Posts

Now it can be told (apparently). The Twitter abuse that I posted about yesterday resulted from a Twitter employee giving their password to a third party service. Someone then used that password to access Twitter with administrative rights and amuse themselves. Part of the problem here is that the credentials required to access your account through the API are the same as those required to access the site through the Web interface. But the other lesson here for developers is that you should really split up the administrative features of your application and the end user features into separate accounts. They probably shouldn’t even use the same interface. That may be more painful for users but it eliminates a lot of risks. And of course employees should know better than to hand out their passwords to random Web sites. ...

As Andrew Leonard notes, with Apple’s announcement today that the iTunes Store is phasing out DRM on the music sold there, we can say that music DRM is dead. It took longer than most would have hoped, but I’m so glad to see it happen. It makes you wonder what’s going to happen with the Kindle down the road. I’m still amazed that people are licensing books from Amazon.com instead of buying them for themselves. ...

Here’s James Surowiecki on Blu-Ray: I think the Internet and the cable systems have a long way to go before streaming video or even high-definition movies on demand become a meaningful replacement for something like Blu-Ray. For the vast majority of Americans, it currently takes far too long to download a high-definition movie for it to be convenient, and while cable systems are doing a better job of offering high-definition films on demand, the supply is (at least in New York) minuscule, and the quality is nowhere near as high as Blu-Ray offers. ...

Small things count when they come in large numbers – lead wheel weights used to balance tires are an example. According to the Ecology Center, 70,000 tons of lead per year is used to manufacture these weights, and they are the largest source of unregulated new lead in the environment. These are the issues of activism that interest me. Replacing them with weights made of other materials would be fairly easy and cheap, but most people don’t even know what lead wheel weights are. What’s the path to producing change on this front? My guess is that you try to get them outlawed somewhere, and then try to get that law to spread. Eventually they’ll be banned in enough places that it’s just easier not to use them at all. ...

James Fallows links to a report produced by the Asia Society on the retreat of glaciers on the Tibetan Plateau. I’m glad we have a President who’s going to take climate change more seriously, but I still don’t feel like this issue gets the attention it should.

Michael Lewis explains in a nutshell why the financial industry must be carefully regulated: Richard Fuld, the former chief executive of Lehman Brothers, E. Stanley O’Neal, the former chief executive of Merrill Lynch, and Charles O. Prince III, Citigroup’s chief executive, may have paid themselves humongous sums of money at the end of each year, as a result of the bond market bonanza. But if any one of them had set himself up as a whistleblower — had stood up and said “this business is irresponsible and we are not going to participate in it” — he would probably have been fired. Not immediately, perhaps. But a few quarters of earnings that lagged behind those of every other Wall Street firm would invite outrage from subordinates, who would flee for other, less responsible firms, and from shareholders, who would call for his resignation. Eventually he’d be replaced by someone willing to make money from the credit bubble. ...

There’s a phishing scheme being run against Twitter users right now. It looks like the objective is the collection of more Twitter passwords, but I’d expect that there is some other fraudulent angle as well that is perhaps yet to be revealed. In any case, avoid clicking on links in direct messages and if you’ve given your password to a third party service, you may want to change it.

This year’s Edge Question is “What have you changed your mind about?” I’ll play along. This is a list of some things I changed my mind about in 2008. Database normalization and redundancy avoidance are the key principles in database schema design. I was once fanatical about normalization and did everything I could to avoid repeating data anywhere, or storing aggregated data in the database. My feeling was always that with SQL you could do all of the aggregation you need to, so why risk introducing bugs that result in conflicting information being inserted into a database? What I’ve come to see is that performance, in many cases, wins. If you have to denormalize to get the performance you need, do it. Storing the atomic values that can be used to derive the aggregated values is usually necessary, but if you have to store the aggregated data to keep customers happy, do it. I’ve come up with a number of other cases where keeping redundant data can be helpful in improving performance, and I’m just going with it. Normalization is a means, not an end. JavaScript is harder to debug than CSS. At one time, I avoided using JavaScript at all costs due to cross-browser issues. These days, there are a number of popular JavaScript libraries that do an outstanding job of abstracting away browser differences and working around for browser bugs. Today, if you’re willing to use a library, dealing with cross-browser issues in JavaScript is no big deal. On the other hand, I’ve been shocked to see how many incompatibilities there are between CSS implementations in browsers. The number of hours I spent (or watched others spend) dealing with annoying CSS issues in 2008 astounded me. And there’s very little out there that has been done or can be done to make these issues go away. CSS depresses me. Texting is not particularly important. See this blog post to see why I changed my mind. You don’t have to make programmers do any programming at interviews. Experience this year has shown this not to be the case. I used to think you could just ask them about projects they worked on, talk about their responsibilities at work, and ask general technical questions and still get the information you need. I now know that in order to successfully interview a programmer, you have to watch them write code, or at least pseudo-code. Even the simplest programming demonstrations weed out a large majority of applicants.

The New York Times has an op-ed on standardized tests that’s worth reading. Even as college administrators recognize that standardized test scores are an imperfect measure of the quality of college applicants, all of their incentives are tilted toward placing greater weight on test scores: Consider the admissions director at our hypothetical college. He knows that college ranking systems take SAT’s and ACT’s into account. He knows that bond-rating companies look at the same scores when judging a college’s credit worthiness. And in lean times like these, he would be especially eager for a share of the so-called merit scholarship money that state legislators give students who test well. ...

I wonder if a dollar value could be assigned to the free service that Amazon.com unintentionally provides by keeping a library of the album art for nearly every CD ever issued. I’ve probably copied hundreds of CD cover images from Amazon.com to fill out my MP3 collection, and I have obviously never paid a dime for any of them. There are plenty of ways to access Amazon.com’s library of album art without even visiting the site directly through various applications and Web sites. (See here, here, or here.) ...