Jason Kitcat's writings

e-democracy'06: More information [edemocracy]

2007-09-25T00:00:00Z

This page provides links with additional information about the projects discussed in the session "Election Information Websites: lessons from 'Election Alarm Clock' and 'My Election' pilots" at e-democracy'06.

Summary information sheet [PDF]
Brief information about both projects.

Summary of session proceedings [PDF]
Read the presentations and discussions that followed.

Election Alarm Clock

The site: http://www.electionalarmclock.com/lambeth

Project partners: London Borough of Lambeth, The Electoral Commission, Delib

Report: Full Project Evaluation Report [PDF]
Conducted and written by Jason Kitcat

Project summary by the Electoral Commission [PDF]

My Election

The site: http://www.myelection.co.uk/swindon

Project partners: Swindon Borough Council, Delib

Report: Article on the site for Arena magazine [PDF]
by Alan Winchcombe, Swindon Borough Council

We have the responsibility to stop e-voting [evoting]

2006-12-19T00:00:00Z

A shorter, edited version of this article was published as "A vote of no confidence for electronic ballots" in Computing 14th December 2006, a longer version was simultaneously published on the British Computer Society website.

At first blush electronic voting sounds like a good idea. To a web-surfer voting online appears no different to shopping on the Internet. But in fact the two are poles apart, when people become more aware of the problems with e-voting, they tend to be much more suspicious. This change in perspective has recently been happening around the world. As the vulnerabilities of their e-voting systems are made clear, countries who had introduced e-voting without much thought or debate have begun to see doubt engulf their electoral systems.

Ireland has a complete moratorium on e-voting following an independent commission’s investigations; troubled elections in the province of Quebec led to an indefinite moratorium on the use of e-voting; the Netherlands withdraw one model of e-voting machine after researchers revealed major flaws in a competing model; Italy have just announced that they will no longer pursue e-voting after doubts were raised over the results of their last general election. In the United States, the home of introducing technology to elections, citizens are reeling from a cascade of disclosures over the insecurity and vulnerability of their systems. The film “Hacking Democracy” broadcast by the HBO network just before the US mid-term elections took the frenzy of citizen outrage to a new high. Following the elections the influential National Institute of Standards and Technology released a firm report which said that electronic voting machines “in practical terms cannot be made secure.”

E-voting is a very difficult technical challenge because, unlike with e-commerce, the vote must be secret and the voter must be anonymous (unless revealed by a court order due to an old requirement in UK election law). In e-commerce transactions we willingly tell the vendor who we are and where we live to help mitigate fraud. With elections, votes need to be secret to protect us from vote buying, coercion and invasion of our privacy. But when the votes are secret how do we know the system has stored the vote as we intended? It would be trivial for an e-voting system to change votes. We would never be able to see what had happened. Even worse, the opportunity to remotely change huge numbers of votes undetectably is for the first time made possible by e-voting.

Paper has properties that we know and understand. It is very hard to carry around one million pieces of paper. Changing the marks on a piece of paper leaves evidence. Once the paper is in the sealed and watched ballot box we can be confident that our ballot will remain unchanged until the count. It is because of these properties that recent postal vote fraudsters in Birmingham and Blakckburn were caught.

Elections and so democracy works because our society has faith in the integrity of the electoral system. Electronic voting’s many problems, which I cannot hope to cover in the limited space of this column, provide ample opportunity for growing doubt in the electoral system and its results. So instead of increasing political engagement introducing e-voting risks having even more people lose faith in our democracy.

As IT professionals we have to be clear when new technology isn’t appropriate or could be done much better. Using technology to improve NHS care is a good idea, but perhaps how it is being implemented needs work. In the case of e-voting it’s a bad idea and we need to call for a stop. The Government has announced plans for e-voting pilots in the May 2007 local elections. We are waiting for the Department for Constitutional Affairs to announce which authorities have been approved to go ahead with which vendors. While we wait it is important that this issue, which runs to the very heart of our democracy, is raised with politicians who are often blissfully unaware of what is happening with the voting system.

You can act now by writing to your MP using WriteToThem.com raising the problems with e-voting as detailed on the Open Rights Group’s e-voting page http://www.openrightsgroup.org/orgwiki/index.php/Electronic_Voting

Jason Kitcat researches e-government and e-democracy at the University of Sussex. He is the e-voting campaign co-ordinator at the Open Rights Group.

Source availability and e-voting: an advocate recants [evoting]

2006-12-14T00:00:00Z

A former proponent of requiring the availability of e-voting system source code explains why he no longer develops source-available e-voting software.

Source-available software whether proprietary or nonproprietary (such as under open source licenses) has garnered significant attention. The arguments in favor of taking a source-available approach in general are numerous [6], but only those of specific relevance to e-voting systems will be discussed here.

Improved security. A system whose security depends on its design and implementation being secret is likely to have brittle defenses. If a system's security is based on a secret design that becomes public knowledge, then security is compromised and the genie cannot be put back into the bottle. Cryptographers and security professionals use peer review to provide assurance for the quality of their systems. A security scheme whose source code and design is known, yet continues to offer a useful level of protection, is a good one. The secrets such systems usually depend on are tokens such as passphrases or keys. If a secret token is compromised, only a particular instance of the system is compromised—not all systems of that design. A new key or password can be chosen to remedy the situation. In other words, security through obscurity doesn't work.

Unfortunately, the leading e-voting suppliers work on this principle of security through obscurity. At best, they share limited details about their system designs [4] and keep the source code closed. This provides no way for stakeholders in the election process (election administrators, candidates, voters) to verify that the software performs as the suppliers claim. A closed approach is not conducive to building confidence in e-voting systems. It puts an enormous burden of trust on suppliers who have clear motivations to conceal security failings. A source-available e-voting system, where the design and source code are freely available, is likely to be more trusted by stakeholders. Not only can the security of the system design be assessed, but bugs can be spotted by anyone who downloads and checks the code.

Transparency breeds quality. Developers are motivated to provide clean, well-commented code when they know their work will be publicly available. They do this out of pride and, if they want participation, to help others understand and contribute to the system. When errors do creep in (as bugs are inevitable), then the transparency of source availability can allow for anyone to patch holes and correct errors.

Freedom from dependencies. While sponsoring and requiring the use of open protocols such as OASIS's XML-based Election Markup Language might help prevent vendor lock-in, source availability can also play a significant role. Once an authority has purchased proprietary voting machines, open standards or not, the authority becomes dependent on the original supplier to service the machines' hardware and software. With such strong lock-in, voting systems are clearly a lucrative business—with the suppliers very much in control. Yet, with a source-available voting system installed on voting kiosks, authorities would at least have the option to maintain the software themselves or contract its ongoing support to less-expensive alternatives. Additionally, if a vendor chooses not to provide a feature that a customer desires (such as printing a paper ballot image for each vote cast), then the authority has the ability to implement the feature itself.

A source-available approach also helps to prevent municipalities from being abandoned if a provider withdraws from the market. Support and future developments, such as to support legislative changes, are made possible by source availability.

The Arguments Against Source Availability

Although a source-available approach seems promising when compared to the poor security and development practices of many e-voting suppliers today, the benefits it offers are not enough to overcome the risks.

Transparency goes only so far. The source-available rhetoric, particularly regarding nonproprietary development, is one of communally improving code. But while open peer review can improve the quality and security of systems, it requires active participation. The reality is that only a tiny minority of source-available projects attract contributions, the majority languish in obscurity with a single developer caring for the code. Generally, the software most used by programmers is that which gains the most attention. Thus, e-voting is not highly attractive to most potential contributors. My experience is that despite significant press coverage and backing from major organizations, an e-voting project is not attractive to many developers.

Arguments have also been made that source-available code's transparency reduces vulnerability to viruses. While GNU/Linux is less likely to suffer from virus attacks than Windows systems, this has nothing to do with GNU/Linux being a source-available operating system. It is partly due to it being built on a well-designed user-level security architecture derived from Unix. Additionally, the relatively low number of desktop machines running GNU/Linux makes it less attractive to virus writers who prefer the rapid viral self-propagation that a dense monoculture of Windows machines offers [5].

Now you see it, now you don't. Having the ability to review software design and source code does tend to improve its security. But while the design and code may appear sound, we have no guarantees this is what is actually used on Election Day. This is a genuine risk, illustrated with the use of uncertified software by Diebold in 17 Californian counties [1] and by Elections Systems and Software in 41 Indiana counties [2], both during 2003 primaries. Computers are black boxes where proving to voters that the software audited is that being run is a challenging problem. Code signing and certificates might have a role but, on large scales and for extensive deployments, they are not enough.

Last-minute fixes are likely, and so any update process presents the possibility that malicious code can also be inserted. Given the inherent pressures of Election Day, what would administrators do if code signatures didn't validate on all machines? A smart attacker would probably either subvert the code signing system or create an exploit that didn't require altering code that is checked.

Design control. Changes to source code are difficult to prevent in an e-voting system, whether or not it uses source-available code. The same applies at the design level. A collaboratively designed source-available system that embodied the best practices in e-voting could be built. But on installing the system a government could easily choose to modify the system or implement it poorly, thereby rendering the system less secure and less reliable. This has already occurred in Australia, where an open source system implemented a voter verifiable paper trail that the government chose to remove, thereby cutting out the costs of providing printers [7]. Of course governments have enough buying power to get any software changed, but source availability makes such a possibility only that much more likely.

Source availability doesn't change the fundamentals. Making an e-voting system's source code available doesn't alter the fundamental challenges that e-voting presents. Creating a secure, private, reliable and anonymous system that provably records voters' intentions accurately is an extremely difficult technical problem. Source availability doesn't change the problems presented in preventing insider attacks, correctly identifying voters while protecting their identities, and in creating trustworthy audit trails that don't undermine voter anonymity. Electronic voting is challenging in terms of usability, the scale on which it needs to be implemented, and on the levels of trust we must have in the outcome. Source availability does not change any of these essential factors.

Conclusion

This article has shown that the source-available approach can offer some security and transparency benefits to the development of e-voting systems. Conversely, source-available software fails to address the fundamental challenges involved in adding technology to the voting process. The gains in system quality that source availability might offer are not sufficient to outweigh the considerable risks to the voting process that all forms of e-voting present. It was for these reasons that, after three years of extensive effort, I ceased development of GNU.FREE, the world's first open source e-voting software [3]. More recent open source initiatives such as the Open Voting Consortium in California are highly likely to encounter similar difficulties. No amount of source availability, clever design, or ingenious code can prevent poor implementation or malicious source changes.

References

1. Ackerman, E. E-voting probe criticizes vendor. The Mercury News, 2004; www.mercurynews.com/mld/mercurynews/news/politics/8491288.htm.

2. Fritze, J. New voting equipment didn't pass state muster. The Indianapolis Star, 2004; www.indystar.com/articles/2/139985-5092-092.html.

3. Kitcat, J.P. GNU.FREE...A Free Software Odyssey. 2003; www.j-dom.org/h/n/WRITING/nonfict/ALL/41/.

4. Mohen, J. and Glidden, J. The case for Internet Voting. Commun. ACM 44, 1 (Jan. 2001), 72–85.

5. Peeling, N. and Satchell, J. Analysis of the impact of open source software. QinetiQ, 2001; www.govtalk.gov.uk/documents/QinetiQ_OSS_rep.pdf.

6. Stallman, R.M. Why Software Should Not Have Owners. Free Software Foundation, 1994; www.fsf.org/philosophy/why-free.html.

7. Zetter, K. Aussies do it right: E-Voting. Wired News, 2003; www.wired.com/news/ebiz/0,1272,61045,00.html.

Originally published in the October 2004 Communications of the ACM where a PDF version is available.

Turnout in the 2003 pilots [evoting]

2006-12-13T00:00:00Z

The following tables show figures that are direct quotes from the Electoral Commission's evaluation of the 2003 e-voting pilots, specifically Tables 3 and 7 pp63-65. My response response to the Commission's evaluation is here [PDF]

Turnout at the pilots providing remote e-voting

Authority	Date of last election	Turnout at last election*	Turnout at 2003 election**	% change	JK's % change
Norwich	2002	35.0%	35.8%	+1.4%	+0.8%
South Tyneside	2002	55.0%	46.3%	-8.7%	-8.7%
Chorley	2002	62.0%	49.8%	-12.2%	-12.2%
Stratford on Avon	2002	45.0%	36.6%	-8.4%	-8.4%
Kerrier	1999	32.0%	28.3%	-3.7%	-3.7%
Rushmoor	2002	35.0%	31.0%	-3.9%	-4.0%
South Somerset	1999	38.0%	47.4%	+9.3%	+9.4%
Shrewsbury & Atcham	2002	43.0%	54.8%	+11.8%	+11.8%
Stroud	2002	38.0%	36.6%	0%	-1.4%
Ipswich	2002	32.0%	31.7%	-0.3%	-0.3%
Vale Royal	1999	31.0%	29.0%	-2.0%	-2.0%
Swindon	2002	31.0%	29.9%	-1.1%	-1.1%
St Albans	2002	38.0%	43.3%	+5.3%	+5.3%
Sheffield	2002	30.0%	32.5%	+2.5%	+2.5%
Averages by JK				-0.71%	-0.86%

* Pre-2003 turnout figures from the Ofice of the Deputy Prime Minister
** 2003 turnout figures calculated using information gathered from the local authorities and include invalid votes. The e-pilot was held in only 15 of the 29 Sheffield wards. Turnout as percentage of registered voters.

Turnout and kiosk usage where kiosks were the only method of voting in-person

Authority	Date of last comparable election	Turnout at last comparable election	Turnout at 2003 election	% change	JK's % change	Kiosk usage
Basingstoke & Deane	2002	29.0%	31.3%	+2.6%	+2.3%	75.4%
Chester	2002	36.0%	32.2%	-3.8%	-3.8%	90.3%
Epping Forest	2000	30.0%	28.4%	-1.6%	-1.6%	95.1%
Stratford on Avon	2002	45.0%	36.6%	-8.4%	-8.4%	77.3%
Averages by JK				-2.8%	-2.88%

Comments by Jason Kitcat: This data shows an average change in turnout of -0.71% (mode -12.2%) for the remote e-voting pilots and -2.8% (mode -8.4%) for the kiosk pilots. Not a great record but the Electoral Commission argue that there is no evidence that introducing new voting methods reduces turnout in any way. It is possible that the turnout figures would have dropped even further without the pilots, but equally the figures could have been higher without e-voting. Certainly at first blush these figures contradict the Commission's view and it is interesting that they did not include indicators such as averages or modes in their report.

The problem is, as any psephologist will agree, that it is virtually impossible to identify which factors account for changes in turnout. New candidates, a local scandal, a supportive local paper or a contentious new development can all impact turnout, as can the proportionality of the voting system. While the figures presented cannot be conclusive it seems that so far e-voting is an extremely expensive way to achieve very little.

2006 update: Looking over these figures again while preparing for the 2007 pilots I've noticed some inconsistencies. The changes in turnout have not been correctly calculated, the biggest discrepancy being Stroud and Norwich in the first table. Stroud shows 0% change yet calculates to -1.4%. For Norwich the change is shown as +1.4% when it calculates to +0.8%. Correctly calculating the change in turnouts using the figures in the table gives an average change in turnout of -0.86% for remote e-voting pilots and -2.88% for the kiosk pilots. See the JK's % change columns.

But that's not all. For Stroud the Commissions's Stroud 2003 pilot report (pp15) shows a -3.2% change in turnout between 2003 and 2002 and although these elections were not identical it is this election the Commission claims for use in the table above. Despite being -3.2%, using the table's figures the change is -1.4% if correctly calculated and only 0% is printed. For Norwich the table shows the last comparable election as being 2002, yet the Commission's own Norwich-specific report for 2003 (pp17) shows 2001 as the last local election. The figures from this specific report show a 2001 to 2003 turnout change of +0.59% against +0.8% using the above table's numbers and the 1.4% actually printed.

Just using the two turnout change figures from the detailed reports changes the average turnout for the remote e-voting pilots to -1%. Perhaps there's a good reason for the figures being the way they are e.g. some adjustments due to boundary changes that weren't properly noted in the main report, but then why the discrepancies in figures between the council-specific and the main reports all of which were Electoral Commission published?

These errors got me curious so I went through all the Commission's local reports for the 2003 pilots and put my own table together. I cannot find any rationale for why the figures between the main report and the local pilots reports differ so much. Certainly a small part is that the pre-2003 figures in the table above have been rounded to whole numbers only, but they alone do not explain some huge differences such as Ipswich showing a change of -7.01% against the -0.3% published. The changes aren't all one way, some areas did better than shown but overall the average change is worse, 23.9% worse: from the published changes in turnout we get an average of -0.71% but from my table we get -0.88%.

Turnout at the pilots providing remote e-voting using local pilot reports

Authority	Date of last election	Turnout at last election	Turnout at 2003 election	% change	correct % change from published*	published % change**
Norwich	2001	35.18%	35.77%	0.59%	0.80%	1.40%
South Tyneside	2002	54.7%	46.3%	-8.40%	-8.70%	-8.70%
Chorley	2002	61.52%	49.81%	-11.71%	-12.2%	-12.2%
Stratford on Avon	2002	39.18%	36.6%	-2.58%	-8.40%	-8.40%
Kerrier	1999	32.22%	28.30%	-3.92%	-3.70%	-3.70%
Rushmoor	2002	32.0%	31.0%	-1.00%	-4.00	-3.90%
South Somerset	1999	38.0%	47.4%	+9.40%	+9.40%	+9.30%
Shrewsbury & Atcham	2002	41.08%	54.80%	+13.72%	+11.80%	+11.80%
Stroud	2002	39.8%	36.6%	-3.20%	-1.40%	0%
Ipswich	2002	38.71%	31.7%	-7.01%	-0.3%	-0.3%
Vale Royal	1999	30.8%	29.0%	-1.80%	-2.0%	-2.0%
Swindon	2002	31.2%	29.9%	-1.3%	-1.1%	-1.1%
St Albans	2002	38.0%	43.3%	+5.3%	+5.3%	+5.3%
Sheffield	2002	30.02%	29.63%	-0.39%	+2.50%	+2.50%
Averages				-0.88%	-0.86%	-0.71%

* Shown as JK's % change column in first table
** Shown as % change in first table

LinuxUser Column 12 [linuxuser]

2006-08-19T00:00:00Z

It was unexpected but incredibly welcome when Google’s Larry Page had a go at electronic manufacturers during his speech at January’s CES show. Perhaps not as attention grabbing as some other tech CEOs accidently walking into the adult video conference next door and certainly not as fun as Robin Williams adlibbing his usual comedy gold - but Page’s comments were much more important.

Admittedly it’s a little odd to hear a company which is supposedly about search, having views on hardware but the man had a point. Why do all these devices have different, incompatible charger sockets? Page noted that it’s incredibly cheap to put a mini-USB socket on any device and that perhaps it would be a good standard to agree on for chargers. I note that newer BlackBerry models do just this.

I can’t really see what benefits there are for phone, digital camera, MP3 player and console manufacturers to all produce their own charger and socket specifications. Surely it would be cheaper for all suppliers if there was a common charging platform. This wouldn’t preclude firms like Apple innovating on the form of the power brick (smaller, cheaper, whiter).

Road-warriors do have some options to reduce clutter but they’re not ideal. I use something called iGo which lets me charge two devices simultaneously. I purchase ‘tips’ which let the charger plug into my many gadgets. So I have Nokia, BlackBerry and iPod tips. But I still need separate chargers for my JVC video camera and Canon still camera - iGo doesn’t provide tips either due to ignorance of those markets or a refusal of those companies to license the charger specs. The result is a bag heavy with chargers when ideally hotels could just provide mini-USB charging leads as standard - think how easy that would be!

My back can still take the weight of four or five power bricks so it’s more an irritation than a necessity to do away with all these chargers. But in the office where we have 6 external FireWire drives we can get in an awful tangle of leads. The chargers are all similar but not quite the same and each adaptor only powers one drive. So 6 drives means 6 plugs leads, 6 power bricks and 6 output leads to match up with 6 sockets.

It’s untidy and I’m sure one single large adaptor powering all our drives would be much more energy efficient than all the separate adaptors we’re forced to use. Of course it would be a single point of failure but I’d rather keep one spare 6-way adaptor handy than 6 spares for each type of drive.

I’ve thought about this rather a lot you see and so when I heard good old Larry moaning about it I could share in his pain. But what the hell can Google do about it? Not a lot I imagine. In the meantime Apple’s new MacBook Pros have a different power socket so no more borrowing Apple using friends’ chargers unless they all upgrade.

Perhaps I’m worrying needlessly - by all accounts we’re going to be suffering power blackouts soon enough thanks to energy shortages, so I’ll just need to hope Sun’s new enviro-computers are efficient enough to run off the power I can generate while frantically pedalling my exercise bike.

It’s interesting to see this whole power per watt trend play out. Are energy costs going to rise enough in the next 10 years to really change the behaviour of corporate IT purchasing? From what I hear electricity costs, directly due to server consumption and from cooling needs, are already getting painful for some datacenters. Sun’s enviro server push may well be spot on. Seeing their first few ads for this new line made me think of those heady days when some server hosts promised to only be powered by solar panels, What ever happened to them? Are they still going, constantly adding panels as they add servers? I imagine each Xeon server would need about a football field of panels to keep going or am I just being cruel… nah.

So can we ever get a standard for charging? If people step back to see the big, wide angle view then I think we might just be in luck. We’re in a simmering pot of never ending innovation driven by fierce competition. That’s generally good and we don’t want to prevent positive innovations. But when folks begin to recognise that standardising the Internet, electrical sockets, DVDs and so on have unleashed massive amounts of creativity they also begin to see that these standards generated huge financial rewards for many including those who may have first resisted these standards (such as AOL who were late to the Internet game).

It’s ok to stop being original with charger sockets. Let go, that’s right, relax and let go. The time you save there you can put into something else much more exciting and innovative. So let’s work towards energy efficiency and simplicity by offering one standard charger format in as many applications and devices as possible.

This column first appeared in the excellent LinuxUser magazine, available internationally. For more information visit http://www.linuxuser.co.uk

LinuxUser Column 13 [linuxuser]

2006-08-19T00:00:00Z

Consistently making great products in incredibly difficult. The last forty years of our wonderful technology industry is absolutely littered with the carcasses from thousands upon thousands crappy applications and terrible hardware. A smaller group of hard working firms have made one fantastic product or product line in their history. It is an extremely tiny, elite group indeed who can keep creating admirable new hardware or software that consistently blows the market away.

Of course everyone stumbles and I can think of terrible products from great companies such as Nokia, Apple or Canon. But the bulk of their output is incredible.

Despite knowing how hard it is to make wonderful things, I can’t fail to be surprised when I come across something which could have been so much better. How hard would it be for Motorola to sort their terrible user interfaces out? Why can’t a hotel run breakfast at sensible times? Is it really that hard to make my ADSL router’s configuration usable? Who thought a programming book published with tiny print was a smart idea?

I think in most cases dumb outcomes don’t flow from stupid people. The problem is being focussed on the wrong thing, not realising what’s important to the customer. Sometimes it’s not even understanding who the customer truly is.

So that programming book probably has tiny print because they had been told to save paper. And my ADSL router is hard to use because they were worried about including as many features as possible for those magazine reviews. Hotels have breakfast organised around their more profitable lunch service, not around their guests’ needs. I can’t think of any reason to justify Motorola’s abysmal software though.

Knowing who your customer is can be difficult, but staying focussed on their needs is even harder. Many don’t ever really know their customers’ needs (though they may think they do), and when those needs shift even fewer keep pace with those changes.

I think many of the more successful FLOSS applications have done well because their leaders have been the epitome of their target users. Scratching their own itches means they are deeply in touch with their customer needs. GNOME and KDE both emerged out of their developers’ desire to have better graphical environments for their day-to-day work on Linux. We’ve all benefited hugely from their work and scratching of their personal itches.

But Linux is a funny one… Who are its customers? Whose needs is it trying to address? An operating system is such a flexible generalised tool (or toolset even) that it’s hard to know which direction Linux is pointing in sometimes. We have Linux for phones, TV set-top boxes and so on. We even now have PalmSource’s ACCESS Linux Platform for mobile devices. There’s no doubt that parts of Linux are outstanding, but for who and when?

In previous columns I’ve argued that the huge number of Linux distributions is holding back it’s more widespread adoption. I think many of these distributions are attempts to create a very specific customer focus for their flavour. So PalmSource is trying to only service smartphone manufacturers. In contrast Ubuntu’s Linux distribution is hugely focussed on consumers wanting to run Linux on their desktop PCs.

It’s sad when a company that used to be great at making products seems to lose it. But often they may be victims of pressures we as their customers can’t even imagine. I’ve been reading Andrea Butter and David Pogue’s excellent history of Palm and Handspring, “Piloting Palm”. It’s an excellent book which I can highly recommend. The book details how the Palm team were pulled in every direction by partner firms, venture capitalists and then corporate parents USRobotics followed by 3Com. Each time the differing visions, goals and cultures pulled the team this way and that - it’s a miracle anything got out the door let alone became the success it did. There’s no doubt that the core Palm team were single-minded to the point of obsessiveness in protecting their product’s goals and it’s simplicity for the user. It paid off.

Until 3Com took control the original Palm team also fiercely resisted generally licensing their operating system apart from for very specific niche uses such as to a specialist ruggedised barcode scanner manufacturer. They understood that only by controlling both the hardware and software could they maintain their relentless focus on a simple, easy product for their customers. I think for these same reasons Apple will never license their operating system to others - controlling the complete experience is too important.

Which is why, as much as they can, the Linux distributions have been customising as much as they can from installers to desktops and window managers. But who’s going to step up with enough cash and faith in their ideas to put together their own hardware and Linux distro in one optimal package? The Sharp Zaurus was a small-scale version attempt at this and flopped horribly everywhere outside of Japan where it still survives, barely.

It’s time for someone with deep pockets to make the leap and show us how great Linux living can be. It’s the only way we’re going to see any long term progress against Windows or MacOS.

This column first appeared in the excellent LinuxUser magazine, available internationally. For more information visit http://www.linuxuser.co.uk

LinuxUser Column 14 [linuxuser]

2006-08-19T00:00:00Z

The other day a friend passed on a link for a new online government service he thought I’d be interested in checking out. I tried to get into the system and noticed that the registration forms seemed vaguely familiar somehow. “Hmm, where do I know this from?” I thought.

Up came the view source window in Firefox and I began sniffing around. It took me all of a minute to discover the open source forum software they were using. They hadn’t even bothered to remove the credit text, they’d just used a stylesheet command to make the text white so it wouldn’t show on the white background. Now while this software is protected by the GNU GPL this wasn’t an infringement of the letter of the license, acknowledgement was requested but not demanded.

Still what really irked me was that all over the site were plastered notes of how it was powered and run by some consultancy company. They didn’t have the good grace or honour to acknowledge the fact that they’d just re-skinned a free (in every sense of the word) software package.

Why did they do that? Is there a stigma with admitting that open source software powers the solution you’re providing to a client? It’s hard to even think about this kind of question if you’re at all immersed in the Linuxish world. Trying to step back as far as I can I think that there may still be a little doubt raised by some few clients who read a proposal suggesting open source. Yet every proposal we submit includes a page detailing the software we use (all open source) and it’s been nothing but a positive point for our clients. I’ve never lost a contract because of what was on that page.

I think the issue may lie more with the practices of some suppliers. If they’re charging a large sum of money for their work they need to justify that expense. If it’s clear that the core of the project delivered was made by volunteers and can be downloaded for free then your client may see the ‘value proposition’ slightly differently. In many ways this isn’t a technical issue, it’s a matter of ethical integrity in consultancy practice.

The honest craftsmen has confidence in their work and is proud to explain what they have done for their client. They can justify the time and money needed for their work. So in my company’s case we use some fundamental building blocks such as Linux, Apache, MySQL, PHP and some smaller modules like the Magpie RSS parser integrated with code developed over seven years. We’re happy to charge a reasonable fee for the new code we created and the services we supply around that. But if the company in the example above charge a large amount of money for some kind of community site before just installing a free bulletin board package and changing the template they have dishonestly charged for work they didn’t do.

Now some might say that the buyer should have been smarter. They should have asked which software would be used. But the provider could have claimed it was their own ‘proprietary industry leading package’ or some such marketing speak. Well then perhaps the buyer should have checked the site like I did. Perhaps. But I’ve been working on online communities for more than a decade, most people wouldn’t have had that intuition that a registration form template looked familiar. When it comes down to brass tacks information technology is a wild west industry where people with no qualifications or credentials can become major suppliers and trusted partners.

This is, of course, a double-edged sword. Smart people are welcomed no matter their background and the industry undoubtedly benefits. But customers can and do suffer when suppliers do them a disservice through dishonesty or incompetence (or both).

Unlike some, I don’t feel that you should need to be a Chartered IT Professional (a real qualification, by the way) to be a practising consultant or supplier. But membership of organisations like the British Computer Society does provide a useful ethical code. It’s not easy to enforce but it sets out a good framework for buyers and suppliers to work towards.

The problem is that many, if not most, potential customers have no idea about the codes of conduct that exist in the various professional associations for technologists. We all need to evangelise our own association’s codes were we can. Also I think it helps to connect to your customers’ world. So for my company we’re members of the professional bodies relating to school communities and fundraising, our customers find this reassuring.

This isn’t just about customer relationships though. We have a responsibility to help protect open source software and the licensing schemes that created our free-wheeling community. Only be maintaining the perceived power of the GNU GPL can we prevent subtle, encroaching infringement. We need to be quick to educate the ignorant on licensing issues. We also need to, where appropriate, take action against the infringers. Otherwise they’ll spoil the party for all of us.

This column first appeared in the excellent LinuxUser magazine, available internationally. For more information visit http://www.linuxuser.co.uk

LinuxUser Column 15 [linuxuser]

2006-08-19T00:00:00Z

Do you remember Application Service Providers? Those people we were all going to rent software from about 4 or 5 years ago? What ever happened to them and their marketing hype? Not much at the time but today we’re using them all the time. We are? Yes, folks. Every web application including LinkedIn, GMail, Writely and Google Calendar is a piece of software running off a server. Through a subscription or advertising we’re paying to use that software as a service, at no point do we ever own or a have an indefinite license to use that software.

The result is that, potentially, web applications can be more restrictive and less free than any non-free desktop software you care to imagine. For my sins somehow or other I still own a Microsoft Word 6.0 license and if I really wanted to keep running it, I could. (I have no idea if WindowsXP would run it but I’ve got nasty old Windows 3.1 on disks somewhere…) But if a web service like Flickr or eBay changes their price plan you either need to stump up the difference or stop using their services. There’s no ownership of the software whatsoever. Some of these providers, like Flickr, are at least very clear that you own your own data such as photos and so make it easy for you to take your stuff with you should you choose to stop paying those monthlies.

Those regular fees are, in many ways, what this (attempted) whole paradigm shift is about. Anybody in business loves regular, predictable payments from their clients. But for the software business regular money is like the holy grail. Why? Because normally software companies run on no income until they release their package, then there’s a huge surge of revenues which trickle back down to near nothing until the next version is ready. It’s hard to manage cash flow and it ends up putting ridiculous pressures on the development process. My first company operated in this way, we had to when shipping floppy disks was the only way. But the Internet allows for an easy way to collect regular fees for software that is updated constantly, as often as daily.

I certainly don’t think this is a massive conspiracy in the works, it is just the inevitable logic of business pressures and technology coming together. Nevertheless there are important implications for open source… As I’ve mentioned in a previous column, I have a theory that this new wave of web 2.0 applications could be a novel way to extract revenues from customised open source software. With no software distributed there’s no need to reveal the source under the terms of the GPL. So open source applications are being successfully leveraged for profit without the community benefit of source code availability. This is an important point of principle in its own right but what about the everyday experience for users? What is this brave new world of web applications like to use?

They’re ok. I’m sure you’ve played with them too. They all need to make trade-offs between the benefits the network brings over the richness of the experience. Being web-based allows for new uses such as social networking, sharing documents and connecting diaries. But being online also means we need to have all these applications squeezed down the still narrow pipes to our computers. This brings along with it many potential points of failure and inevitable latency in the user experience.

Here’s a case study you can try for yourselves at home… You can easily compare Google’s Calendar system with Outlook on Windows, Evolution on Linux or iCal which comes bundled with every Mac. Forgive me readers but I’m a Mac user so I’m going to use iCal for this… Let’s start the comparison then. Google Calendar and iCal offer very similar levels of functionality but one is online and the other is desktop-based. Yes, you can access Google Calendar from any web browser (well Firefox or Internet Explorer) but picking dates, modifying events and general everyday tasks are that much clunkier than iCal. iCal is fast, rich and can be quickly synchronised with my Blackberry. This isn’t a calendaring app shoot-out, but an example to highlight that desktop applications still have much to offer us. Their speed, availability with or without the Internet and usability make desktop applications, in my opinion, the only sensible option for everyday use.

I don’t know about you, dear readers, but I find my computer and its hard drive to be dramatically more reliable than my Internet connection (especially since I got the gift of a free upgrade to 8Mbit ADSL, but that nightmare is a whole other story). Given current trends including the vast amount of old cabling still in houses and streets around the world, the Internet isn’t going to be getting much more reliable any day soon. So it makes sense to keep your everyday data local using the Internet as a conduit for synchronisation and backup whenever possible. So my advice is enjoy the Internet but treat web applications with a healthy bit of caution.

This column first appeared in the excellent LinuxUser magazine, available internationally. For more information visit http://www.linuxuser.co.uk

LinuxUser Column 16 [linuxuser]

2006-08-19T00:00:00Z

Service makes all the difference. That’s what I’ve learnt the hard way over the past few weeks. And there really can be no doubt that truly excellent service is very hard to provide. If it wasn’t so hard we’d be spoilt for choice in every service industry - but how many bad restaurant, bank or doctor stories have you got?

Here’s a bad web hosting story to add to the mix: Earlier this year it became clear that one of my clients were doing so well that we were going to need to get them a serious web serving setup with generous dollops of bandwidth on call. So we shopped around for a dedicated Linux-based solution (of course). I can now tell you gentle readers that, sorrow of sorrows, we are on our fourth hosting provider since we first began our odyssey looking for a reliable new host.

The first host had such a bizarre system setup that nothing was where anybody would expect it to be. And their compulsory statistical processes slowed the server down to a halt every 15 minutes. Despite it being a dedicated server we weren’t allowed to remove these insane CPU hog processes. After pleading failed we were faced with the prospect of our site stopping every 15 minutes hence we took the decision to move on.

So we moved to the next provider who looked very promising and had some good write-ups. They had a great software setup but the hardware and bandwidth turned out to be as ropey as hell. We were going to run out of physical resources in no time. We couldn’t believe it. They were totally misleading about how much horsepower they really had to offer clients.

All along I’d wanted to take this client over to the great company I usually host clients with. Unfortunately this client is growing so rapidly that they’re just about to grow out of the largest provision my hosts are happy to deal with. Which is disappointing for me, but it’s a position I deeply respect. Saying ‘No’ is incredibly hard in business. You never want to turn down a client. But my hosts know that servicing high intensity, heavy duty websites is a different kettle of fish to looking after the needs of small to medium sites. Their datacentre, their support processes and business model are all fine-tuned to meet the needs of a certain type of customer. The small amount they would gain by having one or two giant sites would be hugely detrimental to the rest of their business. If only these other hosts could be so wise.

My clients undertook a truly exhaustive search to find the third choice. Using industry associations and other sources they did everything humanly possible to verify the good reputation of this supplier. We started the move only to find a server not configured to spec, misleading or non-existent documentation and a trail of poor service. It was a shambles and the host got very nasty as my client decided to look elsewhere, again.

We were all exasperated. We couldn’t believe how hard it was to find decent Linux hosting for a successful website. How could people stay in business this way? I’m not sure but I do think marketing seems to overwhelm good old fashioned reputation and referrals. It’s very difficult to separate PR from genuine good feeling about a company, particularly with the abuse of many of these web hosting review sites that goes on these days. The hosts are reviewing themselves in unsurpisinlgy glowing terms again and again.

Finally my client decided to bite the bullet and go for a rather more expensive option. Thank goodness this host, the fourth, turned out to be serious operators. Support has been incredible, the configuration is logical and people answer the phone. Wow, now there’s an idea for you.

Great software, or great software ecosystems (which I guess is what Linux is) can’t alone make for a great customer experience. History is not just littered but carpeted with tales of the technically superior product which failed to win the market. For geeks it’s still hard to accept that this can happen. The technical product is just one part of this mix.

Service is another key ingredient which often gets lost, forgotten or left down the back of the sofa. It’s hard as you need to be patient, understanding, have an eye for detail and be a great communicator. It’s easy to want great service but much harder to give.

So next time you get extraordinary service, don’t just take it for granted. Make a point of complimenting the company and people involved. And do them a favour by spreading the word about their business. We all need to work together to keep good service alive!

_To protect the identity of various parties I did not originally include the names of any companies. I'm now happy to be able to say that the fine host we ended up with was RackSpace UK and our usual host are FutureQuest

This column first appeared in the excellent LinuxUser magazine, available internationally. For more information visit http://www.linuxuser.co.uk

LinuxUser Column 17 [linuxuser]

2006-08-19T00:00:00Z

I love cooking - baking bread, making pasta, creating sushi and generally concocting food - it’s a passion. And like many ‘foodies’ I love trying out recipes. It may sound strange, but nearly every time I cook a new recipe, I think of Richard Stallman.

Why? Because sharing recipes is one of the examples Richard often uses to explain why Free Software makes sense. If someone comes over to eat and enjoys the food you served then it’s normal and friendly to share the recipe you used. You share the recipe no matter where it’s from: your grandma, a newspaper or a book. You certainly don’t stop yourself from handing over the recipe because you’d be breaching copyright - grandma’s or a publisher’s; that would be absurd.

You also don’t see chefs issuing press releases lamenting their lost revenues due to recipe sharing. They make their money from performing the recipes with excellence and flair in their restaurants.

Yet when it comes to software we see companies hounding people over sharing, as Richard Stallman so pointedly calls what others have labelled ‘piracy’. Many small software consultancies do charge for ‘cooking’ instead of for the ‘recipes’ (programming instead of software) but most software providers don’t choose this path, as we know.

If you love cooking then one of the great things about eating out is that you can often reverse engineer what the chef did to get your meal ready. Unfortunately even the best programmers find it a difficult task to understand quite how a piece of software was put together unless they can see the source code. This has major implications for learning and growing the practice of software engineering. (The web is an exception: It’s interesting to note that many web programmers learnt their trade because HTML, CSS and JavaScript code on websites is viewable for all to see.)

Apparently in Japan great chefs are notorious for keeping the details of their recipes secret. This has caused great difficulties in passing on treasures of Japanese culinary art. Allegedly apprentices are known to sneak into kitchens at night in attempts to discover their teachers’ secrets. Only sometimes do they succeed.

We are fortunate that, generally, cooks like to share the results of their culinary experimentations. This means that we can learn from each other and build on previous work. The same applies in academia - only by publishing findings can researchers stand on the shoulders of giants. Very little is achieved or discovered in isolation of what others have found.

Yet the software world loves isolation. Every program is a secret, the code is locked up in the digital kitchens of software vendors. Apart from Free Software, that is. Free Software is wonderful in so many ways but surely one of its most vital points is that is alive to the possibilities of the future. People can learn and build upon the work of previous generations thanks to the power of open source licensing. Closed-source software dies and crumbles away once its parent supplier moves on or closes down. But with Open Source it can carry on, be reused, unpacked and understood.

If we each had to discover independently how to make bread or cook an omelette life would be very strange indeed. We have no trouble in sharing these mysteries of the kitchen - whoever discovered them is lost in the mists of time.

How strange it will seem in generations to come if the secrets of our most important software is not shared in the same way.

I hope that the ever growing movement towards eco-technologies which are hyper-efficient can be married to the Free Software movement. Making money from great ideas is no problem. But if we’re going to avoid making global warming any worse then we desperately need to share as much of these eco-technologies with as many people as possible. Free Software’s ethic is all about sharing. Perhaps the newly invigorated Al Gore who seems to be at the forefront of eco-tech should spend a week with Richard Stallman. And make sure somebody films it as I’m sure it would make for extremely interesting viewing. Al could put it on his cable channel.

I think it’s important to remember that while some people have heard of Linux very few people know what it is. So you may think Al Gore wouldn’t need to talk to Richard Stallman, he’d understand the issues (maybe). But while he and others may have a rough idea about Open Source, very very few people have a full grasp of the philosophical importance of Free Software. There’s nothing about using Linux, Apache, Samba or any of the other great projects out there which forces (or gently encourages) one to understand the key motivations behind Free Software. So we can’t assume that users understand what Richard Stallman and co are fighting for. Thus spreading the word is still important work. When immersed in something it can be so difficult to remember that others are completely unaware. But they are and spread the word we must…

To learn more about the philosophy of Free Software visit: http://www.gnu.org/philosophy/

This column first appeared in the excellent LinuxUser magazine, available internationally. For more information visit http://www.linuxuser.co.uk