[PDF version]

OK, so this is vaguely a discussion of In the Land of Invented Languages: Esperanto Rock Stars, Klingon Poets, Loglan Lovers, and the Mad Dreamers Who Tried to Build A Perfect Language (BUY!)

To start, for full disclosure, let me tell you why I picked this book up: because Arika and her husband are pals of mine. I'm not going to give you a full review--the NYT and Salon have already reviewed it, so she doesn't need me. The Salon review is lazy and represents everything I hate peer review, but that's another rant.

That said, I'll be discussing Arika's world in the context I know best: coding languages. Arika's book is about human languages, and the people who decided that it's high time for a new language around which a world community would (hopefully) be built. That's never the case with a programming language. Nobody expects to raise their kids in Python.

That said, there's still a lot in common between the new human language and the new coding language.

Personality

I'm interested in the coding language thing mostly because I'm sorta forced to. People are darn vehement about this subject, in a scary kind of way, given that we're talking not about abortion or capital punishment but whether to end lines with a semicolon. It's the first point in any discussion of my book: what coding language did I choose? A lot of people never get past that. Others send me letters entreating me to halt my work and redo everything in their favorite language. This happened even after the book was published.

But where does all this vehemence come from?

As Arika tells it, the story of invented languages is a story of personalities: people who (1) felt the need to devise a new way of speaking, (2) did the work of developing a whole new system, and (3) did the harder work of developing a community to use and support that language. All three of these items are tall orders, and require a certain sort of persistence/megalomania.

The stories of the crazy folk who persisted against all odds is what makes Arika's book ready for the popular press. There's certainy conflict: authors whose life's work is torn apart and dismissed, authors expounding on the conspiracy theories holding them down, lawsuits over ownership and control, and yelly people who just yell a lot.

Bringing it back to programming, it's just about all there. The personalities are very evident, and there's a name attached to a great meany languages: Perl = Larry Wall; Python = Guido van Rossum; C = Kernighan & Ritchie; ruby = Yukihiro “Matz” Matsumoto; C++ = Bjarne Stroustrup; and so on. In the case of C, the authors let go pretty quickly, and we now refer to it as ISO C99, not Brian and Dennis's C. For the others, this is less the case, and the authors are a part of the language. When you're using Perl, you've got Larry Wall over your shoulder, whispering in your ear.

As Arika repeatedly shows, anybody who will devote their life to such an endeavor has to have quite the abundance of self-confidence; or as explained by Larry Wall, who describes himself as “the Perl god”, “All language designers are arrogant. Goes with the territory... :-) ” wiki

So what motivates these folks?

No, we won't achieve world peace by all speaking the same language, but I find it indisuptable that language is at some level a unifier and a divider. I've blogged this point before: to choose a language is to choose a team. So to develop a new language is to (attempt to) form a new team.

The smiley-faced way to say it is that the author wants to build a community. Here's Larry Wall again: “I want to see people using Perl to glue things together creatively, not just technically but also socially.” In the world of invented human languages, such thinking goes with the idealists, like the author of Esperanto, Ludwik Zamenhoff.

The cynical way to put it is that the author wants to lead a community, to have followers. These are the ones who wanted more control over things, like the author of Blissymbolics, Charles Bliss, who threatened lawsuits against those who would publicize his language with the wrong line thicknesses, or the author of Loglan, James Brown, who took his followers to court for taking his suggestions and running with them.

Categorizing the authors of the computing languages between community builders and control freaks is left as an exercise for the reader.

Done right, the community actually does form. Arika shows this nicely as she traces how each new language develops its own culture, which repels some people and attracts others. Over and over again, people develop an allegedly culture-free universal language, and then a culture starts to develop around the language, and then reshapes the language to its style.

The grammar and vocabulary of a language inevitably express a point of view, and then those who share that POV gather `round. In that way, I suppose a new language is a lot like a pop band.

The schisms

Some pop bands are entirely derivative, and some say something at least a little different. It's hard to find many that are truly innovative--they still all use rhythms and melodies (except the ones who don't, who all sound alike).

Languages are so cheap because it's always easy to base your new language on an old. Nietsche described the übermensch--the once-in-a-generation rarity--as one who writes a New Word; the rest of us just recycle and recombine.

As a corollary of the fact that all new languages are in some way a derivative of the old, it's hard to keep a language from recombining and digressing. Arika describes the many, many schisms that any succesful language will eventually suffer: Esperanto has Interlingua, Ido, Glosa, Globaqo, Novial, Hom-Idyomo [Arika, p 98]. C has C++, C-, C#, Cω, C-smile, D, Objective-C, and lots of others that at least had the sense to not just name their language some variant of C-increment. This site has a list of about 1,200 languages for ya..

Remember, they're all a set of trade-offs: you can have simple or you can have comprehensive; you can cut out all the redundancy and requirements on the human, or you can fill it with self-checking and human-friendly type agreement rules. But there's no chorus-of-angels true answer that we'll one day discover, and we're instead left wandering the desert using whatever seems useful at the moment.

Hey, I have my complaints about C's syntax, which I already listed in one of my more boring prior entries. But I chose to stick with the standards rather than talk the world into accepting my personal ideal. Others chose to go the other way, and after the bickering and incompatibilities, that's how progress is made.

Figure One: Some typical modern C users (or, what happens when you search Flickr for hipster). Thanks to Kid Paparazzi.

So maybe it's a question of improving on things and really getting the syntax right, but maybe it's just a question of personalities. In such a world, the problem with C is not that its variadic function handling isn't so hot, but that we picture the people using it as being cutting-edge in 1979.

How does one update an imagined community? You don't. It's easier to just generate a new one.

[link][no comments]

[PDF version]

In last episode, I mentioned the lovely and simple concept of the canalphone. To summarize: I think they are fabulous; they are a simple idea--just squish the speaker through an earplug and you're done; and they became ten-bucks cheap only in the last year or two.

OK, so who owns the concept?

Could one of the people selling $150 canalphones have patented them and prevented the $12 entrant from killing the market? Though the $150 versions are still out there for sale, because people have no idea how to evaluate speakers and so just stick to price as an indicator of quality.

It seems not. The speaker-in-earplug idea's been around for a long time, as in patent 5,251,326, filed in 1990, for an entire system of which one component is a speaker-in-earplug. You can also find many hearing aids that use a comparable setup. Or, many applications and patents for in-ear speakers with an interesting twist, like adjustability or multiple speaker arrangements. But there's no patent that I could find--certainly not from the last thirty years--for speakers embedded in an earplug.

So the simple concept has been around for decades, and there's neither legal nor technological barrier to their sale right next to the crappy earbuds that you stick right against but not quite inside your ear. In this case, the Patent Office seems to have done the right thing: it's such a simple and obvious thing that it doesn't merit a government-granted monopoly.

So why hadn't ten dollar canalphones existed to this date? Why were they considered high-end, while the low-end had to make do with those crappy earbuds?

Books on the history of science never quite answer that sort of question. What kept Euclid from working out irrational numbers--or even imaginary numbers? Well, nothing at all, and yet he didn't. Nobody did, for millennia, and we can rest assured that two hundred years from now they'll muse at why we hadn't yet worked out all the things we hadn't worked out ourselves.

But what if he had? What if all of Euclid's colleagues were trundling along with their existing theories that are still trying to grapple with the concept of the square root of two, and Euclid explains to them that we can derive consistent properties around the square root of negative one? There are examples where such ahead-of-their-time ideas were broadly accepted, and where they were broadly rejected. E.g., go ask your search engine about Lord Monboddo.

The patent office is built around a supply-side story of technological progress: the thing that holds us back from better technology is the time spent on new innovation, and the sole means the patent office pursues in advancing technology is (implicitly) paying people to sit in their lab developing new technologies. But we sometimes find that it's the demand side that's the bottleneck. Am I saying anything groundbreaking when I tell you that we consumers (both individual and corporate) often stick with tried-and-true even in the face of clearly better new alternatives? Economists tell us that if something better comes along, its adoption will be immediate and complete throughout the given market. I suppose that sometimes happens, but marketing people instead rely on a standard model (the Bass model) that describes the slow spread of a new technology through the market.

There's still the problem of putting enough brains on a problem and encouraging that flash of genius that creates the new, but that's just the first stage, and is often the easy part relative to the social problems that the idea will have once it is competing with other ideas for attention, a place on the agenda or syllabus, and dollars.

In the case of the concept of a small speaker smooshed into an earplug, that's existed for decades, so there is no patent-office-style bottleneck. Rather, demand-side reluctance seems to do a decent job of explaining why canalphones didn't happen sooner. There first had to be acceptance for cheap walk-around headphones (circa 1970s), earbuds (circa 1980s), and exotics like noise-canceling headphones (circa 1990s).

[link][no comments]

[PDF version]

Headphones are really essential for many types of music. Classical-type composers are writing for a concert hall where there's absolute silence, so the performers can play as quietly as they want, and three seconds later blast their violins at full throttle. Pull out your copy of Jeff Buckley's cover of Hallelujah (which I discussed in an earlier post on covers), and you'll notice that he sighs at the opening, setting the tone for the piece. Or, I dunno, the cello in the Beach Boys' Good Vibrations, which is mostly in background until the end.

Forget about hearing those details in the car. You'll need a reasonably quiet space and good speakers for these things to really be evident. Now, good speakers range from about $100 for a pair to $1e5 for a pair, depending on how much of an audiophile snob you want to be. The real audiophile then works on placement of the speakers, and adding acoustic absorption in the listening room, to ensure direct sound and prevent undesirable reflection. If sound is both reflecting off the walls and coming to you direct, then it gets muddied. Next time you're at a concert hall, notice how the ceiling and walls have few wide, flat, or hard surfaces. Some performers will tell you that the concert sounds different with and without an audience, since bodies absorb sounds that empty seats reflect.

Or you can get headphones. They're right against your ears, so it's easy for them to have better sound. Your $10 headphones are equivalent to $50 speakers, and $150 headphones are equivalent to a thousand dollars worth of speakers. Room arrangement is not an issue.

Of course, there's some logistics. If you're in a social situation then headphones don't make a lot of sense Last I checked in, headphone splitters didn't work all that well. Wearing them all day gets uncomfortable. Also, the odds are good that if you're wearing headphones, you're walking around town.

Which brings us back to the automobile question. There are various tables of decibel ratings around the Web, listing the range of decibel levels from a quiet whisper at 30dB, to normal conversation at 60 or 70dB, up to a jet engine from a hundred feet at 140dB. Traffic ranges around 85-100dB, depending on which table you're reading, and whether you're inside or outside the car. OSHA starts imposing workplace regulations around that level: you can listen to 90dB for eight hours unprotected, and 100dB for 2 hours.

In every state law I know, it's illegal to bike in traffic with hearing protection such as ear plugs. OSHA regulations say it's illegal for a messenger company to send its employees into a full day's traffic noise without hearing protection such as ear plugs. So it goes.

Me, I wear the earplugs while biking, and regret the time I spent not doing so. I'm exactly as aware of an automobile making a muffled 65dB of noise as one making a full-bore 95dB. If I get the sense that the earplugs are too effective, it's easy for me to maladjust them so that I only get partial noise reduction.

Getting back on topic, music at reasonable levels (maybe 70dB, with those subtle sighs down to maybe 50dB) doesn't stand a chance against the automobile.

A decade or two ago, our headphone engineers gave us noise-cancelling headphones that actively dampen incoming sound waves, so your own preferred noise sounds better. This is terrible outside (wind throws these things off) but generally great if you're indoors (e.g., on public transportation, such as a plane). They don't dampen everything, so it's easy to hold a conversation, yet the engine noise really is damped. In short, they're fun, and I'm glad I have my $50 pair.

The next piece of progress, though, is even niftier: the `canalphone'. The idea here is to just take a pair of ear plugs and squish a small speaker through them, so you have what the snobs call the `passive noise reduction' of earplugs, and smaller speakers a millimeter or two closer to your ear. Turns out this is a good combination with good results: you can hear Jeff Buckley sigh, even in a loud room. Thus, these canalphones ran $150++.

But compared to noise-cancelling headphones, the technology is downright primitive. Seriously: small headphone speakers, earplugs, squish, you're done. No serious circuitry. Another relatively recent invention, bone-conducting speakers are higher on the innovation scale but also don't do as well as the simple speaker-in-earplug.

Because the manufacturing cost is not all that much more than a good pair of earplugs and a cheap pair of headphones, the $150 price tag is based on rarity, novelty, and demand. But the jig is up. I got these headphones for $12, and they saved my life.

I've started listening to music that I just hadn't been listening to before. I'm walking down the street, wind in my face, cars at my back, and I'm listening to a bass solo off of Giant Steps.

Penecontemporaneous to getting these headphones, I got a copy of Schnittke's Minnesang b/w his Choir Concerto (BUY!), which I promptly loaded onto my telephone. I'd already heard track two of the Choir Concerto adapted for strings and re-recorded by the Kronos Quartet under the first line of the lyrics (“I offer these collected songs where every verse is filled with grief...”), but I wasn't sure what to expect from Minnesang. As it turns out, my mind was fucking blown. Schnittke has just about every voice in the choir doing something slightly different, so at the same time as the overwhelming wash of voices is coming at and at you, there are individual voices walking around the room. With inferior headphones--i.e., without headphones driving the sound directly into your brain--you'd just hear the overall wash and think it was just whiny.

Now that I've told you how my headphones saved my life, next time I'll talk about the politics and intellectual property issues.

[link][a comment]

[PDF version]

Economists tend to think of people as a lazy, pernicious ooze. If there's a crack in a system, somebody will ooze their way into it and exploit the flaw. After the easy and profitable flaws are covered, people may need to move on to more difficult ways of being lazy.

Password cracking fits this mold: a cracker doesn't crack all the passwords, but just finds the easiest chink in the system and attacks that. If there's one person in the company whose password is password, they're in.

Recently, two data sets of passwords from real people came out; see Schneier and this writeup. It turns out that, if given the chance, an awful lot of people really will use password as their password.

Sysadmins are playing a complementary game to the crackers. They guess the most common passwords, and then deny you access until you can come up with a password that gets past their barriers. And of course, the users, being a pernicious and lazy ooze, invent the absolute simplest password that matches the requirements of the system. OK, password is out, so use password1.

In the beginning, you'd be prompted to just enter a password. The lowest-effort person just used password. Thus, we had the first round of the escalation, which went something like this:¹

Your password will be checked against a `hacker dictionary' of English words, common names, and common product brands, and will be rejected if we find it in the dictionary. Please make an effort to mix caps, numbers, and symbols. If you use password as your password, HR will be notified and you will be asked to clear out your desk.

Things continued to escalate from there, and every year we saw more clauses and conditions added. Here are the seven rules from my telephone company login screen. I left them in Spanish to keep them extra inscrutible If you can't read this, you're experiencing what a huge chunk of the Internet's account setup screens look like to most of the world's users.:

Tu contraseña debe reconocer las mayúsculas y:
• Debe tener entre seis y veinte caracteres.
• No emplear otros caracteres que no sean letras y números (tales como *, &, # y "").
• No utilizar la fecha de nacimiento, el nombre o el apellido ni la combinación del nombre y el apellido.
• No incluir los primeros cuatro a ocho dígitos de tu número de teléfono móvil.
• No debe coincidir con tu número de cuenta.
• No debe ser una dirección de correo electrónico.
• No debe tener más de 2 caracteres repetidos a continuación ni más de 3 caracteres ascendentes consecutivos.

You can see that this escalation can go on forever: users use password; so admins banned it; users lazily ooze to password1; so admins ban it by requiring numbers, lowercase, and capitals; users ooze to Password1, et cetera. From the list of rules, you can almost guess the most common password, which means that the rules don't really bring up the difficulty crackers will have in guessing that bottom end.

Oh, and some systems are broken, like the second bullet point above that won't let you use any characters but letters and numbers. Seriously? Your system can't encrypt and store an arbitrary string of text? Some require a password that is exactly six, seven, or eight characters long, which is just inexcusably lazy database design. So those details add another level of password complexity, as it's called.

Password complexity

Indeed, 2.8 trillion is about fourteen times bigger than 200 billion. But by 200 billion, the game is already over: who cares if your space is four million times bigger than the English dictionary or sixty million times bigger? You've already locked out any casual attempts and script kiddies, and the truly sophisticated will get around the larger requirements too. True story: a pal offered to share wireless with her neighbor David. He never mentioned anything again, but one day a password protected router named apt302 turned up on her computer's list. The first password she tried was Dave, and she was in.

Once you've left the English dictionary, you've done as much as reasonable for dictionary-based attackers. As for the lazy and pernicious ooze problem, a larger space doesn't help at all: there will always be an effort-minimizing corner somewhere. So for this detail of the issue, the added restrictions are just a waste, and the only serious solution is to educate users that they have to stop meeting all the requirements with crap like PasswOrd!.

Me, I like the First Letter Of A Phrase method--the floap method. Almost any sentence will produce a non-English string of letters which is easy to remember and has much higher `complexity' than any system that arrives at a dictionary word with a 1 appended and all the 'o's changed to zeros. It's certainly hard to guess: how many phrases and catchy pop songs do you know? I've written up this rant, though, because even the floap method is increasingly not acceptable: e.g., many systems will tell me that floap is a bad password, having only five letters, no capitals, and no numbers. But it's already outside of the English dictionary, and is thus in the space of 11 million possibilities and not fifty thousand.

We need to pull people out of the 50,000-word dictionary and into using something more complex, but burdening them with extra rules to move them to a space of 2 billion options instead of 200 million is likely counterproductive. At work, somebody may have to spend ten minutes playing Scrabble with the password-checker instead of doing productive work, only to forget the password and get locked out the next day. Online, every additional password requirement is another bunch of people who just closed the browser window and went somewhere else.

Social

After all, the combinatorics above already cover most of the story: the English dictionary is short, and random character streams are hard to search. So why continue the escalation, then, adding longer and more absurd requirements every year?

First, the person setting the password rules looks like s/he is doing due dilligence by having password rules as annoying or more so than the neighbors'. If the rules are weaker and there's a crack, then it's the admin's fault; if the rules are absurdly onerous and there's still a crack, then the admin's ass is covered. So there's a simple Prisoner's Dilemma game, where we all collectively benefit from keeping norms sane, yet admins want to signal that their rules are more impressive than the norm.

That signal is pretty public, too. When you first log in and set up your password, that list of silly rules is a big sign from the IT department stating that they are deeply concerned with security and must be doing lots of things under the hood that are just as carefully considered as this long list of rules. It's only natural that admins would go crazy and overthink the user-facing side of things, whether the effort benefits the system or not.

The potential organizational costs of a breach of security are cleanly focused on the admin who would get fired. The cost of ten minutes wasted by every person in the organization trying to come up with a password, forgetting it, getting locked out of their work, and so on, is by definition a distributed cost. So there's a collective action problem to the situation: how can we get a balanced consideration of the admin's concentrated interest against the inconvenience of every user? At one place I work, being locked out is so prevalent that there's a specially-built site for password resetting, iforgotmypassword....gov. I take this to mean that the balance has not been struck, and the password complexity rules are too burdensome I wanted to post them for you, but the site only works in Windows, and even attempts to get a list of the rules give me errors from IIS.

And, of course, there's the mystic nature of security. It's a security issue wins every argument for your IT guy, and s/he knows it. How do you argue with that? They know the details and you don't, and even if you did know the details, you'd realize that security can't actually be measured anyway.

Footnotes

... this:¹

I never really saw a prompt like this, but you'll see below that it's sort of my ideal balance.

[link][4 comments]

[PDF version]

We had a lot of stupid debates about what to call my front room: the parlor, the sitting room, the living room, but in the end the room defined itself. Now that it houses an upright piano, two clarinets, two guitars, two hammered dulcimers, a fiddle, and an overwhelming amount of sheet music, it's the music room. Let me note that I'm pretty far from playing any of those instruments very well, and my housemates are much heavier users of the music room than I. I met a fellow band member of one of `em a few weeks ago, and he suggested that maybe I could just stand in the back and provide a two-note oom-pah on the clarinet.

I've always hated the sound of the term Indie music, which seems to refer to the label not being owned by one of the Big Four, though even that's problematic: what are we to make of the members of the Independent Label Group, a wholly-owned subsidiary of Warner Music?

No, let's forget about label ownership and popularity. How close is the music to a bunch of people (or maybe one), hanging out in the bedroom or the garage or the living room overcrowded with instruments and cables?

OK, enough pontificating. I downloaded this year's SXSW BitTorrent: 1O53 songs; 2 days, 17 hours, and 41 minutes. I did this for `07 and `08, and it brought me joy.

My last.fm profile tells me that I've listened to the Chocolate Horse's The Caribbean 71 times in the last few months, and Gavin Castleton's Women's Care in Eb maj 23 times, and--giving up on last.fm's massive undercounting--heavy rotation of SXSW tracks by Rebekah Higgs, the Bon Savants, Clare & the Reasons, I Love You But I've Chosen Darkness, Micah P. Hinson, Ola Podrida, Johnossi, and Low Line Caller.

So I get a lot out of this exercise; maybe you'll get something out of it too.

Now go to drop.io/fluffinfo and get yer music.

Black diamond heavies - Bidin' my time

Bomani Armah & Project Mayhem - Read a Book

Gavin Castleton - Bugguts

Delhi2Dublin - Apples

DJ Chicken George - Overthrowed!

Fol Chen - Cable TV

Not much girlfriend or boyfriend music this year. Perhaps I'm not yet over my crush on Neko Case, who does occasional girlfriend music, such as Challengers by the New Pornographers and Neko. I suppose this track is as close as I'm getting on this set.

The Coast - Killing off our friends

Alina Simone - From great knowledge

Radioclit - Kamphopo

Youth Group - Start today tommorow

Honorable mention for best name: Jesus Loves You (But Yr Still Coming Home With Me Tonight) by Des Ark

[link][a comment]

[PDF version]

I've been talking to a lot of journalists lately, about a somewhat technical topic. Some make a real effort to delve and understand the topic. I like those interviews; they are fun. I get the sense that both sides learn something from them.

Others are of the following form:

Who supports [your position]?
Who opposes [your position]?
Who is lobbying Congress in favor of [your position]?
Who is lobbying Congress in opposition to [your position]?

That is, they ask about the horse race, not the topic itself. Halfway through one of these interviews, I finally understood what it is to be a journalist: every day, you come in and face a new topic, and have to invent new, insightful questions about those topics. It's hard. And if you want to coast, all you have to do is fill in the blanks above, and you're done. The article writes itself.

You also don't have to stick your neck out with factual statements about a hard-to-understand subject. Scientists taunt journalists all the time for getting facts wrong; think how freed the science journalist would be if s/he could just write about who supports the genetic link to Type I diabetes, who opposes it, and who's lobbying Congress to change it. They'd get 100% of the facts straight every time.

I work on the politics of certain issues, but most folks associate horse-race journalism with general elections: this week, candidate A is two points ahead of candidate B in Puerto Rico, but B is three points up in DC. Again, this is in lieu of actual discussion of where candidates A or B stand on any issues. The candidates probably don't actually have a position, but that's no problem, because nobody will press `em to develop one.

I realize that there are reasons to write about the horse race. It creates drama in what may be an otherwise boring and technical topic. But there are a ton of ways to create drama--I've seen math textbooks that get a good emotional build over the course of a chapter. Some say that The People really want these sorts of articles. Who supports horse-race journalism? Who opposes horse-race journalism? Who is lobbying Congress to change horse-race journalism? In a major election, where there will be hundreds or thousands of articles written, some of those should be about the horse race.

In a short-circuited way, horse-race articles are a convenient way to help the reader make decisions. We often decide upon questions by who supports which side. This is efficient. If your politics-obsessed pal spent a week reading everything and concluded that Candidate X is the right choice, and you find that you generally agree with your pal, then why bother replicating all that work? As a variant, if your cantankerous uncle (the one who hasn't yet gotten the memo about the “N-word”) is confidently voting for Candidate X, then you can confidently cross X off your list.

But articles about who supports a candidate are an odd sort of double-redirection. By reading about who is or is not supporting X, you can use that to make a choice. But a well-written article will present the issue(s) in a sufficiently comprehensible manner that you yourself could make the decision directly. One article says `here is the information so you can make a decision' and another says `here are some people who have looked at the information and made a decision, and given those names you can now make a decision just as easily.'

At the end of the short-circuit article, you've successfully made a decision, but you haven't learned in the process. Your worldview is no different. You have nothing new to question why it is that you believe whatever it is that caused you to vote in consensus with your favorite nonprofit.

[link][a comment]