Happy New Year!

Our new year’s resolution is to show a sense of childlike wonder at and acceptance of everything we come across, especially this year’s leap second.

Incidentally, this post is scheduled to go live at 2008-12-31 23:59:60. Let’s see what happens!

Update: Movable Type complained when I tried to save the post: “Invalid date ‘2008-12-31 23:59:60’; authored on dates should be real dates.” There goes my sense of wonder. Acceptance, however, remains.

Now will you believe MD5 is broken?

I’m just sitting here blinking, having a Brecht moment in which I am laughing at those who are crying and crying at those who are laughing.

At the CCC congress, a number of people did something dramatic — they created a forged SSL certificate. It’s dramatic, but nothing special.

We’ve known that MD5 is broken for over a decade. It’s been undeniable for nearly five years. We have seen people create colliding PDF documents, we’ve seen a prediction of the last Presidential election by having a multi-collision. This is a clever bit of engineering, drama, and publicity, but anyone with cryptographic sense gives it a shrug.

Nonetheless, the twitterverse and blogosphere are chattering about this, which is what makes me laugh.

On the other hand, there are a number of CAs still using MD5, which made the attack possible and they are only now changing. This is what makes me cry.

In a year that has seen organizations crushed because of heads in the sand when chaos emerges, here’s just another.

Happy Newton, everyone!

In honor of Newton’s Birthday festival, I therefore propose the following song, to be sung to the tune of “The Twelve Days of Christmas.” For brevity, I include only the final verse. All together now!

On the tenth day of Newton,
My true love gave to me,
Ten drops of genius,
Nine silver co-oins,
Eight circling planets,
Seven shades of li-ight,
Six counterfeiters,
Four telescopes,
Three Laws of Motion,
Two awful feuds,
And the discovery of gravity!

The Ten Days of Newton, by Olivia Judson

I miss Montreal

seattle bus stuck in snow.jpg
When Seattle is covered in snow, it’s easy to miss Montreal. Now, folks in areas that get lots of snow like to make fun of Seattlites for being unable to handle a little snow, but it turns out that there’s another reason (beyond the steep hills) the city has a (ahem) unique approach: “Seattle refuses to use salt; roads “snow packed” by design:”

But it turns out “plowed streets” in Seattle actually means “snow-packed,” as in there’s snow and ice left on major arterials by design. “We’re trying to create a hard-packed surface,” said Alex Wiggins, chief of staff for the Seattle Department of Transportation. “It doesn’t look like anything you’d find in Chicago or New York.”

[That’s right Chief Wiggins–you’d be fired if you tried that in Chicago or New York–Ed.]

That leaves many drivers, including Seattle police, pretty much on their own until nature does to the snow what the sand can’t: melt it. The city’s patrol cars are rear-wheel drive. And even with tire chains, officers are avoiding hills and responding on foot, according to a West Precinct officer.

Anyway, after what seems like a solid ten days of continuous snow, it’s 40F/4C and the snow is melting.

[Update: “After storm of criticism, Seattle mayor reverses no-salt policy for snow.”]

At the tail end of the car series…

fake license plate.jpg

Originating from Wootton High School, the parent said, students duplic ate the license plates by printing plate numbers on glossy photo paper, using fonts from certain websites that “mimic” those on Maryland license plates. They tape the duplicate plate over the existing plate on the back of their car and purposefully speed through a speed camera, the parent said. The victim then receives a citation in the mail days later. (“Local teens claim pranks on county’s Speed Cams,” Montgomery (Maryland) County Sentinel)

Eric Rescorla makes some inferences about what happens when you try this:

However, if people are actually getting tickets when you do this, then this reveals some pretty lame procedures by whoever’s running the photo radar system, since presumably the photo of the driver doesn’t match whatever the driver’s license photo of the person you’re issuing the ticket to, and of course the car model probably doesn’t match either.

My educated guess would be it’s easier to bill people and see who argues than check every license plate.

PS: Fonts from certain websites? Try Googling license plate image generator, which is where I found ImageChef to make the image shown. this site has a nicer collection of templates.

PS: Sorry, Eric, couldn’t resist!

News and Lessons from the Auto Market

lines of minis.jpg

“There are no hot segments,” said George Pipas, Ford’s market analyst. “And there really are no hot products.”

So closes an article, “Automakers Report Grim October Sales.” GM, sales down 45%. Ford, -30%. Chrysler, -34.9%. Toyota, -23%. Honda -25%, Nissan -33%.

MINI Cooper: Up 56.4%.

Soon, Ford will be caring about MINI’s market of “only” 60,000 cars a year, which is admittedly a lot fewer cars than Ford sells, and makes it easier to be up.

But I’d like to look a little beyond this for some lessons. I think MINI is pretty prescient in a couple of ways. It’s not just small before small was big. It’s not just cute. What’s really big is the mass customization story and what it means to customer involvement. Almost every MINI is different. The number of factory options is staggering, and then there’s a thriving aftermarket.

So while the Ford will still sell you any color you want as long as it’s black, white or grey, MINI has a dozen colors, some exuberant, and will sell you the roof in the body color, or white or black, and you can get either matching mirror caps, or customize those.

The customization and consumer involvement it brings is huge. A little chaos goes a long way, especially when you’re looking to stand out from the crowd.

As a CTO or as a program manager passionate customers who help you stand out from the crowd can be huge. But your customers can’t really do this unless you prime them. It’s your product. What features are going to excite your customer?

Ford may have answers. In fact, they seem to have better answers than the other American car makers. But they don’t have a wow. And a wow, an emotional response, a tug at the heartstrings is at the core of why MINI was up 56% while GM was down 45.

I drafted this back at the beginning of November, and as I’m getting ready to post, I saw “MINI Shutting Down Production for December,” and “Worldwide MINI sales down 12% for the year.” Near as I can tell, the October numbers are accurate, but I wanted to include context.

Photo: “Lots of Minis” by SquareGraph

Designing Cars

I was struck by this quote in “Edgy, Yet Still Aerodynamic” an article in the New York Times about how new cars are being designed and tested:

To his surprise, in hundreds of tests at Ford’s Wind Tunnel 8 southwest of Detroit the original edges produced less drag than curved substitutes, Mr. Koester said. In the bumper, headlights and hood, in fact, aerodynamics were improved by carefully designed edges.

Usually, aerodynamic shapes are rounded forms that slip through the air. But the wind tunnel is proving that counterintuitive, edgy shapes can reduce the drag coefficient and save fuel or battery power.

Even in fields where repeatable tests seem relatively easy, the expectation and intuition of professionals can be wrong. In information security, it’s far worse.

What are you doing to test your long-standing assumptions?