ALL ART BURNS

Classes don’t start for a couple of months yet but I’m already getting in the back-to-school mental space.

I’m filling out more paperwork for Carnegie Mellon than I ever did for a public school and it’s amazing how much of it is, in fact, paper. Some of it I can do online, including applying for financial aid and course registration, but I still fill out paper forms to prove I have health insurance, my shots, etc. Online registration for courses is one of the best things to happen in the past 20 years — no getting up at o-dark-hundred just to wait in line for hours down at the administration building filling in bubble sheets and getting signatures from admins. (If you’ve only registered online, let me tell you about walking to school uphill in the snow both ways…)

A fair amount of my time in the past few weeks has also been spent researching student loans and other forms of funding. My employer has no sabbatical policy and little in the way of educational programs that I can use to pay for school. They’re good about flex-time and would probably pick up the tab for a specific class required by work, but that’s about it. I’m planning for the worst possible case: quitting my day job, starting school on loans, then picking up consulting work during the academic year as time permits.

Quitting could also be the best case if I can scrounge the cash for the first year and really focus on school. I’m going to school to get my core art and design skills whipped into shape by experts not just get some letters after my name (“BFA, IDSA”). I’d rather go to school for 3-4 intensive years and live cheaply instead of taking a night classes and dragging school out over ~8 years. It took me 7 years to get my first BA, I’d like to not repeat that process again.

Looking back at my last tilt at school, something that I really didn’t understand was money. My family never had much money and my father didn’t know how to manage what we had so I never learned how to manage money. I had no idea how finances worked, how to save or invest, why one should buy a house instead of rent, etc. In retrospect I didn’t have to go to a local city college, I could probably have gotten loans and grants for a much better school had I or my parents known how the system worked.

While I won’t spill the entire financial details of my life here, I think I will occasionally talk about some financial things. I’m probably not the only person so clueless about money that they didn’t even realize how clueless they were (are?) about money.

Ok, enough boring personal details. Next entry is about spimes and security, hope you like it.

Technorati Tags: Carnegie Mellon, debt

[More thinking out loud about what I could do with an SRM. I haven’t started Everyware yet and might edit this after I’m finished. –jet]

So what happens if I drag around a slightly tweaked spime retrofit module and intentionally pre-load it with data and a set of data redistribution rules? As it collects and redistributes data about me over time based on rules I create, how does my life change for the better or for the worse?

More generally, “What happens when I have detailed control about a relatively large amount of my personal information and fine-tuned granularity about how I share that information with the world around me?” Humans in every cultural and temporal collection have had control of simple sets of personal information and how it is distributed via clothing, hairstyles, makeup, tattoos, &tc. These primitive coding systems change over time and require some amount of interpretation and authentication on the part of the receiver. Some subcultures have specific coding mechanisms that are highly-specialized and that don’t translate well outside the community and may not even be recognized as a code by outsiders. Flagging via the hankie code is subtle and probably not recognized (much less decoded) by anyone not familiar with the schema and symbols it uses. These subculture-specific encoding mechanisms require a shared set of interpretations between the sender and receiver and the mechanisms can easily be misinterpreted or not interpreted at all when in the incorrect context. Flagging means something in the Castro neighborhood of San Francisco, but does it mean anything in Tokyo? If I’m visiting friends in New York City or London, are there clothing colors, styles or brands I should avoid if I don’t wish to be thought a gang-banger or a chav?

So let’s say I take a SRM and tinker on it a bit to give it a few additional capabilities:

• broadcast selected information on a routine basis
• respond to broadcast queries (a request to any SRM within listening range) from individuals or entities with specific information
• respond to directed queries (a request to my specific SRM) from unknown but potentially trustworthy entities
• respond to directed queries from specific authenticated individuals or entities
• receive and translate schemas and protocols used by other entities, SRMs and spimes to local, internal schemas and protocols

With these changes I can broadcast data and and any needed translation mechanisms or schemas to other individuals or my surrounding environment in order to correctly identify (or obscure) my identity, likes, dislikes, and needs. I can warn emergency services personnel about existing medical conditions, tell a building I enter about my preferred working environment, or broadcast a authenticated message from a local holder of power that I am under their protection. I can make my availability and orientation known in a singles bar without identifying myself and the bar can collect that information in order to allow in more of the appropriate mates and fewer of the inappropriate ones.

I don’t want everyone to automatically know everything about me or even to know my identity — I want select individuals, businesses, chartered organizations or the public to each know something specific about my patterns, personal tastes and status within the local reputation hierarchies.

My SRM has become something new — a Personal Data Broadcast Device (or PDBD, as I’m feeling a bit acronym happy) that distributes data about me of my choosing to the world around me. Design and implementation of the PDBD is probably more important in the world of The Participatory Panopticon than it is in the spime-full world, but it is built on technology and infrastructure similar to that required to develop proto-spimes.

When I turn on my PDBD, I become a proto-spime. I am now interacting with my environment in a more active and controlled fashion than a typical passive proto-spime or spime, but I still collect, process and redistribute information. In addition, I can dynamically define classes of information and who gets that information in reaction to my environment or new circumstances. (To be a proper spime I would have to have been designed (genetically engineered) from the start with the expectation I would exhibit spime-like behavior. Perhaps I would be able to provide power from my nervous system and collect and store data using my existing senses, but that’s a topic for a future entry.)

When I go to Deathguild, I want the DJs to know what songs I like and I want the bartender to know how often order drinks for groups of people and that I have a history of tipping generously. Neither the DJs nor the bartenders need to know who I am, merely that I am physically present and what my likes, dislikes and buying habits are. Knowing who I am can increase their level of trust or lead to further personalization of my experience, but it is not required for a basic level of interaction. I can make my identity known to entities that I trust or already know, but the general environment won’t have access to that information.

The data I — a proto-spime — distribute isn’t always originated by me but it is data I want to distributed. Not only will I broadcast information of my own selection, but I will also make available data about me generated by others. If you’re a bartender you shouldn’t trust me when I say I’m a great tipper, but you will probably trust other bartenders in the neighborhood. You’ll be able to verify that I didn’t generate a fake message from them about myself using a authentication and nonrepudiation mechanism.

Cryptography 101: authentication and nonrepudiation, the ability to prove that a message was created by a specific entity and prevent them from denying they created it, is an important security concept in both the physical and digital realms. In the physical realm, these tasks might involve a signature, seal or watermark on a document that is both difficult to forge and known to the recipient. In the digital realm, the electronic copy of a document is “signed” using a “signing key” and a cryptographic algorithm like ElGamal or RSA. The “signature” is then attached to the document similar to a footnote or cover-sheet being attached to a physical document. Anyone receiving the document and signature can verify that the document was created by the owner of the signing key and that the message has not been altered since its creation. See Schneier’s Applied Cryptography for more on this subject.

So while I have enough control over my PDBD to delete information I don’t like or don’t want, it is near-impossible for me to fake favorable information about me purporting to be from a known third party. An entity deciding whether or not to act upon data I provide would validate that data thru one or more trust networks that would range from ad-hoc, neighborhood level associations to government or international bodies running trust hierarchies. (Verisign and other companies currently operate trust hierarchies that use SSL certificates to authenticate web sites and web browsers.) Trust networks used by entities to validate my information would be independent of one another and each would likely operate by its own levels of trust mechanisms and standards. A trust network might be a collection of neighborhood bars that share information on good tippers, local power structures (law enforcement or street gangs) that provide identification or reputation references, a government organization or corporate body providing authentication services, or even mutual data sharing programs operated by airlines, hotels and other travel services. (More fodder for future entries: What happens when a trust mechanism requires that I allow negative data to be included in my digital reference if I want to use their service? Do I become a “blank” rather than let Trans Global Airlines note that while I’m a million-mile member I also tend to drink to excess and make trouble with the flight attendants? If I’m a blank for other reasons, will people assume I’m trying to hide negative information?)

When it comes to non-authenticated data, there’s little reason for third parties to automatically trust the data I send out about myself. The Deathguild DJs could compare my “favorite songs list” I broadcast to what I actually bother dancing to or reject the list entirely because it is too divergent from what other club members are reporting as their favorite songs.

“Broadcast” vs. “Transmit”: I’ve intentionally used the word “broadcast” instead of “transmit” in this entry for a very specific reason — the technology described here relies on radio frequency (RF) communications, and RF is by nature a “broadcast” technology. Unlike a switched TCP/IP network that can easily route data directly between two systems never to be seen by any other system, broadcast RF can be seen by any system within a given distance. This distance is determined by transmitter power, antenna size and design, and the environment in which the communication takes place. The 802.11 protocol operates in the 2.4Ghz range and can easily penetrate walls, vehicles, and other line-of-site obstacles that we humans perceive as limits on communication. Given that anyone can listen in on broadcast packets, proper encryption of communication channels is a must for Everywhere or the spime-full world.

I won’t broadcast most information without a specific, authenticated request, and I certainly don’t want to reveal sensitive personal information to untrusted sources. I don’t want a random person on the street to know my shopping preferences or how much I’m willing to spend on an item; my age, ethnicity, religion or sexual orientation; or my medical history or any physical disabilities. Who I decide to trust, what data I will share, how much certainty I require that they are who they claim to be, and the ramifications of a failure in the trust mechanism are questions we will need to answer.

PDBDs, Spimes, and Their Security

The request, authentication and data broadcast interactions discussed so far are automatic and happen without my explicit knowledge or approval. A spime doesn’t check with an owner to verify each request, it operates under a set of rules that define how to validate a request and how to respond to valid and invalid requests. This request mechanism is the only acceptable way to move data off of a spime. Any spime (not just a PDBD) carrying truly sensitive data cannot be designed or implemented in a way that allows for direct reads under any circumstances. If my PDBD is lost, stolen, or simply not under my immediate physical control, another entity should not be able to access the information stored within unless I have previously approved of that access. That is to say, there is no “root” or “administrator” level of access that will reveal sensitive data stored on a PDBD or spime, only a query from an authorized third party (as predetermined by me) will cause information to be revealed. (I’m handwaving over the question, “How do I install rulesets that prohibit access but prevent an attacker from replacing those with rulesets that allow access?” More material for a later entry.)

The requirement that a spime be completely “locked down” requires a great amount of trust in the algorithms and implementations used, as a vulnerability would be easily exploitable without the knowledge of the owner. It is critical that every component of a spime fail safely, not operate on bad data, not have backdoors and do or not do all the things we require out of our most secure computing environments. I would suggest that only open source code and public algorithms be used to implement SRMs and spimes and that significant effort needs to be put into developing authentication mechanisms for executables and how they are installed. The OpenSSL, OpenSSH and OpenBSD projects are a fine example of how secure software for communication channels and operating systems can be developed and distributed for use by third parties.

What I, the Human Proto-Spime, Cannot Do

Based on our earlier distinction between passive collection and dissemination of data vs. active decision making, I as a human proto-spime will be limited in what actions I can perform with my PDBD. Many of the actions one assumes I’d do with a PDBD would likely be performed using a different, more personal object I carry with me or access remotely. For example, I cannot use my PDBD to:

• vet a third party by generating a signed statement about them
• engage in business transactions involving money or goods stored on the PDBD
• collect, relay or transmit audio or visual streams for rebroadcast
• view media, access the InterWeb, or perform other communication tasks

This “separation of powers” pays off in a number of ways. The simple SRM used as the basis of my PDBD will be cheaper to manufacture and will not create a security risk if lost, stolen or otherwise compromised. Anyone who finds a lost PDBD might not be able to determine the owner, even with the help of a third party or possibly the owner themselves. Rather than try and identify the owner, it would be more efficient for the finder to wipe the device and use it themselves or return it to the manufacturer to be wiped and reused.

It is quite possible that a PDBD would be embedded in some other host device I own, but unless it could be easily removed I might not be as likely to carry it around. My wristwatch or a piece of jewelry I wear every day is a more secure and dependable place than a part of my mobile phone, laptop or PDA that I have to carry in a pocket or bag; that I can lose; or that I might replace or send in for repair.

Technorati Tags: spimes, participatory panopticon, everyware, ubicomp

I’ve been trying to categorize Bruce Sterling’s Shaping Things. Is it a design manifesto? A well-informed rant? A bit of SF prognostication based on a basic understanding of technology and comprehensive knowledge of how the world works?

Or does its effect on the reader matter more than which Dewey decimal digits get taped to the spine? Shaping Things gave me a well-needed kick in the head and got me thinking about some realities of ubiquitous computing in the near future.

When I think about past predictions for life in the age of omnipresent computing power — wearable PCs, portable VR, “smart”-whatevers — I’m reminded of why so much science fiction is utter drek. Instead of reaching out and thinking about how the future of technology will change our current life, too many authors take our current (or past) culture and spackle on future techno doodads without thinking about how that tech would actually change everyday life. (You know what I’m talking about: “It’s WWII, but with hover-tanks and grav-guns” or “It’s urban gang warfare in the gritty streets of the astroid belt.”)

The high tech business world suffers from the same sort of limited creativity, but I think it’s even more fundamentally ingrained in the culture and, unfortunately, rewarded more often than it is punished.

There’s a extended metaphor about a business cutting a path through a dense jungle. The workers cut down trees; the managers make sure the workers have sharp machetes and enough food and water and are cutting where they are supposed to be cutting; the leader is out climbing trees and telling the managers which way to go.

The problem is that I first heard that in a project management seminar for software development. When’s the last time anyone cleared a road through a forest with hand-tools and people climbing up trees? Why on earth is this being used as a metaphor for project management in a software development environment? How can one prognosticate about the effects of near-future technology on our life while still mired in 19th century management theory?

This is where I think Sterling’s experience in writing science fiction pays off in the design world. He’s able to leap ahead from what we have now based on what could be and not gussy up the present (or the recent past) in skiffy doodads and present it as THE WORLD OF THE FUTURE!.

Pat Cadigan has this to say:

“One of my favorite examples is people could have probably predicted a road system from the invention of the automobile and you might have been able to predict parking lots and difficulty in finding parking spaces, but you probably would not have necessarily predicted drive-in movie theaters, or making out in the back seat and people becoming parents in the back seat. “

This is the sort of thing Sterling is up to in Shaping Things: given the automobile and the motion picture, predict the drive-in. If not the drive-in, then at least driving school safety films, using cars as mount points for movie cameras, or at least POV movies like “Rendezvous”.

(Note: I’m going to handwave over a fair amount of the book and focus on the bit that kicked me in the head: the formal definition of the “spime”. There’s a lot of words about how we get to spimes, who handles spimes, what they do in the context of a future culture and what comes after, but I’ll leave that for some other time.)

A spime is an object capable of collecting information about its interaction with the world, track its own metahistory, and make that information available in a form useful to others. Sterling uses a familiar, ancient and decided non-technological object as the basis for his future spime: a wine bottle. He also spends a lot of time telling us how we got to spimes, what might follow, and how culture will change to adapt to these new inventions but that’s part of the stuff I’m handwaving over.

Whether or not we call these new objects “spimes”, “blobjects” or some other self-consciously coined word, the base concept is the same: a smart object that can observe its surroundings; collect, filter and store environmental data; report that data and even make decisions. This is a huge step forward in how we perceive the world and how it operates. Yes, it’s a huge step forward in the ability of conglomcos to refine their marketing messages but it’s also a huge step forward in tracking where garbage actually comes from and goes, finding inefficiencies in transportation (“my package sat how long on a loading dock in the rain?”), and learning the secret lives of everyday objects that most of us ignore.

Again we have the problem of “predict the drive-in”, but using the what-if tactics of science fiction in an iterative method might get us a bit further than the history-based product planning and market prediction routines from the past century used by the corporate world. We have a little experience of how simple information flow and collection can change the political, business and media landscapes and we can iterate on that for the next level of granularity with objects helping us manage those data flows.

For my part, this kick in the head has lead to my documenting “proto-spimes” in an effort to get my head around what a real spime might actually look like some day. Once I’ve got a few of those written up I’ll be able to go back and see what was wrong with the first and what they all have in common, re-read Shaping Things, then let it sink in again.

So be it manifesto, rant or design document, Shaping Things achieves the goal of kicking people (or at least me) in the head and getting them to think about the immediate future.

I only have one complaint about Shaping Things and it is a minor one: I do not like the layout nor the color selections used in the book. I’m not color blind but I did read most of it in low light on airplanes, conditions for which the book was apparently not designed. The combination of glossy paper and low-contrast colors made it more difficult to read than it should have been.

Technorati Tags: Bruce Sterling, Shaping Things, industrial design, spimes, futurism

Here’s an interesting interview with Lance Barr, the industrial designer who developed the NES case.

Technorati Tags: NES, Nintendo, industrial design

I picked this up at a used bookstore because it was only a couple of bucks and it was something other than another boring picture book of beautiful but uncomfortable furniture that I can’t afford and that nobody will want to sit upon. What I was looking for: an academic discussion of the history of chairs that would teach me the right “design words” to use in class or when talking to designers. What I found: an excellent history of things to sit upon, the social issues around why we sit, and the sorry mess we’ve gotten ourselves into by sitting on chairs for far too many hours a day during the past century or so.

Cranz — a Professor of Architecture at Berkeley — boils down the history of chairs, sitting, and ergonomics in plain terms that can be understood by the lay person. This history helps explain the ergonomic nightmare we live in today and suggestions on ways we can start to improve our situation.

I’ve always been (too?) willing to question elements of the world I live in, however where I sit has never been on my list of things to question. I don’t like sitting in chairs nor sitting up straight; I prefer to lounge, lie down or sit on the floor while reading, watching TV and even when doing metal work or fabrication. While this leads to interesting discussions at home about who is hogging the couch or why there are magazines spread all over the floor, it’s never led to my thinking about why I try so hard to avoid sitting in chairs. My job requires me to sit for extended periods of time (and I have worker’s comp RSI receipts to prove it) but when I’m doing something I want to do, I’m often standing at a workbench, sitting on a stool with rollers or squatting on the floor.

A few years ago I accidentally started studying Japanese wood and metal working techniques while studying Japanese history and modern Japanese design. One of things that surprised me was the number of modern Japanese craftsmen who to this day sit on the floor while doing rather difficult labor. Even an episode of Discovery’s Biker Build-Off showed the Japanese bike firm Zero Engineering working the way Japanese metalworks worked for centuries: sitting on the floor.

As it turns out, sitting in chairs at a workbench or table is the odd way of doing things in the big historical picture. Until the industrial age, plenty of people sat on floors or stood while working. If the average person was (is) lucky enough to have something upon which to sit, it was likely a bed, bench or simple stool without a back to lean against.

Not only did The Chair open my eyes to the “pro-chair” Western bias that we have sold to ourselves and other cultures, it also helped me understand just how much of modern chairs is form and how little is function. I never really understood why the really expensive designer chairs we had at work or the fancy chairs my friends bought were so uncomfortable. The simple fact of the matter is, they’re supposed to look good, not be useful chairs. These chairs were not furniture, they were art. Now there’s nothing wrong with filling your house with expensive art, but expecting your guests to sit on the art and be uncomfortable is another matter entirely.

The act of sitting in a chair, especially for extended periods of our waking hours, is a modern invention and something our bodies were not designed to do. We did not evolve sitting in chairs, they were thrust upon us (or us upon them) over the period of a few short centuries. This is stating the obvious, but the unstated obvious is that our bodies don’t like it one bit. We are suffering many health problems related to chairs and the sedentary lifestyle they encourage: back and neck pains, varicose veins, RSI injuries and so on. Making matters worse is the use of chairs that are picked not for their functionality or long-term effects on the human body, but for their form and cost.

The solutions are simple: stop sitting, sit differently or at least minimize the amount of time spent sitting. Solutions like these are easy to say but not easy to implement in a chair-based culture that is focused on short-term benefits . The average American is probably not used to sitting on a backless chair for hours on end or standing while working at their computer. “Perching”, or making a tripod of your legs and a chair, is also going to take some getting used to for many people. Sitting in chairs has destroyed our muscle tone and posture so much that what should be a simple task — standing or sitting up straight without any sort of support — is difficult for most people. The next time you’re in a “waiting” situation, in a doctor’s room or waiting on take-out at a restaurant, try standing instead of sitting and see how long you last.

Another problem facing a change in how we sit is the relationship between employer and employee. Some of these solutions — which would require spending as much on an employee’s chair as you do on their computer if you expect them to sit for several hours a day — are not going to go over well with the business community. I’ve done facilities management consulting a few times, and it’s amazing how much a company will spend on a computer that will be replaced in a year and how little they will spend on a chair and desk they expect to last for a decade. Spending $300 on an office chair when there’s one available for $250 requires extensive justification, while buying everyone a new PC every year for $1000 is obviously a good decision. Complicating matters, many employers will not let employees bring their own chairs to use at work, so an employee who’d rather perch or stand can’t even pay for it out of their own pocket.

Unlike many books I’ve read in the past few years, The Chair has made a quick and positive difference in my every day life. I sold my Aeron and have a Hag Capisco (designed for “perching” not “sitting”) on order. I bought a cheap-but-comfortable task chair in the meanwhile, ripped the arms off and sit forward on the seat with my feet elevated enough to take the weight off of my thighs. In the few months I’ve been working with better posture, I’ve noticed that I can stand for longer periods of time, that I don’t have achy legs after working all day and that my infrequent migraines and frequent neck-aches have all but disappeared.

I think the best possible thing I can say about Cranz’s The Chair is that it’s one of the few books I’ve ever bought extra copies of to give to co-workers and friends.

Technorati Tags: chairs, industrial design, ergonomics, books, furniture

TeX Dorkery:

@book{cranz-chair,
Address = {500 Fifth Avenue, New York, NY 10110},
Author = {CRANZ, Galen},
Edition = {Softcover},
Isbn = {0-393-31955-5pbk},
Keywords = {chair design},
Publisher = {W. W. Norton},
Title = {The Chair: Rethinking Culture, Body and Design},
Url = {www.wwnorton.com},
Year = {2000}}