CheckPoint SecureClient

I have spotted one pleasant peculiarity (feature) of CheckPoint VPN SecureClient on Mac OS X - it warns user of imminent session expiration.

In my 4 years of usage, the PC version warns you only when you have lost connectivity, and annoys user with "Reconnect" requests for new RSA code.
But that, magically, never happens on a Mac. In fact, Mac users are politely warned BEFORE issues occur.

How gentle and nice of you, CheckPoint!

BTW if I was to compare CheckPoint VPN to Cisco VPN, I must say that Cisco has one annoying feature turned on by default, and it takes a lot extra effort to fix that - all traffic goes to VPN tunnel.
This means that if remote secure network does not support a service you want to have (SMTP, POP, Skype, whatever), you're toast until you disconnect.

Quite important for telecommuters.

All in all (taken into consideration the admin tools) CheckPoint software is much more usable and has better GUI.
I only wished their installers properly removed (upgraded) their previous versions...

Insecure certification? Say no.

If you, like me, have worked for some corporation, or even smaller company with an Intranet, then you'd recognize this kind of screenshots:

It's a long standing security issue and the one I just read an article about here

For people without due understanding of certificates and why they are used, this is a non-issue - they just click "Continue" or something to that effect - and go on.
But the devil is in the details, as we know.

I think it's about time we stopped allowing that.

Besides presenting a usability issue, namely a "nag" dialog, it also de-voids one of two purposes of certificates - it does not verify the server's authenticity, allowing for so called "man-in-the-middle" attack.

The second, remaining, purpose is encryption against eavesdropping, but this one will also be crippled if you're talking to "the wrong" server after clicking "Continue" on invalid certificate.
Simply because the eavesdropper will be the non-authenticated (fake, malicious) server with similarly incorrect certificate, to which you'd blindly accept connection.

Such practice had been "convenient to user", who needed a way to access things, and "merciful to developer" who did not want to spend money on SSL certificates from established Certificate Authorities.
Well, there's been epoch with no condoms, and people suffered greatly while not realizing there's an exit.
As more and more electronic fraud and hacking dilutes quality of online life, there's more and more need to establish better standard practices.
Now web looks like only richer folks can buy needed protection. The rest of us have to "blindly click extra".

Time to revisit what stops us from helping every website?

I would suggest to "close the cap" by disabling access from all browsers to invalid certificates.

The only exception left would be VALID self-signed certificates, but they should be separately indicated in browsers by a special icon (not the padlock as with CA-signed certificates). Such exception leaves out one vector of attack - DNS.

And for future development, there is a need to secure DNS, too.
I think there can be one solution to both problems.

An option to get certificate when registering your domain name!
(Directly from the registrar.)

Think of this - we trust DNS, should not this trust be augmented by certification?

Unfortunately, this would mean serious increase in business for registrars and decrease for CAs.
Well, good does not come without changing.
Besides, I think they are in the right position to lobby this as a new web standard.

For registrars, that would be an additional competition vector.

Cloud computing

I was thinking of those 'new' paradigms and buzzwords.
I believe the strife to create such ecosystem is easily explained:

If it's called 'cloud computing' then how do you call someone who 'sits on a cloud'?

Their usual mantra is "have your information anywhere" which actually means "we hope to have all your info and lend you access to it" + "you must also pay the internet fee whenever you want to use your data".
No suprise, as usual, the best business is when you sell people something they already have.

Either way, IP communication companies have brighter future.

Web is making new mistakes

Lo and behold! The web is making new mistakes.
But before I explain what, let's first look at previous common mistakes and misconceptions, made by way too many designers, software architects or coders during those "Internet boom era" days (some might say "dark days")...

1. "That darned encoding stuff"
That was way uncool in the 90s, when you got and e-mail with incorrect encoding set, or arbitrarily changed by one of SMTP relays, or not set at all.
According to RFC2047, if an encoding of a body or subject is not indicated, it should be treated as ASCII.

"Thanks" to development of web clients (browsers, instant messengers and e-mail clients) which allowed to override this RFC by setting "Default" encoding (changing it from RFC ASCII to accomodate lame content), many other developers and web masters could still not care to indicate international encoding in their content, nor process it properly in case of relays and web platforms. They relied purely on user setting his "Default" encoding to his native language (for me, that was Русский).

All this havoc continued until the bloom of Unicode in XXI century, and nowadays most e-mail bodies are properly encoded and re-coded, while I cannot quite say the same for e-mail subject lines (especially from some forum/BBS platforms).
AOL seems to have fixed their ICQ offline messages encoding only with the latest update of protocols, which broke some clients. That was one reason why RFC822 was not that widely accepted.


2. Browser wars (image courtesy of Saint Michael's blog)
Vertiginous success of Microsoft Explorer as the dominant browsing technology, coupled with Microsoft's competitive practice of ignoring or bastardizing standards, led de-facto to a massive deviation from official W3C standards and behaviours.
Many webmasters never tested their stuff on another browser.
Most companies shrugged of the need to allow a bigger budget for true "web compatibility" testing of their intranets.
The competitive ecosystem was not healthy when Microsoft almost monopolized the market. Microsoft's "Embrace and Extend" strategy had it's negative impact on true multivendor/multiclient compatibility in the Web.
Not only Microsoft's to blame, of course.
Netscape, which probably had 85% browser market share before Windows 95 came out, had made a decision which caused it lose the leadership: to re-write the browser from scratch. Thanks to that, we now have Mozilla Firefox!
Firefox, Google and Apple are leading the world to a standards-based future.

Now, what's wrong with some modern and popular web sites?

With the rise of user location services based on incoming IP address, it became possible to have a fair guess about which country user is in.
The wrong part about it's usage is that some major sites simply imply your native language from your location!
THIS IS VERY WRONG!
And even the fact that it works for majority should not preclude your clear judgement.
Just like ASCII worked for most users in the early 90s simply because most users were in U.S., we should not lay a new time bomb with incorrect usage of the metadata.

First of all, not all people living in a particular country, can read in local language. Some are travellers, some are expats, some from ethnical minorities.
Secondly, with the current state of corporate globalization, there are web proxy servers which are placed in one country per region. The regions are APAC (Asia and Pacific), EMEA (Europe Middle East Africa), LAT (Latin America), NAM (North America). Those comprise communities of different languages, whereas having a single geolocation point on the map, speaking from IP address perspective.
Just imagine some global company install a major web proxy in China - should most employees then be greeted by all major sites in Chinese?

In order to let websites know about user's language preferences, there is RFC2616 (Accept-Language header) and Language preferences in browsers, where user can set up the order of preference for the languages he wants in web content.
Good usage examples of are here or here.

I strongly believe we all should comply to standards, instead of using geo-location as an indication of user's preferred language.

NB: There is a silver lining in such incorrect websites' behaviour - I cannot read popup advertisements of those banner networks which rely on location of my company proxy.

6 things I will still miss in iPhone 3GS

1/ syncing over wifi (or bluetooth)
2/ video call
3/ haptics
4/ themes
5/ USB storage mode
6/ flash support

I will miss those, but (!) I will enjoy the rest!

Ah, and MMS support is quite lousy in 3.0... Just an attachment (no background color, no text formatting, no multi-page animations, no sound attachments). A half-hearted attempt, driven by mass-bickering more than belief...

UI metaphor collision... or not?

Person A >> Hmm.. I wonder why computer 'desktops' are covered with 'wallpapers', not with 'tablecloths'?

Person B >> You see, monitors are vertical, so tablecloths would not hold.

Source here

What's next for iPhone?

I have been watching Steve Jobs giving iPhone lauch Keynote 2007 and it just struck me - he was talking about Visual VoiceMail as "just an example" of "what's coming", and he assured the public that "this is just a first fruit" of cooperation between Apple Inc. and AT&T. He underscored that point, obviously it was important for him.

"The innovative Visual Voicemail feature lets you view all your voicemail messages at once, then listen to them in the order you prefer. Use the Play/Pause button to control playback of your voice messages. The scrubber bar even lets you replay portions of a message you find hard to understand"

In fact, the telecom industry, as a whole, has not been fast to adopt IT-led innovations, and Visual VoiceMail is not an exclusion from that.

(Reality Check: Of those coutries where iPhone is sold, how many have VVM now?)

It does not take much observation power to see that user services innovation rate is much slower in telecom than it is in IT. This only adds to user's attachment to the Intenet and aversion to mobile operator "innovations".

Nokia takes on that with it's Ovi services suite. But Ovi is completely IP-based.

Is there a space for innovation of telecom-based services?
Will Apple take lead in that?

As if that "left hook" from Apple's honcho was not enough, there was a second hidden punch, an uppercut done by Cingular's chief Stan Sigman who went on stage and, incidentally, talked on the same subject - how Apple innovated [their sleepy] telecom kingdom.
At about 6:30 down the show he talks about partnerships with Apple, and at 7:35 he mentions VisualVoiceMail, ominously uttering "and I promise - you'll see more of that coming down the road".

Now, hold on. WHAT could they mean?

Well, I have an idea.
It seems so that right now we are in need of "3G saviour", a killer app which would be the differentiator, a watershed, between old-style 2G networks and the new ones, "innovated and reinvigorated with some help of Apple Inc."
Of course, I hear you say, internet via 3G is so much faster!
Well, but WiFi on a 2G handset can give you better speed, not to talk of a wired computer.

And what about VideoCalls? "Yuck!", you'd say, "who needs those?"

Well, sure, like nobody "needed" internet on a handset before iPhone.
Remember, when there's no market, there's opportunity to create one - exactly Apple's business.

I'm very sure that further innovations in mobile networks must focus on this single feature - mobile video call.

First of all, video quality must be improved.
Current 3GPP codecs were developed during the 90s era - they are just pure crap by modern merits, even when compared to YouTube's FLV (Flash Video) compression.
Ripping and replacing them for H.264 or some proper codec would be the first great step to improve usage rate.
Of course, next comes into play the high usability of iPhone user interface.

If it's easy to use and the quality/price is great - people will use it.

Why would you not make a "killer app" (and a cash-cow) out of that?
iPhone could do it to mobile internet usage, it can do the same revenue increase with proper use of video calls.

It also takes some consideration to notice that video calls are of greater use to long-distance (like Paris/Rome tourists calling Moscow home) and business users (telecommuting, making it a corp policy to call workers with video).
While the former group makes it harder to implement (all CSPs must be capable to handle the new H.264 codecs), the latter group is much easier to harness (as was demonstrated by the Windows gang) - they are policy-driven. And policies are centralized...

Next gen iPhone would need a separate frontal camera for video call.
I was surprised when I did not see videocall demo by Steve at Keynote 2008, along with launch of iPhone 3G. There must be more to do, to be ready for such massive roll-out. New standards, RAN upgrades, new mobile phones...

Could this happen this year? Probably not, "thanks" to reduced budgets for innovations, worldwide.
But I secretly hope it's still in the iPhone's+AT&T roadmap.
Maybe LTE version?