<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>bugfox blog</title>
	<atom:link href="http://bugfox.net/blog/feed/" rel="self" type="application/rss+xml" />
	<link>http://bugfox.net/blog</link>
	<description></description>
	<lastBuildDate>Wed, 16 Jan 2013 03:25:05 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.5.1</generator>
		<item>
		<title>Aaron Swartz&#8217;s Suicide</title>
		<link>http://bugfox.net/blog/2013/01/15/aaron-swartzs-suicide/</link>
		<comments>http://bugfox.net/blog/2013/01/15/aaron-swartzs-suicide/#comments</comments>
		<pubDate>Wed, 16 Jan 2013 03:25:05 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=332</guid>
		<description><![CDATA[If you have been following the news you must be aware that Aaron Swartz, a social-networking pioneer, academic researcher and clumsy hacktivist, has killed himself. Though he left no suicide note many people attribute his death to the fact that &#8230; <a href="http://bugfox.net/blog/2013/01/15/aaron-swartzs-suicide/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<p>If you have been following the news you must be aware that Aaron Swartz, a social-networking pioneer, academic researcher and clumsy hacktivist, has killed himself. Though he left no suicide note many people attribute his death to the fact that he was facing federal charges that could have sent him to prison for many decades.</p>
<p>I feel obliged to comment since I responded to the original news of his arrest with a somewhat sardonic post called &#8220;<a href="/blog/2011/07/19/when-ethicists-steal/">When Ethicists Steal</a>.&#8221; (Swartz was a Fellow at the Harvard University Ethics Center and the title referred to my long-held suspicion that self-styled academic &#8220;ethicists&#8221; just come up with rationalizations for their gut feelings and present them as scientific results, far superior to the ethical opinions of mere mortals.)</p>
<p>Swartz downloaded a vast number of academic articles from the JSTOR database. He apparently believed that they should be freely available to the public. Who knows? Maybe he was right, given that the public probably paid for the research with their tax dollars.</p>
<p>However anyone with any involvement with computers should understand that it is not OK to enter a network wiring closet without permission in order to make an unauthorized connection to the network. Surely this would justify some sort of criminal penalty.</p>
<p>On the other hand what he did was in no way comparable to murder. It was more on the level of entering an empty house though an unlocked door and taking a sandwich from the refrigerator. Except that nobody was deprived of a sandwich. (JSTOR, the aggrieved party, didn&#8217;t lose any money and didn&#8217;t want to press charges.)</p>
<p>So the loud outcry that the federal prosecutor was abusing his power by threatening to send Swartz to prison until he was an old man is not without merit. We have lost a bright and promising young man whose actions were surely misguided but not evil.</p>
<p>On the other hand we are not dealing with a rogue prosecutor here. This is what prosecutors do every day, though usually not to people with so many friends in the media. They routinely threaten to send people to prison for the rest of their lives in order to pressure them to plead guilty to reduced charges&#8211;even if they are innocent. That&#8217;s the kind of justice system we have and presumably that&#8217;s the kind of justice system the voters want, otherwise they would change it.</p>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2013/01/15/aaron-swartzs-suicide/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Megan McArdle on the Newtown Killings</title>
		<link>http://bugfox.net/blog/2012/12/18/megan-mcardle-on-the-newtown-killings/</link>
		<comments>http://bugfox.net/blog/2012/12/18/megan-mcardle-on-the-newtown-killings/#comments</comments>
		<pubDate>Tue, 18 Dec 2012 04:06:40 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Politics]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=327</guid>
		<description><![CDATA[I usually look to Megan McArdle for sensible well-informed financial commentary. She&#8217;s willing to tell people things that they don&#8217;t want to hear&#8211;a valuable trait in a financial writer. Now she has something to say that probably none of us &#8230; <a href="http://bugfox.net/blog/2012/12/18/megan-mcardle-on-the-newtown-killings/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<p>I usually look to <a href="http://www.thedailybeast.com/contributors/megan-mcardle.html">Megan McArdle</a> for sensible well-informed financial commentary. She&#8217;s willing to tell people things that they don&#8217;t want to hear&#8211;a valuable trait in a financial writer.</p>
<p>Now she has something to say that probably none of us want to hear: <a href="http://www.thedailybeast.com/articles/2012/12/17/there-s-little-we-can-do-to-prevent-another-massacre.html">There&#8217;s Little We Can Do to Prevent Another Massacre</a>. Unfortunately I suspect that she is right.</p>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2012/12/18/megan-mcardle-on-the-newtown-killings/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>More thoughts on Orca</title>
		<link>http://bugfox.net/blog/2012/11/11/more-thoughts-on-orca/</link>
		<comments>http://bugfox.net/blog/2012/11/11/more-thoughts-on-orca/#comments</comments>
		<pubDate>Mon, 12 Nov 2012 02:30:38 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Politics]]></category>
		<category><![CDATA[Software Development]]></category>
		<category><![CDATA[orca]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=319</guid>
		<description><![CDATA[Everyone seems to be jumping on the story of the Romney campaign&#8217;s &#8220;Orca&#8221; debacle. But it seems to me that this is not really a new story. It&#8217;s a story that&#8217;s been repeated over and over again thousands of times, &#8230; <a href="http://bugfox.net/blog/2012/11/11/more-thoughts-on-orca/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<p>Everyone seems to be jumping on the story of the Romney campaign&#8217;s <a href="http://bugfox.net/blog/2012/11/09/the-romney-campaigns-great-it-failure/">&#8220;Orca&#8221; debacle</a>. But it seems to me that this is not really a new story. It&#8217;s a story that&#8217;s been repeated over and over again thousands of times, in large companies and small, not to mention government agencies.</p>
<p>Tell me that you haven&#8217;t heard this one before:</p>
<ul>
<li>To begin with, you have a CEO who is a great visionary. (Everyone tells him he is, so he must be.) He doesn&#8217;t know much about Information Technology, but that&#8217;s OK&#8211;you can hire people to handle that.</li>
<li>The CEO is approached by an IT consultant who proposes a great new system, something that has never been done before, which will run rings around the competition.</li>
<li>The consultant has never actually developed a system of comparable complexity but the CEO is impressed with his vision. He tells his people to give the consultant everything he needs.</li>
<li>Because of the great strategic importance of the project the team accepts an extremely aggressive development schedule. It just has to be ready by the drop-dead date. To make it work the team will have to put in lots of overtime and not waste too much time on things like design reviews and extensive testing.</li>
<li>The consultant creates an elaborate marketing presentation to sell the project to the organization (and maybe to outsiders as well.)</li>
<li>To simplify the transition they decide on a &#8220;Big Bang&#8221; implementation. On the deadline date the old system will be irreversibly shut down and the new system will go online.</li>
<li>Users are given &#8220;training&#8221; that is basically a rehash of the marketing presentation. They can&#8217;t practice with the new system because it isn&#8217;t ready yet.</li>
<li>Result: <strike>Profit!</strike> humiliating failure.</li>
</ul>
<p><span id="more-319"></span><br />
Even this doesn&#8217;t necessarily get to the heart of the problem. I&#8217;ve seen projects fail even though they came in on time and under budget with all the required features, just because the original specification didn&#8217;t match what the organization really needed. You need to understand the problem before you come up with a solution.</p>
<p>Suppose Orca had worked perfectly as designed. Poll watchers would have used their smart phones to submit real-time reports to the giant computer in Romney&#8217;s Orbital HQ. The computer would have analyzed the data and issued real-time orders to field workers via their cell phones.</p>
<p>The most likely result would have been that Romney would known a few hours earlier that he needed to write a concession speech. (As it was, with Orca flopping helplessly on the beach, his team was reduced to watching the TV news broadcasts and found out the results at the same time the rest of us did.)</p>
<p>Any experienced campaign manager should know that you need to have your resources in place <em>before</em> Election Day. Any scheme to dynamically shift resources around while the voting is taking place is likely to have very limited effect.</p>
<p>So the correct way to manage this particular project would be not to do it at all. Instead it would have been better to spend those millions on opening more field offices and providing better training for volunteers.</p>
<p>That would probably not have been enough to change the outcome of the election. Nate Silver&#8217;s <a href="http://fivethirtyeight.blogs.nytimes.com/2012/11/08/as-nation-and-parties-change-republicans-are-at-an-electoral-college-disadvantage/">final analysis of the results</a> makes it clear that the situation was beyond the ability of any get-out-the-vote drive to salvage. However they should have at least been able to flip Florida which would have made the final result less embarrassing.</p>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2012/11/11/more-thoughts-on-orca/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The Romney campaign&#8217;s great IT failure</title>
		<link>http://bugfox.net/blog/2012/11/09/the-romney-campaigns-great-it-failure/</link>
		<comments>http://bugfox.net/blog/2012/11/09/the-romney-campaigns-great-it-failure/#comments</comments>
		<pubDate>Fri, 09 Nov 2012 22:33:03 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Politics]]></category>
		<category><![CDATA[Software Development]]></category>
		<category><![CDATA[orca]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=316</guid>
		<description><![CDATA[Ars Technica has a great analysis of &#8220;Team Romney&#8217;s whale of an IT meltdown.&#8221; Regardless of your political views, if you are involved in any large IT project this is worth reading. &#8220;Orca&#8221; was the campaign&#8217;s massively-hyped centralized computer system &#8230; <a href="http://bugfox.net/blog/2012/11/09/the-romney-campaigns-great-it-failure/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<p><a href="http://arstechnica.com/">Ars Technica</a> has a great analysis of <a href="http://arstechnica.com/information-technology/2012/11/inside-team-romneys-whale-of-an-it-meltdown/">&#8220;Team Romney&#8217;s whale of an IT meltdown.&#8221;</a> Regardless of your political views, if you are involved in any large IT project this is worth reading.</p>
<p>&#8220;Orca&#8221; was the campaign&#8217;s massively-hyped centralized computer system for managing the get-out-the-vote drive. It was supposed to track the process in real time and shift resources as necessary from areas where Romney was running far ahead to areas where more help was needed&#8211;thus running rings around Obama&#8217;s more old-fashioned system.</p>
<p>In fact the system was inadequately tested and users had essentially no training. On Election Day it collapsed, leaving the campaign managers flying blind. Given the margin of victory this probably wasn&#8217;t enough to change the results the election. (The &#8220;ground game&#8221; is supposed to be good for a point or so.) Still, it certainly didn&#8217;t help.</p>
<blockquote><p>
&#8220;The end result,&#8221; Ekdahl wrote, &#8220;was that 30,000+ of the most active and fired-up volunteers were wandering around confused and frustrated when they could have been doing anything else to help. The bitter irony of this entire endeavor was that a supposedly small government candidate gutted the local structure of [get out the vote] efforts in favor of a centralized, faceless organization in a far off place (in this case, their Boston headquarters). Wrap your head around that.&#8221;
</p></blockquote>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2012/11/09/the-romney-campaigns-great-it-failure/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>What to watch for on Election Night</title>
		<link>http://bugfox.net/blog/2012/11/04/what-to-watch-for-on-election-night/</link>
		<comments>http://bugfox.net/blog/2012/11/04/what-to-watch-for-on-election-night/#comments</comments>
		<pubDate>Mon, 05 Nov 2012 03:04:21 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Politics]]></category>
		<category><![CDATA[Elections]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=297</guid>
		<description><![CDATA[As Election Day approaches it looks like a pretty tight race. The polls tend to favor President Obama but his lead is usually within the margin of error. A lot will probably depend on which side does a better job &#8230; <a href="http://bugfox.net/blog/2012/11/04/what-to-watch-for-on-election-night/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<p>As Election Day approaches it looks like a pretty tight race. The polls tend to favor President Obama but his lead is usually within the margin of error. A lot will probably depend on which side does a better job of turning out the vote. In addition such a close race offers the chance of some rather ugly outcomes, including the following:</p>
<ul>
<li>A slow count or recount in which we won&#8217;t know the outcome for several weeks. (Think 2000).</li>
<li>An &#8220;Electoral College inversion&#8221; in which one side wins the popular vote and the other side wins the Electoral College. (Once again, this happened in 2000.) This is bound to cause resentment on the losing side.</li>
<li>A 269-269 tie in the Electoral College. In that case the House of Representatives chooses the President and the Senate chooses the Vice President. The House is pretty certain to remain under Republican control while the Senate is pretty certain to remain under Democratic control, so we will end up with President Romney and Vice President Biden. That will be embarrassing to say the least.</li>
</ul>
<p>On the other hand it is still barely possible that we will have a clear winner soon after to polls close on the East Coast.</p>
<p>In any case, most states are not competitive so the winner in the Electoral College will be determined in a small number of swing states where the race in considered close. If you keep an eye on the swing states you will know the outcome as soon as anybody does.<br />
<span id="more-297"></span></p>
<h3>States where the polls close at 7 PM ET</h3>
<p><strong>Florida</strong>. Romney seems to be holding on to a comfortable lead, which is good for him because without Florida he&#8217;s toast. There is no plausible winning combination for him without the state&#8217;s 29 electoral votes.</p>
<p><strong>Virgina</strong>. This state looks very close and potentially vital. Whoever gets VA&#8217;s 13 electoral votes will have a very big advantage.</p>
<h3>States where the polls close at 7:30 PM ET</h3>
<p><strong>North Carolina</strong>. Probably belongs to Romney but Obama has made a significant effort. Still, if Obama takes NC it probably means that the polls are wrong and he&#8217;s going to win easily.</p>
<p><strong>Ohio</strong> is where the election is most likely to be decided. To win without Ohio&#8217;s 18 electoral votes, Romney would probably have to sweep all the tossup states (CO-IA-WI-VA-NH) while Obama would probably need 4 of them. Obama seems to have a small lead here, but if it comes down to a close race here we may be waiting a long time to know the winner.</p>
<p>Over a quarter of a million people have already voted by absentee ballot and these will not be counted until Nov. 14. (A ballot mailed on Election Day is allowed up to a week to arrive.) Both sides have hordes of lawyers and spin doctors ready to descend on the state if the count is close enough to justify a manual recount.</p>
<h3>States where the polls close at 8 PM ET</h3>
<p><strong>Michigan</strong>. Obama is favored to win the state&#8217;s 16 electoral votes, at least partly thanks to the auto bailout.</p>
<p><strong>New Hampshire</strong>. First, forget Dixville Notch. It doesn&#8217;t mean anything. Most scenarios leading to an Electoral College tie require Romney to take NH. Otherwise the state&#8217;s 4 electoral votes probably won&#8217;t be decisive.</p>
<p><strong>Pennsylvania</strong>. Obama is favored to win here but the Romney campaign has made a significant effort. It is just possible that the aftereffects of Hurricane Sandy might depress turnout enough to give Romney a boost. If Romney were to get PA&#8217;s 20 electoral votes that would turn the race around, making it difficult for Obama to come up with a winning combination.</p>
<h3>States where the polls close at 7 PM Mountain Time or 8 PM Central</h3>
<p><strong>Colorado</strong>.  a close race with 9 electoral votes.</p>
<p><strong>Wisconsin</strong>. Another close race and 10 electoral votes. Assuming that we know who won Ohio at this point, either CO or WI would be in a good position to wrap things up.</p>
<h3>States where the polls close at 7 PM Pacific or 9 PM Central</h3>
<p><strong>Iowa</strong>. If we&#8217;re still paying attention at this point the race will be very close indeed. A toss-up state with 6 electoral votes.</p>
<p><strong>Nevada</strong>. 6 electoral votes which will probably go to Obama (plenty of Mormons but even more Hispanics.)</p>
<h3>Sources</h3>
<p>I have relied heavily on 2 sources: Larry Sabato&#8217;s <a href="http://www.centerforpolitics.org/crystalball/">Crystal Ball</a> site and Nate Silver&#8217;s <a href="http://fivethirtyeight.blogs.nytimes.com/">FiveThirtyEight</a>. </p>
<p>Larry Sabato uses a fairly straight-forward average of polls, combined with his expertise as a long-time observer of U.S. politics.</p>
<p>Nate Silver uses a more complex and controversial mathematical model which combines polling and economic data. Polls are weighted to compensate for &#8220;house effects&#8221; (some polling firms consistently seem to favor Republican or Democratic candidates) and for differences in methodology (polls that include cell phones get more weight than those that call only land-lines.) He then runs tens of thousands of simulations every day, slightly varying the assumptions for each iteration. This allows him to assign ridiculously precise probabilities to various outcomes.</p>
<p>This approach allowed him to correctly predict the winner in 49 out of 50 states in 2008, but as they say, past performance is no guarantee of future results.  For what it is worth, these are some of the probabilities calculated by his model as of Sunday Nov. 4:</p>
<p>Obama wins the Electoral College: 85.5%<br />
Obama wins the popular vote: <strike>50.5%</strike> 80.1%<br />
Romney wins the popular vote but loses the Electoral College: 7.3%<br />
Obama wins the popular vote but loses the Electoral College: 0.7%<br />
Electoral College tie: 0.2%<br />
Recount (one or more decisive states within 0.5 percentage points): 8.3%</p>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2012/11/04/what-to-watch-for-on-election-night/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>More aLinks Fixes</title>
		<link>http://bugfox.net/blog/2012/10/31/more-alinks-fixes/</link>
		<comments>http://bugfox.net/blog/2012/10/31/more-alinks-fixes/#comments</comments>
		<pubDate>Wed, 31 Oct 2012 23:54:22 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Site Administration]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[aLinks]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=294</guid>
		<description><![CDATA[I fixed a problem with WordPress 3.4.2 I added an option to enable/disable aLinks&#8217;s internal cache. In fact I left it off by default. Unless your database is on a separate server, caching things in your local file system is &#8230; <a href="http://bugfox.net/blog/2012/10/31/more-alinks-fixes/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<ul>
<li>I fixed a problem with WordPress 3.4.2</li>
<li>I added an option to enable/disable aLinks&#8217;s internal cache. In fact I left it off by default. Unless your database is on a separate server, caching things in your local file system is unlikely to improve performance much and may actually slow you down.</li>
</ul>
<p>To get the updated version, go back to my <a href="/blog/2008/11/14/alinks-20-bug-fixes/">original aLinks post</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2012/10/31/more-alinks-fixes/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Presidential Candidate Phone Apps Threaten Privacy</title>
		<link>http://bugfox.net/blog/2012/08/20/presidential-candidate-phone-apps-threaten-privacy/</link>
		<comments>http://bugfox.net/blog/2012/08/20/presidential-candidate-phone-apps-threaten-privacy/#comments</comments>
		<pubDate>Mon, 20 Aug 2012 16:47:11 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Politics]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Phone Apps]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=286</guid>
		<description><![CDATA[A word to the wise: before you download that smartphone app for your favorite candidate you should read The Register: Don&#8217;t download that app: US presidential candidates will STALK you with it.]]></description>
				<content:encoded><![CDATA[<p>A word to the wise: before you download that smartphone app for your favorite candidate you should read</p>
<p>The Register: <a href="http://www.theregister.co.uk/2012/08/20/us_pres_campaign_mobile_app_privacy/">Don&#8217;t download that app: US presidential candidates will STALK you with it</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2012/08/20/presidential-candidate-phone-apps-threaten-privacy/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Security Fail Award of the Month</title>
		<link>http://bugfox.net/blog/2012/06/09/security-fail-award-of-the-month/</link>
		<comments>http://bugfox.net/blog/2012/06/09/security-fail-award-of-the-month/#comments</comments>
		<pubDate>Sun, 10 Jun 2012 00:36:35 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Passwords]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=281</guid>
		<description><![CDATA[There are endless competitors for this, but surely some sort of major stupidity award is due to the Dollar Rent-a-Car password system as described by Geoff Kuenning: But the winner of the incompetent-design sweepstakes has to be Dollar Rent-a-Car, who &#8230; <a href="http://bugfox.net/blog/2012/06/09/security-fail-award-of-the-month/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<p>There are endless competitors for this, but surely some sort of major stupidity award is due to the Dollar Rent-a-Car password system as described by Geoff Kuenning:</p>
<blockquote><p>
But the winner of the incompetent-design sweepstakes has to be Dollar Rent-a-Car, who asked me for the last four digits of my driver&#8217;s license number and my birth date for verification (but not my old password).  Then, when I clicked &#8220;Change Password&#8221;, it took me to a customer-support e-mail form!  Apparently I was expected to type a message asking a human to change my password for me.  I declined; it seems monumentally stupid for them to let one of their employees to have access to thousands of customer passwords.  Instead, I used the form to ask them to let me know  when they deploy a secure system.</p>
<div class="small"><a href="http://catless.ncl.ac.uk/Risks/26.89.html#subj16">Observations on changing passwords</a></div>
</blockquote>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2012/06/09/security-fail-award-of-the-month/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Time Zones and Daylight Saving Time in Java</title>
		<link>http://bugfox.net/blog/2012/05/04/time-zones-and-daylight-saving-time-in-java/</link>
		<comments>http://bugfox.net/blog/2012/05/04/time-zones-and-daylight-saving-time-in-java/#comments</comments>
		<pubDate>Fri, 04 May 2012 20:57:24 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Java]]></category>
		<category><![CDATA[Software Development]]></category>
		<category><![CDATA[DST]]></category>
		<category><![CDATA[TimeZone]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=262</guid>
		<description><![CDATA[You might think this would be simple but I actually spent a fair amount of time last week tracking down some confusing bugs. The problem is that the official documentation is pretty sparse and if you Google for support you &#8230; <a href="http://bugfox.net/blog/2012/05/04/time-zones-and-daylight-saving-time-in-java/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<p>You might think this would be simple but I actually spent a fair amount of time last week tracking down some confusing bugs. The problem is that the official documentation is pretty sparse and if you Google for support you will find many answers that are confused or flat-out wrong. Hopefully this will provide the straight dope.</p>
<p>The key Java classes are as follows:<br />
<span id="more-262"></span></p>
<h3>java.util.TimeZone</h3>
<p>This is an abstract class that contains the definition of a time zone, including that zone’s rules for Daylight Saving Time (or what Europeans refer to as &#8220;Summer Time.&#8221;) Any code that needs to explicitly deal with time zones should use a TimeZone object.</p>
<p>The best way to get a TimeZone is to call the static method TimeZone.getTimeZone() and pass it the standard &#8220;Olson name&#8221; such as &#8220;America/New_York&#8221; or &#8220;Pacific/Honolulu&#8221;.</p>
<p><a href="http://en.wikipedia.org/wiki/List_of_tz_database_time_zones">This link</a> lists all the standard time zone names.</p>
<p>You can call TimeZone.getTimeZone(&#8220;GMT&#8221;) or TimeZone.getTimeZone(&#8220;GMT-5&#8243;). None of these GMT-based TimeZone objects support Daylight Saving Time. (Note: &#8220;GMT&#8221; and &#8220;UTC&#8221; mean practically the same thing. GMT is defined in terms of astronomical observations and UTC is used for setting atomic clocks. For most practical purposes they can be treated as identical.)</p>
<p>You can also use common abbreviations e.g. TimeZone.getTimeZone(&#8220;EST&#8221;) instead of TimeZone.getTimeZone(&#8220;America/New_York&#8221;). This is strongly discouraged. Depending on circumstances you might get the wrong Daylight Saving Time behavior or even the totally wrong time zone, since the same 3-letter abbreviations are used around the world for different time zones.</p>
<p>When displaying a time zone to the user you should probably call TimeZone.getDisplayName(). Depending on the parameters you pass this will return a user-friendly value like &#8220;Eastern Standard Time&#8221;, &#8220;EST&#8221;, &#8220;Eastern Daylight Time&#8221; or &#8220;EDT&#8221;.</p>
<h3>java.util.Calendar</h3>
<p>This is an abstract class which serves as a wrapper around two independent values:</p>
<ul>
<li>A time, stored as the number of milliseconds since January 1, 1970 00:000:00 GMT.</li>
<li>A TimeZone object which indicates how the time should be displayed.</li>
</ul>
<p>(This is an oversimplification. The actual implementation is a a bit more complicated, but this is close enough as long as you are not actually digging into the source code.)</p>
<p>Note that the time offset is always supposed to be in GMT. If you see code samples that make a different assumption (and there are many out there on the web) ignore them.</p>
<p>Time zone conversions are simple: if you call setTimeZone() on a Calendar object you get the exact same time but displayed in the new time zone.</p>
<p>A more complex problem occurs when you get a time string from a user in a different time zone. If you parse the string &#8220;05-01-2012 08:35 AM&#8221; then the parser will generally give you a Calendar object for 8:35 AM in the computer’s default time zone. </p>
<p>If this is wrong then you will need to change the time offset to convert it to the correct time. If the time string was supposed to be in GMT then you can use the folowing code to convert it.<br />
<code><br />
public static Calendar convertToGmt(Calendar c) {<br />
&nbsp;&nbsp;&nbsp;&nbsp;java.util.Date date = c.getTime();<br />
&nbsp;&nbsp;&nbsp;&nbsp;TimeZone tz = c.getTimeZone();<br />
&nbsp;&nbsp;&nbsp;&nbsp;long timeInMilliseconds = date.getTime();<br />
&nbsp;&nbsp;&nbsp;&nbsp;int offsetFromUTC = tz.getOffset(timeInMilliseconds);<br />
&nbsp;&nbsp;&nbsp;&nbsp;Calendar gmtCal = new GregorianCalendar(TimeZone.getTimeZone("GMT"));<br />
&nbsp;&nbsp;&nbsp;&nbsp;gmtCal.setTime(date);<br />
&nbsp;&nbsp;&nbsp;&nbsp;gmtCal.add(Calendar.MILLISECOND, offsetFromUTC);<br />
&nbsp;&nbsp;&nbsp;&nbsp;return gmtCal;<br />
}<br />
</code></p>
<p>If it was supposed to be in a different time zone then you can call TimeZone.getOffset() for both time zones. The difference between the two values will give you the number of milliseconds that you need to add to do the conversion.</p>
<p>This code provides an alternate way to convert between arbitrary time zones.<br />
<code><br />
public static Calendar convertToNewTimeZone(Calendar calendar, TimeZone timezone) {<br />
&nbsp;&nbsp;&nbsp;&nbsp;Calendar newCal = new GregorianCalendar(timezone);<br />
&nbsp;&nbsp;&nbsp;&nbsp;newCal.setLenient(false);<br />
&nbsp;&nbsp;&nbsp;&nbsp;boolean am = newCal.get(Calendar.AM_PM) == Calendar.AM;<br />
&nbsp;&nbsp;&nbsp;&nbsp;newCal.set(Calendar.YEAR, calendar.get(Calendar.YEAR));<br />
&nbsp;&nbsp;&nbsp;&nbsp;newCal.set(Calendar.MONTH, calendar.get(Calendar.MONTH));<br />
&nbsp;&nbsp;&nbsp;&nbsp;newCal.set(Calendar.DATE, calendar.get(Calendar.DATE));<br />
&nbsp;&nbsp;&nbsp;&nbsp;newCal.set(Calendar.HOUR, calendar.get(Calendar.HOUR));<br />
&nbsp;&nbsp;&nbsp;&nbsp;newCal.set(Calendar.MINUTE, calendar.get(Calendar.MINUTE));<br />
&nbsp;&nbsp;&nbsp;&nbsp;newCal.set(Calendar.SECOND, calendar.get(Calendar.SECOND));<br />
&nbsp;&nbsp;&nbsp;&nbsp;newCal.set(Calendar.MILLISECOND, calendar.get(Calendar.MILLISECOND));<br />
&nbsp;&nbsp;&nbsp;&nbsp;boolean ampm = calendar.get(Calendar.AM_PM) == Calendar.PM;<br />
&nbsp;&nbsp;&nbsp;&nbsp;if (am &#038;&#038; ampm) { // cal = 0 but we want 1<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;newCal.roll(Calendar.AM_PM, 1);<br />
&nbsp;&nbsp;&nbsp;&nbsp;} else if (!am &#038;&#038; !ampm) { //cal = 1 but we want 0<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;newCal.roll(Calendar.AM_PM, -1);<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;return newCal;<br />
}<br />
</code></p>
<p>Once again, this gives you a Calendar object with the same wall-clock time in a different time zone, as opposed to getting the same actual time in a different time zone.</p>
<h3>ISO 8601</h3>
<p>To avoid such problems when sending dates and times between different time zones you can use the <a href="http://www.w3.org/TR/xmlschema-2/#isoformats">ISO 8601 formats</a> commonly used in XML documents. These formats allow an optional trailing time zone indicator e.g.</p>
<p>2012-05-01T08:35:01.123Z<br />
2012-05-01T08:35:01.123-05:00</p>
<p>A &#8220;Z&#8221; code indicates that the time is GMT. A &#8220;-05:00&#8243; indicates a time zone that is 5 hours behind GMT. In the U.S. this could mean either &#8220;Eastern Standard Time&#8221; or &#8220;Central Daylight Time&#8221;.</p>
<p>Most standard XML libraries can handle these formats.</p>
<p>In the &#8220;-05:00&#8243; example above the parser will return a Calendar subclass whose TimeZone object is &#8220;GMT-5&#8243;, not &#8220;America/New_York&#8221; or &#8220;America/Chicago&#8221;. You have the correct time but you don’t really know which official time zone it is.</p>
<p>The time zone indicator is optional. If the document contains</p>
<p>2012-05-01T08:35:01.123</p>
<p>that will be interpreted as being in the receiving computer’s default time zone.</p>
<h3>java.util.Date</h3>
<p>This is a wrapper around a count of milliseconds since midnight January 1, 1970. There is no associated time zone.</p>
<p>According to the documentation the millisecond count should always be in GMT, but this is often ignored. You will find many code samples on the web that attempt to deal with time zones by adding or subtracting hours. This is NOT recommended.</p>
<p>If you need to deal with time zones you should use a Calendar object.</p>
<p>The Date class has methods like getHours() and getMinutes() which are all deprecated. If you use them they will return the value in the computer’s default time zone. Date.toString() will also display in the computer’s default time zone.</p>
<h3>java.sql.Date</h3>
<p>This is intended to represent a SQL DATE field. The Java implementation is a simple wrapper around java.util.Date which makes sure that the time part is always set to midnight in your computer’s default time zone.</p>
<p>What is actually stored in the database depends on the implementation but can be assumed to consist of a year, month and day in some format.</p>
<h3>java.sql.Time</h3>
<p>This is intended to represent a SQL TIME field. The Java implementation is a thin wrapper around java.util.Date which makes sure that the date part is always set to January 1, 1970.</p>
<p>What is actually stored in the database depends on the implementation but can be assumed to consist of either an offset from midnight or a combination of hour, minutes and seconds in some format.</p>
<p>There is no support for time zones built in. If time zones are important the application will have to keep track of them separately.</p>
<h3>java.sql.TimeStamp</h3>
<p>This intended to represent a SQL TIMESTAMP field. The Java implementation is similar to java.util.Date in that it contains an offset from a fixed starting time, but it is much higher precision, supporting fractions of a microsecond instead of milliseconds.</p>
<p>What is actually stored in the database depends on the implementation but is usually some sort of offset from a starting date.</p>
<p>TimeStamp is similar to java.util.Date in that</p>
<ul>
<li>It does not contain a TimeZone.</li>
<li>The internal offset is supposed to be in GMT and bad things can happen if it is not.</li>
<li>It is typically displayed in the computer’s default time zone.</li>
</ul>
<p>Usually you create a TimeStamp from a java.util.Date object. (If you are starting with a Calendar object just call getTime() on it.) So basically you are writing out the millisecond offset in the GMT time zone. If you started with a Calendar its original time zone is lost.</p>
<p>When you read a TimeStamp from the database you are getting back the time with no time zone information. Calling getDate() will return it as a java.util.Date object. If you want it in a time zone other than your computer&#8217;s default time zone you can do something like this:<br />
<code><br />
Calendar cal = new GregorianCalendar(desiredTimeZone);<br />
cal.setTime(ts.getDate);<br />
</code></p>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2012/05/04/time-zones-and-daylight-saving-time-in-java/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Apple will decline after Steve Jobs…</title>
		<link>http://bugfox.net/blog/2011/08/27/apple-will-decline-after-steve-jobs%e2%80%a6/</link>
		<comments>http://bugfox.net/blog/2011/08/27/apple-will-decline-after-steve-jobs%e2%80%a6/#comments</comments>
		<pubDate>Sat, 27 Aug 2011 22:29:43 +0000</pubDate>
		<dc:creator>Jonathan Tappan</dc:creator>
				<category><![CDATA[Economics]]></category>
		<category><![CDATA[Humor]]></category>
		<category><![CDATA[Apple]]></category>

		<guid isPermaLink="false">http://bugfox.net/blog/?p=256</guid>
		<description><![CDATA[A lot of the value in Apple has come from the ineptitude of other companies and the passion and willingness of early adopters to spend huge money. There are inherent limits to growth fueled by those two factors. For example, &#8230; <a href="http://bugfox.net/blog/2011/08/27/apple-will-decline-after-steve-jobs%e2%80%a6/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
				<content:encoded><![CDATA[<blockquote><p>A lot of the value in Apple has come from the ineptitude of other companies and the passion and willingness of early adopters to spend huge money. There are inherent limits to growth fueled by those two factors. For example, the early adopters with the greatest willingness to pay for smartphones (and associated service) have already purchased smartphones. Now the big market is from people in emerging countries, such as China, and the average consumer in developed countries. The record companies were so poorly managed that they gave up 30 percent of their digital music revenue because they were too lazy to run their own Web site. What other industry is going to give Apple 30 percent of its revenue in exchange for Apple running a server?<br />
<cite><a href="http://blogs.law.harvard.edu/philg/2011/08/27/apple-will-decline-after-steve-jobs/">Philip Greenspun&#8211;Apple will decline after Steve Jobs…</a></cite>
</p></blockquote>
]]></content:encoded>
			<wfw:commentRss>http://bugfox.net/blog/2011/08/27/apple-will-decline-after-steve-jobs%e2%80%a6/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
