Reverse Engineering: Finding the (Not So) Secrets of javaxnet10.dll

When I was restoring my Blackjack from backup last week, I noticed a file with an interesting name in the Yahoo! Go application folder: javaxnet10.dll

Eh? ... some kind of Java library? or a JVM? or maybe just a Microsoft runtime DLL for using J# with the .Net Compact Framework? Running J2ME apps on .Net CF would be a kind of cool... Ok, off to Google. A Google search for "javaxnet10" (over the web and newsgroup archive) produces several links to this single discussion thread where someone speculates on this exact question.

So I did some research. I'll save my conclusions and speculation for my next post; here, I'll tell you how I did my 10-minute analysis of this app. Old news to Win32 developers, but I think there may be a few .net/mobile/Web2.0 devs out there that might find this useful.

First, I used ActiveSync to pull all the DLLs and EXE for Y!Go off of my phone and onto my desktop. Then I right-clicked on the files to see if there was any metadata I could view that way. There was nothing -- either because it wasn't published, or it was removed at some point.

So I opened up a Visual Studio command prompt and cranked up dumpbin.exe. Dumpbin is a command-line PE format file processor. Since Windows Mobile is built on Windows CE and uses PE format for binaries, dumpbin doesn't care that these files are for a phone with an ARM processor rather than a desktop with an x86. Dumpbin will tell you which libraries a file loads, what it exports for other files to use, and all kinds of other fun stuff, including disassembly and -- get this -- it will disassemble an ARM binary into ARM assembly (the register names are the giveaway). I wonder how many instruction sets it understands?

But that's not relevant here because javaxnet10.dll is not a native code library at all.

It's a .Net assembly. How do I know? It reports a single import of mscoree.dll. mscoree.dll, short for "Microsoft component object runtime execution engine" is the .Net virtual machine. Or, as Don Box more poetically put it, "mscoree is the last COM DLL." He meant that metaphorically, not literally, of course. "mscorlib," he continued, "is the first .Net DLL," since that's the base library that mscoree loads to do anything useful.

Ok, let's look at all the files from Y!Go and see how they break down: javaxnet10.dll is .net, platform.dll is .net, ygonet.exe is .net, interop.dll is native (it imports a handful of OS binaries, and not the .net runtime -- try dumpbin /dependents to see).

So this is looking like a .Net CF app, with a native interop helper library for things that are hard or impossible to do with .Net CF. But we still haven't answered the question of what javaxnet10.dll is about.

Since it's a .Net assembly, we can bring in the magical MRI machine of dot-net, Lutz Roeder's .NET Reflector. This tool is an amazing free application that allows you to fully explore the insides of a .Net assembly, from the class-and-namespace level down to full decompilation. And, since .Net IL is much richer in metadata than native assembly, the decompilation produces intelligible code in the .Net language of your choice!

Point the .NET Reflector at javaxnet10.dll, and the mystery is revealed: it's an implementation of most (maybe all) of the J2ME and MIDP APIs. It does not run Java bytecode (it's not a JVM, interpreter, or cross compiler). Instead, it implements Java platform interfaces the way WINE implements Windows APIs. Here's a screenshot... the namespaces read like a tour of the MIDP API.

Just to confirm our understanding, we can basically browse the source of the whole application, and see the use of Java types and patterns everywhere. For example, StringBuffer is the classic Java equivalent of .Net's System.Text.StringBuilder. Although the waters have been muddied with the recent introduction of a Java class called StringBuilder, J2ME/MIDP predates that API by years. Which is to say, if the app were being written in a .Net CF style, we would see StringBuilder in high-level functions even if Java libraries were leveraged down below. In a Java mobile style, we'd see StringBuffer. The fact the we see StringBuffer (and many similar cases) argues that, in fact, this is basically a Java app. Heck, com.yahoo.go.app.YGo extends javax.microedition.midlet.MIDlet.

'Nuff said. Next time, we'll talk about the significance or usefulness of our discoveries, and where javaxnet10.dll might have come from.

Show Up for Class, Learn the Questions on the Final (or Interview)

Even though I went to the University of Chicago, unofficially known as the place "where fun comes to die," some profs had a sense of humor. Physics professors would sometimes "joke" about the sort of problems that would likely appear on the final, and the joke was that those problems (or nearly identical ones) would appear on the final. If, even with the hint, you still didn't prepare how to solve the problem, then the joke was on you.

In that spirit, I'll share my two favorite (at the moment) interview questions for senior- and lead-level tech job candidates. First:

What's interesting about RSS?

I'm not looking for what RSS stands for, how it works, what library you'd use to parse it, or who invented it, although those might make excellent lead-in questions. Or fallback ones if you have no idea how to answer the real question.

The real question is about the significance of RSS ... to the industry, to building applications, etc. You don't have to like it. Tell me why it's no good. Tell me how you'd do it differently, and what the tradeoffs are. Tell me about the alternate formats and why they exist. Or tell me why it's saved the Internet. Either way, show some real thought process. I know it sounds obnoxious to read -- heck, it sounds obnoxious to write. But hundreds of absolutely stumped interviewees with overblown resumes have taught me it's necessary.

Second:

"I always thought that Smalltalk would beat Java, I just didn’t know that it would be called ‘Ruby’ when it did." — Kent Beck.
What is Kent saying here?

Notwithstanding this page, which claims to have verified the quote, it could be apocryphal. Doesn't matter (though it's not bad if you know who Kent Beck is or at least recognize the name).

I want to know what you think the quote means. At the industry level, what's the significance of Smalltalk? Ruby? Why are they being compared? Why are they distinguished from Java? At the nuts-and-bolts level, what might it hint at in terms of improving Ruby performance?

Anyway, it's not the answer, it's the thought process that matters.

No. It's Just About the Metadata.

If an ad-supported blog exists to stir the pot then I supposed the GigaOM network's future of software blog is succeeding. I thought the first post was tennis without a net. Actually I also thought the second post was tennis without a net. And now I think the latest, "Web Services war is over: Time to Rest" is just bogus hype. Not that REST isn’t gaining ascendancy, but it’s a case of the straw man fallacy.

The war was never between REST and WS-* specs: the WS-* specs have been despised, ignored, and abused since their introduction.

Nor is it between REST and SOAP (and the xml schema documents that go with SOAP, which are also despised) which WS-* was meant to supplement.

It’s a war of describing operation semantics versus hoping that they will be “implicitly self-describing” and that everyone can agree on what GET, PUT, DELETE, POST etc. mean.

 The latter, which is the purist REST position, works well for documents (e.g., HTML pages on the web), and alright for basic business objects (calendar appointment, car maintenance record) but gets a lot trickier for transactional services like “change John's seat on the second jetBlue segment today to 13A, or else the window seat closest to the front of the cabin, or else fail fast and give me a set of alternate available seats.” Can this be done with REST? Yes … kinda sorta … but the call will not be one of those trivial “implicitly self-describing operations on an entity” that REST works very well for.

The good news is that, in reality, both camps are converging on a compromise: REST with (optional) metadata: WADL, OpenSearch, WRDL, even the much-maligned (and for good reason) WSDL 2.0. The metadata supports tooling, automated strong bindings, better testing, automatic integration to enterprise object buses etc.

This is a philosophical step away from REST, but this is actually what we’re seeing coming down the pike for enterprise work, and the SOAP and WS-* people will be just fine with it.

Minimo and Blackjack: Destruction, Repair

On my Blackjack phone, I use Pocket IE, Opera, and the pseudo browsers in Yahoo! Go and Windows Live Search for Mobile. But none of them deliver the Firefox-level experience I really want. So today I grabbed the latest build of Minimo, a Windows Mobile build of Mozilla that has been in development for a few years now. I installed it, it started, it stopped, it completely trashed my Blackjack smartphone. Ouch.

I'm not complaining about Minimo, since it's a 0.2 product, it's open source, and I'm thankful folks write software and give it away as early as possible. Stuff happens, especially when it's v. 0.2 and mobile (since true smartphones give the user full power over the device and there is rarely a root vs. user privilege distinction).

Instead, I figured I'd share the symptom and the solution.

Symptom: After rebooting, the home screen was missing graphics, the Start Menu was empty, and the whole device was relatively non functional.

After freaking out for a moment or two, I plugged in my ActiveSync cable and opened the device file explorer from my desktop. The filesystem seemed mostly ok. The biggest problem I immediately saw was that, in the Windows directory, all of the folders were gone. Bad for Windows. But not so bad for me, since the rest of my data looked to be still there.

Fix:

Step 1. Make a folder on my desktop, and copy off My Documents, My Pictures, etc. from the Blackjack.

Step 2. Copy off interesting folders in the Application Data folder from my device to the backup folder. In my case, this was a Google Maps for Mobile data folder.

Step 3. Copy off application folders from under the Program Files folder. Actually, I could have skipped this step and installed the software anew. Moreover, there's no guarantee that copying an application folder ("xcopy deployment") will work. But many mobile apps play nice and keep all the necessary binaries in their folder. Some of these same ones also play not-so-nice and put configuration data in their app folder too. Ideally this should go in a data folder (like under Application Data) or user settings folder. But it doesn't always work that way, and I wanted to preserve this data if possible. So... grab the app folder for things like Yahoo! Go, Live Search, etc.

Step 4. Factory reset! Unhook from PC. Power off the Blackjack. Holder the "up direction" on the directional pad while powering back on. Answer the prompts indicating you do want to format (the flash memory).

Step 5. Wait a few moments, and you're looking at the baby fresh Blackjack that greeted you when you first took it out of the box.

Step 6. Plug it back into your PC. If you use Exchange ActiveSync and/or DirectPush, enter your account and password data. The phone will sync and all of your contacts, calendar, mail, etc. will automagically re-appear on your phone.

Step 7. Copy the stuff from steps 1, 2, and 3 back onto the device in the appropriate locations.

Step 8. Reinstall any OS extensions that you need, such as the .Net Framework. In particular, the Blackjack doesn't ship with .Net Compact Framework v. 2. So if you use any software that depends on .Net CF2 it, you'll need to reinstall it. Easily enough done.

Step 9. Adjust device settings the way you like -- things like sound profiles, choice of home screen, and which app lives under the right-side-soft-key.

All in all, only a minor hassle.

Here's a vaguely clever idea in parting: Microsoft should provide an API (as part of the Pocket Outlook / Exchange Sync services) that lets apps store their data (and backup images of themselves) with a mechanism that syncs to storage on the Exchange Server. Maybe with some kind of unified store API like Core Data. Preferably with versioning.

This would be good for Microsoft, because it would be a great phone feature and a great way to sell Server and Exchange licenses, and maybe even work SQL Server and SQL Server CE. It would be great for the end user (me) because if things go badly, I can wipe my phone, re-create my pairing to the Exchange server and -- just like my contacts and mail -- all of my apps and config data would show up.

Free Stuff Heralds Changing Conference Scene ... Not Just More Money Either

LinuxWorld is offering free exhibit hall passes for the San Francisco show next week. They have always made exhibit passes available for free. But in the past, as with many conferences, free guests were

• only free when pre-registered by a certain date
• restricted from conference sessions
• not invited to catered events

After the dot-com crash, free passes got cheaper. This year, things are even easier, with LinuxWorld providing

• free day-of-conference passes
• coupons for passes sent to all pre-registered attendees, with instructions to photocopy
• open invitation to the "kick-off" shindig
• a voucher to attend one conference session for exhibit-hall-only guests

The tech show world has been evolving: JavaOne, after some years of a no-exhibit-pass policy started selling them. The Web 2.0 conference not only invited people in for free, but invited them to a free-beer-and-food fest. It's not just that the shows are hurting for attendee numbers to prop up sponsorship and booth prices. They may be, but I haven't got data to prove it.

Rather, it's that the value proposition of the show has changed. Conference sessions used to be a critical way to keep up with the tech landscape. I remember my frustration at not being able to get into the $2000 JavaOne show in 1999: I was working on a critical app using the brand-new Java2D API and the only people who really knew what I needed to find out about this API were not available to chat except at that show.

Now, the developers themselves blog about the newest APIs, post examples, and answer comments, providing a richer kind of support than was ever possible before. So you don't need to wait in line to snag them for 30 seconds at the end of a session.

Companies large and small are freely distributing pre-release bits too. Years ahead of RTM, in some cases. The audience has gotten sophisticated, and understands the difference between a brilliant but unofficial "side project" of a developer, a CTP, a "Go Live License" ... and that their favorite features may not make it to the RC, but that's a small price to pay for having running code -- for free! -- many quarters ahead of retail launch.

Valuable beta bits from the show goodie bag are usually posted by their creators within hours of any significant announcement at a show. And the blogosphere is de facto host to a worldwide birds-of-a-feather session that dwarfs any single show.

Meanwhile, unconferences are proliferating, where developers go to jack their brains straight into the coding matrix of other geeks, bypassing silly conference stuff, going right to what's relevant, and showing something off or banging something out on their own.

So where does that leave traditional format tech conferences? Honestly, I'm not sure. I hope somewhere good, since I'm presenting at one in September.

The current vibrancy of the tech economy should guarantee that these traditional-format shows will not whither due to lack of sponsorship/exhibitor money, or employers' belt-tightening. Money isn't the currency at issue at the moment. But attention is, and the quest to craft something that combines the meaningful intimacy of the unconferences with the massive scale of the every-day-is-Christmas tech-blog world. It's a big, expensive, and maybe even lucrative opportunity.

Yahoo! Go: Nice Product, Sorry Testimony to the Horrific State of Mobile Dev Standards

I finally got my Yahoo! Go on this week, when the client for my Samsung Blackjack became available. I had been watching this project because it's one of the more ambitious mobile initiatives in a long time. You wouldn't know from the press coverage, but that's because it's in the middle of the land of purple, a giant doing everything and nothing, well and badly, all at the same time.

Let's pass over Y! Go's features and design for a sec. In terms of software architecture, we're looking at a smart client app: its content and features are network-oriented (mail, flickr, search), but it also runs offline, saves stuff locally to make that work, and masks fluctuating data rates and request latency under a locally controlled UI.

It's effectively got an embedded web browser (although it looks like page transcoding is happening on the server side, to save bandwidth and reduce complexity on the phone) and server-side support for viewing PDF, Microsoft Office documents, HTML email, etc. This strategy is a lot like the Blackberry's server-side translation, with the exception that Yahoo's actually works.

So Yahoo has basically built a 1990s-era AOL client, a monolithic app that provides a controlled experience and mediates access to the Internet. And they've built it on at least four platforms (Windows Mobile, Symbian, J2ME BlackberryOS, J2ME/MIDP vanilla) with countless versions and quirks. Which is why even versions for "similar" phones have trickled out over the course of months.

Why would Yahoo do an AOL? Because they want to take over the world with their platform, and control where users go? Nope. They did it because they didn't have a whole lot of choice. The phone development platforms remain extraordinarily fragmented across OS, API, version, and hardware install (!), and the carriers are more of a hindrance than a help. The worst part is that within six months there will be enough new devices and OS changes that the entire QA cycle and maybe even dev will have to be at full throttle just to keep this app viable.

Most likely, the original mission was to bring Yahoo to mobiles in a more consistent and usable way than the old mobile web site. And most likely they looked at mobile web options before realizing that those would require nearly as much customization for different devices as rolling their own app (plus mobile web would lack critical offline/low-data-rate functionality). So they did what everyone has to do: build their own native application to serve as platform and abstraction layer over the other APIs.

Who wins in this scenario? It's not the Yahoos, Microsofts, or Googles, who would rather not rebuild, test, and maintain the same app over and over. It's not startups, who kill themselves trying what only GYM can really afford to do. It's not the carriers, who want to increase revenue per sub by selling data plans, and who need compelling network-intensive apps to do that. And it's probably not the hardware folks, who don't care too much what's happening four levels up the software stack.

No one wins this game of 52 Pickup. It creates "small value" in the short term, while stifling "big value" in the long term, the same way a tornado wrecking a town brings a bunch of contracting and insurance dollars in the short term, but doesn't make the town a creator of value in the long term, the way building infrastructure like fiber-to-the-curb, or a decent university extension campus might.

I built a push-mail system in Perl in 1998, the same year RIM started shipping the precursor to the Blackberry, and I started reading my Yahoo mail on my phone in 2000 via WAP. So we're nearly at 10 years of mobile productivity apps and the trend is still toward more chaos rather than less. So... how can we reign this in, hopefully still preserving some biodiversity in phone DNA at the same time?

LifeLock: More Shenanigans, Now Featuring Radio Jingle

I almost feel bad piling on LifeLock at this point... after all, I passed on writing when I first had an inkling something was up, at the beginning of April.

It was curious that they ignored a polite email where I articulated that I might be interested in their service, and that I understand no system is perfect, so I would like to know their views on some potential security vulnerabilities. After all, they purport to close some ID theft gaps, but they create some new weak links in the process. My friend Andy, who knows more about security and financial fraud than I, wrote this post about my concerns.

The rest is history ... Kleiner gave them $6 million a couple of weeks later. And perhaps skimped on the due diligence, since Wired has been following the company and turning up gems like

• LifeLock Founder Resigns Amid Controversy (such as identity theft and fraud ... hmmm ...) in May, and more recently
  
• Police Say LifeLock Coerced Unusable Confession from Identity Theft Suspect (a mentally disabled man who managed to partially thwart the CEO's own LifeLock protection plan)

Like I said, I almost feel bad piling on at this point (and wasting your time, since if you're interested in LifeLock you've almost certainly seen the latest already).

Why only "almost"? Because, as I wrote earlier this week, "the money has to go somewhere." In particular, Kleiner Perkins' money, and Bessemer's if there's any left, is now buying radio spots in the San Francisco area for these guys. Argh. On the other hand, if tracking down and threatening crooks becomes part of that ad campaign, I might not be so quick to change stations.

Microsoft to Turn Your Windows Mobile 6 Phone into a Sideshow Device

Gadgets on the desktop are a little gimmicky ... But gadgets on ... gadgets are a lot cooler.

I love Windows Sideshow, the technology that gives lets you browse and control your media right on your remote or digital picture frame, or read your email on a watch or a digital fridge magnet -- even (especially!) when the "media" or "mail" apps are really running on your PC and your PC is powered down!

But I don't run Vista on my laptop (a post for another time). And anyway, I don't have any Sideshow compatible devices.

I find myself simulating Sideshow though, with my Windows smartphone: typically email pops up on the phone (via DirectPush) before it gets to my desktop. So I monitor my email on my phone, even when I'm at my desk. It's great to have that extra screen on the phone, so I don't need to bring up Outlook when I'm coding. Same thing with calendar items, contacts, and my notebarn list o' lists. The phone is always more "up-to-date" than desktop Outlook.

Admittedly, though, this isn't the full Sideshow experience.

So I was psyched to come across this thread where Microsoft contributor Dan Polivy writes

"Windows SideShow support is not built in to Windows Mobile 6, but we will be
releasing an application which will enable your WM6 device to work as a
Windows SideShow-enabled device. It's a software-only addition, assuming
your device already has a Bluetooth radio in it. Stay tuned for more
information; our current release target is the 3Q of this year."

This move is a brilliant way to tap into a ready-made pool of millions of powerful devices and enthusiastic users.

Sideshow is only supported on Vista, not XP ... but if I can get Vista in VMWare to see my Bluetooth radio, I might be cooking with gas...

Building the "Not Real" Internet: an On-line WYSIWYG Mobile Site Builder

The iPhone's browser renders the "real Internet" (after sucking the data through a pipette, and assuming your Internet doesn't include Flash applications). But notwithstanding the iPhone, it's a safe bet that making your application or data accessible to phones will involve publishing some kind limited type of html, xhtml, chtml, wml, etc. Probably all of them, using an adaptive rendering mechanism.

To take some of the alphabet soup out of casual mobile site creation, Sprint is promoting a free on-line wysiwyg mobile site builder, powered by mobiSiteGalore.

This page composer loads slowly and doesn't impress at first glance. But wait … keep going… it’s got templates ... AJAX editing ... limited forms support … an image resizer … a page hit counter … 1-click SEO-er-izer ... and automagic versioning with the ability to easily rollback to an earlier version.

In addition, there's a "wizard” that lets you add useful pseudo-widgets to mobile pages with one click -- things like launching a phone call from the browser, getting driving directions, viewing audio/video clips, even making payments via bango.

Then it generates slick reports (by ready.mobi) on how compliant the resultant site is, including running it in multiple emulators right in the online report.

Finally, there’s an integrated publishing workflow, where you can check your work and publish to your own site, publish to a free site provided (yourname.websiteforever.mobi – which is prolly a bit much to type on a phone!), or download your files. For complex sites with any kind of application functionality, you'd probably have to employ this last function and add use that output as template material for your ASP.net, PHP, etc.

If you are too lazy to press any buttons, there’s a demo movie.

Sprint and mobiSiteGalore call this “the world's first standards compliant mobile website design tool” with a “Guaranteed test score of 5/5 on MobiReady Report” that is based on w3c standards.

Which is nice. Now if only the mobile phone browsers were standards compliant too …

The Money Has to Go Somewhere: Ads as Boom Barometer

During the dot-com boom, it seemed as though every advertisement on the radio was for one dot-com or another. Some campaigns paid off (amazon.com had a big radio spend); some didn't.

This morning I heard a radio commercial for "pinger" ... which appears to be a voicemail site for when you want to leave a message and really don't want the other person to pick up the phone. Or when you want to spam a whole bunch of people with voicemail. I just don't buy it. I had heard of it before and it doesn't sound any more sensible now.

The commercial was on KCBS, an all-news watt-monster in the Bay Area that is not cheap to advertise on. Especially during morning commute hours. In poker, this is what they call "buying the pot" -- and pinger is lucky enough to be buying with Kleiner's money.

Having recently seen VC-backed mobile-YouTube-play Zannel placing large ads at art events in SF neighborhoods where the only dot-com you expect to see is laughingsquid.com, I realized the ripple effect is underway.

I was hesitant to promote anecdotal evidence as economics data, but my confidence was bolstered by the coincidental publication this morning that "VC Investment Hits Highest Level Since 2001"

The money has to go somewhere. Like free movie tickets just for applying for a job:

Sore Thumbs: 1,000 Characters of Text Message via SMS Compression

I've been thinking a little about the amount of text that can be moved over SMS messaging. Like around 1000 characters ... or a whole lot more than the 130-160 characters allowed in a standard uncompressed message.

It seems that if I write a text message with lowercase letters, numbers and a few punctuation marks, I could get by with a character set of maybe 42 characters ... whereas raw SMS seems to be able to carry a full 224 characters (from 0x20 on up).

On this assumption, the true bandwidth of a 160-character message is 160*224 = 35,840 distinct signals. (Assuming also that carrier-side compression is adaptive, so that as a message uses more of the bandwidth, carrier compression drops towards zero.) 35,840 signals is about 853 characters in a 42-character set. In a 48-character set (or allowing for more mode/signaling codes) we get 747 characters. And this is before applying any Huffman coding, any knowledge of common txtspeak, etc. Assuming we get some yield from those techniques, I'm SWAGging we could hit 1000 characters.

Despite the fabulous data rates of HSDPA, EV-DO, etc., there are core benefits to SMS: living in the signaling layer of the network, it works where voice calls and 3G (or 2G for that matter) data transport don't. Plus it provides fire-and-forget together with delivery tracking.

The idea of compressing SMS messages is not new -- there are a couple of relatively unused consumer-facing applications that let you send and receive compressed messages. It's also likely that the Blackberry push system and Microsoft's older pre-DirectPush real-time ActiveSync -- which both use special SMS messages to trigger device sync -- compress those messages.

If SMS message plans offered by wireless carriers are priced to average some profit per message, then there's little reason a carrier would promote a technique that lets consumers send fewer messages.

Maybe building this compression into on-deck txting is a first hack for your new OpenMoko phone. Plus it will motivate your friends to get one too since no one else will be able to make sense of your compressed messages.

"Though Leadership" via (Company) Blog ... Part 2

I wrote about general approaches and challenges in launching a "thought leadership" blog, especially if it's supposed to assert some leadership position for your organization.

I promised an example of how this might work in the real world. So let’s take as an example this story "6 Months Later, a Report Card on Vista" that spawned comments a few days back

Re-reporting this story is not part of the thought leader program. So let's try and "think in value terms" and plug in other approaches:

Research. Pick some sampling of programs (top productivity apps, top games, whatever). Do some benchmarks. How many of them perform worse on Vista? How much worse? How many don't run at all? Which Best Buy customers choose which Vista SKUs? Why? How many people can name a Vista feature? How many know what Vista Media Center is? Some of this territory has been covered, but you get the idea. You do the legwork, pick a newish topic, and now you've gone out in front and created some value.

News. Work your contacts at Microsoft (hit LinkedIn if you don't think you have any, you probably do) to find someone who'll talk to you -- on the record or anonymously -- about this Vista adoption issue. What's the feeling inside Microsoft? Is there a SP1 or a Vista '08 coming? What will it include? Will it help or hurt? What are the big regrets about Vista that everyone voices at free-beer-Fridays? What kind of mitigation strategies are being discussed?

Be controversial: e.g., Microsoft worked hard on anti-piracy for Vista. Should they have made it easier for, say, college students to "steal" licenses and run the OS? Could that help viral adoption (assuming that Vista gained a lot of traction and it triggered a lot of legit purchased copies)? Write it up (with suitable anonymization of sources if absolutely necessary). For extra credit, see if you can find voices at Apple or voices from a Web-2.0-who-cares-about-a-client-OS-anymore-as-long-as-it-has-a-browser company. Write that up too.

Opinions/Predictions. How many of the Vista installs will be Business? How many Ultimate? Look at the (questionable) success of XP Media Center. Cross reference with XBox numbers to guesstimate how many people could possible run Vista media center in the living room. Ok, what does this say about building software for Vista MC?

Hmmmm... but "company opinions"? Always shaky ground. For the sake of argument, suppose your firm builds Vista Media Center applications. And let's suppose the above procedure leads you to the position that Vista Media Center is not going to be a big deal.

Is this a problem for the firm? Sure, you could go to clients interested in Vista Media Center work and say "Hey, forget you and your contract, what's the point?" ... but you could just as easily say "Hey, did you know that with an additional 30% investment in development, you could target all .Net 3.0 machines, not just Media Center? See, we’ve published this white paper that runs the numbers, and your customer base would be 7x bigger if you take our recommended approach. Which, incidentally, we’ve been pitching at industry events, so lots of other companies will be doing it anyway. Waddya think?"

Product. Suppose we are fairly certain (let's say) that Vista adoption rates will restrict the ROI and market size for new Vista Sidebar Gadgets. Bummer, 'cause your company also like to build those. But guess what? Maybe you think Sidebar is so cool that you hunker down and sketch out a Sidebar that installs on XP. "Here's the free download on our website, and you can bundle it with you own widgets if you want. Compatibility to Vista not good enough? Here's the source, help us fix it." Instant bigger pie for everyone. Value.

This might not be the best example, but it floated through my inbox and I sketched out these scenarios. And yes, ok, Jakob, these articles will probably not be the kind you dash right off. Not that you can't have some of those too.

"Thought Leadership" via (Company) Blog ... Part 1

Had an interesting discussion with a colleague last week about organizations manifesting (or not) "thought leadership" by means of a blog. It's certainly easier than hiring analysts and writing white papers. But there are challenges, particularly around the notion of org versus individual. Good blogs are almost universally individual.

Spending some time thinking about the problem I came up with a taxonomy of approached that I share here. At the time, I thought this line of thought was purely personal; by coincidence it's germane to the firestorm kicked of by Jakob Nielsen's high-handed post about serious blogging and the serious bloggers who do it.

A former boss once said, "It's hard to lead by following" ... he meant following someone else's products, R&D, deal flow, strategy, etc. Leaders lead, and they lead in a particular direction.

A couple of ways one can do this in the technology field with a publishing medium (like a blog):

Establishing thought leadership with facts

Reasearch. Discover and publish benchmarks, compatibility studies, polls, usability data, security vulnerabilities, etc. As with all research, part of the trick is finding something that hasn't been researched to death, and another part (pardon me, Mr. Nielsen)i s finding a "hook" that makes it a relevant part of current conversation in the field.

News. Many top bloggers are essentially journalists. Sounds fun, but it's hard work because you need to stay ahead of the rest of the blogosphere. Come to a story late? You're just another commenter. If you are interested in going this route, the next trick is to narrow your coverage area both topically and geographically.

Media and entertainment technology? Way too big.

"Tech in the U.S. for watching commercial video content on cell phones" or "OSS that interoperates with commercial VOD services" is getting a little more approachable.

Narrow down even more, like "Evolving interaction designs for VOD and time-shifting applications" and a single person can get it under control, though it still might be a big job

Leading with opinions, and opinions combined with research (such as predictions)

This approach is fun because you get to spout off. But it's tough because it's easy to have an opinion and there are lots of voices. The more trivial the opinion ("DRM sucks!" "Apple is cool!") the less value you're offering. But the more complex and subtle the opinion, the more attention and background knowledge you demand from your audience. You're making people pay a high price and they don't know if it will be worth it.

The other catch here is that opinion blogs work great for individuals, not so great for organizations. It's hard (and often futile) work to try and uncover a non-trivial organization-wide opinion about anything. And if you do find one in a group bigger than a small startup, there's a great chance it's just PR bull shiitake.

Leadership with product (not necessarily polished; includes any usable code, etc.)

Actually a combination of fact and opinion. The opinion is the assertion that the product is useful, interesting, worthwhile. The fact is that "Hey! It's here, done, built. You can't deny it. Love it; hate it; try and steal it... But you can't ignore it, because now it's out there." Arguably the best approach.

If you put product out there and it gets ignored, you're either ahead of your time (not a bad place to be in tech if you can afford to wait), "behind your time" (a good reality check to get with the program), or doing something off on a siding somewhere (indicating that either there's no market -- bad -- or you need to work to make your market -- potentially good).

So

How does all this work in the real world? Example in Part 2...

Blogger Sponsorship and Unwitting (?) MSM Publishers

Plenty has been written about bloggers, sponsorship, and full disclosure. But generally we've seen disclosure on blogs, and bloggers' personal sites. What about bloggers who also write for mainstream-media publications? Especially dead-tree ones, where the printed paper context means background-digging on a columnist is not just a Google-search away?

I recently read a "full-disclosure" post by a top-tier blogger. Ok, cool. A little while later, my mind started doing a slow-motion double-take. A month or two ago, I read a column by this writer in a traditional media publication (which produces a paper edition). I remember thinking the writing was really sharp -- but one pop-culture reference seemed stilted or a little confusing to me. At the time I thought maybe at age 33, I'm old enough to miss a clever Gen-Z quip. But I wasn't convinced, because it referenced a tech area I specialize in. Put another way, this quip was unlikely to be the one I'd miss.

Well, the remark makes a whole lot more sense now. With the recent "disclosure" blog post, I now know that the company mentioned in the print publication has been sponsoring the writer's blogging (and other) activities. It was basically an awkward product placement, with no disclosure at all at the time of publication.

I don't love it. But my bigger question is: what does this print publication (a fairly serious establishment newspaper) think about being used in this way? Did they know and not mind, because it wasn't a hard news story? Or are they in the dark?

Commoditization of Social Networks is Just the Beginning

On Monday, Om wrote about the commoditization of social networks. A couple of days earlier, dojo added a nice section to its docs comparing AJAX frameworks ("Why Dojo?").

What do these things have in common? Only that they reminded my of a couple of other technologies...

Remember "portals"? A portal was how to make your site sticky, customizable, get users to spend lots of time there, view lots of ads make you lots of money. Maybe they would even set it as their homepage! A few companies made big money as purpose-built portals. Then there were content-management sites where every group of accounts shared a portal that they could customize themselves -- using the site itself! How amazingly meta! And then came open source portal and CMS products and finally the sign that portal magic had surely jumped the shark, a JSR for portal components. Ok, portlets, I said it.

That first part was fun though ... sounds a lot like social networking sites. Groups of users. Widgets. Social. Sticky. Ad views. Customizable. And as Om points out discussing Ning, you can roll your own right online. The next step is code I can download and run locally, or that godaddy.com sells me with my domain name registration. Like CMSs, storefronts, and shopping carts, the basic software form of a social networking site is stabilizing (stabilized?). Freshmeat lists nearly a dozen social networking apps/projects in varying states of maturity.

I'm not criticizing these sites; quite the opposite -- I'm suggesting that their success will be so complete as to make them just another page in another site. Eventually one ASP.net template or Rails script will import all the social networking features you could want.

AJAX frameworks and libraries remind me of application servers:

• When the CGI was the baseline, app servers let the innovators stand out with more sophisticated interactivity and customization.
• When full-page GET/POST was the baseline, AJAX toolkits let the innovators stand out with more sophisticated interactivity and customization.

I'm not trivializing app servers. Standardization was a boon, and the decision of which to use had long-term consequences. Painful ones, if the decision was taken incorrectly.

Eventually, though, in part thanks for Moore's Law, commodity hardware, open source software, and the nuclear winter, it became no big deal. They all work. More or less fine. Some are better than others for certain things, but no one's gonna waste time arguing that PHP or IIS/ASP.net is "just no good," and (non-technical) business concerns or the right talent often makes the case for one or the other today.

Aside from their being interesting in themselves, these comparisons are meant to put some perspective on where we are in the technology cycle. We're getting past the "hey wow" part of AJAX, widgets, and social networking features. Commoditization comes, standards emerge, infrastructure value-add declines.

These bits become the new top layer of the stack, and we should be thinking about the apps that we will build to ride atop them.

My Femtocell is Watching You (and Your Movies)

Om Malik wrote a post this week wrapping up some news on "femtocells" (smaller than a picocell, get it?)

Those of us with bad cell coverage at home can't wait for this privilege of paying twice for a fix (lending our wired broadband backhaul to the wireless company from whom we're buying service). Meantime, there are some other interesting opportunities that ubiquitous femtocells could provide.

Since the femtocell can identify your phone, and you usually have your phone with you, the femtocell owner can tell when you're nearby. In a big facility, like an airport or conference center, the owner has a pretty good idea of where you are.

When I worked on RFID-based airline check-in at eTag Technology, we built our initial system using passive RFID chips embedded in loyalty cards. But we always planned on leveraging femtocells or similar technology to detect passenger arrival (and location) in the terminal. Just give the airline your phone number, and you can have your check-in, upgrades -- even rebooking if you're not gonna make it -- handled automatically. Eliminating the custom hardware and RFID tag issues makes the concept even more of a no-brainer.

At Voice Media Lab, another startup, we were leveraging the cell phone for voice recognition, media browsing, and control functions. But we wanted to use femtocells to handle the issue of visiting a friend (or a hotel, or a conference room) and wanting to play your movies on the local home theater / media system.

One idea is to wait for even big high-def media collections to become portable enough that you can put everything on an iPod. But our approach was to use your cell phone as your presence token, so that anywhere you go with your phone, all your stuff is accessible. When you go home, everything you haven't explicitly left behind (shared) disappears with you.

Of course there is a downside to all this: if your phone "just works" (without being paired Bluetooth-style to a base station network) then you're giving away a lot of location data to third parties all the time. This concern is not a trivial one, especially since a central company could collect this data, paying femtocell providers a small amount for every "sighting" of your ESN/IMEI.

(Interestingly, the same issue applies to WiFi cards and base stations, but has not been a big concern, presumably because the WiFi device is less "intimate" than a phone and because MAC addresses can be spoofed more easily than ESN/IMEI data.)

ActionScript 3 Code Generator Update

After I announced my quick Violet UML ActionScript3 code-gen integration last week, David Holroyd, author of the metaas ActionScript DOM library I used, updated his library to fix a couple of tiny bugs.

I've updated my code to use his latest, with the result that

• internal and protected members have full support now
• default visibility is now avoided in favor of internal and
• package declarations in interfaces are written out to disk properly.

Check out the project page for details and downloads.

3D Accelerometer, Yes! ... $600 Java Dealie, No!

Sun has been licensing and promoting Java in embedded applications forever, which is not totally surprising since Java (nee Oak) was invented for "connected devices" -- set-top boxes and the like. And of course there's J2ME, which you'll think is either a brilliant success or an industry-plaguing disaster, depending on whether you've ever needed broadly to deploy an app on the platform.

At the MakerFaire, they were showing off "Project Sun Spot," a sophisticated experimental gadget with a 180MHz processor and radio networking. The most interesting attribute of the Sun Spot, though, is the integrated accelerometer. With a little room and a sensitive enough accelerometer (actually you'll need to slave a couple of them) you can build all manner of fun and dangerous things. Like inertial guidance systems.

Never mind that a 180MHz device ought to be able to run full-on Java (Sun seems to have realized this, acquiring defunct SavaJe and leveraging their J2SE tech toward JavaFX mobile). Something getting shot on rockets for experimentation oughtn't to cost $550 + shipping!

Happily, you can buy these 3D accelerometers for $35 and bring your own ... everything else:

Wanted: A VIP (VPN?) Room for Web 2.0 Apps

I am working on a project with a team in New York, San Francisco, and Noosa, Australia. It's a bunch of really smart folks and we have a good time ... but collaboration and communication could always be better.

I would love to cook up a little social networking site for our project work using, say, Ning. In addition to the basic stuff like messaging and chat, we could embed this box filesharing widget, put up videos and photos (ok, our photos are mostly of whiteboards, but we count that as fun), audio recordings of meetings, maybe a gizmo or skype or grandcentral widget for click-to-call. Maybe plug in some WYSIWYG wiki editing.

But we can't do that because of security and nondisclosure concerns. IndustryNext doesn't harbor a lot of secrets, but our clients may -- especially when it concerns upcoming and unannounced products that we're building with them. And our confidentiality with clients means that we won't put their project data into a shared SaaS environment.

So what can we do? The other extreme (from fully shared Saas) is to acquire the apps to host in-house. But that's not an option with many of these services, for good reason.

I propose that a third party build a business hosting secured and partitioned areas where instances of these apps could live. Of course going down this road starts to break the business model that makes many web 2.0 services viable. Without shared hosting infrastructure, and with the added hassle of supporting a "customer" deployment (even if the hosting service is a very sophisticated customer), advertising won't pay all the bills anymore.

But that's ok: I'm willing to pay some money for secure, semi-private access to these apps. It's way cheaper than any alternative I'm aware of, and would have a positive impact on our productivity. Moreover, since the apps are already built and deployed, it's all gravy -- a new revenue line -- beyond the actual hosting and the maintenance (from the app provider to the host).

Does something like this exist? If not, any takers?

Free ActionScript3 Code Generation from Violet UML

At IndustryNext, we are in the interesting position of building cutting-edge projects, with cutting-edge tech for somewhat more established companies than your typical web 2.0 startup.

Part of keeping the speed and quality high is leveraging tools for code analysis and code generation to help keep a handle on dynamic language development. (E.g. I wouldn't ban the use of eval in Ruby, but I'd sure as heck want a tool that can tell me where in the codebase it's being used, and why.) In some cases, we're pioneering these methods.

Generating consistent code from models is a step in this direction. (In JavaScript, just guaranteeing consistent variable names can save no small amount of debugging.)

In order to make it easier to play with object models in ActionScript 3, I spent a little time integrating Cay Horstmann's lightweight Violet UML modeling tool with David Holroyd's metaas library for manipulating ActionScript.

The result is VASGen (Violet UML ActionScript 3 Generator) 0.1, an initial release of a free code generation tool that supports generating classes, interfaces, field, properties, methods, and various types of relationships from Violet's Class Diagram editor.

The project page includes details on what works and what doesn't in this release. If you build applications in AS3 and you like UML models, please give it a try and let me know what you think.

Jeans and a Minority Report Moment

I was putting on a pair of jeans and noticed a nylon tag stitched in them, marked "Remove Before Washing or Wearing." The fabric was conveniently marked with a line saying "cut here."

Wondering what that was all about (a desiccant? inventory control?) I grabbed a knife, cut out the tag, and held it up to the light:

Ok, it's an inventory control RFID tag (the rings are the antenna). Not a huge surprise...

But something about cutting the fabric out with a knife, holding it up to the light, and seeing this inside reminded me of the sequence in Minority Report when John goes to a back-alley surgeon to get his eyes cut out and replaced (tracking and identification is accomplished through retinal scanning in the film). After the operation, he's forced to hide, delirious and blindfolded, in a tub of icewater, as the police flood the building with robotic eye-scanning spiders. This description makes it sound a touch hokey, but it's a brilliant terrifying sequence in the film, and an allusion to role of eyes in Bladerunner.

Having worked hands-on with RFID quite a bit, I'm sure someone imagined how easy and "useful" it would be to not print "Remove Before Washing or Wearing" on the tag at all.

More Khakis: Build a Market for Near-Future Consumer Dealmaking

Here's an idea I've had for a while... if you're good with strategy (see Hey, Guys in Khakis) you might be able to fit the pieces together well enough to make a buck. I thought about building something like this at one point but I'm just not enough of a strategist or a consumer to have a real passion for it.

The premise is that most everyone always has some purchases they're planning, say two weeks to six months out in the future. The buyer has some characteristics in mind, a general idea of price, and is definitely going to buy in that time frame. But he or she doesn't have a specific item chosen nor a specific date when it's time to search out a deal and buy.

As just one example, if you like or need shiny gadgets, you might have thought

• I'm going to get a X-megapixel camera sometime this summer, I'm just too lazy to read all the reviews and sort it out right now.
  
  
• I'm want to buy my wife a bigger flat panel, but the prices are always bouncing around. I think I'll wait a while and see how much LCD real estate I can get for my money.
  
  
• I'm sick of encoding all these DVDs. When I see a deal on TigerDirect or techbargains I'll grab one of those DivX-capable DVD players and be done with it.
  

There's a market here: a lot of people are not actively searching today (using one of the many comparison shopping sites), but they are definitely buyers. Whether $150 is a good pricepoint or $1500, it's something they are comfortable with and have essentially already decided to spend.

Today, this is an inefficient process on both sides.

The customer waits around until eventually he or she happens to hear the Fry's ad on the radio, drives by a store, or sees a chipmunk on the way to work and figures it's time to get a camera and start posting lolmunks.

The seller has limited visibility into who is interested in what products, when they plan to buy, and how much they'll spend. If a site has an extensive profile on you (say, amazon) then maybe they could develop an algorithm to predict when you'll upgrade your camera, what you're likely to spend, and how you comparison shop. They could then communicate directly with you to try and close a sale. But most vendors have a fleeting relationship with the customer, so they spend lots on ads, make sure their products are listed on sites like pricewatch, and hope the customer comes.

The opportunity is to create a market that lets vendors go look for buyers who want certain kinds of products, and make them an offer. For example, Fuji revs their cameras constantly, so maybe I have a bunch of a particular model, and I know the next line is coming out soon. If I want to move the inventory, I put it "on sale" and pay to advertise.

What if I could go and find a bunch of buyers who have said they're looking for this kind of camera at a price point I can stand and they're buying soon? My goal is to (1) offer them a price they'll buy at and (2) make enough on the sale that I'm still ahead of where I would have been in the "put in on sale and advertise" scenario.

This system would be a win-win. But several pitfalls must be overcome. Principally: How can you tell a "true buyer" from someone who just wants to window shop some really great deals? It makes a big difference to the seller, because publishing these kind of targeted deals out into the ether (offering them to arbitrary unverified people) is essentially the same thing as just publishing a lower price. It's asking the vendor to show his cards without the buyer committing anything.

So, to make this work, one needs at least a way of limiting the pool of "true buyers" to those who are plausibly legitimate. At the same time, it cannot be a closed system of fully committed participants since a "true buyer" may sign up, see some great deals, and legitimately decide to just forget it and buys something else that catches his eye. The buyer is not likely willing to be obligated to buy through this system.

The whole mechanism needs some sophistication, and probably a few small but key innovations that will keep people (mostly) playing fair on both sides. These might include unique valid credit cards, online reputation mechanisms, social networks, and some things that haven't been invented yet.

I believe such a market can and will be built. I expect to see someone clever or lucky make a bunch of cash building this and then selling it to eBay. And although I don't love shopping nearly enough to want to build this product, I'd gladly be its first customer.

Design and Implementation for Longevity: Two 20th-Century Machines

Here are two twentieth-century machines that are beautiful, functional, and still have it after several decades of radical technology evolution "should have" passed them by.

This C2 Corvette is as edgy, clean, and exciting as any vehicle built since. It probably always will be:

This original (1978) Cessna 152 performs at original spec after 30 years and looks great doing it:

So what does it take to come up with a design and an implementation that can hold up like these two?

Certainly sportscars and airplanes are not trivial problem domains with few constraints. And they're not domains lacking innovation and evolution. Yet neither of these machines take it on the chin for lacking digital gauges or GPS navigation.

There's some luck, some genius ... what else? It's more than a design question. If it were only about design, we might get bogged down in aesthetics and cultural theory, which is fun but sort of a sui generis sport. (Why does art deco seem futuristic? because "the futuristic" has irremediably incorporated art deco? what about directly undermining this? or does that form a stucturalist framework that reinforces the duality? ... )

One key piece is the absence of over-engineering. The 'vette and the 152 are fabulous implementations of their times, but never strove to be "ahead of their time" in terms of showy engineering.

Contrast a recent BMW or a Mercedes, which always comes off rather less slick a few years on, because at design time it had been packed with every blinking gewgaw money could buy, and those rarely age well. These cars do ok, though, because the first buyer gets a space shuttle experience during her 39-month lease. And since the drivetrain and suspension tend to be solid on these cars, the cars hold up for the next 25 years -- they just look increasingly tired doing it.

Scamalicious, Bubblicious, or the Next Transistor?

It's a multiple choice test for this venture investment in Stirling engines as solar power collectors. Stirling engines are of course very real. But so is fusion.

Is this brilliant risk-taking and the green investment that'll lead to breakthroughs? or another dangerous sign of too much money chasing too few ideas?

Pac-Man on your Smartphone? Ghosts are Chasing Your Game Download

Remember Bad Idea Jeans? That's what came to mind after TechCrunch told me Namco is releasing classic arcade games for AT&T smartphones, and I checked it out.

Pac-Man on my Blackjack is not a bad idea at all. But here's the ordering page:

Notice you can choose how many copies you want to but, but not whether you want "Download Protection" ... Interesting .. My downloads have never been injured before. I wonder why I need protection? If you click the protection link, you get this popup:

This is obnoxious on so many levels. And no, I'm not complaining about the money. The problems are these:

First, the market for off-deck software for mobile devices is in its infancy. While the general population is slowly realizing that the phone is a computer and can run programs (if the iPhone does nothing else, its TV spots will help communicate this fact), most folks have still never installed an off-deck app, let alone paid for one.

The smartphone users are at the vanguard, the evangelists that get their friends and companies onto mobile apps. So why even suggest that the software downloads are any different from a PC software download? Why suggest there's some special problem with mobile software, so you'd better pay $3 for "insurance" in case your stuff gets screwed up?

At this market's stage of maturity, users need to be told that if they're ready to start buying mobile apps, there is no risk, and the vendor will do 100% whatever it takes to make sure the software is available in case a device gets broken, hard reset, etc. Compare the early days of e-commerce: a number of companies promised extraordinary customer service to overcome anxieties about returns, using credit cards online, etc.

The second problem is that it undermines the whole idea of software sales as IP licenses. If I've bought a permanent license to Pac-Man for my device, why does it cost $3 to make sure I can download it again later? Is the $14.99 for a conditional license, that only gives me the right to use the app until such time as my device gets reset? Then $3 buys me a permanent license? Of course this is absurd.

Bottom line: if Namco want another $3, just call it a handling fee, or a one-time provisioning fee, or just toss it into the price. My downloads don't need protection.

Hey! Guys in Dockers! Over Here!

Geeks love to hassle the guys with the MBAs and the "strategy" resumes. And plenty of geek entrepreneurs have showed the MBAs a thing or two making a fortune with code-first-ask-questions-later software and websites. But sometimes the technology isn't the problem and some strategy would be helpful.

In particular, I was chatting with a co-worker last week about how to set up a mass system for buying and selling used software licenses. In most countries and most U.S. jurisdictions, the "right of first sale" says that if you have a software license, you can resell your rights under that license to someone else. That's the legalese behind buying an old game from a bored gamer on craigslist. As an IP sale, it's not about the disks or even the activation key, but about the license. The seller has to relinquish the right to use the software (usually) and anything that comes with that (like support). The buyer gets it.

For big expensive licenses, like that 16-CPU perpetual Oracle license you no doubt have lying around, there are companies ready to help broker a deal. Actually there are a handful of companies ready to wheel and deal. At the consumer or low-value, low-volume level, there are some funkier ones. But there is no ebay for buying my aunt a "used" but legit copy of Word 2003.

Clearly there's a market here, and a look at the current players suggests it's not efficient or transparent. How can we get a web-based open market to work?

In this arena, it's reasonable to suppose most buyers are "legit" because most or all of these software packages could be acquired illegally for free if the consumer were not inclined to pay. It's trickier on the sell side since, in the extreme case, a seller can offer to sell a license for anything at all without possessing it in the first place. Most software licenses have no physical redemption token like a bearer bond, stock certificate, or paper money. So a buyer pays up, and the seller says, "You've got a deal, you're now the owner of a Foobar 2.0 license."

So we need some kind of clearinghouse ... but a clearinghouse for what? And how to keep it digital so we don't need a Netflix-grade DVD sorting facility to bag Microsoft Bob disks?

We're going to need digital tokens and a tracking scheme that software vendors want to participate in. Why would they want to do that? One argument asserts that a product is more valuable if a buyer knows it can be resold (think cars). And a uniform, open key registration and verification scheme could help fight software piracy without requiring each vendor to pay to maintain their own system.

The point is, I need a strategy guy (or gal) to line all the pieces up. The tech is trivial -- we have auction systems and reputation systems and crypto and tokens and all that. What we need is a scheme that arranges interests, incentives, and rewards in such a way that enough players get in to bootstrap the market.

Alrighty Then...

This blog gets a lot of hits via Google... from Windows Live Search, not so much.

Recently a visitor arrived via this referring URL:

search.live.com/result.aspx?q=viagra&mrt=en-us&FORM=LVSP

I'm unsure whether this says something about my blog or about Microsoft's search engine. Probably the latter. But if it's the former, I'm not sure if it's a compliment or not.

A Workforce That's Never Seen Mac OS 9

I spent some time yesterday with a recent grad who is interviewing for a design position with IndustryNext. For some reason, I got the idea to ask him if he'd ever used a Mac before OS X. "Nope," he said, "I've been OS X all the way."

Damn, man. I'll resist the temptation to get melodramatic about feeling old or to reminisce about walking uphill both ways, hacking Think C and Think Pascal code for the old MacOS, with Inside Macintosh open on my lap 'cause there was no "line" for online docs to be "on."

Actually, the emergence into the workforce of a generation that knows only OS X means that Steve Jobs, for all his quirks, has pulled off something pretty amazing. Namely, making OS X successful enough for long enough that students are graduating who don't know anything about Apple's troubled bad ol' days.

I'm still ambivalent about Apple and Mac OS X, though. Great accomplishments include the design (both software and industrial), the first POSIX compatible BSD OS that your mom wants to use, and the first mass-market OS with a native OO API...

At the same time, Apple is still a high-maintenance partner with serious control issues.

Things have improved since the "authorized repair" racket in the 80s, where Apple required personnel to confiscate hardware if there were signs you had tried to install it yourself or put in something that hadn't been blessed by Cupertino (creating ethical dilemmas aplenty for the geeks with the case crackers and screwdrivers, at least where I lived). But vestiges of the program were still in force for factory repairs, at least up to the point just before OS X was released. And after that, there has been an unending series of minor scandals.

To be fair, selling high-end product in a Wal-Mart world is a tough gig. More power to 'em for trying. And nostalgia aside, if a new generation of designers doesn't know or care about the Mac legacy, good for them. Let's hope that their ignorance of the past opens their minds to new possibilities for the next generation of products.

Notebarn: Launching URLs and International Phone Numbers (Includes Crash Couse in Numeric Regular Expressions)

A lot of visitors to this blog and the Notebarn project page (where you can download the app) are from outside North America, and all of those folks got a raw deal from my last update.

I added the ability to dial numbers from a note, but the phone number recognition was based on a hard-coded pattern that looks like a North American phone number (basically, 10 digits with some optional delimiters).

So I've got an update that moves the phone number recognition out to a configuration file, where you can put in a localized phone number pattern.

I also found it really frustrating to put a URL in a note and then have to key it in later to browse. So this update recognizes URLs in notes and lets you launch them just like dialing a phone number from a note.

URLs / web browsing works straight out of the box. For localized phone numbers there's, um, a small catch.

The Catch

I did not set up a list of international phone number patterns. So, in this release, if you're outside North America, you'll need to add your own phone number pattern to the config file. Here's how it works:

1. Install the new Notebarn with the latest OTA installer. The install will place a config file called notebarn.config.txt in the Program Files/Notebarn directory on your device, right alongside the executable.
2. If you have a regular text editor on your device you can edit the file in place and skip to step 3. Otherwise, use ActiveSync to grab the file, pull it over to your PC, and edit it there (with an editor like Notepad). When you're done you can push it back to the device with the changes.
3. In the config file you will see two lines like this:
   

   #Add a RegEx for your localized phone number format here:

   PHONE=\d{3}\D{0,2}\d{3}\D?\d{4}\D
   

The beast on the right is called a regular expression, and your .net-enabled Smartphone has a great engine for processing them. Microsoft has docs on the format. But you don't need to read all that. The cheatsheet for phone number patterns works like this: \d means a digit. \d{3} means exactly 3 digits in a row. \D means a non-digit. Specifying non-digits is how you look for delimiters used between groups of numbers, like a period, space, dash, parens, etc. And \D{0,2} means anywhere from 0 to 2 non-digits in a row. The \D? is shorthand for \D{0,1}, or "zero or one non-digit."

So all together, the North American pattern above means 3 digits (the "area code") followed by 0, 1, or 2 non digits (think of 415-555-1212 or (415) 555-1212), then 3 digits, optionally a nondigit, 4 more digits, and a non-digit to mark the end. How does the phone dial if we've recognized an extra non-digit at the end? Well, the phone app in Windows Mobile is smart enough to drop the non-digit parts of the phone number when it dials.

If you put together an expression for your locale (or borrow one from another program), feel free to email me or post it in the comments. In the next release I'll include all of them in the config file to make it easier to set up.

Foleo is Foolish ... But Here's a Better Idea

I know, the Foleo is spelled with an "e" ... Either way, it's such a silly proposition only Steve Jobs could hype this thing enough that people might buy it. And if he did, the only benefit would be keeping the computer gene pool diverse by preventing people from buying a decently spec'd Windows laptop, for about the same price.

The interesting bit is that we do need optional larger displays for small computing devices so that we can get the most out of them as they continue to increase in power and connectivity. So what would work better than this non-laptop?

I worked with Tim Andrews at Viant in "Web 1.0" and one time he took us out of our way to look at the latest video goggles from Sony Japan. Ok, personal movies ... huh? I didn't get it. The goggles are going to be the video output for this, Tim explained, pointing at his Palm. Tim has spent much of his career thinking ahead, and this time was no exception. The 1999-era Palm would've taken 30 seconds to BlT a frame for these goggles. But now?

Let's see... Modern smartphone hardware can drive a VGA display or larger. And here are the visor displays: VGA for about $400, and SVGA for $1600. Like most hardware, the price is inverse-exponential with volume. That's a fancy way of saying these are expensive gadgets 'cause no one makes a lot of them. The price will drop drastically as they are produced in higher volume.

On the input side, there are old fashioned Bluetooth or more futuristic solutions and bear in mind: you don't always need big input and big output at the same time. Web browsing and document review can benefit from a big screen, but hardly need a full-sized keyboard. So there's no reason to fill your lap with another battery-chewing, airport-security-antagonizing monstrosity just to follow up on some links.

Small computing devices are about mobility and convenience. They are hardly "enhanced" by chaining them to a big dumb anchor. But the tech is here to take a smartphone-grade device and get a ton more productivity and value out of it by widening its human I/O bandwidth with these virtual keyboards and virtual big screens.

"Offline is Here" ... and Credible (!)

I spent a few minutes chatting with Brad Neuberg yesterday, following up on his presentation at Google Developer Day on Thursday. We spoke about offline data persistence for web apps, and the rapid crystallization of industry players around a particular approach.

"Offline is here," he said. Two weeks ago, that would have been just one opinion of one prominent person working in the space. Fast forward to June 1, and half the industry seems to have decided that now is the time, and that a specific SQL flavor of offline storage is the right one.

Why two weeks ago, not one week ago? Because when I asked about Firefox 3 (which has been promising an offline facility), Brad pointed me toward this change to the XHTML5 spec at the WHATWG, submitted on May 23. Here's a more readable and faster-loading spec draft section on local SQL storage (but content might change, as the doc develops). Firefox 3 aims toward this spec, and the spec API looks remarkably similar to what Google Gears offers.

So we have Dojo, Apollo, and Firefox essentially promising the same relational, origin-domain-partitioned storage metaphor along with similar APIs. Google brings plugin implementation code targeting all major browsers. For someone like me, who gets paid to make bets on the (near-term) future in order to architect applications, that's awfully persuasive.

In some ways, this is another iteration of the "dumb terminal + remote computing" vs. "smart terminal + dumb network services" oscillation... but it seems like we're maybe getting critical damping now.

Microsoft articulated a sensible "Smart Client" architecture around eight years ago: deliver apps that leverage services in the cloud but can also run offline. They should sync when online, while leveraging local hardware for performance and to maintain state. I'm using a quintessential smart client right now as I type.

The only easy way to implement that architecture and get the full benefit of local resources though was to build a .net application. Then Win XP shipped without .net; zero-click install had issues, one-click install was too late, and the rest is history.

We got AJAX and Web 2.0 instead of a lot of smart clients, which wasn't a bad trade.

I'm pretty psyched now though, because it looks we're going to get to have both.

dojo.offline = apollo.db = google.gears

You know those scenes in political thrillers when a character starts spilling the beans about what's really going on? And as the real plot takes shape in your mind you start thinking about the consequences: "That means the old guy is working for them ... and the girl is going to get killed if ... wait, she must've done all that stuff on purpose, which means..." You get the idea.

Well I had one of those experiences tonight at the final Google Developer Day session, where it turns out dojo has elected to scrap their own infrastructure for offline AJAX app operation, which had been in development a long time and had just reached beta. In the runup to Dev Day, Brad was treading lightly. But what he just told us is that the dojo plugin is dead. The dojo offline high-level Javascript library will run on top of the Google Gears offline app plugin. Incidentally, Google helped pay for porting the dojo offline library.

Early in the day, when Gears was introduced at the keynote, we learned that Gears would interoperate with Adobe Apollo. This post has details.

Ok, who's left standing here?

True, "interoperation with Apollo" isn't the same as "being Apollo" (Apollo has access to the filesystem, up to the perms that the current user has). But dojo was clearly the frontrunner in offline AJAX, and has held a hegemony in vector graphics and other wicked scripty stuff.

So to keep the metaphor, I see a surprise coup d'etat. And not necessarily a bad one, either. I want to see how this one ends.

Rejected for Individual Health Insurance Coverage in CA? Meet the MRMIP

I keep this blog to tech commentary (and to areas I have expertise in), or software I've cooked up. But I'm writing today about a California-specific health insurance program that guarantees coverage for, among others, self-employed geeks who seek individual health coverage and get rejected.

This is a common phenomenon for those who stray outside the white-picket-fence world of employer-sponsored group coverage. Last weekend I came across another smart, savvy tech pro who got rejected for individual coverage and didn't immediately find info about this critical program. I'm not a big SEO guy, no doubt to the detriment of my traffic volume, but this information really needs to make its way up the Google rankings: for the heck of it I ran a number of searches myself, and info is just as obscure today as it was four years ago when I went looking for help on this issue.

So here's the executive summary:

• California's "Major Risk Medical Insurance Program" or MRMIP is a state-administered program that guarantees certain groups of individuals can buy a health insurance plan from a specific set of private-sector plans
  
  
• This program is mainly valuable to folks who need to obtain individual coverage (i.e. are not eligible for group coverage through an employer, union, etc.)
  
  
• You are eligible if you have been formally rejected for coverage in the last year or if you have been offered coverage at a more expensive rate than the current MRMIP program rates
  
  
• The program addresses accessibility of coverage, not affordability. I.e., it will help you get insured; it will not help you pay for it. Sadly, that means you more or less need some flavor of middle-class income to get your HMO on.
  

Considering this program lives at the unholy intersection of (a) government bureaucracy and (b) health insurance bureaucracy, it is well documented, easy to apply for, and easy to work with. YMMV, but I am speaking from personal experience, having struggled with the "I have no group coverage" problem and being happy with the solution MRMIP provided.

Ironically, once you know the magic keyword (MRMIP) it's easy to Google the rest of the data. But here are some direct links anyway:

2007 program brochure, which includes details on eligibility, carriers, coverage, prices, and the application form. The original is on the state's web site. Here's the program home page.

The program is administered under the auspices of the "Managed Risk Medical Insurance Board." If you're interested in the politics, policy, and future of this program, these notes are interesting.

Two last things worth noting:

First, there is an annual coverage cap of $75,000 on these plans. That seems like a lot of money, but in the US's insane healthcare economy it is very possible to run through that amount if something bad happens. For that reason it is still worth looking at which program offers the most potential care for $75k. I have a hunch that would be Kaiser, though I don't have all the data to back that claim up.

Second, although insurance companies seem to be getting more diligent about investigating your medical history, there may be the temptation to falsify or conceal various bits in order to get coverage, or to get a better rate. Doing so is hazardous.

If you get away with it in the short term, you may get some cheap doctor visits. But if you have a serious illness or injury, where the insurance company is looking at paying big bills, you can bet they'll put a fraud investigator on the case. If they can turn up evidence that you lied on your application, they'll deny your claims and probably try to terminate your coverage altogether. You could fight, but it would be a long uphill battle and not the kind you want to take on when you're already sick or hurt.

Bite the bullet, tell the truth, and if they tell you to get lost, programs like MRMIP can help.

Notebarn Update: Dial Phone Numbers from Notes

Once I gut a bunch of phone numbers in my Notebarn notepad, I started getting frustrated that I couldn't dial a phone number in a note just by viewing the note and clicking on the number. So I've updated the app to include this capability.

If you want this feature, and don't want to read any more geek ramblings, you can go right to the project page and download the app.

I missed this feature acutely because I used to use a Blackberry. On the Blackberry, whenever you come across an email address, URL, or phone number, the device recognizes the format of the text and creates a sort of smart tag. The trackwheel menu gets new tasks related to the data. If you move the cursor over a phone number, the wheel menu will include Call, Send SMS, and, if the number is recognized as matching someone in your address book, clever things like "Send an email to [name]", "Invite to meeting", etc.

It's not accidental that most Blackberry apps support this functionality: the folks at RIM supply classes in their platform API (net.rim.device.api.ui.component.ActiveRichTextField and net.rim.device.api.ui.component.ActiveAutoTextEditField to be specific) that do pretty much all the work for you. Use these classes, and you get this functionality for free.

Despite many strengths relative to the Blackberry platform, the .Net Compact Framework on Windows does not include such a class (at least as of 2.0).

Making this kind of an implementation harder, the Smartphone version of a multiline textbox has a "clever feature": In order to allow multiline textboxes to fit nicely onto a small screen, play nice with directional tabbing, and still accept a lot of text, they have two states. The base state shows one line of text and a little "expand" triangle. You can edit the text, the control responds to events, etc. If you click "Enter", triggering the expansion, the textbox switches into a fullscreen state where you can put in all the text you like.

The problem is that in fullscreen mode the component does not respond to all of its events (it doesn't even fire an event when switching modes), making it very hard to do context-sensitive stuff, such as "look at where the cursor is, extract the nearby phone number, and allow the user to dial it." Which is what I really wanted to do.

I implemented two workarounds instead. When notebarn finds one phone number in the note (using a RegEx that looks like a U.S. number), it adds a "Dial 415-555-1212" command to the main app menu. If there are multiple numbers, it opens a new window with a list showing each number and some of the context around it (so you can tell which number is which). Pick the one you want, and click to dial.

Happy calling!

TechCrunch vs. The Maker Faire

Mike Arrington wrote one of those shot-heard-round-the-world posts today. It wasn't news, but Mike Arrington writing it on TechCrunch was the news. The Valley in a troubling state? Indeed.

It would bum me out a lot more if I hadn't spent this weekend at the Maker Faire. The fair was a beautiful thing. The people and projects looked great; the companies mostly silly. The bigger they tried to look (Yahoo!) the sillier they looked. The more they focused on doing cool stuff (Microsoft... sorta kinda) the better they looked. But really it was DIY anything and everything. The essence of the geek thought process was there, the thought process that makes Silicon Valley work decade after decade: one part science, one part "I bet if I monkeyed with this a little more, it would be really damn cool," and one part "that is really damn cool -- you need a hand with that?"

Robert Scoble already made this connection. But I want to hammer on it a little more. Spend 15 minutes browsing this flickr stream and you'll feel right as rain. It's meatspace stuff, mostly, some fire and robots and yarn along with the software. But the idea is the same, and the membrane between online and offline has never been thinner.

On Saturday, we spent 20 minutes looking for parking and ended up in the far reaches of a dirt lot where some cargo trailers were parked. The event was well attended.

The peninsula has its own cash-driven strain of lycanthropy, never more than a full moon away, but a lot of people here always want to sit down with a soldering iron or scissors or a blank text editor window and put something new and cool into the world.

No Signature Required: It's the New Cash

Banks, credit card companies, startups, mobile phone companies, and whole bunch of other folks have jumped onto "future payment systems" in recent years -- focusing mostly on how to make small day-to-day payments more frictionless. So we've seen a dozen wireless phone wallets that, in the U.S. anyway, aren't very useful. RFID payment experiments at Mobile or McDonalds, and credit cards with chips of dubious value embedded in them.

When I recently found myself hoarding cash because it made certain purchases easier than using a credit card, I thought a little bit about the ease-of-payment problem. I came up with the following equation:

Ease(CreditCardPaymentNoSignatureOrPIN)
>= Ease(LoyaltyCard)
>= Ease(CashWithNoChange)
>= Ease(CreditCardWithSignatureOrPIN)
>= Ease(CashWithChange)

In English? The easiest game in town is swiping your card (or handing it over) and walking away (well hopefully you get it back). No signature, no PIN, no touchpad. Where does this happen? Starbucks and 7-Eleven are among the merchants supporting the Visa No Signature Required program for amounts under $25. It's a beautiful thing -- I can't imagine any easier way to pay, and I used to work on some of those RFID systems. At best they match this experience, but they can be much worse. The credit card gives me near perfect fraud protection, an itemized bill, and a short-term zero-interest loan.

A lot of businesses (Peets, Subway, etc.) haven't hopped on the bandwagon though, I suspect because the fine print is higher pricing on the back end. They'd love to avoid and card fees if they can, and they're happiest when they carry your cash for you. So they sell you a stored-value card and in exchange for letting them keep your interest and unspent funds, you get a swipe-and-run experience. This approach also has the drawback of requiring an extra card for each vendor, more of a hassle than pulling out a single Visa card.

After this, a cash transaction where no change is involved is fast and painless. You can pay and run, and cashiers love not having to count or give out change. Pricing in round numbers (think parking garages or ballparks) eliminates most change. Much is made of the supposed "anonymity" of cash. But that argument applies only to illicit transactions. Any transaction you do in person with an established business is bound to be on camera and timestamped these days, so you can be tracked even if you pay in cash.

Then you have credit card purchases with a signature or PIN -- my principal method of payment. This sounds easy until you're handed a card and a receipt to sign and return at a parking garage on a windy day. Aaaargh.

Lastly there's old fashioned cash with change: pain for all involved.

The big opportunity here is for banks and other credit-card issuers to cement their lead in the payment industry by pushing hard to expand the No Signature program. As it is, there is vastly improved data transmission infrastructure compared with what existed when credit card protocols were designed. The Obopays and Speedpasses, not to mention alternative credit card entrepreneurs are all over it. But the same data infrastructure could let Visa vastly extend No Signature without the fraud risk this would once have entailed.