may maym

Crosspost: My impressions on the new “sex-positive social network” Blackbox Republic

2009-12-14T19:46:34Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

This post was originally published on my other blog, a much more Not Safe For Work site, at maybemaimed.com. However, it turns out that blog is censored in various countries, such as Dubai. Gotta love Internet censorship. Sigh. Anyways, since I think the material there is interesting and technology-relevant, and in order to help people avoid Internet censorship, I’m cross-posting the contents here. Enjoy.

Social media. Internet publishing. Privacy. Three phrases that have seemed to be at tenacious odds with each other in a multitude of subtle and not-so-subtle ways. For people like me, who have progressive views about sexuality, these three things are constantly on our minds. How do we participate in the online revolution without being forced to “come out” about every sex act we enjoy, some of which are still illegal thanks to draconian restrictions on sexual freedom, even (and especially?) in America.

This month, a new social network called Blackbox Republic (BBR) is attempting to tackle this head-on and aims to create a place for, as Marshall Kirkpatrick put it, this particular large and unserved group of people. Although BBR is clearly a business, it’s a business whose creators have laudable intentions for positive social and cultural change. In that respect, and in many others, Blackbox Republic is worth a close look.

I was informed about the venture via Clarisse Thorn many months ago. I got in touch with BBR and signed up for a limited-offer “founder” account—basically a private beta. The founder account gave me free access to the features of the BlackboxRepublic.com website for what would normally be a $25 monthly subscription fee.

So, without further ado, here are my impressions about Blackbox Republic, and how its launch may be just what the Internet needs to get us moving in the right direction with regards to personal privacy, and mainstream awareness of the different needs of different people on the Internet.

Mainstream sex-positivity or a VIP room in cyberspace? Or both?

Over the past few months, Blackbox Republic has been building a marketing arsenal of anticipation and intrigue. Its creators are successful in non-sexuality-focused spheres of influence: Sam Lawrence is the respected former Chief Marketing Officer of Jive Software, Inc., and April Donato, has experience in community management. They also both jive (pun!) well with the sex-positive movement, discussing it at length in the early stages of their marketing efforts after de-cloaking the new company.

In an interview for Social Networking Watch, Sam Lawrence said,

[Sam Lawrence:] The co-founder [April Donato] and myself are part of [the sex-positive] community. Sex positive means that your sexuality is not an issue. You don’t have an issue with other people’s sexuality. You’re open to what other people are interested in and what their boundaries are, and you’re open with your own.

[…]

[Interviewer:] To what extent do you practice a sex-positive lifestyle?

[Sam Lawrence:] From the perspective of sex not being an issue, I think that love is generated by people being open enough about who they are as people to put all of themselves out on the table. As far as putting all of myself on the table, it’s something that I do every single day.

I have an enormous amount of respect for anyone able to so capably present themselves as authentically as Sam does. On the eve of KinkForAll New York City 2, I met Sam and April at one of their “founder meetups” and had the chance to talk to them face-to-face. Our conversation revolved around the importance of steadfastly holding true to one’s own desires and having appropriate places to express those things with appropriate communication tools. I really liked their emphasis on self-identification over labeling throughout our discussion.

I also really appreciated the way that Sam and April spoke about their target audience. Blackbox Republic will welcome everyone, but it’s not designed for everyone, and I think that’s a good thing. David Evans writing at Online Dating Post says,

BBR has room for everyone, but is not for everyone. Definitely catering to non-mainstream folks, it will soon feature a constellation of micro-communities, or groups, called Camps. BBR doesn’t tell people how to organize their camps; we’ll do it ourselves, thankyouverymuch.

So is Blackbox Republic a dating site, or a social network? Well, both, kind of. Part of BBR’s slogan includes, “Dates will happen. Sex will happen. It matters how you get there.” The implication, of course, being that the current suite of tools for finding love or play online—sites like Alt.com, OkCupid, and countless personals boards—focus too strongly on the end result, turning matchmaking into a meat market instead of the natural process of getting to know one another. The focus BBR is placing on each person’s “journey” is an extremely welcome paradigm shift in the online dating world.

Along with the welcome and (IMHO, painfully obviously better) new approach to online dating, however, Blackbox Republic faces some real challenges. For new users, the service costs a minimum of $5 a month to use (and $9 per month for new sign-ups starting in 2010), which gives access to basic features like a personal profile. For $25 a month, members get added features like the ability to list real-world meet-ups, send private messages, and partake in a virtual “gifting” economy (think LiveJournal’s “virtual gifts“).

For that reason, BBR has been called a “members-only club.” There are some legitimate differences of opinion as to whether this is a positive or a negative thing. In a press release over the summer, Blackbox Republic is reported as stating:

Blackbox Republic will be a members-only experience that will unite the sex-positive community and give them a personal, private and secure way to connect online and in person.

Writing for ZDNet, Oliver Marks likens Blackbox Republic’s approach to online dating to the fashionability of owning an Apple computer:

Think of Blackbox Republic as a fashionable online ‘members-only’ club where you might expect to meet people with similar interests to your own, and ideally the person of your dreams. […] Blackbox Republic is arguably an Apple product to Facebook’s Windows look & feel: a much more intimately crafted, fuller featured personal user interface which should appeal to Apple generation sensibilities.

Many pages on Blackbox Republic's website showcase fashionably dressed women.

Indeed, almost everything about Blackbox Republic’s marketing and design seems to me as though it’s positioning itself as the equivalent of the hip, new, and exclusive nightclub down the street. There are images of super-chic women in short skirts and tight pants all over the Blackbox Republic promotional pages—way more than there are pictures of men. I was (yet again) put-off by this over-prevalence of women in all advertising material.

This isn’t really a criticism of the site, but rather a statement of disappointment that the marketing gurus behind the effort seemed to me to have succumbed to overwhelming cultural pressure to sell their site with old-school sex appeal: women’s sex appeal, of course. How…traditional.

Not only is the Blackbox Republic intro video markedly gender-skewed, but somewhere along the line Sam and April decided to drop the “sex-positive” phraseology from their marketing:

[L]ike most startups, Blackbox decided it needed to change up. Observers were confused by the sex-positive label.

Oh well. I think this just goes to further showcase how much more social change we really need in our culture.

However, while the clubby, cliquey feel is totally my own subjective perception, there are other issues at play here, too. Most notably, as Clarisse Thorn and many others rightfully remind us very often, the sex-positive movement is overwhelmingly white, middle- to upper-class, college-educated, and privileged in a huge number of ways that many people often take for granted. Even without a for-pay social network, not everyone who wants to can participate in the great-sex-for-everyone party atmosphere of many sex-positive niches.

Will creating a “members-only club” of sex-positivity on the Internet really be a positive thing for “the movement”? Well, maybe. Although it has the potential to exclude lower-income people from the experience, who are sadly also often the people with the most pressing need for the kinds of privacy-related tools BBR offers (school teachers spring to mind!), one upside is that Blacbox Republic promises to pledge a portion of membership dues to a charity of the user’s choice.

It’s $25 a month and $5 of those community dues go to charity. One way to think about it is if you’re sex-positive, you can either spend money on expensive coffee every month or upgrade your social life and meet other sex-positive people like you.

Inescapably, the major selling point of any social network is, of course, the network! If your friends aren’t on Twitter, then you’re probably not going to find it useful. The same truth holds for Blackbox Republic: if the users you want to interact with aren’t there, I doubt you’re going to find the experience fruitful. Due to the membership fees and the socioeconomic realities of the sex-positive community, I’m concerned that BBR’s current business model is too exclusive, and as a result it will have a lot of trouble attracting the kind of diverse community its creators seem to be hoping for.

Yet, some others think differently (pun!). For instance, Dennis Howlett welcomes the for-pay model for a social network:

anyone can join provided they’re willing to pay the $25 a month (I like that he has a pay model from the get go. That sorts out the weirdos and hangers on from day one)

I wonder if adopting a free-mium approach might work better. Still, there are real-world limits to business. Everyone needs to make money, and I don’t think Blackbox Republic’s business model is inherently more exclusive than, say, purchasing access to porn. If anything, BBR’s got some real promise to inject much-needed financial awareness to the sexually insensitive corporate infrastructure of our society. Nevertheless, convincing people to join “the Republic” is going to be a hard sell.

Show me the features!

Let’s say you do decide to join. What do you get? Other than the sex-positive mindset, what’s the benefit?

Well, the bulk of the experience is what you’d expect. Profiles (called “personas”), messaging, user search capabilities (called “explore”), and so forth. A Twitter-like “activity stream” dominates the main page where you can post text, picture, or video status updates. Event listings fill the sidebar. (I’m not going to provide internal screenshots in deference to BBR’s strict confidentiality rules.)

While that’s fun, it’s nothing special. What makes Blackbox Republic different is flexibility, and privacy.

Goodbye drop-downs, hello sliders!

An innovative new interface acknowledges (most of) the diversity in human sexual experience and desire.

Blackbox Republic’s most visible feature is the way its interface allows you to flexibly self-identify various facets of yourself. Rather than give you static drop-down menus or radio buttons for things like your sexual orientation and relationship status, you’re presented with sliders you can change at will. Perhaps you’re feeling particularly same-sex attracted one day. Just move the “Orientation” slider towards the “Gay” end and away from the “Hetero” end. If that changes tomorrow, just move the slider back. Sho-weet!

BBR offers you 5 different sliders for your profile. In addition to the one for sexual orientation, you also get one for relationship “status” (ranging from attached to unattached, with Facebook’s famous “it’s complicated” neatly in the middle), whether you’re available for more partners or not, how comfortable you are with casual sexual activity, and how eagerly you’re looking to par-tay. I’m instantly reminded of FetLife’s innovative, if dull-looking, mechanism for specifying multiple relationships. Blackbox Republic gives you similar flexibility as FetLife does but presented in a superb and far more intuitive interface.

All that said, one slider is conspicuously missing: the one for gender. The sliders are a very interesting idea and might just be the most innovative feature of the entire site. It speaks volumes about the sensitive and thoughtful mindset of the developers, and that’s why I’m so disappointed that the interface for self-identifying gender is relegated to the Sex 1.0 days of a single, binary option of “male” or “female.”

What gives? Are polyamorous people more welcome here than those who don’t fit the gender binary? I hope this is simply an omission that will be fixed as the service matures, since I couldn’t find any other reason why gender was absent from the sliders. For extra credit, I hope to see different profile options for “Sex” and “Gender,” two distinct concepts that frequently and incorrectly get used interchangeably. This would make it possible to represent complex gender presentations like additive gender on a social networking interface for the first time ever, and that’d totally be something to write home about!

Privacy and security

The other major selling point of Blackbox Republic is its careful attention to privacy. The entire offering, including its name, is predicated on letting users very carefully segment their information based on their privacy boundaries. I love some of the things BBR has done to enable this, and I can only imagine it’s going to get better from here.

Blackbox Republic’s Web of Trust

There are three levels of privacy, which (as far as I can figure out) map directly to the level of trust other members have gained within the Republic’s community. It works like a web of trust. New users are “un-vouched.” As they begin to interact with others on the site and, hopefully, make some friends, they should receive “vouches”—or votes of trust—from previously-vouched members. As a member, you get to control whether something you do, such as posting a status update, gets sent to the “public,” (i.e., the entire public-facing Internet), to all Blackbox Republic members (i.e, to both vouched and un-vouched members) or only to vouched members.

Additionally, privacy settings allow you to specify whether you want to allow un-vouched members to send you private messages, to follow your updates, to comment on your posts, or to see you in search results.

Unlike Facebook, which has very good privacy controls that almost nobody on Earth is aware of (thus negating the control’s usefulness), Blackbox Republic makes it a point to highlight their privacy controls at just about every sensical turn. Each of the settings I found defaults to the most private setting, not the most public, which is exactly the right move. I gotta say, I found turning off privacy settings instead of having to turn (or leave) them on to be a really empowering feeling.

You’re not a “friend,” you’re an acquaintance!

Moreover, the Blackbox Republic platform makes a native distinction between “friends” (again, like Facebook, or FetLife) and “followers” (like Twitter). When I friend someone, I’m connected to them in a way that I’m not if I just follow someone. I’m not yet certain what the practical distinction between “friending” and “following” are, other than the fact that your view of the people you’re connected with is segmented based on which button you clicked, but I think the distinction is a very appropriate and natural one to embed in the software.

This separation is probably the single most important innovation in the space of social networks as a medium of communication and collaboration that I can point at. I love that I can indicate without ambiguity which people I want to remain in constant communication with and which I simply want to watch from a distance. After all, aren’t at least some of your “friends” on Facebook really just “acquaintances” in reality? I think that for the first time ever in a social network, Blackbox Republic gets this feature right. Now, if only I could figure out what it actually does. :)

What? No on-the-wire encryption?!

With all that being said, there’s still at least one really frightening problem with Blacbox Republic’s careful attention to privacy: as far as I could tell, no part of my session is SSL/TLS encrypted!

Stunningly, for a site that sells privacy, not even Blackbox Republic's login form is on a secure page.

The entire BlackboxRepublic.com website is served over HTTP, including the login form and—again, as far as I could tell—every page on the inside of the site. This means that it’s trivial for malicious people who don’t even have a Blackbox Republic subscription to intercept, eavesdrop, and modify my interaction with the site. They could watch—and save—private messages between me and one of my friends (or lovers!), for instance.

In Blackbox’s defense, I don’t know of any social network that protects you from this. FetLife is another example of a website that should seriously consider HTTPS-only pages, but as of this writing hasn’t implemented it. Therein lies one of the most frightening oversights in the entire social networking space: regardless of so-called privacy settings, everything you do on the vast majority of social networks, blogs, and other sites on the Internet are the equivalent of passing notes between friends in a classroom. Better hope that big bully who likes to steal your lunch money doesn’t open the note and read it himself while he’s passing along your login details!

The thing is, few other social networking sites place so strong a spotlight on user privacy and security. Since Blackbox Republic seems to be nobly and rightfully holding itself up to a new standard of privacy, I feel justified in pointing out this glaring omission in their service offering. Given everything else they’ve done so well, and how well-aligned the majority of their technical implementation seems to be with their philosophy, this omission came as a big surprise to me.

Until Blackbox Republic only serves HTTPS traffic for all private areas of their site, I can’t make a recommendation in good conscious that it’s the place to be for privacy-conscious people. But again, despite public opinion to the contrary, I’ve never been able to make that claim for FetLife either.

Conclusion

Blackbox Republic is one of the most interesting websites on the Internet today. Its privacy-conscious and sexually open approach to social networking and online dating deserves huge praise. Its technical implementation—although plagued with some glaring oversights for now—is to be seriously respected.

From a social change perspective, I think the site is a mixed bag. Its exclusivity arguably makes the insularity of the sexuality communities an even bigger problem than it already is. On the other hand, the market-value of that very same exclusivity, if steered toward a benevolent purpose, can end up benefiting philanthropic, non-profit, and other sex-positive endeavors that often struggle to find necessary financial support.

Moreover, Blackbox Republic’s internal gifting economy does seem to encourage a sort of altruistic nature among members. How that may or may not translate into increased support for non-commercial activists has yet to be seen. Nay-sayers should remember that this kind of thing simply hasn’t been done before and the net effect could be quite positive.

Having just launched, however, I don’t think Blackbox Republic should be touted as the go-to site for sex-positive people quite yet. Like other social networks, it needs to grow to become truly useful, and its subscription fee business model poses a serious obstacle to many people. I was fortunate to get in with a free “founder” account, but I have mixed feelings about encouraging my friends to join me knowing they—or someone nice enough to “gift” a limited-time subscription to them—will have to pay for the service.

Additionally, its focus on being, well, a black box and its commitment to not allow Google or other search engines to index its internal content simply doesn’t resonate that strongly with me.

Lawrence emphasizes that what members say in Blackbox Republic will stay private. There’s no danger of what they post inside becoming part of their “Google resume,” as he puts it. He says he would resist efforts from search engines to index content the way Facebook and Twitter allow. “The value proposition is this is the first private, large social network out there,” Lawrence says.

Put simply, and noting that I’m probably not the majority case here, I rely on my “Google résumé,” to use Sam’s words, to live the life I want. My lukewarm reaction to this isn’t a criticism of the goal, simply an observation that it turns out I’m not in the ideal target market for Blackbox Republic’s value proposition.

In other words, I think I’m “too out” for this site to be immediately useful to me. The fact that FetLife is not readily available to the public Internet is the single biggest reason why I don’t sign on to that site very often, and so I have the same reason not to spend all that much time behind the curtains of Blackbox Republic.

Nevertheless, many other people do. If you’re among the cross-section of the populace who’d like a sociosexual experience online and would also like to effectively outsource your social reputation management, if you will, but you feel that sites like Facebook just aren’t cutting it, then Blackbox Republic is definitely worth checking out.

If you do check it out, or even if you don’t, I’d love to know what you think in the comments. And if you’re definitely sold, consider signing up via my partner link. Full disclosure: signing up that way earns me a small commission. If you’d rather sign up but not give me a commission for the referral, just register from the front page.

What Kind of Man

2009-04-30T14:09:13Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Over the past month or so, several people with whom I am close—either because we were once close and reconnected, or because we are newly close—have remarked on the jewelry I wear. I have five thin chain bracelets; one around each wrist and ankle, and a fifth closely fitted at my neck. I remember the nights Sara put them there.

“You’re still wearing these,” each of these friends said to me as they slipped a finger underneath one of them.

“I know,” I reply each time. “I’m still figuring out how much of them are me, and how much of them are Sara.” Who am I today, without the life I thought I’d have?

New York City has been a difficult place to be in. Instead, I have spent much of my time North, shuffling between Boston and Providence. The “organized” Boston communities are vastly divergent from The Scene that I am used to. I like the differences—I like that they exist, and that one place is different from another—even if I don’t like all the specifics.

In Boston, I attended the second NEPups.org puppy munch. I went with a friend and met a few gay pups and a kitty girl, and I spoke about queer masculinities and how uncomfortable I feel in the gay communities I’ve tentatively explored. I have never been gay, and I still feel a twinge of discomfort “admitting” to bisexuality in such spaces.

I have a growing connection to Providence. In large part, this is due to the people I’m coming to think of as the sun girl and the metal boy. They are young (younger than I am), which for the first time in my life is a notable thing. They live in slow time and enjoy the physical world in ways that are not entirely new yet not entirely familiar to me. There is much of Sara—a goodness and comfort—in each of them.

The metal boy in particular has been a quiet revelation for me. I find myself more unsure around him than I would have thought, as though I am younger, less experienced, more hesitant. I’ve been sexual with other men before but only now, after being with him, can I wholly and without silent reservation answer “Yes” to the still often asked question, “Are you really bi?” The sun girl, for her part, is in many ways a pure blessing. She is magic and warmth and a grounding force that has helped me move forward.

My trip to San Francisco these past five days proved useful but disappointing. It’s now obvious to me that the plan I had conceived before I left Sydney and which I so steadfastly tried to make happen despite the financial and emotional burdens of losing my relationship with Sara will not actually work. I’m thankful that I met with several other friends who have each generously offered support and crash space for my planned arrival time in late June. It may have perhaps been destined for me to be alone (but not isolated) when I arrive in San Francisco; it’s been almost a decade in the making for me by now.

I’ve been to San Francisco twice before this trip, but I’ve never been so happy to leave it before. I am still determined to move there, but as I write this in my airplane seat somewhere over the landlocked middle of the continent, I find myself eagerly awaiting a return to Providence. I can’t stay on the East coast, but I can’t leave. Not yet, not when there is still so much for me to do here.

My thoughts are consistently drawn to productive pursuits; my second CSS book, my sexuality projects (KinkForAll.org and MaleSubmissionArt.com). I feel strong in ways I’ve never felt before: I bend the world. I change reality. I can.

But I’m still so, so sad, and so, so pained. I don’t cry every day anymore, but I do feel overwhelmed by it. I suspect that, in part, Sara left me because I am so driven by the things I need to change rather than the things that work. Some parts of me want to reach a point where I’m no longer fueled by things that way, but other parts of me doesn’t. As one Bostonian friend fondly reminds me, “All progress is the work of unreasonable men.”

I speak about KinkForAll so often everywhere I go that I’m uncertain whether I’ve latched onto it or if it has latched onto me. I fear for it like a father fears for a child growing too fast and yet I keep pushing it out from underneath my own auspice because I know it can’t ever be what I want it to be without experience in the world. The weekend after I was in Boston, KinkForAll Boston was set into motion by the people I spoke with there and now I am determined to be a part of it.

In the mean time, I am also thinking and becoming increasingly excited about the Sex 2.0 presentations I will give on May 9^th. In particular, I’ll get to meet the likes of Sarah Dopp, one of the inspirations for the Gender and Technology presentation that was accepted (and seems to be in increasingly high demand) at the Sex 2.0 conference. I’m just learning to speak with the people I admire to that degree, and in a week and a half I’m going to stand up and present my own version of the very things they inspire me to be. I will feel like I am standing in front of the very giants whose shoulders I stood on when I was across the planet.

So again, I ask myself, who am I? What is my sexual submissiveness without the dominant presence that revived it when I had given it up those four long years ago? What is my career when I have achieved, for me, an unprecedented level of recognition after 8 long years of being in the workforce? What is my contribution to my own future, and to people like me who are still young children today?

What kind of man am I if so much of the world I live in refuses to see manliness in what I am? Because today, having considered the possibility that I was perhaps a woman at earlier stages of my life, it turns out I am a man. And I am going to make the world know it is good to be the kind of man I am.

Now it’s all the little things

2009-03-12T21:54:23Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Immediately after arriving in New York City, I turned myself into a tornado of work and worry in order to make sure KinkForAll was the success I desperately needed it to be. To my indescribable relief and happiness, KFANYC wasn’t just a success, it smashed through even my wildest expectations, topping at 45 presentations with well over 100 participants physically present and countless others watching the online feeds. (I was so worried about presentation shortage, I prepared 4, but only ended up needing to present 1. Likewise, I originally thought we’d top off at maybe 35–45 participants, and in the end one of our biggest problems was simply lack of physical space!)

On that front, I’m now looking at the amazing possibility of helping people in sexuality communities who have contacted me from Washington DC, Toronto, and San Francisco emulate the success of New York City’s event in their own hometowns. But not yet…. Not quite.

As the unconference ended, Sara and I were joined by a group of over 20 friends (and friendly acquaintances) for dinner at a nearby Asian restaurant. Despite my hunger (I only ate at the behest of my concerned friends during the day ’cause I was so busy), I didn’t want to finish my meal; I knew that would be the end of dinner, and the day. Nevertheless, day turned to night and as Sara and I walked around the corner for a modicum of privacy, excitement gave way to sadness and we said (temporary) goodbyes in tears.

I retreated from the city then, headed towards Providence, Rhode Island to stay with close friends who generously offered me the opportunity to create a small sanctuary in their spare room. This has been helpful, and I can begin to feel myself recovering, but I’m still having trouble grounding myself in the here and now or focusing on the new tasks at hand. For one thing, there are so many, and for another thing, they are so vastly different from what I’ve just done that mentally changing gears so radically, so quickly, under so much pressure, is actually painful.

When I moved my self and my life half way around the globe to Sydney last year, I felt optimistic about what I would find. Sadly, I didn’t find what I wanted. Now, having moved myself and my life all the way back across the planet and then some, I’m determined to make what I want—because it doesn’t exist yet, and no one knows what it’s going to look like…except me.

My hosts, Emms and Zac, are nothing short of a godsend. They are literally a healing warmth of a magnitude I could not possibly express adequately in words. Unfortunately, shortly after arriving in their home, I fell ill. Of course, this is not at all a surprise considering my physiological history for exactly such mind-body connection.

My attempts to focus on my writing (for my second and much more advanced web development book on CSS I’m authoring; my first book was much more 101-level) have been only partially successful, but I’m encouraged by this anyway. As Emms told me last night while cooking a pasta dinner for us all, “Comfort yourself with the standards of the world,” a piece of advice she wisely preceded with, “Now’s the time to focus on only the most important parts of your chapters.” This, all while taking my hand every time my eyes unexpectedly overflow with the salt water I feel like I’ve been storing up in them.

I’m a little…not annoyed…chagrined at the admission that yesterday was the first full day in more than 4 weeks that I didn’t cry at all. Not only this, but earlier today while my hosts were at their day jobs and I mainlined enormous quantities of tea as though it were a blood transfusion, I couldn’t stop myself from crawling backwards in time towards happier memories. I cried again, embarrassingly loudly since no one was home, and resigned to let my head rest for a while instead of forcing it further into failing attempts to create reusable patterns of CSS code for styling semantic markup.

To help with the memories, I’ve been playing MGMT’s Kids on repeat for what must be an hour or more now. I first heard it on Australia Day (apparently Australia’s almost-equivalent of America’s Columbus Day), which Sara and I spent with Janek and company at his house on a tropical, warm, rainy day in Sydney. The radio was playing all day but the only song I remember was this one because, somehow, it stood out like a spotlight. I remember laying on the couch in the living room with my head in Sara’s lap, eyes closed, as she pet my head and I purred along with the kittens in the far corner of the room. The memory is emblazoned in my mind’s eye as a vivid still frame.

When Zac came home and gave me a hug to comfort my tears, he remarked on the song. “It’s always weird to hear this song,” he said.

“Why?” I asked.

“Because Emms and I went to college with them—the band.”

And now I have two memories.

Too many tears: My first morning back in NYC

2009-03-07T15:24:35Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

A few minutes ago I awoke in a friend’s bed in their apartment in Harlem. I wanted to do nothing but stay there and not get up. I feel like there is too much to take care of, way too much to handle.

My flight from Sydney to New York City was less than good, better than terrible. I already knew I hated United Airlines, now I’m just more committed never to flying with them again. More than that, I’m frustrated that my flight was so dependent on choices Sara’s family made for her without consideration for me. If little else, I’m happy to be finally out of reach of their influence.

It’s been weeks, literally, since I haven’t cried at one point or another, usually multiple, in the day. I’ve been falling asleep in either tears or unmatched stress and restlessness—each has benefits over the other. Last night was no different.

Today I have errands to run for the KinkForAll New York City event I’m helping to run tomorrow. I’m extremely proud of the work Sara and I have managed to accomplish on it not only for the first time ever in our lives but also literally from the other side of the planet.

Simultaneously, I’ve been chasing and feeling continually frustrated by failing to make significant-enough progress on writing my book on CSS. My co-author Joe has been fantastic, and one particular employee, Clay, from the publisher has also been equally supportive. However, the rest of this project feels extremely precarious and that is endlessly aggravating.

It’s aggravating because it was a project I sincerely wanted to see done well, and have been working toward for a long time. I quit my day job something like 6 months ago now in order to focus on getting it accomplished successfully, but I am now further behind than I was then. Despite my best efforts, life kept throwing me curveballs to the point where I already know it’s not going to be the book I wanted it to be. I’m extremely angry at…everything…for that.

As if that weren’t enough, as many already know by now, Sara and I are no longer together, for reasons I’d rather not discuss quite yet. As painful as this would be in general, this is even more painful when seen in light of the fact that it’s one of the reasons my book has suffered. The book isn’t some great money-maker for me, but rather an opportunity for professional exposure and recognition that I’ve been working towards for 8 years—that’s how long I’ve been making money in the web development industry. To have that opportunity suffer pours salt into wounds that moving to Sydney in the first place had already re-opened and which the loss of this relationship is a 3^rd degree burn.

All in all, I’m struggling to keep professional commitments afloat, organizing a first-of-its-kind unconference for the sexuality communities in New York City, ending a 4-year relationship (with the person I’m organizing the unconference with), and moving across the planet. All. At. Once.

I want to change the channel off of this ridiculous soap opera, but can’t. Instead, I keep playing everything in fast-forward in my head until I can again see a point somewhere in the hopefully not too distant future where everything I’ve worked on is successful and I’m peaceful once again. Please let that day be soon.

Buy Web Development Books from SitePoint’s 5-for-1 Sale and Donate to Bushfire Relief

2009-02-10T13:06:41Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

For those of you who don’t already know, I’ve been a blogger over at SitePoint for a few months now. Today, I’m even happier to be a participant in the SitePoint community because, for a limited time only, SitePoint is offering the sale of the century: buy 5 SitePoint books for the price of 1. Every last cent of the proceeds from the sale of these books will go towards relief efforts for the recent Victorian bushfires that have claimed over 300 lives and are among the worst fire disasters on record.

The books are full-color PDF downloads, and include some really awesome titles. These are precisely the kinds of books you want as PDFs, too, since you can search through them and always keep them with you while you’re coding and looking for inspiration or a reference (even when you’re without Internet access). I couldn’t help but pounce on this deal, and I’m now the proud owner of the following books, which have all received some pretty great reviews:

In just 3.5 hours, SitePoint has managed to raise over $15,000 AUD, according to employee Kevin Yank on Twitter. And that’s just on this side of the world. All my North hemisphere friends were asleep when this was announced, but not to worry. SitePoint’s sale will last until this Friday, so there’s plenty of time to take advantage of it.

Obviously, I think you should do so. Not only are you getting some really quality content and helping disaster victims at the same time, you’re also sending a loud and clear message that companies whose humanity outshines their accounting are the ones you’re going to support. I’m thrilled to see that SitePoint is one of these human companies, and ever more thrilled to be a part of it.

clickjane.css: A CSS User Style Sheet to Help Detect and Avoid Clickjacking Attacks

2008-12-29T10:31:09Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Clickjacking or, more formally, user interface redressing, is a class of security vulnerabilities similar to phishing scams. The technique uses web standards to trick unsuspecting victims into performing actions they were not intending to.

Clickjacking does not rely on bugs in any software. Instead, the technique is simply an abuse of the growing graphical capabilities that advanced web standards like CSS provide to web browsers. A good introduction to clickjacking is provided by Steve Gibson and Leo Laporte on their Security Now! podcast.

As far as I’m aware, only Firefox when combined with the NoScript add-on and Internet Explorer when combined with the GuardedID product provide any measure of protection against clickjacking attacks. To date no other browser can detect, alert, or otherwise help you to avoid or mitigate the risks of clickjacking attacks.

That said, there’s gotta be something users of other browsers can do. Well, it may not be as much as what NoScript can do, but there is something: use a user style sheet to help expose common clickjacking attack attempts.

`clickjane.css` helps detect clickjacking attacks for all browsers

Until browser manufacturers provide built-in protections against clickjacking attacks in their software (which is arguably the best place for such logic in the first place), I’ve started putting together a user style sheet I’m calling clickjane.css that attempts to instantly reveal common clickjacking attempts. Since it’s a CSS user style sheet, this approach should be cross-browser compatible so that users of any browser including Safari, Opera, and other browsers that don’t have other means of protecting against clickjacking attacks can use it.

I’ve only recently learned about this class of exploits and so I’m not supremely well-informed on the topic. As a result, the clickjane.css file is relatively sparse and currently only reveals what I’m sure is a small set of clickjacking attmpts. However, as I research the topic further and learn more about the actual underlying HTML and CSS that clickjacking uses, I’ll be updating the clickjane.css code to reveal those attempts as well.

Naturally, contributions and assistance in any form are most welcome! Learn more about clickjane.css as well as how to use it at the Clickjane CSS Github wiki.

Before and after `clickjane.css`

Here are two example screenshots of a benign clickjacking demo.

Before:
Screenshot of Safari before clickjane.css is used to expose clickjacking attempts.
After:
Screenshot of Safari after clickjane.css is used to expose clickjacking attempts.

Good habits you should get into to mitigate clickjacking risks

Here is a list of behaviors that you should make habitual while you browse the web. Engaging in these behaviors can dramatically reduce the likelihood that you will be victimized by a clickjacking attack.

Explicitly log out of any service you have logged in to when you are done. That log-out button is there for a reason: use it!
Avoid providing your browser with “Auto-Complete” information for critical sites, such as your bank.
Make sure you are running Flash Player 10 or greater, which mitigates this vulnerability for Adobe Flash content.

More resources to learn about clickjacking

Hackademix.net - More clickjacking links to the OWASP presentation, the white paper, and a blog post showing several CSS-based exploits.

Introducing KinkForAll: A no-limits gender and sexuality unconference

2008-12-18T04:07:56Z

This is crossposted from one of my other blogs. Read the full post for more context.

As if I didn’t have enough projects going right now, while here in Sydney, Eileen and I had an idea for a social and educational event that will promote positive ideals of sexuality from and to many communities and organizations. The idea is called KinkForAll, and I need your help to make the first KinkForAll event a reality this March. Below is the 411 on KinkForAll as well as links for where to learn more.

Most of all, I need your help to spread the word that KinkForAll event exists. To that end, please copy the flyer text below and post it on your blog(s), send it to any mailing lists you belong to, talk about it to your friends, and generally help get the word out. For this hugely beneficial movement to succeed, it needs enthusiastic participants on the ground—and that’s you!

Here’s the flyer text to copy:

PLEASE COPY AND CROSSPOST THIS MESSAGE FREELY.

If you have already heard about KinkForAll through the grapevine, then please consider this email a reminder. If you haven’t, then please take a minute to scan this message. You’re receiving this message because someone trusts you to read it with an open mind. Smile! :)

Vitals

======

What: A no-limits sex-positive gender and sexuality unconference.

Why: To inspire a creative, interactive and open environment where everyone feels comfortable talking, learning, and being inspired by all kinds of sexuality.

When: March, 2009 (exact date yet to be determined)

Where: NYC (We’re still looking for a venue! Can you help? See ‘Get Involved,’ below!)

Who: Everyone

How much: Free (as in beer as well as freedom)

Details

=======

KinkForAll is an ad-hoc gathering born from the desire for people of the kink, queer, sex-positive and related communities to share and learn in an open environment. It is an intense event with discussions, presentations, and interaction from all participants. (It is inspired by the BarCamp community.)

ANYONE WITH SOMETHING TO CONTRIBUTE OR WITH THE DESIRE TO LEARN IS WELCOME AND INVITED TO JOIN. When you attend, be prepared to share with others. When you leave, be prepared to share it with the world.

A KinkForAll is a special kind of gathering because there are no spectators, only participants. Attendees must give a talk or a presentation, help with one, or otherwise volunteer/contribute in some way to support the event. This is called sharing and we like it. All presentations are scheduled the day they happen—there are no pre-scheduled presentations or keynote addresses. The people present at the event will select the presentations they want to see.

Anyone can present, on any topic related to sexuality. You do not necessarily have to teach a new skill or idea. You might share an experience, review a product, or read a poem. The goal is to start a discussion, make connections, and exchange knowledge. Presentations promoting specific commercial products or companies are discouraged.

Learn more about what to expect at

http://kinkforall.pbwiki.com/WhatToExpect

Learn more about the event guidelines at

http://kinkforall.pbwiki.com/TheRulesOfKinkForAll

Get Involved

============

We need your help in spreading the word. Please help by participating. Here’s how:

1. Get excited by reading the ideas on http://kinkforall.pbwiki.com/KinkForAllNewYorkCity

2. Add your name or handle to the list of participants

3. Join the mailing list and introduce yourself by emailing kinkforall@googlegroups.com

If you have access to a venue, or know someone who has access to a venue, please email the kinkforall@googlegroups.com mailing list with that information.

Still have questions? Read the Frequently Asked Questions at

http://kinkforall.pbwiki.com/FrequentlyAskedQuestions

or email kinkforall@googlegroups.com for more details.

KinkForAll Online

=================

Participate online before the event at your favorite social networking web site.

Homepage: http://KinkForAll.org

Google: http://groups.google.com/group/kinkforall

Twitter: http://twitter.com/KinkForAll

Identica: http://identi.ca/kinkforall

Facebook: http://www.facebook.com/pages/KinkForAll/40066342762

All primary organizational efforts are being coordinated via the mailing list. Join for free and help turn ideas into realities!

http://groups.google.com/group/kinkforall

Why CSS needs delegation capabilities and not “variables”

2008-12-14T07:55:07Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

It’s been too long since I joined the fun, if amazingly heated, debates over the direction that Web standards are moving in. Recently, given the “free” time to do so, I decided to dive head first into what is (sadly) an almost 14 year old debate. The result is this blog post, which is mostly a response to Bert Bos’s essay Why “variables” in CSS are harmful and Matt Wilcox’s opposing response to that essay, Why CSS needs to borrow from programming languages. Their articles are each worthy of a read, possibly before this one.

Here’s the summary of my argument.

Adding many “programmatic” features to the CSS language such as variables, macros, or flow control is a mistake. However, CSS’s failure to simply encode visual relationships (instead of merely typographic properties)—a severe deficiency in the core language itself—requires the addition of delegation features. With the additional capability to reference an arbitrary element’s computed value regardless of its hierarchical context, CSS will be more accessible to both amateur and professional web designers, more capable, and will more forcefully promote the semantic Web and its ideals.

In this corner: CSS variables are harmful

Bert does a great job of summarizing the conclusion of his argument himself. In his essay, Bert says:

Adding any form of macros or additional scopes and indirections, including symbolic constants, is not just redundant, but changes CSS in ways that make it unsuitable for its intended audience. Given that there is currently no alternative to CSS, these things must not be added.

As we all know, one of the wonderful things about CSS is that the core language itself is remarkably simple. (What’s not simple is the spectacular way browser manufacturers have destroyed everyone’s hope that implementing CSS-based designs in the real world will ever be easy, but that’s a whole different can of worms.) Fundamentally, CSS’s syntax can be explained with a mere three major components: property/value pairs, declaration blocks, and rule sets.

What this means is that CSS as a language is stupidly easy to learn. I think everyone would agree that it’s certainly easier to learn than, say, JavaScript or XSL. Now, that’s important because, without putting too fine a point on it, Bert mentions multiple times that CSS’s “intended audience” are the diverse and likely relatively technically ignorant content authors that are responsible for the overwhelming majority of web pages on the public Internet today.

He makes the very good point that The value of the semantic Web isn’t defined by how well structured the best documents are, but by how well structured the vast majority of documents are. In other words, CSS needs to remain instantly useable and reusable to these untrained, amateur web content publishers for the benefits of self-describing documents (i.e., the semantic Web) to see mass adoption.

To wit:

reusing other people’s style sheets is more difficult if those style sheets contain user-defined names. Class names are an example. Their names may suggest why the author created them (assuming they are in a language you understand), but typically you will have to look at the document to see where they occur and why. Symbolic constants make that problem worse.

And, later:

For many people, style sheets with constants will thus simply not be usable. It is too difficult to look in two places at once, the place where a value is used and the place where it is defined, if you don’t know why the rule is split in this way. Many people are confused by indirection anyway and adding an extra one, in addition to the element and class names, has the same effect as obfuscating the style sheet.

Whether or not you believe Bert Bos is underestimating the average web designer, it’s pretty clear that these are really good points. Nobody wants CSS to be obfuscated, hard to learn, or hard to reuse. That’d just be crazy talk.

In the other corner: CSS variables are a real-world requirement

The more features you add to an application, a programming language, or indeed any software, the more difficult it becomes to grok it. As the Python people would say, the larger a language gets the more difficult it is to hold all of it in your head. Nevertheless, adding “features” is sometimes the only way to add capabilities, and I don’t think anyone in their right mind would argue that, once written, software should never change. (That’d just be crazy talk, too.)

In his opposing arguments, Matt Wilcox recognizes this when he says, Yes, the syntax should be simple, but the capabilities of CSS should not. What he’s alluding to without verbalizing it is the balance between adding necessary capabilities without unnecessarily growing the “size of the language.”

However, Matt says that modern web design methodologies (e.g., separation of concerns between structure, presentation, and behavior) dictate that CSS needs more capabilities than it currently has:

CSS lacks capabilities to allow truly flexible design, requiring layer upon layer of ‘tricks’ to accomplish certain objectives, requiring content to be structured ‘just so’ to achieve a display objective, or in the case of some designs proving instead to be completely incapable.

[…]

CSS’s positioning is a cludge. It’s a cludge because you can only position relative to the last positioned parent container. Well, that limitation in itself dictates that all positioning relies upon how the content is structured. And that means the presentation and the content are not truly separable.

To align CSS’s capabilities with the requirements of real-world web design objectives, he says, CSS needs to be capable of describing relationships between semantically and structurally arbitrary but visually related elements.

Visual design is fundamentally about relationships between elements. For all of the artistic flourishes and creativity, it’s about relationships. ‘That yellow’ only grabs your attention because of its contrasting relationship with ‘that blue’. ‘This heading’ only works as a heading because of it’s exaggerated relationship to the size of the body text. […] CSS has no clue about relationships, period. And that’s why CSS as it stands right now, is not good enough. That’s why CSS without variables (true variables), without basic logic, without maths, can never be as flexible as we need it to be.

This is what web designers have been complaining about for (what feels like hundreds of) years. The fact that CSS has no capability to describe presentational relationships between elements in addition to directly describing an individual element’s presentational properties is a gaping hole that sorely degrades its ability to be a media-agnostic styling language. Every single web designer I’ve worked with has gasped at this omission, and though at first I didn’t understand why, the more I understood the principles behind graphic design the more I came to realize how fundamentally problematic this omission really is.

Adding delegation makes CSS easier for designers

As Matt eloquently stated, design is all about relationships. Good web designers create designs by constructing visual elements that have strong, often exacting relationships with other visual elements. There are many names and examples for this: visual language, visual hierarchy, the golden ratio, the grid, visual balance, the typographer’s scale, and so on.

What happens when the designer tries to define a relationship between elements? “How do I say that the whitespace between element A and element B should always be the same? How do I define element A’s height as half of element B’s?” These definitions, which are natural and necessary to the way designers work in both their mind and their mediums, are impossible to encode in CSS.

The closest you can get is declaring the same values to each element’s properties, not describing the relationship itself. This suffices only so long as these values are known ahead of time and are the same as one another, which severely limits the design possibilities we are capable of (without resorting to what Matt calls “tricks”). That’s why achieving simple visual effects are actually very complex and so, sadly, that’s where you’ll find the majority of indirection and obfuscation in CSS today. (I’m looking at you, faux columns.)

So who wins?

Both Bert Bos and Matt Wilcox have made some great points. Bert rightfully wishes to keep CSS lean and simple, even at the expense of some arguably beneficial styling power. Matt, on the other hand, argues that our needs as web designers have evolved faster than the technology to the point where CSS is too limited, fundamentally so.

The truth is, they’re both right. And they’re both wrong. Or rather, they are each taking a position that is too extreme. Bert’s absolutely correct when says that many of these proposed extensions are redundant and harmful, and yet Matt’s also correct that CSS lacks some fundamental capabilities that designers expect to be present.

Bert says that the CSS capabilities everyone’s asking for can be implemented using techniques that don’t rely on CSS whatsoever. These techniques, he says, make things like true CSS variables “redundant.”

There are examples of CSS with constants to satisfy all styles of programming, e.g.: David Walsh (in PHP), Tedd Sperling (in PHP), Digital Web Magazine (in PHP), Eco Consulting (in SSI), and Christian Heilmann (SSI and PHP).

Quite simply, he’s correct in stating that programmatic features need not be added to CSS proper to achieve desired results, but he’s incorrect in his apparent thinking that designers will be able to use these other tools to leverage CSS. Take, for instance, the probably more familiar (though not linked above) notion of using JavaScript to manipulate CSS values.

var x = document.getElementById('SideBar'); // get #SideBar element
var y = document.getElementById('MainColumn'); // get #MainColumn
var z = document.defaultView.getComputedStyle(y, '').getPropertyValue('height'); // get computed height of #MainColumn
x.style.height = ( parseInt(z) / 2 ) + 'px'; // set #SideBar's height 1/2 of #MainColumn's

This is an example of programmatic code that uses variables and expressions. It sets the element with the ID of SideBar to half the pixel height of the element with the ID of MainColumn. It does this by obtaining the MainColumn’s height (at the time this code runs) and saving it in a variable, then performs some trivial math to half the value and use the result as the pixel height of the SideBar.

Doing this is currently impossible with CSS alone, yet it’s something that clearly belongs with whatever other “presentational” code exists and not in “programmatic” scripts that would otherwise be charged with defining “functionality.” As Matt states, using JavaScript to “script” solutions to CSS’s shortcomings like this is not an acceptable answer.

CSS doesn’t have [basic logic or maths]. Nor is it the job of JavaScript to make up for this lack of abilities. JavaScript is about interaction behaviour, and what we are talking about here is pure display logic. Not interaction logic.

Moreover, the place designers expect to put code like this is, of course, into a CSS style sheet. The way designers expect to put code like this into CSS is by adding delegation features. Requiring designers to learn JavaScript (or any other programming language) to encode such design relationships is nothing short of ridiculous. In what world is that easier for untrained laymen to understand than CSS?

Adding delegation to CSS is worth the effort

One of Bert’s arguments against such additions to CSS is that implementations would become harder to create, and that we’ll (almost certainly) see more bugs.

extending CSS makes implementing more difficult and programs bigger, which leads to fewer implementations and more bugs. That has to be balanced against the usefulness of the extension.

Although I do agree with his statement that an extension’s usefulness has to be balanced against its potential costs, I think something so fundamental to design methodology as delegation greatly overcompensates for the cost of such implementation efforts. Moreover, if I understand Bert correctly and as he also discusses, the majority of implementations that would need to implement such delegation already have relatively complex internal structures to make the implementation effort somewhat easier:

There is no scoping [in proposals that only define global constants]. That means that an implementation needs a symbol table, but no stack. A stack would require a little bit more memory, but mostly it would make implementations more complex. (Although every programmer has, one hopes, learnt to program a symbol table with lexical scope during his training.) Constants in CSS are thus easier than, e.g., XML Namespaces, which are lexically scoped.

It is different for those CSS implementations that provide a CSS Object Model (an API for manipulating a style sheet in memory). Those implementations do need to keep track of scope in some way, because adding or removing a line of the style sheet can make a previously redundant definition become meaningful.

In order to use JavaScript to solve many of the shortcomings of CSS, as huge numbers of professional web developers do routinely, we use the very CSS Object Model whose prior implementation already exists for us to build upon.

CSS delegation doesn’t grow the size of the language

For the sake of argument, let’s simplify our requirement somewhat so that our somewhat contrived example of design intent is to create a relationship between the MainColumn and the SideBar elements such that they are of equal height. This is more informally known as “making columns.”

Here’s what a natural, hypothetical snippet of CSS would look like if the language supported delegation features such that it could encode visual relationships.

#SideBar { height: #MainColumn; }

This code theoretically says almost the exact same thing as the JavaScript shown earlier (save for the division, of course); it takes the computed value of the MainColumn element’s height property and applies that value to the SideBar element’s height property. In other words, “The SideBar’s (element B’s) height is always the same as the MainColumn’s (element A’s).” (Of course, this is a parse error in reality today.)

This extremely trivial example has some remarkably far-reaching implications, and yet there is really nothing radical about its syntax. Making this a reality significantly expands the capabilities of CSS without dramatically increasing the size of the language. This capability would not only beat the pants off “CSS tables,” it also potentially obsoletes the arguably misguided efforts of the CSS3 Advanced Layout and Grid Positioning modules, too.

We’ve long since abandoned table layouts because they force us to use presentational markup. That’s still what “CSS tables” force us to do, too. In other words, with display: table, the SideBar needs to be a child of the MainColumn element or, maybe worse and more likely, a child of a semantically meaningless wrapper element.

CSS positioning was introduced with the promise of freeing us from source-order-dependent styling, without which there is no hope of efficiently abstracting presentation away from structure. Moreover, abstracting presentation away from structure is the single most important prerequisite needed to improve document reusability and strengthen the semantic Web. Absolute positioning works, but limitations elsewhere in CSS mean its use is problematic for many designs, so in practice it doesn’t gain widespread adoption.

Here’s a theoretical solution to a two-column and a footer layout using CSS delegation with this semantic HTML:

<body>
    <div id="MainColumn">I'm the main column.</div>
    <div id="SideBar">I'm the right-hand sidebar.</div>
    <div id="Legalese">No one will read me.</div>
</body>

The CSS would look extremely familiar, possibly like this:

#MainColumn { margin: 0 25% 1em 0; float: left; }
#SideBar { width: 25%; min-height: #MainColumn; }

Using the same HTML, the same solution using the CSS3 Advanced Layout module would look something more like this, although to be frank I’m not certain I fully understand this syntax even after staring at it for months:

body {
    display: "a  b"
             ".  ." /1em
             "c  c"
             75% 25%
}
#MainColumn { position: a; }
#SideBar { position: b; }
#Legalese { position: c; }

Not only does there seem to me to be far more indirection in this method than there would be using CSS delegation, there is also an enormous increase to the size of the CSS language: a new (ASCII-art?!) value to the display property whose syntax is clunky at best. A similar story can be said of the CSS3 Grid Positioning module, which does lots more than just add a new (already complex) gr CSS unit.

The upshot is that the Advanced Layout and the Grid Positioning modules are doing some of the right things in many of the wrong ways. Both those modules add unnecessary complexity to CSS without giving designers a natural way to say what they mean. They do more to introduce obfuscation and indirection than simple delegation would, and they aren’t as broadly capable. Both of them try to solve a specific problem instead of dealing with fundamental deficiencies in the toolset designer’s have to work with.

Designers want relationships via delegation, not variables

Adding delegation such as that I’ve just shown is a natural, necessary addition to CSS because it is how designers create visual components—such as grids—in their designs. Variables (and constants, and macros, etc.), which simply reuse and modify pre-defined statements aren’t what designers care about. Adding them will bloat CSS without adding useful functionality.

“Okay,” you may be saying to yourself, “but delegation is itself a kind of variable, isn’t it?” Technically yes, however adding delegation resolves the core deficiency in the CSS language that designers need to use every day. Yes, it’s technically a form of variable, but that’s not how designers think of it. To say that one element’s visual properties is like another makes a variable only by creating a logical and visually appropriate mapping from the first element’s property to the second independent of markup, thereby avoiding indirection in the form of a variable name or other unfamiliar symbol.

Delegation like this doesn’t require the addition of anything other than what already exists in CSS. Class names and ID values are identifiers whose indirection people already have to deal with. Using them for delegation (to reference another element’s style) doesn’t increase the cognitive load any more than using them to reference HTML elements does. Though untested, the cognitive load might actually be even less since the CSS delegation’s references could be in the same (style sheet) file.

Moreover, delegation will increase the likelihood of document reusability by enabling style sheets to be more self-describing, more self-referential, in a similar way as good markup is. It satisfies a very fundamental need that designers have to define graphical relationships between elements. At the same time, it does so in a way that is natural to both their way of thinking and beneficial to the separation of concerns principle on which the “web stack” (the trifecta of HTML, CSS, and JavaScript) is based.

One Minute Mac Tip: Create an encrypted disk image to store confidential files

2008-10-13T06:33:20Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Nary a day goes by when I don’t use my computer for some extremely personal stuff. I would consider it a Very Bad Thing if some of this information (my bank account details or private SSH keys, for instance) fell out of my control.

Everyone has sensitive files that they keep on their computer and, fortunately for Mac OS X Users, Apple has made it ridiculously easy to create a cryptographically secure containers for such files. You can think of a container like this, which is just a standard Mac OS X disk image (.dmg) file, like a vault that you open, put stuff you want to keep safe inside, and then close again.

Here’s how you go about making and using one.

Create the container, an encrypted disk image

First, open up your copy of Disk Utility.app, which is located in your computer’s /Applications/Utilities folder. (As an aside, this program is a bit like a swiss army knife for handling disk operations in Mac OS X. You should definitely find out what else it can do).
Next, select the File → New → Blank Disk Image… option. This will cause the New Blank Image window to appear.
Fill in the typical details such as the disk image file’s name and where you want to save it to. In addition, you’ll be presented with a number of options such as Volume Name, Volume Size, and Image Format. The defaults are usually adequate except for Volume Name, which you should customize so that when you mount the disk image the disk label is meaningful for you, and the Image Format, which I recommend you switch to “sparse disk image.”
Sparse disk images can start small and grow automatically as you write more files into them. If what you want to keep secure in this manner are very large files, say gigantic high resolution PhotoShop documents, then you might consider the sparse bundle disk image format instead.

Also, obviously, set the Encryption to a value other than “None.”

Here’s an example screenshot from my Mac:
Screenshot of the New Blank Image window showing meaningful values entered, Encryption field set to 128-bit, and Image Format field set to sparse disk image.
Press the “Create” button and you’ll be presented with a standard password selection dialogue. This is the password you’ll use to mount the disk image and is analogous to the idea of setting the combination on your vault’s lock. It’s critical that the password you choose is a good one. Ideally, your password is a totally random string that may include any printable character. Since that’s hard to remember, you can have the Mac OS X keychain manage your passwords for you.

Encrypt some files by writing them to the disk image

Now that you have an encrypted disk image, a secure container for your sensitive data, you can make use of it just as you might any other disk image on Mac OS X. For instance, say I have a top secret file called “My Killer Business Plan.pages” and I don’t want anyone to get at it. All I need to do is copy the file into my encrypted disk image, as the following screenshot shows:

It should go without saying that you want to delete the original, unencrypted copy of the file you’re copying into the encrypted disk image, but I’ll say that anyway. Don’t leave unprotected copies of your files lying around. Also, be certain to unmount (eject) the disk image when you’re done using it because the only thing the password protects is opening the disk image, not the files contained within it.

External references

Here are some additional places where this technique is discussed. Check out these additional articles about this topic elsewhere for more information and other perspectives:

Add a post limit and output format to the WordPress Category Posts plugin v2.0

2008-09-19T15:24:27Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Tonight I wrote a quick (and idiotic) patch to the very simple WordPress Category Post plugin v2.0. This backwards-compatible patch features:

parameter-based post limit to define how many posts the plugin function will print
parameter-based format option to output the posts in real <li> elements

The wp-category-posts.php patch file is available for download here. To apply the patch, run the following commands at your shell promp:

cd path/to/wordpress/installation/wp-content/plugins/wordpress-category-posts
patch -p0 < path/to/downloaded/wp-category-posts.patch

I’m hoping this will get integrated as the next version of the plugin, perhaps version 2.1.

YubiKey and OpenID: Two great tastes that taste better together

2008-09-01T17:08:28Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

In some communities, this is sort of old news, however I’ve recently become aware of an exciting and affordable security product called the YubiKey, manufactured by Yubico. The YubiKey is a $35 USD one-time password second-factor authentication token that uses 128-bit AES encryption to provide identity verification. That’s a mouthful, but what it really means is this: using a YubiKey to log in to stuff makes your logins about as secure as a military installation. Here’s how.

When you log in to just about any Web site or Internet-enabled service, say Basecamp for example, you traditionally simply type in a user name and matching password. This is known as one-factor authentication because all you need to do to log in successfully is use a matching pair of user names and their passwords. Since the user name is not hidden, the only piece of the puzzle that’s providing any security is your password.

Now, a password is something you have to remember, so this factor is called "something you know." Of course, if someone else also knows your password, this means that person can log in pretending to be you. Thus enters the need for a second factor for authentication.

The YubiKey is a physical USB fob device with a unique ID. That is, each YubiKey in the world has its own ID, meaning that no two are identical. This implies that if you have a YubiKey with you, no one else can have that same YubiKey anywhere else in the universe. Thus, this gives you a second factor with which to authenticate yourself, specifically it’s "something you have."

When you combine something you know (for instance, a password) with something you have (such as a YubiKey), you have two-factor authentication. Authenticating yourself with both of these factors is obviously more secure than relying solely on one factor because in order to compromise it an attacker needs to compromise both factors; the attacker would need to know what you know (figure out your password) and steal something you have (physically obtain your YubiKey).

If you’re familiar with one-time credit cards such as those that PayPal offers, you can think of the YubiKey like one of these cards, but instead of being used to make online purchases, it’s used for logging into stuff (and, of course, you don’t need more than one physical YubiKey). Of course, for authentication to work with the YubiKey the application or service you are logging into has to be able to understand that you’re using one of these authentication devices.

The good news here is that the entire process of using a YubiKey is a well-documented, open-source, and open-spec scheme so it’s easy for service providers to implement. And, because Yubico is also an OpenID identity provider, you can use your YubiKey to log into any site that supports the OpenID protocol right now, such as (you guessed it) Basecamp! There’s even a WordPress YubiKey plugin so you could theoretically use your YubiKey to secure your authentication to any of your WordPress blogs.

The YubiKey spec is, itself, completely independant of the OpenID spec and vice versa, which is what makes the combination so formidable. What’s so cool about this process is that the site you’re authenticating to, such as Basecamp or your WordPress blog, doesn’t have to know anything about how you’re authenticating because the OpenID provider (Yubico in this example) simply returns the answer—a perfect example of a well-constructed API at work. Either you have successfully authenticated to your OpenID provider or you haven’t, and the site can respond accordingly.

And if that’s not cool enough, want to know the coolest thing about the YubiKey? It’s environmentally friendly! The YubiKey web site states that the robust, ultra-thin and battery-free design increases lifetime and reduces environmental impact.

I’m more than seriously considering getting one of these myself, and even beyond that, getting one for all of my fellow site editors on some of the community web sites I help maintain. This is especially important for sites dealing in confidential or otherwise sensitive information, such as those which hold financial records or have other privacy concerns. Securing the authentication of privileged users such as the site administrators seems a natural step.

Even better yet, because the only cost to implementing this system is developer resources and the cost of the physical YubiKey device, I’m also seriously considering baking this right into any new sites I develop. At $35, a YubiKey is actually cheaper than an SSL certificate, and even though they don’t protect against all the same attack vectors, I think a device like the YubiKey is clearly a vastly superior solution in the majority of use cases.

I never really had a compelling reason to begin to propagate an OpenID identity before but now, at last, I do.

Productivity: It’s not what you do, it’s how you do it, and twentysomethings do it bette

2008-08-04T15:20:59Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

I don’t believe I have ever before posted an entry that, for all intents and purposes, is just a link to another blog post. However, this blog post is simply so brilliant and yet so short and easily-digestable, that I have nothing more to say. Thus: Twentysomething: 7 Reasons Why My Generation Is More Productive Than Yours.

By those definitions, I’ve been a productive twentysomething-year-old since I was a pre-teen, which just goes to show you that age has nothing to do with it. Damn straight.

One Minute Mac Tip: Remove .DS_Store files from ZIP Archives

2008-08-04T06:08:41Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

The Mac OS X Finder has some nifty features, one of which is an exceptionally useful contextual menu item to create ZIP archives of folders. Unfortunately, the Finder also has some really, really annoying habits, one of which is to create a file named .DS_Store in each folder a user opens (when not in Column view). What this means is that if you create a ZIP archive on your Mac and then send it to someone who unzips it without the Finder (such as a Windows user using the Windows Explorer), the recipient will see a lot of litter in the form of useless and meaningless .DS_Store files.

If you’re not afraid of the Terminal, this can be avoided. Put the following lines in your ~/.profile (or similar):

alias rmds='find . -name ".DS_Store" -type f -print0 | xargs -0 rm'

What this does is creates a new command that you can use (rmds) which recursively finds and deletes any regular file named “.DS_Store” starting from the current directory. Thus, running this command in the folder you are about to create an archive out of will clean it first, and will prevent unnecessary confusion on the part of your archive file recipient.

Alternatively, another way to do this is to use the command-line zip program and an (admittedly more complicated) pipeline to remove the .DS_Store files after they have been added to the archive. To do that, use this series of commands:

zip -d ZIPfile.zip `unzip -l ZIPfile.zip | grep .DS_Store | awk '{print $4}'`

where, naturally, ZIPfile.zip is the ZIP archive you want to remove the .DS_Store files from. Creating an alias out of that command (and making it work for paths that contain spaces) is left as an exercise for the reader. ;)

As an aside, the alias, find and xargs commands are incredibly useful in their own right and can be used to do a lot of pretty amazing things. As always, man command will give you the nitty gritty.

Also as an aside, you can stop the Finder from creating .DS_Store files entirely when browsing network volumes (like Windows shares) with another command, documented in Apple’s Knowledge Base.

One Minute Mac Tip: Securely erase files from the command line

2008-07-31T09:24:44Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Security provisions are one of those “things” that Mac users have been snooty about—for good reason—for decades. However, I’d dare say that, even though the UNIX architecture of the underpinnings of Mac OS X is much more secure than most other popular operating systems (cough, Windows, cough), much of the security benefits that Mac users have enjoyed are really security-by-obscurity, which is not very secure at all. With the added popularity of Mac OS X, lots of responsibility suddenly shifts from the vendor (Apple, Inc.) to the individual users (this means you) to keep your data secure.

Apple has been on point, however, providing good security utilities built right into the operating system and easily available to end users. Of most common use is probably “Secure Empty Trash” which securely deletes files that you put into the trash. The counterpart to this function available in the Finder is, too few Mac users know, the srm or secure remove command-line utility.

srm can be thought of as simply a version of rm that overwrites file data before unlinking it from the file system. It comes with a few more options than rm comes with all geared towards tweaking just how it overwrites files. My favorite is -m, which the manual page says:

overwrite the file with 7 US DoD compliant passes (0xF6, 0×00, 0xFF, random, 0×00, 0xFF, random)

I had the perfect occasion to use srm today: I was transporting my SSH private key from one laptop to another via a temporary drive. I wanted to securely remove all traces of the private key file from the temporary drive after installing it in the new computer. (See this SSH public key tutorial if you don’t know why this might be important.)

After copying the private key file over, removing it securely looks like this:

srm -m private_key_file

It’s that easy.

To be confident that your file is truly overwritten with garbage, you can use the -n option. This is one way to retain a file, but completely corrupt it. Observe:

Meitar:~ meitar$ cat testfile
Hello world.
Meitar:~ meitar$ srm -mn testfile
Meitar:~ meitar$ cat testfile
?
 ?)c?I
      P?Meitar:~ meitar$

That garbage you see after the second invocation of cat shows that the file really was trashed, that is, overwritten with garbage data. Now, a simple rm testfile can do the rest of the work.

As always, man srm will give you all the other juicy details.

One minute Mac tip: Schedule off-hours downloads by enabling `at`, `batch` UNIX job scheduling comma

2008-07-14T08:48:57Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

In a lot of places in the world, many people still have to pay for bandwidth costs. I’m one of those people who just can’t afford to download lots of stuff during peak hours when my bandwidth might quickly get shaped or, worse, I’ll get charged. Nevertheless, there are often plenty of legit reasons to initiate huge downloads.

In these cases, it makes sense to be smart about when I initiate these downloads. Being something of a UNIX-head myself, I wanted to use the age-old at command to download a Linux ISO during off-peak hours, which my ISP says starts at 2 AM. Much to my chagrin, I found that at doesn’t work by default on Mac OS X and, worse, the Leopard man page leads to a dead end (though it didn’t back in Tiger…).

Turns out that the system daemon that is responsible for checking up on at jobs has been wrapped with a launchd job. This makes enabling at on your system really easy:

sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.atrun.plist

Once you’ve done this, you can now use at as you normally have done. For instance, I could now schedule my downloads to happen during the off-peak hours:

Perseus:Fedora maymay$ at 2:15am tomorrow # now press return
curl -O http://download.fedoraproject.org/pub/fedora/linux/releases/9/Fedora/x86_64/iso/Fedora-9-x86_64-DVD.iso
# now press CTRL-D.
job 1 at Tue Jul 15 02:15:00 2008
Perseus:Fedora maymay$ atq
1	Tue Jul 15 02:15:00 2008

This is also incredibly handy for scheduling just about any resource-intensive task that you don’t have to do right now. To take it one step further, you can even let the computer itself choose when to run these resource-heavy tasks by using the batch command, which will execute commands much like at but will check the system load average instead of the system clock to determine if it should start the job.

Note that with the com.apple.atrun job loaded /usr/libexec/atrun is started every 30 seconds (unless you change the StartInterval key in the plist file). Since the atrun command checks a file on disk (that it places in the /usr/lib/cron/jobs directory) to see if there is any work to do, this will probably prevent your disks from ever sleeping, which could be a major concern for battery life on portables. Also, obviously, your computer needs to be turned on and awake for the job to actually launch.

For more information, check out the result of typing man at and man launchctl at a Terminal prompt. There’s also a really good Google Tech Talk about Launchd that will teach you a lot more about job scheduling on Mac OS X.

One minute Mac tip: Auto-complete, spellcheck, and search for definitions in Cocoa text fields

2008-06-28T10:19:50Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Without doubt, the most common use of computers today is to create written content of some kind. Blogs are an obvious example, but written content can take a number of forms. Writing manuscripts for publication is another example.

No matter what kind of writing you’re doing, using good tools to make your writing technically better is an incredibly handy thing. Letting the computers do the technical stuff—the stuff they’re good at—let’s you focus on the creative stuff: writing great content. Which is why, if you use a Mac, you’ll be happy to hear that any application’s text field let’s you do a number of really cool things (as long as it’s a Cocoa application, of course).

1. Auto-complete unfinished words

Try this out:

Open TextEdit, from your /Applications directory. A new blank document will open.
Type Hel and then press the ESC key. A drop-down menu will suddenly appear with an alphabetically sorted auto-complete list of suggestions, sourced from your computer’s current language dictionary. It looks like this:

This feature works with both Pages and, for those of you still using it for some reason (I know you’re out there), TextEdit, too. Also, if you’re a developer and a writer as well (like I am), you’ll be happy to hear that this feature also works with Xcode’s Code Sense feature, and suggests completions for variable, function, class, and method names in your code.

2. Spellcheck as you type

A Cocoa text input field also has a number of other tricks up its sleeve. For instance, in many applications you can elect to turn on the “Check spelling as you type” feature, which will cause words you misspell (words not in the computer’s dictionary) to appear with a dotted red underline. If you right-click on these words, the contextual menu that appears will offer spelling corrections.

However, sometimes we use words like those in slang or colloquial language that isn’t in a proper dictionary. These words will still appear to be “misspelled” when you type, so in these cases, we can tell Mac OS X to “Learn Spelling” (also from the contextual menu). When you select this option, you append that spelling to your personal dictionary. (This is really just a plain-text file located at ~/Library/Spelling/lang file, where lang is the language code you’re typing in. For Enlgish, this file is ~/Library/Spelling/en.)

3. Look up word definitions and search for text in Google or Spotlight

Last, but certainly not least, another neat thing you can do with text on your Mac is look them up with Dictionary.app. Simply highlight some selectable text on screen, right-click and select “Look up in Dictionary”. This will cause Dictionary.app to open and display the definition of the selected word.

Since Dictionary.app can also look up articles in Wikipedia, this is also a very quick way to go to a Wikipedia article without ever having to open up a Web browser.

Also, from the very same menu, you can open a Web browser. Simply select “Search in Google” to cause your default Web browser to launch a Google search for the highlighted text.

Arbitrarily exclude posts from displaying in WordPress

2008-06-06T18:11:09Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

When hacking away at WordPress sites, often times you’ll find yourself in a situation where you need to filter out certain posts from displaying on some pages, such as the home page. There are a lot of ways to do this, but few are perfect. Recently, I had the need to do this and went searching for pre-existing solutions.

I came across Vaibhav’s post on the topic and noted that his solution uses the query_posts() function to alter WordPress’s query object before The Loop has run. While this is a great solution if your exclusion criteria is simple enough to be supported directly by the WordPress query object, other times the query_posts() function doesn’t provide you with the hook you need.

In these cases, you can run the original query, note any modifications you need to make, and then create a new, modified query and display the results you get from running that one instead. For instance, you might need to do this if you need to exclude posts based on category and, say, the beginning of their title, or their category and a certain piece of content in the post itself, or all three, or any other combination you can think of.

Another advantage of this technique over simpler ones is that this method maintains the same behavior you’d expect to see in every other way. Most notably, this means that if you’ve told WordPress to display the 10 most recent posts on the home page (in the WordPress settings), you’ll still see ten posts on that page even after you exclude some of them.

To do something like excluding posts if they are in the “Uncategorized” category (traditionally the category with an ID of 1 in WordPress) and their title begins with “Some title”, you can do this:

// original query runs in The (real) Loop first
while ( have_posts() ) : the_post();
    // detect pots matching our exclusion criteria
    if (in_category(1) && (0 === strpos(the_title('', '', false), 'Some title')) ) {
        $wp_query->post_count++; // increment the post counter
        continue;
    }
    endif;
endwhile;
// now make a new query and show the posts for real, with the adjusted post count and filtering
$my_new_query = new WP_Query($query_string.'&showposts='.$wp_query->post_count);
// do another The Loop (and display the results this time)
while ( $my_new_query->have_posts() ) : $my_new_query->the_post();
    // detect and exclude these same posts
    if (in_category(1) && (0 === strpos(the_title('', '', false), 'Some title')) ) { continue; }

// ...the rest of the WordPress template goes here...

This is neat because it gives you the capability to define arbitrarily complex exclusion patterns and directly modify your new query object however you like before you execute it. Once you know this works, you’ll probably want to extract the filtering code into a function. Using the above example, your new code might look like this:

// define criteria for filtering
function matches_filtering_criteria () {
    if (in_category(1) && (0 === strpos(the_title(”, ”, false), ‘Some title’)) ) {
        return true;
    } else {
        return false;
    }
}
// original query runs in The (real) Loop first
while ( have_posts() ) : the_post();
    // detect pots matching our exclusion criteria
    if (matches_filtering_criteria()) {
        $wp_query->post_count++; // increment the post counter
        continue;
    }
    endif;
endwhile;
// now make a new query and show the posts for real, with the adjusted post count and filtering
$my_new_query = new WP_Query($query_string.’&showposts=’.$wp_query->post_count);
// do another The Loop (and display the results this time)
while ( $my_new_query->have_posts() ) : $my_new_query->the_post();
    //
    // detect and exclude these same posts
    if (matches_filtering_criteria()) { continue; }

// …the rest of the WordPress template goes here…

For more information on these functions, see:

Things different about Australia

2008-03-02T09:50:25Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

By way of example, I am being completely devoured by mosquitos sitting on a bench somewhere in Newtown, a suburb of Sydney. I’m leeching wifi in quite literally the only freely open, non-commercial wifi spot I’ve been able to find in the entire city after searching for such a spot for more than a week. Turns out, Internet access here is obscenely expensive—even by American standards—which partially explains the lack of free, open Wi-Fi.

Leeching this wifi is incredibly uncouth, I know, but I justify my behavior with the fact that I absolutely must ensure that my finances are in order in time for things like rent payments and every other opportunity to use the Internet—my only means of banking at this point—have been unavailable. Indeed, even the most common “free hotspot” service in this city, uConnect, provided by Unwired, shuts off at 7 PM. In fact, most of the city shuts off relatively early, save for nightspots and pubs.

The University of Sydney campus is, for the most part, closed on weekends. Those of you familiar with New York’s collegiate services would be appalled at the notion of something like your college library being closed at anything other than normal 9-5 business hours, but that seems the norm here. Similarly, back to the Internet access frustrations, all (and I mean every) bit of bandwidth you use on the University’s network is monitored and, ultimately, limited. The University has a Squid HTTP proxy set up which you must use to get anywhere on the Internet, but each account has a bandwidth cap of 2 MB per day, barring cache hits, of course. Beyond that, and you pay by the megabyte.

All Internet access, it seems, has bandwidth caps like this. There’s a veritable alphabet soup of ISPs that provide similar services, most over ADSL technology, since cable is hard to come by. Very frustrating, as I’ve never before had to think about how and where my bandwidth is being spent.

In any event, aside from the Internet access woes which were sadly unexpected, there are a number of other things about Sydney that are very different that New York City.

In restaurants, water is either self-serve or comes in bottles instead of being poured into glasses. This is a great idea, because it means I’m much more likely to actually have water when I want it. Also, waiters and waitresses expect no tip, so your bill is all you pay. This has two side effects, one rather nifty, and the other very uncool.

First, because your waiter isn’t your personal server for the meal, any and all waiters will wait on you at your behest. None of this, “I’ll call your waiter” non-sense. Makes restaurants seem much more cohesive, egalitarian—a theme in this country. Secondly, because wait staff get no tips, they get paid much better than they do in the states, which in turn raises prices for the meals. This goes so far as to change the prices on menus during “public holidays,” when—presumably—wait staff get paid time and a half. Menus often say “surcharge applies on public holidays and weekends” to indicate this.

And speaking of menus, there’s a whole different language for coffee here than in the states. Regular coffees as we know them in NYC are called “long blacks” here. Contrast this with a “short black,” or single espresso. “Flat whites” are lattes served in coffee cups, whereas “lattes” are lattes served in regular water glasses. Why the distinction? I have no idea.

Some things are the same. Mochas, for instance, are coffee with chocolate. (So are the “stop” buttons on the public transit busses, but I digress.) Other coffee slang bits sound way too Starbucks-ese for me to like them, such as “Vienna long black,” which just means a long black (regular) coffee with whip cream on top.

If you order any coffee, don’t expect a refill—there’s no such thing as free refills here. In fact, everything, even the tiniest bit of luxury, is charged here. It costs you 10 cents per printed (B&W) page at the University of Sydney computer labs to print anything (but pages here are not the normal 8-and-a-half-by-11 that you’re used to in the States). If you want hot water at the showers after taking a swim at Bondi Beach, for example, then you drop a 20 cent coin into the shower stall. Say you want some condiments for your fish and chips, like ketchup? That’ll cost you 80 cents in addition to the price of your food. Tartar sauce is more expensive, at $1.10 per several-ounce dish.

Food in general is obscenely expensive, and at first I thought it was just me, but after talking to locals it seems everyone’s noticed the price increase. The past 7 summers in Australia have been very dry, so dry that the drought caused harvest yields to decrease dramatically, raising food prices by more than 30% in the past several years. Couple this rising inflation concerns, weakening U.S. Dollar strength, and what I’m left with as an International traveller is the grim prospect of paying almost $15.00 (USD!) for a bacon and egg breakfast with a single, non-refillable coffee at any decent café.

Similarly expensive are spirits and liquor, which in addition to being taxed at 10% like everything else under Australia’s national “Goods and Services Tax” (GST), have an additional tax associated with them dependent on their alcohol content. This means my favorite liquor, Tequila, costs about $70 AUD for a 750 ml bottle of Cuervo. Forget the really good stuff like 1800 Resposado or Patron, which are upwards of $100 for the same amount. Sigh.

As a result of all of this, my money is not going nearly as far as I would have hoped. I am looking forward to having an actual apartment—with an actual kitchen—because at least when that happens I can stop paying exorbitant prices for food. It’s nearly impossible to cook in the hostels Sara and I have been staying at because they’re simply uncomfortable, not private, and not very well-equipped. And to top it all off, I think my hostel’s bed is giving me allergies.

I have a job offer, assuming I can get permission to work from the New South Wales government. Ironically, permission to work is also something I have to pay for—how crazy is that?—so I’ve had to rush to set up bank accounts as soon as I got into the country. The banks, for what it’s worth, are surprisingly good even though everyone here says they are terrible thieves. This makes me think no one from this country would be able to put up with any bank from the States.

The best thing about my bank is that it has CSV, QIF, and MNX download options for every single data table presented on their web site. This is, interestingly, the biggest selling point for me but something no one at the bank had any clue about. It’s not mentioned in their marketing material, their sales staff had never heard of it, and the only reason I knew it existed was because I saw a screenshot with the words “export data” on the corner. I took a chance and set up my account with them based on this screen shot and it looks like it payed off. Machine-readable financial interchange, baby!

Conclusions? This country is in what I consider to be the bronze age when it comes to technology. Only the elite technophiles—looked down upon as “tall poppies” here, rather a bad thing what with the whole egalitarian society thing—even know their way about anything other than a web browser or Microsoft Office. That being said, everyone knows how to lock their wifi, even if they don’t know how to change the channel so that they can actually broadcast that signal more than 10 feet in any direction.

Deleting GMail messages from an iPhone or iPod touch won’t “Archive”

2008-02-14T03:41:23Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

I just paid way too much money for an iPod touch (because I’m a technoslut), and in playing around with the Mail application it comes with ever since Macworld and the “free Software Upgrade”, I noticed a bit of a gotcha while using GMail IMAP accounts.

It seems, that despite syncing up with my iMac’s accounts, the iPod touch (and, presumably, the iPhone as well), treat the “Trash” mailbox specially. Specifically, whereas you can map the “Delete” button in Apple Mail.app to function as though it were the GMail “Archive” button (by following these simple steps), Mail on the iPod touch or iPhone won’t inherit the same behavior. “Delete” on the iPod touch really is an honest-to-goodness delete—forever.

Instead, to Archive GMail messages on an iPod touch or iPhone, you’ll need to tap the “Move” button (the folder icon with a downwards-facing arrow, second from the left on the bottom toolbar) and select the “All Mail” folder. I wonder why the difference in interface choices….

Insomnia of the worst kind

2008-02-10T07:02:10Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Tonight’s my first of a little over a week’s worth of nights alone. When this ends, I’ll be on the other side of the planet. I’ve turned out the lights maybe four times already, trying to get ready for bed, but my body just won’t shut down despite its utter exhaustion. I really hate this feeling of waiting—having at once nothing and everything to do. I really hope I get some rest.

Service-oriented Internet companies and porn: Ning gets it right

2008-01-08T08:23:57Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

I think it’s important—for a lot of reasons—to let people do what they want rather than to try to force people to do what you think is right. Ning is a company that gets it:

In a nutshell, we aren’t pro-porn, but we are pro-freedom.

To prevent porn, you have to take an activist stand against freedom of expression — you have to get in there and judge content, judge people, judge intent, and take action based on your judgments. I would never criticize a company for doing so, but I don’t want to do that, and we as a company don’t want to do that.

We think a better approach is to let people fundamentally do what they want, as long as it isn’t illegal and doesn’t otherwise violate our terms of service.

A heartfelt applause to Marc and everyone at Ning for putting their user’s personal choices ahead of their own. It’s not only good social justice, it’s excellent business.

Marc even provides some history:

From the very beginning of the Internet as a mass medium, porn has been present, and all of the Internet companies that have come before us have had to figure out where they stand.

[…]

[D]uring my time at AOL, I was fascinated to see how AOL dealt with porn. AOL had to balance two facts. One, their entire marketing thrust to be a mass market service meant that they had to come across as — and be — highly family-friendly. And in fact, they did a lot of work with parental controls and other features to make sure that families would use AOL safely. But the other fact was that a huge part of AOL’s actual usage all through the 90’s was for adult content — chat rooms, bulletin boards, and all the rest.

In practice, I think they balanced those two facts quite well — AOL could be used as a family-friendly service or as an open environment for people to do whatever they want, and it worked quite well for everyone.

This is a model that Yahoo then followed, and Google more recently.

Yahoo has always had an enormous amount of adult activity and material — some estimates are that as much as half of Yahoo Groups’ activity is adult in nature, for example.

And Google of course famously crawls and serves up search results and images for all kinds of adult topics, among every other topic in the world.

In light of many high-profile anti-porn practices by social networking sites such as MySpace, Facebook, and to a lesser degree, LiveJournal, it’s great to see that at least one company has put its own business ahead of other people’s politics. It’s precisely that sort of thing that’s made Marc an entrepreneurial blockbuster time and time again.

And frankly, I think the social agenda called freedom is just as important.

Via Susan Mernit

I want to go away

2008-01-04T22:38:16Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

I’ve slept most of the day. I haven’t even really slept, but I’ve been in bed and haven’t gotten up. I woke up at 9 AM at first, feeling full of energy but wanting nothing more than to go back to sleep. I woke up again, finally, at 2 PM or so after tossing and turning for hours.

In less than two hours of being awake, I was crying in fits and starts on my bed again. I wanted to tire myself out again so I would go back to sleep. I just want to go away and hide.

Steven Pinker’s ‘The Stuff of Thought’

2007-12-28T09:21:36Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

This video, which is one of the recent TED Talk videos, is of Steven Pinker’s talk called The Stuff of Thought. This is simply brilliant. So brilliant, in fact, that those who know me well are about to be utterly astounded by what I am going to say:

I now understand the value of indirect communication. And it is immense.

I also understand why I never saw it before: the benefits are reaped solely through language’s social applications, not its analytical ones. See for yourself by watching the video.

If

2007-12-25T09:41:49Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Time is a limited resource. That’s why patience is a virtue.

By Rudyard Kipling

IF you can keep your head when all about you
Are losing theirs and blaming it on you,
If you can trust yourself when all men doubt you,
But make allowance for their doubting too;
If you can wait and not be tired by waiting,
Or being lied about, don't deal in lies,
Or being hated, don't give way to hating,
And yet don't look too good, nor talk too wise:

If you can dream - and not make dreams your master;
If you can think - and not make thoughts your aim;
If you can meet with Triumph and Disaster
And treat those two impostors just the same;
If you can bear to hear the truth you've spoken
Twisted by knaves to make a trap for fools,
Or watch the things you gave your life to, broken,
And stoop and build 'em up with worn-out tools:

If you can make one heap of all your winnings
And risk it on one turn of pitch-and-toss,
And lose, and start again at your beginnings
And never breathe a word about your loss;
If you can force your heart and nerve and sinew
To serve your turn long after they are gone,
And so hold on when there is nothing in you
Except the Will which says to them: 'Hold on!'

If you can talk with crowds and keep your virtue,
' Or walk with Kings - nor lose the common touch,
if neither foes nor loving friends can hurt you,
If all men count with you, but none too much;
If you can fill the unforgiving minute
With sixty seconds' worth of distance run,
Yours is the Earth and everything that's in it,
And - which is more - you'll be a Man, my son!

Today is not the day

2007-12-20T16:35:07Z

This entry was originally published at my site's personal web log. Additional information or comments may be available on the original posting.

Augh. Today is not the day I want to be an adult. Or have to go down to the courthouse. Or deal with law things and governments. Or go run errands before I can do that. Or stress about all sorts of future plans stuff. Or….

Bah. I want to crawl back into bed and stay there until Spring comes.

may maym

Crosspost: My impressions on the new “sex-positive social network” Blackbox Republic

Mainstream sex-positivity or a VIP room in cyberspace? Or both?

Show me the features!

Goodbye drop-downs, hello sliders!

Privacy and security

Blackbox Republic’s Web of Trust

You’re not a “friend,” you’re an acquaintance!

What? No on-the-wire encryption?!

Conclusion

What Kind of Man

Now it’s all the little things

Too many tears: My first morning back in NYC

Buy Web Development Books from SitePoint’s 5-for-1 Sale and Donate to Bushfire Relief

clickjane.css: A CSS User Style Sheet to Help Detect and Avoid Clickjacking Attacks

clickjane.css helps detect clickjacking attacks for all browsers

Before and after clickjane.css

Good habits you should get into to mitigate clickjacking risks

More resources to learn about clickjacking

Introducing KinkForAll: A no-limits gender and sexuality unconference

Why CSS needs delegation capabilities and not “variables”

In this corner: CSS variables are harmful

In the other corner: CSS variables are a real-world requirement

Adding delegation makes CSS easier for designers

So who wins?

Adding delegation to CSS is worth the effort

CSS delegation doesn’t grow the size of the language

Designers want relationships via delegation, not variables

One Minute Mac Tip: Create an encrypted disk image to store confidential files

Create the container, an encrypted disk image

Encrypt some files by writing them to the disk image

External references

Add a post limit and output format to the WordPress Category Posts plugin v2.0

YubiKey and OpenID: Two great tastes that taste better together

Productivity: It’s not what you do, it’s how you do it, and twentysomethings do it bette

One Minute Mac Tip: Remove .DS_Store files from ZIP Archives

One Minute Mac Tip: Securely erase files from the command line

One minute Mac tip: Schedule off-hours downloads by enabling `at`, `batch` UNIX job scheduling comma

One minute Mac tip: Auto-complete, spellcheck, and search for definitions in Cocoa text fields

1. Auto-complete unfinished words

2. Spellcheck as you type

3. Look up word definitions and search for text in Google or Spotlight

Arbitrarily exclude posts from displaying in WordPress

Things different about Australia

Deleting GMail messages from an iPhone or iPod touch won’t “Archive”

Insomnia of the worst kind

Service-oriented Internet companies and porn: Ning gets it right

I want to go away

Steven Pinker’s ‘The Stuff of Thought’

If

Today is not the day

`clickjane.css` helps detect clickjacking attacks for all browsers

Before and after `clickjane.css`