strawberryJAMM's Security and User Experience WebLog : Hi-Tech

mmmmmmmmmm..... This is not a Test. The World Is Flat. I Repeat, This is not a Test.... mmmmmmmmmm.....

strawberryJAMM — Sat, 09 Apr 2005 18:48:00 GMT

Someone on a mailing list I'm on passed along the URL to the article "It's a Flat World, After All," by Thomas L. Friedman, author of "The World Is Flat: A Brief History of the Twenty-First Century," from which the article is adapted (and which is now on my list of "books to read").

Friedman has quite a lot of interesting things to say in his seven web pages about the current status of the globalization process that started when Columbus safely returned home (thereby proving the world was round). ;This event kicked off an era where countries were globalizing for resources and imperial conquest, followed by the industrial revolution starting an era where companies were globalizing for markets and labor, and lead inexorably to the information era, where technology has "leveled the field" enabling individuals and small groups to globalize.

Around about the third page of the article, Friedman poses the question "How did the world get flattened, and how did it happen so fast?" He follows that up with a list of 10 events and forces, that all occurred or came together during the 1990’s, converging right around 2000. The first three world flatteners "created the new platform for collaboration":

Nov 9, 1989 – The Berlin Wall Comes Down (and Microsoft Windows 3.0 goes up)
Aug 9, 1995 – Netscape Goes Public (bringing the internet and the dot-com boom with it)
Workflow Revolution – Application to Application infrastructure (Enables outsourcing Y2K bug fixes to Indian engineers)

The next six world flatteners were the new ways in which individuals and companies could collaborate on work and share knowledge using the platform the first three created:

Outsourcing – work could be digitized, disaggregated and shifted to any place in the world where it could be done better and cheaper
Off-shoring – send the whole factory from Canton, Ohio, to Canton, China
Open-sourcing – whole new operating systems are written by engineers collaborating online and working for no pay.
Insourcing – let a company like UPS come inside my company and take over my logistics operations
Supply-chaining – create a global supply chain so efficient that when an item is sold in Arkansas, another is immediately made in China. (This is Wal-Mart’s specialty)
Informing – allow anyone to collaborate with, and mine, unlimited data all by themselves (This is Google, Yahoo and MSN Search)

The tenth and final world flattener, he called "The Steroids":

Wireless and Voice over Internet Protocol (VoIP) – the other collaboration methods areturbocharged: you can now do any one of them, from anywhere, with any device

Friedman follows up his discussion of these ten "World Flatteners" with the following quote:

<quote>

The world got flat when all 10 of these flatteners converged around the year 2000. This created a global, Web-enabled playing field that allows for multiple forms of collaboration on research and work in real time, without regard to geography, distance or, in the near future, even language. ''It is the creation of this platform, with these unique attributes, that is the truly important sustainable breakthrough that made what you call the flattening of the world possible,'' said Craig Mundie, the chief technical officer of Microsoft.

</quote>

As if the leveling of the playing field was not enough on its own, Friedman points out another convergence that occurred at roughly the same time: The three billion new players who walked, and often ran, from the sidelines and straight into the game. That is, all the people of China, India, Russia, Eastern Europe, Latin America and Central Asia who were suddenly no longer restricted from joining the free market after their economies and political systems opened up during the course of the 1990's.

>Friedman does go on to note that not everyone has access to this platform yet, but more people have access to it in more places on more days than ever before, and it the numbers are only increasing across the board with time. What I found particularly interesting was his and others thoughts that the so-called "IT Revolution" of the past 20 years was nothing more than the warm-up act – the first steps that forged, sharpened and distributed all the tools the world needed to collaborate and connect. The main act is only just beginning as we move on into the era where technology REALLY transforms every aspect of business, government, society and life.

Another quote that caught my attention:

<quote>

When the world is flat, you can innovate without having to emigrate. This is going to get interesting. We are about to see creative destruction on steroids.

</quote>

This got me thinking about how this trend is already changing immigration patterns into countries like the USA and Canada. There are tough requirements in these countries around who they will allow a company to bring in to work – ostensibly to protect their own citizens from the risk of loosing job opportunities to someone from another country. But, what happens when the companies really do not need to bring the people in to the country to get the work done? When the better educated, gung-ho people are not here but there? The jobs will be lost just the same – in fact, even more so. There are, of course, rules and regulations regarding what kind of offshore holdings a company can legally have, or how much offsite consulting they can legally utilize, but I wonder if, in the long run, this kind of locked down policing of global employment will do more harm than good?

You can already see this happening with help lines – you are more likely to get someone with a "friendly Indian lilt" answering your request for help, especially outside of North American working hours (8am EST to 6pm PST), than someone living closer to home, when you call a 24/7 help line. Even at Microsoft, we have staff working our internal corporate technical help desk lines in India in addition to staff in Denver, Colorado and some city in California. Truthfully, it does makes sense – over there, they are just waking up while, over here, it’s after dinner and we’re just trying to download our email or copy a document off of the corporate network Why hire people to work a "graveyard shift" when there are humans who can do the work as a "morning shift"?

Another quote, this one from Rajesh Rao, a young Indian Entrepreneur that Friedman spoke with, digs into the issue much more deeply:

There is no time to rest. That is gone. There are dozens of people who are doing the same thing you are doing, and they are trying to do it better. It is like water in a tray: you shake it, and it will find the path of least resistance. That is what is going to happen to so many jobs – they will go to that corner of the world where there is the least resistance and the most opportunity.

...

[Americans and Western Europeans would] be better off thinking about how you can raise your bar and raise yourselves into doing something better. Americans have consistently led in innovation over the last century. Americans whining -- we have never seen that before.

As Friedman says, "This is Not a Test" – it is time for the United States (and its cadres) to wake up and take a good long look at the other kids on the playground and in the classrooms. It will not be long before just getting by, by doing what has always been done and always worked, will not even get a "Satisfactory" grade from the World-at-Large.

We need to get going immediately. It takes 15 years to train a good engineer, because, ladies and gentlemen, this really is rocket science. So parents, throw away the Game Boy, turn off the television and get your kids to work. There is no sugar-coating this: in a flat world, every individual is going to have to run a little faster if he or she wants to advance his or her standard of living. When I was growing up, my parents used to say to me, "Tom, finish your dinner -- people in China are starving." But after sailing to the edges of the flat world for a year, I am now telling my own daughters, "Girls, finish your homework -- people in China and India are starving for your jobs."

I don’t know about you, but I’m already sitting on the edge of my seat, popcorn and a Coca-Cola in hand. The previews have ended, the digital sound check is just fading away, and the movie studio logo is rolling. In the next 10 to 20 years, there is going to be a spectacular, mind-blowing show unfolding around us. I sure wouldn’t miss this for anything in the world. Besides, I have a vested interest – I am expecting to write a line or two of the screenplay after all. ;-D

--
Jenni A. M. Merrifield =:= strawberryJAMM

strawberryJAMM moves to Blogs @ TechNet

strawberryJAMM — Tue, 29 Mar 2005 03:00:00 GMT

blogs.TechNet.com has officially gone live and "strawberryJAMM's Security and User Experience WebLog" has moved off blogs.MSDN.com...(read more)

Internet Explorer 7

strawberryJAMM — Wed, 16 Feb 2005 03:56:00 GMT

Today, in his keynote for the 2005 RSA conference, Bill Gates announced, among other things, that Microsoft would be releasing a new version of Internet Explorer for the XP SP2 platform. Internet Explorer 7 (IE7) is expected to continue with advancements already in Windows XP SP2 by adding additional security to the platform while still maintaining its current levels of extensibility and compatibility. Betas are expected to be sometime this summer.

Here are a few related links:

This is a Good Thing^(TM), and I think Dean, from the IE Team, puts it best in his "IE Blog" post about the IE7 announcement:

[The IE Team is] committing to deliver a new version of Internet Explorer for Windows XP customers. Betas of IE7 will be available this summer. This new release will build on the work we did in Windows XP SP2 and (among other things) go further to defend users from phishing as well as deceptive or malicious software.

Why? Because we listened to customers, analysts, and business partners. We heard a clear message: “Yes, XP SP2 makes the situation better. We want more, sooner. We want security on top of the compatibility and extensibility IE gives us, and we want it on XP. Microsoft, show us your commitment.”

I think of today’s announcement as a clear statement back to our customers: “Hey, Microsoft heard you. We’re committing.”

The only thing that I'd still like to know myself is whether IE7 will bring with it improved support for open standards such as CSS, XHTML, PNG, SVG, MathML, &c in addition to improved security. And it looks like I'm not the only one either, based on a quick scan of the first ten or fifteen comments to Dean's post. I think I'll have to skim through them (there are 354 as of 4:47pm PST) to see if Dean or anyone else on the IE team has responded to the queries from my "creative" kith and kin.

Geo-Blog - Where Blogs Meet Maps and Location

strawberryJAMM — Tue, 08 Feb 2005 03:20:00 GMT

At BlogMap you can geo-code your blog by entering a primary city, zip/postal code, country and your blog feed URL. Then you can link to your own BlogMap or display it as an inline image (you should be able to see a blog map for this blog just to the right of this paragraph) using a fairly simple URL!

Very cool, if you ask me. :-)

[edit: link correction, plus added break to clear past right float image]

The Problem of Usabilty in Open Source Software

strawberryJAMM — Wed, 20 Oct 2004 10:32:00 GMT

I just recently found this article on NewsForge about the problem of usability in Open Source Software (OSS). It was written by Frans Englich, who is a participant in the KDE project:

Open source usability is a technical problem we can solve on our own:

"Poor usability is a huge barrier to wider open source adoption. Our backends have matured and we consistently achieve technical excellence. Usability is the one area we have not yet mastered. For some reason, we treat it as a mystery instead of looking at it as a problem we can solve the same way we solve all other technical problems. " - Frans Englich, Friday July 09, 2004 (04:34 PM GMT)

I thought his initial characterization of the OSS community as a group of people who are wary of usability issues (and, by inference, other user experience issues) was both interesting and fairly accurate. In fact, I'd go so far as to argue that it isn't just OSS developers who look on with confused and dazed expressions when confronted with usability issues but that it is actually a characteristic of a significant majority of developers. Which is why product development teams frequently suggest or expect responsibility for the "mystical matter" of usability and user experience to be handed over, wholesale, to outside forces such as the "outside Companies, Experts and Laboratories" Frans attributes to the OSS developers or the members of a User Experience team that is rarely (in my experience) looked on as an integral part of the product development team.

Usability and other user experience issues aren't really all that mysterious - they just represent another technical problem that needs to be addressed along with all the other technical problems associated with a software application, such as Security, Performance, &c. I think we (Microsoft) are starting to grok that across the company - after all we already have "HOWTO's" for user experience issues in the Windows environment in the form of the Windows User Experience Guidelines and the Microsoft Manual of Style for Technical Publications - but it's going to be a long, slow journey that involves a significant culture shift away from developing technology for technology's sake and towards solutions for the user's sake, regardless of technology.

I just hope that our developers accept this culture shift and eventually acheive the goal of producing a truly usable, useful, operating system and software applications. (Preferably before the OSS community does. ☺)

Edit1: Corrected link to the Windows UX Guidelines. Thanks to uwe for pointing out the error.
Edit2: Expanded on and changed the tone of my last sentence.

Windows Logo Schmindows Schmogo

strawberryJAMM — Fri, 01 Oct 2004 02:33:00 GMT

I was recently involved in a conversation about what was wrong with the current version of the Windows Logo Program. The general consensus was that while it, in and of it self, was a good thing to have and promote, too many of the ISVs (Independent Software Vendors), especially the smaller ones who focus on specific niche markets, simply can’t afford certification, either due to the actual price of the evaluation (especially for server applications) or due to the resource and time cost to upgrade their older stuff to .NET.

One of the participants in the discussion argued that a major problem with the program is that, for a lot of ISV’s the question isn’t "HOW can we get the Logo?" but "WHY should we bother to get the Logo?"

· MSFT doesn't even certify all its own apps, so why should they?

· Getting the Logo will always have a cost – financially for the evaluation, time and resources for the necessary development – however having the Logo doesn’t provide an obvious competitive advantage for the ISV:

· Few businesses make the Windows Logo a requirement for purchasing decisions.

· People who do buy software are more interested in the functionality it provides than what it’s Logo status is/

Even when an ISV really wants to get the Logo:

· Meeting all the Logo criteria may be too costly in time and effort given what is available currently available.

· Meeting all the Logo criteria may actually be impossible given the nature of the application.

· How many computer action-oriented games can you think of that would be meaningful to someone who was blind even if it was text reader enabled? Or that would actually be engaging to someone with a mobility impairment that required it to be severely slowed? There are also machine level applications, such as anti-virus or disk partition software which simply won't work without administrative privileges. Since they won't be able to run under LUA (Least-privileged User Account) credentials they won't meet the bar for the current Logo program.

· The software will not get a Logo if it is unable to meet all the Logo criteria.

· If the software won't be able to get a logo because of one thing, what incentive do they have to spend any time worrying about their conformance to any Logo criteria when the time and effort that would cost could be "better" spent on further developing features and functionality.

If I could change things, what I'd like to see is a system where related sections of the Windows Logo criteria effectively represent individual Windows Logo certifications (much like the separation between Client and Server certification that already exists).

If the Logo program was re-implemented this way, it shouldn't be less expensive in all contexts (time, money or resources) for software to qualify for certification in the "basics" for Server or Client and would encourage ISVs to work towards full certification one small step at a time.

As an example, I would create separate Logo certifications under the following categories:

· Basics – Client
Minimum requirements for all applications that run on client
E.G., installation/setup, data manipulation and storage, stability, security &c.

· Basics – Server
Minimum requirements for all applications that run on client

· Administrative
Requirements for applications that should legitimately run with elevated Privileges.

· Accessible
Meets requirements of Section 508 of the Rehabilitation Act

· Global
Requirements dealing with Unicode data entry, Supporting for RTL languages, complying with user's locale settings, &c.

· Gaming
Requirements dealing with standard gaming features such as graphics acceleration, 3D display, audio support, &c.

Whenever an application has been certified for one or more category, the Windows Logo mark would always include a small checklist of all relevant Logo categories and the ISV can place check marks or dots or whatever next to those categories their software qualifies for. The list would only include "Relevant" categories since some combinations may not make sense. For example, there is no need to show "Basics – Gaming" on an Knowledge worker application.

By splitting up the Logo certification in this way it would also makes it easier for MSFT to start getting stricter about which apps meet the bar in each area. Any company that doesn't meet the bar in one area (other than "Basics") could still obtain the logo but only for areas where it does meet the bar. Hopefully, this would lead consumers to start using the checkboxes as a mark of quality - the more check marks, the higher the relative quality. Especially if MSFT takes the time to evangelize that Logo'd software equals Low TCO!

MSFT could then take a real stand and start enforcing a policy that NOTHING ships without at least meeting one or both "Basics" categories. Also, applications that fall into certain niches couldn't ship without also meeting certain other Windows Logo categories (e.g., a knowledge worker app, such as Outlook, must also qualify for the Accessible and Global categories while a desktop computer game must qualify for the Gaming category.)

So, what do you think?

· Is the current Windows Logo program useful or useless?

· Do you ever pay attention to whether some 3^rd- party application is Logo'd?

· If you are developing and testing an application, you have all the necessary resources available to you, would you actually bother to get your application certified or not? Why?

· Do you think that splitting up the Logo certification into thinner slices would make the program better, worse or no difference?

[NOTE]

I am aware the current Logo program does have "Optimized For..." options (e.g. "Optimized for Accessibility", "Optimized for Games", and such), but it doesn't really feel to me like its the same as what I'm trying to suggest. It certainly doesn't separate out all Logo criteria, categorize them into one or more areas thereby making it easier for smaller companies to avoid being "road blocked" for lack of resources, and thereby removing some of the excuses used to simply avoid the topic of Windows Logo Certification altogether.

Digital Rights Management - A Product Customer’s don’t Want

strawberryJAMM — Fri, 17 Sep 2004 09:30:00 GMT

{This post is an expansion of a small section out of a longer, non-technical, post at my “personal” blog at strawberryjamm.blogspot.com . This should be it for the reposts.}

The quoted text and link below is from a transcript of an excellent talk about digital rights management (DRM) given by Cory Doctorow on the Microsoft Redmond Campus. I, unfortunately, missed seeing the talk live, but did get to see a recording of the session a week later. It had a bit more zip and zing to it but the transcript is still good reading.

I thought he made some really good points (though I must admit I have doubts about how seriously anyone working on DRM solutions here probably took his views). One such point was around why DRM systems ultimately don’t work: the “attacker” trying to crack the secret is also the “recipient” of the coded message (after all, what use is having an encrypted DVD if you don’t also have a device that allows it to be decrypted and played?) So Alice sells Bob her encrypted DVD, and a DVD player that can play it, Bob ends up with the key, the cypher, and the cyphertext in his hot little hands, and, as Cory says, “Hilarity ensues”).

Another point that resonated with the “user experience professional” side of me, was how it is essentially a fallacy to believe that DRM is particularly useful as a “speed bump keeping honest people honest” (he gives this wonderful example of how existing DRM on a DVD ruined the experience of an honest friend of his who was only trying to do something perfectly legal.)

<quote who=“Cory Doctorow” what=“DRM and MSFT: a product no customer wants”>

Greetings fellow pirates! Arrrrr!

I'm here today to talk to you about copyright, technology and DRM, I work for the Electronic Frontier Foundation on copyright stuff (mostly), and I live in London. I'm not a lawyer -- I'm a kind of mouthpiece/activist type, though occasionally they shave me and stuff me into my Bar Mitzvah suit and send me to a standards body or the UN to stir up trouble. I spend about three weeks a month on the road doing completely weird stuff like going to Microsoft to talk about DRM.

I lead a double life: I'm also a science fiction writer. That means I've got a dog in this fight, because I've been dreaming of making my living from writing since I was 12 years old. Admittedly, my IP-based biz isn't as big as yours, but I guarantee you that it's every bit as important to me as yours is to you.

Here's what I'm here to convince you of:

1. That DRM systems don't work

2. That DRM systems are bad for society

3. That DRM systems are bad for business

4. That DRM systems are bad for artists

5. That DRM is a bad business-move for MSFT

It's a big brief, this talk. Microsoft has sunk a lot of capital into DRM systems, and spent a lot of time sending folks like Martha and Brian and Peter around to various smoke-filled rooms to make sure that Microsoft DRM finds a hospitable home in the future world. Companies like Microsoft steer like old Buicks, and this issue has a lot of forward momentum that will be hard to soak up without driving the engine block back into the driver's compartment. At best I think that Microsoft might convert some of that momentum on DRM into angular momentum, and in so doing, save all our asses.

Let's dive into it.

</quote>

Thoughts on Designing Administrative User Experience

strawberryJAMM — Thu, 16 Sep 2004 14:51:00 GMT

{This is the second user experience related post from my “personal” blog at strawberryjamm.blogspot.com}

Originally Posted: Monday, April 19, 2004

In my current position as a Microsoft UX PM in the Windows Security Core I am responsible for the administrative user experience of a V1 product being developed to support web service federated authentication. This is a wonderful opportunity, and one I am grateful to my new group for. All too often UX professionals focus on the end user experience, concentrating on the usability of client tools and leaving the men and women who are responsible for installing, monitoring and maintaining the servers the end users interact with - otherwise known as "IT Pros" - stuck in a dismal world with little more than an esoteric CLI (Command Line Interface) and an application-centric GUI (Graphical User Interface) shell.

Some IT Pros would sit up at this point and shoot back at me with the comment that they actually prefer using the command line for their work. One claim I've heard is that trying to use a GUI for daily IT tasks is too slow and often much more complex than just opening a command window and banging off a few, usually well known, command line parameters. Another comment is that they prefer to write scripts for frequent and/or repetitive tasks anyway.

I think a lot of this attitude is really alpha geek posturing:

<quote who="Alpha-Geek">

At the drop of a hat I can quote the syntax of any command line parameter for applications X, Y and Z. I can and you can't, therefore I must obviously be much cleverer and technologically savvy than you are.

</quote>

But the truth is even IT Pro's are human (trust me, they are. Even the ones that you'd swear are aliens from an alternate dimension), and they are also users. And any human user can benefit from the application of a user centred design approach on any tool that is developed to help them meet their goals. The key, of course, is to focus on the right kind of users - in this case, the technically savvy IT Pro, who wants to complete daily tasks quickly and be made instantly aware of problems in the system so that operations will continue to run smoothly.

One thing that I've been trying to teach my new team is that it really doesn't have to be an "Either/Or" choice between having a good GUI or a good CLI. Instead, it should be an "And/Both" - that is, have a good GUI AND a good CLI. When both kinds of interface have been designed to meet the user's ability to achieve goals and tasks, then the user is truly free to choose the tool that best suits the current scenario.

If we want IT Pro users to actually use a GUI-based administration tool, it must be at least as straightforward for an expert to do common tasks with it as with CLI (preferably, it would be even more straightforward). Using the GUI-based tool should not impose a significantly greater amount of key strokes than using a CLI would.

On the other hand, a CLI should also be designed with ease of use in mind. Parameter names should be meaningful and sensible so they are easy to remember and reasonable defaults should be provided whenever possible so that the process of scripting a task is straightforward. Additionally, every single action that can be done in the GUI-based tool must also be possible through the CLI, and vice versa (I'd be rich if I had a dollar for every time I've encountered a tool with some operations that could only be done through the GUI and some operations that could only be done using the command line.)

Give administrative users the best of both worlds - GUI and CLI - and they might actually like installing and maintaining a server application.

What a great idea!

Critiquing Open Source UI

strawberryJAMM — Thu, 16 Sep 2004 14:10:00 GMT

{This is the first of about 2 or 3 user experience related posts that I originally made on my “personal” blog at strawberryjamm.blogspot.com that I thought I’d reprint here, just to get things going}

Originally Posted: Monday, April 05, 2004

The following note was sent to a Microsoft UI Design discussion list I’m on the other day. As I agreed with the comments of the original poster (one Andrew McLaren by name) I thought that I would just copy them all here:

<quote who="Andrew McLaren">

Eric Raymond, self-appointed spokesperson for the Open Source movement, recently wrote a few articles complaining about the poor state of UI design in many open source projects. See for example

http://www.catb.org/~esr/writings/cups-horror.html.

A superficial response to this might be "good, the Linux guys are admitting they have cruddy interfaces and that they need to lift their game". But John Gruber has written a much more devastating analysis of Raymond's comments:

http://daringfireball.net/2004/04/spray_on_usability.

This scathing and insightful essay is full of good quotes; e.g.:

"This sort of task-driven interface is windows' forte ... they make these tasks approachable for [ordinary users]. And they're the result of a lot of work by a lot of well-paid full-time Microsoft engineers."

Okay we could take issue with the "well-paid" bit :-) - but anyways - and ...

"It's easy to ridicule the estimated 2006-or-2007 ship date for Longhorn... [but] do you doubt for a moment that Longhorn will provide more improvements from Windows XP than desktop Linux will gain during the same period?".

Gruber's core complaint is this: Raymond castigates Linux developers because they've done great fundamental software work, but then they've slackened off at the end, and not paid enough attention to that last little bit to make a project a success - the UI. Whereas, according to Gruber, good UI design is an intensive project in its own right, potentially much longer and harder than coding the inner logic and function. And structural aspects of open source militate against them ever getting good results, even if they did "put in that last little bit of effort."

Anyway Gruber's whole essay is a good read. I gather he is more of a Mac-oriented kinda guy; but I guess in this area, Apple and Microsoft have some common ground.

</quote>

I, also, definitely recommend both articles.

Follow-Up:

Moms are the best ego-boosters. I forwarded the information I blogged above to mine and this was the response she sent me:

<quote who="Mom">

I liked this statement:

“Conversely, some people who are good UI designers aren’t programmers. But the rock stars are the guys who can do both, and they are few and far between.”

Maybe you should be getting paid more - you are a hardware engineer with program experience and UI specialization - no wonder your new group wanted you !!!

</quote>

"A user experience rock star"...

You know, I do like the sound of that. J