Alex Batlin

Distributed Ledgers and Disintermediation of Trust

2015-01-31T00:34:00.003-08:00

People often ask me - 'What is so special about Bitcoin?' - and one of the answers I give is 'disintermediation of trust'. In economics, disintermediation is the removal of intermediaries in a supply chain, or "cutting out the middlemen". In my opinion, money is all about trust - you trust that if you work for X hours a day, your employer will pay you Y amount of money, and for that Y amount of money you will be able to buy Z amount of food etc.

But here is another question, why do we need to trust each other? Evidence shows that we can live better by specializing e.g. I am a much better IT guy than a musician, so if I do what I do best most of the time, I can't do the other things, but I can exchange my labour for money, and then for other goods and services e.g. buy music; and as a result you get better music and IT than if each one of us did both part time. So if specialization leads to better quality and productivity, then to unlock its value you need a form of exchange.

First form of exchange was barter, but it was pretty inefficient - hard to figure out how many sheep should be exchanged for a cow. In essence the cost of transacting was high, since it took a long time to barter, and it was hard to determine if one side or other got the better deal as the market visibility was poor. The nice thing about barter is that it is hard to double spend (cheat) what you have as there is a physical inspection and exchange of goods. You are still at risk of getting an inferior to what you bartered for product e.g. an ill sheep versus a healthy one.

So money in the form of gold was a big step forward. Gold is limited in supply, so in principle inflation can be controlled, unless a new source of gold is discovered e.g. South America's gold rush for the Spanish crown. It's hard to double spend or cheat the system, as like with barter you can perform a physical inspection and exchange of gold. Some people do cheat and substitute cheaper metals for gold or skimp on wieght if possible, so when performing a transaction it is worth checking that actual gold is exchanged, and you need to weigh it to ensure the amount is correct. Again, the cost of transaction is high as you have to check quality and amount, but better than taking a cow along for the ride when you want to buy a coffee.

Next innovation was the minted coin - essentially standard weights of gold, and hopefully a guarantee of quality i.e. you are getting gold not some inferior metal. A central authority, the mint, backs up the currency and guarantees quality and amount standards, enforcing those through punishment of forgers. Cost and speed of transaction is reduced, and there is now someone you can ask to enforce the law if fraud happens - recourse.

Gold is still pretty heavy to carry, even if it lighter than a cow, so paper money was the next invention. Much easier to carry and hence reduced transaction costs and time (friction). Paper money is printed in all sorts of clever ways to ensure that it cannot be forged and double spent.

However paper money was at first a simple proxy for gold reserves. Problem with gold is that it is of limited supply - good to prevent double spend but as the economy growth through more people being born and them becoming more productive, if no new gold is discovered, the money supply is constricted and no longer supports effective exchange of value, either leading to deflation or stagnation. Many argue deflation is bad, others argue that deflation is only bad if you have constrained demand. Go figure. Solution to this gave rise to fiat currencies - money not backed by commodity like gold.

Moving away from commodity backed money meant that governments became free to control money supply as the economy expands or shrinks e.g. quantitative easing etc. It's a very powerful tool, but places a lot of trust in the government not to print to much money and cause inflation. So, for paper based fiat money, you need to have trust in the government's central bank to not over or under supply money, and in the mint to create paper that is hard to forge.

Problem with paper money is that it is hard to send it remotely i.e. electronically. Sure you can post it, but that takes a long time. In the new digital age paper money transactions are just too slow and thus expensive. So, how do you send money electronically, and prevent double spend? After all, anything digitally stored is easy to copy and hence double spend. Current answer is to trust a bunch of organizations e.g. retail, merchant and central banks, payment processors etc. not to actually move money around, but for the various parties involved to record transactions in their own ledgers and then sync them up between organizations to achieve consensus.

In essence, it's the bank's view that determines how much money you have - that's a lot of trust. A good article about how money moves around can be found on this gendal.me blog.

All this works pretty well, so why did Bitcoin evolve? Remember 2008? Some people decided that they did not trust the banks all that much after all. So they sat down, and decided to imagine how you could keep and transact money without having banks and payment merchants. Then they wrote some code. Then they got a bunch of people on run that code on their servers. In 6 short years Bitcoin is worth now 3BN USD. Small compared to everything else, but awesome when compared to nothing - and all without a single bank, payment merchant or government body.

You may say - why do I need it, living in UK, CH, US etc? The answer is probably more belief based, rather than practical - with free retail banking it's easy to transact, and although merchants pay and pass on payment processors fees, you do get recourse in return.

But now think about the 2.5 billion or 35% of world's 7 billion total population who are unbanked, or indeed 12% of UK households and 8.2% of US households.

Turns out that it costs a lot of money to maintain all these central services, costs passed on one way or another to users, but only viable if there is a lot of payment volume. Large parts of the world therefore simply have no banking access as putting the required infrastructure there is not economically viable. So what Bitcoin has done, is by disintermidiating retail banks and payment processors via use of new technology, it has reduced costs and unlocked previosuly economically unviable business models.

All you need is a 26 GBP smartphone and mobile broadband subscription (2007 : 4% of world population subscribed, 2010 : 11.3%, 2013 : 29.5%). You are done! No need to open bank accounts or deal with VISA, PayPal etc. Imagine if just half of the unbanked started using Bitcoin - would the rest of the world be able to resist it? Take a look at M-Pesa and see it's phenomenal uptake in Africa if you are skeptical about demand. And whilst's Bitcoin's volatility index is about 7.55% against USD (https://btcvol.info/) compared to gold's 1.2% and major currencies' 0.5% to 1.0% range; it's not that bad when compared to currencies that majority of unbanked transact in.

But let's assume that Bitcoin the currency will not spread; but instead there will be government backed distributed ledger networks that track fiat currencies - after all how different is eMoney (legal, tried and tested) on a pre-paid debit card and a crypto-pound managed by smart phone app? It's that very question that the UK government is starting to ask : http://www.theregister.co.uk/2014/11/04/treasury.

Disintermediation of money - can we do better?

2015-01-30T23:43:00.001-08:00

I have done a lot of research about Bitcoin, blockchain 1.0, 2.0 and 3.0, distributed ledgers, alt-coins, Crypto 2.0, smart contracts, programmable money etc. I think it is a fascinating subject, and clearly has huge potential.

In doing so, I have come up with a mental model where as a society we have moved from barter to money based on gold, then commodity backed paper, then government backed fiat currencies - both paper and electronic.

Bitcoin is the latest technology that pushes our understanding of money and how it can be used in a digital world - it disintermediates the need for retail banks, payment merchants etc.

However, money itself is an intermediary - a proxy for value. In being a proxy, it has a lot of risk associated with e.g. inflation, theft, forgery to name a few. Yet for a very long time is has been the best means of value exchange we could think of.

So, here is the question, do we have the technology now to disintermediate money?

For example, could we go back to barter if we had perfect means of communication and information based on IoT, possibly coupled with derivative type contracts and smart agents acting on our behalf to place value on goods and services based on our pre-defined or machine learned criteria in near real-time using big data, AI and cloud computing?

Or is there something entirely different we can do to facilitate our lives, in the way money has so far? What could unmediated exchange of value look like? I would love your thoughts, thanks.

Eurostar Nightmare

2015-01-18T04:57:00.001-08:00

We left the Alps on what was meant to be 10.25 am this Saturday. On a train still, being told that we are at least 1.5 hours from being allowed to enter the tunnel.

The entire experience has been shambolic. Whilst the fire was an unfortunate accident, it is how a company responds to adversity that builds or destroys a brand.

There was one single lady dealing with hotel allocations last night after they had over 3 hours to organise something - we were lucky and got a hotel as quickly as 2 hours on the account of us having two little children and being lucky to have tracked down a Eurostar rep who looked like he was running away from the calamity, but took pity on us. Others were still waiting in the queue at 10.30 pm.

For some reason we had to travel in morning to Paris and do the whole check in again, whilst they had all the facilities in euro Disney - where they disembarked us overnight. Guess it was cheaper to for them to manage the shamble via the Paris hub rather than treat their customers with any sort of dignity.

My two children are now too tired to scream, I am too tired to be truly angry, and I resign myself to Calais as my most likely resting place tonight. But all is well, we were told that our compensation will be a free Eurostar ticket - they are obviously not just incompetent and uncaring but outright sadistic.

- Posted using BlogPress from my iPhone

Crypto Currencies : Will we need retail banking?

2014-10-20T03:26:00.003-07:00

I did a little bit of brainstorming on the subject of crypto / digital currencies and their impact on how we bank. A lot of people are skeptical about Bitcoin as an alternative currency. It feels a bit anti-establishment and likely to be squashed by governments if it ever becomes a serious threat - after all how will they set interest rates and do quantitative easing if they do not control the money supply.

That said, some say that if you wanted to build a new financial system that's better than today's, then blockchain, the technology that makes Bitcoin operate, might make it possible by rewriting the landscape of trust intermediation. Blockchain, a distributed ledger that can be adapted to authenticate and record a wide range of real-world financial transactions, such as clearing securities or transmitting international payments, demonstrates that digital records can be held securely without any central authority.

"it just throws up all the cards in the air." - Sean Park, founder and chairman, Anthemis Group.

Bank of England describes it as a "significant innovation" that could have "far-fetching implications". UK's chancellor George Osborne announced this year a government initiative to explore digital currencies. Blockchain changes the nature of fraud risk as there is no central place that would be a gold mine for hackers to attack. Due to in built use of cryptography, transactions are also naturally safer and prevent any asset in the system being spent twice.

"[Blockchain] will revolutionize how assets are registered, exchanged, transacted and owned. Custodians, assets registries, exchanges, clearing and settlement service providers will have to take notice lest they will be disrupted fully." - Pascal Bouvier, partner, Route 66 Ventures.

So, blockchain is "great" but bitcoin is not to be trusted. A bunch of new startups are trying to improve on Bitcoin e.g. Stellar<https://www.stellar.org/blog/introducing-stellar/>, Ethereum<https://www.ethereum.org/>, Ripple<https://ripple.com/protocol/> all talk about using blockchain, but all introduce their own currencies, not as fiat replacements but as intermediate exchange currencies or as proof of work. I think they will still suffer same distrust issues as Bitcoin. HyperLedger <http://hyperledger.com/#getstarted> is taking the next step forward and trying to introduce a blockchain technology that can represent any asset, and on first look is not trying to introduce a new currency, which is good news.

This opens up an intriguing possibility. If somehow we could solve the challenge of issuer's authenticity, possibility though the use of PKI i.e. a bit like today's website SSL certificates, why could the central banks not issue crypto currencies direct to citizens. Assuming that majority of central banks participated in a new type of blockchain protocol, then they each could issue their currencies as crypto currencies. No more alternative currencies, just fully fledged, legal fiat currency, only in crypto format. Today central banks don't want to do it because distribution of money and it's management is expensive, so they let retail banks handle it, but with crypto it is almost free, so why not bypass retail banks and have the control yourself.

On the consumer side, myself being one, I use retail banks for money security and convenience. Interest rates are the other traditional benefit, but being so low, it does not count for me now. Security becomes far less of an issue, as crypto currencies are by nature much more secure, so I don't need a bank for that. Convenience advantage also disappears as I can pay for anything using a mobile phone with crypto currency just as easily as with credit or current account card. Since there is no bank that holds custody of money, I do not need the deposit guarantee scheme.

So, all of a sudden, the good old retail bank that has been the financial platform since the 16th century, is no longer mandatory. Sure, I may want to exchange my crypto currency for paper money, but that can be operated by the ATM provider that is part of the blockchain network, not a bank. If I did want to get a bit of interest from my money, I can either choose to go P2P lending root for a superior lending rate but higher risk, or I could still transfer money to a bank that would pay me interest in exchange for my deposit.

However, even the way deposits work will change. An adjacent concept called smart contracts, goes hand in hand with blockchain technology. They are an extension of today's bitcoin transactions. You can think of a transaction as a contract that transfers X amount of money from a wallet with public key A to B, and optionally a small fee to the miner. So, Bitcoin already has some ability to add custom logic to a transaction, but it is not Turing complete i.e. there are no loops allowed. Newer protocols propose secure Turing complete execution environments, and Smart Oracles e.g. trusted data sources that supply external data to a contract so that it can execute complex logic in response to external events.

As a consumer, you would issue a smart contract that transfers X crypto pounds to your retail bank. In case of a current account, that contract would allow you to instantly ask for money back, in case of a savings account, there may be a pre-determined vesting period. The contract itself would pull in interest rates from the bank's smart oracle service, apply them to the amount under contract and depending on interest type, either add the amount of interest to money held under contract or transfer to your wallet. In case of bank's default, that contract would straight away transfer money back to the person ahead of any other creditor. Government in this case could provide a smart oracle defaults service.

In this case, Governments may not need to provide a deposit guarantee scheme at all if capital requirements are high, or offer a much smaller guarantee that would be cheap to administer as smart contracts would do all the settlements themselves. Based on this model, banks will strip away most of their proprietary infrastructure as the deposit smart contracts will be largely self-administrative, and there will be less risk in the economy in case of default.

Neither is FX safe, the other utility retail banks provide. In most cases today, I have to pre-load my account, either current account or some third party FX provider account before money transfer happens. I then pay FX fees and / or spread costs to market makers. Or, I can issue an FX smart contract where I specify how much I want to exchange at what rate, and how long will that position be valid for e.g. 30 secs. That contract will have it's own wallet private / public key. So I would transfer money from my account id to the contract account id, in effect creating an digital only escrow holder for a limited amount of time. If there is a blockhain match, then contract performs the exchange and I get the requested currency, if not, money is transferred back into my account from the contract escrow account. This may not be suitable for institutions as too much money would be locked up, but not an issue for consumers.

So, why does this all matter. Simple - retail banking is THE finance platform today, feeding other banking services like wealth manager and investment banking i.e. retail banks convert small deposits into wholesale loans etc. If they disappear, all other forms of finance will be profoundly disrupted, and we need to anticipate the fallout to survive and prosper. In the next set of blogs I will try to investigate a less disruptive scenario - how could banks set-up a blockchain technology to trade financial instruments between themselves.

Human Debt Avalanche

2014-08-12T12:41:00.002-07:00

“We are exploring how to optimise our business though the use of big data” - said a lawyer, just like many others, at a recent CIO round table I had the privilege to host. That’s when a thought struck me - “you might not have a business to optimise, unless you start investing in robo-law right now”.

Big data, like mobility and broadband internet, is part of the digital disruption wave that has already transformed music, video, news, publishing, photo and numerous other industries beyond all recognition. Knowledge workers; you are next.

Need proof? My parents’ translation business was first aided by Google Translate and just a few years later destroyed by it. I saw bankers walked out of the door as algo trading took hold. Wealth management robo-advisors are mushrooming, and it’s not hard to imagine robo-law, auto-accounts and digi-doctors.

So how did Google do it when most failed for years? Google was amongst the first to use machine learning and big data technology to harvest web’s huge amount of human translated text to improve accuracy. Slam-dunk!

Hypothesis: - Previously safe from machines, knowledge workers and their businesses will be disrupted, and for some terminally. Much like new entrants often arbitrage technology debt to out-compete the established heavyweights, disruptors will exploit new technology to avalanche human assets into human debt - very quickly and with little warning.

Need help? Flip your assumptions and start disrupting! Instead of thinking how computers can help humans, create and execute on a product roadmap that articulates how your most valued humans can help computers deliver enhanced value to your customers. Stop reading this, start now!

Post-contemporary Communication - Bridging Physical and Virtual Reality

2014-01-03T02:44:00.003-08:00

Imagine a virtual digital assistant that just floats up in front of you and reminds you of the tasks that you need to complete, or better still tells you what was done on your behalf automatically?

What about a video conference where all the people are augmented in 3D right in front of you and stay in a fixed position as you move your head and walk around them?

How about floating text showing you operating instructions for any object that you are looking at?

Or picture an office of the future where there are no monitors because all employees are wearing augmented virtual reality headsets that gee a 360 sphere of display space, accessible by just turning their heads, whilst interacting with virtual objects using virtual hands!

People have talked about this kind of stuff for a while, but I think we are finally on the brink of making all of this a really, given the new up-and-coming, and more importantly affordable, consumer tech.

But before we start, does anyone remember Second Life? It was the popular VR service launched in 2003, that's right, same year as LinkedIn and before Facebook (2004) and Twitter (2006). For a while it was the in-thing to do, and companies like IBM were hosting virtual conferences in Second Life, whilst ordinary people were converting "real" money into a virtual Linden dollar currency to buy virtual real estate, way before Bitcoin started in 2009.

Users in Second Life are able to not only explore the world, but also text chat or talk to each other using voice if they are near each other in the virtual world - an elegant alternative to SIP, XMPP and IRC. Not a fully fledged social network or a unified communications solution, but close.

Second Life is still going, but the hype is gone. I tried it back in 2005, with the pre-conception that most people using it would be looking for an escape from their first life, so it would not be for me, as I was, and still am, in a pretty happy place in the real world. Many of the stereotypes did play out, but I did like the ability to explore new worlds i.e. cyber-turism, and that kept me entertained for a few hours.

Why did I stop using it? Well, I had no use for it - I did not need escapism, cyber-toursim kept my attention only for a short period, and I much preferred to meet people physically when possible rather than attend a virtual business conference - idea of walking to a virtual auditorium to view a presentation seemed crazy, when I could just open it in PowerPoint and not waste time walking to a virtual space.

Then came Facebook and Twitter, which also provided alternative to email, phone or text chat online communication channels, but with much lower activation energy requirements than Second Life. Being social media, they also provide pub-sub model of communication i.e. stream of personalised news just for you, rather than just point-to-point or group blast communications.

Final nail in the coffin for Second Life was widespread adoption of mobility, which lowered the activation energy for Facebook and Twitter usage even futher, making them ubiquitius, and froze out Second Life which would not run on less powerful mobile devices, or look good on a small screen.

So, why am I mentioning Second Life after all this time? That's because there is a whole wave of new technology coming onboard that I think can breathe a new lease of life into Virtual Reality beyond gaming, and make Second Life like platforms useful again.

A lot of people would have heard of Google Glass, Google's take on augmented reality. A very exciting technology, that provides a heads-up display (HUD) for you in everyday life. Whether people like me, who do not like wearing glasses, will take it up, is another question, but having an ever present digital assistant is a attractive proposition nonetheless.

The idea of a genuinely useful digital assistant today is also a far greater reality than back in 2005, chiefly because much more of our lives are now digital, and with the availability of big data, semantic modelling and reasoning, machine learning, and natural language processing (NLP) technologies, it is now possible for computers to be much more intelligent at a fraction of the previous cost.

IBM's Watson and Apple's Siri are great examples of what can be achieved when you combine these technologies together. Or take a look at wise.io for machine learning, wit.ai for natural language processing and Ontorion for semantic modelling and reasoning.

Augmented reality however is additive, not immersive, unlike virtual reality - this means that there is a limit to the experience, unlike VR. Also, presently Google Glass does not support head tracking, so your experience is not updated based on your head position changes, again limiting interaction.

VR headsets, which include a head mounted display with head tracking have been around for a while, but are generally very expensive. For example, Vuzix SAT 1200XLD glasses are a snip at 5000 USD, however they combine virtual and augmented reality. But, Oculus Rift, a VR only headset, is about to change all of it. A developer kit version is only 300 USD, so I assume a consumer version will be cheaper still.

I got hold of one, and have played with it for a few days. Rift comes with some pretty impressive demo applications, but the demo virtual universe is pretty limited. So, that's when I remembered Second Life and searched for any options to view SL with Rift. Lucky for me, some people have already created an alternative to SL's native player called CtrlAltStudioViewer. Good news, it also works with OpenSim worlds.

The experience is pretty awesome. You get a truly immersive experience, way beyond what you get on a 2D screen. That said, I do have a few issues with Rift, chiefly, it makes me feel a bit queazy when moving about. I think that is down to a combination of refresh rate and pixel resolution. It's not that either are that bad, but because experience is so close to reality, anything that isn't 100% really effects you.

I discovered that refresh rate becomes far more important in VR than in 2D, since you are much more likely to move your head a lot more often and more quickly than using a 2D screen. You need a fast PC and the VR server must be able to keep up too. Resolution is also still too grainy on Rift, as I can see the pixels in the current version.

There is a another very exciting augmented / virtual reality product coming out September 2014, that's CastAR. Take a look at it's Kickstarter page.

The other niggle I had was using a keyboard to interact with the virtual world, frankly it sucked. A while ago I got Leap Motion. It is a little USB attached device that tracks your hands, I guess inspired by Kinnect. So, I thought about using it with the Rift and Second Life.

I decided to look at Rift because it is well suited for a office desktop environment i.e. hands only. If you wanted to do full body tracking, then Kinnect is very good. If you actually wanted to walk around in the VR space, then take a look at Omni.

Like Rift, Leap is a pretty awesome gadget for just 80 USD. It has a lot of promise, however my original use case was to turn any display into a 3D touch display, which it kind of does, but accuracy IMO is still not really good enough to easily allow me to interact with the PC desktop.

However, unlike the 2D use cases, demo apps for Leap designed to manipulate 3D objects and recognise gestures felt a lot more natural in my experiments, so I figured using Leap Motion with Rift and Second Life would be a good fit.

Again, doing a quick search, lead me to this blog. Take a look at the video - damn impressive, however Leap Motion is used to map gestures and hand movement to controls, not display virtual hands. However, a separate project - Flight 0.1 does just this, take a look! It would be great if someone combined the two - hint, hint :).

It's worth mentioning that Leap Motion and Kinnect are not alone. There is Razer Hydra, AirStrike, 3Gear, PMD, Stem and Myo. Myo takes a different approach, and uses a bracelet instead of cameras to track movement.

There are a couple of other technologies that I think should be considered. One is around identity - making sure that you are who you say you are - passwords just do not feel conducive enough to an immersive experience, or frankly secure enough any more.

Take a look at Nymi. It uses a bracelet with a hardware based secure element, heart beat monitor and gesture recognisers to identify you and control other systems over BLE. Waiting for that one to arrive! Imagine if your digital assistance knew if you are agitated by checking your heart rate and tried to calm you down! If you had enough of the assistance, you could just wave them away.

Next, how about knowing where you are! You first response might be - easy, just use GPS. However, what about in buildings where GPS reception is poor. For that consider micro positioning tech like Apple's iBeacon. You can place iBeacon protocol capable devices like Estimote, StickNFind, Red Bear or Bleduino in location of your choosing, and once a BLE enable device enters within the signal zone, it can pick up the beacon ID and react to it e.g. fetch a web page, update location in VR world etc.

Assuming the issues around head set refresh and resolution are sorted out, and support for 3D headsets and hand tracking is ubiquitous in VR clients and servers, then in principle, we get to a whole new paradigm of affordable VR. However, so what?

Is there an application for VR beyond gaming, and into everyday life? To answer this, I loop back to Google Glass. I love the idea of an ever present digital assistant, but the current form it takes in Google Glass is a small amount of text overlaid over real life, with no head tracking.

IMO that is not enough. Why do I say that? Let's take a real life example. I used to manage a team of great developers in Chicago and Moscow from London. To discuss next software release we used to talk about it over a conference call. However, because I could not see their expressions, it was really hard to decide if they were getting what I wanted them to do, or not.

Video conferencing at that time was either low quality like Skype, where the resolution and refresh are often too poor, so annoy me more than assist, or are too expensive e.g. Cisco TelePresence, and require too much activation energy in form of booking a video conferencing room and walking over there, versus just joining a call from the desk.

Later, we installed Lync, and it was a game changer. Do not get me wrong, there are many really good alternatives to Lync, it's just I have experience with it. The setup we ended up with is what I would call good enough - the video quality is high enough and predictable enough to really benefit from seeing facial expressions and figure out if people you are talking to are connecting with your thoughts or not. That is, small changes can sometimes make a big difference.

Same story for augmented and virtual really. On their own, I think they are OK, but not good enough IMO to make me change my working practices, at least based on the current tech, which is just not bullet proof enough. Remember Apple's MessagePad? Probably not, it was just not good enough for mass consumption! Remember iPad? I bet you do, much the same idea, but it works well enough and look at the consumer base!

So, what do I think needs to happen? Easy to imagine, hard to implement - for the physical aspect, I want a combined augmented virtual reality a.k.a. mixed reality headset, with GPS and iBeacon location tracking, and some form of hand tracking, either using normal cameras (which Google Glass already tries to do) and/or infrared cameras (Leap Motion).

Also I would like to combine Nymi with Myo, to get both identity and enhanced hand movement tracking. Finally, both the AVR headset and identity/tracking bracelet to talk to my smartphone over BLE or like, so that I can be mobile.

On the software side, I think you need to combine chat, voice, video and email with social media but modify it for augmented virtual reality. Second Life already has voice and text chat, so why not take a feed of events from social media (or allow people to follow events created in something like Second Life), present them in virtual space (beaming) and allow people to meet instantly if interested, but instead of Skype call, just superimpose (augment) a live 3D video of the person.

Alternatively, some people are experimenting with bringing the traditional desktop to VR environment, see Ibex. Looks cool, but I do not see how this actually adds to my productivity.

Once this kit and software combo is ready and works every time, than all the use cases I talked about are right round the corner! Can't wait!

Install IPSec VPN for iOS on Rackspace -1

2012-09-03T09:52:00.003-07:00

I wanted to set-up an IPSec VPN server to connect my iOS devices to an private network. iOS now supports VPN on Demand (triggers VPN when a specific DNS entry is accessed) using Cisco IPSec (which StrongSwan supports) with multi-factor authentication (client X509 certificate and XAUTH username + password) of the box.

I first tried OpenSwan which comes with RHEL6 / CentOS6 but it was a nightmare to configure, so I switched to StrongSwan. Still complex to configure, but at least I got it to work. To get going I created two CentOS 6 cloud servers on Rackspace, one to act as the VPN Gateway (Private IP =10.177.192.20, Public IP=5.79.25.82), and one as the web server behind that gateway (Private IP=10.177.198.18).

Before going much further, ensure that selinux is turned off (vi /etc/selinux/config; SELINUX=disabled; reboot), most likely it is already. Now install StrongSwan:

rpm -Uvh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-7.noarch.rpm
yum install lsof man strongswan rng-tools
vi /etc/sysconfig/rngd; EXTRAOPTIONS="-r /dev/urandom";
ln -s /usr/sbin/strongswan /usr/sbin/ipsec
service rngd start
service ipsec start
chkconfig rngd on
chkconfig ipsec on

Then create the /etc/init.d/vpn script as shown below, and make sure you can execute it and run at startup:

chmod 755 /etc/init.d/vpn
service vpn start
chkconfig vpn on

Next we need to create a new Certificate Authority (CA). Create the new_ca.sh script, and run it. It will create the new CA. Now generate both the VPN server and the iPhone certificates, by first of all creating the new_peer script as included below, and then execute it:

./new_peer.sh vpngateway "5.79.25.82" vpngateway

note, IP must match the Public IP of your gateway

./new_peer.sh alexiphone "alexiphone" alexiphone

Copy the vpngateway.p12 and alexiphone.p12 files from /etc/strongswan/ipsec.d/pkcs12 to your Mac, and then include them in the Configuration Profile using iPhone Configuration Utility, see screen shots later. Export the profile, and install on iPhone (email, website etc.) If you want to get clever, use SCEP server to auto-generate this file.

The /etc/strongswan/restart.sh script:

#!/bin/sh
ipsec stop
service iptables stop
service iptables start
./iptables-nat.sh
ipsec start

The /etc/init.d/vpn script:

#!/bin/sh
# chkconfig: 2345 20 80
# description: Configures openswan specifics
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f; done
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $f; done
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -I INPUT -s 0.0.0.0/0 -d 5.79.25.82 -p udp --dport 500 -j ACCEPT
iptables -I OUTPUT -s 5.79.25.82 -d 0.0.0.0/0 -p udp --dport 500 -j ACCEPT
iptables -I INPUT -s 0.0.0.0/0 -d 5.79.25.82 -p udp --dport 4500 -j ACCEPT
iptables -I OUTPUT -s 5.79.25.82 -d 0.0.0.0/0 -p udp --dport 4500 -j ACCEPT
iptables -I INPUT -s 0.0.0.0/0 -d 5.79.25.82 -p 50 -j ACCEPT
iptables -I OUTPUT -s 5.79.25.82 -d 0.0.0.0/0 -p 50 -j ACCEPT
iptables -t nat -I POSTROUTING -s 10.177.192.0/18 -d \! 10.177.253.0/24 -o eth1 -j MASQUERADE
iptables -t mangle -A PREROUTING -i eth0 -p esp -j MARK --set-mark 1
iptables -I FORWARD -i eth0 -o eth1 -m mark --mark 1 -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -i eth0 -m mark --mark 1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 80 -j DROP

The /etc/strongswan/new_ca.sh script:

#!/bin/sh
cd /etc/strongswan
mkdir -p ipsec.d
cd ipsec.d
mkdir -p cacerts certs private pkcs12
strongswan pki --gen > private/caKey.der
openssl rsa -inform DER -outform PEM -in private/caKey.der -out private/caKey.pem
strongswan pki --self --in private/caKey.der --dn "C=UK, O=Netdata CN=Netdata CA" > cacerts/caCert.der
openssl x509 -inform DER -outform PEM -in cacerts/caCert.der -out cacerts/caCert.pem

The /etc/strongswan/new_peer.sh script:

#!/bin/sh
# 1=key name 2=cert cn 3=p12 name
cd /etc/strongswan/ipsec.d
echo "Generating key"
strongswan pki --gen > private/${1}Key.der
openssl rsa -inform DER -outform PEM -in private/${1}Key.der -out private/${1}Key.pem
echo "Generating certificate"
strongswan pki --pub --in private/${1}Key.der | strongswan pki --issue --cacert cacerts/caCert.der --cakey private/caKey.der --dn "C=UK, O=Netdata, CN=${2}" > certs/${1}Cert.der
openssl x509 -inform DER -outform PEM -in certs/${1}Cert.der -out certs/${1}Cert.pem
echo "Generating pkcs12 file"
cat private/${1}Key.pem certs/${1}Cert.pem cacerts/caCert.pem | openssl pkcs12 -export -name "${3}" -out pkcs12/${1}.p12

The /etc/strongswan/strongswan.conf file:

# strongswan.conf - strongSwan configuration file
charon {
# dnsl = 192.168.0.1
# number of worker threads in charon
threads = 16
# send strongswan vendor ID?
# send_vendor_id = yes
plugins {
   sql {
   # loglevel to log into sql database
   loglevel = -1
   # URI to the database
   # database = sqlite:///path/to/file.db
   # database = mysql://user:password@localhost/database
   }
}
# ...
}
pluto {
}
libstrongswan {
# set to no, the DH exponent size is optimized
# dh_exponent_ansi_x9_42 = no
}

The /etc/strongswan/ipsec.secrets file:

: RSA vpngatewayKey.der
alex : XAUTH "alex"

The /etc/strongswan/ipsec.conf file:

config setup
interfaces=%defaultroute
plutostart=yes
nat_traversal=yes
conn rw
left=%defaultroute
leftcert=vpngatewayCert.der
leftid="C=UK, O=Netdata, CN=5.79.25.82"
leftsubnet=0.0.0.0/0
leftsourceip=10.177.192.20
leftfirewall=yes
right=%any
rightid="C=UK, O=Netdata, CN=*"
rightsourceip=10.177.253.0/24
keyexchange=ikev1
authby=xauthrsasig
xauth=server
pfs=no
auto=add

iPhone Configuration Utility screen shots:

Including multiple incompatible library versions on iOS

2012-06-08T03:06:00.000-07:00

There will be times when you need to include different often incompatible versions of the same library in your project e.g. you may be using two different vendor SDKs, and both of them include OpenSSL libraries, but different versions.

Both rely on THEIR version of OpenSSL, so your application will crash if you only link in one version of OpenSSL. However you cannot link to two different versions of a lib*.a file. There is however a solution.

To begin, you need to determine if your libraries contain multiple architecture objects i.e. fat files. Run the lipo command to find out:

> lipo -info lib1.a

Lipo command will list all of the included architectures. We will assume for this blog that we are dealing with a fat file. Next, you need to "flatten" the libraries provided by the vendor. For example, we may have three vendor supplied libraries : libcrypto.a, lib1.a and lib2.a.

The libcrypto.a (bundled lib by the vendor, not written by them) OpenSSL library is the offender, so what we want to do is link it into lib1.a and lib2.a (vendor written libraries) and ensure that it's symbols are not exported (but vendor written libs exported symbols are also exported in the new object), thus creating a single file with no external symbol dependencies a.k.a dependency closure.

We can "flatten" these libraries into single object file by using the LD command, but first we need to generate a list of exported symbols. To do so we use the NM command:

> nm -g -arch armv6 $(ls *.a | grep -v libcrypto.a) | grep ' _' | grep -v ' U _' | sed 's/^.* _/_/' > libsuper-armv6.symbols

The above command gets all the exported (-g) symbols for armv6 architecture for all but libcrypto.a libraries in the current directory, stripping out all non-symbol text (grep ' _'), all undefined symbols (grep -v ' U _') and finally stripping all but the symbol name from a line (sed 's/^.* _/_/').

Output of that command is saved in the libsuper-armv6.symbols file. We would need to run the same command but change the arch value based on all bundled architectures e,g. armv7 and i386. Now we are ready to flatten the libs into a single object, we do so using LD:

> ld *.a -arch armv6 -r -exported_symbols_list libsuper-armv6.symbols -o libsuper-armv6.o

Above command will link all *.a libraries in the current directory and ensure that only the specified symbols are exported, with the output saved as a libsuper-armv6.o file. In this case libcrypto.a symbols are local, but lib1.a and lib2.a are exported, which creates the required dependency closure.

This will then allow you to wrap a different version of libcrypto.a into other vendor's libraries and avoid clashes. Repeat the command above for other architectures.

Finally, recombine the object files for different architectures into a single fat file using LIPO, and include this object into the Xcode project instead of the original vendor supplied libraries:

> lipo -create libsuper-armv6.o libsuper-armv7.o libsuper-i386.o -output libsuper.o

Job done!

Spark and OpenFire External SASL Authentication with X.509 Certificates

2012-03-29T10:38:00.003-07:00

Introduction

The instant messaging and presence XMPP protocol uses SSL to encrypt data in transport, and SASL as the chosen authentication frameworks. SASL supports a range of mechanisms e.g. PLAIN, OTP, EXTERNAL.

Most common method is to use PLAIN i.e. send username and password over SSL connection, and let the server look up user either against it's own user database, or access an external identity provider like an LDAP server, be that OpenLDAP or MicroSoft Active Directory Directory Services (AD).

In some circumstances, you may want to have a stronger form of security. This is where the EXTERNAL SASL mechanism comes in handy. It takes on the context's implicit identity i.e. using SSL connection's X.509 PKI certificates.

Websites supporting HTTPS use them all the time, however majority of the time the focus is on the server certificates to validate their authenticity, whilst user credentials are passed using login forms. It is also possible to issue user certificates that authenticate user's identity, as long as they are signed by a mutually trusted by the client and server certificate authority (CA).

User's identity a.k.a. user name is embedded in the certificate, which is then signed by a trusted on the client CA. When an XMPP SSL connection is being established, that certificate is passed back to the server, and since the server also trusts the same CA as the client, the certificate is read and the user name is extracted. No further identification is then required e.g. sending user name and password back to LDAP.

In order to demonstrate how such a configuration can work in a real life scenario, let's create the following environment:

Install OpenFire XMPP server on a CentOS 6 Linux server with a PostgreSQL database.
Install Spark instant messaging client on a Mac - it's Java based so really any system will do.

The next steps require some knowledge of cryptographic tools like OpenSSL (assume that the openssl package is installed on the same server as the OpenFire package) and Java's keytool:

Set-up a Certificate Authority
Configure Spark and Openfire to trust new CA
Configure OpenFire to use EXTERNAL SASL
Configure Spark to use new signed user certificate
Login with Spark using new certificate

Set-up a Certificate Authority

First of all create the CA environment on the Linux server

mkdir /opt/exampleca
cd /opt/exampleca
mkdir certs private
chmod g-rwx,o-rwx private
echo '01' > serial
touch index.txt
vi openssl.conf

[ ca ]
default_ca = exampleca
[ netdataca ]
dir = /opt/exampleca
certificate = $dir/cacert.pem
database = $dir/index.txt
new_certs_dir = $dir/certs
private_key = $dir/private/cakey.pem
serial = $dir/serial
default_crl_days = 7
default_days = 365
default_md = md5
policy = exampleca_policy
x509_extensions = certificate_extensions
[ exampleca_policy ]
commonName = supplied
stateOrProvinceName = supplied
countryName = supplied
emailAddress = optional
organizationName = supplied
organizationalUnitName = optional
[ certificate_extensions ]
basicConstraints = CA:false
[ req ]
default_bits = 2048
default_keyfile = /opt/netdataca/private/cakey.pem
default_md = md5
prompt = no
distinguished_name = root_ca_distinguished_name
x509_extensions = root_ca_extensions
[ root_ca_distinguished_name ]
commonName = Netdata CA
stateOrProvinceName = England
countryName = UK
emailAddress = ca@netdata.me
organizationName = Root Certificate Authority
[ certificate_extensions ]
basicConstraints = CA:false
[ req ]
default_bits = 2048
default_keyfile = /opt/exampleca/private/cakey.pem
default_md = md5
prompt = no
distinguished_name = root_ca_distinguished_name
x509_extensions = root_ca_extensions
[ root_ca_distinguished_name ]
commonName = Example CA
stateOrProvinceName = England
countryName = UK
emailAddress = ca@example.com
organizationName = Root Certificate Authority
[ root_ca_extensions ]
basicConstraints = CA:true

export OPENSSL_CONF=/opt/exampleca/openssl.conf
openssl req -x509 -newkey rsa -out cacert.pem -outform PEM

The cacert.pem file is the public CA certificate.

Configure Spark and OpenFire to trust new CA

Since both Spark and OpenFire are Java based products, we can use keytool utility for both. Before you begin, make sure that you have copied the cacert.pem file where you can access it, be that on the Spark client or OpenFire server host.

For Spark, we assume that we use the default for your JRE paths, so open the terminal and:

keytool -import -alias exampleca -file cacert.pem

For OpenFire, make sure your import the certificate into the default location

keytool -import -alias exampleca -file /opt/exampleca/cacert.pem -keystore /opt/openfire/resources/security/client.truststore

Remember the password you set for the client.truststore, you will need when configuring OpenFire.

Configure OpenFire to use EXTERNAL SASL

First, set the following OpenFire server properties using the Web UI:

xmpp.client.tls.policy

xmpp.client.cert.policy : needed

xmpp.client.certificate.crl : path to CRLs in a single file in PEM format.

xmpp.client.certificate.accept-selfsigned : true

xmpp.client.certificate.verify : true

xmpp.client.certificate.verify.chain : true

xmpp.client.certificate.verify.root : true

xmpp.client.certificate.verify.validity : true

xmpp.client.certificate.accept-selfsigned : true

xmpp.socket.ssl.client.truststore : set only if you don't want the default

xmpp.socket.ssl.client.trustpass : <pass_for_client.truststore>

sasl.mechs : EXTERNAL (or EXTERNAL,PLAIN,etc.

Also consider setting these values:

xmpp.client.compression.policy : disabled
xmpp.auth.anonymous : true
xmpp.server.certificate.accept-selfsigned : true
xmpp.server.compression.policy : disabled
xmpp.server.dialback.enabled : false
xmpp.server.tls.enabled : true
xmpp.socket.ssl.active : true

Restart OpenFire server.

Configure Spark to use new signed user certificate

First of all we need to create a new user in OpenFire. When creating the user, select whatever password you want, this is not going to be used anyway. Make sure that whatever user id you create, matches the CN in the user certificate you are about to create.

On the Sprak client, create a new key and generate a new certificate request.

keytool -genkey -alias <userid>
keytool -certreq -alias <userid> -file <userid>req.pem

Copy the certificate request to the CA server (in our example OpenFire server) and sign it.

openssl ca -in <userid>req.pem

The output from the command above will display the certificate,save it to a file called <userid>cert.pem. Copy it to the Spark client host, and import it.

keytool -import -alias <userid> -file <userid>cert.pem

Login with Spark using new certificate

The final step. Start up Spark, but before you login, click on the Advanced button.

Click on the PKI tab
Tick the "Use PKI authentication" option
Select "Java Keystore" as the PKI method
Enter "/User/<username>/.keystore for both Keystore and Truststore locations (assuming you used defaults)
Enter the trust store password on the Spark client you set when you first started to generate keys and import certificates.
Close the Advanced dialog

On the login screen:

Enter your <userid> as the username, remember this must match the CN value in the certificate, and the OpenFire user name exactly.
Instead of putting in the OpenFire account password, enter the truststore password which you used when you started importing CA and user certificates.

Note, I have only tested the use case where the truststore password is same as the certificate key password. They can be different, so I suspect you would need to put in the certificate key password here.

Note, when I imported two different user certificates, the login process stopped working, suspect this is a bug.

Enable SSL debugging on OpenFire

In some cases, you may need to see debug output from the SSL engine. To do so, modify the openfire.sh script by adding this line:

OPENFIRE_OPTS="${OPENFIRE_OPTS} -Djavax.net.debug=all"

Patch Openfire to support mixed-case with spaces certificates

By default Openfire will not let you create a user account in the embedded database using mixed-case. It converts everything to low case. However when it performs certificate based authentication, it will not convert the Common Name to lowercase, so your certificate will fail to authorise. If CN contains spaces, then those are not escaped either, which is what is required by Openfire.

To fix this, you need to modify the ../net/SASLAuthentication.java file to include this line:

private static Status doExternalAuthentication(LocalSession session, Element doc)

            throws UnsupportedEncodingException {

...

// new bit start

username = username.toLowerCase().replace(" ", "\\20");
principal = principal.toLowerCase().replace(" ", "\\20");

// new bit stop

if (AuthorizationManager.authorize(username,principal)) {
Log.debug("SASLAuthentication: "+principal+" authorized to "+username);
authenticationSuccessful(session, username, null);
return Status.authenticated;
}
} else {

Log.debug("SASLAuthentication: unknown session type. Cannot perform EXTERNAL authentication");

}
authenticationFailed(session);
return Status.failed;
}

Smart Communications Concept Pitch

2012-02-08T08:28:00.000-08:00

In order to compete effectively, companies must become increasingly agile. Agility in this context is defined as ability to respond in "real time enough fashion" to situations that impact the health and well being of the enterprise and its stakeholders.

Smart Communications (SC) builds on Unified Communications (UC) to deeply integrate social and collaborative communication techniques using open, distributed, federated, plug-and-play standards which are able to cope with consumerisation, mobilisation, platform diversification and enterprise BYOD mega trends; whilst at the same time can track, respond and gain humanely impossible insights from huge amounts of information generated by federated communications systems and processed by big data analytics.

Communication is perceived as a key component in improving agility, so to that end I have been looking at Unified Communications (UC) tools strategy as an agility enabler. Aside agility, other benefits are often associated with a successful communication solutions:

direct cost savings

VoIP cheaper than roaming
social support communities reduce need for support staff
teleworking can reduce primary and BCP real estate costs

improve employee and business process productivity

do more with same, and in some cases less

enhance employee retention

better work-life balance using teleworking
leads to improved job satisfaction without increased spend

improve customer retention and gain new ones

customers will switch unless you provide mobile solutions
as it fits with their changing lifestyles
be proactive in responding to their social posts
they value and recommend an organisation that listens and responds

UC tools are often mentioned alongside collaboration, social media and social networking tools, so I wanted to understand how these fit together. It struck me at first reading, that I was having trouble distinguishing these various categories of tools, as there is a lot of functional overlap. In the end, I defined the following mental model:

collaboration, social media and social networking are all use cases which rely on communication.
social media and social networking are primarily intended to create and maintain community communication by stimulating dialog, with or without a specific goal in mind.
collaboration is about working together to achieve a goal; it relies on communities discussing how a goal is to be met and delivering a product that achieves that goal.
you can communicate without being social or collaborating e.g. static website or blog.

Armed with that mental model, I re-visited the contemporary definition of UC: integration of real-time with non-real-time communication services; UC is not a single product, but a set of products that provides a consistent unified user interface and user experience across multiple devices and media types.

Instant messaging (chat), presence information, telephony (including IP telephony), video conferencing, data sharing (including web connected electronic whiteboards), call control and speech recognition are examples of real-time UC services.
Voicemail, e-mail, SMS and fax, also known as unified messaging, are representatives of the non-real-time UC services. Blogs, discussion groups, bulletin boards, internet forums can also be included, but are less often cited as examples.

As such, UC's broad definition does cover communication techniques required to support collaboration, social networking and social media; but at the time the term was coined, collaboration and social use cases were not commonly included in UC examples.

Audio conferencing, video conferencing, telepresence, web conferencing with document and desktop sharing and co-editing capabilities are all examples of collaboration services.
YouTube is a good examples of a social media service - set of tools to share and discuss something with a broad audience i.e. web-based and mobile technologies used to turn communication into interactive dialogue.
LinkedIn can be classed as a social networking service; it facilitates the action of networking with a community of people.

Google+ (with it's Google+ Messenger), Facebook (with IM support) and Twitter (with Direct Messages) are all examples of tools that straddle UC, collaboration, social media and social networking worlds, as they operate both at network and public levels.

As great as these types of services are, they are often not much more than suite of tools brought under a single UI. Making a VoIP call, IM chatting or sending someone an email does not add an event to one's activity stream, therefore missing out social graph discovery opportunities, and even if that does happen under the hood, it is not exposed to the user's community.

In addition, these services are largely silo, proprietary solutions, unlike the established UC solutions e.g. STMP and XMPP, which are open and distributed. Many vendors initially interpreted UC as integration of communication techniques as long as they were provided by that vendor alone, however eventually a more open, distributed, standards based, pick-and-mix model prevailed.

There are other mega trends which impact on UC: consumerisation, mobilisation; platform diversification and drive for BYOD in the enterprise. At this point there is no consistent approach to dealing with all these aspects across the full range of UC communication techniques.

There is one other mega trend that opens up a massive opportunity in the communications field, if applied successfully. IBM calls it Smarter Planet : instrumented, interconnected and intelligent. UC is already by and large instrumented and interconnected, but it is not intelligent.

Today we rely on human beings to turn UC information into insights. Humans are pretty good at doing this up to a certain scale, but are latency and bandwidth limited to cope with huge volumes of data generated by UC systems. Distributed human activity also has a finite scale out for certain types of problems.

Until recently, even computer systems struggled to cope quickly enough with petabyte sized data pools, even if the huge cost of running such systems could be afforded. MapReduce frameworks like Hadoop significantly reduce the cost of both compute and storage capabilities, whilst at the same time provide almost limitless scale out.

Ability to process huge amounts of data, coupled with advanced analytics, open new opportunities for business optimisation by enabling rapid, informed and confident decisions and actions, not possible if humans alone are doing that work e.g. by using big data analytics over distributed systems, we can monitor topic sentiment and respond with speed and accuracy that would be impossible without automation.

As I finished this mental journey, it dawned on me that if we are to meet all these new emerging needs and opportunities, we need something that is much more than UC, as it is understood today. So in it time honoured tradition, I made up a new term - Smart Communications, to try and clearly differentiate it from today's Unified Communications, itself an evolution of Unified Messaging.

The need for differentiation is down to the transformational nature of changes required to meet new challenges, which were not as urgent when UC was first coined, and will fail to be addressed by sticky tape:

Extend contemporary UC to deeply integrate with social media, social networking and collaborative communication techniques using open, distributed, interoperable, plug-and-play standards.
Evolve tools to cope with consumerisation, mobilisation, platform diversification and enterprise BYOD mega trends.
Track, respond and gain humanely impossible insights from huge amounts of information generated by federated communications systems and processed by big data analytics.

So Smart Communications is a term that represents a concept, implemented by a bunch of mashed-up tools.

Smart Communications 0.1 Specification

2012-02-06T12:02:00.000-08:00

Abstract

Smart Communications (SC), as a concept, builds on Unified Communications (UC) to deeply integrate social and collaborative communication techniques using open, distributed, federated, plug-and-play standards which are able to cope with consumerisation, mobilisation, platform diversification and enterprise BYOD mega trends; whilst at the same time can track, respond and gain humanely impossible insights from huge amounts of information generated by federated communications systems and processed by big data analytics.

Smart Communications, as a specification, applies a group of related protocols (OStatus, XMPP etc.) to define Smart Communications standards to meet it's goals.

Motivation

Integrating social networking and social media platforms gives us an opportunity to unlock social silos and get much better idea of a person's true social graph and the content they post across the internet, allowing exponential growth in ability to connect, recommend, comment and reply.

That's not enough to give us the true social picture. Vast majority of communication is still done via voice, IM, email, web conferencing etc, so all that social data is missing. To capture all that communication you must integrate social, real-time and non-real-time communication services as per the diagram above.

But there is one other piece to this puzzle. Having enabled individuals to connect and work together better and faster than ever, we are still at the mercy of individuals to make the right connections, observe and react to events, make the necessary joins and turn data into information.

Individuals are superb computational beings, and for their network, they have proven time and time again to be masters of data manipulation. What individuals are not great at, is analysis of huge amounts of data, quickly and consistently.

Traditional RDBMS solutions are great for large data sets of structured data. However they start to struggle when processing data ranges of terabytes and beyond. Relational databases are being scaled out (VLDB), but often at a huge expense.

Also, by it's very nature, communication data is semi-structured or just plain old unstructured. By forcing it into some sort of structure, you are in danger of either losing data (if aggregated and stored in a data warehouse) or stored in a way that makes asking new questions difficult.

Big Data solutions like Hadoop change that. They allow cheap massive storage using HDFS, and ability to run MapReduce jobs on that data on an almost infinite number of compute resources. This way you can create a Hadoop grid using cheap commodity hardware.

Since MapReduce always scans the entire data set (RDBMS full table scan), you can transform data on the fly every time. Using different regex's, you can scan the same data set, but ask all sorts of different questions, unlike with relational fixed schema databases. And since storage and compute are cheap, you can store a lot more data with aggregation.

On the fly data transformation become even more powerful when coupled with with natural language processing (NLP) to extract structured data out of unstructured content. The final piece is to apply content analytics and more traditional business intelligence tools to captured and extracted data to deduce solution to business problems e.g. are people duplicating effort, sentiment trading, what are the major bottom-up projects etc.

This kind of analyse is already possible by social networking fire hose feeds. However that data is limited to interactions on that specific social site.

Background

Each of the more established UC categories has it's own set of standards. XMPP, IRC and SIMPLE are just three of the instant messaging and presence standards. RTP, RTCP and SIP are complimentary and commonly used protocols for voice and video transmission, both point to point and conferencing. SMTP, POP and IMAP are best known email standards.

Social media and social networking systems are less mature, and are largely based on proprietary implementations. Much of the glue between those systems is based on RSS and Atom feeds. Standards like OStatus are emerging, but have low take up at this point. OStatus lets people on different social networks follow each other using HTTP based standards. It applies a group of related protocols: PubSubHubbub, ActivityStreams, Salmon, Portable Contacts, and Webfinger.

Interestingly, instant messaging standards like XMPP have also defined publish-subscribe and personal event extensions which define semantics for using the XMPP publish-subscribe protocol to broadcast state change events associated with an instant messaging and presence account. In other words, it's way for an XMPP user to send updates or "events" to other users, who are typically contacts in the user's roster.

In fact, XMPP is designed with extensions in mind. It defines a concept called gateways - service on the XMPP network that translates between the XMPP protocols and the protocol used by another service e.g. IRC, SMS, Email etc. Social media and social networking were not on the radar when gateways were first designed, but they are flexible enough to adapt.

Architecture

Concepts

Two key standards are relied upon: XMPP (with publish-subscribe and personal event extensions) and OStatus. XMPP's inbuilt extensibility via gateways is used as the glue. Hadoop is the chosen framework for big data analytics.

XMPP and OStatus gateway provides a deep integration between real-time and social communication services.
Email, SMS, voice mail and other unified messaging gateways bring the entire stack together.
Firehosing all the generated information via a BigData gateway to HDFS and running analytics MapReduce jobs on captured data allows humanely impossible tracking, response and insights.

XMPP for Social Media

2012-02-06T08:56:00.000-08:00

The Extensible Messaging and Presence Protocol (XMPP) is an open technology for real-time communication, which powers a wide range of applications including instant messaging, presence, multi-party chat, voice and video calls, collaboration, lightweight middleware, content syndication, and generalized routing of XML data.

XMPP is designed with extensions in mind. One such extension is the XMPP Personal Eventing Model, itself based on the XMP Publish-Subscribe extension. This specification defines semantics for using the XMPP publish-subscribe protocol to broadcast state change events associated with an instant messaging and presence account. This profile of pubsub therefore enables a standard XMPP user account to function as a virtual pubsub service, easing the discovery of syndicated data and event notifications associated with such an account.

In other words, it's way for an XMPP user to send updates or "events" to other users, who are typically contacts in the user's roster. An event can be anything that a user wants to make known to other people, such as those described in User Geolocation, User Mood, User Activity, and User Tune.

By creating an XMPP gateway to social media tools (e.g. Twitter, Facebook) via interfaces like OStatus, it's both possible now to syndicate social events for social media tools to messaging tools like IM, and vice-versa.

XMPP, IRC and SIMPLE

2012-02-06T08:38:00.000-08:00

In this blog I wanted to compare and contrast competing near real time IM protocols, and suggest integration routes : XMPP, IRC and SIMPLE.

Whilst XMPP evolved from Jabber as first of all a person to person protocol, IRC, an much earlier protocol was designed primarily for group chat. Both however have extended themselves to cover both group and person to person chat use cases. SIMPLE protocol is an extension of the SIP protocol, which originated from voice and video world, but was also extended to support IM. For details, see this Wikipedia comparison.

A nice feature of XMPP, is that it was designed with interop in mind - the standard defined gateways from XMPP to other protocols, both messaging such as AMPQ and JMS, as well as fire and forget ones like email and SMS.

XMPP has a number of defined standards that interop with voice and video (Jingle extension to XMPP relying on SIP connections). By adding IRC and SIMPLE gateways, you are now able to consolidate a whole host of messing platforms. If you wanted to bring in machine events, you could provide an SNMP and syslog gateways.

OStatus explained

2012-02-06T08:26:00.000-08:00

Another week and yet another social site. We are asked to network, but only within the confines of a specific website. Companies are creating their own closed social sites. They try to open them up to partners, but guess what? They have their own. Which one to use? Nightmare.

A number of projects are trying to cover this gap, such as Diaspora and StatusNet. They are part of the distributed social network movement, trying to break the grip of public sites like Twitter, Facebook, LinkIn and team centric tools like Chatter, Yammer and Jive. Note, these system often do offer some cross-posting, but no advanced features like following people across platforms.

One of the standards I have been able to understand, is OStatus, so I will try and explain it here. Just for sake of honesty, parts of the text to follow is copy/paste from the OStatus website. OStatus lets people on different social networks follow each other. It applies a group of related protocols (PubSubHubbub, ActivityStreams, Salmon, Portable Contacts, and Webfinger) to this problem in a simple and obvious way.

OStatus is a minimal specification for distributed status updates or microblogging. Many social applications can be modelled with status updates, however. Practically any software that generates RSS or Atom feeds could be OStatus-enabled. Travel networks, event invitation systems, wikis, photo-sharing systems, social news sites, social music sites, podcasting servers, blogs, version control systems, and general purpose social networks would all be candidates for OStatus use.

So let's start with Atom feeds. The name Atom applies to a pair of related standards. The Atom Syndication Format is an XML language used for web feeds, while the Atom Publishing Protocol (AtomPub or APP) is a simple HTTP-based protocol for creating and updating web resources. In fact AtomPub is considered to be the canonical RESTful protocol.

Application can generate Atom feeds based on any number of criteria e.g. system events, new database entries, new messages. Blogging sites can generate atom feeds of a user's blog posts. Those posts could have been generated using proprietary clients and stored in a database, and then exposed as Atom feeds, or they may support REST clients, so a user can add/update/delete blog entries using a RESTful client via AtomPub protocol.

ActivityStreams feed standard is based on Atom, and extends it to define a collection of activities. This way any client that understands this specific dialect of Atom can interoperate with any server that also support its. Typical updates in the feed would be represented in the default Activity Schema, another Atom standard, this time for items in the feed, not the feed itself.

Activities such as user posting a new blog or note, someone replying to it to start a discussion, or just marking it as liked or sharing it with other users, all generate new activity entries in a feed. Typically these postings would be done via AtomPub, but they may have been captured by other means e.g. SMTP or XMPP traps.

Since Atom (and RSS) feeds have been around, many tools have been created to read them e.g. desktop tools like RSS Bandit, MS Outlook; and web tools like Google Reader. Most of them rely on polling (fetch feed every 30 mins) to get new items. It's a working model, but in the new fast paced world we live in, can be too slow. So OStatus uses the PubSubHubbub protocol to ensure that as soon as a new activity has been published, a subscriber is notified of this event and can view the new entry in near real time.

Social networking / media sites like Twitter do this already i.e. as soon as someone posts something, all those people that subscribe to those posts see it in near real time. Great if your entire system is based on a single tool, PubSubHubbub allows you to syndicate these posts to as many subscribers in any compatible system as you want.

The other innovation introduced by Social tools is the ability to reply, share, comment and like posts. This is a great way to start a conversation. Most sites though keep all those social conversations locked within that tool. Use of the Salmon protocol, piggy backed off the PubSubHubbub protocol, ensures that all those social comments and conversation in may different tools are propagated back to the original source, and then re-syndicated in their consolidated form back to the subscribers.

Let's give an example at this point. I am a blog poster, using Google's Blogger service. When I post a new blog, a new event is added to my ActivityStream. I have three subscribers. One user on Twitter, one on FaceBook and one on Google Reader. Note, Twitter and Facebook do not support OStatus at this point, so this is a fictional example. The Twitter user enjoys my post, and retwitts it. Based on that retwitt, people post a number of replies. The Facebook subscriber comments on blog entry, and their friends mark it as liked. Google Reader subscriber shares my post using +1.

It's great that all those comments were made, but as the original blogger, I have no visibility of this, nor do the users of the separate systems. Ideally all those comments and updates should be visible to everyone, no matter which tool or service they use. By using PubSubHubbub and Salmon, that's exactly what happens.

Subscriber (e.g. Twitter user) polls Publisher's feed (e.g. Blogger ActivityStream);

Feed contains a forward link to the Hub.

Subscriber POSTs subscription request to the Hub;

The request contains the endpoint URL where the Hub should POST new updates;
Hub POSTs to the endpoint URL to verify the request was authentic;
Subscriber responds with confirmation to the Hun.

New entry is posted, using AtomPub protocol, or by some other means (e.g. iPhone client to Blogger);

Publisher notifies Hub about updates by POSTing feed URLs to the Hub;
Hub pulls the feed again to find new entries;
If the Publisher does not inform the Hub, the Hub will periodically poll the Publisher's feed for new updates;

When the Hub receives new update to feed X, it POSTs the update to the Subscriber's endpoint URL;

If feed XY has multiple subscribers, the Hub sends updates to all of them. This reduces load on the Publisher.

New comment is posted on the Aggregator (e.g. Twitter);

It pushes the comment back upstreat to the Source using Salmon, based on a link contained in the feed;
Step 3 is initiated which forms a loop.

All it takes to subscribe to someone's feed, is their email address, as long as domain support the WebFinger protocol. Google supports it for all Google mail users.

At it's simplest level, WebFinger specifies that you should take an email address, extract the domain name, and download that domain's host-meta XRD file. Using LRDD templates, get user's XRD file.

<Link rel="lrdd" template="https://meta.example.org/?q={uri}" type="application/xrd+xml" />
So given {uri} = acct:foo@example.com, this yields after swizzling:
https://meta.example.org/?q=acct%3Afoo%40example.com

Extract service links e.g. blogger ActivityStreams URL from user's XRD file. Alternatively, feed links may be include in user's profile page, and discovered using Web Linking.

Social feeds architecture

2012-02-03T06:30:00.000-08:00

If you blog, most likely you want a lot of people to find and read your blog. In the good old days, blogging on a Google indexed site (Blogger) and exposing an RSS feed was good enough. Exposing your feed through FeedBurner also allows you to analyse traffic, usage etc. to help you improve your blog and possibly monetorize it.

With the rise of social media platforms like LinkedIn, Facebook and Twitter, it's important to get your message out there too, so people can discuss, comment and recommend your blog. What you don't want to do though is have to remember to cross post your blog entries manually to multiple sites.

No fear, with TwitterFeed, you can get it to scan your RSS feed (or using PubSubHubbub you can be notified of changes in near real time) and post new blog entries as Tweets.

You probably also have a personal web site. I use Google Sites. By using an RSS widget, I can display my Blogger entries on my personal site. People can also subscribe to that feed using Google Reader or such like.

Twitter can be configured to post twits to Facebook, so that's pretty handy. LinkedIn can be configured to both post status updates to Twitter, and pick up Twitter twits and display them as LinkedIn status updates.

Whilst Twitter has stopped exposing twits as RSS feeds, they do provide JavaScript snippets to display your twits. You can wrap that JavaScript into an OpenSocial widget and add it to you Google Sites personal website.

Now, when you read news stories in Google Reader from subscribed to feeds, you can share interesting stories by posting links to Twitter, which given the above set-up will post updates in Facebook, LinkedIn and display them on your personal website.

If you want to read the stories off-line on your smartphone or tablet, you can send them from you Google Reader (or an app linked to your account on iOS or Android) to Instapaper, which will cache the story when you device is internet connected and mobilise it for easy reading - strip away ads etc. If you like a story that you have on Instapaper, mark it as liked, and Instapaper can post a link to that story to Twitter.

Agile fundamentalism

2011-11-24T00:54:00.001-08:00

Went along to a meeting last night to talk about Cloud technology, and was reminded how even most pragmatic ideas are turned into fundementalist dogmatic disciplines - I am indeed talking about agile development.

Agile the agile. Agree to set the itteration duration at the beginning of each sprint to be as short as possible, but no shorter - based on the objective of the sprint, loosely sequenced by classical waterfall approach, and depended on factors such as architectual complexity (cost and time to re-architect), product maturity (need to back support), importance of time to market, criticality of the solution, complexity of new use-cases and the time and cost to build, test and deploy.

Having worked in the banking sector for over 10 years running software development and distribution engineering and development teams, I have learned the hard way that stakeholders are as hard to pin down as budget, requirements are never clear, and expectations always run way ahead of allocated resources, and change on a whim of political games.

Agile development is naturally appealing, compared to university taught waterfall and iterative style methodologies. It acknowledges the fact that we simply cannot predict with any accuracy future delivery timelines largely because any captured use cases and requirements are models of the business analysts understanding of what a customer needs, which in turn is their model of a solution they have not seen yet. Models often fall apart once tested, so we need to accept the arrow and circle semi-chaotic nature of development.

So I don't have an issue with agile, I have an issue how it is being promoted by many people i.e. all is well, we are agile. According to evangelists, over 80% project in 2012 will be agile. But what the heck does that actually mean?

This reminded me of the time I interviewed a developer whose CV had agile developer plastered all over it. We got on well, so I asked him what made him an agile developer, his answer was "because it gets me a job". I kinda agree with him, agile has become a fashion statement, all I need to do is go to an interview with my iPad that has my agile CV on it, sold!

This is a bit like the big vendors slapping enterprise in front of all their products, and repeating that mantra to scare you away from cheaper alternatives with little in a way of differentiating feature lists.

Years ago I ran an event which I invited Grady Booch to, and he talked about agile. He describe the productivity gains that can be made by an agile team composed of smart, motivated, co-located developers with active participation from their stakeholders. Hmm, I think just about any methadology will deliver a success.

Try doing it with a small team of de-motivated double-doughnut (no bonus, no pay rise) employees spread around the globe, with little time overlap, trying to manage an army of equally un-motivated out-sourcers with language and cultural differences, subject to ever decreasing budgets and complete lack of concrete requirements. See if agile will help you there :)

So what's my point? Scrap agile? No! We must get back to basics and be pragmatic. Agile banner has both XP and Scrum as the two well known tags. XP is more about engineering best practices (test driven, continuous integration etc.) and says little about project management, whilst Scrum tries to define an agile project management style.

I really like XP. I am less sure about Scrum. I like some of the principles of Scrum e.g. short time boxed iterations with clear deliverables i.e. sprints, but it really does not deal well with architecture. My interpretation is that architecture is done within each scrum (about 4 weeks), encouraging just enough architecture, to avoid over-architecture that can drive costs up and reduce delivery.

So, any new use-case may trigger a need to re-architecture your product, and you are meant to do so within a 4 week sprint. That can work for very standard 3-tier systems, but usually does not. So then sprints start to be hacked, and shippable products are downgraded to documentation. Hmm, smells like itterative and even worse, waterfall.

In my opinion, agile project management techniques (as opposed to engineering practices), are not so different to iterative, which in themselves are not that different to waterfall. People want to show how progressive they are so find all sorts of killer differences, but to me there are more similarities than differences. And, all three never are followed to the letter, because they are just models for managing projects, which have a really annoying tendency not to follow the rules that models require.

I think we need to agree that agile project management methodologies like Scrum are just short time box waterfall iterations, where everyone agrees that the only commitment we can make is that 4 week window, and even that is suspect. Each iteration is roughly equivalent to a software release, or at least that's the aim.

But as argued before, this does not always work i.e. when the product is immature, and you need to design and implement architecture, it often takes much longer to get the first shippable release out. On the other hand if the product is mature and changes are incremental, 4 week sprints are perfect. However if a new use-case requires major re-architecture, sprints timelines are broken again.

There are other variables i.e. cost of re-architecture, time to re-archirecture and risk of mis-architecture. Scrum largely relies on the fact that re-architecture is relatively cheap, and quick. Often it is not. It can take a lot of man-power (cost), and often cannot be sped up by throwing more people at it (time). And for some applications, having non-performant or reliable architecture can kill businesses and more importantly people.

What's the solution? Agile the agile. Agree that agile, iterative and waterfall are complimentary. Good waterfall practices like design before coding must not be abandoned, but instead put into the current needs context i.e. maturity of the product, architectural complexity, how different is the solution compared to existing patterns, importance of time to market, criticality of the solution, complexity of new use-cases.

Before you start any sprint/iteration/phase, agree the primary focus of the time box, loosely based on the waterfall sequence. Decide the appropriate length of the time box, instead of being very rigid with the time box, depending on the complexity of the problem to be solved, keeping it as short as possible, but no shorter.

SSH Remote Port Forwarding with Putty

2011-11-22T08:18:00.001-08:00

Here is the use case:

You are behind a firewall, and wish to expose an intranet site to the internet in a safe way
You have SSH access to an internet connected server

Here is what you do:

Install a web server on your local workstation or server
Modify internet servers "/etc/ssh/sshd_config" to have "GatewayPorts yes" and restart "service sshd restart"
Establish a Putty connection from local workstation or server to the internet server, ensuring that your local web port (80) is Remote forwarded to the internet server.
If required, open up the firewall for the internet server, and in some use cases enable NAT, if you need to.

Social Analytics and Smart Tagging

2011-11-21T10:09:00.001-08:00

Brainstormed about how social networking works differently in enterprise vs. consumer space, and current general challenges for both. Some thoughts:

Use of hastags sucks when collaborating

Now, gasp! People like tags! Self-organising etc. etc. but in a corporate environment they did not really work. People mis/under/over tag with no real consistency.

Sure, it's better to have them than not, but we can do better. In consumer space where you are not paying any money for service it's ok if you discover 10% of total content, you still better off than 0%, but in an enterprise you need ~100%.

Hashtags rule when used as personal bookmarks

Because as a person you control your own namespace, being able to tag (without first creating an enum list of terms) contents you want to bookmark makes perfect sense. Tag acts a bookmark folder, with links to docs within in. Additionally, this is server stored, so those links move with you.

Define classifications and tech system to apply them

Large orgs will always want to define a lexicon to drive common goals, unlike self-defined social media tags. This cuts down on duplicate/overlapping tags but still risks under/over/mis classification. Newer systems like Apache Mahout allow you to define classifications, and then teach it based on input documents what classification to apply automatically using NLP and stat analysis.

Content analytics to discover trending topics

Just because management has defined strategy and lexicon, does not mean that on the ground reality matches vision. In fact vision may be organically defined from grass-root movement. Smart management wants to listen, hear and respond to this innovation. Sometimes even the individuals involved may not appreciate correlation, so relying on tagging is not enough. Use automated content analytics to identify trends, not social tagging.

Integrating social media platforms

2011-11-21T06:02:00.001-08:00

Emergence of social media and social networks is pretty existing, however current inter-social-net integrations are pretty poor. Sure every provider claims to have open APIs, and a number of companies like HootSuite try to create a single interface to them all, but this is a pretty expensive way to operate for consumer social networks.

It will get a lot worse once companies start to create gated social networks that can be accessed on the internet by employees, customers and partners. I call them social extranets.

So what's the solution? Open standards is the common answer. But standard to do what? To answer that, ask your self, what are key social media / networking killer features? Well, to me anyway, it's

activity streams (timelime, wall etc.) of your connections & interests
search anything
auto suggestions

Note, security and DLP are BIG issues, but outside the scope of this post. So, let's look at how we support these features:

Activity Streams

HTML websites do not support activity streams, as they are stateless, request-response system i.e. passive, but with broadcast capability. Email and IM are user-to-user or user-to-group systems, or in messaging speak they support both point-to-point and publish-subscribe patterns. IM is near-synchronous, email is asynchronous.

So, we can enable activity streams by posting messages whenever an action is performed (an event), and subscribing to those messages for our connections. These does not need to be real-time, i.e. it can be asynchronous.

In other words, if we could agree on a standard to describe social events, we could use email as the message transport. Reason to use email v.s. IM? IM is still locked into proprietary systems, email is truly open. Alternative is to monitor RSS/ATOM feeds for new events, but email on first look should provide a more scalable platform.

Each social network would need to be able to generate and consume event emails, and generate activity stream from internal events, plus external events. Individuals, groups etc. would need to configure their social tools to notify an explicit list of partner social media tools.

Search Anything

Standards like OpenSearch already exist. Each tool needs to be able to expose their search system as an OpenSearch compatible system, and on the other side, be able to federate search across multiple search engines. Big challenge is around opening up URLs security to external partners.

Auto Suggestions

Suggestions are very smart, and will get smarter as big data (Hadoop) and analytics (Mahout) gain momentum. There is a need to combine activity streams (including searches you have done) with content analytics engines that work off data warehouses created by storing all data that you have produced, be that documents, or you activity.

This should then produce auto suggestions e.g. because you searched for XYZ, viewed document ABC, sent a message to FGH, and other people or documents match that profile, you get a link to that document, person etc.

That takes care of the internal data, now just like with search, you need an open standard to federate that across many distributed systems e.g. OpenSuggest.

RDP over SSH Port Forwarding (Tunnelling) with Putty

2011-11-21T01:28:00.001-08:00

Here is the use case:

You have got a physical Linux server somewhere e.g. cloud
You are running multiple Windows guest OS's on some hypervisor e.g. KVM sitting on top of those physical servers
You've got yourself a single public IP address, and optionally a DNS domain.
You want to access those Windows guests via RDP from home via that single IP in a secure way

Here is the solution on the server side:

Make sure that the Linux server is running SSH.
Suggest you bridge your physical NIC to allow guest OS's access to same physical network
Assign static IPs to guest OSs on your private LAN.
Ensure that firewalls allow SSH traffic.
Optionally, edit DNS zone files and create A records for public and private IPs e.g.

A record : server1.mydomain.com => 90.12.44.11 (public IP)
A record : windows1.local.mydomain.com > 162.0.0.21 (private IP)

And on the client side (your home/work Windows PC):

Download and install Putty.
Configure your Putty session to:

Login to the physical server over public IP,
Forward RDP port (3389) from local windows OS IP to your PC's 3391 (or any other) port

Start RDP client and connect to localhost:3391.