Interesting debate taking place in the blogosphere between two of my former colleagues from MSFT. It started with an article in Wired,  titled “Slap in the Facebook” decrying the closed nature of social networking sites and urging Facebook to embrace an open model where users can reference content from other services. Dare wrote a response pointing out that business incentives favor this closed “walled-garden” model because Facebook has no incentive to refer visitors to other websites unless there is some benefit– the idea being that eye-balls/traffic drive revenue for advertising supported websites. The argument goes, allowing users to link to other websites or reference content there amounts to an altruistic (read: foolish) act of driving those coveted eye-balls elsewhere. Kim Cameron came back with a rejoinder arguing that authentication by itself does not constitute a revenue source. Quote:

“Summary: what counts is the ACCOUNT, not the CREDENTIAL.Credentials should be seen as a cost center, and accounts as a profit center.”

Stepping back, there are three issues here:

1. Authentication is indeed a cost center. Most companies invest in an identity management systems originate from the requirement to solve a problem that the company itself has. As a concrete example, Amazon asks users to create account so they can purchase books and track their orders. That scenario is directly relevant to their bottom line. It’s difficult to see how allowing users to authenticate some place else with that ID contributes to their business objectives, especially when each instance involves a transaction cost.
2. In the language of identity management, relying parties are indeed at the mercy of identity providers. That is to say, if website Foo started accepting users with an identity issued by website Bar, it would be taking on a critical dependency on Bar. Because many scenarios require authentication– if user can not authenticate, nothing else works. This is partly the reason every website decided to invent its own identity management system (most of them mediocre and dubious in security assurance, as expected) contributing to the proliferation of passwords that unfortunate users must remember.  It is possible that Bar will at some point decide to hold users hostage by refusing to authenticate anyone to Foo, especially if there is no contractual relationship between them. Cameron argues that the PR repercussions will act as deterrence. It’s not clear if this has prevented companies from breaking interop in the past, as the history of failed attempts at getting instant messaging systems to cooperate shows. This is not entirely unjustified paranoia either: failure of authentication leads to breach of security and the last thing an aspiring website wants to see is to get blamed for someone else’s error. In the public perception, blame is not always allocated fairly.
3. Finally there is an interesting irony: everyone wants to see authenticated users coming in, but no one is interested in authenticating their own users to other websites. Even assuming that the concerns in #2 could be addressed and sites would be willing to accept external identities, why would any ID provider spend their own resources in the interest of another website? The common sense answer would be: “because users want this feature.” But this is no different than the deadlock which existed among mobile carriers: everyone wanted to be able to convert users over to their network without changing their cell-phone number, so-called “portability” problem. Yet no company wants to make it easier for users to switch to another carrier, so there is an incentive to raise switching costs by not allowing the customer to keep the number. Any mobile carrier to offer this on their own would be faced with the classic sucker pay-off from game theory. Eventually it was a regulation that mandated portability, by forcing everyone to implement it at the same time.

cemp

An iPod can store music in two ways:

• Mounting the device as ordinary USB drive
• Syncing content using iTunes

In principle the user experience for these two modes is different and incompatible. For example MP3s stored in the drive will not show up in the music selection. Meanwhile the iTunes content is in principle not visible as plain files that can be copied to another location by mounting the iPod as a drive.

It turns out “in principle” is the operative keyword there. One of my friends pointed out that she is aware of some special-purpose 3rd party applications that can recover iTunes content. A little bit of experimenting shows that nothing fancy is required; the basic functionality available in Windows XP+ will do the trick. (Note: following descriptions apply to an iPod formatted for Windows.)

Short version of the story is that iTunes places content in a hidden-folder and scrambles names of MP3s. That means recovery requires two steps:

1. Display the hidden folder– this is relatively easy. In Windows Explorer, navigate to the iPod drive, select Tools –> Folder Options, switch to the View tab, locate/select the radio-button for “Show hidden files and folders.”

This will reveal a hidden folder named “iPod_Control,” distinguished in the listing by its pale, faded color. Alternatively in a command line you can type “dir /ah” which instructs the shell to display files with attribute “H” for hidden. Inside the main directory is a series of sub-folders with names like Fnn where “nn” is a two digit number. Inside each folder is one or more MP3 files with cryptic names. But hovering over an MP3 show the ID3 meta-data, which includes information such as the song title, artist, album name and genre. This is good news because it suggests that the file is left intact by iTunes when transferring to the iPod.

2. But the file names no longer correspond to song names, which is probably what they started out with originally. Not that it is always correct: typically ripping software will contact an online database to retrieve song information. Accuracy of that database varies. This creates a search problem.
It turns out that even the primitive search capability built into XP is up to the task. Selecting “Search” from the File menu in explorer brings up a new window, with a picture of a dog wagging its tail and blinking its eyes in the lower-left hand corner. (Clippy strikes back? Apparently somebody forgot to remove the last vestiges of that abysmal UX experiment from Windows.) For example, entering “Dylan” for the word/phrase to search and selecting MP3 from advanced options finds all tunes performed by Dylan or written by Dylan, although it takes a while to search the files individually. An indexing-based approach such as the one built into Vista, Windows Live Toolbar or Google Desktop will likely yield the same results but faster.

cemp

It’s been official for three weeks now but worth announcing here as well:
I have joined the Google security team.

cemp