Comments (1)

By Mark Curphey, September 7, 2010

I recently heard a wonderful story about design that I simply had to re-tell. Claudia Kotchka is the head of design at Proctor & Gamble. P&G make stuff and they make lots of it. From household goods to food P&G design and manufacture a wide range of goods that I am sure you use. In October 2005 Kotchka spoke at an industry event about the emotional connection between people and design and in an attempt to drive home the point that design is not just about being functional used the Altoid tin as an example. Altoids are the curiously strong mint that come in a distinctive tin.

Here is how she described the Altoid experience:“Open the metal tin with the nostalgic typeface; hear and feel the crinkly liner paper; smell the scent of peppermint oil wafting out the of box; and see the hand-made appearance of the uneven size mints. Even the tin appears to be hand filled and packaged. The whole thing is very authentic.”

Of course Altoids are as mass produced as other candy but the company has maintained the design as they have modernized their production. Kotchka described a scenario of how Altoids might look if P&G owned the brand (before their focus on design of course). P&G are a functional company who do a great job designing packaging that is highly efficient. The management would almost certainly attempt to get rid of the expensive tin and put in it a diaper-wipe type container with a single cheap mono-tone sticker. The liner paper would go and mints would be normalized in shape to reduce the size of the container and hence reduce manufacture, shipping and storage costs. She even suggested that P&G would probably rename the new product Proctoids to maintain the brand but promote P&G. To drive the point home she had an industrial designer mock-up the new product for full visual effect. The only image I can find is poor quality (see above) but certainly provides a good visual.  It’s unidentifiable from a pill dispenser; functionally great design, low cost, high performance but with zero emotional connection. Gone would be the pleasure people get when they buy Altoids in a tin and ironically gone would be the significant price premium over other mints (that far outweigh the additional manufacturing costs).

In the software world Apple get design and the Apple Design Awards recognize great software design. If you haven’t played Flight Control (one of this years Apple Design Awards for the iPhone) then I recommend it. There are some wonderful examples of web based software appearing that creates an emotional connection and that has loyal fans. Zendesk.com is one example but there certainly aren’t enough.

When I was at University I shared a house for a short period of time with a student artist. I used to laugh at his stupid bits of art and fall on the floor when he used to tell me “You aren’t qualified to make a judgment on whether its good or not”. I was young and frankly he was an idiot. His response was an excuse to being challenged much like you hear the god squad preach “god exists because you can’t prove he doesn’t”. What was missing though was an appreciation that an emotional connection between a person and a design (art or software) is a personal thing. Good design is rarely the optimal functional design but when we get design right for a large portion of the potential user population it will result in loyal passionate fans who are prepared to pay a premium. The same principle applies to a work of art by Rembrant or a web site by a young Rails coder.

Factoid : Design matters.

Comments (0)

By Mark Curphey, September 7, 2010

This post is #10 (the last and hopefully the best) in a series 10 Crazy Ideas That Might Just Change the State of the Security Industry.

I have been doing Agile development in earnest for about two years now. First while building security tools like static code analysis and web protection libraries and most recently building large scale web sites. I have learnt a lot (actually I have learnt a great deal) and while Agile is clearly not a panacea, I firmly believe that it could be successfully applied to many security situations to improve the state of the security industry. What follows are a selection of ideas; certainly not complete and certainly not exhaustive. This post should not be confused with infusing security into an Agile process. This post is about using Agile techniques for security.

For context Agile works best in a world sandwiched firmly in-between complex & chaotic projects and predictable & simple projects. This is the Agile “sweet-spot” and luckily enough (from my experience) where 99% of the security projects I have seen fall. Many stalwarts who don’t understand Agile often say something like “But Agile is not for the Enterprise.” Here is a factual answer: “The Enterprise is a colossal spaceship from the 80’s flown by people with bad taste: Highly advanced, but purely fictional”. Don’t make the common mistake of confusing the size of a project with complexity or predictability!

Agile takes a pragmatic approach to life by acknowledging that when we first encounter a project (or topic) it is the point when we understand the very least about it. This is called the “Cone of Uncertainty”. What tends to happen in non-Agile environments is that people try to estimate the size of a problem or project at the funnel end the very point when they are least qualified to make an accurate estimation. This is true for example of security reviews. A security consultant typically is given an overview, an RFP or high-level description and asked to estimate the amount of time and therefore cost a project will take. They are asked to estimate the time and cost to perform a function such as a code review based on nothing more than a high-level description of the application or in some cases basic information like the LOC. In reality what happens (and this maybe a dirty little truth about the industry but I can tell you that its the norm) is that consultants will simply cut back on the scope or depth of analysis to match their initial estimation. Instead of getting an analysis of the things that need analyzing you end up getting an analysis of the things that can be analyzed in the amount of time that was guessed. This is actually why the concept of Threat Modeling is powerful. It allows an analyst to understand the system and isolate the areas of importance that warrant further detailed investigation.

Another common Agile concept is ‘Plan for Today And Worry About the Future Tomorrow’ – Most people try to plan for the future and layout elaborate timelines that stretch into the distance. Most are based on what-if scenarios. What-if “X” happens or what-if “Y” happens ? The reality is most people fail with this approach. Most plans are nothing more than guessing games. Security assessments and architecture reviews usually do exactly this, guess what will need to be done. Agile promotes worrying about real tangible problems that we face today and not getting side-tracked into thinking about issues that may or may not occur tomorrow. Don’t be fooled into thinking that this means ignoring architecture and scale. It just means keeping a solid eye on reality and not on fiction.

And for people who think that accurate estimation is complex and really tough try this. Choose a city about an hour away, then choose a city a few hours away and then choose a city in the middle of the country and then one of the other side. Get a team of people to estimate the time it will take to travel to each location using relative measurements ie if the city one hour away is one then how many units would the next one be? We did this exercise in Seattle with Tacoma, Portland, San Francisco, LA, Las Vegas and Miami and were able to estimate the distance from Seattle to Miami within 100 miles! That kind of result is repeatable and predictable. Most people spend way too much time trying to make perfect estimations when in reality accurate approximations using comparative techniques are all that’s needed.

The Agile manifesto http://www.agilemanifesto.org lays out a set of principles in a particularly meaningful way and one such principle is that Agile values ‘Individuals and Interactions over Process and Tools’.  Another way to say that is that partnerships drive results. In my experience very true partnerships between security specialists and developers exist. Instead we have lots of CYA process and “gotcha” type traps built and operated. Security people must partner with developers and encourage them to partner back.

The Agile manifesto talks about ‘Working Software over Comprehensive Documentation” & about ‘Customer collaboration over Contract Negotiation”’ – I will always remember when I was audited by a PCI firm that shall remain nameless (to protect the stupid). I had some code that protected a token passed on URL parameter. It was cryptographically secure (from replay, tampering, viewing etc) but I failed the audit as the token wasn’t passed over SSL. I was caught on a technicality. This was a case where a secure system (working software) didn’t meet a checklist (comprehensive documentation). As Forest Gump would say “Stupid is as stupid does”.

Finally (for this post anyways) Agile promotes the mind set of always working on the highest priority thing in small increments to deliver the greatest value while embracing change. I believe that by adopting the way we manage backlogs would help security teams groom what’s important and always be working on what’s the most important thing to be working on at that time.  In Agile we maintain what is called a Product Backlog, a fancy name for a list of things we want to do. When we understand enough about each item on the backlog (usually to estimate the effort to take on an item) we rank them and work from the top of the pile. We spend time and effort refining the backlog, an activity called Backlog grooming. Compare that to the way a typical security assessment is done today, procedurally following a long list of pre-determined things. By spending more time on the important topics as we define and understand them would allow us to be more effective at reducing real risk.

I hope the series has been useful.

Comments (0)

By Mark Curphey, September 6, 2010

This post is #8 in a series 10 Crazy Ideas That Might Just Change the State of the Security Industry.

When Jason Fried of 37 Signals spoke at Web 2.0, most for the media picked up on a great meme proposing that web site owners should think of themselves as software curators. Instead of trying to pack in as many features as possible, it’s is the ‘collection’ of features that create an experience and what ultimately matters. During the talk he spoke about design driven software and used a few great analogies, one using a clear water bottle to explain why it’s easy to assess the quality of the design of a physical objects and then went on to discuss why software is so relatively hard. I recommend the video here and a talk by Ryan Singer the 37 Signals UX person here.

End users of most software are simply confused about security warnings and therefore generally ignore them. Security features such as authentication systems are privacy settings are complex and in general seem to be designed by and for developers. FaceBook had 4,000 comments in a week for privacy features that it claimed already existed.

Most security software is also nothing more than a hodge-podge of every possible feature every possible security person can think other users might want want. Security people have long ridiculed the desire to have a “shiny red security button” including myself many many times. The truth is that security is way too complicated for the majority of people and it has to be made easy. That wil only come by embracing Design Driven Security.

Comments (0)

By Mark Curphey, September 6, 2010

A simply great quote from Jeff Bezos read on Six Pixels of Separation Blog

“Before if you were making a product, the right business strategy was to put 70% of your attention, energy, and dollars into shouting about a product, and 30% into making a great product. So you could win with a mediocre product, if you were a good enough marketer. That is getting harder to do. The balance of power is shifting toward consumers and away from companies…the individual is empowered… The right way to respond to this if you are a company is to put the vast majority of your energy, attention and dollars into building a great product or service and put a smaller amount into shouting about it, marketing it. If I build a great product or service, my customers will tell each other.”

Comments (0)

By Mark Curphey, June 1, 2010

Introduction

User forums are ubiquitous these days. There are chat boards where mums discuss how to best bring up their kids, forums for people who like to garden and premium support forums where technicians provide customer service to frustrated software users. Millions and millions and millions of people use forums everyday to get connected with other users and get information on an endless amount of long tail topics. So user forums must be a brilliant bit of clever software design right? Wrong! In fact dead wrong!! The main trouble is that the basic design of user forums haven’t changed to any real degree over the last decade when forums were designed as textual based navigation systems for server to server connections using telephone lines. At this time forums were of course called BBS’s or Bulletin Board Systems.

Since BBS’s first came on the scene other web software that has evolved has gotten a whole lot better. We have seen the rise of social software like Blogs, Twitter and FourSquare and the whole culture of crowd-sourcing and user generated content has risen from Web 2.0 movement. I think it’s high time that user forums were dragged into the modern way of designing web software. In doing so we can accelerate the connection of people at an even greater rate than we have today and provide an all around better user experience.

In this post I will dissect the problems with most forum experiences today and describe what I think is a better way. To be clear and upfront a few sites have ‘got it’ and created the modern versions of forums I am describing here.  Those sites like FaceBook, Twitter and StackOverflow have grown huge user bases and serve as perfect examples!

The Very Very Quick History Lesson

Back in the old days when you connected to other computers with a 14.4 kb / s modem that screamed as it transmitted data (and real geeks knew the exact tone made when a connection was made) if you wanted to ‘connect’ to a group of people you probably used a BBS or Bulletin Board System.  A BBS was hosted on a server (that you typically dialed via the phone network before mainstream Internet) and organized around a topic of interest like “hacking phone systems”. In the early Internet days companies like AOL and CompuServe would host collections of forums on their systems usually sorted by broad topics like “travel” or “technology”. BBS’s have always been hierarchical in the way they organized topics meaning that you need to go look for information in a particular place.  BBS’s were originally pure text based navigation systems and have slowly progressed through crude tree navigation to today’s software that replicates the same design pattern using HTML. When the Internet as we know it today started to evolve a parallel system called NNTP (Network News Transport Protocol) took off that allowed a global collection of forums that were distributed and synchronized typically by ISP’s to be accessed via an NNTP news client. These forums were again arranged in a hierarchical manner. You always had to go looking for what you were interested in and then subscribe to the category to get new threads. Since the early part of the decade web based forums have largely taken over and with popular software like PHPBB and Phorum.

The Problems With User Forums

As we have learnt how social software works (as in is successful) we can look at the original BBS design with a critical eye (and of course the beauty of hindsight) and identify key areas that are “sub optimal”.

• Discoverability
• Relevance
• Distribution
• Aggregation

Discoverability – Search doesn’t work well on discussions that tend to flow between states. For example at what point in an online discussion did the question you were interested in asking turn into an answer? This is a tough problem for which the best search engines today are far away from being good at solving. When it comes to finding relevant information a user has to know that a a forum contains a gem of information about a particular topic. That means a taxonomy of topics must be setup and the user has to navigate through the taxonomy to the place where the information would most likely have been posted. That is not a huge problem and search can certainly help but it’s ineffective all the same but when combined with the challenges in where to post information the problem gets significantly worse. For instance if a gardener wants to post a question about a tree should it be in a perennial forum or a landscaping forum? The effect is that most forums administrators (who are not information architects) tend to adopt one of two strategies. They create forums for every discrete topic and rely on navigation or create a few topics and rely on search. As discussed above neither are great ways of finding the useful information buried in forums.

Relevance - Some forum software allows you to rate content and even rate users in an attempt to help relevance but none I have seen connect with social media systems like Twitter or FaceBook to provide ratings systems based on users social graphs. If I follow @caracurphey (my wife) I am likely to be much more interested in what she posts in a forum than “Random Joe”.

Distribution – While modern web based forums allow RSS aggregation of posts threads and a few allow email as a way to post ad receive, BBS’s are for the most part a pull model. You need to go and get the data. Mint.com sends me an update when I have been charged an ATM fee but forum software doesn’t alert me when an interesting topic is getting discussion heat.

Aggregation -  Forums today in general only contain information created in the forum itself. They may contain outbound links but rarely dynamically created external content. This makes the forum an island of data, isolated from other discussions that are happening in other media forms like Twitter or Blogs. While its true that we could manually reference external sources of information in practice its to hard and rarely done. In the physical world we get information from books, online, TV, radio, face–to-face and all form part of the body of knowledge we use to communicate and connect. Forums don’t do a good job of aggregating information from anywhere other than the forum itself.

There is a better way!

I think there are several techniques that can be used to design better forum software. These techniques can be used in isolation or used together (with some careful thought).

Discoverability – Instead of setting up an fixed data-model in which users will come and post (the forum) users should be encouraged to tag data describing the information in a way that it can be exposed into various views using the ‘tags’. One bit of information should have many tags and a tags will relate to many pieces of information. A forum today typically tags each thread with just one description, the forum it belongs to! Lets say for instance we want to ask a question about Configuring Ruby on Rails on Cygwin we would tag the post with Cygwin, Ruby and Rails. This would allow the discussion to surface to users watching any of the three topics as opposed to the place where the user happened to think it fitted best. Users on the other hand would be able to set up “streams” using tags that would allow the system to surface relevant posts. I may for instance create a “stream” where posts on Ruby surface and a “stream” where Rails posts occur. The Ruby on Rails post may well appear in both streams but given its a reference to one bit of information the lifecycle (replies etc) will also be reflected in both. Experience has shown that managing “tag clouds” provides a balance between the semantic web and a humanly navigable web site. 

Using this technique users don’t need to know where to post their information (they just need to know how to describe it) and users can more effectively find information by subscribing to “tags”. This technique is used heavily on StackOverflow and has proven to be very scalable.

Relevance – Content is often better when it has come from recommended users you trust. Modern forums should leverage the social graph created from Twitter, FaceBook or Linked-in. If a post was made by a Twitter user you follow or a by a FaceBook friend it should have a different level of relevance than from a complete stranger. Let’s face it if a friends asks you for help or has something to say you are generally more inclined to help than Godfried from the Bank in Nigeria trying to give you $25 million dollars! Ironically connected to the social graph also helps reduce spam.

Distribution – Some forums like www.communityserver.org allow you to post and receive mails via the web and via email. Sometimes users are better suited to email that the web and other times they may prefer to browse via RSS and comment via Twitter. Users should be able to choose how they interact with the discussion stream.

Aggregation – There are many ways discussions start on the grid. Email, Twitter, RSS posts + comments, FaceBook etc. Forums software force a user to interact with one conversation type rather than do the hard work of aggregation and provide a seamless way to traverse the mediums using software. I think content should be able to be aggregated into “information streams”. As an example I may want to set up a stream on “Ruby on Rails Development” and provide meta-data that the stream should be created based on “Google News”, my OPML RSS feed list, people I follow on Twitter and my FaceBook friends as well as a traditional threaded forum for users to post new information outside of those systems. A discussion may start as a pithy comment in 140 chars and move on to a healthy threaded debated on a forum and then be summarized in a blog post. That’s information lifecycle is important to follow and it’s important that the discussion remains fluid and seamless as it transpires. There is simply too much friction in moving from one medium to another and today too much gets lost.

In many ways this is what FaceBook does. It builds a wall (an information stream) from user activity with FB and applications interacting with its FB platform. Bob just sent Alice a starfish or Kate just commented on Simons photo. Unlike FB I think the user should be able to interact with the stream via any of the mediums the software supports (with the constraints of the medium selected (140 chars etc)).

Summary

I think that Discoverability, Relevance and Distribution are relatively easy to improve on and would have significant improvements on how most forums work today. FaceBooks walls and StackOverFlow are great examples of how these techniques can be used with dramatic results. Aggregation is probably the “holy grail” and clearly needs some significant thought but what this could give you would be a way for very specific and focused discussions that form naturally from online interactions in an “information swell”. Those discussion streams would interact seamlessly with the various ways users consume and produce information in a way that provides a better way to link to and add value to related dynamic data.

So is this Google Buzz? No I dint think it is. I tried Buzz and didn’t get it. It felt like it was trying to be everything to everyone. It was IM meets Twitter meets …..a “stream” is simply a more effective and efficient way to hold a group discussion online. Believe you me the world doesn’t need another incarnation of BBS and forums. What the world needs is a digital water-cooler. I think information streams built out may provide that “better way to discuss things online” and if done in an open source open standards way could have a dramatic effect on the efficiency and effectiveness of human-to-human digital conversations. 

Now all that is left is for me to whip up a prototype I guess….

Thanks to Mike DeLibero for  reviewing the article prior to posting.