Anyone who has wondered what would happen to MySQL now that Oracle has purchased it need look no farther than www.mysql.com. The website has been remade in Larry Ellison’s image. My company stopped using MySQL a few years ago (we switched to PostgreSQL), but I saw a press release that there’s a new version of MySQL, so I went to look at the release notes. Problem is, there are no links to documentation from the website. None. So what is there?

• Links in the heading for “Recommended servers for MySQL” (links to Sun/Oracle servers) and “Contact a MySQL Representative” (which has a login form)
• A search form, which can’t find product documentation
• A list of bullet points about the new version, if you click on the right rotating banner ad
• A whitepaper about the new version, behind a login form
• A full-page advertisement when you click on the home page link

But the coup de grâce is that a Google search for “MySQL Documentation” brings up an advertisement—with “MySQL Documentation” in its title—which leads to the whitepaper, login required.

(As a Java developer, I’m not actually surprised by any of this. For the last 15 years it’s been more convenient to use the online Java documentation than to download a local copy. Lately that’s changed. Oh, and for what it’s worth, the MySQL documentation website—it’s always been a separate site—has been Oraclified as well.)

…type 0 and type 1. (Laugh here.) Okay, so software engineering isn’t really binary. Still, I’ve found that the world of computer programmers makes a lot more sense if you divide it into two categories: engineered and improvised. If you think in this way, you’ll find that many of the holy wars among developers are a result of improvisers who don’t see engineering problems and vice versa.

Engineered programming is appropriate for problems with solutions that can be defined mathematically. People rely on these programs to act correctly. This includes wind tunnel simulators, machine controllers, pacemakers, and even tax preparation software. But it also includes software within a computer program for storing, retrieving, and interpreting data. For example, your web browser must follow many different protocols so a JPEG image will look like Justin Bieber and not random garble. Engineering problems need to be tested for correctness, because the end user may not be able to evaluate it. If your accounting software is buggy, and you’re not an accountant, you’re in trouble. Not only can they be tested, but the components of engineered software can be divided into sub-components, each of which can be tested independently. In fact, it’s possible to develop a test suite for every branch in the code. How much testing you do is limited only by how concerned you are about bugs. A pacemaker company hires 10 test engineers for every programmer, while an accounting company is considerably more relaxed, while the data loader for a video game may get fairly little testing. The tools of the trade for engineered software make testing quick and easy, and often automated. For example, when I’m writing Java code, my IDE highlights certain errors as I type them and offers corrections, just like a spell checker. As these tools get more sophisticated, bugs get harder to write.

Improvised programming is appropriate for problems where there’s no right or wrong answer, just better or worse solutions. And better or worse may be in the eye of the beholder. User interfaces are the most common situation, but there are others, such as special effects. Even things that ought to have well-specified requirements may require improvisation, particularly when the people providing the requirements keep changing their minds. When I write screen savers, I often find that my bugs are more interesting than what I’d planned to write. This is not a “no tests, just wing it” environment, though. The difference is in the kind of testing that’s appropriate. You can’t sub-divide a user interface into components and test each one separately; holistic tests are the rule. Usability tests tell you if the program works in a particular context for particular people. An iPhone widget that works great for kids may be completely unusable for fat-fingered football players. The tools of the trade for improvised programming make it easy to make changes, including throwing everything away and starting from scratch. This is often called rapid prototyping, even though the finished product is often the best prototype.

So there are two completely different types of programming, for which completely different types of tools–even different programming languages– are called for, and they are mingled together in most programs. What to do?

There’s a design pattern called Model-View-Controller, or MVC, which offers a solution. It’s enforced by Apple’s development tools, and Ruby on Rails is built around it. In MVC, the model is the engineered portion of your code. It describes the universe in which your game exists. If you can prove its correctness, it belongs in the model. The view is the pure UI portion, where user feedback rules. The controller is the in-between portion; it’s the logic of the program which isn’t as clearly defined as Model and isn’t as flexible as UI. The genius of MVC is that it cleanly separates the parts of the code that are best suited for test-driven design from those that require rapid prototyping.

MacBook Pro battery, with cells inflating like a balloon

Our laptop worked fine for its first three years, but this summer it started having trouble charging and it wouldn’t hold its charge. We bought a new battery, and it still refuses to charge most of the time. So once the new battery charged this weekend, we decided to charge the old one as a backup. This is what we found it had done in the last several months. (We’re recycling it right away.) In the picture, the normal looking cells on the left are perfectly flat, rather than puffed up like a balloon and buckling the enclosure.

Back when Steve Jobs was CEO of NeXT, and it wasn’t clear that the company was going to survive, open source developers cloned the company’s crown jewel, OpenStep, with GNUStep. Then OpenStep morphed into Mac OS X, and GNUStep was largely forgotten.

But the great thing with open source software is that nothing gets completely lost. Sony’s working on a software platform using GNUStep on top of Linux.

There are good technical reasons to use GNUStep, and for a long time the biggest reason not to was that having to to learn an obscure new language (Objective-C) scared away a lot of developers. My guess is that the fact that Apple has convinced so many programmers to use Objective-C for iPods made an impression on Sony. That and the fact that Apple has shown that Objective-C works well on low-power devices.

Several years ago, if you wanted to write portable code, you used C. If you were careful, it could run on Macs, Windows, and all the servers and mainframes. Typically, the UI would be a native app, and everything else would be cross-platform. With cell phones, that’s no longer the case. On Android, you have to use Java. On Palm/HP’s WebOS, it has to be JavaScript. And until a few months ago, iPhone apps would be automatically rejected if not originally written in C/C++/Objective-C. This made it impossible to write even a few lines of code that run on multiple machines.

This makes me suspect that Sony has decided that if they can get cross-compatibility with only one platform, it’s Apple’s.

I just upgraded this blog to the latest version of WordPress, due to a WordPress worm that was infecting all sorts of sites. I wasn’t vulnerable, but it doesn’t pay to be complacent.

The reason I wasn’t vulnerable is because the worm needs to be able to create an account, and I’ve disabled new account creation. I used to require an account to comment, as an anti-spam feature. Now I require people to answer a question about octopodes, or octopuses. Turns out the plural is questionable. Regardless, it has blocked 100% of the spam, and as long as I’m the only one using that question, it’s likely to remain effective.

Recently I joined Facebook in order to coordinate a project with the high school kids at church. Facebook really isn’t designed for this sort of thing; Yahoo Groups might be more appropriate, except that communicating with teenagers is hard. They all have email, but most of them never check it. Some of them check Facebook several times a day. (Others refuse to sign up.)

Ever since then, I’ve been getting “friend” requests. For the most part, I’ve been pleasantly surprised with how many of these are people I know quite well. But I occasionally get one from someone I barely remember– but who might have good cause to remember me.

I went through the same thing with Friendster when it was popular. I’m a minor celebrity at Opus (and only at Opus), so after I got home from Opus one year, I got 50 friend requests. Mind you, I’m sure I had meaningful conversations with most of those people, but my brain is terrible with names and faces.

In everyday life, we assume that friendship is commutative. That is, if I am your friend then you must be mine. That’s absolutely not the case with social networks, where friendship is linked to one’s access another person’s information. A celebrity who wants people to know what he or she is doing needs to approve everyone as a friend.

Twitter has a more natural model. Signing up to follow one person’s tweets doesn’t imply that that person needs to follow yours. As does Slashdot, which lets you declare “fans” and “foes.”

Social networking sites need to forget friends and just have fans. The interface on Facebook wouldn’t need to change much. (Although the underlying data model would need to be significantly revamped.) When you sign up as someone’s fan, that person could be given the chance to deny you access. (In practice, that probably wouldn’t stop a committed stalker.) You’d also be given a chance to be that person’s fan.

In real life, friendship isn’t as commutative as people pretend it is. How close one really feels to another is often a guarded secret or an unspoken assumption. Doctors regularly feign familiarity with their regular patients, whom they see far too infrequently to remember. As do ministers and a host of other people in a variety of professions.

Recently, Mac expert John Gruber has been asking why there is effectively no malware [malicious software] for the Mac. So far, the theories people have offered don’t match what I see as the reason.

In a nutshell, it’s because malware is no longer a hobby. It’s big business, with all that entails: economies of scale, industry consolidation, and standardization. All of which make it cheaper to target Windows and abandon the Mac.

There are lots of ways you can make money from controlling someone else’s computer. You can steal information (bank account numbers and passwords), or you can do things you wouldn’t want traced back to you, such as sending spam.

It turns out that if you want to get information, it’s often easier to ask people than to search their computers. Just send out email that looks like it came from the bank, using some scary pretense to urge them to log onto the bank website through a phony link provided in the email. This is known as a phishing attack. (Banks make this easier by regularly sending email that looks less legitimate than the phishing attacks.)

Much of what criminals want to do with random people’s computers involves sending spam. And the rest is similar enough that for the sake of argument, I’ll just focus on spam.

Back in 1997, there were plenty of unprotected mail-forwarding computers (“open relays”) so you needed only a little technical skill to send all the untraceable email you wanted. By 2000, the open relays had been closed, but security was still lax enough that you could hire someone to break into enough computers to send your spam. If you (or the person you hired) were a Windows expert, you’d break into a Windows computer. Otherwise you might target Mac or Unix machines.

We’ve come a long way, security-wise. These days, all the really dumb mistakes have been fixed. As a result, you can’t just hire a smart kid off the street and start spamming. You have to hire someone who’s got some specialized skills.

But why pay $80,000 to hire an unscrupulous professional, when you can rent all the compromised computers you want at a reasonable price? That’s the value proposition of a botnet. The best and the brightest criminal minds write malware (such as the Storm worm) to take over millions of computers. Then they resell computer time at a price that maximizes their profits: low enough to attract as many customers as possible, but as high as those customers are willing to pay.

The costs of running a botnet are something like:

• The cost of developing the software to recruit computers, which is an ongoing expense as exploited computers get cleaned off or retired, and as security holes get closed.
• The incremental cost of adding one more computer to the network. Practically zilch.
• The cost of developing and maintaining the software used to access the botnet.
• General business expenses: sales, marketing, etc. For a business this big, organized crime is probably involved.

Like so many software businesses, there are virtually no incremental costs. A virus that is good enough to spread to 100 computers will likely spread to 10,000 computers. And if you have enough of the compromised computer market, you can hire a whole team of people to keep you one step ahead of the security experts.

The economics favor taking over more computers than you need and using each one as little as possible, since people aren’t likely to fix their computers if the malware never becomes a nuisance.

So let’s say you have a big botnet, and you want to make it bigger. Which is the cheapest way to grow it by 5%? (A) Have your existing staff (plus maybe a few new hires) make your existing malware 5% more effective, or (B) hire some Mac or Linux experts, and capture a comparable portion of those computers?

To target a Mac or Linux computer, you need to know some sophisticated details about how those operating systems work. And it’s a moving target: as exploits become known, they get fixed. You can’t just hire run-of-the-mill programmers. Plus you’ll need to rewrite your payload (the software used to access the botnet.) And the more software you have on target machines, the more information you’re providing to your adversaries. So you’d end up nearly doubling your development staff and end up with a software platform that’s harder to maintain and leaves you more exposed. It’s hard to imagine a scenario where that makes sense.

And that’s assuming that you even want to grow the botnet. Once you have enough computers to satisfy the demand, being more clever just gives your adversaries more bugs to fix–and more incentive to fix them.

Mr. Gruber asks what the situation would be like if the PC market were more evenly divided between Mac OS, Windows, and Linux. So long as there are enough PCs to satisfy the demand for zombies, there is no reason for the entrenched players to branch out into Windows or Linux. And the cost to develop a competing botnet would be big: software development, sales and marketing, law enforcement evasion, kneecap protection, etc. One could imagine a world where Windows computers are in the minority, but common enough to satisfy all of the demand. Indeed, it may be the case that a large percentage of the zombies today are running Windows 98.

In short, the notion that Macs should get 5% of the malware because they have 5% of the market is based on the notion that there are lots of independent malware writers. If there are a small number of big players, and Macs aren’t strictly needed, then it makes sense for there to be no malware to speak of for the Mac.

.

As a postscript, I’d like to mention that this discussion is just about malware. I mentioned phishing before, and that’s just one example of a cross-platform attack: persuasive ploys are just as effective against Mac users as Windows users. And computers have become hardened to the point that the Storm worm, responsible for the world’s largest (known) botnet, requires human intervention to spread.

Focusing too much on the OS misses the point: the weakest link in computer security is no longer the computer. We can debate whether the Mac’s “are you sure you want to install this?” warnings are better than Windows’ but at the end of the day, a sufficiently motivated user is going to bypass any security feature.

My new laptop has a sticky mouse button, so I went to the Apple Store at Ridgedale for repairs. A few thoughts:

• The window display is a pair of mock iPhones made of of HDTVs on their side, which gives the impression of an impossibly high resolution display. If only real iPhones had that many pixels. Then again, it makes me wonder how they came up with the demo; the easy thing to do if you’re an Apple developer is to use a development version of the OS which supports that resolution. Then again, the marketing department might not be able to do that. But this is Apple, so you never know; The Steve might have personally commissioned the demo.
• Tech support is at the so-called Genius Bar, with a young, hip employee who looks different from the other employees because his T-shirt says “genius” on it.
• They had a 2-hour wait to get to the Genius Bar, but you can’t tell, because you sign up online. This was on a random Tuesday at a small Apple Store in a modest suburban mall.
• It didn’t pay to show up a few minutes early for my appointment.
• It does pay to wait in “standby,” especially if you have a quick question. Two people without reservations managed to squeeze in front of me, even though they were running late.
• To verify that my mouse clicks smoothly, they needed a username and password, which is printed on your reciept and stored in their database. Fortunately, they were willing to take my guest account, even though the reciept says “admin.”

I’ve been playing around with GWT recently, Google’s toolkit for making Gmail-like applications in Java. The idea is pretty slick: you write both the client (web browser) and server portions in Java, and then it translates the client-side Java into several dialects of Javascript (one for each of the major web browsers.) You get to use a Java debugger and keep all your code in one language, without having to learn all the nuances of each web browser. It works great if you’re writing something that works like Gmail, but it’s totally inappropriate if you just want to add a few flashy effects to a web page.

That said, here’s an example of something I whipped together in GWT. For the record, my three-year-old thinks it’s funny, most people think it’s mildly creepy, and Seebs says it’s disturbing to autistic people like himself– but only due to color asymmetry.

Why do financial institutions insist on pretending to be identity thieves? I just made a big purchase on my Discover Card, and to verify the transaction they left a message on my answering machine telling me to call a number that’s not listed on my card or their website. (1-800-347-4996) Indeed, without calling Discover, their phone company, or the police, there’s no good way to track a random toll-free number. (It’s a little more dangerous for a crook to set up a nefarious number than a nefarious website, but it can be done.)

The irony is that Discover’s website has a quiz on the front page, where one of the questions involves a phishing attack identical to what Discover itself did, except that it’s done through email rather than the phone.

It’s not just Discover. This behavior is rampant among financial institutions. My retirement account (through Charles Schwab) has an option to send monthly reminders to check your online statement. The email has an embedded link, so you can click on it rather than typing the URL into your web browser. Which is exactly the behavior you shouldn’t do, since the link may be to an imposter site.

The reason they do this, of course, is because your security isn’t their priority. They’re not to blame if you fall for an imposter: except for training you to fall for the trick, they’re not even involved.

Actually, that’s not quite true. Credit card companies are on the hook for all but $50 from a fraudulent transaction. So Discover should be trying to prevent this sort of attack. Why don’t they? For one thing, it’s not a common attack yet. But the root cause is more subtle.

Companies secure assets, information, and transactions. Thieves attack the weakest link in an ecosystem. Companies worry about their own infrastructure and how people interact with it. Imposters aren’t part of that world: they create their own faux world. Banks aren’t used to worrying about how customers can verify their identity. Typically you know it’s your bank because you walked into it. Or called the number printed on your statement. That’s not a safe assumption now, if it ever was.

More important, security often consists of reacting to known attacks, rather than preventing potential attacks. In many cases, that’s a good thing, since attackers won’t try something novel unless the tried-and-true stops working, and you can waste a lot of time preventing imaginary threats. With credit card theft, tricks that worked decades ago work just as well today. But identity theft is still evolving, and the preventative measures– in this case, using the same phone number for all incoming calls– are cheap and easy.

(Computer security has the opposite dynamic: preventing whole classes of potential attacks is usually more fruitful than fighting known attacks. That’s because an attack can go from being unknown to being common in a matter of hours. And attacks need to be novel, since once a security hole is patched, it is fixed permanently.)

For the record, I called 1-800-DISCOVER, which is the number printed on my credit card, and had an agent transfer me to the fraud prevention department.