Work 2 Different Logons (or Sessions) with Private Browsing Modes

Here’s a trick that’s fairly obvious to web developers but probably not so for everyone else.

Private browsing modes – such as Incognito (in Google Chrome) or InPrivate (IE 8) clear out locally stored browser cookies (snippets of tracking data) each time they are run, and do not share cookies with the main (non-private) browser tabs.

Since these cookies are the core mechanism by which web sites associate independent browser tabs/windows with a single user session, the private browsing modes can be used to interact with multiple different logons or accounts at the same time.

How does this work in practice?

Let’s say you want to interact with two totally different accounts (logons) at, say, Gmail, Yahoo, eBay, Orbitz, or some other site. You’ve probably noticed that if you are logged in to, e.g., Yahoo with one browser tab, and you open another window or tab in the same browser, and go to Yahoo, it will “know” who you are and allow you to interact with the same account.

In many cases, this is a desired behavior. But if you want to work with two different Yahoo accounts at the same time, it is quite tricky.

Here’s where the private browsing mode comes in.

Open a private browsing window/tab, and log on to Yahoo with the second account. Since the private tab doesn’t share cookies with the main tab, you now have two interactive sessions with the two different accounts, and they “stay separate.”

There are three catches though:

First, since the private browsing tabs are designed to discard cookies on shutdown, they will “forget” your logon when you close the browser even if you select “stay logged in” on a specific web site.

Second, it is possible (though unlikely) that this mechanism could fail if the site uses “Flash cookies” apart from regular cookies.

Third, while this trick works perfectly well, do not assume that the service you are connected to has no idea what you are doing. They probably don’t care. But if they do care, assume that they could guess that the same user was on both sessions (through IP addresses, NAT port assignment patterns, etc.) at the same time.

Two More Small Tales from the IP Front

There are a small number of areas in which I am an expert, and intellectual property is not one of them. For expertise, I like to refer folks to Mike Masnick and Techdirt.

Nonetheless, it’s hard to move through the technology world and not get bonked on the head by IP absurdities and incongruities calling out for some solution aside from lawsuits and Nancy-Reagan-style denials.

First up is the tale of two Comcasts, and two identical HD streams of Battlestar Galactica. One of these streams comes in via the HD DVR, and the other comes in via Bittorrent.

Actually, I’m leaving a bit of information out in the setup. See, the two HD streams from SciFi channel should be more or less identical modulo commercials. But they’re not.

Due to bandwidth allocation and network management issues, the “legitimate,” paid-for SciFi channel stream is full of bitrate-spike artifacts reminiscent of late ‘90s web video. So the HD channel, the HD DVR, the HDTV gets you … a pretty awful picture the second characters start fighting, running, or blowing things up.

Then you have the Bittorrent stream, ripped from SciFi, and carried in via the same Comcast coax line. This stream looks great, and makes a customer glad to have Comcast and a HDTV. In some strange respect, this latter stream may represent a problem in the “industry’s” opinion, even though it’s clearly what the customer wants and is paying to view, and even though the bandwidth (both instant and aggregate) is a small fraction of that required for the “broadcast” stream.

Next strangeness is Grooveshark, a free, crowdsourced, on-demand streaming service that appears to live on the razor-thin edge of legality if it has a claim on legality at all.

That said, the ability to send (or post/tweet/blog/…) a link that goes directly to a particular song is an extremely potent way to virally spread the music you like. And more music loved by more fans is the core asset base for any music industry, whether it resembles the 20th-century “legacy” record industry or not.

Without Grooveshark, there is always YouTube for sharing instant, no-membership, no-login-required tracks. But unlike YouTube, Grooveshark is structured in a way that encourages more exploration of an artist, album, etc.

So anyone wanna throw into a pool for how long ‘til this service gets shuttered? Wait, that’s not quite legal either. We’ll “just say no” and it’ll all just go away.

Suck Us All Into the Machine: Build FluidDB on Twitter and #Hashtags

I was reading today about a fairly amorphous, tag-based, public "database" concept called FluidDB.

To avoid the usual distractions, I will assume my audience knows all about relational and non-relational datastores, implications of tag-oriented metadata, etc. In fact, since my friends know about this stuff and they are most of my audience, I think I'm not too far afield making this assumption.

One reason I found the FluidDB concept interesting is vanity: about four weeks ago, I spent some time considering building just this kind of database ... on top of Twitter.

Why would one want to do that?

Precisely because Twitter already has a lot of meaningful data curated by humans and tagged with a well-known metadata scheme (hashtags).

In exchange for having very small or hypernormalized data records (since each atomic entry is limited to 140 characters minus the tags and any indexed keys), we get a strange merging of human- and machine-readable data.

Humans could read (and follow, search, etc.) data entities of interest.

And clearly the "goal" of automated (machine) participants (clients) would be to understand as much of the human content as possible, treating it as objects, tuples, logical inferences, or knowledge base "facts."

Moreover, the originator of a tweet, as well as any @-referenced recipients, are critical metadata. They are, actually, tags themselves in way which is linearly independent of the hashtags. That is, a from-@adbreind tweet (entity) marked #database is different from a to/ref-@adbreind tweet marked #database, while #database must be considered to (possibly) have a different sense than it does in, say, a from-@headius tweet. However, the same tools and semantic analyzers can be applied, essentially treating the writer and target of a tweet as special tags.

In this way, our twitter discourse, short enough to make machine understanding tempting even when the packed cultural references make such understanding impractical, merges us into the database and makes us "just another part of the machine."

AT&T “Fixes” My Phone by Downgrading It

I don’t want to be another corpse in the AT&T pile-on. AT&T has many problems, and they impact me, but let’s look at another technical clue about the network trouble:

I stopped in Tuesday at an AT&T store to see if they had any advice or fixes for the network issues plaguing my phone. The only thing the service rep said he knew of was to replace the SIM card. Sure, why not? Can’t hurt anything, can it?

Well the answer to that question apparently depends on whether ditching 3G access counts as “hurting.”

Since I got the new SIM, the phone spends most of its time on the EDGE and GPRS service, and only rarely gets a fix on the 3G service even when I’m in known-good 3G areas.

For a fleeting moment, I thought about taking the phone back and asking AT&T to do something to restore my 3G goodness.

But I quickly realized that the network’s inability to keep the phone on 3G was a big part of the problem. In other words, as so many iPhone users have discovered, staying on EDGE is better than flitting between EDGE and 3G and getting nowhere. Likewise in the case of EDGE and GPRS.

So for now, I’ll take my retro GPRS and its 50kbps or so of throughput. Since the setup and teardown of the data connection, as well as the latency in repeating a request, are the slowest part of the process, I’d rather use dependable 50kbps connection over an unstable, unusable 500kbps one.

Until I get a network that actually works, that is.

Link: An Illustrated Brief History of Augmented Reality

Check it out.

Plus who knew that Philippe Kahn invented the camera phone?

Apparently, a lot of people, just not me. The guy is so awesome.

Microsoft’s Real Punishment is Having to Fight with the Gloves On

By the time the Microsoft anti-trust cases wound down, it could be argued that the alleged damage was long since done to the industry.

In a curious reversal, it appears that Microsoft’s direct penalties from the case were only a tiny beginning.

The real penalties Microsoft pays are not in money, nor in shipping “K” and “N” SKUs. They are in product strategies unpursued because they would be too provocative. In other hands, such strategies  might be reasonable if aggressive, but for Microsoft they might look like “relevant conduct.”

Today’s announcements about Office 2010 (“14”) were … well … let’s just say if you didn’t read about it, the most interesting thing you missed was seeing critics point out that Microsoft, inventor of AJAX (literally, for the Outlook web client), is only bringing other apps online 10+ years later.

The reasoning here is not about selling client OS licenses. Microsoft could have moved to the cloud richer and faster and more profitable if it could take the gloves off.

Need to get Silverlight penetration up from its abysmally low numbers to where it can really compete with Flash and become a meaningful platform? Just ship it with Windows and make it a priority update to every Windows box in the world. Problem solved. Now we can get down to the real work writing apps. Or at least Adobe could actually face some competition. But Microsoft doesn’t dare do this.

Why not stitch cloud storage directly into the OS? I hate leaving files “on the other machine.” Right out of the box, anytime I see an “Open…” or a “Save As…” dialog box on Windows 7, I would like the default destination to be a secure folder on Windows Live SkyDrive. Using the provider pattern, other vendors could offer a similar service, and the end user could choose. But Microsoft doesn’t dare with this either.

It is quite possible that the long-term benefit to the industry of having Microsoft thus restrained far outweighs the “lost” value we could have had from Redmond. But let no one fool himself into believing that what we see from Microsoft these days is everything they have to offer.

VncSharp Rocks for Programmatic and Interactive Remote Access from .NET

VncSharp is a C# implementation of the VNC protocol together with a handy visual Remote Desktop .Net widget.

At first, the open-source VNC remote-access solution might seem like a surprising item to need in a Microsoft-based solution.

But once he gets you in the little room, VNC starts telling you that, in exchange for lower performance (than Microsoft’s own RDP), he can get you more flexibility, more features, no licensing issues, and access to remote Macs or *nix hosts. After these arguments (or is it the heat?) VNC looks a lot more persuasive.

Throw in the fact that you can run your VncSharp-enabled apps on Mono, and … well, it would be cool if that bought you a lot. But actually if you aren’t already focused on a Linux solution then the Mono angle is just another bullet.

VncSharp itself, though, works extremely well straight out of the gate.

When you see the documentation page – where the author essentially invites you to read the source to figure out how to drive it – you may be concerned. Or even start to form silent curse words with your lips.

Do not let that stop you. There are demo/sample apps that will show you what you need for basic use cases (e.g., popping open a “remote help” window will only require a line or two). And the source, if you need it, is elegant and straightforward to navigate.

A programmable VNC client is, perhaps, a niche product. VNC on Windows maybe more so. So it’s gratifying to see such a mature and streamlined OSS effort.

Can iPhone et al Drag Augmented Reality Into Non-Augmented Reality?

I’ve been pitching augmented reality apps in startup circles for a few years now, so it was exciting to see the AR startup crop grab some press coverage this week (VentureBeat and more VentureBeat and …even SF ABC 7).

With the iPhone hardware suite (and comparable devices like the Android and Pre), there’s no shortage of hardware for the core AR tasks:

• capture decent-resolution images
• recognize “target” areas in images
• contextualize the targets if necessary, by adding GPS data, solid-state compass data, and/or accelerometer (angle) data
• lookup augmentation data suitable to the target and the end-user via suitable web services
• employ “billboarding” or 3D rendering to composite a representation of the augmentation data on top of the target
• repeat as fast as possible without draining the battery (yeah, right)

Now for part two of the plan: this facility needs to run through a cool looking visor (a.k.a. "head-mounted display” or HMD). And neither the $6,000+ price tag nor the Silence-of-the-Lambs-night-vision look is appealing on these traditional high-tech units.

Happily, there are mass-market headsets designed for the gaming or personal entertainment market which are almost ready to go. A couple are even within striking distance of cool factor. Maybe an Apple logo would be enough to do it, at least for the Bay Area.

Even better, leaders such as Vuzix recognize the need to provide video and accelerometer data from the POV of the headset (vastly reducing the amount of computation needed contextualize the image). They appear to be planning these capabilities as optional clip-on modules to their newest “Fall ‘09” model visor.

Note the word “planning.”

Like smartphones themselves, we’ve been here before … a lot of times. The iPhone was easily the industry’s 10th attempt at a commodity handheld computer, so it’s not like the writing is on the wall. Unless it’s AR writing:

Workaround for Some Instances of Win 7 WiFi Problem

One of the very few real broken bits in the Win 7 RC is a WiFi problem. The current thread on Microsoft TechNet is here.

On at least a few laptops, the following is a dependable if annoying workaround.

1. Turn off the WiFi with the laptop hardware switch (“airplane mode”)
2. Open Start –> Computer –> Manage –> Device Manager –> Network Adapters
3. Right-click and disable the wireless adapter
4. Wait a bit and verify the OS has completely lost the wireless adapter (by watching the icon in the tray)
5. Turn on the WiFi with that hardware switch
6. Right-click and re-enable the wireless adapter
7. Wait … potentially a couple of minutes for Windows to find the appropriate network, connect, and recognize the route (if applicable) to the Internet

This maneuver is a hassle, to be sure. But it seems to work 100% of the time on some laptops (including mine) and it is much more convenient than rebooting, which is the only other dependable solution.

iPhone and Palm Pre – the Obligatory Post

I’ve had my paws on the Pre, and while I have not, of course, gotten hold of a 3GS, it doesn’t really matter.

See, getting my hands on a 3GS might convince me it has a better hardware/software experience. And since the 3G already has a better hardware/software experience than the Pre, I’m going to call it a “gimme” for the new 3GS.

The Pre, for all of its clever conceits compared to most phones, is still clunky, hiccup-y, and jittery next to even the current iPhone model. The graphics aren’t as smooth, the UI is harder to use, the physical keyboard is marginal, and on and on.

On top of that, it is hard to overstate how important the app ecosystem is to this “competition,” and Palm doesn’t even seem to be trying (they’re still saying “real soon now” on the SDK).

No matter how many apps in the App Store are just fart apps, and no matter how beautiful the bundled apps on the Pre are, there is no contest because these guys are playing different games.

Apple has succeeded in making the phone a general computing platform in the mind of the public – something I argued for 3 years ago – and you judge a platform not by its internal specs but by what you can run on it. Palm doesn’t seem to get that. They’ve got a decent bundle of specs but there’s nothing to run on it and there may never be much.

So with Apple still killing in the UX department, and Palm leaving their A-game at home (if they ever had one) as far as the app/platform/dev community goes … is there anything positive to be said for Pre in this contest?

Only this: AT&T’s network is so egregiously ill-behaved in so many prime metro areas that Sprint could actually pull a few people across the line.

I am one these last folks: I would much rather replace my current phone with an iPhone, but the thought of another two years of dropped calls, missed calls, bars-but-no-coverage, data connection unusable half the time … and I’m seriously considering the Pre.

Say what you will about Sprint (I’ve used every major carrier and none is perfect), where they have coverage, the devices just work. You can make or take a phone call. Which, ironically given that smartphones are bordering on augmented reality nowadays, is still the sine qua non for a phone.

Windows 7 RC, One Month In

A month ago, not long after the RC was released, I wiped my ol’ Server 2003R2 notebook (yes), and installed Win7 x64. Time to try a consumer OS on the machine again, finally go 64-bit, and jump without a net (I had a big client demo coming up and decided it would be sink-or-swim with 7).

First, a word about this laptop. Bought in the holiday sale period of ‘07 just for client demos and occasional web surfing, it would take a whole new, um, “lower end” category of Microsoft “Shopper” commercials to capture the spirit of this baby: for $299 I got a mobile Celeron (1.6 GHz, one core, no HT) and 512MB of RAM. Billed as “Vista Basic Ready,” it was being discontinued due to … not really being Vista Basic Ready. Well, duh. I had given up on Vista after my 3.6GHz desktop choked on it, so I put another GB in the laptop and loaded Server 2003R2 (using unofficial XP drivers I grabbed off the net).

So … Windows 7.

Upon install, all of the hardware was supported perfectly, which isn’t a huge surprise since 7 uses Vista-era drivers and this hardware ensemble was originally targeted for Vista.

Except for a compatibility issue with AVG Anti-Virus (which I’ve written about before), it has worked almost perfectly with everything I’ve thrown at it – ranging from Office and Visual Studio 2008 to Alfresco Enterprise (yes, a Java server app), Google Earth, and Ruby. Overall performance has been excellent and better than I would have expected. No, I wouldn’t play games on this machine, and the 5400-rpm hard drive can be a drag just as it is on most laptops.

The two big negatives I’ve seen are as follows and will hopefully be fixed by RTM time.

First, there is a well-documented issue with WiFi. On a cold boot, Windows does just what you want it to do with the WiFi. But, after waking from sleep or hibernate, or trying to switch networks a few times, it just cannot seem to sort itself out. Most of the time you are forced to reboot to get a working connection. This bug is all over Microsoft’s Win 7 feedback forums, I’m just too lazy to look up a link right now. So hopefully it will get a fix.

Second, the integration with other default browsers (I use Chrome) is broken in a bunch of places. Many of the cases where the shell is called to supply a browser to a specific URL do not work (e.g., menu options in twhirl, connections to the web from Office Live). In addition, Windows doesn’t want to associate local .html (or .htm) files with Chrome. Sometimes I can get these things fixed, but then they revert (perhaps partly a result of Chrome’s auto-updates).

These cases all work fine on XP and don’t require in-process loading (suggesting it’s not a x86/x64 issue). It’s inconvenient, and the anti-trust folks will be back after Microsoft if they don’t make other browsers first-class citizens soon. So this bug should get squashed.

Aside from those two admittedly very annoying issues, this is a really solid, fast, and elegant operating system. How serious is the “Microsoft tax” issue on OEM PCs? I don’t know, but if I do pay such an implicit tax on a new machine, I’ll be a heck of a lot happier if I can get a Win 7 license out of the deal and not a Vista license for my trouble.

Mark Process for x86 to Use Skype API or Topaz SigPlus API

If you happen to be integrating your Windows app with Skype's COM bridge, or with Topaz' SigPlus API for their biometric digitizing signature pads, those libraries won't play nice if loaded from an x64 process.

The easy fix -- assuming you don't have dependencies that mean you need x64 -- is to create a build configuration for your main app that specifies a target platform of x86 (instead of "Any CPU"). The resulting app will run in WoW (the 32-bit shim for 64-bit Windows) and works fine with these libraries.

The hard fix would appear to be using IPC to coordinate two different processes: your main app in x64, and a proxy/helper 32-bit process running in WoW that works these DLLs for you.

Those Little Shape Widgets in VS2008 Require Deployment

The Visual Studio 2008 SP1 control palette has a few "shape" widgets -- Rectangle, Oval, Line ... which come from a "Visual Basic PowerPack" library: Microsoft.VisualBasic.PowerPacks.Vs.dll

If you use these, you need to deploy the library manually with your application. That is, an up-to-date .Net 3.5+ machine will not have the library available globally, and Visual Studio will not mark this DLL to be copied into your output folder.

I haven't checked to see whether the VS Installer project will determine the dependency and include it -- I'm guessing it will. But if you are doing xcopy deploy, or just testing, you will need to bring this library along.

There is also an earlier version of this same library, that shipped on VS2008 but will not work (it is missing some components that were added to the namespace later). So if you need to build against the current version (e.g. if you are working on code that uses the shape components), make sure you update to VS2008 SP1, which updates this library.

Windows 7 and AVG == Unhappy CPU Usage

The title pretty much says it all.

Backstory is that I ran Windows 7 in a VM without any anti-virus while doing some evaluation, and I was impressed by how sparing it was of resources.

Then I installed the RC on my (underpowered old) laptop, figuring it would be a good replacement for Server 2003 (which is resource efficient but not exactly designed for laptops).

The RC used somewhat more memory -- it appears to be able to adjust its memory footprint depending on the host hardware, which is cool -- and a ton more CPU.

The CPU usage was suspicious because it's rare to find software that consistently pins a CPU with actual work, and because the usage was high priority -- coming from kernel space or a library tied tightly to kernel hooks. It was also suspicious because Microsoft plans to sell a version of 7 on netbooks, which are even more underpowered than my two-year-old bargain-o-matic laptop.

Turns out AVG, generally a fine anti-virus product, struggles with Windows 7 and often insists on every available CPU cycle, while the end user sits there wondering why context menus won't even open anymore.

After a bit of Googling, I removed AVG and installed Avast, and 7 is screaming along on the laptop now.

Note the retroactive Windows 7 hardware subsidy: this laptop was discontinued by the manufacturer in '07 because it shipped with Vista Basic but proved so slow as to be completely unusable in that configuration. The new OS basically injects value into the old machine.

Bonus Security Credit for Google Chrome’s Strange Install

Last fall, many folks including myself commented about Google Chrome’s unusual install behavior. Our best guess at the time was that it represented an attempt to accelerate adoption, by allowing non-administrative users to install Chrome.

It also allowed lower-privileged domain users in corporate environments to install and use Chrome unless their IT specifically blocked it.

With this recent Chrome vulnerability and rapid patch cycle, though, I’ve come to see the install in a new light.

Firefox requires an admin to initialize an update. This can be done through programmatic remote admin or right on the console, but still requires intervention. IE can be updated via Windows auto-update, but if auto-update isn’t set to run or if a specific patch needs to be applied, it requires intervention. Chrome, on the other hand, will update itself on the fly for each user’s install (it does require a restart, but only of the Chrome app) unless the installer is cracked to remove the GoogleUpdater component.

Given the cost of having an out-of-date browser version versus the risk of having Chrome updated without admin knowledge … I have to say I like this approach.

Notebarn Update

Notebarn, my Windows Mobile / Exchange sync notes app, definitely looks like an archaeological relic these days. Dating from early ‘07, before the iPhone era, and being a simple text utility, it is almost comic how it doesn’t resemble modern mobile apps.

That said, I still use it, and it turns out a lot of other people have been using it too. So when a user helped me reproduce a tricky timing bug that could cause data loss under certain circumstances on app initialization, I hopped back into the old (and quite small) codebase to fix it.

There is a little more info on the notebarn project page. Or if you just want to install the app you can install it over-the-air from here. If you already have the app it will automatically install in-place over your existing version. And since the “notes” are actually stored in an Outlook/Exchange Task, the install won’t affect existing data.

A word about backups: notebarn doesn’t have its own data backup mechanism. There are two main approaches to backing up and recovering data if you should lose it for any reason (e.g. problem with notebarn, problem with ActiveSync, accidentally deleting a note you needed, etc.)

One is to lean on whatever backup solution protects all of your Outlook/Exchange data, since notebarn data is really Outlook data. If you can go back to a backup snapshot of this data, even temporarily, you can simply grab the notes data from there. If that’s not practical, you can either manually or via a script back up the “My Notes” item from Outlook tasks, into another place in Outlook, the filesystem, etc.

Google “Similar Images” Roadmap

Ok, it’s not their roadmap, it’s my roadmap.

I was psyched to see the Similar Images announcement today, but I was underwhelmed by the results. That’s ok, it’s helpful, it’s free, and here is the post where I explained how to build the rest of it.

Oracle and Sun: Cui Bono?

Well, here’s a hint: it’s not Oracle, “Sun,” Java, or MySQL in the long run.

I’m thinking the Ruby, Python, and PostgreSQL worlds just got a shot in the arm, as this is minor calamity (at least) for Java, and a major one for MySQL. Ironic, since Java maturing like a fine wine and recovering from early-decade blunders; MySQL was already in trouble thanks to Sun.

As for benefits, it’s also not Google, who relies heavily on Java but could eventually find itself in an adversarial relationship with Oracle as enterprise computing moves to the cloud. Google does have enough sheer wo/manpower to exploit the OSS licensing on Java to take it in its own direction if necessary … but is that really a desirable way to go? or one the investors can live with?

I don’t think Microsoft minds this one bit either … since there was nothing that that Java, Oracle, and their communities (and users) couldn’t do before that they can now, while a number of scenarios (Java and open source databases/appservers in the enterprise) suddenly become just a bit murkier.

Atalasoft: Another Example of Gnarly DRM == Lost Sale

I’m working on a project that involves semi-automated document imaging. Scan, deskew, crop, re-arrange …

It’s on Windows, where every modern scanner hooks into both TWAIN and WIA out of the box, often without even needing a vendor driver, so I just needed a library/toolkit to do the lifting on the app logic side.

Enter Atalasoft DotImage imaging libraries. Does everything you need, works fairly well. Established presence in the market. We start heading in that direction. The Atalasoft bits we needed turn out to be pricey as components go, and we would need a runtime license as well as the development license – but this is a commercial project the success of which would not be diminished by the software costs. So we didn’t blink at the price.

We downloaded the dev SDK, implemented a few features … and we needed to show them to customers. In other cities on other machines. Well, the dev SDK is crippled and doesn’t allow that.

Atalasoft’s sales department generated a 30-day license for me, and sent me the instructions to install and deploy it. And … it half worked. Some machines could run the deployed app. Other machines, the app would crash when the relevant DLLs tried to load, despite deployment of the magic binaries, license files, and other DRM voodoo.

For a brief moment, I thought maybe my app is just broken … but, upon attaching a debugger, I saw that all of these crashes threw the same error. And, since it was .Net, the error was in plain English: Atalasoft’s licensing module was barfing and taking the whole app down.

At that point I could have spend more critical hours trying to navigate around these problems (I’m guessing their pre-sales tech support would have tried) … but … wouldn’t you know it, here is another company offering a similar library, much more agreeable terms, 30-day trial and a seemingly foolproof license key mechanism.

Download, type type build deploy. Success. Haven’t looked back.

Now it’s also convenient that this other product seems to work a little better, has more agreeable legal terms and costs less. But those were not dealbreaker criteria at this stage.

I would never have even gone down the list to this other vendor if Atalasoft’s DRM hadn’t broken my tight-deadline customer demos.

Facebook “Private” RSS Feeds Probably Don’t Leach Data…

Last year I experimented with private group microblogging systems via authenticated feeds. Didn’t go anywhere, because many of the biggest newsreaders don’t properly support authenticated feeds. And “obscure but public” feeds get indexed by aggregators like Bloglines, by design, making sensitive content much less obscure.

Enter feed access control, a several- (3-?) year-old RSS/ATOM extension that tells Bloglines, and anyone else who is listening, that this feed should be treated as private, even though it’s public.

Facebook’s feeds are intended to support this protocol:

Which seems reasonable enough.

There are a couple of issues though. First, this approach is based on a third-party’s positive action to prevent or “opt-out” of publishing and indexing, in a system that normally defaults to syndication, indexing, etc. So it’s easier for a glitch to expose data.

Second, the whole “fac” extension is a gentlemen’s agreement among parties that couldn’t even agree on making authenticated feeds work well. Perhaps they all make a best effort to isolate the marked content. But tomorrow, a startup with a rocking aggregator could simply ignore “fac” and expose all of the feeds it has.

In some sense, the same vulnerability exists with other systems – if you signed up with some random webmail provider, who’s to say they don’t expose your mail. But because RSS is public by nature, almost all feeds live utterly unprotected, and this extension is one vendor’s hack, it’s not quite the same.

All in all, probably not a big reason for concern. But when people tell me how private things can be on facebook (where you can sneeze and end up revealing your data because the IxD is tilted so heavily toward sharing everything) it always seems worth noting how your data (via your friends’ feed subscriptions) can slowly leach out into the open ocean of the indexed net.