Why security back-doors for governments are a bad idea

Bruce Schneier has written yet another spectacularly lucid piece on why the the FBI shouldn’t be able to force technology vendors in the USA to add back-doors to their products.

The current proposal which is probably going to get the backing of the Obama administration, will levy fines of $25,000 per day on technology vendors that don’t add back-doors to their systems to allow government monitoring.

Schneier argues that history has shown that those back-doors are inevitably used by criminals and foreign governments with ill intent and leave people, the vast majority of whom aren’t criminals, less secure and less free.

 

 

 

What Musk and Tesla are up against

Go now to Tesla.com and listen to Elon Musk’s portion of the shareholder meeting that occurred today from minute 49:00.

It’s probably the best insight you’ll get into how entrenched the USA is on traditional cars and traditional sales channels. It’ll also explain why you consistently have a crap experience buying cars in the USA and why servicing your car costs so much.

Musk gets emotional and my sense is that he is emotionally invested in his company and has big dreams that are being blocked effectively by industry incumbents.

I just became a Tesla fan.

 

How Leaders Influence your Reality

During the last several years I’ve had the opportunity to see great leaders in action and the misfortune to see great deceivers at work. Both have one characteristic in common. Many would call it charisma, but I’d like to expand on what I think that “charisma” thing is.

Pause for a moment. Think about the fact that you’re giving me the opportunity to paint a reality for you. It’s my perception of reality, but by taking it on board and fully understanding the way I see things, you’re giving me the opportunity to mould and shape your reality. If you read this whole blog entry you’re going to have devoted a full 2 to 5 minutes of your conscious thought to my perception of reality. And whether you like it or not you’re going to take some of it on-board.

Great leaders and great deceivers are given a constant flow of opportunities to project their perception of reality and their vision for a future reality on large numbers of people. They alter the way a large group of people see the the world and the way these people think the world should be.

Ever wondered why Germany followed Hitler? Those screaming German speeches weren’t gibberish. They were rousing calls to arms with a believable and powerfully delivered rationale behind the call.

These speeches, or put in different terms, these opportunities Hitler was presented with to impose his perception of reality and his vision for a future on large groups of people, allowed him to influence an entire nation to go to war and eventually carry out some of the most awful atrocities in history.

So the lesson would appear to be “be careful who you lend your ear to”. But it’s a little more complex and more difficult that simply being careful. When others acknowledge someone as a leader, celebrity, genius, as talented and so on, it has a big influence on us as individuals and our default behavior as Cialdini writes in “Influence”, is to go along with the crowd.

“You say his a violin virtuoso, well he must be”, “You say this is a ’82 bottle of Latour’, well it must be spectacular”.

On a side-note, a friend once did an experiment where he sabotaged an already open bottle of excellent wine by decanting it and pouring in a very cheap wine. He watched the wine enthusiasts drink the sabotaged bottle and rave about how clearly excellent the wine is.

Social proof is a powerful phenomenon and if a group of people or respected organization acknowledge someone, they’ve given them a platform for “reality influence” or to create a “reality distortion field” if you’re a Steve Jobs fan.

If you’re a leader, I hope you’ve gained a greater understanding of how privileged you are to have the attention of groups of people. If you’re a listener, I hope you’ll learn from history and be careful who you grant access to your vulnerable and valuable attention.

 

An unpleasant Herman Miller experience in South Africa

Update: HM’s Director of Comms was kind enough to post a response here (see below in comments), Elmarie responded in the comments, today the issue was resolved when the owner of the HM distributer in South Africa called Elmarie and apologized for the way things were handled and it sounds like they’ll be working together on getting a few more Aerons for the office. Nice to see a brand that has their ear to the ground and responds to consumer feedback within 24 hours.

My good friend Elmarie ordered her first Herman Miller Aeron chair for her office. She responded to an ad placed in Gumtree by “All Office” who are the exclusive Herman Miller agents in South Africa.

She was pretty excited when her Herman Miller Aeron Chair arrived, as were we all, but it turns out the price she was charged was not the advertised R6995 (approx $765.50) but instead she was charged R7974.30 (approx $872.68), over $100 more.

She called “All Office” slightly irate and was told the price she was quoted was excluding VAT (South African sales tax). For my American friends/family and anyone in a non-VAT country, one of the first principles of the South African VAT act is that you include the tax in the price.

What really soured this experience was the following: When chatting to a manager at “All Office” Elmarie was told that if she doesn’t want to be a “good citizen” and pay the full price, then he would take the balance out of the salary of the sales person who placed the Gumtree ad.

So after hearing ads for the Herman Miller Aeron chair by Sit4Less on National Public Radio for the last year in the States – and thinking we’d get a few for our office in the USA, I’ve pretty much done an about-face on the brand and won’t be buying any Aeron’s any time soon.

PS: I’d like to hear from Herman Miller in Germany about this. Elmarie has emailed them and is waiting to hear back.

A Viable Business Model for Facebook

Facebook’s second quarter revenue is expected to be $1.1 billion. That would give them roughly $4.4 billion per year, not exactly a number that justifies the $100 billion market cap they were/are hoping for. Compare that to Google’s $37 billion last year with current $200B market cap and Facebook isn’t even a player yet.

The endgame has arrived and the whole world is on Facebook today. Those that aren’t are seen as eccentric and are beginning to get depressed about losing touch with their kids.

What business model would make sense for Facebook now? Clearly advertising isn’t cutting it. They have a problem of “intent”. People go to Google to find things and if those things are in an ad, they click that ad. With Facebook the only intent is to “facebook”, not find a plumber and potentially click an ad. So as far as I’m concerned advertising will never work for Facebook.

So what should they do? Well, for starters, they have a dossier on just about every literate person on the planet with Internet access. Their data extends beyond just their own website facebook.com. They have data on most of the websites their members visit and what those members do on each website. They know who you are, where you are, who your friends are, who their friends are, where you were born, what you and your friends look like, who you communicate with most frequently, what you like, which websites you visit most frequently, how you get to those websites,  which pages you visit on those websites and all the usual demographic cruft.

In short, Facebook is the most complete and most current database of dossiers on individuals globally that the world has ever seen and it’s effortlessly updated in real-time.

So who might be interested in that? Any intelligence agency on the planet. Is there any money in that? Lets find out.

The Department of Defense in the United States 2013 budget is going to be roughly $525 billion. How much of that might they spend on surveilling people globally in real-time? Looking at the budget for the National Reconnaissance  Office (NRO), the guys who launch and manage our spy satellites, is instructive.

The NRO’s budget for 2010 was roughly $15 billion. If Facebook can also be considered a global array of data gathering nodes similar to our spy satellites, then surely $15 billion would be a reasonable number to throw around in a conversation with the folks who launch and operate the data gathering nodes?

And that’s one customer, albeit the largest customer. Remember that the USA has intelligence partners around the world. An example of this is the five signatory states in the UK-USA signals intelligence sharing agreement which are: USA, UK, Canada, Australia and New Zealand. All these folks have significant budget they can also contribute.

Another budget item that might be instructive to look at is the cost of ECHELON which is not public data. But the scale, size, importance and multi-decade nature of the project (started in the 70′s and still going strong) is a good illustration of how seriously the USA and it’s partners take signals intelligence and the scale of the budget available for it.

To be a “Google”, Facebook would have to bring in $40 billion a year in revenue which would take them to Google’s valuation of $200 billion. Right now they’re stuck at $4 billion a year.

Facebook is the only social network that matters and will be forever thanks to it’s network effect. It’s hard to believe that the smart people Facebook keeps gobbling up haven’t considered chatting to the global intelligence gathering and cyber security community. The data they have is game changing and something the global SIGINT community would never be able to gather on their own.

Trying to visualize the conversation Zuckerberg might have with the global intelligence community, it reminds me of a quote by Richard Gere’s character in Primal Fear who is a famous defense lawyer describing the conversation he has with new clients: “Have you been saving up for a rainy day? Guess what? … it’s raining!”

Footnote: There is the hard problem that publicly working with the intelligence community would kill Facebook. But then the intelligence community has never been very public and one wanders if there are ways to productize the desired data into something that appears benign and have contractors buy it on the agency’s behalf. Food for thought.

11 Questions Every Startup’s Money Guy Should Be Able to Answer in Her Sleep.

Every profitable business has a Money Guy. Sometimes it’s the CEO, sometimes it’s another member of the exec team. Money sticks to this persons hands for reasons unknown. They know how to get the best deals for anything they buy and they have a habit of making more money than they lose. If you don’t have someone like this in your business then you are almost certainly not profitable and never will be.

Often this persons title is Chief Financial Officer or Chief Operating Officer. They are the ones who update the cash flow plan and know how much cash the business has on hand at all times. They are the money guy. You’ll know your money guy rocks when you wake them up in the middle of the night and they answer every one of these questions as if it’s a reflex:

  1. When do we run out of money?
  2. What is our next revenue target date and amount?
  3. Are we going to make our target or are we slipping?
  4. What are the two most effective things we can do to increase revenue?
  5. How are we doing with regards to implementing those 2 most effective things?
  6. What are our top two sources of customers?
  7. Are either of those sources at risk of disappearing overnight?
  8. What are our two biggest expenses?
  9. Have we done everything we can to lower those expenses?
  10. Are we at risk of facing a large bill in the near future?
  11. Now that you’ve been woken up, is there any current or future problem in the business that will make it hard to go back to sleep?

Other awesome Money Guy attributes:

  1. Your Money Guy discovers surprising ways to save significant amounts of cash on big expenses.
  2. Your Money Guy isn’t constantly moaning or complaining, but occasionally will assemble the team and lay out hard facts that put some acid in your gut.
  3. Your Money Guy always has your important financial data on hand, often memorized for impromptu brainstorms or planning sessions.

The culture I’ve described here is unfortunately not what you find in most nascent businesses which is why most of them fail to make that critical four year mark. Also not that this does not apply, or put differently it is unable to be applied to the paralel universe of West Coast Technology Startups in the USA. But it’s something I’ve observed in businesses around the world including profitable USA businesses.

Often Money Guys are seen by tech entrepreneurs as people with green eyeshades who work under dim green lamps and aren’t fun at parties. But without the Money Guy, the parties end, entrepreneurs become employees and the innovation ends. Your Money Guy is the person who makes sure your business has enough oxygen to dive deep, take those big risks and come up for enough air to do it again.

Stop Being a Recruiter and Start Being an Entrepreneur

The Valley has taken some criticism for massively incentivizing the smartest people in the world to work on problems that won’t really benefit our species – like how to get more ad clicks. But that’s not what really bugs me.

What really bugs me is that in SV, nothing is built to last. Everything is built for an exit.

Imagine a party and a room full of silicon valley entrepreneurs. You are a new entrepreneur to the area and you want to meet the guy who is everything you want to be. Go on. Admit it. It’s that guy in the corner surrounded by people, who arrived 2 years ago, started his company 18 months ago and just sold it to Google for $20 to $50 million and now works for them. That’s the guy everyone wants to talk to because they want to be that guy. That is the epitome of SV success. And it is a massively destructive culture.

SV is attracting the worlds most talented engineers and tech business people. The founders, staff and investors of these companies hope that these folks will build a product for 18 months to 3 years, have the company acquired by a large incumbent and have the product killed within 2 years. Only the team remains as employees for the acquirer.

The dominant business model in SV is not innovation and entrepreneurship but recruitment. And if you arrive in SV and are hoping to build to get acquired, you are really an aspiring recruiter. Your strategy is to assemble a team, find a project that is intellectually interesting enough to them to keep them all in one place for 1.5 to 3 years, and have them demonstrate their talents to a large tech incumbent who is hiring. When the hiring event occurs, the incumbent will acquire the company for somewhere between $1 and $4 million per engineer. The deal will be cash for investors and an earn-out for founders, both of these being the equivalent of recruiting fees.

What makes me sad about this is that many real and talented entrepreneurs who could be building innovation and job creation machines are caught up in this. They are mentored into thinking this is the way things are done and their potentially world-changing businesses are eaten by the system.

Most of the rest of the world has a wonderful natural selection system for defining business success. Good, healthy successful businesses generate cash and lots of it. They create jobs, make people profoundly happy and satisfied and create new products and services that improve lives. They grow organically with their customers as they develop a pattern of making people happy.

Silicon Valley is a wonderful place to raise investment capital for a technology business. My investors are amazing individuals and have empowered us tremendously as entrepreneurs. But basing a business in The Valley feels to me like clearly stating your intent to exit and not build. And I think every entrepreneur’s intent should be to build and not exit.

PHP array() is a little scary

Push 100,000 elements onto a PHP array() where each element is a four element associative array (a hash in Perl speak). Here’s the data being pushed:

array(
  'owner' => 100,
  'host' => 'www.example.com.co.uk',
  'path' => '/this/is/an/example/path.html',
  'hostkey' => '1111'
)

The memory grows by over 80 megabytes.

Pushing takes less than a second or two but shifting off the first 1000 elements takes over 17 seconds on my machine.

Now take that same data and create a basic FIFO class that has push() and shift() methods. Use pack() and unpack() to store the data in a long string. Total time to push 100,000 and shift the first 1000 elements is around 1 second. Total memory is 7 megabytes which is less than 10% of PHP’s internal array()’s consumption.

PHP’s splFixedArray class which is advertised as mainly having a speed advantage doesn’t fair much better. With a fixed array created of 100,000 elements and loading and unloading the same associative array() it grows by 75 megs but is very fast at half a second. Just for fun I pushed 100,000 elements on an splFixedArray which are simply the values of the test associative array concatenated into a string and it’s still weighs in at 13 megabytes.

Here’s the FIFO class:

class wfArray {
        private $data = "";
        private $shiftPtr = 0;
        public function __construct($keys){
                $this->keys = $keys;
        }
        public function push($val){ //associative array with keys that match those given to constructor
                foreach($this->keys as $key){
                        $this->data .= pack('N', strlen($val[$key])) . $val[$key];
                }
        }
        public function shift(){
                $arr = array();
                if(strlen($this->data) < 1){ return null; }
                foreach($this->keys as $key){
                        $len = unpack('N', substr($this->data, $this->shiftPtr, 4));
                        $len = $len[1];
                        $arr[$key] = substr($this->data, $this->shiftPtr + 4, $len);
                        $this->shiftPtr += 4 + $len;
                }
                return $arr;
        }
}

Here’s the test script using the FIFO class with the array() tests commented out.

require_once('wfArray.php');
error_reporting(E_ALL);
$p1 = memory_get_peak_usage();
$stime = microtime(true);
//$arr = array();
$arr = new wfArray(array('owner', 'host', 'path', 'hostkey'));
for($i = 0; $i < 100000; $i++){
        //array_push($arr, array(
        $arr->push(array(
                'owner' => 100,
                'host' => 'www.example.com.co.uk',
                'path' => '/this/is/an/example/path.html',
                'hostkey' => '1111'
                ));
        if($i % 1000 == 0){ echo $i . "\n"; }
}
$i = 0;
while($elem = $arr->shift()){
//while($elem = array_shift($arr)){
        $i++;
        if($i > 1000){ break; }
        if(! ($elem['owner'] == 100 && $elem['host'] == 'www.example.com.co.uk' && $elem['path'] == '/this/is/an/example/path.html' && $elem['hostkey'] == '1111')){
                die("Problem");
        }
}
echo "\nTotal time: " . sprintf('%.3f', microtime(true) - $stime) . "\n";
$p2 = memory_get_peak_usage();
echo "Grew: " . ($p2 - $p1) . "\n";

Hidden Data in The Spanish Economic Crisis

Spain has been all over the press this weekend with a 100 Billion euro bailout agreed to by   Eurozone finance ministers. I spent the last three days in Spain and I find the coverage I’m reading somewhat disconnected with reality.

I drove down to Madrid from where I live in Southern France and spent Thursday, Friday and Saturday morning there, then drove back home and spent Saturday evening in Pamplona where the San Fermin festival starts in a month with the running of the bulls.

Madrid is a shining jewel in Europe. The city is immaculately clean and has a wonderful mix of new buildings like the Cuatro Torres that make for a spectacular modern skyline juxtaposed against gorgeous old buildings like the Royal Palace.

Walking in the Parque del Oeste where the Egyptian temple of Debod was moved to save it from the Aswan Dam, the park is filled with locals who have come out at night for their evening walk. Kids playing, groups of older women or men walking together, lovers in a quiet secluded spot in the park. Everyone is happy and full of life.

Driving around Spain there is an incredible amount of active road construction and the roads that aren’t being worked on are in great condition with many spectacular bridges.

Pamplona was absolutely heaving with party-goers on Saturday night including a huge Spanish rock festival, packed bars and pubs and streets literally filled from wall to wall in the older part of town – and the newer part was full of locals out for their evening walk. I visited a heavy metal bar with an Iron Maiden cover band doing a terrible rendition of Maiden’s older stuff and the standing-room-only crowd loving every second of it.

While in Madrid I got chatting to a local shopkeeper and went out on a limb and asked her about the informal or under-the-table economy in Spain. She explained that many people are employed off the books. I asked why, speculating that the tax in Spain is very high. She explained yes that’s one reason, but taxes are higher in Italy where she’s originally from. Another reason is to keep getting social benefits like a housing benefit. She also said it’s popular to pay someone only 70% of what they’re really paid into their bank account and the rest in cash to avoid tax.

More evidence that there’s a thriving off-the-books economy is that when we stayed in Madrid, we rented self catering accommodation. The proprietor asked that we pay the roughly 200 euros bill in cash.

All the economic indicators used to describe the “Spanish crisis” and provide rationales for bailing out spain or to predict how bad the “coming collapse” will be don’t take the informal economy into account. It also makes it difficult to understand the needs of the Spanish people, what the GDP really is, how dependent they really are on social programs and what Spain’s real ability is to service it’s debt.

To some the informal economy in Spain may seem to be immoral because conventional wisdom holds that one should “pay your taxes” and put your money in a safe place like a bank. But the Spanish people seem to be discovering a way to live without banks and government visibility on how much they earn or what they do with their money. I suspect many of the government assistance programs are over subscribed and do little to serve their intended targets.

It makes one wonder who the Eurozone is really bailing out.

Everyone has a plan until they get hit

“Everyone has a plan until they get hit.”

~Mike Tyson.

Studying French for 1.5 months and then arriving in France thinking I’m a badass knowing how to sling a few sentences together was a notion rudely trussed, cooked, carved up and served back to me on a giant silver platter called humility by a certain French checkout girl yesterday at Decathlon.

I’d already been to the Bordeaux Apple Store (which is awesome), Animal’s World for pet supplies (also awesome), Orange and Ikea and flattered by people taking my money into thinking that I’m doing OK. Standing at the back of the line at Decathlon at the end of the day a checkout girl hurls a handful of words at me and waits while the entire line turns around and stares at me. I completely froze and couldn’t utter a word of french. I leaned over and in squeaky english said “I don’t speak french” and wanted to die. She gesticulated wildly at the line next to me and I walked over there and she stopped gesticulating. I still have no idea what she said.

I started today screwing up my first verb “parlez” instead of “je parle” after I was sure I’d at least get that right. Learning French and actually speaking it is like going from boxerobics to Mike Tyson swinging at your head.