of the crypto. It just happens. SSH takes an approach that is deliberately vulnerable to man-in-the-middle attacks on the first session in order to reduce the UI, and it has almost completely replaced unencrypted telnet among the command line crowd.

I write about this because now Google is finally doing an experiment to let people have their whole gmail session be encrypted with HTTPS. This is great news. But hidden in the great news is the fact that Google is evaluating the "cost" of doing this. There also may be some backlash if Google does this on web search, as it means that ordinary sites will stop getting to see the search query in the "Referer" field until they too switch to HTTPS and Google sends traffic to them over HTTPS. (That's because, for security reasons, the HTTPS design says that if I made a query encrypted, I don't want that query to be repeated in the clear when I follow a link to a non-encrypted site.) Many sites do a lot of log analysis to see what search terms are bringing in traffic, and may object when that goes away.

Tags: 

Secrets of the "Clear" airport security line

Yesterday it was announced that "Clear" (Verified ID Pass) the special "bypass the line at security" card company, has shut its doors and its lines. They ran out of money and could not pay their debts. No surprise there, they were paying $300K/year rent for their space at SJC and only 11,000 members used that line.

As I explained earlier, something was fishy about the program. It required a detailed background check, with fingerprint and iris scan, but all it did was jump you to the front of the line -- which you get for flying in first class at many airports without any background check. Their plan, as I outline below, was to also let you use a fancy shoe and coat scanning machine from GE, so you would not have to take them off. However, the TSA was only going to allow those machines once it was verified they were just as secure as existing methods -- so again no need for the background check.

To learn more about the company, I attended a briefing they held a year ago for a contest they were holding: $500,000 to anybody who could come up with a system that sped up their lines at a low enough cost. I did have a system, but also wanted to learn more about how it all worked. I feel sorry for those who worked hard on the contest who presumably will not be paid.

The background check

Pages