Hyperlinks for emails?

It's looking like we could be able to hyperlink to emails soon! No more of this "oh uh check your email for the one I sent at 11:27...". You'll be able to add a link that works just like linking the web!

The IETF is working on their "Parsable Mail Pointer Email Protocol" (PMPEP), and I was able to get an advance copy! Check it out below:

RFC 9869: Parsable Mail Pointer Email Protocol (PMPEP)

Personally, I think they backronymed it from "Per My Previous Email Protocol"...

Edit 4/11: Yes, this was a joke. And apparently it would indeed be enough just to use the messageID. So why hasn't anyone implemented this???

Leaked Google initiative: No more passwords!

I have an inside source that's claiming Google will be rolling out a new replacement for passwords and other secrets for authenticating users. They shared the upcoming blog post/press release with me. They're moving to a more "holistic" authentication system? Let's see if this pans out. In any case, here's the not-yet-released announcement.

***

Are you who you claim to be?

User logins protect websites from malicious actors, like spammers and trolls. So when you go online, only people with legitimate credentials can access the useful features of the site -- and others can't impersonate you. For years, you've used logins -- such as a username and password -- to prove to the site that you are who you claim to be, like this:

Some go even further and add a second factor to authenticate with, like an SMS code or one-time-password generator like you might have in the Google Authenticator app.

But, we figured it would be easier to just directly ask our users who they are -- so, we did! Following on our earlier success with No CAPTCHA reCAPTCHA, we’ve begun rolling out a new API that radically simplifies the login experience. We’re calling it "Credential-Free Authentication" and this is how it looks:

On websites using this new API, a significant number of users will be able to securely and easily verify their identities without (separately) having to provide credentials: no password, no rotating code. Instead, with just a single click, they’ll validate who they claim to be.

A brief history of user authentication

While the new login API may sound simple, there is a high degree of sophistication behind that modest interface. Authentication has long relied on attackers not having critical secrets, like a password or random number generator seed or other private information. You may have heard the traditional formulation, that authentication requires you to provide something you have, something you are, or something you know.

However, our research recently showed that it's about as likely for the genuine user to be missing the credentials as it is for a malicious actor. How many times have you forgotten your password or encountered a bug with your password manager? (Not GPM, of course!) Thus, challenging users for credentials is no longer a dependable test.

Furthermore, attackers are often able to steal user credentials, forcing providers to rely on a secondary layer of fraud identification, so as to lock accounts when users behave suspiciously. You've seen this if you've ever had a credit card declined for an unusually large or remote purchase.

Introducing Credential-Free Auhentication

That got our security engineers thinking: if we already have to analyze a user's behavior in order to catch account compromises, why not just use that as the authentication? It would cut two carrots with one knife! After all, an attacker might be able to guess your password or your credit card information, but they will never be able to mimic the full depth and breadth of how you interact with websites, from your browing history, to your cookies set, to the way you move your mouse.

Following the "No CAPTCHA" model above, we developed an Advanced User Analysis backend for logins that actively considers a user’s entire engagement with the the Internet to determine who that user is. This enables us to rely less on "Do you have the secret?" and, in turn, offer a better experience for users. Now, users can just click a radio button, and in most cases, they’re logged in. In fact, you'll rarely have to log in at all, because sites will "recognize" you, just like you don't have to show your ID to go into an event venue a second time if the bouncer recognizes you.

But are you really that person?

However, authentication challenges aren't going away just yet. In cases where our tracking cookies and other behavioral metrics can't confidently predict who someone is, we will prompt the user for additional information, increasing the number of security checkpoints to confirm who the user really is. For example, you might need to turn on your webcam or upload your operating system's recent logs to give a fuller picture.

Adopting the new API on your site

As more websites adopt the new API, more people will see Credential-Free Authentication. Early adopters, like Snapchat, WordPress, Twitch, and several others are already seeing great results with this new API. For example, in the last week, the number of support tickets for account resets on WordPress went down by 90%. Twitch reported similar figures -- and also was able to unmask several sockpuppets who had been manipulating discussions and vote totals.

To adopt the new CFA API for your website, visit our landing page for more.

Good users, we'll continue to keep the internet safe and easy to use. Bad users, it'll only get harder to hide yourselves and take over legitimate accounts -- sorry we're (still) not sorry.

***

Edit: Yes, this was an April Fools joke.

An HTTP status code to say "you messed up but I'll handle your request anyway"

So apparently, the Internet Engineering Task Force is going to introduce a new HTTP status code. Just like there's the 404 for "File not found", we're soon going to have "397 Tolerating", similar to a redirect.

The way it would work is, if you send a request that violates some standard, but the server can identify the probable intent of your request, it will reply with a "397 Tolerating" to say, "oh, you messed up, and here's how, but I'm going to reply to what I think you meant".

This is much better than the options we had before, which were either a) unnecessarily reject the request, or b) silently reply to the intended meaning but with no notice that was happening. This lets you tell the client you're tolerating their garbage!

My contact at IETF send me an early draft of the RFC, which you can access at the link below.

RFC 8969: HTTP Status Code 397: Tolerating

Pastebin Link

Another Slashdot memory: Ah, the brick-and-mortar analogies...

So, I remembered another funny Slashdot exchange (again, no link).

Story: Some online retailer got in trouble for filtering their "customer reviews" so that only the positive remarks (about listed products) stayed and everything else was deleted.

A: "Wow, that's pretty scummy. They don't have the right to just clip out negative reviews."

B: "Don't they? I mean, it's their site; they have the right to set whatever editorial standards they want."

C: "Sure, but there's still an issue of consumer fraud and deception. For a brick-and-mortar analogy, imagine that Barnes and Noble started hosing 'book discussion nights' at their stores and promoted it as such. But you quickly notice that whenever someone says something negative about a book sold by B&N -- and only those books -- that person gets a tap on the shoulder from security, pulled aside, and asked to leave.

"In that case, it would indeed be correct to say they can expel whoever they want, but it's still fundamentally fraudulent to represent that event as being for 'book discussion' rather than 'book promotion'."

---

In other news, I finally found one of the ones that I thought I couldn't! The Armadillo rocket failure mentioned in this post was actually this conversation. The actual (but truncated) exchange went like this (note the links to original comments):

A: "And to think, they want us all to ride in these things commercially...."

B: "John and his team have an excellent track record thus far, and have continued to make safety a main issue. I'm sure that this experience will teach them even more, helping to make the next flight even safer."

C: "You mean even safer than a huge orange fireball?

"I don't know, that's a pretty high bar."

Some of my geeky tech jokes -- with explanations!

I know the line: explaining a joke is like dissecting a frog; you understand it better, but it dies. Still, not everyone will get these, and I figure I might as well have a place where you at least get a chance. So here are some of my own creations, explained.

---

Girl, you make me feel like a fraudulent prover in a stochastic interactive zero-knowledge proof protocol ... because I really wish I had access to your random private bits!

Explanation: In a stochastic zero-knowledge proof protocol, there is a prover and a verifier, where the former wants to convince the latter of something. But for proof to work, the verifier must give the prover unpredictable challenges. Think of it like a quiz in school -- it's not much of a quiz if you know the exact questions that will be on it.

The information to predict the challenges is known as the verifier's private random bits Those with a legit proof don't need this, but a fraudulent prover does. Thus, a fraudulent prover in a stochastic interactive zero-knolwedge proof protocol wants access to the verifier's "random private bits".

---

A historian, a geologist, and a cryptographer are searching for buried treasure. The historian brings expertise on practices used by treasure hiders, the geologist brings expertise on ideal digging places, and the cryptographer brings expertise on hidden messages.

Shortly after they start working together, the cryptographer announces, "I've found it!!"

The others are delighted: 'Where is it?'

The cryptographer says, "It's underground."

'Okay, but where underground?'

"It's somewhere underground!"

'But where specifically?'

"I don't know, but I know it's underground!"

'Slow down there. If all you know is that it's underground, then in what sense did you "find" anything? We're scarcely better off than when we started!'

"Give me a break! I just gave you an efficiently-computable distinguishing attack that separates the location of the treasure from the output of a random oracle. What more could you want?"

Explanation: In cryptography, an encryption scheme is considered broken if an attacker can find some pattern to the encrypted message -- i.e. they can identify telltale signs that it wasn't generated by a perfect random number generator, a "random oracle". Such a flaw would be called a "distinguishing attack". So in the cryptography world, they don't care if the attack actually allows you to decrypt the message; they stop as soon as they find non-randomness to the encrypted data. Applied to a treasure hunt, this means they would give up as soon as they conclude that the treasure location is non-random, which the cryptographer here things s/he's done simply by concluding that it's "underground".

---

So, 16-year-old Johnnie walked into an Amazon Web Services-run bar...

"Welcome," said the bartender. "What are you drinking?"

Johnnie replied, 'What've you got?'

"Well, we have a selection of wines and the beers you see right here on tap. But if you prefer, we also have club soda and some juices."

Johnnie thought, Wait a second. Why is he telling me about the wines and beers? Does he even realize ... ?

'Okay, I'll take the Guinness.'

"Bottle or draft?"

'Draft.'

"Alright, and how will you be paying?"

Johnnie only had large bills from his summer job and gave the bartender a C-note.

"Sorry, but I gotta check to make sure this is real." The bartender took out a pen and marked it, then counted out the change. Johnnie reached for the beer.

"Hold on a second! Make sure to use a coaster!" The bartender slipped one under the glass. "Okay, now enjoy!"

Johnnie lifted up the glass to drink. Before he was able to sip, the bartender swatted it out of his hand.

"WHAT ARE YOU THINKING!?! Don't you know 16-year-olds can't drink!"

Explanation: On the AWS site, they will gladly let you click on the "Launch server" button and go through numerous screens and last-minute checks to configure it, and only at the very last stage does it say, "oops, turns out you don't have permission to do that" -- so it's like a bartender that takes you through a entire transaction, even verifying irrelevant things (like whether the money is real), while knowing the whole time he can't sell to you.

---

How is a Mongo replica set like an Iowa voter?

In primary elections, they only vote for candidates they think are electable!

Explanation: Databases can have "replica sets" where there are multiple servers that try to have the same data; secondary servers depend on an agreed-upon "primary" to be the "real" source of data. Often times, the primary server goes down, so they have to decide on a new primary, known as a "primary election". But there are some restrictions on who they will vote for -- if they e.g. have reason to believe that a server can't be seen by other members, and in those cases it will regard that server as unelectable. So you can get funny messages about "server42 won't vote for server45 in primary election because it doesn't think it's electable".

Funny Slashdot exchanges, before they're lost to time

In the time that I was a regular reader of Slashdot, I saw a few exchanges that stayed in my mind. I later went back to find them, but was never able to. So that they're not lost to time, I figured I'd post all the ones I remember. What follows is from memory, and prettied up a bit. (Not trying to plagiarize, if you can find the original post for any of these, let me know.)

Enjoy.

---

[Story: Armadillo Aerospace has a failed rocket launch.]

A: Well, I think we can close the books on Carmack's little project.
B: Come on, now. Private space travel is still in its infancy. There are growing pains. Not everything works the first time. But what's important, is that we're learning from these events. Armadillo is learning. They'll adapt. And the next voyage will be better and safer!
C: You mean, even safer than a big orange fireball?

---

A: [long rant] So that's the problem with this ban on incandescent light bulbs.
B: Whoa whoa whoa, slow down. There is no "ban" on incandescent light bulbs. It's just that the government passed new efficiency standards, and incandescents don't meet them.
C: Oh, that's clever! I should try that some time: "See, I'm not breaking up with you! I'm just raising my standards to the point where you no longer qualify."

---

[Story: a pedophile was caught because he took pictures of his acts and tried to blur out the victims' faces, but police analysts were able to unblur them.]

A: Hah! What an amateur! Everyone knows you have to do a true Gaussian blur to destroy the information content of the picture!
B: Yeah, or entropize it by blacking out the whole face.
C: Right. Or, you know, you could just ... not molest children.

(IIRC, C was heavily voted down and criticized for assuming guilt.)

---

[Story: police used "big data" analytics techniques and discovered that most robberies occur on paydays near check-cashing places, which allowed them to ramp up arrests.]

A: I don't know, this seems kind of big-brothery...
B: Not at all! This is the kind of police work we should applaud! Working only off publicly available, non-private data, they found real, actionable correlations. It wasn't just some bigoted cop working off his gut: "Oh, this must be where the thugs go ..." No, they based it on real data. What's more, it let them avoid the trap of guessing the wrong paydays, which can actually vary! Some people get paid weekly, some biweekly, some of the 1st and 15th. For example, I get paid on the 7th and 21st.
C: So, uh ... where do you cash your checks, by chance?

Setting naming conventions for international audiences straight.

So the place in Budapest where I'm staying is called the K9 Residence.  What I need to say next depends on your native language.  Please skip to the subheading that best describes you.

Native English Speakers

No, the place doesn't have anything to do with dogs, nor can one jokingly say that they "treat you like one".  The name comes from how it's number 9 on the street Karoly Korut, and no one ever alerted them, apparently, that K9 is a common shorthand for "dog" in English.  (Or perhaps they did learn that much, but deemed it too late to change.)

Non-Native English Speakers

Hey, did you know that in English, K9 is a common symbol or abbreviation for "dog"?  Yeah, it comes from how it's pronounced like "canine", the adjective for dog based on its Latin root canis.  Remember that movie K-9?  Yeah, kinda like that.

****
Anyway, I don't expect all of this internationalization to go perfectly for everyone, but, well, y'all could have saved me from having to explain stuff to a lot of people of different native tongues...

Mr. Ford, meet Boeing

You know how it's become a sort of cliche/folk-economics to say that "You should pay your workers enough so that they can buy the product you sell?" It's supposed to be what gave Henry Ford I his tremendous success with the Model T, and has become a staple of union bargaining.

For a recent example of this line of thought, here's none other than (former Secretary of Labor) Robert Reich arguing it, complete with reference to the Model T story.

Well, it recently occurred to me how underpaid I am. My employer modifies and sells large aircraft. No way can I afford that!!!

Did somebody say "raise"?

(This post made entirely without use of the mouse -- including for looking up and copying over links -- thanks to the use of the Firefox Pentadactyl extension. Give it a whirl!)

Addendum: To clarify, Boeing is not my employer, just a synecdoche for large aircraft manufacturers in general.

Setting professor fashion straight

How good are you at distinguishing professors from the homeless? Test your prof/hobo classifier here. I only did slightly better than chance -- 6/10. (Though obviously it doesn't sample uniformly over all professors.)

HT: Jerry Coyne

Happy birthday to me...

Today is my big 30th birthday. Check out the cake my friends made for me! (Click to enlarge.)

You know you're an economist when ...

... you find yourself needing to cite “Buchanan 1973″ when claiming that gangs want to do “too many” drive-by shootings.

In addition, the Mexican Mafia regulates drive-by shootings…because any particular street gang only suffers a portion of the increased attention of law enforcement from drive-by shootings, each street gang has an incentive to do too-many (Buchanan 1973).

Almost funny...

... except for the fact that the Fed really does think like this.

Onion Video: Should The Nation's Unemployed Be Buying New Apple Computers?

The Onion sets Time Magazine straight

Oh ... this is epic. Just epic. The Onion says what's been on my mind for years: Time is written like it's for children, dumbing everything down and writing in such simplistic terms that aren't conducive to critical thinking.

Likewise, despite all the criticism the blogosphere gets for being superficial, I've long held that one day of browsing blogs gives me more intellectual stimulation than I've gotten from a lifetime of reading print media like Time. And I used to joke that the average poster on a discussion site communicates better than Time's writers.

Average commenter: "Two plus three equals five."

Time article: "So imagine that you've got a pair of whiz-bang new gadgets, and your friend has stepped up with three of her own. Well, using an advanced mathematical procedure called adding, you can instantly figger how many you've got in total, say Profession David Livinsky of MIT. The result in this case? Cinco."

But enough of that -- just watch the video. They've nailed everything there is to mock about Time.

Election humor

In case you didn't know, Alvin Green won the Democratic primary in South Carolina, despite being unknown and not running much of a compaign. (My earlier comments on the strange reaction this has gotten.)

Well, thanks to this post from Bob Murphy, I found some clever videos someone made about Greene's campaign. The dialogue is done with a speech synthesizer, but that somehow just makes it come off as being even funnier!

Like in this one:

I just voted for the first guy on the ballot. [Greene's name was first on the primary ballot, which many attributed his victory to. --SB] I used to vote for the second guy on the ballot, but that didn't work out. Now, I only vote for the first guy on the ballot.

Or this one:

No, Greene, we can't spare you for Iraq. We need you to guard this table. If you were not here to guard the table, then who would?

(Quotes from memory.)

I'm surprised they didn't get more views. These had me laughing harder than I have in a while! Synthesizers sure know their deadpan...

World's newest space agency: Reuters

I normally don't pay much attention to photo credits, but I had to do a double-take on this one. An article in the Telegraph has a satellite picture of the sun. Of course, to get that kind of picture, you have to get pretty close, exist in a high temperature environment, and have photography equipment capable of significantly attenuating the EM radiation thrown off from the sun

And who do they credit for the photo? NASA, right? No, we get:

Professor Henrik Svensmark argued that the recent warming period was caused by solar activity. Photo: REUTERS

Um, yeah dude. I think Reuters got that photo from someone else. With the budget cuts the media have had to make in the past few years, they can only afford near-earth satellites. Deeper-space probes are just out of the question.

ANYWAY, since I haven't posted on Climategate, or for that matter, anything in a while, here are my thoughts: It's absolutely disgraceful, the way the scientists in question have acted. Disclosure of your data does not mean that skeptics get to go on a multi-year scavenger hunt to find your raw data and then play guessing games about which sources you threw out and why.

The very fact that you have to make a post like this one in order to summon forth all the data is proof that you weren't being transparent enough.

There's also clear evidence that the scientists didn't seem to understand that you can't contort one data source to look like another and then call it two independent sources of data. Eric S. Raymond has done a tremendous job at exposing the tricks in the code, which explains exactly why the insular climate science doesn't want critics poring over their work

Oh, and just a hint: when you only allow people you approve of to review your work, that's not science.

PS: Recall that my outrage at many libertarians has been to their reactions *conditional* on AGW being real, and that outrage remains.

Update on Billy Mays

Turns out he died of heart disease. (HT: Megan McArdle)

In honor of Billy Mays's characteristic style, and because I don't know the appropriate waiting time for stuff like this, I feel like I have to write the following:

***

Genial pitchman appears

"Are you suffering from clogged arteries?"

[footage of attractive middle-aged actor clutching chest and wincing]

"Does your doctor tell you to cut back on the foods you love?"

[footage of stereotypical doctor grimly advising attractive patient, who appears to be saddened]

"Well, now you can plow STRAIGHT THROUGH that build-up with Arta-cleanse! Using its patented formula, you can clear out those harmful deposits that put you at risk for heart disease!"

[computer simulation of large artery with ugly-looking blockage that is being magically washed away with pretty fluid]

"Powered by nature's very best ingredients, Arta-cleanse gives you INSTANT results you can SEE! Just watch!"

[Pitchman goes over to attractive middle-aged woman sitting down, injects syringe into upper inner right right arm]

"Watch as Arta-cleanse works its way through the system to BLOW AWAY all the nasty build-up that drags down your mood and strength!"

[camera zooms in on woman's arm, as discoloration propagates through arm where vein is located]

"In just MINUTES you have a cleaner, meaner, healthier circulation, or your money back!"

[camera cuts away to woman jogging, then to her blood pressure being checked, with a good reading showing up on a conspicuous monitor]

"But wait! Order in the next ten minutes and we'll throw in this free tourniquet that will make the injection even easer! And that's not all. Call within the next FIVE minutes and we'll DOUBLE your order for FREE! All this for just $29.99."

"HERE's how to order!" [points at camera]

***

You BETTER pay me royalties if you make that video! >:-(

Fun with graphics and the environment!

Well, the Environmental Defense Fund has a cute graphic out (HT: Free Advice) promoting "green jobs":



The basic idea, as you probably figured out from the graphic, is that mandating pollution caps will give people something to do, thus reducing unemployment. They don't put it that way, of course, but that's the idea, and it's a rehash of the Broken Windows Fallacy.

This justification for pollution restrictions misses the point, of course. Assigning well-defined, sustainable pollution rights is a good idea, for the same reason that assigning rights to any scarce resource is a good idea: because of justice and efficiency, not because it would add another task for people to do.

In light of all of that, I decided to pull a SomethingAwful and put different words into the graphic, in an attempt to criticize my nemesis Bob Murphy's (of the Free Advice site linked above) sudden love of Coasean extortion payments when it comes to pollution. Enjoy!

A Big-Three-Bailout argument that just might work...

When they couldn't convince anyone they had a clue what they were doing, the Big Three resorted to doom-and-gloom about all the spillover damage onto poor, innocent workers that would ensue if they failed. But even that isn't working. Maybe it's too abstract? Not enough emotional appeal?

Don't worry, Silas X to the rescue! In this video, I show them how to really win over the hearts and minds of our elected representatives!

Yes I'm still around

And, inspired from a different context, I drew this comic about the current credit crisis corruption.

Arnold Kling asks for crisis joke, Silas delivers

In a great post on the current financial market issues, Arnold Kling says:

The guys who got it right on low-down-payment mortgage are the Freddie Mac folks that [ousted Freddie Mac CEO Richard] Syron ignored. (There has got to be a siren-Syron pun in their somewhere, but I'm missing it.)

Oh, that's easy: "In America, it's dangerous for you to ignore a siren. In Soviet Amerika, it's dangerous for Syron to ignore YOU."

I can't post it in his comments section for obvious reasons. If one of you would point him here, that would be rockin'.