ed costello: articles and essays

Leashes and Water Coolers (or: Getting the EGR Valve Replaced)

2006-04-27T17:22:19Z

So, we're down to driving the car about twice a month now on average. Usually it's me taking the car out to meet with a friend for lunch once a month upstate, or the occasional need to fetch her highness Frisket from Monstermutt.

Still, I take the car in regularly and try to keep it clean and in shape. And we tend to drive it more in the summer than the rest of the year. So today is the one day a quarter I spend a morning (and likely much of the afternoon) somewhere in Queens.

I'm not quite sure where I am, I take the BQE north to Northern Boulevard, drive west a bit, and drop the car off at Paragon. About two visits ago I discovered a Starbucks had opened about six blocks west on Northern. Now, I hate coffee, but I love WiFi, so I'm spending the time in a Starbucks.

I've never been one of the working-in-Starbucks crowd, probably because of the intense dislike for coffee (you want to see a horror face: give me a sip of your coffee). It's an interesting mix of people: some reading books, newspapers, others tapping away at laptops. One guy, an obvious regular since I saw him the last time I was here in December, has a whole corner locked up: laptop, phone out, headphones on and bluetooth headset at the ready.

Another table was taken up by a pair of men. It became apparent that it was a new manager and an employee and they were talking through some issues. I can't tell how it went, there was some raised voices but they did seem to leave amicably.

The downside of sitting in a Starbucks: I feel a guilty need to buy something, so there's a collection of Jones Soda Co. Root Beer on my little table.

There was a stretch of time at IBM where the idea of sitting at a cafe, whiling away the time while working wirelessly seemed like a great idea. Doonesbury even ran a series of strips where Mike Doonesbury works away in Paris, sitting at cafes all day.

I never really got to try that out at IBM, and now that it's pervasive, I wonder how good it is to do this regularly.

I mean, there are moments where I miss working in an office, but as I wrote in my post on sabbaticals, the office I keep looking back to is the one I had when I first joined IBM: show up no later than 8:12 (my hiring manager said that that 12 minutes was for commuting, and that you actually were considered to be in the office at 8:00). Log in, check your email, and then jaunt down to the company cafeteria for the morning bagel and diet Coke.

Return, work for a bit, then back to the cafeteria for lunch.

The afternoon was the longest stretch of work, though there was usually time for another jaunt to the cafeteria. You also always had one or two people doing the rounds, gossiping mostly, sometimes touching base. We had one coworker who was called The Deal, who made a regular stop at our office between 2:00 and 2:15. He'd dish out the goss, but also pass along useful bits of status on projects that we weren't directly involved in but still found useful in our work.

Communicating.

All of these moments, as wasteful as they appear to my post-costcutting, post-layoffs eyes, brought people together to communicate. Certainly much of the communication had nothing to do with what we were doing for the company, but a good chunk of it did. We exchanged ideas, tidbits, knowledge learned on the job. Have an acronym you can't decipher? Just type WHATIS at a CMS prompt. It's how I learned to move from being a student to an employee, working to a schedule, deadlines, how to communicate with coworkers.

And I know that that world is long lost, both within IBM and outside.

We're all very optimized now, trying to squeeze as much out of each moment of time to do work. But I wonder what we've lost, working on our own in the cafes, Starbucks, etc. We seem to have gained time, but we've lost the interpersonal connections we had.

You can argue that we've got I/M, email, Skype, newsgroups, mailing lists, blogs, feed aggregators: yes, truly we have more ways to keep in touch, communicate, that ever before. But we're more often that not communicating very precise information. What time the meeting is, the answer to your question (No, you can't have that domain name.).

And what a torrent of information that is. You can't unplug because you'll fall behind, so you check email on your phone, at public workstations. You check the blogs (the biggest sinkhole of my time since I discovered FORAVIEW many years ago).

But are we learning anything? I feel, and this is wistful hindsight I'm sure, I feel I learned far more in those moments of talking to the people I worked with than in the months if not years I've spent reading and absorbing information online. It's not that I feel I waste time reading stuff online, but the information is so dispersed, it's not concentrated, I have no personal connection to know whether or not this tidbit of advice is truly valuable.

You read about people giving up blogging. It's typically so-called A-list bloggers that call attention to themselves by announcing that they are giving up blogging. I wonder if it's because they feel they spend too much time reading, or too much time writing.

We've adopted all of this new technology, but we have yet to learn how to use it efficiently. I've been writing HTML for over ten years by hand most of that time. The last project I was involved in as an Information Developer at IBM was to develop a WYSIWYG editor for our shift to SGML from Bookmaster. That was in 1993. Now, while you can sort of do WYSIWYG editing of HTML, it's with specific platforms or tools. I'm typing this in a web form for MovableType, and entering various tags etc. by hand. I've used (alleged) WYSIWYG tools for blogging, and always find that I need just one specific tag that the tool doesn't support. And not only does it not support it, if I enter it by hand the tool strips it out when I return to WYSIWYG mode.

We keep building these silos, silos of applications, silos of information.

Part of the whole Web 2.0 meme is mash-ups, taking bits of applications and data and mashing them together. Sometimes, as with Google's Maps, the application owners support this explicitly. Other times, as with the housing maps based off Craigslist, there isn't explicit support, but the data is there to be used as you see fit. And still other application and data providers lock everything away. They prefer the customer they can squeeze over the potential customers they may gain by opening up.

With good reason: if you give stuff away for free how can you make money? Forget even profit motive, how do you pay the bills? A long time ago I was looking for an internship as part of my technical writing program. One of the potential places was a well known free software advocacy organization. They needed someone to write or update the user manual for one of their projects. In retrospect, it was silly to think I could just walk in and do the work, but I applied anyway.

And pretty much had the job if I wanted it. Only catch: no pay. No pay, no salary, no benefits, no stipend to cover the cost of living in Boston.

With a zillion dollars in student loans hanging around my neck I couldn't take the job (is it a job if you're not getting paid?).

So, instead I took the positon at IBM. My job was to create a booklet of commands for RACF. Seemed simple enough, I had three months to do it and had completed much of the work in the first six weeks.

Which was good, I didn't feel as guilty skipping out with the afternoon movie crowd, or spending as much time on the long lunches at the Poughkeepsie Galleria.

And it was good as well because three months in, one of the lead writiers on the product became gravely ill, and suddenly I was responsible for an entire book (I know these days individual writers get tasked with entire libraries in the refined, streamlined processes of 21^st century writing).

And it was at that moment that being able to talk to people face to face mattered. I don't know that the same situation could occur today, but if it did I'm not sure how successful I would have been if I had to rely entirely on email, I/M, Skype, etc. to communicate with people. I am sure I would have learned much of the information: after all I used email and I/M (so to speak) at IBM. But the face-to-face communications adds something to the mix Something I can't put my finger on, but it makes the education richer.

I read somewhere, once, that we learn by doing, we learn by repetition. And I wonder if our brains (or perhaps just mine) isn't wired yet to learn by doing on line. And certainly I try to avoid repetition while reading stuff online. I've read it, I don't need to read it again. But you don't say that when someone tells the story of the APAR from hell for the fourth time, because you notice, even subliminally, that the story is a bit different each time. Not that the previous times were false, but each time the tale is told there's a different audience. This time there's a developer that was involved with the diagnosis, that time a manager who had to make the call on where to invest the limited people resources she had to solve the problem.

You learn through the repetition, because it's not repetition: the story gains new facts and information, and because you've heard parts of the story before you can sort of elide out the stuff you know and focus on what you hadn't heard before.

You do this automatically, you don't consciously think about it. If anything you think: My god, he's going to tell that stupid story about the Deep Blue vs. Kasparov web site again!.

And it's these interactions we miss when we don't work together. If you're not working together, physically together, you don't get a snack, you don't do lunch, you don't comment on the weather. When I was a kid it seemed like a running joke that people would ask about the weather. But as I've become embedded in an online world, working across an international mega-organization like IBM, it became a way to get a sense of presence. How is the weather there? I'd ask at the start of a conference call with Sydney, Madrid, Vienna, Portsmouth. It was different each time, but it gave a way of opening the door a bit, softening the discussion that was to follow (since if I was calling you more likely than not I was going to tell you something you didn't want to know).

There's a term for this chit-chat which I learned many years ago and forgot probably just as soon. I even picked up a book of rhetorical terms in the hopes of finding it again but it wasn't listed.

We need meta-discourse to fill out the holes, we need it to learn and absorb facts and information. Too much of what we're developing in information technology strips out the meta-discourse, or provides no room for it in the first place.

I'm working on a couple of projects which I hope will do a little bit to address this. Too much gets lost when we optimize the hell out of our every day lives, to make it easier to work remotely, to work at Starbucks. What used to seem freeing may instead be the path to being ever-chained to our electronic devices.

I resisted getting a pager for a long time, partly because I didn't think I was getting paid to be on-call (I wasn't, never really was). But eventually it became necessary, cell phones were expensive and range was limited, pagers cost less and were effective at communicating very precise bits of information: someone with this number has called you. I don't remember the circumstances, but when I got the pager a friend commented to me: Welcome to the leashed life.

Too often, the technology we adopt has become exactly that: a leash. Not an enabler, a restriction or constriction.

And while it's been fun sitting here at the Starbucks, watching the interaction between employees and customers, listening in on the various discussions, I'm still waiting for the stupid EGR valve to be replaced (and no, I'm not defining that, I know as much about the engine in the MDX as I do about sub-atomic physics).

If you're developing technology, and you've read this far, tell me this: are you developing the next leash or the next water cooler? I think we need more water coolers, more The Deals wandering the virtual hallways, and less leashes.

A meditation on sabbaticals

2006-04-25T19:54:00Z

Via Fast Company Now, an article on sabbaticals I totally missed in last weekend's NYT: Sabbaticals Aren't Just for Academics Anymore. The article is mostly a survey of current practices in the US, positing that sabbaticals are growing, that they are a good way to help employees beat burnout, or to retain employees during slow periods.

In theory, I think sabbaticals are a great idea. My own personal experience was less than great though. Here are some thoughts on it, I'll attempt not to whine too much about IBM.

The setup

From 1994 through 1999 I worked at an insane pace, 16-18 hour days were not unusual. It was a highly stressful environment, multiple interwoven deadlines, competing corporate factions, frequent escalations. On good days I was totally confident I knew what I was doing and could withstand the onslaught. On bad days I barely kept my act together, because truth be told I frequently had no idea what I was doing (and there were few places or people I could go seek advice). My health went to hell, I had few personal relationships outside of work (and dating? dating was just a non-option).

I pretty much quit in late 1999 only to be offered another position.

For about a year, through 2000, I had perhaps the easiest job I'd had at IBM in years: managing the Olympic Games web site. Now, it was not without its stressful moments: nothing like having a key database get corrupted during the last dress rehearsal because it grew to 2,147,483,649 bytes. But i had a great team, and my job was mostly to provide a buffer between the team and the various executives and managers.

In the winddown after the Games I decided to take a break. In retrospect, I had enough documented vacation time that I could probably have just argued for 6-8 weeks off. But the end of the Games brought the end of IBM's involvement, so the management team dispersed (many retiring). It was easier to take a leave of absence which is what I did.

I'd first heard about sabbaticals when, in the wake of the Lotus takeover, we met with counterparts on the Lotus web team. Sabbaticals were part of the package at Lotus, available to employees after some period of time (I think five years? maybe seven?). It was an attractive idea, I thought it'd be a great way to bridge to something new at IBM.

Now, the NYT article discusses the sabbatical options for people, some are paid, some are not, some require some sort of plan of action or approval from the company beyond agreeing to allow the employee to take a sabbatical. It doesn't really go into what happens when you take a long break from work.

The sabbatical: a real break from work

My sabbatical started off with a two week trip to Australia, which seemed like a great way to start four months off.

On returning to Brooklyn, I spent a couple of weeks vegging. Flew out to see my mother, spent some family time.

I read, I surfed the web.

I contemplated building a blogging service but decided that wouldn't go anywhere.

Besides, I was returning to IBM.

Basically, though, I frittered away the four months I'd set aside. As the (initial) sabbatical was coming to a close I decided I wasn't ready to go back to work yet, and extended it through the end of August 2001.

Did some more travel, more reading, tried to bone up on technology skills that had rotted as I became more a personnel and project manager and less a grunt techie. Took an intensive three week class in Mandarin Chinese. I think I can still say My name is Mr. Plum, how is your rice watching?

In late June I decided to get on top of things and reach out to various people at work to see what positions were available.

The silence was stunning, but I wrote it off to mid-summer vacations.

I mean, come on, I was IBM's webmaster, surely there was a place for me somewhere. Hell, I had five years of pent-up education on running large scale web sites that could be unwound into briefings, consulting engagements, etc.

I had ideas I wanted to pursue, once I got back to work, and need to find a place I could pursue them in.

I checked in with IBM Research. I promised not to whine, so I'll just write that we couldn't work out a position.

In my head, I was looking to return to the IBM I'd joined ten years earlier, in reality the company I was returning to was completely different. My time at ibm.com and then the Olympic Games was time worked in a secluded part of the company: people knew we were doing some great things, but didn't understand what we were doing and generally left us alone organizationally.

As July morphed into August and August into September I ended up taking sort of a fallback job in consulting services. That worked out so well, I ended up leaving two months later.

What happened?

I didn't appreciate how much taking a break from a manic pace would cause me to never, ever want to return to that pace. Not that I necessarily liked doing nothing, I was frequently bored. But it set up my mood for what I was looking for in my next job: something predictable, 9-5, maybe 9-6. Not nights. Not weekends. And certainly not a different city every week (the consultant's life).

I didn't know how to articulate what I wanted to do without coming off like some slacker: you walk in and say you want a 9-6 job and managers look at you like you are on crack. What I wanted was to have a "normal" job, whatever that meant in 2001. I didn't want to serve at someone's leisure, beck and call. There probably were positions available that would have fit my skill set and my goals, but I didn't know how to look for them (and I'm fairly certain had I found one I wouldn't have know what words to use to get in the door).

I didn't appreciate the network of professional connections I'd made in my years as Corporate Webmaster, nor the impact of the number of people I'd apparently offended, pissed off, or just rubbed the wrong way. I didn't leverage the connections in the lead up to the sabbatical to articulate what they knew I could do and to help find or create a position to return to.

I also didn't appreciate that the network of contacts I had was very narrowly focussed within a slice of the company. In my little world of webmasters, user experience and interactive marketing people I was a office-hold name. But outside that world if I was known at all, it was as that jerk from corporate who said No, you cannot have www.ibm.com.java! There is no .java top level domain.

I was unfocussed. I had no master plan, other than a notion I'd had that I would:

buy a 64½ Mustang,
get a really decent sound system installed in it,
and drive up and down the West Coast for 4-6 weeks.

(I did do a bit of a driveabout, from San Francisco to Seattle, via Crater Lake and Mt. St. Helens, over the course of maybe 10 days, bracketed by trips to Las Vegas).

But, again, I was unfocussed. I wasted days reading the web, catching up on years of TV I'd "missed".

And some of that was important...it's important to have unstructured time. But not necessarily nine months of it.

So, sliding into September 2001 I was a bit of a sub-surface mental wreck. I felt abandoned by the company I'd done so much for (in my head), sacrificed so much for. I was stuck with a job which no one could describe to me, and which sounded promising until the first session I had as a consultant.

Into this mix, stir in 9/11. From 1997 thorugh mid-2000 I'd lived in Battery Park City, and woke up every morning to the reflection of the WTC towers in my windows. I loved the WTC, in all its ugly glory, in a very boyish, isn't-this-cool sort of way. I even had a yearly routine even of going to the roof of WTC 2 the first clear day of the year (if you've ever been on the roof of a 1300 foot building in winter, you'll appreciate both how stupid this was, as well as how clear the view was).

On returning from Sydney, I'd moved in with my girlfriend in Brooklyn Heights, so I was "safe" from the physical effects, but not so much from the other effects.

Had I had my wits, and I now know I didn't, I would have just stayed on sabbatical through the end of the year, dealing with 9/11 and performing a real job search.

Instead I latched onto the first position that came along, and when I hated that, latched onto the next job that came along. It's not a very smart way of career management, and has pretty much trashed my ability to get a job.

My advice...

So, what's my advice to a dedicated employee pursuing a sabbatical?

Before you leave...

Seek out other people within your organization who have taken a sabbatical and pick their brains. Organizations have their own culture, you need to suss out how the reality matches the documented approach to sabbaticals.
Determine early whether you are returning to your current position, or to a new role.
In either case, define what your position will and won't be on your return. The organization can and will change while you are away, think about what factors would cause you not to take the position, or would change the position.
Get things in writing, print off copies of the organization's policies with respect to sabbaticals or leaves of absence. Once you are out the door you may not have access to the documents, and if they change in your absence you may end up being caught short.
Truly understand your organization's approach to sabbaticals and leaves of absence. At IBM I was warned that there was no guarantee of a job on my return, which I sort of waved off, they have to do that, right? But while there was no guarantee of a position on my return, I had to guarantee that I would return on command, if necessary (which didn't happen).
Assume you don't come back, what do you need to take care of, wrap up, get copies of? There's a million reasons you might not come back, having nothing to do with how much you like your job or coworkers. You are going away, you are taking and making a break from work. You may find something else you really want to do.
Make a plan. How are you going to spend your days? Are you going to school? Are you going to write a book? Read a book? Travel? Make a plan, review it with your friends and family. Structure your time and be aware of how you are spending your time.
Plan your reëntry. when will it occur? How far in advance do you need to check-in? What factors will affect your return? What are the repercussions if you decide not to return?

While on sabbatical

Keep to your plan, your schedule, your structure. Keep aware of how you are really spending time and either revise the plan, or change the way you're spending time. Only you can decide how well you spent your time on sabbatical.
Keep in touch with people from work. Frequently enough that you don't feel totally out of touch, infrequently enough that you're out of the loop on day to day, week to week tasks, problems and issues. You're not doing this for your employer, you're doing this for yourself first and foremost, and you're keeping up professional-personal relationships.
Enjoy the time. Again, only you can decide how well you're spending your time and meeting your goals. In a sense, you are working for yourself, your pay or reward is the time off, the education gained, the experience gained from whatever it is you decide to do.
Keep a log or journal or diary, both so you can track your time, as well as so that you can look back a year or more and recall this time away.

Reëntry ...

You've been gone for 3, 6, 9 months. A year perhaps, more in extreme cases. A lot has changed with your organization, some good, some not so good. You've changed.

If you're considering not returning, don't be hasty. Review why you don't want to return, did you find something else to do on your sabbatical? Do you not like the organization as much now that you have some distance? Do you think there is another position out there, at another organization for you?

If you decide to look for another job, start the process well before your scheduled return date. If you wait until the weeks immediately before your return date you'll feel rushed, and you will be rushed. If you're mind is elsewhere, on that other job lingering out there, you won't be very effective on your return to work, which will make the experience seem miserable.

If you do return, you're going to feel like a new employee, unless you return to exactly the same position and team as you'd left. Even then, in theory someone else has been doing "your job" since you went on leave. The culture will be just a little different. Depending on the organization you may be welcomed back by all, or you may get treated as the guy who took six months off while we all worked our asses of.

In retrospect...

I do not regret taking a leave of absence, a sabbatical, from IBM at all. I think it saved my life in multiple ways, physically and spiritually. It broke me from some very bad working habits, it broke me away from an unhealthy working environment, it broke me away from an unhealthy approach to work in general.

I do regret not being structured about it. I regret not taking the time leading up to my leave to plan it out better, and to plan my reëntry better. I regret not acknowleding the professional relationships I'd had, nor attempting to mend the relationships that had frayed.

I regret not taking the organization at its word: no obligation to place me in a position on my return. I can't complain that I wasn't warned, I knew full well what I was getting into (not that I comprehended what I was getting into). I knew many of my organizational ties, my professional networks, would be broken or disappear while I was on leave, yet didn't do anything to mitigate the fallout.

If you need a sabbatical, take a sabbatical. But be aware that organizations are living, breathing things and will change while you are away. The company you return to will not be the company you left. You will not be the same employee on return as the person who left.

The only comparison I can make to shared experience is this: the summer between your last year of grade school, and freshman year of high school. The structure of the two schools may have been similar, they may have even been in the same buildings or campus; the students may be mostly the same students you went to grade school with; but the culture is different and even amongst all the familiarity you'll feel off. The advantage of being a professional on sabbatical, returning from sabbatical is that you really can control what you end up doing. Unlike high school, you can decide to alter or leave the situation.

Blocking Referer Spam (shorter version)

2005-06-14T19:42:46Z

For a tale, see Blocking Referer Spam, but if you want the Cliff's Notes version:

Referer spam refers to bozos who bombard sites with traffic, peppering the HTTP Referer: header with various URLs, the goal being to drive traffic back to their sites.
Even if you don't post Referers (really, referrers, but someone misspelled it in 1993 or so and we're stuck now), you'll get Referer Spam.
Sometimes it's combined with attempts to exploit open proxies and generate click through revenue for affiliate and some ad sites.

Sites using Apache can respond to referer spam by modifying their configuration files or their .htaccess files and the Apache URL Rewrite Engine.

The simplest approach is to block by IP address:

deny from 127.0.0.1

Now this approach will still record a hit in your access log,but it will be recorded with a 403 status code. This approach is a bit of a sledgehammer (you could block everyone from the 127 network with deny from 127. for example) and requires frequent maintence since the spammers bounce around from system to system.

Another approach is to block by pattern:

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*pattern.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^.*another-pattern.*$ [NC]
RewriteRule . - [F,L]

Where pattern and another-pattern could be poker, gambling, high-stakes (just to pick a few of the words I'm blocking on). Now, this will effectively deny access to your site for anyone submitting a referer containing the patterns you use. Again, you'll still get the hit recorded.

Note that blocking by pattern could block some legitimate requests. For example, in a few days I'm fairly certain that a search on poker referer spam will return this page. If you click on the link to this site you (should) get an error message back, assuming the search term is echoed in the Referer header.

Why is this important? It may just be a hit, but it requires processing on your server. If the target of the hit is a CGI or application (even PHP script) it requires more processing and takes that capacity away from your legitimate users. If you're just managing a personal site then it's unlikely to be a significant problem, more just an annoyance. On the other hand since the tools seem to blast away at practically any URL they can find on a site you're open to a denial of service attack if the spammers stray across a CGI or other application.

I don't post referers on my site with one exception, but I get spammed nonetheless. There's one exception: I do echo back the Referer in a <link> element. That's the Referer the active client used to retrieve the page, not all the referers that hit the site.

My personal practice is a mix of blocking by pattern (variations on poker, gambing, texas-hold-em, and a list of domain names which I noticed generating the spam traffic) and blocking by IP. I block an entire class A for example. Yes, that effectively shuts out several countries from my site but....just to be clear, this is my site. It's not public benefit, and if the net value to me of having traffic from that Class A is less than the impact of the bozos pounding away with spam robots, then I'll block the site.

Little privacy hole in itp32.exe

2005-05-18T00:57:57Z

Back in the day (the day being sometime in the 1990s) I tried to convince various and sundry people I worked with that all network related activity on behalf of the company I then worked for should occur under the domain we managed. My argument then was: Sure, this product/service/release/announcement/gopher is the most critical thing in the world today and I'm sure you feel you need your own domain name, but in three months when you've moved on and the company has moved on and you forget about the domain name, you still might have links, or worse, customers who are using that special domain name you set up.

I was frequently ignored, and then called on (usually around 3:00 a.m. wherever I was in the world) to fix things. To this day, I still can't get over the request to create a .java top level domain because someone had printed companydomain.java on 15,000 mugs.

I digress.

Anyway, I'm gearing up to do some work, and in a bizarre footnote, I decided I wanted to install Lotus 1-2-3 and Lotus Freelance. I can't explain why except that I find Microsoft Excel and Microsoft Powerpoint a pain to deal with and for the immediate future, I just need to crunch some work.

I didn't go for the whole Lotus Smartsuite install, partly because you now receive a warning dialog that various Lotus Smartsuite programs are incompatible with the version of Windows I'm using (XP).

So, I install 1-2-3 and FLG and the last step is the dreaded registration screen. I should point out that as far as I know I have a legal copy of Smartsuite, it came with one of the IBM Thinkpads I've acquired over the years.

Anyway, you fill out the registration panel, and then it prompts you for dialing information. Apparently in the early 21^st century it was common to connect computers to POTS lines and do this bizarre dialup procedure. I cancel since I have yet to configure a modem on my x31 a year after buying it. It then offers a chance to register using this Internet thing and I click Ok.

Now, I've had this CD for a couple of years, possibly more. It's labelled Millenium Edition but I have to admit the last copyright date is 1998.

To be fair, now, the Lotus Internet Team generally ignored any suggestions I made and had every right to as Lotus was not part of the grand, galactic corporate web mess I was managing.

The registration program proceeds to attempt to ftp to lotus.regserver.com. This actually hangs in a SYN state for awhile as there's now no ftp server running on that site.

Now, the privacy hole I mention is this: I almost ftp'd a bunch of semi-personal data (I use my business contact information and a junk-mail email address) to a site which I'd assumed was a *.lotus.com site since it doesn't say anywhere that it was going to transfer data to a third party.

Some investigation revealed that that third party was a company called Naviant. Naviant apparently started out as a company focussed on product registrations but evolved into an email marketing service which leveraged all that nice product registration information it had received over the years. Fast forward from 1998 when the hostname was hardcoded into itp32.exe to today: Naviant was acquired by Equifax in 2002.

Now, at some point someone made a decision (usually unconciously) to drop this service, at least partially. The host name lotus.regserver.com still resolves, it's a CNAME to pipe.pcpipeline.com which in turn resolves to [216.31.246.147]. Now, that host doesn't appear to be running either ftp or http servers, so my data is secure. However the thought, in retrospect, that it could have been transmitted to Equifax is disturbing. Nothing against Equifax, but it was the last place I'd expect to transmit Lotus product registration data to.

So, I'm wondering what other products have these little privacy timebombs waiting to go off? It would have been much better to use a CNAME like regserver.lotus.com which could have pointed anywhere, and could also have been deleted at its end of life, rather than left out there like a solitary mine waiting to go off. I assume the products don't call home on a regular basis to this site, even so I'll be blocking the registration program with the Windows Firewall just in case.

Always, always maintain control over the hostnames and domains you hard code into products. And always, always listen to your Corporate Webmaster, no matter how psychotic he may seem to be.

Nerd upgrades laptop to 1Gb, freaks.

2004-09-10T21:44:54Z

I upgraded my laptop to 1Gb of RAM. This caused a moment of pause.

When I first joined IBM in 1990 the company was still in the thrall of PROFS and VM/CMS and mainframes in general. Allowing staff to use PCs was just not even given much thought. I was privileged to have a genuine PC-XT on my desk as a co-op instead of the standard-issue 3279 terminal.

When I returned as an Associate Information Developer in 1991, I was given a PS/2 Model 80 with two 60Mb drives. It ran OS/2 1.3. I don't remember how much memory (RAM) it had, maybe, maybe 16Mb.

One of the guys I was working with took me on a virtual tour of the development mainframe we used. It had 512Mb of main memory and (hey, I'm forgetting the terminology finally) another 512Mb of "secondary" memory (which was slower and used for hiperspace, paging, swapping ,etc.

That system had perhaps 1000 people using it. All via 3270 terminals or APPC.

Now, my laptop, which pretty much by definition is a single-user machine, has 40Gb of disk and 1Gb of memory. In the house we have close to 1Tb of disk, though some of it is locked up in various dedicated boxes like the Tivoim.

While having that much power/capacity/whatever is cool and all, and makes it much easier to use Microsoft Office applications (especially Visio!), I'm not sure that it's such a wonderful thing. I can't really do that much more than I did in 1990. My writing is still limited by how fast I can type (and that rate is slower on today's lousy keyboards… give me a genuine manufactured-by-IBM-Lexington PC-AT keyboard anyday). I can do some graphic things I couldn't do before. I can multitask, but I was doing that even in 1990 on the 3270 terminals, moreso once I conquered APPC configuration and Communications Manager. I think I get a bit too hung up on how things look now. I can't just power-write, windows pop up and demand attention, the cursor suddenly switches to a spinning globe or clock, mystery applications steal focus just long enough for whatever I'm typing to be redirected elsewhere.

So, while the geek in me is quite happy to have a 1Gb laptop (and nearly 1Gb in this mac, and the Gb's of disk space), the writer, programmer, and whatever else I am in me isn't so sure that I've advanced that far. It makes things I do and have been doing easier, but doesn't really add that much to my day. It doesn't make it possible for me to entirely cease doing something. I still have to type the characters into the computer, I still have to think through the design of a program or the plan of the operations center. I can't just say to the air I want something that does this, this, that, and a bit of this.

Back in August I posted a Lazyweb request for ideas about a smart diagramming tool. I still need to sift through the great suggestions I got, but I think that that request originated with this sense I have of: I have all of these great tools, but none of them really help me do anything new.

Things don't always go as planned

2004-09-06T18:42:19Z

I've been watching The History Channel's Modern Marvels Engineering Disasters marathon today and have picked up a few ideas to keep in mind:

Cost Savings Measures need to be scrutinized left, right, up, down, and then put on the shelf for further thinking before implementing or putting into production.
With a number of these disasters, someone somewhere decides to change or tweak a design to use a cost savings measure which should have minimal impact on the design. Something which worked in a similar situation or design and easily slides into place with this new design. But what happens is that you're changing one element of a system, you need to analyze reevaluate the entire system with the change you've made.
Substitutions need similar scrutiny.
If you're working in or with a system of interconnecting components and dependencies, you need to understand your dependencies and how changes in them can affect your component, whether or not it's supposed to affect your component.
Too many systems assume optimal conditions and don't account for sub-optimal conditions or just right-out negative conditions. The designers trade off consumer experience or business value against the cost of implementing features to account for possible (probable) sub-optimal conditions.

What amazes me is the failure to learn from past accidents, disasters, and just plain malfeasance. Watching this in marathon style you see the same type of accident or disaster over and over again.

Update 10/Sep/04

Dan Bricklin has written a great essay Learning From Accidents and a Terrorist Attack: Another key point I found in the book is that in order to keep failures from growing into accidents the more an operator knows about what is happening in the system the better. Another point is that independent redundancy can be very helpful. However, back to coupling, redundancy and components that are interconnected in unexpected ways can lead to mysterious behavior, or incorrectly perceived correct behavior.

epcostello.net site redesign

2004-09-05T01:57:50Z

This is a collection of notes about the redesign I'm doing for epcostello.net this labor day weekend. It'll be updated occasionally as I do the work. Remember: I'm a rank amateur. I am not a professional. Thank &deity;. Don't try this at home. If you do, I don't care.

Current Problems:

Let's start with the obvious: I'm not a graphic designer. I don't even try to play one on TV. Yet, I'd like to try to add some color to the site. I will freely borrow ideas from sites I like on the web, and mangle them (in)appropriately.

Almost all of the HTML content is generated using PHP. This isn't a bad thing, however I need to work back in some lessons learned over the past year or so in playing with PHP. I include multiple modules now, I'd like to cut that down to one or two. I'd like to create a page class or perhaps classes for specific sections of each page.
All pages need to have appropriate metadata generated, either for the HTTP header or the HEAD section of each page. Currently this work is split between PHP and MovableType. MT will need to generate the actual values, but PHP should be used to create the necessasry HTML tags.
All pages should have proper expiration dates, however I'm not certain of that, again due to the multiple PHP modules thing.
Currently some pages handle modified-GET requests correctly while others just return the document.
Some pages are served with a gzip transfer-encoding, while others are not.
The CSS used throughout the site is a mess. The classes are a mix of leftovers from three previous sites with MT gorp added in for good measure. I want to get back to having one single CSS file, with browser-specific secondary files to fix specific problems. I don't want to use the various CSS hacks that float around as they all depend on various unique problems each browser has parsing CSS.
The content for Articles, Journal, and the blog--er--comments should use pretty much the same templates. I think. At any rate, I've learned enough about the oddities of MTIfEmpty that I need to clean up the templates, ie if there are no comments on an entry then don't display a Comments heading
For index pages advertising should be on the sides. For content pages advertising should be inline as much as possible with Google
Perhaps too much this time around but I'd like to make better use of Amazon for advertising
In case anyone's interested, I've earned an amazing US$1.30 from advertising this year. So, it's not exactly a money earner but it is something I'm using on other client sites so the more variations I play with the better
I've tried various layouts for the homepage, the last entry from each section, headlines only, headlines and excerpts, etc. I've created the problem for myself by splitting content up as I have and I'd just as soon keep it separated but it means I can't just dump a list of things into a file. There needs to be some sorting or ordering done to keep some semblance of date order.

Guidelines, Goals

All pages will have proper Last-modified and Expires headers.
All pages will be able to be served with a gzip transfer encoding if the client supports that method.
All pages will support modified-GET
All content will have explicit cache headers set, most for 24 hours from serving time
The homepage will use a different layout from the rest of the site, but content will use the same classes as on the other pages of the site
No URLs from the previous design should break, should either continue to be served or redirect to appropriate replacements.
CSS classes will be used to identify different types of content. CSS ids will be used to further delineate within a class.
The site will continue to have three main sections (Personal Journal,Comments & Links / ‘blog, and Articles & Essays). Information about the site will be chained off the "about" pages.
I'm using Firefox as the reference browser, on Windows and Mac OS X. The site should work with Opera 7 (Windows) and Safari (Mac). I really don't care what happens with Microsoft Internet Explorer except, I guess, that the site should display.
I'm going to supply ~~three~~ two feeds for each section: RSS .91 headlines and Atom headlines~~, and Atom articles~~. Other feeds will continue to be generated but I'll remove them from the <link>s in the HEAD as well as from the nav.
Would be nice if the feeds were gzip'd as well but I suspect most feedreaders don't support gzip or deflate as a transfer encoding
I like the general layout I've been using (left hand content, narrow right hand nav/meta column). One problem I've had is that, although I'd like to use relative sizes and widths, the different CSS engines are not at all consistent in how they treat relative widths for side by side content, so I'm going to set hard widths and sizes, but using points and picas, not pixels as the units
In the Articles section, the title of the article should be prominent, not the title of the site. I mean, I'm not a brand, the site title should be repeated somewhere but not as an h1/banner
If possible, switch from the gorp of intertwined PHP and HTML to a page-as-PHP-object model with the content being passed in.

I want to try something with comments...having them automatically close 7 days after posting unless a trackback comes in, then reopening them for seven days.

Development

There's a mockup now online at <URI:http://gothic-egg.net/~epc/test2/>. Put any feedback here....

I added:

php_flag zlib.output_compression On
php_value zlib.output_compression_level 9

to the .htaccess for the site to automatically gzip all PHP generated content (assuming the client supports it). Pair does not support mod_gzip so the non-PHP items are still uncompressed.

ala carte pricing the Time Warner Cable way

2004-08-02T06:24:47Z

Time-Warner CEO Richard Parsons has been quoted as saying a la carte cable pricing [...] is a bad idea for consumers. Yet, oddly, when Time-Warner Cable of NYC has a tiff with CableVision they can magically pull stations on/off the air.

Now, I know that that's comparing apples and oranges, they just yanked the feed for all subscribers at the head end. However, last year when TWC was in a tiff with the Yes Network over various fees, they allowed customers to voluntarily unsubscribe from the Yes network and we did, resulting in a $2 credit every month.

Truth be told, anyone with a digital cable box (anyone who can get cable modem service could get digital cable) has a box which is capable of ala carte channel subscriptions. Of the 100s of channels we receive, I'd guess we regularly watch about five, with the Tivos grabbing recordings off another ten or so. We don't watch any of the shopping channels (which we pay for), or the religious channels (which we pay for), or the sports channels (which we pay for). We end up subsidizing most of the channels we don't watch.

It's pretty stupid for the cable companies to stand in the way of ala carte pricing. I mean, on the one hand they get forced by the various content providers to carry multiple channels (witness Disney's bundling of the ABC Family Channel with ESPN, and all but requiring systems to carry ESPN if they wanted to carry ABC broadcast channels. Of course, the FCC requires cable companies to carry all broadcast channels in a geographic area.)

If Time Warner adopted ala carte pricing in the New York area just for their digital customers, they could document how many customers are willing to subscribe to specific channels and then avoid getting socked by the content providers to pay for 650,000 subscribers to the Fluff Network.

According to the message currently carried by TWC on the blacked-out (actually blued-out) MSG/Cablevision channels, TWC is willing to rebate $2 per month to customers while this tiff continues (I'd be just as happy to unsubscribe and keep the $24/year from this, and the other $24/year from the Yes network).

I'm perfectly willing to pay for content, and even accept that it may need to be bundled in like packages (eg: all sports channels, a set of movie channels, etc.), I just resent having to pay for the vast majority of channels which we never watch, will likely never watch, and are not in the target market for the commercials which theoretically pay for the channel. Time was when your cable bill either went to custom content channels like HBO or MTV which had no commercials to support them, or to subsidize the carriage of commercial channels. Now the content providers view the bundling agreements as a way of creating a revenue stream out of nothing. You can put a crap channel together and force it down the Cable TV systems throats because of the various bundling and must-carry rules.

Cable TV: Programming that continues to diminish in value

2004-08-02T06:14:50Z

I am writing a separate post about ala carte Cable TV pricing which was kicked off by this message from Time Warner Cable of New York City:

To our customers:

Cablevision has forced the removal of MSG, Fox Sports New York, and the Metro channels from your channel lineup.

Cablevision has refused to sign an extension allowing us to continue carrying these channels while we work on a new agreement.
Cablevision has threatened to sue if we continue to carry their networks.

Cablevision has demanded unprecedented fees for programming that continues to diminish in value.

Time Warner Cable will voluntarily rebate its customers $2.00 per month to minimize this inconvenience.

We continue to press Cablevision to return the channels to your lineup but, so far they have refused.

Earth to Time Warner: I DON'T WANT THESE CHANNELS TO RETURN!. And, if I had ala carte pricing, not only would I not subscribe to the channels, but Time Warner would in turn not have to pay whatever the unprecedented fees are for programming diminishing in value.

I wonder how any of these cable companies would respond to customer initiated ala carte subscriptions (mass cancellations).

Hedging real-world money online

2004-07-03T04:21:58Z

I found Gaming Open Market via buy sell buy sell from Ben Hammersley's Dangerous Precedent and am now wondering how long it will be before you see an EverQuest hedge fund.

See, when you play online games you can earn various rewards, usually denominated in some sort of virtual currency. In the game world you can trade currency for items and vice versa. Someone, somewhere got the idea of trading virtual currency for real currency, through eBay and other venues.

The Gaming Open Market site is (apparently, I've done all of ten seconds research on it) conducting a sort of FOREX market for virtual-real world currencies.

You can read more about this phenomenon in Game Theories by Clive Thompson. Game Theories is about the work and research of Edward Castronova into virtual world economies, auctions, and the crossover into real-world finance.

What I wonder, in addition to the hedge fund idea, which I should probably file a business models patent for, anyway: if activities in an online virtual world can be readily translated into real world materials and actions, what makes the virtual world virtual?

Plug: Bloglines

2004-06-25T17:04:47Z

I've started using a news aggregator again. I used to use Radio Userland but found it to be slow, buggy, and a bit of a memory hog. Once they started a $40 per annum licensing fee I decided to switch off it for both aggregation and blogging.

Anyway, for most of the past year I've just relied on opening sites in tabs, using Opera or Firefox. This isn't that bad, I can see quickly whether or not something's updated and close the window if it hasn't. But it's also a bit of a black hole time wise since I invariably go clicky-clicky on another link, or ad and end up wasting an hour.

Bloglines is a simple web based news aggregator. I played with it briefly last year but didn't get into using it. I returned to it earlier this month and imported all of the blogs/newsfeeds I've been reading and have really enjoyed using it. It's totally plain, no ads (yet), few graphics. I'm sure there's other aggregators out there but I just wanted one that works, wasn't a pain to set up and use, and just works (again).

One minor problem I've run into is with the display of my blogroll on my homepage. It's done through a JavaScript file downloaded from bloglines.com. The javascript isn't encoded in any particular character encoding. My site is (well, should be) in the UTF-8 encoding. The problem shows up with the link for Michael Bérubé. The website encodes the e-acute character as either é or é. But the XML feed serves the raw 0xE9 character. I'm not sure that's even wrong, I don't know UTF-8 well enought. Anyway, that 0xe9 character gets scooped up by bloglines and then served to my site in the JavaScript. I'm not sure if JavaScript has a default encoding but it ends up as a junk character on my site (using Firefox on Windows XP).

I'm going to see if I can proxy the Javascript request and clean the feed myself (converting the 0xe9 to the é character, I guess I'm assuming the javascript is in win-1252 or iso-8859).

Index Template to Create Redirect list for .htaccess

2004-06-13T19:53:14Z

I decided to change the structure of the /articles/ site slightly, to remove the /archives/ path from the URL and to change the filename from the article number to a munged form of the title.

As there weren't many articles, I could easily manually create a redirect list for my .htaccess file, but I wanted to see if I could use a MovableType Index Template to do so.

Below is the template I created, I use Redirect instead of RedirectMatch or the RewriteEngine because there isn't a regular pattern to rewrite the URLs to (I can't use a map file on the hosting platform I'm on).

<$MTArchiveList archive_type="Individual"$>
<MTEntries>
Redirect permanent /articles/archives/<$MTEntryDate format="%Y/%m"$>/<$MTEntryID pad="1"$>.php <$MTBlogURL><$MTEntryDate format="%Y/%m"$>/<$MTArchiveTitle dirify="1"$></MTEntries>
</MTArchiveList>

This writes out to /articles/archives/.htaccess.

Note: There appears to be a bug in MTArchiveTitle in the archive file template context, it appears to resolve to an empty string. Switching to MTEntryTitle seemed to work.

Update: 16 June 2004

I realized I missed redirects for the category archives I had, I've added those with the changes in bold below:

<$MTArchiveList archive_type="Individual"$>
<MTEntries>
Redirect permanent /articles/archives/<$MTEntryDate format="%Y/%m"$>/<$MTEntryID pad="1"$>.php
<$MTBlogURL><$MTEntryDate format="%Y/%m"$>/<$MTArchiveTitle dirify="1"$></MTEntries>
</MTArchiveList>
<$MTArchiveList archive_type="Category"$>
Redirect permanent /articles/archives/cat_<$MTCategoryLabel dirify="1"$>.php <$MTCategoryArchiveLink$>
</MTArchiveList>

On this date in 1990 (alternately: Do the math)

2004-06-11T16:45:17Z

I bought my first, and last, GM car on June 11, 1990.

I'd just started my intersnship at IBM's Myers Corners Lab near Poughkeepsie, NY. As an intern I didn't get moving & living, so I'd returned to Chicago to borrow the utility van my dad owned, drove it back to Pittsburgh, and then headed to Poughkeepsie.

Somewhere just south of Wilkes-Barre, PA on I-81 I attempted to roll the van over.

It wasn't intentional, I'd been following a pickup truck in the left hand lane, maybe 200ft behind, at about 60-65mph.

The pickup truck made a slight swerve to avoid something.

I might add, the pickup was 4WD so it had higher clearance than I did.

I saw that it was swerving around a tire but it had just clipped the tire itself so now this thing was moving around in my lane.

I managed to almost miss it, which of course means I hit it.

Clipped it really, with my right front tire. The van went up on its left wheels as the tire, with new vim and vigor, bounced along the bottom of the van.

One thing I've neglected to mention: the tire was still attached to its rim, so there was a lot of mass rolling around on I-81 that night.

This all occurred just before an exit and I pulled over and off, not only to get my head together, but to try to find out why the engine had a strange noise.

I made it to a gas station where I was informed that the on-duty mechanic was off duty for the weekend.

I didn't see any obvious damage except to the exhaust pipe which was sort of bent, probably where the tire crumpled it.

I started the van up and headed back on the interstate.

It soon became clear there was more damage than just to the exhaust pipe because any time I let the engine idle (say, going downhill), it died.

So I drove the remainder of the way to Poughkeepsie alternating between Drive and Neutral, deafening all whom I passed.

I headed up Route 9 to the Ramada south of the IBM Main Plant and pulled in. That was the last time the van ran.

Over the next week I managed to get around either through rides from various new co-workers or just through walking back and forth (this was not easy as Poughkeepsie isn't very friendly to non-automotive means of transport).

At the weekend, with the confidence that comes with having been paid for a week's work at IBM of all places, I went car hunting. This literally felt like hunting since I had to walk from dealer to dealer.

I found a nice Mazda GLC for $2000. It was clean, had some miles on it, but would do the job for me and I'd feel no qualms about getting rid of it at the end of the internship.

But, I had no money.

So I called the bank of parents, one of whom was quite upset about my borrowing and then essentially wrecking his van. Anyway, I quite cheerily called and asked for a loan of about $500, which would get me the car and a decent rate on the remaining $1500.

They said No.

No, they would not give me moeny to buy a foreign car. If I would buy a nice new American car they'd give me more, say $1000.

At this point I was getting kind of tired of walking and bumming rides off co-workers.

So I caved, and bought a 1990 Pontiac Sunbird. Fire engine red even.

With taxes and various options, the total came to about $16,000.

The monthly payment was $271.

As I was under 25, my insurance was about $150 per month.

As I was technically not in school for the fall semester ('twas a nine month internship), I had to start paying my student loans.

I quickly found my financial skills to be somewhat lacking, because the car was costing me close to $500 per month, about a third of my after tax income.

My rent was $650, the student loans were about $290, leaving about $200 per month for everything else (food, cable, phone, etc).

This wasn't my brightest moment, financially speaking. The car became a black hole for my income and savings for years. When I returned to school in 1991 I had to cover five months of payments, plus a kick in my insurance (for moving back to Pennsylvania), with no income whatsoever. What little savings I'd made while working in 1990 quickly evaporated.

And, the car?

The car sucked. For a small car it guzzled gas at an amazing rate. The air conditioning was lousy and within two years of buying it the driver's side window started falling into the door unexplicably.

The dealer I bought the car from was closed due to fraudulent business activities, which really didn't help my mood.

On returning to Pittsburgh in January 1991 I discovered that the air conditioning was lousy because an entire component of the a/c and heat system had been left out. A dealer in Pittsburgh did the repair for free to me, even though the car was technically out of warranty (1 year or 12,000 miles, I ate through the 12k miles in the months of driving between Pittsburgh and Poughkeepsie).

I ended up driving the car for another seven years, from 1995-1996 I drove it normally 100 miles round trip between Poughkeepsie and Armonk. It managed to do the job, but I hated the car.

I managed to refinance the loan at some point after I returned to IBM as a real employee (and could thus get a loan through the employee credit union). I lowered the monthly payment by about $130 but felt like I was going to be paying for years for my earlier mistake in buying the car in the first place.

In 1997 I moved to New York City and all but stopped driving. I had a four block commute from an apartment on Battery Place to my office on Broad Street. And although the car was paid off at this point, I was still paying insurance and now parking, about $350 a month still.

The car had no residual resale value.

One morning, before moving to New York but after I started commuting by train to NYC, anyway, one morning I happened to walk around the passenger side of the car. How many people hop in their cars on a daily basis and never look at the passenger side? I did this morning and discovered the passenger door had been gouged, if not carved, from the hinge to about half the length of the door. About the right height for...a snowplow ? I don't know what had hit it, nor when it had occurred since I'd been training for about a month at that point.

So, over the summer of 1997 the car spent most of its time parked in a lot in front of my apartment at Battery place.

Once, a colleague found his car blocked in in the same lot and called to see if he could borrow my car to drive himself and a couple other employees to Armonk for the day.

I said sure, but do you know what shape my car is in? since at this point the passenger door was frozen in place, and the driver's side window randomly fell into the door at odd moments, like during blizzards or rainstorms.

At this point it was cheaper to rent a luxury car from Hertz periodically than to hold onto the Sunbird.

I never really planned to abandon it, it just happened.

September 1997 dawned and the Museum of Jewish Heritage opened just south of my apartment in Battery Park City. No parking was allowed on the street, and the lot I parked in was to be closed for the days surrounding the opening. I in turn was to go to Boston for that year's ICC meeting. The ICC was a family of employees (mostly guys) who ran IBM's internet operations. Not marketing types, hardcore geeks, hackers, and systems administrators. I had a weird role in that I frequently had to butt heads with the guys since my job was to eliminate rogue web sites and internet operations.

Anyway, so I had to go to Boston and move my car somewhere. So I parked it in a local parking garage and took the train to Boston.

On returning I....didn't retrieve the car. Instead I flew to Tampa, FL to do some work with the guys working on the 1998 Nagano Olympic Games web site.

And on returning from Tampa...I didn't retrieve the car.

As the days became weeks and then nearly a month, I did go to the car to get it out of the lot and, lo, it was dead.

Not a spark of life in the battery, nothing.

Now not only did I have a car with a running bill of $35/day parking, but it was dead and I'd have to find a tow truck willing to go up multiple levels in a parking garage to either retrieve it or at least charge it.

Another month or two passed. December '97 dawned and I found myself working on the 1998 Superbowl web site. In the midst of a trip to Atlanta I learned my father had had a heart attack and was due to have bypass surgery. The surgery was successful but he had a difficult recovery.

At this point, the fact that I owned a car or that it was parked in a garage in downtown Manhattan was the farthest concern from my mind.

December became January. January became February. In those months I flitted between Chicago, New York, San Diego, and Nagano, Japan.

On returning to New York at the end of February 1998 I resolved to do something about the car. Swallow my whatever, pay the parking bill, and get rid of the car.

Only...the car was gone. I walked throughout the garage and it wasn't on any level of the garage. Totally gone. Stolen? Who knows. Only that at least one problem had been resolved. I wasn't sure if I was still lliable for the parking bill but at this point was not going to ask.

Some years later I did a search on the VIN at Carfax and discovered that the car had been transferred, somehow, to someone in New Jersey.

So, someone somewhere is driving a 1990 Pontiac Sunbird, with a slight shimmy in the front end, and I hope a replacement passenger door.

As for me, I blame the truck tire that started the whole mess.

Notes on a new Thinkpad x31

2004-05-31T20:26:22Z

I bought a new IBM Thinkpad x31 earlier this month and am really enjoying it. It replaces an IBM Thinkpad x21 from 2001 so I picked up two+ years of updates with the new system.

Oddly, it has a slightly smaller footprint than the x21. For the most part this isn't noticeable, except that it means the x31 is not compatible with the ultrabase I bought for the x21. It does work with the dock I have (which still has a fan just a little louder than a turbine engine). I have not decided whether or not to get a new ultrabase. It's handy for travel, but I don't travel much.

Font legibility and ClearType

One thing that has bothered me with the new system is that all of the fonts looked bad. Skinny, unaliased. I remembered something about Cleartype on Windows XP and so I went off hunting for this option.

I couldn't find it in any of the control panels, at least not in the obvious ones (Display and Fonts).

Eventually I found a web page at microsoft.com, ClearType information. This page has information about Cleartype as well as an ActiveX control which you can use to activate and configure ClearType.

I find it odd that Microsoft would not include this in the base operating system (perhaps it's there, but I really did look).

Back to the x31: It's nice to have a keyboard with play again. The x21 has lost a lot of the play in the keys, and the mouse buttons are dead.

Firewire

A minor quibble: the x31 comes with a Firewire interface, but nothing on the descriptions (at CDW, and I believe ibm.com) indicates it's four-wire, not six-wire. This is a ok as long as you have a four-to-six wire adapter and the device you're plugging in is self-powered.

Migration

I managed to move most of my documents over without any problems, and I think I've managed to reinstall the applications I need (eliminating the cruft that builds up from applications you install and use once or twice). Had to scramble to find various license keys for things I bought over two years ago. I see no reason to buy a new license, especially since I'm trashing the image on the x21 and replacing it with a Linux or FreeBSD build.

Userid configuration

The only other gotcha I've had is that I initially configured my userid as my business email address (eg: userid@example.com instead of just userid. Thought this made some sense, until I installed cygwin and realized that there was nothing to separate the userid bit from the domain bit in the email address, so I ended up with userid@example.com in places where it didn't make sense (eg: my prompt became userid@example.com@lancaster).

Java

Another problem I had: I couldn't get Java to work in either MSIE or Firefox. There was an IBM JVM loaded but neither browser could use it to run applets. I ended up removing it and installing the Sun 1.4 SDK and JRE. Applets worked in MSIE but still not in Firefox. I learned that I had to copy several DLLs over to the Firefox plugin directory and then voila, applets worked.

Software build

This is what I have loaded so far:

Microsoft Windows XP
Microsoft Office XP
FireFox
Opera 7
Microsoft Project
Microsoft Visio
Trillian
Sun Java 1.4 SDK
cygwin

One update: Bluetooth doesn't work

I can't seem to get Bluetooth to work. There's every indication on the machine that there is no bluetooth available (other than the dimmed out bluetooth icon). There's every indication at CDW as well as IBM that Bluetooth should be on this system as well as installed and configured. Hmmm.

Update on Bluetooth (8 Jun 2004)

I poked around when I returned to Brooklyn over the weekend and discovered that Fn-F5 brings up a control panel of sorts which allows you to turn on or off the Wifi and Bluetooth. Wifi must be turned on by default while Bluetooth isn't. I turned it on and managed to get my nokia phone recognized as a modem. I believe I need to remove the Microsoft utilities (what little there are) and install the IBM Bluetooth utilities. In any event I'm happier now that I don't have to ship the box back to IBM for repairs.

ibm.com history on the web

2004-05-24T15:00:00Z

www.ibm.com has been online for ten years now, having first come online on 24 May 1994. This article is a collection of links and stories I've found over the years covering www.ibm.com. Note that some of the links may be stale, decayed, or otherwise changed since I first tracked them.

Report From a 1994 Web Usability Study by Jakob Nielsen contains discussion about and screen shot of the November 1994 www.ibm.com homepage.
Screen shot of www.ibm.com from 10 October 1996.
IBM's redesign results in a kinder, simpler Web site (Infoworld, 19 April 1999)
Good Web Site Design Can Lead to Healthy Sales (The New York Times, 30 August 1999)

May 1994: www.ibm.com is launched

2004-05-18T02:22:14Z

I was in a pretty deep funk ten years ago.

I was convinced I'd be caught in the next round of resource actions at the lab I worked at, Myers Corners Lab. I was pretty much a C average employee at the time, spending too much time screwing around with ftp, gopher and helping people with various Internet things, and not working on the books for the internal product I was assigned to.

I think we learned that IBM was closing our lab in May, though it may have been April. I know that it was inevitable, one of the three buildings at MCL was all but empty and various services were being cut back.

So, mid-month I accepted an invitation to interview at a company in Atlanta. I learned two things on that interview: first, I never, ever wanted to live or work in Atlanta (a feeling which would be reinforced two years later during the Olympic Games), second: it was incredibly reassuring that someone, somewhere was willing to pick up the tab to interview me for a job I was maybe remotely qualified for.

I returned to Poughkeepsie feeling a bit better about things. I was scheduled to present a Communications Seminar about this Internet thing. My manager and I figured maybe 10-20 people would attend. I don't know the actual numbers, but the entire cafeteria was filled, easily a hundred people, perhaps more. I ran out of the FOILS I'd prepared (this was pre-Freelance and PowerPoint).

In retrospect, it was a goofy presentation.

I showed how people could sign up to send and receive Internet email (in those pre-Notes days, IBMers uses PROFS and VM/CMS for their office needs). I introduced ftp, gopher, archie and veronica and briefly, just briefly, touched on this world wide web thing.

I talked a bit about the Books On Internet project where we'd gotten the product release folks out of a bind by publishing some S/390 Parallel Sysplex books using gopher and ftp, thereby meeting a requirement that the books be available at GA.

I couldn't really demo the web except through a text only browser that you could telnet to at NJIT. I showed that our dread adveraries Amdahl and Fujitsu had web sites.

At the time of the demo, IBM did not have a web site.

This was actually the subject of much debate in the internal internet community. A group in Atlanta had started to put together a website oriented around IBMLink. Meanwhile, in Armonk, the corner office was still stewing about Sun's presentation of results from the 1994 Lillehammer Olympic Games on the web and had started a parallel effort to create something called a home page for IBM on the Internet.

These projects collided in April 1994 with Corporate Communications taking command but the IBMLink folks doing the work and hosting.

www.ibm.com was launched May 24, 1994 after being previewed at the 1994 Senior Manager's Meeting.

Meanwhile, back in Po-town, I was drafted to do work at the divisional level to create a proper home page for the Large Scale Computing Division (with no money, formal support, etc. a trend which would continue for years).

Over the next few months I worked with a variety of people to figure out what one would actually put on a home page...what did customers want? What did the marketing people want? What could we actually support?

It was fun. I had absolutely no idea what I was doing, but it was better than watching as MCL melted down.

I continued to present my talk, now titled Surfing the Internet and made my presentation available internally through gopher and the old TOOLSRUN request system.

My last presentation unfortunately was to the IBM Kingston lab the afternoon the employees there were told that the lab would close.

The summer carried on, with me getting more and more confident in my take on the right way to run things. This included frequently flaming the people running the Corporate site about various nitpicks and issues.

The division site, lscftp.kgn.ibm.com, launched in mid-September. I was flown down to Atlanta (again!) to demo the site at the N+I trade show.

Over the course of the fall we did a variety of neat things on the web site, launching a sub-site for the POWERparallel group (if ever there was a bizarre corporate marriage it was POWERparallel and the System/390 divisions). I was briefly on some sort of internal division assignment to LSCD headquarters. That came to an end at the end of the year as they couldn't figure out how to fund any staff.

I was back to being in the position of getting my resource actioned out of the company.

Then, in the most bizarre turn of events which could occur, the very people I'd been an utter pain in the ass to at Corporate came calling. They needed a dedicated technical staff. They asked: Would I take a one year assignment? And of course, I said no.

No way was I going to move to Westchester on my own dime for a one year assignment. I needed something, a raise, some sort of compensation.

So they asked again, this time offering to reimburse for mileage and any necessary lodging.

And....I accepted.

One year working in Corporate on www.ibm.com wouldn't be too bad, especially if they picked up mileage (it was ~100 miles round trip) and occasional lodging (in the rare event I'd have to work late).

Of course, the one year assignment became a five year adventure.

I went from being technical staff to the so-called webmaster for www.ibm.com and eventually the dubious yet real role of corporate webmaster. Along the way we picked up a few people, did some cool things, and served a couple billion hits.

When I eventually left in 1999, I left a job that was completely unimaginable in 1994. I left because it was almost all politics, all corporate, and all stress. I left because the fun had long seeped out. I left because I didn't have anything else to prove, I'd built and rebuilt the site, hosted a variety of events, invented a bunch of tools and technologies, and learned quite a lot from the experiences and misadventures.

I left because when the CIO tells you you're his go to guy, you know it's time to leave.

Anyway, that all started ten years ago. It certainly doesn't feel like ten years has passed.

Blocking Referer Spam

2004-05-04T00:52:29Z

Read Blocking Referer Spam (shorter version) if you want just the quick & dirty take on referrer spam and possible solutions.

Note

This article is getting a lot of traffic (well, for me at least) and while the advice is still valid, it turns out that what I was seeing was not necessarily referer spam, but something a bit weirder which I need to write up in detail when I have time. Basically, my .htaccess information below is correct for what I was seeing, but may not work at all to solve strict referer spam problems. The problem I was seeing (and still do, though much less so) was that somehow my site ended up listed as an open proxy on some idiot's list. It isn't now, nor has ever been (I suspect it was due to an early PHP mistake on my part). So, the traffic I was calling "modified referer spam" was actually someone's attempt to fake traffic through affiliate sites by routing through my "open" proxy (and I imagine many others).

Anyway, read the rest for entertainment, perhaps enlightenment, but it's not necessarily correct. Check out Proposal for a solution to referrer spam: Using MT-Blacklist and other blacklists to filter spamming URLs for a better example than I provide here.

On a monthly, sometimes bi-weekly basis, I scan through my traffic logs and reports looking for things. Nothing in particular, oddities, things that stand out. I used to do this on a much larger scale at ibm.com and it helped me in tuning the site as well as debugging problems within IBM's web space.

Late last year I noticed an increase in odd referrers. A referrer is (in theory) the URI which contains a link to a given site and is passed by the user agent (eg: Microsoft Internet Explorer, Mozilla Firefox) in the block of information sent to the target site when a resource is requested from that site.

Basically, that means that if you’re viewing http://example.com/ and click on the link ed costello: articles and essays, a request like the following gets sent to my server:

GET /articles/ HTTP/1.1
Host: epcostello.net
Referer: http://example.com/
...other stuff irrelevant to this post...

So, that is what a referrer is (referer is a tragic misspelling which occurred some time in the early days of the web and we're stuck with today in the CGI spec and other places).

Referrer spam is a recent innovation by the lower life forms which populate the web. I'd seen it in the ibm.com logs, but infrequently and not on any regular scale. Now there are tools and web sites you can use to try to drive traffic to your site by spamming the referrer field on the target sites.

Referrer spam has become popular due to the am I cool or what need of various bloggers to show who's linking to their blogs. The easy way to do this has been to scrape the referrer field from the access logs or to capture them in real time using PHP or some other server side scripting language. Whatever way they're captured, they're then reposted to the site, sometimes ranked, usually linked.

The spammers rely on the fact that people will click on anything on a web site, even something that clearly says in bright letters DON'T CLICK HERE. Referrer spamming may also help increase a site's pagerank though I doubt that is that effective.

Whatever the cause, I'm now getting referrer spam. Of course, this is silly since I don't post referrers anywhere on any of my sites. Nowhere. In a country where you can get arrested, tried, and convicted simply for linking to content which someone has deemed illegal, reposting referrers just seemed like an easy invite for trouble.

Silly me, I thought that if I don't post referrers, I wouldn't get referrer spam.

Not only am I getting referrer spam, I'm getting what I now call modified referer spam: this consists of malformed proxy requests like the following:

GET http://example.com/images/searchbox_2_1.gif HTTP/1.0
Referer: http://www.hanyhost.com
—and—
GET http://example.com/s.php?uid=20694&keywords=monitor6&submit=Go%21 HTTP/1.0
Referer: http://www.gofortraffic.com

Now, I don't run my site as an open proxy either, so this is just stupid, irritating, and a complete waste of my resources.

This referrer spam traffic provides no value to me at all, and if it grows could negatively impact whatever real traffic I do want to accept and respond to.

So, I'm fighting back.

My site uses the Apache web server, the following code bits are relevant only to Apache.

My first step was to block the IP addresses of the systems running whatever client application is available to generate referrer spam thusly:

deny from 218.11.90.83
deny from 218.11.93.1
deny from 218.11.93.101
deny from 218.11.93.148
deny from 218.11.94.112
deny from 218.11.94.168
deny from 218.11.94.215
deny from 218.11.94.251

The problem here is that this gets to be a pain to maintain, eventually the spammer gets a new IP address, or gets smart and uses AOL or some other large ISP for a run. Who’s going to block an entire ISP?

I realized that it would be easier to block by the patterns that the spammers use, as well as by the referrers being spammed. Since one pattern is to request a resource which isn’t on my server at all I check to see if the hostname matches my hostname. If the hostname doesn’t match, then I bounce the request. I’ve tried a couple different methods of bouncing requests...you can fail them entirely, serve up a nasty comment or two, or redirect the request.

A neat thing I discovered while I was running www.ibm.com was this: when you redirect a request, the Referer does not get updated to reflect your site as the redirecting site, I found this was true for every web browser in popular use in the 1996-1998 timeframe and I believe it to be true today.

Case in point: in the 1996-1997 timeframe someone wrote a really stupid web crawler whose sole purpose for existence was to scrape email addresses from web pages. One night I watched the site monitors for www.ibm.com and realized we were being attacked: something was driving a high volume of traffic to the site, and worse was causing a high volume of errors.

Doing some digging and tailing some of the logs, I realized that it was this stupid crawler. It had become trapped in the site, not handling a URL correctly and just generating ever more erroneous requests to the site. I did the only logical thing I could think of, since I wanted to get rid of the traffic (and the crawler was not stopping in response to 403, 404 or 500 errors), I added the URI in error to our redirect file, and targeted the redirect at the web site of the crawler in question.

The traffic immediately disappeared.

Taking this a step further, since we had all sorts of code patched into www.ibm.com (the homepage itself was a CGI for a long time, probably far too long): I redirected all requests from the crawler (which happily supplied a user agent identifying itself and the company responsible for developing it) to the developer’s web site.

Anyway, based on that bit of history, that’s how I’ve responded on my own sites: redirect the traffic back to the spammers in question. I don’t want the traffic, I derive no financial benefit from receiving the traffic, I have no contractual obligation to accept the traffic. And I am breaking no laws that I know of in redirecting the traffic back to the originators.

So, without further adieu, here is the htaccess directives to do so, note that I’ve changed references to my site to example.com:

RewriteEngine On
RewriteCond %{HTTP_HOST} !^example.com$ [NC]
RewriteCond %{HTTP_REFERER} ^(.*)$ [NC]
RewriteRule ^(.*)$ %1 [R=301,L]

There’s multiple variations on this of course, you could do:

RewriteEngine On
RewriteCond %{HTTP_HOST} !^example.com$ [NC]
RewriteCond %{REMOTE_ADDR} ^(.*)$ [NC]
RewriteRule ^(.*)$ http://%1 [R=301,L]

Which tells the client to redirect to itself or at least the IP address it is spoofing.

I could just fail the request, using RewriteRule ^(.*)$ $1 [F,L] but that seems self-defeating: if my server has to put up with the crap traffic to begin with I want someone else, preferably the bozo initiating it or paying for it, to feel some pain as well.

I strongly believe that the primary reason email spam and referer spam is so successful is that it’s so easy to do and carries so few penalties. If more sites reacted with strong defensive measures instead of just sucking up the additional traffic there would be less value to the spammers to do this sort of thing.

Note: This article was modified on 7 August 2004 to edit the URLs in the modified referer spam example to 'example.com'.

2004-12-09T20:03Z: I've turned comments back on...see if the spam bots attack again.