strawberryJAMM's Security and User Experience WebLog : Grab Bag

mmmmmmmmmm..... This is not a Test. The World Is Flat. I Repeat, This is not a Test.... mmmmmmmmmm.....

strawberryJAMM — Sat, 09 Apr 2005 18:48:00 GMT

Someone on a mailing list I'm on passed along the URL to the article "It's a Flat World, After All," by Thomas L. Friedman, author of "The World Is Flat: A Brief History of the Twenty-First Century," from which the article is adapted (and which is now on my list of "books to read").

Friedman has quite a lot of interesting things to say in his seven web pages about the current status of the globalization process that started when Columbus safely returned home (thereby proving the world was round). ;This event kicked off an era where countries were globalizing for resources and imperial conquest, followed by the industrial revolution starting an era where companies were globalizing for markets and labor, and lead inexorably to the information era, where technology has "leveled the field" enabling individuals and small groups to globalize.

Around about the third page of the article, Friedman poses the question "How did the world get flattened, and how did it happen so fast?" He follows that up with a list of 10 events and forces, that all occurred or came together during the 1990’s, converging right around 2000. The first three world flatteners "created the new platform for collaboration":

Nov 9, 1989 – The Berlin Wall Comes Down (and Microsoft Windows 3.0 goes up)
Aug 9, 1995 – Netscape Goes Public (bringing the internet and the dot-com boom with it)
Workflow Revolution – Application to Application infrastructure (Enables outsourcing Y2K bug fixes to Indian engineers)

The next six world flatteners were the new ways in which individuals and companies could collaborate on work and share knowledge using the platform the first three created:

Outsourcing – work could be digitized, disaggregated and shifted to any place in the world where it could be done better and cheaper
Off-shoring – send the whole factory from Canton, Ohio, to Canton, China
Open-sourcing – whole new operating systems are written by engineers collaborating online and working for no pay.
Insourcing – let a company like UPS come inside my company and take over my logistics operations
Supply-chaining – create a global supply chain so efficient that when an item is sold in Arkansas, another is immediately made in China. (This is Wal-Mart’s specialty)
Informing – allow anyone to collaborate with, and mine, unlimited data all by themselves (This is Google, Yahoo and MSN Search)

The tenth and final world flattener, he called "The Steroids":

Wireless and Voice over Internet Protocol (VoIP) – the other collaboration methods areturbocharged: you can now do any one of them, from anywhere, with any device

Friedman follows up his discussion of these ten "World Flatteners" with the following quote:

<quote>

The world got flat when all 10 of these flatteners converged around the year 2000. This created a global, Web-enabled playing field that allows for multiple forms of collaboration on research and work in real time, without regard to geography, distance or, in the near future, even language. ''It is the creation of this platform, with these unique attributes, that is the truly important sustainable breakthrough that made what you call the flattening of the world possible,'' said Craig Mundie, the chief technical officer of Microsoft.

</quote>

As if the leveling of the playing field was not enough on its own, Friedman points out another convergence that occurred at roughly the same time: The three billion new players who walked, and often ran, from the sidelines and straight into the game. That is, all the people of China, India, Russia, Eastern Europe, Latin America and Central Asia who were suddenly no longer restricted from joining the free market after their economies and political systems opened up during the course of the 1990's.

>Friedman does go on to note that not everyone has access to this platform yet, but more people have access to it in more places on more days than ever before, and it the numbers are only increasing across the board with time. What I found particularly interesting was his and others thoughts that the so-called "IT Revolution" of the past 20 years was nothing more than the warm-up act – the first steps that forged, sharpened and distributed all the tools the world needed to collaborate and connect. The main act is only just beginning as we move on into the era where technology REALLY transforms every aspect of business, government, society and life.

Another quote that caught my attention:

<quote>

When the world is flat, you can innovate without having to emigrate. This is going to get interesting. We are about to see creative destruction on steroids.

</quote>

This got me thinking about how this trend is already changing immigration patterns into countries like the USA and Canada. There are tough requirements in these countries around who they will allow a company to bring in to work – ostensibly to protect their own citizens from the risk of loosing job opportunities to someone from another country. But, what happens when the companies really do not need to bring the people in to the country to get the work done? When the better educated, gung-ho people are not here but there? The jobs will be lost just the same – in fact, even more so. There are, of course, rules and regulations regarding what kind of offshore holdings a company can legally have, or how much offsite consulting they can legally utilize, but I wonder if, in the long run, this kind of locked down policing of global employment will do more harm than good?

You can already see this happening with help lines – you are more likely to get someone with a "friendly Indian lilt" answering your request for help, especially outside of North American working hours (8am EST to 6pm PST), than someone living closer to home, when you call a 24/7 help line. Even at Microsoft, we have staff working our internal corporate technical help desk lines in India in addition to staff in Denver, Colorado and some city in California. Truthfully, it does makes sense – over there, they are just waking up while, over here, it’s after dinner and we’re just trying to download our email or copy a document off of the corporate network Why hire people to work a "graveyard shift" when there are humans who can do the work as a "morning shift"?

Another quote, this one from Rajesh Rao, a young Indian Entrepreneur that Friedman spoke with, digs into the issue much more deeply:

There is no time to rest. That is gone. There are dozens of people who are doing the same thing you are doing, and they are trying to do it better. It is like water in a tray: you shake it, and it will find the path of least resistance. That is what is going to happen to so many jobs – they will go to that corner of the world where there is the least resistance and the most opportunity.

...

[Americans and Western Europeans would] be better off thinking about how you can raise your bar and raise yourselves into doing something better. Americans have consistently led in innovation over the last century. Americans whining -- we have never seen that before.

As Friedman says, "This is Not a Test" – it is time for the United States (and its cadres) to wake up and take a good long look at the other kids on the playground and in the classrooms. It will not be long before just getting by, by doing what has always been done and always worked, will not even get a "Satisfactory" grade from the World-at-Large.

We need to get going immediately. It takes 15 years to train a good engineer, because, ladies and gentlemen, this really is rocket science. So parents, throw away the Game Boy, turn off the television and get your kids to work. There is no sugar-coating this: in a flat world, every individual is going to have to run a little faster if he or she wants to advance his or her standard of living. When I was growing up, my parents used to say to me, "Tom, finish your dinner -- people in China are starving." But after sailing to the edges of the flat world for a year, I am now telling my own daughters, "Girls, finish your homework -- people in China and India are starving for your jobs."

I don’t know about you, but I’m already sitting on the edge of my seat, popcorn and a Coca-Cola in hand. The previews have ended, the digital sound check is just fading away, and the movie studio logo is rolling. In the next 10 to 20 years, there is going to be a spectacular, mind-blowing show unfolding around us. I sure wouldn’t miss this for anything in the world. Besides, I have a vested interest – I am expecting to write a line or two of the screenplay after all. ;-D

--
Jenni A. M. Merrifield =:= strawberryJAMM

strawberryJAMM moves to Blogs @ TechNet

strawberryJAMM — Tue, 29 Mar 2005 03:00:00 GMT

blogs.TechNet.com has officially gone live and "strawberryJAMM's Security and User Experience WebLog" has moved off blogs.MSDN.com...(read more)

Geo-Blog - Where Blogs Meet Maps and Location

strawberryJAMM — Tue, 08 Feb 2005 03:20:00 GMT

At BlogMap you can geo-code your blog by entering a primary city, zip/postal code, country and your blog feed URL. Then you can link to your own BlogMap or display it as an inline image (you should be able to see a blog map for this blog just to the right of this paragraph) using a fairly simple URL!

Very cool, if you ask me. :-)

[edit: link correction, plus added break to clear past right float image]

[OT] Lifetime Reading Plan

strawberryJAMM — Sat, 18 Dec 2004 21:50:00 GMT

Something a little more refined than usual and (for those reading my professional blog) a bit off topic, a list of "life time reading recommendations" was shared by one of the women in a Book Club I'm in:

The Lifetime Reading Plan by Clifton Fadiman (3rd Ed, 1988)

I'd include the list I received in email here, but I found the page it was copied off and the author has asked that it be linked to and not reposted on the web.

--=+=--

Well, I think I'm a bit behind with that list, so I'd best be getting right on it don't you think? :P

Actually, as I started perusing the list in more depth I realized that, considering I wasn't actually trying or anything, I've actually made a pretty good inroad so far:

· I thank heaven for my BA in Classical Studies--it single-handedly polished off all of the "Beginning" section

· High school and college English Literature courses ran the gamut of Bunyan, Joyce, Orwell; cleared a good solid chunk of Chaucer and Shakespeare; and dabbled with Dante and all of these poets: Donne, Milton, Blake, Wordsworth, Coleridge, Yeats, Eliot.

· Robert Frost is my all time favourite poet and I've read all his poems at least once. One of my two all time favourite poems is The Road Not Taken, which I have been able to quote from memory since I was about 10. It's also a good summary of my general attitude in life. (For the record, my other "all time favourite" poem is The Highwayman by Alfred Noyes, who was contemporary with Yeats and doesn't rate a separate spot on Clifton's list, but could be included in Poets of the English Language)

· Childhood reading ticks off Lewis Carol and Mark Twain

· My husband took this awesome college course in "History of Speculative Fiction". I snagged each book after he was done, which captured Huxley's Brave New World, along with several other classics of the genre.

· The book club I mentioned at the start of this post has also accounted for a few including Austen's Pride and Prejudice, (half of) Gabriel Carcia Marquez's One Hundred Years of Solitude (It didn't sit well with me and I just couldn't finish)

· A "Negotiation Strategies" practice group I've attended a few times reviewed a few sections from Machiavelli's The Prince.

· Finally, a result of a life time passion for literature and reading has also managed to put away:

o More of Shakespeare than school can account for (though still not all of them)

o Emily Brontë's Wuthering Heights

o Jane Austen's Emma

o All of Edgar Allen Poe's stories (and poems)

Interestingly, although I have read some Dickens, none of the works listed are included: A Cricket on the Hearth, A Christmas Carol, and (some of) A Tale of Two Cities

A 4th edition of the reading list ("The new Lifetime Reading Plan") was released in 1997, which included quite a few more items, most notably a significant number of eastern classics and some key works by that most prolific of authors Anonymous. Of the additions to that list I've also read:

· The Epic of Gilgamesh (English Lit)

· Parts of Sun-tzu's The Art of War (through the "Negotiation Strategies" practice group)

· Parts of the The Koran (just 'cause)

· The Rubaiyat of Omar Khayyam (another just 'cause)

· Parts of One Thousand and One Nights (ditto)

· Charlotte Brontë's Jane Eyre (ditto)

· Freud's The Interpretation of Dreams (ditto)

I think I really will have to dig into some of the things on those lists I haven't read - especially the non-fiction works, which I'm not nearly as far along with as I am with the fiction works. Are you game?

ADDENDUM

There are very few "modern" works on these lists but the site that is linked to includes some among the Great Books Lists: Lists of Classics, Eastern and Western page. I haven't explored them in depth, but it got me thinking about what I'd add to a "Lifetime Reading Plan" of my own devising. The following immediately came to mind:

· J. R. R. Tolkein, The Hobbit, The Lord of the Rings Trilogy

· Joseph Campbell, The Masks of God, Vols. 1-4

· Arthur C. Clark, 2001: A Space Odyssey, The Hammer of God

· William Gibson, Neuromancer (Remembering Tomorrow)

· James G. Frazer, The Golden Bough: A Study in Magic and Religion

· Orson Scott Card, Ender's Game

· Anne Frank, The Diary of Anne Frank

· Rudyard Kipling, The Jungle Book, The Second Jungle Book, Puck of Pook's Hill

· Hugh Lofting, (complete tales of) Doctor Doolittle

· Richard Adams, Watership Down

· L. M. Montgomery, Anne of Green Gables, A Tangled Web

So, how about you? What books would you add to a "Lifetime Reading Plan" of your own devising?

--
Jenni A. M. Merrifield == strawberryJAMM

Now playing: "Get the Party Started" by "Pink" in Windows Media Player 10.

Edit: Added [OT] to title to make it clear that this isn't a technical topic.

All you need is LUA

strawberryJAMM — Fri, 15 Oct 2004 20:28:00 GMT

I was thinking about LUA (Least-privileged User Accounts) and had this little burst of silly creativity that I felt compelled to share on my blog... ☺

Jenni

--=+=--

To the Tune of "All you Need is Love"
(With my deepest apologies to John Lennon and Paul McCartney)

All you need is LUA
By Jenni Merrifield

LUA, LUA, LUA
LUA, LUA, LUA
LUA, LUA, LUA

There's nothing you can't do that could be done
Nothing you can't win that could be won
Nothing in the way so you can learn how to play the game
It's easy

Nothing you can't make that could be made
Nothing you can't save that could be saved
Nothing stopping you from doing all that you could do before
It's easy

All you need is LUA
All you need is LUA
All you need is LUA, LUA
LUA is all you need

Nothing you can't find that could be found
Nothing you can't hear that had a sound
Nothing you can’t show to blow away the CEO
It's easy

All you need is LUA
All you need is LUA
All you need is LUA, LUA
LUA is all you need

All you need is LUA (All together, now!)
All you need is LUA (Everybody!)
All you need is LUA, LUA
LUA is all you need
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
Yee-hai! (LUA is all you need)
LUA is all you need (LUA is all you need)

Yesterday (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
LUA is all you need (LUA is all you need)
Oh yeah! (LUA is all you need)

--=+=--

The best thing, I think, about this silly little ditty is that it's pretty close to being true. You really don't need to run as Admin for your daily work as long as you know a few workarounds for Non-Admins. Give it a try! Your system will LUA you for it. ☺

Windows Logo Schmindows Schmogo

strawberryJAMM — Fri, 01 Oct 2004 02:33:00 GMT

I was recently involved in a conversation about what was wrong with the current version of the Windows Logo Program. The general consensus was that while it, in and of it self, was a good thing to have and promote, too many of the ISVs (Independent Software Vendors), especially the smaller ones who focus on specific niche markets, simply can’t afford certification, either due to the actual price of the evaluation (especially for server applications) or due to the resource and time cost to upgrade their older stuff to .NET.

One of the participants in the discussion argued that a major problem with the program is that, for a lot of ISV’s the question isn’t "HOW can we get the Logo?" but "WHY should we bother to get the Logo?"

· MSFT doesn't even certify all its own apps, so why should they?

· Getting the Logo will always have a cost – financially for the evaluation, time and resources for the necessary development – however having the Logo doesn’t provide an obvious competitive advantage for the ISV:

· Few businesses make the Windows Logo a requirement for purchasing decisions.

· People who do buy software are more interested in the functionality it provides than what it’s Logo status is/

Even when an ISV really wants to get the Logo:

· Meeting all the Logo criteria may be too costly in time and effort given what is available currently available.

· Meeting all the Logo criteria may actually be impossible given the nature of the application.

· How many computer action-oriented games can you think of that would be meaningful to someone who was blind even if it was text reader enabled? Or that would actually be engaging to someone with a mobility impairment that required it to be severely slowed? There are also machine level applications, such as anti-virus or disk partition software which simply won't work without administrative privileges. Since they won't be able to run under LUA (Least-privileged User Account) credentials they won't meet the bar for the current Logo program.

· The software will not get a Logo if it is unable to meet all the Logo criteria.

· If the software won't be able to get a logo because of one thing, what incentive do they have to spend any time worrying about their conformance to any Logo criteria when the time and effort that would cost could be "better" spent on further developing features and functionality.

If I could change things, what I'd like to see is a system where related sections of the Windows Logo criteria effectively represent individual Windows Logo certifications (much like the separation between Client and Server certification that already exists).

If the Logo program was re-implemented this way, it shouldn't be less expensive in all contexts (time, money or resources) for software to qualify for certification in the "basics" for Server or Client and would encourage ISVs to work towards full certification one small step at a time.

As an example, I would create separate Logo certifications under the following categories:

· Basics – Client
Minimum requirements for all applications that run on client
E.G., installation/setup, data manipulation and storage, stability, security &c.

· Basics – Server
Minimum requirements for all applications that run on client

· Administrative
Requirements for applications that should legitimately run with elevated Privileges.

· Accessible
Meets requirements of Section 508 of the Rehabilitation Act

· Global
Requirements dealing with Unicode data entry, Supporting for RTL languages, complying with user's locale settings, &c.

· Gaming
Requirements dealing with standard gaming features such as graphics acceleration, 3D display, audio support, &c.

Whenever an application has been certified for one or more category, the Windows Logo mark would always include a small checklist of all relevant Logo categories and the ISV can place check marks or dots or whatever next to those categories their software qualifies for. The list would only include "Relevant" categories since some combinations may not make sense. For example, there is no need to show "Basics – Gaming" on an Knowledge worker application.

By splitting up the Logo certification in this way it would also makes it easier for MSFT to start getting stricter about which apps meet the bar in each area. Any company that doesn't meet the bar in one area (other than "Basics") could still obtain the logo but only for areas where it does meet the bar. Hopefully, this would lead consumers to start using the checkboxes as a mark of quality - the more check marks, the higher the relative quality. Especially if MSFT takes the time to evangelize that Logo'd software equals Low TCO!

MSFT could then take a real stand and start enforcing a policy that NOTHING ships without at least meeting one or both "Basics" categories. Also, applications that fall into certain niches couldn't ship without also meeting certain other Windows Logo categories (e.g., a knowledge worker app, such as Outlook, must also qualify for the Accessible and Global categories while a desktop computer game must qualify for the Gaming category.)

So, what do you think?

· Is the current Windows Logo program useful or useless?

· Do you ever pay attention to whether some 3^rd- party application is Logo'd?

· If you are developing and testing an application, you have all the necessary resources available to you, would you actually bother to get your application certified or not? Why?

· Do you think that splitting up the Logo certification into thinner slices would make the program better, worse or no difference?

[NOTE]

I am aware the current Logo program does have "Optimized For..." options (e.g. "Optimized for Accessibility", "Optimized for Games", and such), but it doesn't really feel to me like its the same as what I'm trying to suggest. It certainly doesn't separate out all Logo criteria, categorize them into one or more areas thereby making it easier for smaller companies to avoid being "road blocked" for lack of resources, and thereby removing some of the excuses used to simply avoid the topic of Windows Logo Certification altogether.

All About “strawberryJAMM”

strawberryJAMM — Thu, 16 Sep 2004 10:35:00 GMT

I thought I'd start off this blog by introducing myself – it’s nice to know who is talking at you right?

My name is Jenni A.M. Merrifield, though (as I'm sure you've guessed) I also go by “strawberryJAMM” here and about online. I work for Microsoft as a User Experience Program Manager (UX PM) for the Windows Core Security (WCS) group. I joined the WCS in Feb 2004 and was originally tasked with driving the user experience issues for the “TrustBridge” team federated identity management project. Unfortunately for me (‘cause I really liked working with them), the entire TrustBridge team was re-org’ed out of WCS and into the Active Directory (AD) group where the product was officially christened “Active Directory Federation Services” (ADFS). Hopefully they will stick to my original plan and the snapin will be both useful and at least somewhat usable.

Currently I’m on the Application Security (AppSec) team and am focused on issues around the user experience when running with a Least-Privilege User Account (LUA) versus an Administrator Account, and around the configuration and application of Software Restriction Policies (SRP) in both the Home and Enterprise environments.

I have a little over seven years of industry experience in the User Experience field for client/server applications and systems development. Prior to my recent move to the WCS group I was with the Content Management Server (CMS) team in the Windows Server System group for almost three years and I worked for NCompass Labs, Inc. (a small startup located in Vancouver, BC, Canada that developed “Resolution” – the web content management client/server application that became “Microsoft Content Management Server” after Microsoft acquired NCompass in May 2001) for the four years before that.

Prior to hooking up with NCompass Labs (June 1997) I did time at university (11 whole years of time) and completed two separate undergraduate degrees: a Bachelor of Arts (BA) with a major in Classical Studies (The art, history, architecture and archaeology of Ancient Rome and Greece) from the University of British Columbia followed by a Bachelor of Applied Science (BASc) with a major in Computer Engineering (and a personal focus on human-computer interaction, user experience and ergonomics) from Simon Fraser University.

As you may have guessed, I originally hail from “Lotus Land” – (that would be Vancouver, BC, Canada) – and “I am Canadian”. My family and I moved to the Redmond/Seattle, WA area from the Vancouver, BC area in August of 2001 (about four months after the Microsoft acquisition of NCompass labs). Since then, my husband Ron, son Nathan (He’ll be six on Sep. 21st) and I have lived just south of a small city called Mill Creek which is, in turn, North West of Seattle. We do, however, make a point of regularly visiting our friends and family who still live “North of the 49th”. I expect… No, I know I’ll move back someday, I love that area too much, and while the Seattle area is similar, it just isn’t the same (close, but not the same). Still, I’m quite happy where I am at the moment, both with my career and in my life, so I’m definitely here for the long haul.

On a more personal note, when I can actually eek out some spare time (admittedly not nearly as often as I’d like), I love to read (almost any genre, but with a definite preference for science fiction and fantasy), I regularly DM and play in tabletop fantasy Role Playing Games (mainly D&D 3e5 and d20), and dabble in digital artwork and web site design for fun and (occasional) profit.

And that's the scoop on who I am and what I'm about. Now it’s up to you to decide whether the words that pass from my fingers to my keyboard and onto the pages of this blog are worthy of your attention. J