James Clark's Random Thoughts

In Brazil it usually follows first(s) name(s) + mo...

2010-06-19T00:38:40.670+07:00

In Brazil it usually follows first(s) name(s) + mother's family name + father's family name. Myself, for example, am called Pedro Ivo Coimbra Siqueira e Dantas. Pedro Ivo being my first names, Coimbra my mother family's name, and Siqueira e Dantas comes from my father. It's quite a long name (for a brazilian, at least) and sometimes I'm mocked by my friends that say I must belong to the royal family, for having such a long name.
But this structure, mother's family name + father's family is just a tradition, not a law: my wife, for instance, has a different name structure: she is called Marina Campos Magalhães, but Campos comes from her father and Magalhães from her mother. Her parents just though it sounded nicer. So, when we have kids, if we follow the tradition it should be named Something Campos Dantas, but it could really have any combination of our last names.
In the countryside and small towns, some time ago, people used to be known by their first name and mother's first name. For example, João de Maria, meaning João son of Maria. Off course, they would still have an canonical name for official purposes.

It's a shame that you no longer appear to believe ...

2010-06-08T09:17:23.259+07:00

It's a shame that you no longer appear to believe in the virtues of namespaces. I think the problem with namespaces, as with any tool, as not as much the specification itself, as how it's used in practice. For example relying on prefixes rather than the actual URI's. Also, a more abstract convention for namespace URIs may be in place, for example magnet links for namespaces rather than HTTP URIs.

I think the problem with namespaces being layered is that they are useful for defining a standard vocabulary for things like comments which could have simply had a namespace rather than a completely distinct syntax. And they could in terms have been layered on top of the basic specification. That would have been a better layering than layering the namespacing. - Isn't hindsight great?

Sadly that's not the case. The same could be said for several other features like processing instructions. Do you really need a special syntax for these?

Also, is human-readability a benefit or an issue? Human-readability leads to things like attributes which leads to things like the XML Information Set which treats attributes like something distinct from elements. Really, there either be only elements and editors should have ways to represent simple elements in a smart way. Also, attributes lead down the path of micro-formats which completely abandon the elegant underlying XML data model.

Again, the benefit of hindsight...

Is it better to build VLC on macports or just to d...

2010-03-20T18:17:43.074+07:00

Is it better to build VLC on macports or just to download the binary and install? Time is not an issue for me when building ports, just wanted to get feedback from others.

James, Thanks for the comments. If you're intere...

2010-02-27T13:32:18.862+07:00

James,

Thanks for the comments. If you're interested in filing some issues against the Salmon or Magic Signatures specs, I've opened up an issue tracker at http://code.google.com/p/salmon-protocol/issues/list and tracking issues raised there.

I assume you mean RFC3447 for RSAPublicKey -- it's possible that ASN.1 DER encoding w/base64url would work, it's just very hard to verify that by reading the ASN.1 spec itself. If there's a reasonably way to specify this as a profile of ASN.1 DER (just for the set of integer fields needed for keys) without pulling in all of ASN.1 as a dependency it could be reasonable to use it.

Salmon has a specific problem in that it needs its signatures to survive not only transit but storage in hostile environments (e.g., SQL) prior to re-syndication. Thus the armoring provided by Magic Signatures.

is this all ? not more ? :-)))) look our "tour" fo...

2010-02-22T21:29:30.768+07:00

is this all ? not more ? :-))))
look our "tour" for yiid.com

http://blog.yiid.org/2010/02/22/openyiid-ein-update/

AFAICT the list of names on the OWF site shouldn't...

2010-02-22T15:28:04.709+07:00

AFAICT the list of names on the OWF site shouldn't be read as an endorsement, but rather an effort by folks to give guidance on what looked like an interesting endeavour.

It's been around for a while, and it's still hard to even say what the OWF is, much less what it does. Beyond the license, of course.

Dare, I take your point about using the term "sta...

2010-02-22T11:16:41.455+07:00

Dare,

I take your point about using the term "standards". I guess I should have said something like "draft specifications that could plausibly evolve into open standards".

Dare -- right. That's why I immediately left a co...

2010-02-22T04:19:23.025+07:00

Dare -- right. That's why I immediately left a comment clarifying the difference between standards and specifications the moment I saw James' post. My comment is right above yours.

And to be clear, nearly all of these specs _are_ standards. The ones that aren't, like Activity Streams and Salmon, are still being worked on in the open and no standards body would accept them in the current form anyway. What should I call them instead?

If there's something you'd like to add about what Google or I should be doing differently in building Buzz, I'm all ears. In fact, we'd love it if you'd contribute.

And of course, James knows better than anyone the difference between standards and non-standards. He's written more of them than the rest of us combined. : )

Dewitt, Standards mean a very specific thing in...

2010-02-22T04:03:03.909+07:00

Dewitt,
Standards mean a very specific thing in our industry whether they are de facto or de jure standards. Misusing the term is bad for the industry because it allows companies to sling FUD while using what are effective proprietary technologies in their products and it misleads customers.

This is orthogonal to the merits of the underlying technologies or whether Microsoft employees are involved in OWF or Atom-related spec work.

Dare, PuSubhubbub was indeed developed by Google ...

2010-02-22T03:45:41.370+07:00

Dare,

PuSubhubbub was indeed developed by Google employees, but as a side project and the spec has been released for anyone to implement. No licensing issues.

Webfinger is an effort by a number of folks, most influencially Eran Hammer-Lahav (currently of Yahoo). Yes, Googlers have participated in the definition, as have folks from Yahoo, Six Apart, and any number of indie voices.

Dare -- actually, I'm very very careful not to eve...

2010-02-22T03:45:01.972+07:00

Dare -- actually, I'm very very careful not to ever use the word "standard" to refer to anything that hasn't gone through the IEFT, OASIS, W3C, ISO, etc. And I ask the people I work with to do the same.

You'll notice I make that very point in my comment above.

You've made it crystal clear that you don't like that Google is pushing for these specs. But what's odd is that Google is building on the very same specs that Microsoft authored or is advocating for -- Atom, AtomPub, Activity Streams, OAuth, etc. Moreover, the lead counsel writing the OWF license agreement is a Microsoft attorney, (and a very good one at that), who is doing it in part so that Microsoft has a publicly-vetted open licensing model to use.

Try not to throw the good parts out—the parts that your own colleagues are writing—just because Google is also championing for them. To be sure, we're not turning them away just because Microsoft had a hand in creating them.

I'm confused as to how a bunch of these things are...

2010-02-22T02:57:52.103+07:00

I'm confused as to how a bunch of these things are being called "standards" especially by someone like James who's been around the block in this space.

Most of these so-called standards are specs written entirely by Google employees and primarily implemented by Google products (e.g. WebFinger, Salmon, PubSubHubub). In that case, why don't we call Twitter's API or the Facebook platform standards? After all, their specs are online and there a lot more apps that implement them than any of the above.

I find it extremely troublesome that one company has started a trend of mislabelling proprietary technologies as standards and has gotten members of the press and tech elite repeating their spin.

Thanks for writing this up, James! We're working...

2010-02-22T00:31:22.006+07:00

Thanks for writing this up, James!

We're working on the APIs out in the open over at http://groups.google.com/group/google-buzz-api if you or your readers want to join us there.

Regarding the OWF, the OWF isn't a standards body of course. But the OWF offers the OWFa, a permissive license that can be used for open specifications. Many of the specs we're using are licensed under the OWFa. This can happen even before a spec goes on to be standardized in a formal setting.

Orthogonally, many of these protocols are standards by way of the IETF and OASIS, some with their own permissive licenses.

The most urgent reason for doing this IMO is that ...

2010-02-14T19:12:17.359+07:00

The most urgent reason for doing this IMO is that people -- especially at Google -- are starting to talk about running everything over SSL, so as to avoid transparent proxies, transforming/transcoding proxies, and so forth.

While I'm sympathetic to their goals -- pretty much no one wants their network operator mucking about in their Web browsing experience, much less automated agents' traffic -- making the entire protocol stream opaque is hitting it with far too big a hammer, and makes scaling the Web -- especially for smaller sites, and especially for more remote users -- a big problem.

A reliable way to sign HTTP responses would enable people (both publishers and consumers) to have confidence that the content hasn't been mucked about with, and would avoid the need to use SSL in these cases (of course it's still necessary when there are privacy concerns).

Caching can be important to dynamic content, but of course if you're relying on caching buffering isn't such a big deal, necessarily.

Carrying the 'main' page via SSL and using signed referents is an interesting approach; especially if that initial response that carries the policy for remaining ones can be long-lived in cache...

Mark, I don't know of any further progress, altho...

2010-02-11T10:57:47.279+07:00

Mark,

I don't know of any further progress, although I'm still convinced it's an important problem.

I agree that the signature stripping issue is an important one, but I think it's separable and depends on what you are using the signatures for. I had a couple of scenarios in mind:

a) The signature is a value-add rather than being essential. For example, a newspaper that provided signed versions of its pages (which might be the same as the print-friendly version) would be providing extra value to readers. The pages could be downloaded and saved complete with the signatures; in the future, even if the page goes away, you still have evidence to prove that a particular entity was at a particular URL on a particular date. That's useful for scholars, journalists, lawyers. If the signature gets stripped, then you don't have that value-add, but there's no security breach.

b) You are doing something like talking to your bank. Often you have an HTML page containing the dynamic content which is (or can be made) relatively small, and that page references a lot of other resources (images, stylesheets) that are relatively large and static and are also shared between multiple users. I envisaged that the HTML page would be served using https, whereas the referenced resources would be served using http with response signing. The browser would be responsible for requiring resources referenced from an https page to be secured either with https or with http response signing.

How important is caching for dynamic content?

James - I'm curious if you've made any further pr...

2010-02-10T06:16:53.450+07:00

James -

I'm curious if you've made any further progress on this, or seen any implementation.

In the long run, I think this is an important problem to solve; otherwise, approaches like SPDY that are (at least currently) cache-unfriendly will have an advantage.

I have lots of feedback about the details, but AFAICT the big issue facing proposals like this is stripping the signature; i.e., presumably, you're wanting to give UAs a way to detect that a response has been modified by an intermediary, but the only thing that has to be done to circumvent the signature is to strip the header.

This could be worked around by defining some sort of site policy about whether signatures are checked. Unfortunately, AFAICT that would have to be hosted on SSL/TLS to prevent *it* from being compromised -- but that's still better than making the whole site opaque to caches.

One other thing -- this sort of approach requires "dynamic" content to be buffered before sending. That's not always a dealbreaker, but sometimes it may be undesirable (e.g., with very large or very performance-sensitive responses).

I'm struggling to find a way around that; HTTP trailers are required to be optional to understanding/processing the message, so that's probably not going to work here. The only thing that comes to mind is indicating somehow that the signature will come at a particular place near the end of the content (in it), but that seems pretty messy.

Font rendering on Mac isn't inferior, just differe...

2010-02-07T23:07:45.295+07:00

Font rendering on Mac isn't inferior, just different. A decent explanation is here: http://www.joelonsoftware.com/items/2007/06/12.html

Did you plug the mouse into the keyboard? If it's...

2010-02-07T19:07:30.239+07:00

Did you plug the mouse into the keyboard? If it's too short with it plugged in there then you must have quite expressive mousing behaviour. :)

I'm really liking the development channel for Google Chrome, but that's mainly because it has a really smooth implementation of bookmark syncing.

DisplayPort wins over HDMI because it's royalty-free, unlike HDMI. Apparently this is why very few ThinkPads have HDMI, the extra cost won't be appreciated by the corporate purchasers.

If you plan to run your own processes in the backg...

2010-02-07T05:53:30.830+07:00

If you plan to run your own processes in the background like a Java servlet container, use 'Lingon' to define these processes.

Also, use 'Handbrake' to rip DVD's;

Get your svn client from OpenCollabnet (http://www.open.collab.net/downloads/community/).

@Brian: I think keyboard use within text editing o...

2010-02-07T05:17:08.395+07:00

@Brian: I think keyboard use within text editing on the Mac is more of a "find out how this app does it", while on Windows it is a dependable interface.

The Mac really disappointed me there.

I'm a recent Mac convert too, although all of my o...

2010-02-07T04:08:42.294+07:00

I'm a recent Mac convert too, although all of my other system are still Linux. I've had a similar experience to you from the sounds of it. I tried MacPorts - found it annoying so now I'm on Homebrew and it has less friction for me. The lack of a system-wide package manager is frankly stunning coming from Debian-based systems with aptitude. I can see that someone offering a binary package manager on a subscription basis would probably have some customers on a Mac. I've compiled more software in the last 2 months on a Mac than I have in 10 years on Linux systems!

Safari was rapidly dumped in favour of Chrome for its speed, and Firefox since I need a lot of the extensions for some of the work that I do.

By report, though, the Mac-style menu really sucks...

2010-02-07T04:02:28.551+07:00

By report, though, the Mac-style menu really sucks when you have two screens, because it sticks firmly to the primary screen even when the app window is on the secondary screen. There is probably a way around this, though.

AppFresh is nice if you want to update software/pl...

2010-02-07T03:24:55.519+07:00

AppFresh is nice if you want to update software/plugins. It's not package system, just updater.

Top menu is awesome though! I have 30" (over DisplayPort no less!) and I still like it. It's just always in one place where you can quickly grab it. I remember exact fixed position of every item - it never changes.

While software choices will vary (I would personal...

2010-02-07T03:24:33.848+07:00

While software choices will vary (I would personally never install macports - check out homebrew for an alternative) the big wins will come in other ways IMO.

For one, almost all applications (except odd non-native ones like Firefox) have a unified set of keyboard shortcuts. Things like moving around text (ctrl-a, crtl-e, etc..), tab switching, window selection, application selection (keep in mind that these are different unlike alt-tab in windows-like systems), spotlight, menubar selection (also check out cmd-shift-?), and more. You can even add your own very easily or change the build in ones (a little more involved).

As for other things to check out, include Plainview (fullscreen webpages for things like presentations), Limechat (IRC), Echofon (twitter), Things (task tracking), iWork (very well done, worth the free trial at least), droplr (free drag and drop file share/upload), dropbox (I use this instead of time machine).
s

Plug mouse into keyboard. That's why cable is so s...

2010-02-07T03:18:28.801+07:00

Plug mouse into keyboard. That's why cable is so short.
Magic Mouse is quite good too.