I’m sitting at the computer with a glass of Chardonnay (used it with fish last night, can’t let the rest of the bottle go bad!) and writing to stave off a SERIOUS craving for frosting. I’ve looked up at least a dozen different recipes in the last 24 hours, and can almost recite the differences between Swiss, Italian, and French buttercream. If a recipe ever calls for vast quantities of Crisco or other shortening for frosting and does not use butter, please, do us all a favor. Rip the recipe out of the book, throw away the recipe, and burn the book. Yuck.

However, to set up for an easy dinner tomorrow and keep away from the sugar, butter, and eggs (that’s it! well, and a bit of vanilla…) I picked up a pizza dough recipe I looked at recently. I’ve talked before about Rouxbe, the online resource for cooking tips, recipes, and lessons. They’re star people, and Dawn and Joe have both been supporters of my food adventures, answering questions and giving plenty of advice along the way. I’ve been a member for a long time now. Funny enough, Joe remembers me for starting the conversation about how even trained chefs eat Costco hot dogs – I’ve got to work my way up from that!

To give you a taste of what they have to offer, I’ll let them show you the recipe preview (Flash required):

They offer this high quality video detailing step-by-step all parts of a recipe, with tips sprinkled throughout (see "Related Techniques" above) that boost your knowledge. The dough slow-rises in the refrigerator overnight, so I’ve done the first part tonight and will do the rest tomorrow – plus, I now have dough in the freezer ready for another day.

That’s not the best part. Last week, they (finally!!) launched the Rouxbe Cooking School, a partnership with the Northwest Culinary Academy of Vancouver. This is something I wanted to see years ago – this is the sort of instruction and comprehensive learning facility that is missing without actually leaving my career and changing worlds. I’ve read all sorts of instruction on technique and skills, and consider myself reasonably capable in a kitchen, but actually seeing it and going through all the details is a wonderful experience. It’s high quality, and perfect for the enthusiastic cook like me with a day job.

Here’s a taste of the cooking school lessons:

I really can’t say enough good things about what these folks have done, both in growing an online community, providing good video recipes that are easy to follow, and now especially to publish a curriculum like this.

Ding! Laundry’s done. Off to bed now – I’ll let you know how the pizza turned out tomorrow.

There are whole rafts of Web 2.0 sites out there devoted to managing your life more effectively. 30Boxes for calendaring, Upcoming.org for events, Scribd for publishing documents, meebo for instant messaging, stikkit for todo and note tracking… The list goes on.

Staring at bubbl.us to brainstorm a process for work, it occurred to me – with all of these sites out there, if I really began to use them effectively, I’d have a massive disaster recovery issue on my hands. My information is spread over many sites, not held in one place, and none of it in a place I can directly control.

My solution? Look at each to see who provides exports, such as RSS or PDF, and begin to re-aggregate myself into one place locally so I don’t lose me.

Below are my SxSW panel notes. There is minimal formatting – ASCII is the ultimate portable format – but email me if you would like the source file.

UPDATE: Panel podcasts available here.

WORLD DOMINATION VIA COLLABORATION

Panel focused on successful internet communities and how they engaged with their users.

What sorts of things work to build a community? Participation is key, but can be a killer. You have to create a sense of connected and involvement that gives people a certain personal stake in the success of the group; they have to want to participate and feel some attachment. Secondly, there needs to be some sort of mechanism for troll defense – either by content moderation or, more passively, by monitoring the group.

One key learning is to ask, not tell, your users. This gives people a space to add their own contribution and become part of the process, rather than simply retrieving more information. In a world where we compete for attention as a resource, being involved is a much more attractive draw than yet another information source.

Building community within a corporate environment: Once it’s become part of the culture, it becomes a critical part of that culture. Communities become a key mode of communication between geographically spread out employees. The tendency is to focus on technology (e.g. blogs, wiki, AJAX) when building a community, when the reality is that the focus must be on the people instead. Questions to ask – What’s the linkage? What’s the draw? Why should they want to contribute? FOcus on the community needs and give them lots of space to contribute. Example: Dove’s Real Beauty campaign. They asked the question, “What is real beauty?” and people were very compelled to answer – even if most of the answers did not involve Dove products.

Be open with the community; involve the users in the building process. Hiding issues or problems from the users creates a distance, while exposing the issues and involving them in the process not only allows them to build a personal stake in the outcome, but they become involved in the solution itself.

Rapport with the community, from the onset, is another important facet. In some examples, greet the new members personally at the start to accelerate onboarding to a critical mass. At some point, that becomes too much overhead, but by then the community is bootstrapped. It’s like any party – somebody has to be there to “work the door”, welcome guests, and make them feel at home. Oh, and never lie.

Blogging at Microsoft was a corporate grassroots movement. There was a set of people/personalities who were very vocal and passionate and wanted some platform on which to be heard. Shy users were given space to start small and grow into it – maybe a post here or there, or even having the first few posts authored for them. And to help guide them, the character of Norbert, the Cod of Conduct, was created.

Social capital is also an important concept. Users being able to build trust/reputation e.g. through online rating systems as an indicator of status within the communmity is a powerful tool. Again, this speaks to invsting personally in a site – it’s a form of reward for the users.

Lastly, owners actively participating in their community will set the tone and tenor of conversation. Passive suggestions for doing this include pulling quotes and featuring users, active participation in discussions also goes a long way. There are also tricks to use to hook in lurkers (people watching but not participating actively), such as polling, Question of the Day, et cetera – essentially involvement without much authoring on their part.

BRIDGING THE CULTURAL DIVIDE

This panel focused on how to deal with issues of race, gender, and other diversity factors in an online community environment where it can be difficult to carry on the conversation.

Social networking involves building linkages to other people, often via online tools. The core is about finding and connecting people.

The community must be open and permissive to succeed. Allow dissenting views to be heard. This allow for content to be moderated to stay on topic, but the moderators must not quiet one particular point of view in favor of another. (One point of view is that the negative comments highlight the need for such open forums.)

Every post, every comment, becomes a historical document with intrinsic value once submitted and should be preserved as such. This kind of honesty and freedom of speech is the only way to allow the community to flourish when dealing with sensitive issues.

Should all participation rules be the same for all sites? It depends on the focus. I may have different rules of conduct on my personal blog as opposed to a discussion forum. If I choose to be open and encourage this dialogue, then I shouldn’t make that a biased discussion. Media companies have (for example) editorial standards, a defined and broad audience, and the like. This creates a set of standards and rules that these companies by which these companies abide. Blogs are more personal and typically don’t have the same business scope and focus. There are no rules that make popular bloggers responsible for what they say or do once they become popular as there is with mainstream media.

Personas are also different. When people communicate offline, social norms and behaviors enforce a level of civility and restraint that is not seen when online. Online communication lends one a (false) sense of security and can allow people to say things that they normally would not say in mixed company. This goes to highlight an exaggerated form of current social themes.

The way to improve discussions about e.g. race is to take the initiative. If a young black woman and an old white man are not going to hang out together offline, then there is no incentive for them to do so online.

WIKI COMMERCIALIZATION

This panel focused on business models surrounding making a viable company around a wiki.

Wikis are information repositories open to everybody for edit, with everybody working on the same body of knowledge. The popularity of wiki is enhanced by the ease of editing the data.

Most wikis grow from personal or non-profit roots. Can companies participate? Yes, there needs to be a healthy economy of personal, public, and private wiki knowledge bases.

Four wiki business models:
- Service Provider
- Content Hosting
- Consulting
- Content Development

Successful wiki businesses need to move from crowdsourcing model to platform model.

Crowdsourcing: End users (“suckers”) feed you content, which you essentially sell back to them. The users are doing the work for free. This is the current common wiki monetary model.

Platform: Knowledge Havers connect to Knowledge Needers via You (the wiki). Your role is to give the users a mission and to moderate the content to keep them focused. Remember, however, that you (the wiki) are ancillary – you are the vehicle, not the product itself. Value must be demonstrated to keep users engaged.

WEB HACKS

This short “power session” focused on the impact of content feeds and mashups/pipes on today’s information production.

Key point is that feeds (RSS/JSON/etc) can be usurped, hijacked, and mashed up without proper attribution. Services like Yahoo! Pipes can act almost like a washing machine to abstract content from the original writers.

The net result, stated provocatively, is that copyright is dead. Because of the abstracted nature of feeds, there is a massive, human cost involved in actively protecting content copyright. This cost will prove to be too great and therefore alternate models are needed.

[Note - I'm not entirely sure I agree with this rather extreme point of view, but it is an interesting starting point for a discussion on what and how to protect knowledge we generate.]

FROM TAGS TO RICHES

This panel focused on the journey people take to grow from coder/designer and into other fields, such as marketing, management, etc.

Unanimously, the trigger for panelists to move was a lack of challenge. These people had reached a point where they were beginning to stagnate in their coding skills, and while there was a constant need to keep skills sharp, individual assignments no longer posed a challenge.

It can be daunting to try and move into another position, given the excessive list of skills often advertised. Recognize that these desired skills lists are really often a superset or wishlist – even if you do not have all the qualifications, you should try and apply for the position anyway on the basis of what you know.

Software and web design is a profession, although this position is still gaining movement. As a whole we should move towards professional organisations and ways to define and communicate how deep and complex a space it is. There is currently a lack of well-defined industry career paths or educational process, which does not help the cause.

Other challenges people have faced as they move out from coding/design are around time management, people/line management, and dealing with in-house politics. These are elements that you don’t necessarily deal with as a coder but become important as your scope of influence increases. (Best quote on time management: “I’m an independent – I rebel against my own authority.”)

Realise too that moving away from coding/design means that your skills will necessarily falter – it is not possible to learn a new skillset while devoting enough of yourself to keep current and sharp. The balance is to work to keep up but allow for some slack. Being conversant in a new web technology is not necessarily the same as being able to crank out code in your sleep.

COMMUNITY ECOLOGY

This panel discussed the balance between building online communities and servicing company needs at the same time.

The notion of a community ecology is that it is about balance – servicing the user’s (community) needs while at the same time satisfying corporate (company) goals.

To build a community, focus on the value add – what’s in it for them? Incent users with authentic ideas that fit them, then trust the community to create a spark with its own creativity. Companies that try and micromanage or overcontrol a community will in actuality stifle it. (Realise, however, that commuity volunteering can bring its own set of liabilities and issues as well that need to be managed.)

There is a recurring theme among successful communities of constant adjustment. The group must not stagnate but continually work to improve, refine, and most importantly grow. This growth can be directed by the company but again beware the potential to stifle creativity.

Create the notion of company “ambassadors”. These people participate in external (often 3rd party) groups and expose a bit of the inner workings of the company. [sort of like Robert Scoble and Microsoft] This invites users to comment and humanizes what can otherwise be a start and sterile corporate image.

Looking internally to a company, start small, find a few “ringers” to be vocal contributors, and focus even more on the question of “What’s in it for me?” and how this community will improve their day. Publicise the community to keep interest up, and to help create the microbrand within the company.

SHORT ATTENTION SPAN AND BIG DIVIDENDS

This panel focused on the creative process and approaches to harnessing this potential.

Successful creatives will constantly churn and capture ideas, later working to refine or (largely) discard them. For example, one marketing group keeps a written log of ideas that likely will never be seen through (the “Big Book”). The effect of writing this down legitimizes the daydreaming process and makes it more real rather than a seeming waste of time.

“I’m not writing it down to remember it later, I’m doing it to remember it now.” – Ideas happen in a given context and place/time. This can be just as important as the idea itself.

The continuing theme of this panel is to keep doing, even if it’s only for the sake of doing. Don’t worry about polishing everything or else you risk continually second-guessing yourself. Instaed, constant churn and exposing these ideas to other minds will lead to thoughts you would not have had on your own.

Lastly, outlandish ideas or absurd thoughts can be brought to fruition in order to incent working on boring stuff. For example, one designer used iconography from McDonald’s packaging to build an interface to Google based on these icons – all to improve their Macromedia Flash skills.

“I CAN’T BELIEVE I SENT THAT!”

This panel focused on email’s dominance in our culture and common mistakes using email in a business setting.

Email has two stealthy characteristics:
- It is affect-less; it is unable to convey tone/voice as if in person or over the phone.
- It is an enormous time waster, often able to simulate progress without generating real work. The toll of email is our time and energy.

Six issues why email is bad:
- Curse of the new: once we get it, we use it. As such, email can take up too much of our time and be used inappropriately as a productivity tool.
- In email communication, we must aways remember who they (or we) are and impose voice/tone over the communication. Email can often give a false sense of closeness or intimacy in communication.
- Often, email conversations happen too fas to keep up with; this leads to sloppiness and haste.
- Our emotional brains monitor reactions/body language in face to face coversations. Email offers none of this, and has been shown to actually lull people into a less inhibited (more reactionary) state.
- Email eggs us on to lose our cool.
- What works in speech comes out very differently in text. For example, “Reply by Friday, please.” Is the please meant as a polite courtesy or as a pointed accusation?

How we email badly (8 deadly sins):
- Email that is unbelievably vague
- Email tha tinsults so badly you must leave your desk
- Email that is cowardly
- Email that puts you in jail
- Email that won’t go away
- Sarcastic emails (not identified without tone and often taken incorrectly)
- Email that is too casual
- Email that is truly inappropriate

Bottom line: Think before you send, and send what you want to receive.

CORPORATE ACCESSIBILITY

This short panel discussed the journey to accessibility in corporate websites, using ChevronTexaco as an example.

One key learning is that accessibility isn’t as large a switch as would be expected – a CSS-based layout and some level of template/standardized layout is most of the way there. Accessibility is a different, not additional, way of working. The best way to achieve accessibility is to draw a line in the sand, rather than initiate a project to retrofit an entire intranet/internet presence. Allow for existing site refresh cycles to pick up the accessibility by requiring them to enable accessibility after the line in the sand.

Eight steps to accessibility:
- Determine the necessity of accessibility. (This involves not only corporate direction but legal, as there are liability issues under national laws e.g. US Americans with Disabilities Act.)
- Create/modify a role of accessibility watchdog, somebody empowered to police and enforce the drive for accessibility.
- Evaluate the current web position (gap analysis).
- Establish the accessibility policy, that defines what accessibility means in your internet presence (scoping).
- Obtain tools necessary for creating accessible websites; there are many out there, some free, some commercial. This is increasingly added as features within major editors such as Dreamweaver and soon many Microsoft products.
- Train your staff on expectations.
- Create a testing and compliance mechanism.
- Draw a line in the sand.

GETTING UNSTUCK

This panel focused on ways to “get unstuck” and effectively work with clients. In a broader sense, many of my takeaways are on getting things done effectively in any business setting.

Unstuck: the act or process of doing good work, being productive, and feeling fulfilled on a team.

Being stuck is a matter of perspective – seeing no clear way out from whatever situation is present. Once stuck, the common tendency is to close up and not share ideas but mule forward; instead this is the time when sharing ideas openly can be the most effective.

Management through conversation. Successful people talk a LOT with their client before entering into design – this builds rapport and depeer context for understanding each others’ position.
As this relationship builds, the key point is to remember to listen. People can be indirect, so hear what they actually mean as opposed to the letter of what they say. For example, in web page layout, if a client requests odd changes such as massive font size for the top of the page, probe a bit further to find out – in THEIR LANGUAGE – what issue they are trying to resolve. Taking it back to their language and being fluent there saves them from having to translate into yours, and is ultimately more effective.

Continuous communications cycles are also important. Always be engaged with information flowing in both directions. Writing (effectively) helps focus ideas and become crisper, but also keeps all parties involved and invested in the process.

Negative space (when not to speak, sparing words) can be as important, if not more important, than positive space in communications. Know/learn when to not speak.

We live in a sound bite culture. Changing minds and planting messages becomes much easier with “two-ssecond” messages, little phrases or key points. This applies to internal brands as well. Naming things (effectively) also greatly helps this – a name can carry a much larger connotation in only one or two words.

Realise that building software is in fact a political process, not a theoretical one. It involves people with their own motivations and desires, and successful builds will take into account the people factor to ensure everybody is moving in the same direction.

Effective communication is not just about going out and doing roadshows. Often, it is more effective to simply go and add value all over the place. This builds tangible grassroots support more strongly than any roadshow or powerpoint presentation.

Finally, simplify and focus. Frame issues in your target’s (be it your client, teammate, manager, etc.) perspective, not in yours, and look at their drivers. Learn the language of the other side, so to speak.

SCALING YOUR COMMUNITY

This panel dealt with primarily people aspects in growing a community base and allowing it to form a life of its own.

Scaling, in this sense, means being as useful/relevant for the last 100,000 users as you were for the first 100,000.

How to keep the closeness as the community grows up and up? Four points:
- The foundation must be strong. Start as simply as possible. The best message is the simplest thing that you can reasonably articulate. (see sound bites above) Finally, don’t just promise, visualise. Show rather than tell the users.
- Bootstrap the community. Talk to people – get them out of their normal mode of interaction (be it blogs, wikis, et cetera) and engage with them.
- Let go! By this point, you’ve bootstrapped a community with users who are now more passionate about it than yourself. Let them run with it, keep the ideas and communication flowing, and nudge every so often to keep on track. Remember that at some point, you can’t do it all yourself; the founder’s bandwidth is a limited commodity.
- Personalisation. This is different from customisation. Fundamentally, this is a filter on the mass of data that is (hopefully) flowing through your community. Keep it fresh – introduce elements of randomness/change and unpredictability, e.g. a sample of popular posts that changes frequently. Allow for correction in this as well – users should have some control over their personalisation. Bootstrap with Popular – the idea being that people are compelled to stop and view popular items, so this can be used as an attention grabber. Lastly, respect your users’ time – they need to have valuable interactions in order to keep coming back.

What’s the best scaling social software ever? Email. What’s killing it? Spam. Think about that in the context of your current community efforts.

VIRTUAL TEAMING

This short panel dealt mainly with technical advances and tools for virtual teaming (not reproduced here), but did offer a few themes to keep in mind when dealing with virtual teams.

Virtual teaming is teams working across space and time connected by technology and networks.

Working virtually can give individuals more freedom and flexibility to succeed, improving work-life balance. However, this does require some discipline and structure to compensate for the lack of “casual mind-melding”, the informal conversations or quick checks that keep a physically colocated office moving. Take care not to lose communications and create foggy visibility; establish regular touchpoints to keep in step. Create “virtual hallways” where people meet and talk in unstructured formats.

Most critically, be focused on every team members’ output rather than hours worked. The focus should be on hitting milestones and deliverables effectively, not on counting time at the computer. This requires a level of dedication and independence on the part of the employee as well as a high degree of trust and faith on the part of the manager.

Best practice: Pace yourselves. Things that happen with regular frequency offer an anchor for workers in physical isolation. Regular team meetings, agreed standards and frequency for IM/email, clean and clear commitments, etc. reduce the chance of drift.

MAKE IDEAS STICK

This panel focused on effectively getting your ideas across and making them stick in peoples’ minds.

Sticky ideas are: understood, remembered, and change something.

Six principles of ideas that stick (SUCCESS):
- Simple (“if you say 10 things, you say nothing”)
- Unexpected (break a commonly understood pattern in order to grab and capture attention)
- Concrete (easily visualised, tangible and sensory)
- Credible
- Emotional
- Stories

Urban legends, for example, remain popular because they are very sensory and tangible; it is easier to recall details of urban legends than the last memo you read, for example.

Challenge plot can be very effective e.g. Subway and Jared’s weight loss campaign. Think of an online personals site such as match.com – short one sentence pitches that compete for your attention. The most effective of these will touch on the six principles above (e.g. “The guy above me is married, the guy below me is a stalker.”)

“The curse of knowledge” – when you know something, it becomes hard to picture not knowing it. This can make crafting messages difficult. Remember to try the message out on people without knowledge to verify your assumptions about effectiveness.

YOUR PODCAST IS LAME

This mini-panel, the last session attended, focused on tips and tricks to improve your podcast.

Five plus one tips:
- Know your audience
- Good equipment is cool (and not terribly expensive)
- Be prepared
- um, like … Edit afterwards for flow, stutters.
- Do like the pros do (theme music, intros/outros, wrapups, etc.)
– Have fun!

Abstraction can be an effective tool if and only if all people involved have a shared knowledge and background. Otherwise, stick to concrete messages to cleanly convey meaning.

I’m not necessarily one to sprinkle widgets across this site. It introduces a dependency on another site being alive, and doesn’t necessarily perform (in fact, it rarely does). However, this one was interesting. So, I’m posting it here, and if it proves interesting, it’ll become a widget.

Again, I wish I knew a bit more about coding than I actually do. Jason brought home a math brain teaser the other day that he and his grandmother got stumped on:

Arrange the numbers from 1 to 16 in a four by four square so that each row and each column and the two main diagonals add up to 34.

(note: as I type this, I have the brainflash to feed that quote into Google. I think I just found the answer there – would’ve saved me a few hours today. I’m not going to be able to sleep if I don’t figure this out for myself, though.) I spent some time with Excel this afternoon, setting up a grid that showed the row, column, and diagonal sums and then started arranging the numbers. I’ve managed to fit everything but the diagonals, and I’m getting a feel for the rules of movement to switch numbers around without breaking what I’ve got so far.

Part of me wants to make this a linear programming problem, set up a matrix of coefficients, and solve it. That was one of the coolest things I learned in my Materials & Energy Balance class, the first course in chemical engineering. By setting this up as a system of equations, if you have enough (non-redundant) equations to satisfy the degree of freedom, there is a matrix manipulation algorithm that will nicely resolve all the equations into the solution. I’ve been trying, but I can’t come up with enough equations. I have sixteen variables (one for each grid square), so I need sixteen equations, but I can’t pick them out to get a solvable matrix.

I moved on a little while ago to think about a computational brute-force. Let the computer churn overnight on all the 20,922,789,888,000 variations on this square and check them while I blissfully sleep. My problem with that, and the reason I wish I had more of a computer science background, is that I’m not sure how to represent the matrix in a sensible form. The ugly way would be a nest of sixteen for i = 1 to 16: loops, with checks at each level of the nest to ensure that no number was used twice. This would be hideous to write and, I suspect, extremely inefficient.

Rather than represent this as a matrix, what it really looks like is a sorting problem. Instead of a matrix, treat the grid as a sixteen-element array. Let the first row be positions 1 through 4, the next row positions 5 through 8, and so on. Based on what I tried with the linear programming above, I can write a function to evaluate the matrix by adding up the values at certain positions and make sure they add up to 34. Problem is, I don’t know nearly enough about sorting algorithms to readily apply them here. Essentially, a sorting function would be able to evaluate two items in the list and see if they are in the proper place (the first is “higher” than the second) or if they should be swapped around (the second is “higher” than the first) and swap them. Unfortunately, in the evaluation function for this problem, I don’t know how to determine which is a better fit and which is not, so which elements should I swap?

See, this is what keeps me up at 1:17 in the morning. Welcome to my world.

UPDATE: Answer is in the comments. Thanks, Dad!

Today has been Christmas day. Rather, Christmas lights day. I spent the afternoon outside untangling strands of lights, hanging strands, rehanging (%$#^ plug end goes on the OTHER side of the yard…) the strands, re-rehanging the strands (whadya mean I hung them too low?), and searching for the burnt out bulbs among far too many sections of lights. The back yard is now cozily lit (if dim in a couple of spots), and if the front yard looks like it came down with mange, well, I did my best. We’ll have it fixed by Christmas.

In other news:

• Teachef, from Adagio Teas, is a community site dedicated to cooking with teas. Each month, they offer up samples of a particular variety of tea, and whomever gets to spend the rest of the month coming up with the best recipe to showcase that tea. I’ve just signed up to work with Lapsang Souchong in January, so this should be quite interesting to follow.
• NIST Dictionary of Algorithms and Data Structures – put this one in the “Gee, wish I’d studied computer science” category. Lots of concepts here that I wish I knew more about, and if I read between the lines enough I might get to learn them. If anybody has a recommendation like Graph Theory For Dummies or Dick And Jane Learn Stasticial Modelling, please pass it along.
• The wood-fired oven idea is not dead. I’ve requested a copy of Denzer’s book (linked a few posts below) from the local public library, so I can see it before I decide if this is beyond my skill or not. It’s been suggested that if I want to spend time building an outdoor oven, I should probably also look at screening in our back porch. If anybody has a recommendation like Building Wood Frames For Dummies or Dick And Jane Use A Nail Gun….
• Dating an Apple Developer. Something that should be required reading if you ever find yourself in a relationship with a code monkey. Fortunately, Christine is quite understanding.
• An interview with the Hairy Bikers. If anybody out there in blogland UK can record this for me, I’d be extremely grateful. Food television that sounds like it should not be missed. (Tip of the hat to Geoff)
• Transferring MPEG2 files back to the TiVo; more of a mental note to myself than anything else.

That about covers it. Work has been extremely busy, not the usual end-of-year slowdown, mainly because I’m covering for two roles that each want 75% of my time. I am still cooking when I can – I make a pretty mean buttermilk scone, and I enjoyed my crepes last week, not to mention a fabulous roast chicken – and getting into the holiday spirit. For everybody who has asked, I do have a skeleton of a Christmas list if it’s still needed – send me an email and I’ll send it out.

(bonus points for catching the title reference.)

I’m seriously impressed by SoulPad, an effort by IBM Research to essentially make your computer (mostly) hardware independent.

Basically, it’s like this: You have a portable storage device, say a USB-connected drive. Plug it in to a computer, boot from it, and your computer is in front of you ready to go. When you shut down, your session is stored and the computer shuts down. Take that device over to your neighbor’s house, plug it in to their computer, boot, and watch your computer come up in front of you.

It’s accomplished using plenty of existing technology – Knoppix as a base OS to autodetect the hardware and boot, VMWare to maintain the “guest” OS (whether I want to run Windows, or Linux, or whatever), and some glue to make it all more friendly.

Put simply, rather than have my home computer at home, I could put it all on a portable drive and be on my computer wherever I can find a free PC. Too bad they haven’t released any of their software.

Still getting some of the home computing resources back into place after Operation: Nachos (the escape from Rita). The Linux server, drteeth, is in place but not powered on – haven’t put time into working on any of the projects on that machine yet. The Windows PC, floyd, is limping along. The CPU cooling fan failed shortly before the hurricane, so at the moment, the system case is opened and is ghetto-cooled by a desk fan.

In other news, Opera is free. Opera was one of the early “alternative” browsers, dating back to the Netscape/MSIE fights. It has some nice eye candy, but the feature I’m enjoying most now is the voice feature. It provides text-to-speech capabilities, which means I can have my browser reading web pages to me while I’m following up on emails. It also allows for voice control of the browser, but I don’t have a headset for the laptop yet.

Almost done with the setup of WiKID – have put all the components in place, now just need to do some last configuration. Christine has her first round of exams this week, so I’ve put some of that on hold.

In other news, I’ve been cooking in earnest again. We made some great dips and such for Christine’s birthday party last weekend, and I’ve made some outstanding vegetable soup and sausages en papillote this week. I love my kitchen.

The WiKID thread continues at Thinking WiKID Thoughts, the blog of the CEO of WiKID systems. Awesome stuff.

WiKID Systems Open Source Strong Authentication System – their commercial site can be found at wikidsystems.com

Let me break down some terms before I jump in here:

• Identification vs. authorization – Identification is asserting your identity (“My name is Mike”). Authentication is proving your identity (“Here’s my driver’s license that says I’m Mike”).
• Strong authentication – Authentication that is considered relatively secure and definitive. Generally equates to two-factor authentication.
• Two-factor Authentication – You can prove your identity in one of three ways: something you know, something you have, and something you are. The first one, something you know, could be a password, passphrase, or the answer to a secret question. The second one, something you have, is a token, such as a smart card, key fob, dongle, passport, birth certificate – it’s a unique physical thing that only you possess. The last one, something you are, is a biometric – your fingerprint, retinal scan, voiceprint, et cetera. Two-factor authentication means using two of these three things to prove identity.

With that in mind, I can explain why WiKID caught my eye. Usernames and passwords, in almost any real-world setting, are fairly insecure. They can be guessed, sniffed, or brute forced. We often use easy to remember passwords (mydogskip) instead of more secure passwords (b!ouFroap*lus1le). We don’t change them often enough, and we use the same password for many systems. There are some good uses of passwords, and they aren’t all bad, but there is a need for stronger authentication.

I have a smart card for work. That card is how I log on in the morning, how I open a connection to the office from home, how I authenticate myself to many of our internal systems. I plug it in to a special card reader, enter in my PIN, and it sends off the digital certificate that validates I am who I say I am. This is two-factor authentication, combining something I have (the smart card) with something I know (the PIN).

This is great for the corporate environment, where there are people whose job is to maintain all the digital certificates (granting, expiring, revoking, etc.) and to handle the cases where somebody forgot their card at home, or lost it, or what not. It’s also worth it to a corporation to tie in their systems to this single source of authentication. This is a fairly expensive proposition, however, for the home user.

WiKID aims to solve this by providing a software-based token. Essentially, there are three components:

1. WiKID server – This is the heart of the authentication. Basically, this is the part that maintains the list of registered users.
2. Device client – This is the software-based token I mentioned. This is what you use to authenticate yourself.
3. Network client – This is the agent that runs in the target system. This agent replaces the old authentication scheme, like usernames/passwords, that your web site formerly used.

Basically, it works like this (based on http://www.wikidsystems.com/technology/overview):
You need to authenticate yourself to your web site (for example). You open up the Device client on your computer and feed it your PIN code. The device client encrypts the PIN so only the WiKID server can read it and “phones home” to the WiKID server that manages your user directory and verifies your name and PIN. The WiKID server checks this, and issues you a one-time password (OTP), a magic code that is only valid for a short period of time. You feed that code to your web site, which asks the WiKID server if this is a valid OTP for you. The WiKID server answers yes, and presto, you’re authenticated.

This is more secure than a username and password for a few reasons:

I haven’t done a deep dive into this yet, but on the surface, it’s a pretty good thing. It would be possible to capture and spoof the encrypted PIN transmission to the WiKID server, but traditional hardware token-based authentication suffers from the same. There’s an initial set-up step with each Device client to give it the WiKID server keys and add the user to the directory, similar to going to the Department of Motor Vehicles to get your driver’s license. Overall, though, it appears to be nicely secure. Time permitting, I’ll look at adding it to my SSH server at home and for my WordPress installation.

The one problem I have with this solution is the software token, the Device client. In a traditional scenario, not only is my PIN secret but my token is unique – somebody has to have my token in order to impersonate me. With WiKID, I can authenticate using anybody’s device client that has my server’s key. Every device that has registered with my WiKID server could be used by me to authenticate – or by anybody else that happened to discover my PIN. It’s not wide open to the world, but it is an opening not shared with smart card-based two-factor authentication. The security of this system then essentially revolves around keeping the PIN secret and safe.

In short, I like it for home or perhaps small office use. It’s stronger than passwords and easier to manage than certificates (my current SSH solution). It’s reasonably secure and it’s open source. I’ll report back later on the ease of installation.