Today, the site will be moving from having a canonical name of www.iay.org.uk to the simpler iay.org.uk. Everything should be redirected safely from the old location, but I can't rule out the possibility of some redirection loops to start with.

Later, the two blogs (including this one) will be migrated from Movable Type into the same Drupal content management system as most of the rest of the site uses these days. Again, I'm hoping that everything interesting will be redirected safely but I do plan to change the organisation of things like archive index pages so some links may well break.

Wish me luck.

If you've ever had a copy of the Letraset Catalogue on your shelf, or know what (rather than who) Arnold Böcklin is and can recognise it in the street, you'd enjoy reading this. If you can instantly tell Helvetica and Arial based only on their respective lower-case 'a's, it might be a bit simplistic for you.

A word to the wise: skip the chapter on Eric Gill's personal habits. No Wikipedia link for that one.

When I was very young and naïve, I thought Facebook looked pretty interesting. In practice, the level of sheer malevolence displayed by the company and its founder have stopped me from using it for anything other than keeping up with the family.

Ever hopeful, I now have a presence on Google+. It's possible that this new service will end up as malign as Facebook, but for now at least I feel much less like I am being packaged up and sold as product. It seems, really, like a social network done right.

All that seems to be missing is the people.

You should, of course, run out and buy all of her music directly from her web site in order to increase the likelihood that we'll all have more to enjoy in the future. The thing that prompts this post, though, is a short documentary film. It was made by Intel as some kind of advertising ploy for a semiconductor product that they happen to manufacture, but thankfully that's not too blatant and the film is well worth its six minutes. The soundtrack is superb, as you might expect.

• PEM: iay-ca-g1-2011.crt
• DER: iay-ca-g1-2011.cer

The SHA1 fingerprint for this certificate is:

• 34:6E:CB:19:25:15:E7:94:ED:AF:A4:F1:C4:79:BF:92:C5:8B:3C:D5

For reference, the previous root certificate is here:

• PEM: iay-ca-g1-2006.crt
• DER: iay-ca-g1-2006.cer

The last certificate issued under the old root certificate expires on 2011-01-23.

I gave a presentation to FAM10 back in October in Cardiff, in the "Not for the faint hearted" session. You can download the slides as a PDF file from the illustration on the right.

My working title was "How to Survive the Coming Zombie Apocalypse", but the presentation was really about how to survive the transition from cozy local federations to federated operation in the global internet. Whether that looks like a scary prospect depends, of course, on how conservative you've been to date: UK federation recommendations have always emphasised the difference between technical trust and behavioural trust, and the talk goes into some detail on this topic.

Understanding trust allows you to protect yourself against the zombie hordes (sorry, I mean "entities not bound by your local federation's behavioural norms"). The other topic covered in detail is how to benefit from interfederation by making sure that you're running software capable of interoperating widely.

You can find out more about it at the project's wiki; Nicole Harris has a pretty good summary of the idea and what it might mean.

One thing that seems to be confusing people about BEER is that it's easy to make the assumption that it's trying to be a federation along the lines that we have at present, just with less strict membership rules. I'm not saying that such a thing wouldn't have a use (TestShib has been very useful for many people, although it leans so far towards openness that some would argue that it falls over), but this is not what BEER is about.

It's probably more helpful to look at BEER as a new kind of thing, an independent registrar of metadata. Its job is to assure the authenticity of the metadata it publishes (in terms of establishing that the metadata for an entity has a connection to the owner of the associated domain) without attempting to make guarantees about any of the things you might later layer on top of that "technical trust". As such, it's aiming to be a component in an overall trust framework rather than a complete solution in the way that many of the existing federations see their role.

Whether such a service has a long term role to play depends on whether the various existing federations start to converge in terms of their view of their own roles, and of course whether that convergence is in the direction of monolithic trust or in the direction of separation of the different trust components. Both approaches have supporters, of course, and we'll just have to see how things work out. It will be obvious from previous posts that I'm in the "separate the concerns, behavioural trust is end-to-end" camp, which I'd broadly characterise as the design we chose for the UK federation, and which I think has worked out pretty well in that community.

By coincidence, I'll be talking at FAM10 next week about how to survive a scary post-apocalyptic future in which not all UK federation metadata originates from the federation's own members, and BEER will certainly be on the agenda. As will beer, of course, although probably not during the talk.

Bureaucracies temporarily suspend the Second Law of Thermodynamics. In a bureaucracy, it’s easier to make a process more complex than to make it simpler, and easier to create a new burden than kill an old one.

[from The Collapse of Complex Business Models by Clay Shirky]

I recently came across this perfect expression of the idea, which I pass along here without further comment:

It's true: never let the guy with the broom decide how many elephants can be in the parade.

[Merlin Mann said that.]

I'm making a note here: "Huge Success".

Portal is free for the next few days, on both PC and Mac.

If you've never played it, Portal is pretty hard to describe. Instead, I'll just direct you to the trailer.

The only other S/MIME certificate authority I'm aware of that does Web of Trust type identity validation is CAcert; unfortunately their root certificate isn't trusted by most browsers and e-mail clients and until that happens (if it ever does) I can't recommend them as a replacement. Similarly, the lack of built-in PGP/GPG support in current mail clients rules that system out for most people.

If you had a Thawte S/MIME e-mail certificate, you may have been able to trade it in for a 1-year equivalent from VeriSign free of charge. Unfortunately, after the first year it looks like VeriSign charge $19.95 per annum even for a "persona not validated" certificate, which doesn't sound to me like a lot of bang for your buck.

One alternative for the cost-conscious is Comodo's Free Secure Email Certificate product. Again, this is "persona not validated" but should be sufficient for most uses and you can't beat the price.

I think the talk went reasonably well; a couple of people remarked that they liked having the key concepts separated out and clarified. People even chuckled in the right places a couple of times.

Checking Twitter for the #FAM09 tag I find that the main thing a couple of people took away from the talk was a snarky remark I made about XSLT. Curiously, I find that I'm fine with that.

As usual, here's a PDF version of my slides from the presentation:

20091123-Metadata-Aggregation.pdf

There are a fair number of animated diagrams in this talk, and not as many words as usual. That might mean that some parts are hard to follow without hearing me talk. I'm going to try and get hold of the audio recording made at the time and will upload a slide-synchronised version of the talk later if possible.

Seen on a recent trip to San Antonio, Texas, which is probably the last place you'd expect to see any attempt to constrain the use of any kind of headwear.

Obviously they don't mean you can't wear your own hat while taking photos; what they want to prevent is people wearing the display hats for the purposes of having their photographs taken. Or at least I think so; there were no hats in the vicinity of this particular notice.

I've been trying to figure out why I couldn't burn a Fedora 11 DVD to upgrade one of my oldest machines for several months now. I had checked the SHA-256 hash of the download then copied the file from the server where I run BitTorrent across to a desktop machine's external hard drive. The burned disk verified against the image on the machine that created it but the installation self-test always failed, claiming the disk was corrupt. I tried burning from the same image on another machine; I tried burning at different speeds; I tried different blank DVDs. No change.

Finally, today, I thought to try verifying the hash on the copied image rather than the original one. It was different. Comparing the original download with the copy, I discovered two locations in the copy where byte 0x12 of a block had dropped the 0x08 bit.

It's probably not a coincidence that the machine on which I made the corrupted copy has recently come back from a couple of extended "warranty repair" holidays during which first the main system logic board and then (at my strong and repeated insistence) the actual DRAM were replaced. The machine had been having some intermittent problems involving applications shutting down unexpectedly; these looked like memory issues to me but the manufacturer's diagnostics had always given it a clean bill of health. As an old-school computer guy, of course, I know that the manufacturer's diagnostics never detect real memory issues.

The moral of the story? I'm not sure there is one: "faulty hardware sometimes gives the wrong answer" seems rather an obvious thing to say. On the other hand, if you are aware of the concept of metastability in electronics, you know that there's no such thing as perfect hardware as long as the logic needs to talk to the outside world. So we can reduce the frequency of odd weirdness to the point where we never expect to encounter it, but we can never make it go away altogether.

One thing that has become apparent as that work has developed is that we need to look at some of our basic assumptions with a fresh eye: complex problems can be often be simplified by looking at them from a different direction. To that end, Chad La Joie (of SWITCH and Shibboleth) and I have put together Interfederation and Metadata Exchange: Concepts and Methods, the current version of which you can download here:

concepts-v1.10.pdf

The main aim of Concepts is to provide a framework in which it is possible to think clearly about identity federations in a multi-federation world. This involves first separating concerns and then recombining them in new ways, leading to what we think is probably best thought of as a global metadata layer. There is also coverage of some of the technical implications of such an approach, but we've tried to keep that part as light-weight as possible here.

During the recent Internet2 Member Meeting in Arlington, this document was also reviewed by Scott Cantor, Steven Carmody, Josh Howlett, Leif Johansson, Thomas Lenggenhager and Valter Nordh. We are grateful to our colleagues for their many constructive comments, which we have have tried to incorporate faithfully in the current version. I will leave it to those individuals to state whether, and to what degree, they endorse our conclusions.