September 05, 2005

Big Oil vs. Victims of Katrina

Folks,

My wife has done the research on this subject, and the numbers are truly apalling -- and staggering. I can't really do much more here than quote:

Large oil companies are earning billions from US citizens, and only donate a tiny amount to help hurricane ravaged areas, even where they have major oil refining operations. Three large oil companies headquartered in the US have pledged $15 million to help Katrina’s victims…but this is miniscule compared to the earnings that these companies made in only three months. Exxon Mobile (HQ- Tx) pledged 7 million as of 2 September compared to its Second Quarter 2005 net profits of $7.6 billion. Chevron (HQ – CA) pledged $5 million, compared to Q2 profits of 3.7 billion. Conoco Philips (HQ – TX) pledged $3 million, compared to Q2 earnings of $3.1 billion. That’s around .1% of only 3 months PROFIT donated to help people in a country where these companies are making billions each month. Two other big non-US oil companies are about the same: Royal Dutch Shell pledged $2 million (+1 million to match employee contributions) compared to Q2 profits of $5.2 billion; BP pledged $5 million, compared to Q2 profits of $5.2 billion. Check out the press releases on their websites if you don’t believe it.

Derrick Jackson has called Big Oil "the nation's biggest looters". More quotes:

President Bush Thursday told ABC-TV, "there ought to be zero tolerance of people breaking the law during an emergency such as this, whether it be looting or price-gouging at the gasoline pump or taking advantage of charitable giving or insurance fraud."

Zero tolerance is meaningless when the White House lets the biggest looters of Hurricane Katrina walk off with billions of dollars. We are not referring to the people you saw in endless footage, crashing through storefronts and wading through chest-high water with clothes, food and pharmaceuticals.

And:
New Orleans is under martial law and will not return to normal for years. Members of the Red Cross, the Coast Guard, the National Guard, police agencies, and firefighters are sacrificing time and risking lives to save lives. Texas is opening up its school systems for homeless Louisiana children. Generous food wholesalers are giving away their stocks to passersby. The Astrodome took in the refugees of the Superdome.

In the midst of this charity, big oil looted the nation. The pumps instantly shot past $3 a gallon, with $4 a gallon well in sight.

Do some Googling for "(oil|gas) price freeze". You'll see plenty more stories like that. But this problem is not limited to just the US -- Big Oil has already started price gouging in Canada, Jamaica, and Argentina. And these are just a small selection of the news articles that can be quickly found.

How long are we going to let them continue this behaviour? It's time for everyone in the world, not just people in the United States, to stand up to Big Oil and tell them that this must stop now. And make sure to tell your politicians, too. Please read and sign the petition at http://www.petitiononline.com/itsasham/.

There are others who feel the same way. Both Senator Nelson and Senator Carl Levin have both already made similar calls to President Bush for price freezes, but we need more voices. We need more people to stand up and say that they won't tolerate this anymore. And we need voices from all around the world, not just in the United States.

Please. Read. Sign. Pass it on.

http://www.petitiononline.com/itsasham/

March 12, 2005

Update: OpenNTPd...

Folks,

I've recently discovered that Darren Tucker has been working on fixing some of the problems I've previously raised regarding OpenNTPd. I'm going to do everything I can to work with him to get any remaining issues resolved.

That's all for now.

October 23, 2004

Update: SonyEricsson P900...

Folks,

In my previous blog entry on this subject, I stated:


    Note that SonyEricsson has announced that they are moving away from the stylus-required mode of the current UIQ interface, and moving something closer to the keyboard-only interface of the Nokia Series 40/60. Again, Nokia wins and SonyEricsson has already admitted defeat. People have asked me where I read this, but all I can do is tell you that I recall seeing this announcement on a variety of wireless/mobile phone websites, but I can't tell you which ones. I would hope that Google would turn up some obvious links, but I haven't had the chance to try that myself.

Well, a bit earlier this month (2004-10-04), I was vindicated. UIQ officially announced that they are moving away from stylus-based interfaces to something that can be operated with one hand. From http://www.uiq.com/opera:

    Until now, UIQ handsets have been positioned for the high-end market, necessitating pen-based, touch-screen devices such as Sony Ericsson's P800, P900 and P910 smartphones, BenQ's P30, Arima’s U300 and Motorola's A920, A925 and A1000 phones - handsets that all include Opera either in the firmware or as an added-value on the memory card. With the new UIQ 3.0, which includes Opera, UIQ Technology will offer users full interaction with one-handed operation for the first time, opening up a wider market for UIQ based devices.

Score:

    Nokia & Series 60: 1
    SonyEricsson & UIQ: 0

July 20, 2004

SonyEricsson P900...

It's weird that in July of 2004, I'm now seeing so many reviews come out for this phone in print media. The phone itself has been around for a while, but the reviewers in Mobile Business Advisor and Stuff Magazine (among others) don't seem to be able to use Google to find decent existing reviews on the 'net (some dating back to October of 2003). If they did, then they might be able to get at least some facts straight.

Although some of these reviews are rather effusive in their praise, others are more realistic. For example, ZDnet UK, BargainPDA, and InfosyncWorld seem to be pretty balanced, with BargainPDA being the only major review I've seen that included actual sample pictures taken from a P900. Somewhat more positive are Mobile-Review.com (which includes a lot of descriptive text and good pictures) and Esato.com. Out in left field is My-Symbian.com, which has to always be 100% positive about all Symbian-based products they review -- still, they've got some good pictures, and show more screen dumps than any other review I've seen.

However, I've lived with a SonyEricsson P900 for a while, and all of the reviews I've seen so far have been missing some user interface details which end up making the P900 a frustrating phone to use on many occasions.

First off, the thing seems to be suffering from multiple personality disorder. When operating with the flip closed, you have access to only five items on the main menu: Messages, Contacts, Call List, Calendar, and Applications. The latter is an "escape" to the full set of ten applications you are allowed to use: CommuniCorder, Music Player, Messages, Contacts, Calendar, Tasks, Jotter, Sound Recorder, a carrier-specific menu that will vary depending on which company you have service with, and "Connections". The last item allows you edit your Infrared, Bluetooth, and cable settings, and is a subset of the functionality provided by the Control Panel in "flip open" mode.

However, with the flip closed ("FC mode"), you have only limited access to each of these applications.

In FC mode, going into Messages allows you to write and retrieve SMS and MMS messages, but you can only retrieve e-mail -- you can't write e-mail in FC mode. If you go into Contacts, you can use the numbers to search through the entries (press "4" once to get to the G's, then press "3" once to scroll down to the names beginning with "GE", etc...), but if you pull up an entry and scroll down to the e-mail address and select it, you are taken to the menu which would allow you to create an MMS to send to them -- and you're only allowed to see phone numbers and e-mail addresses, nothing more. If you need to look up a street address, you have to go to flip open (FO) mode, which is essentially a totally different device.

If you go into Call List in FC mode, you'll be able to see the names of people you've recently called, but not their number. Alternatively, you'll see only their number if you don't have them in your Contacts list. Either way, if you select that entry you'll be forced to dial that exact same number again, as opposed to being given the option of dialing another number you may have for them under the same name. For calls made/received today, you'll be able to see what time that was, but otherwise you'll only see a date and have no way of getting more detailed information. You also can't take a number you've dialed and add it to your Contacts list -- you have to completely re-type everything. This is a basic feature that even my old Nokia 6110 did correctly, and yet the modern SonyEricsson P900 can't.

In FC mode, the Calendar application only lets you see a single day at a time, and doesn't allow you to enter any data -- it's read only. Pretty much all the applications are seriously crippled in FC mode, and while they leave out the advanced features that might be too confusing with a smaller screen (but where a T9-enabled keyboard could be useful), they don't have some of the features that are really needed when you're in FC mode -- such as easily copying numbers from the Call List to Contacts, and then letting you quickly edit the new entry.

FO mode isn't that much better, when it comes to important ease-of-use features.

First off, in FO mode, you lose the T9-enabled keypad. You either have to try to decipher the chicken-scratch stylus input method, or you have to use the miniscule on-screen virtual keyboard -- which is lacking some important keys, at least on the main keyboard. You can get third-party add-on software which will give you a shortcut dictionary (eZiTap FEP), so that you can start typing the word you want, and when it shows up on the display line above the keyboard, you just tap on it and go on to the next word. Or, you can get software that will completely replace the built-in keyboard and give you something much more reasonable (PopOnTop Keyboard), but the built-in virtual keyboard is a serious dog.

In FO mode, the Messages application gets a little better. You have to deal with the data input issue (chicken scratch or crappy virtual keyboard), but at least you get the opportunity to be able to send e-mail. However, one of the key features of this phone is the camera which can take either still pictures or video, and sending attachments is a pain. If you've composed a message, you can tap on the paperclip icon at the bottom, then tap on the "Add" button, and choose your attachment type (the default is "Image"). Once you've chosen the type, you then wait a while as the phone puts together a list of all files on the phone which match that type. While you wait for that to display the top few items in the list, you can choose to switch to a specific folder which may contain a lot less data to sort through, or choose to switch to list view as opposed to icon/preview mode. Once you've got your list of items to attach, you scroll through the list and choose one -- but only one. If you want to attach more than one, you have to go through the entire process all over again. This gets very tiring very quickly, if you have a folder of pictures that you've recently taken and you want to send more than one image from that folder. The File Manager and Picture application both have a way of allowing you to select multiple files/pictures at once -- why can't Messages do the same? Heck, even Messages allows you to select multiple files that you've already attached to a given message and do something with them, why couldn't it do the same here?

As far as e-mail applications are concerned, I don't think I've ever seen anything worse than Messages, on any platform (including on the Palm V I had years ago). Unfortunately, there aren't many alternatives -- unlike PalmOS.

In FO mode, Opera is a gift from $DEITY. The built-in Internet browser isn't too excessively bad on simple pages, but doesn't have any of the Small Screen Rendering features, and it breaks on many pages (because of JavaScript or Java?). Unfortunately, in my own browsing, Opera doesn't seem to be able to have more than two pages open at once, even with all images turned off. Most of the time, if I try to open a third page, it gives me an error stating "Not Enough Memory", at a time when there is 6MB free on the phone and 20-30MB free on the MemoryStick Duo. If PalmOS had Opera, then there wouldn't be any smartphone on the market that could withstand the onslaught from the Treo 600.

Then there are the speed dials. It is absolutely insane to press a number for a speed dial, then be forced to press the "OK" button to actually dial that number. There's no excuse for not having press-and-hold for this function. Doubling the number of button presses required to dial a number is not a good thing, especially since this almost forces you to look at the keypad to make sure you're pressing the right buttons. Again, Nokia understands how to do this right, and have been doing so since the 6110, if not much earlier. I used to be able to speed-dial purely by feel. Not anymore. This is a crucial unnecessary additional distraction.

How about dialing a number, getting into a voice prompt system which requires that you dial further numbers, and then hanging up? For whatever bizarre reason, the P900 keeps those numbers in its input buffer, and if you were to accidentally press the "Okay" key one too many times, it might start to dial them as a real telephone number. If you only had to hit one number in the voice prompt system, then when you exit, the phone thinks you've selected a speed dial and accidentally pressing the "Okay" key will dial whomever is assigned to that number. Bad juju, bwana.

Or locking the screen? With the P900, this feature is not always supported. When you can do it, it takes one key sequence to lock the screen (press the "menu" key and then the "OK" button, or "menu" and "1"), and a different one to unlock it (press "OK" then "*" or "menu" and then "*"). Again, this is a completely idiotic approach, and absolutely destroys any muscle memory that could potentially be built up for "automatically" locking the screen whenever you go to put the phone back in your holster. But then there are the times that screen-locking is not supported, and the same key sequence you've gotten used to will instead put the phone into "mute" mode, as opposed to locking the keyboard/screen. If the screen has auto-locked in FO mode, you have to press the five-way jog dial button either forward or backward, and then in. Chalk up another one for Nokia -- Pressing the menu-star sequence may not have been documented (at least, not in any Nokia manual I ever saw), but it was well supported and well-known in the industry.

The five-way jog dial? It's far too easy to accidentally press the dial forward or backward when you meant to press it in, or otherwise get one of these three actions confused with the others. Of course, they each do different things in different applications, so you're really screwed when it comes to doing anything with it. Moreover, since it's on the left-hand-side of the device, it's not too hard to use with your thumb when the phone is in your left hand, but it's a royal pain to try to use with your right hand. In a surprising number of cases, I find myself needing to use both hands to use the phone or uncomfortably switch the way I'm holding the phone while trying to do something one-handed, due to the poor placement of the jog dial or the functions overloaded onto it which could have been implemented differently.

Having two separate locations for plugging in a headset is just confusing. Especially when one of them is covered by a rubber flap that is a pain to open, and the other requires a different and proprietary Ericsson connector. Oh, and SonyEricsson doesn't seem to sell a device that can function as both stereo music earphones as well as phone headset with microphone.

The desktop sync/charging station looks cool, but in reality it is a major pain. They're stuck with the legacy Ericsson connectors, that much I can live with. But because there's no part of the station which acts as a guide when you are trying to make the connection, and with the connector socket on the bottom and the phone blocking your view of the plug on the UFO station, it's damn bloody tough to make that happen on the first try, even in a fully lit room when you are fully awake. Trying to do it in the dark when you are half-asleep is virtually impossible. Even the Sony Clié designers did better on this.

With regards to the stylus, it is by far, the very worst that I have ever used in my life. And I thought that the stylus which came with my Sony Clié NX70V was bad! Peeeeeeeeeeeeeeeee-Uuuuuuuuuuuw!

I think one of my biggest complaints has to be about battery lifetimes. As with some of the reviews that I consider to be more balanced, I can normally get about two days of life before the battery conks out -- without using the phone very much at all. If I do more than just a few minutes of web/wap browsing via GSM/GPRS, the battery gets sucked down faster than an ice-cold milkshake in the desert. Even with heavy use, my Nokia old 6110/6150/7110/6210 phones would get at least several days between charges, when used with higher capacity Lithium-Ion batteries. A third-party extended capacity battery is supposedly available for the old P800 (along with a replacement back that accomodates the extra space requirements), but I haven't heard of anything comparable for the P900. Moreover, because the battery is a model which requires removing the back of the phone, even if you have a spare battery (even though there is no way to charge one externally), it is a rather involved process to make that swap. Again, the 6110/6150/7110/6210 were much more advanced in this area.

I know that it's a relatively minor complaint, but using a bright blue for the keypad backlight is a bad idea. I know that manufacturers aren't allowed to do any sort of back light that isn't "cool", which means they now are all forced to use blue, but that doesn't change the fact that blue hurts your eyes and destroys your low-light vision. Of course, you've got this mucking great flamethrower of a backlight for the LCD display itself and can be used as a flashlight to help guide you out of a building when all the power in the neighborhood has failed, but that doesn't change the fact that they should have instead used red as the backlight for the keypad -- or used RGB LEDs and let you choose whatever color you want.

Note that SonyEricsson has announced that they are moving away from the stylus-required mode of the current UIQ interface, and moving something closer to the keyboard-only interface of the Nokia Series 40/60. Again, Nokia wins and SonyEricsson has already admitted defeat. People have asked me where I read this, but all I can do is tell you that I recall seeing this announcement on a variety of wireless/mobile phone websites, but I can't tell you which ones. I would hope that Google would turn up some obvious links, but I haven't had the chance to try that myself.

The SonyEricsson P910 is supposed to be adding a QWERTY keyboard inside the flip, intended for use in FO mode (see also the rah-rah review). I'm not sure how well this will work in reality, but if you cradle the phone with both hands and fingers stretched out (pinkies on the bottom near the connector jacks, middle and third fingers behind the phone, index fingers bracing against the top of the phone by the blue & green LEDs, then it might just be possible to thumb-type on the open flip -- But I'm reserving judgement. Having 64MB onboard instead of just 16MB will be greatly appreciated, as will being able to support the Memory Stick Duo Pro with up to 1GB of flash memory. Hopefully the quality of the 640x480 camera will come closer to what we saw years ago on the Sony Clié NR/NX series, as opposed to the crap we have today. But there was so much more they should have done to improve this phone.

Software-wise, Symbian isn't too bad. I've been able to find a few third-party applications which I find useful -- mostly stuff ported over from PalmOS (the "Handy" series, the "Mate" series, etc...). WorldMate in particular is much more useful when you can have it connect to download the latest weather reports, currency exchange rates, etc... and you don't have to depend on another device to make that happen. Moreover, Symbian does multi-tasking (theoretically), so you can start up a slow web page download and then go do something else, and come back to it later. This is a feature I'm looking forward to with PalmOS 6/Cobalt -- and hopefully they'll have a better implementation.

All-in-all, I'd give it one-and-a-half to two stars out of five. Only marginally better than my old 6110, not because of the way it handles the phone aspects (which the 6110, 6150, and 7110, and 6210 each did much better), but because I do have a need for mobile Internet connectivity, and as bad as the P900 is in this area, it's better than trying to take a cable and hook it up between my 6210 and a PalmOS PDA, or do the same over Infrared, or buy yet another new phone and PalmOS PDA combination which both include proper Bluetooth functionality built-in.

I don't know whether or not the P900 is better than the Nokia 6600/6610, but I have to believe that Nokia, even though they are no longer the King Midas of the industry, they still haven't slipped this far.

Sigh....

May 19, 2004

SPF...

The original concept for Sender Permitted From (now Sender Policy Framework, see http://spf.pobox.com/) was to reduce joe-job attacks. You know, where someone else claims to be you, sends out a massive spam, and then you get to deal with all the complaints, bounces, counter-attacks from people who mistakenly think you actually did it, etc....

Insofar as this goes, that might be a decent goal. Of course, to be useful, everyone everywhere would have to implement the most stringent form of checking. It doesn't do you any good to publish SPF records and not have anyone else use them, or to not have them actually refuse to accept messages claiming to be from you but which do not originate from your designated mail servers.

Unfortunately, a lot of people seem to have latched onto this as the Final Ultimate Solution to the Spam Problem (FUSSP).

There are a lot of objections to SPF, some of which are semi-flippantly addressed at http://spf.pobox.com/objections.html.

If you are the sole owner of your own domain, and no one else is affected, then you can do whatever you want with it. But if there are other users affected, saying things like "just use a different provider", or "just tell the users to configure their client for port 587" are not particularly useful or practical. In many cases, there simply may not be any other options available.


Sites like AOL can use SPF with impunity because they want to force everyone who claims to be user@aol.com to be using the AOL client or the AOL webmail system anyway. This is just another way to enforce that.

But there are too many mail forwarding services and access-only services to make this sort of thing practical on any kind of wide basis. Not only are you talking about changing the way that programs work, but fundamentally changing the way that users work -- always a losing proposition.

Some alternatives to SPF validate both the envelope sender address as well as the header "From:" field within the body of the message, which means that they also break most mailing lists, in addition to everything else. As bad as SPF is, at least it doesn't validate the header "From:" field, so it may break forwarding and aliases, at least it doesn't break proper mailing lists.


Now we hear that SPF and Microsoft's Caller-ID proposals are being merged (see http://spf.pobox.com/slides/thenewspf/). Of course, anyone can claim anything they want in the envelope, as well as in the headers. All Caller-ID does is verify that the "DAVE=" parameter in the envelope matches the "Resent-From:" header in the body -- how hard would that be for spammers to ensure?

If you don't understand the significance of this, read the "You Might Be an Anti-Spam Kook If..." page again.

Of course, modifying all MTAs to support the "DAVE=" feature in the envelope, and getting them to add the appropriate "Resent-From:" header in the body is a much bigger challenge.


Worst of all, SPF is implemented via the DNS. We know that the DNS is a simple UDP protocol, and does not have any inherent security. There are extensions to add security features to the DNS, but they are not widely supported within the implementations, or used in the field. These features are still under development, and while they have a bright future, they are not yet here.

Beyond the security issues of the DNS records themselves, we know that the vast majority of nameservers in the world are set up in highly insecure ways, some of which I highlighted in my invited talk Domain Name Server Comparison: BIND 8 vs. BIND 9 vs. djbdns vs. ??? which I presented at LISA 2002 and RIPE 44.

It would be trivially easy for spammers to poison the cache of nameservers around the world, so as to use SPF as a denial-of-service attack (claiming that the legitimate mail servers for a given domain were somewhere else than they really are), or to make you think that their machines are legitimate designated senders for all domains in existence.

In most cases, they could probably poison the caches of the nameservers for the domains that they are spoofing, so that you get the answer they want you to see, from the machines you should be seeing them from. They could almost certainly poison the caches of any target system that they wanted to send spam to, to make you think that they are legitimate.

To have any hope of this proposal working the way it was designed, you'd have to secure virtually all the nameservers around the world against cache pollution/poisoning.


Trying to add a security feature to one system via a mechanism that is itself inherently insecure and plagued by security problems, is a recipe for failure and disaster.


If you want to use SPF to help reduce to eliminate joe-job attacks, and all the potentially affected users understand all the risks and agree, then you've only got yourself to blame when it blows up in your face. But don't think that this is a panacea.

Indeed, don't think that this will do anything other than cause more harm than it could possibly solve. At least, not until they resolve some of the implementation issues and use more secure methods for reliably transmitting the information they want to publish.

UPDATE 2005-09-05: Early indications are that I was right -- SPF is not a panacea for spam, as many have mistakenly claimed. The Register has an interesting article at http://www.theregister.co.uk/2004/09/03/email_authentication_spam/ quoting a study from CipherTrust with statistics showing that more spam is sent using SPF than legitimate mail.

Now, when are we going to start seeing people talk about technological solutions to a sociological problem in a way that acknowledges the fact that everything in the security business is a balancing act, and that any proposed advance in one area needs to take into account collateral damage possibilities?

My Photo

Recent Posts

Powered by TypePad

Categories

  • Current Affairs
  • Internet e-mail
  • Mobile Connectivity
  • Web/Tech

May 2006

Sun Mon Tue Wed Thu Fri Sat
  1 2 3 4 5 6
7 8 9 10 11 12 13
14 15 16 17 18 19 20
21 22 23 24 25 26 27
28 29 30 31