“when are you going
to explain to our kids
what you did!?”

the memory of that dream
remains with me since

and left a message…

we watched a bit of this
though you’d not remember
given your amused disinterest

you were all, ‘why is this?’ and ‘what is that?’
and i tried to explain
like i was some expert

which i’m not
eventually you turned it off

in the mood for love

this was a film i wanted to see
japanese noir but romantic,
in the genre’s twisted kind of way

“i don’t like subtitles”, you said, ‘they make me have to think’
so we watched something else instead
it was Mr & Mrs Smith

2048

a chinese film festival
the sign above the window said
‘boxed office closed’

however innocent and pure
your feelings were.

the only thing that i can change
is how i feel

about you.

each week I look through
drawers to find a cloth

once removed – I think of
you, always

this is the only time I
take it off.

1. Disable GPS. I only turn it on now when I need it (google maps and flickr): Options | Advanced Options | GPS. Set GPS Services to Location Off and Location Aiding to Disabled. Now I appreciate there’s some debate about whether this makes any real difference or not because GPS is (apparently) only used by applications on demand. However, because I frequently forget to properly close applications – google maps used to be on almost constantly - having it off by default suits me.

2. Same with Bluetooth (I really only use it in the car with my handsfree): Manage Connections | Bluetooth off

3. Screen Brightness – you won’t really notice much of a difference in terms of usability, so this at least can’t hurt: Options | Screen/Keyboard. Set Backlight Brightness to 10 and Backlight Timeout to 20s

4. Providing you can remember to disable this if you need to use the alarm early in the morning, use the Auto Off feature: Options | Auto On/Off set both Weekdays and Weekend to Enabled between the times that suit

5. Another controversial one – use 2G instead of 3G – theory being that this reduces the amount of network switching, and hence saves power: Manage Connections | Mobile Network Options. Set Network Mode to 2G. While you’re there make sure you have Data Services set to Off When Roaming – which really ought to be the default. My phone company currently charge a fixed £5 per day in Europe and £15 elsewhere…

google provides plenty of others, some of which are just daft - not using message notifications, ringtones or ‘power hungry’ applications (like email, im and facebook). yeah, but that’s why i, and i suspect most others, bought the thing in the first place…

in a previous post i talked about the resources i used for sitting the omg ocup fundamental exam. wish i hadn’t waited a year before sitting the intermediate as i’m now having to do a quick refresh before studying for the exam proper. in so doing i’ve spent the last couple of hours on google looking for study resources and have drawn a complete blank. now, i’m pretty sure my previous combination of the excellent UML 2 Certification Guide, topped up when required with the tedious but necessary UML Reference Manual and UML User Guide will do the trick; but where are the blog posts, the discussions, even the odd powerpoint from a training course? there’s little except forum posts noting victorious passes and samples of testking exams, given which i suspect these two things are linked. i posted about this sort of thing six years ago and my view then still holds…

My point? Well, apart from the aesthetic and more human readable characteristics of a post that ends “/robbie/why-x-sucks” rather than “/robbie/?p=n”; a decent google rank clearer prefers this. That said, I’ve had a thing about ‘permalinks’ for quite some time. Ever since I wrote my first config utility that had to be reused in multiple applications and environments (using DNS resolution), but especially years ago on an internet web content management system (where I had to justify at a ’business’ meeting why we were using our own ’internal’ guid as a primary resolver). At that time there was no little debate about ‘permanent’ or ‘pesistent’ urls or purls, as they were commonly called. Both config utils and links on websites need to relate to resources with specific identities, but it’s the job of URLs to locate those, and URLs change – even if the identity of the resource doesn’t. For example when I upgraded my blog, all my post’s URLs changed. But their permalinks don’t. WordPress uses its own internal locator, so either http://www.wellitworkedlasttime.com/robbie/?p=38 or the new style http://www.wellitworkedlasttime.com/robbie/index.php/2008/wordpress-pretty-permalinks/ is equally valid. And frankly that doesn’t matter – all external cached links on google, twitter  or wherever, will be resolved providing the application is running, and that’s the point. If it’s not, the resource should be unavailable.

The idea that persistent URLs ought to exist somewhere out on ‘the cloud’ is simply wrong. I was about to add this link to purl.org, most known for its use in dublin core metatags perhaps, when I saw this:

“We have reverted back to the old purl server. Any PURLS, USERID, GROUPS, and DOMAINS that were added after 5:50 am edt on 04/07/09 have been lost. We will try to recover them, but we are not sure it is possible at this time.”

An amusing aside (yeah, persistent, my ass!), but my real issue is this from Wikipedia:

“PURLs are an interim measure — while Uniform Resource Names(URNs) are being mainstreamed — to solve the problem of transitory URIs in location-based URI schemes like HTTP. Persistence problems are caused by the practical impossibility of every user having their own domain name, and the inconvenience and money involved in re-registering domain names, that results in WWW authors putting their documents in rather arbitrary locations of questionable persistence (i.e. wherever they can get the WWW space). Existing official PURLs (on Purl.Org) will probably be mapped to a URN namespace at a later date.”

Interim? Impossible? Inconvenient? Expensive? Oh Really? A pretty lame case if ever there was one… In my view the location of a resource is best resolved at the edge, close to the resource itself, by software under the owner’s control. It’s really not that much bother…

 Let’s start with the fact that I hate the term – it’s really not an “impact assessment” at all – at least not in the way we have “critical event analysis” which occur post-facto, in the ‘let’s find out what when wrong’ sense; even the slightly more proactive ‘after we’ve done this how could we have done it better’ type of analysis one might often commission if things went well. Rather, it ought to be a component part of the process. But if you google that right now you’ll find little other than guidance and opinion – certainly no commonly adopted  processes or standards. It’s hugely immature.

 I’m struck by the similarity of ‘privacy’ with the evolution of ‘security’ and, more recently , ‘identity ‘ in that respect – here we now talk about “assurance” in relation to those concepts – why are we not using the equivalent nomenclature?  Possibly because only a few academics and lawyers are truly interested? “Privacy assurance” (at the time of writing don’t expect much) is surely the better term? It’s part of the process of developing systems that process personal data. Any personal data, whatsoever. At least it ought to be. We should be considering privacy at every step of our designs and implementations. An example…

Five or so years ago on a project far, far, away we had a technical design discussion that went something like this:

Q: Yes, but do we assume the government owners of this system to be both good and competent?

A. No, therefore we must put in place mechanisms that will make it as difficult as possible for a corruptible entity to abuse its potential power whilst still saving itself from its innate inability to be effective…

I doubt very much that such design considerations were widespread. But they should have been. At the time we called this “security by design” or “security-led design” depending on whom you talked to; now its “privacy by design”. That’s ‘A Good Thing’ in my view – at least we can discuss privacy issues in broad daylight in a way that means something to senior stakeholders. So saying security is still, in my mind, the overarching concept here – because security and privacy only really begin to trade-off when identity (or identifiers or identity data) are introduced.

Simple example: mechanical lock and key to gain me entry to my house does not depend  on my identity – there is no implicit or explicit semantic assumption that I – and only I (or my delegated identities) can enter that building. Anyone with the appropriate physical key – whether actual or otherwise forged – can. And that’s the point – it’s not dependant on my identity. Therefore this scenario does not require a P.I.A. as privacy, in terms of identity, is irrelevant. However an entry system that does depend on identifiers or identity ought to.

So, ‘conducting’ a P.I.A. – which probably means ‘getting in consultants to review an implementation’- is not what my defintion of ‘privacy assurance’ is about. Privacy assurance ought to be a fundamental, integrated part of the process of designing and assuring solutions, not a methodology or a discrete task in that process…