Advogato blog for adulau

2008-09-13 The Corporate World Should Learn From Internet

Sat, 13 Sep 2008 16:04:39 GMT

The Corporate World Should Learn From Internet

A recent blog post of Alex Schroeder about corporate wikis and my comment on his post, remind me of a post I wanted sometimes ago to make about the difficulty for a corporation to learn from Internet. Internet, beside being a big mess, works often better to manage large volume of information and on-line/distributed collaboration than any other internal company designed software/process. I don't really want to understand why it is the case on Internet maybe due to the "trial-and-error" approach with the continuous feedback (well described by Linus Torvalds in this post about Kernel's evolution). I just want to point some areas where the corporate world could learn from Internet to avoid classical pitfalls.

Start Small And Prototype Early (And Forget All Those Bloody Requirements...)

As nicely and visually explained in the post about corporate Wikis from Alex Schroeder, new software project in a large corporation often start by accumulating all the requirements from the "stakeholders"(in other words : anyone that could be affected by the introduction of the new project). But does it work in practice? From my small experience on the subject, I tend to say "not at all". First, it's usually impossible to find any (free or proprietary) software that meet all the requirements. In such situation instead of throwing away some requests from the "stakeholders", the software project is trying to extend the software to meet all requirements. That generate unrealistic requests like modifying existing software (the famous "small customization"), creating software from scratch, over extending a work flow to match those crazy requirements or worst making a two hundred pages requirements document sent to a software engineer already working on 10 "corporate" projects.

Successful Internet projects often take the opposite approach by starting something small and doing it well. The first release of del.icio.us was simple and clearly focusing on a simple multi-user bookmarking service. But it worked. Various Internet services started very small due to their small asset and money constraint. Starting small with a really focus objective limit the risks of creating a monster that no one want to use. If it fails, you start a new project. On Internet, failure is accepted and welcome. Especially that helps (only helps ;-) to avoid repeating the same failure and experimenting other ideas that could fail or work well.

Companies should look more into this approach of creating very small project, through away "consensus among all the stakeholder" and implement ideas by prototyping early. I know that's not an easy task in the large companies especially changing (read killing) the approval process of companies (often good Wikis don't care about approval as described in Why it’s not a wiki world (yet)) or the hiding failure as default policy and we don't code we just make meetings. Don't take me wrong, I'm not trying to say that everything is broken in companies. But they should start to understand they are not living in island and they can gain a lot from Internet practices inside the companies.

This post is somehow related to a previous stacking idea page about how to better operate a company.

Tags: company startup innovation internet wiki

2008-09-09 Hack Lu 2008

Tue, 9 Sep 2008 20:04:08 GMT

The 4th edition of the security conference hack.lu 2008 is on a good track. The plenary agenda is now on-line with plenty of interesting talks. If you want to join us in this information security delirium, there is also the hackcamp/barcamp. A space where more spontaneous discussion/demo can be held. If you have some crazy ideas or demos that you want to do in information security area, the hackcamp/barcamp is the right place. On the organization side, everything is going well except the standard glitches…

Tags: hacklu infosec

2008-08-19 IPv6 Usage Is Growing

Tue, 19 Aug 2008 21:07:38 GMT

Looking at the recent "article"/post in slashdot about IPv6 claiming that its use is not growing, I do not agree especially when I saw the latest IPv6 statistic from AMS-IX : The usage is growing, more and more ISP announces their IPv6 prefixes and start to connect their customers. By the way, I will add an AAAA record for my webserver this month. IPv6 is real, working and its usage is increasing. Sure it will take time but it's time to jump…

Tags: ipv6 internet

2008-08-16 Operating Systems Always Need Git and GNU Screen

Sat, 16 Aug 2008 09:03:57 GMT

Following a micro-discussion with Michael about the software that you always need on your favorite operating system, we came to a similar conclusion : Git and GNU Screen are the must. Without them, your favorite free operating system looks useless. Of course, if you want to be ahead and always have the latest version of Git and GNU Screen in your ~/bin, there is a an easy way : Git 1 ;-)

#!/bin/bash
# assuming a cloned repository of GNU Screen in ./screen

cd ./screen
git pull
SCREEN_VERSION=`git-show | head -1 | cut -c8-`
git archive --format=tar --prefix=screen-current/ HEAD >../../down/screen-current.tar
cd ../../down
tar xvf screen-current.tar
cd screen-current/src
sed -e s/devel/${SCREEN_VERSION}/ patchlevel.h >patchlevel.h.tmp
mv patchlevel.h.tmp patchlevel.h
./autogen.sh
./configure --prefix=${HOME}
make
make install

As GNU Screen development is hosted in Git, you can use Git features like commit ID to generate the version. That makes easier to know exactly which version you are running when reporting bugs. I also used a similar approach for Git. And you? What are our favorite two software that make an operating system useful?

Tags : git gnu_screen scm gnu

2008-07-21 Killing Usenet Is A Bad Idea

Mon, 21 Jul 2008 11:14:17 GMT

In a recent news from the EFF, there is an increase to limit the use or block access to Usenet by some ISPs. But NNTP and Usenet can be still useful for new technologies, a nice example of a NNTP server plug-in in a wiki. In such case, you can benefit of Usenet threading using a standard Usenet client or distributing RecentChanges RSS feed in a more efficient way than regularly fetching RSS feeds via HTTP. Old is new and new is old… don't kill the Usenet infrastructure that could support the next interactive business.

Tags: internet freedom wiki usenet

2008-06-23 Hardware Random Number Generator Useful

Mon, 23 Jun 2008 15:09:12 GMT

If you have a system machine generating various cryptographic keys, you really need a non predictable state in your entropy pool. To reach a satisfied level of unpredictability, the Linux kernel gathers environmental information in order to feed this famous entropy pool. Of course gathering enough unpredictable information from a deterministic system, it's not a trivial task.

In such condition having an independent random source is very useful to improve unpredictability of the random pool by feeding it continuously. That's also avoid to have your favourite cryptographic software stopping because lacking of entropy (it's often better to stop than generating guessable keys). In the graph below you can clearly see the improvement of the entropy availability. On an idle system, it is difficult for the kernel random generator to gather noise environment as the system is going in a deterministic way while doing "near" nothing. Here the hardware-based random generator is feeding regularly the entropy pool (starting end of Week 24) independently of the system load/use.

If you are the lucky owner of a decent Intel motherboard, you should have the famous Intel FWH 82802AB/AC including a hardware random generator (based on thermal noise). You can use tool like rngd to feed in secure way the Linux kernel entropy pool. In a secure way, I mean really feeding the pool with "unpredictable" data by continuously testing the data with the existing FIPS tests.

That's the bright side of life but I would close this quick post with something from the FAQ from OpenSSL :

1. Why do I get a "PRNG not seeded" error message?
... [some confusing information]
All OpenSSL versions try to use /dev/urandom by default; 
starting with version 0.9.7, OpenSSL also tries /dev/random 
if /dev/urandom is not available.
... [more confusing information]

If I understood the FAQ, by default OpenSSL is using /dev/urandom and not /dev/random first? If your entropy pool is empty or your hardware random generator is not active, OpenSSL will use the unlimited /dev/urandom version and could use information that could be predictable. Something to remember if your software is still relying on OpenSSL.

Update on 03/08/2008 :

Following a comment on news.ycombinator.com, I tend to agree with him that my statement "/dev/urandom is predictable" is wrong but that was a shortcut to urge people to use their hardware random generator. But for key generation (OpenSSL is often used for that purpose), the authors of the random generator (as stated in section "Exported interfaces —- output") also recommend to use /dev/random (and not urandom) when high randomness is required.

That's true when you are running out of entropy, you are only depending of the SHA algorithm strength but if you are continuously feeding the one-way hashing function with a "regular pattern" (another shortcut). You could start to find problem like the one in the linear congruential generator when the seed is one character… But that's true the SHA algorithm is still pretty secure. So why taking an additional (additional because maybe the hardware random generator is already broken ;-) risk to use /dev/urandom if you have already a high-speed hardware random generator that could feed nicely /dev/random?

Tags: kernel linux security random prng hrng

2008-06-15 Internet Liberties Still In Danger

Sun, 15 Jun 2008 18:03:52 GMT

Everything started when government tried to limit the liberties on Internet, the first major case was the Communications Decency Act. The famous blue ribbon campaign of the EFF started due to that legal non-sense in 1996. We thought that we were safe from such stupid regulation in the cyberspace when the US supreme court admitted that the Communications Decency Act was mainly unconstitutional. But the history proven the opposite, governments are continuously trying to limit civil liberties on Internet (and not only in China). It's a fact and seeing such intensity from government to limit our rights in a space where freedom is there by nature, I really have a confirmation (by repeating so many times so many legal trick to achieve a complete on control on Internet) that's an intended purpose to limit our freedom space.

Hopefully there are still an active (from scientific to citizen) community where interesting paper came such as : Cassell, Justine, and Meg Cramer. “High Tech or High Risk: Moral Panics about Girls Online." Digital Youth, Innovation, and the Unexpected. An interesting part is the comparison with telegraph and telephone. The conclusion of the paper also showed the danger of the "moral panic" for women :

And in each case that we have examined, from the telegraph to today, the result of the 
moral panic has been a restriction on girls’ use of technology. As we have described above, 
the telegraph, the telephone, and then the internet were all touted for how easy they were for 
young women to use, and how appropriate it was for young women to use them. Ineluctably, 
in each case, that ease of use and appropriateness became forgotten in a panic about how 
inappropriate the young women’s use of these technologies was, and how dangerous the 
women’s use was to the societal order as a whole. 
In the current case, the panic over girls’ use of technology has taken the form of believing 
in an increased presence of child predators online. But, as we have shown, there has been 
no such increase in predatory behavior; on the contrary, the number of young women who 
have been preyed on by strangers has decreased, both in the online and ofﬂine worlds.

Finally, as with uses of communication technologies by women in the past, it is clear 
that participation in social networking sites can fulﬁll some key developmental imperatives 
for young women, such as forming their own social networks outside of the family, and 
exploring alternate identities. Girls in particular may thrive online where they may be more 
likely to rise to positions of authority than in the physical world, more likely to be able 
to explore alternate identities without the dangers associated with venturing outside of their 
homes alone, more likely to be able to safely explore their budding sexuality, and more likely 
to openly demonstrate technological prowess, without the social dangers associated with the 
term “geek.” And yet, when moral panics about potential predators take up all the available 
airtime, the importance of the online world for girls is likely to be obscured, as are other 
inequalities equally important to contemplate.

But obviously, I'm still very affected by the continuous flow of bad law (like the recent one from France) or action like blocking Usenet. Do they want to turn Internet into an useless medium where free speech is banned ? and an Internet where so many technical restriction implemented, it becomes impossible to use it.

Tags : freedom internet

2008-05-24 My Git To-Do Process

Sun, 25 May 2008 15:10:00 GMT

Until very recently, I was using a mixture of text files to maintain a to-do list across my various activities. The problem is some of my to-do and activities are linked and I needed a kind of permanent access to those lists while at work, home or travelling/moving. I also needed to update the list off-line and with the ability to merge them easily. That was working but not perfect and sometime messy.

I found an updated version of the famous todo.txt (a bash script to maintain plain text to-do list) called git-todo.py hosted at (gitorious.org). After a simple test, I decided to move all my to-do lists, idea lists or n lists to git-todo.py. The major work was to recreate all the lists using the simple format of todo.txt but that was straightforward.

So I "centralized" (a big word for a distributed SCM ;-) everything around the to-do master git repository accessible via Internet, nothing really exotic. I have some basic script to always merge the master when I'm starting to work to be sure that the local branch is up to date.

My daily process is roughly described in the diagram but the idea is there. I mixed all my various lists and used the format of todo.txt to tag the entries. That permits me to recover some old ideas lost in my previous messy format. Another big advantage of todo.txt is the ability to change child/parent for each entry. Very handy when you see that a project is going nowhere without making other tasks before.

I have also included the daily idea list where I'm just listing crazy idea coming in my mind or after discussions with a friend or a colleague. That's a way for me to keep a kind of imaginative playground along with more raw task to be done. When an idea is becoming a task (that's often a good news), I just add a tag to link the idea with the current project to work on.

Tags : gtd git todo scm idea

2008-05-12 Wiki Creativity Metric An Experiment

Tue, 13 May 2008 00:05:47 GMT

Following my past blog entry why creativity metrics are needed , I quickly made an experiment called Wiki Creativity Metric to monitor the activities of some well-known Wiki talking about Wiki (from technology to the use of them). The idea is to have a more positive approach to metrics where we can have more influence. Let's imagine that you have seen that the WCI was down yesterday, that's maybe the time to contribute more to CommunityWiki. If our world is overflowed with today's metrics, indices of all kind, why not inventing our metrics to make the world more free and better. I updated the graph following the excellent feedback from Jean-Etienne Poirrier.

Tags: metrics creativity positivism wiki freedom

2008-05-11 GPL is not always the GNU General Public License

Mon, 12 May 2008 02:05:52 GMT

GPL is not always standing for the GNU General Public License… as this seen on a flower label. It's a company doing "plant novelty rights" called GPL international (http://www.gpl.dk/). They are clearly going into the opposite direction compared to the freedom defined in the well known free software license called GNU General Public License.

By the way, if those osteospermum flowers are not F1 hybrid we will be able to keep some good seeds and copy (doing multiplication) of the plant. It's the right to nature to reproduce itself. It's the first time I see a company trying to disallow the gardener (as described on their labels, check the photo below) the multiplication of the plant purchased.

Tags: freedom biology gpl gnu license nature gardening seeds biodiversity