insight

A geeky rant that non-geeks really should read

Nice to see that this is finally getting some press...

Tesco web security 'flaw' probed by UK data watchdog, BBC News
Tesco face enquiry over 'lousy' website security, Telegraph

So what's happened? Basically, Troy Hunt, a software architect, discovered a flaw or two in Tesco Online's security a few weeks back. Geeks can read the whole thing here but for the non-technical, if you use Tesco's website your password is being stored on their server in a decryptable way. This is actually provable - go to any website you have to log into, and use the password recovery function. If the function resets your password to something random or allows you to change it to something you can remember, that's good. If it emails you your password, then that's a broken system. Tesco does the latter. If a website stores passwords on a server (which Tesco must do, in order to email it to you) then all it takes is one hacker to get in and all the passwords are compromised. The story has been picked up by numerous IT professionals - including the CTO of Sophos, Graham Cluley - all of whom criticise Tesco's security.

So all Tesco have to do is start encrypting their passwords server-side, and this whole problem will go away. Instead they came out with this tweet:"Passwords are stored in a secure way. They’re only copied into plain text when pasted automatically into a password reminder mail."

This might calm the layman but everyone with even the basic knowledge of computer security will read that sentence and scream at the insanity of it. It's physically impossible to copy a password to plain text if it's actually stored securely. Secure password storage means one-way irreversable encryption (known as 'hashing').

If that didn't annoy me enough, this tweet was the nail in the coffin..."We know how important internet security is to customers and the measures we have are robust." Which is basically the Twitter equivalent of sticking their fingers in their ears and going "la la la I'm not listening."

OK, so Tesco hasn't been hacked. But that doesn't matter - the world now knows that their security is crap, so 10 to 1 there are already malicious hackers targeting them. And when they get in, because Tesco don't hash their passwords, your security as a customer is at stake, and Tesco will only have themselves to blame for sticking their heads in the sand. Letting a massive security flaw like this lie is like not locking your front door when you go out. Sure, you may not get robbed for years but the one day that the burglars do come, they'll get away with everything with very little effort.

There is no such thing as too much security... and no amount of security is ever enough. Especially when you're trusted with the details of thousands of innocent customers.

Achievement and Appreciation

It has come to my attention that we, as a society, place far too much emphasis on sport. We worship footballers like gods and have many national and international competitions in which athletes and those of peak physical fitness can shine, and be doted on by an adoring public.

This first came to my attention during Danny Boyle's opening ceremony for the 2012 Olympic Games in London. Boyle did, in my opinion, a wonderful job producing a spectacle that incorporated pretty much everything that's good about Britain - while leaving it to the closing ceremony to showcase everything that's bad about it! But there was one thing that stuck in my mind more than anything else, and that's the fact that a grinning David Beckham riding a speedboat down the Thames got instant recognition and applause from the crowd, yet Tim Berners-Lee got a polite and slightly subdued clap only after an announcer told everyone who he is. For those who still don't know, Berners-Lee invented the World Wide Web, and Beckham gets paid to kick a ball around a field.

I believe this is a problem that stems from childhood. I was one of the kids at school who was useless at PE, but I excelled in subjects that actually matter, such as maths and science. I'm not for a minute suggesting that it's not essential to get some exercise, but it always annoyed me that one day every year we had to be pulled out of lessons to go and watch the physically able kids show off - we called it "sports day". I certainly don't recall a "maths day" in which academically bright children were cheered and applauded for doing what they're good at. I may even go as far as to suggest that it's possibly a root cause of bullying. We're encouraged from a very young age to worship the physically fit, but not the brainy kids. Who are the kids who most regularly get picked on at school? The geeks and nerds.

I'm not telling anyone off. If you feel that someone who can score a goal from the other end of the pitch or run 100m in under 8 seconds deserves praise and adoration, feel free to give it to them. Heck, if I was feeling particularly cold and ruthless, I might even suggest that we genuinely need to show sporty people all this love, because it may be the only thing preventing them from realising that their achievements don't actually matter in the grand scheme of things, and I personally can't imagine anything worse than having no purpose. But as we show love to these physical powerhouses, let's not forget those who actually get things done. Scientists, doctors, nurses, teachers, builders, inventors - heck, toilet cleaners and street sweepers do more for the good of humanity than most footballers, and get a fraction of the appreciation, not to mention paycheck. So let's make our culture better by celebrating and appreciating everyone, not just people who are good at sport.

UPDATE 2014-07-29: This week's episode of University Challenge was moved from its primetime slot to teatime, because the commonwealth games pushed everything on BBC1 to BBC2. If that doesn't prove my point I don't know what does.

Blaming the Victim

There's a lot of talk at the minute, regarding the recent theft of millions of customers' personal details from Sony's online services, Playstation Network (PSN) and Qriocity. Obviously it's yet another plus point for us paranoid technophobes who don't use the same password for anything, have a separate email address for every service we use and never give out credit card numbers unless we're 100% sure we can trust the security being used, but me saying "told you so" is hardly helpful, and certainly doesn't change the fact that 77 million people are now living in the knowledge that their name, address, phone number and possibly credit card number and password is currently in the hands of a malicious hacker.

But there is a moral dilemma... who to blame? I immediately began badmouthing Sony for this obvious lapse in security, but this morning a colleague of mine pointed out to me that you should never blame the victim; the fault lies with the hacker. This is a very good point, and one echoed by many, some even go so far as to suggest that blaming Sony for this hack is like blaming a shopkeeper for a burglary, or telling a rape victim she was asking for it. I would never blame a rape victim for being raped, nor would I blame a shopkeeper for being burgled. But let's say the shopkeeper were to go home for the night, trusting the locking up to his absent-minded apprentice. Then, let's say the apprentice gets drunk, staggers home leaving the door of the shop wide open, and insults a local gang on the way home before drunkenly daring them to burgle the shop. Would it then be OK to blame the burglary on the apprentice?

For those who don't know, this hack has a history. The hackers almost certainly got in by discovering some weakness in the protocol used to access the Playstation Network from a Playstation 3. This time last year, such a task would have been impossible, but, at the 27th Chaos Communication Congress meeting in Berlin in December 2010, a group of hackers known as fail0verflow presented their work [YouTube] in hacking the PS3. During this presentation, they pointed out that the PS3's security model is fundamentally broken because although Sony uses a pretty damn bullet-proof elliptic curve cryptography method to sign its code, rather than use a different random number each time, they use the same number, which effectively means that anyone with a basic understanding of maths can reverse engineer Sony's private key, effectively rendering the PS3's entire code-signing functionality completely useless. So who do we blame for this... fail0verflow for pointing out Sony's mistake, or Sony for making such a stupid, rookie mistake in the first place?

Soon after fail0verflow gave their presentation, George "geohot" Hotz, the hacker previously known for his work in breaking the security of the iPhone, used fail0verflow's methods to reverse-engineer the master private key of the Playstation 3. Anyone who has this number can write and run any code they damn well like and run it on any PS3 console in the world. It was a godsend to homebrew coders, and I know people who have done some really cool things with it, including one person who wrote some code to use an Xbox Kinect to control a PS3. But in blowing the PS3's security wide open in this way, it's very likely that geohot inadvertently allowed malicious hackers to write code that interfered with the Playstation Network, leading to the theft of 77 million peoples' personal details. So should we be blaming geohot for this mess? Many do.

For my part, we need to go back to fail0verflow's presentation in Berlin. Early in the presentation, the group make a very good point about the PS3's security. The PS3 remained unhacked for 4 years after its release. Many owners of the console wrongly assume that this means the PS3 is very secure, unlike the Wii which was hacked in under a week. But, as fail0verflow point out, when it first came out the PS3 didn't need to be hacked, because it ran OtherOS. This was a piece of software built into the console that effectively allowed homebrew coders to do almost what they wanted with it. This was a happy co-existance for over three years until Sony, for one reason or another, decided to kill OtherOS on existing consoles via a firmware update. At the time I argued that this was a bait-and-switch and that Sony should really be in court for breach of the Trade Descriptions Act... people bought the PS3 knowing they could use it for homebrew and now they've parted with cash they're being told they can't any more. I'm not a lawyer, but regardless, Sony pissed off thousands of hackers with this rather odd decision. This led to the hacking and subsequent discovery of the master private key. The PS3 didn't take four years to hack, it took four years for a hack to become necessary, and then less than a month to hack.

I'm not defending the yet-unnamed person or people who broke into PSN and stole all the customer details, they're clearly bad people. And no, I'd never blame the victim for a crime. But in this case, there are 77 million victims and Sony aren't one of them. Sony, instead, is the incompetant apprentice and a victim only to karma. Perhaps one day they'll learn that people in glass houses shouldn't throw stones... and people who suck at security shouldn't piss off hackers.

Charity Gigs

A lot of pubs, particularly chain pubs, have a habit of putting on charity events. These are generally fun days with live music, possibly guest beers, etc etc, and all in the name of some charity. It could be a local charity, a charity close to the hearts of the owners or punters of the pub, or just a charity that is supported by the pub chain. Afterwards you get the obligatory 'big cheque' photos in the local papers.

This week, some friends of mine who are in a band (who shall remain nameless so they're not associated with this overly critical blog post, but whose identities will be known to those who read this blog often) had one of their gigs cancelled by a pub at very short notice. The pub will also remain nameless, suffice to say it's part of a pub chain owned by Mitchells and Butlers, and located in the south of England. The reason for the gig not going ahead was due to an ultimatum given to the band by the pub: it was a charity do and they were expected to turn up and play for free, despite being previously booked on the understanding that they'd get paid. Of course, the band decided not to do the gig, as they have running costs and can't afford to simply gig for free whenever a pub decided to put on a charity gig, and it's more than a little cheeky of the pub to "move the goalposts" in this way anyway. Of course it's easy to assume the band are heartless bastards for not playing at a charity gig, and only in it for the money. But the whole thing made me think a bit more about the situation, and I can only conclude that charity gigs in general are a massive scam.

Charity gigs are usually run by pubs, and the pub is often open as usual. You can go in, buy drinks, listen to live music for free, and there are collection buckets around into which you can throw your loose change. The atmosphere is usually pretty good, and giving money to charity is generally a good thing. But there is one constant in the entire thing that never changes, charity or not - the pub. Think about it - on a normal gig or event night, the pub will pay a band, DJ or other entertainer to appear. The whole point of booking said events is to pull in punters and sell more beer and/or food. On a charity day the bands and entertainers don't get paid, they effectively 'donate' their time to the cause, but the pub don't actually donate anything. In fact, the pub have basically just conned a bunch of bands and entertainers to appear in their establishment, thus earning them extra bums on seats, without actually having to pay them. OK, so they've put a few charity buckets around the place and told one or two of their already-employed staff to run around hassling people for change, but the pub actually contribute nothing to the charity, financially or otherwise, yet reap the benefits of having live entertainment. The pub will usually even get free advertising in local papers in the weeks after the event, which is where the big cheque photo opportunities come in. The local paper will run a story that a nearby chain pub has raised [x] thousand pounds for charity, yet in actual fact they did bugger all, sold loads of beer and food on the back of a load of entertainers they didn't have to pay, and to cap it all off, they're now getting free advertising in the local paper.

So what am I saying? Basically, if you own a pub, run charity events. They're a fantastic way to make money while convincing gullible punters that you actually care about their poxy charity. If you're a band, please don't feel guilty about turning down charity gigs, you can't possibly be as immoral as the pub holding it. And if you're a punter and your favourite local band is playing a charity gig, please give generously. In fact, take all the money you would have spent on drinks and put it in the charity buckets instead. You'll be doing far more good than the pub are.

Dependencies

In my current employment my job is to manage the flow of large amounts of data for quite a well-known university. It sounds quite dull but it's actually really exciting because I don't just get to maintain data I get to write cool stuff that uses the data too. For example, every five minutes I get fed a list of all the PCs in the university and whether there's anyone using them, so while I was going through the process of making sure this data was being stored and managed correctly, I took a few hours to write a little web app for students which draws the uni's workstations on a map and tells them where their nearest available one is. I've had loads of positive feedback and the site gets hundreds of hits per day, which is why my job's so rewarding.

My predecessor and mentor had similar experiences - he used live information fed to the university from the council's transport department to produce a website which gives up-to-the-minute bus information, and because we re-publish the data in a sensible format, anyone who can program can write a website or smartphone app that does the same or similar things. Just recently the council changed their data provider and I've spent large amounts of the last month (and probably the coming month too) hacking the code on our server to ensure that no external apps break during this transition phase. OK, some downtime is unavoidable, but in a month's time if there are apps written six months ago that no longer work, I've done something wrong. This is really important to me, as I feel that by publishing this data and having people rely on it, we have a duty to those who trust our data. I really don't want to have to track down everyone who's using our data and tell them they need to re-write their code because I've changed the format, and I certainly don't expect any developers who've written apps to keep checking our site to make sure we haven't just changed the format without telling anyone.

But this is why it pisses me off when others don't do the same. I've had so many troubles writing Facebook apps that I just don't bother any more - if I need data from Facebook I screen-scrape it. You think the front-facing parts of Facebook change all the time, well you should try using the API. I've written so many things that worked for months and then simply broke without warning because Facebook decided to change something. The most recent example is their sudden removal of user RSS feeds, which I've been using for years, as I tend to use Google Reader rather than logging into Facebook. I write quite a lot of Twitter-related scripts too, and I noticed while checking something in their docs today that they indent to deprecate version 1 of their API "within the coming months" in favour of version 1.1. It's not a simple transition either, things that before required no authentication now require OAuth, which is a real pig for a programmer because things I used to be able to do in one line of code (eg getting the public tweets of a particular user) now requires me to implement an entire authentication pipeline, which will probably take me hours.

The biggest bane of my life in recent years was in my previous job as a computer science researcher. I worked on a pervasive device for sufferers of memory loss, and a part of its functionality - recognising the faces of friends and colleagues - was provided by an external service known as Face.com. We used the service for about a year before the company was bought by Facebook, and as soon as this takeover happened they shut down their API, effectively making our system useless overnight. All the training data we'd provided to Face.com was lost, and even if we had found another service, we would have had to start again from scratch. Cheers, guys.

Google seem to be doing the right thing - I've written many Google Maps applications, the first of which was the places part of this very website. The Google Maps API is now up to version 3, which I use when writing anything new, but the places page still uses version 1, and it still works. I've not had to re-write anything. Although v1 of the API is officially deprecated and unsupported, Google have kept it live so that apps written using it don't break. It amazes me that organisations such as Facebook have so much contempt for developers that they can't keep old APIs active, or at least consistent, despite being worth billions of US dollars. If you can't support an API, you really shouldn't provide one.

I doubt anything relies on the data made available by Madhouse Beyond, but I promise you now I take data dependency very seriously. The URL structure of Madhouse Beyond changed considerably in the last year, but I made absolutely sure that with a few exceptions (the text speak translator has gone because it's not funny any more) all the old URLs redirect properly. I did this myself, because I care, and it's sad that I seem to be one of a very small number of people who do. I just hope that as the world wakes up to the possibilities of linked open data, app developers gravitate towards data sources that actually bother to keep their formats consistent. This will force less competant providers to improve their practices or simply fade away.

Draw This

"You should play Draw Something, it's really good" said a good friend of mine the other day. I called it up on Android Market and checked the different versions available.

Firstly, I'm all for paying. I hate adverts. If I get the choice of a free version with adverts or a no-ad version for under a quid, it's a no-brainer for me. So I compared the two versions of the app, the premium and the free, and noticed something interesting... they both require access to the GPS hardware.

| | | | --- | --- |

Now, I'm aware that sometimes the free version of an app will require access to the user's location mainly to decide which adverts to show (pointless showing an ad for a service only available in the US if the user is in the UK for example) It's only fair - you still pay for the app, just not in financial terms; you pay either with your time (reading ads) or your privacy (app collects lots of info on you) but in this case the game wants to know the location of the user even if they opt to pay, which isn't right. More worryingly, it asks for the fine location - the actual GPS position (potentially accurate to within a metre) of the user, rather than just the network location. Fair enough, if a developer wants to know I'm in Southampton I've no real issue with that - but I don't want them knowing my exact address. I decided not to install Draw Something.

What worried me the most is that when I mentioned to another good friend of mine why I decided not to install the app, they replied "all apps want to know your location", dismissing it as not worth worrying about. So do I worry too much? I decided to find out.

One of my favourite games on Android is Cut The Rope. I had a look at the permissions required for the different versions. There are three versions - Free, paid and HD. As a tablet user I have the HD edition (which isn't free). It requires the coarse location permission. This allows the game to determine the approximate location of the user without giving it access to the GPS. This is perfectly reasonable in my opinion. After all, any app with access to the internet can gain this information without needing the location permission anyway. As to why it needs it, I've no idea, but as I said, I've no issue with it knowing roughly where I am. As a developer I like to know stuff about my users so I can tailor my future stuff to them, I'd be surprised if others didn't think the same way. A little worrying is the fact that it wants to know the device's phone number, but as my device is a tablet with no phone function I guess this doesn't really apply to me. I'd hesitate before installing the app on my phone though. But look - the free edition requires the fine location permission, which allows the app access to the GPS. This runs true with my earlier assertion that you pay for free apps with your privacy. The app only wants to know exactly where you are if you don't pay up.

| | | | --- | --- |

But let's look at another example - the ubiquitous Angry Birds. As far as I can tell, Android has no paid version, the only version is the free one (not counting the sequels, Rio and Space). Even so, the game doesn't want to know exactly where you are, just roughly. And as it's a free app, with ads all over the place, I think this is fair enough. In fact, Rovio are so intent on people not getting the wrong end of the stick that they went public [talkandroid.com] with the reasons behind all the permissions required to run Angry Birds (or, to be more precise, one of its sequels) on an Android device. They specifically mention that they didn't feel the need to request a precise GPS-based location for the user in order to target their adverts. So when one of the market leaders says things like that, OMGPOP, developers of Draw Something, had better follow suit or at least give a damn good reason for not doing so. Sadly, there doesn't seem to be any kind of privacy information for the app on their website. Their privacy policy only refers to the website itself, and the one page on the site relating to Draw Something has nothing other than a promotional video and links to the various app stores.

In this age of identity theft and privacy infringements I think we all need to be a little more cynical. When someone asks for information, there's always a reason. If they refuse to divulge that reason, a smart person should really be wondering what they have to hide. But for developers, it really does make good commercial sense to keep users informed - OMGPOP have certainly lost one potential customer and I'm certainly not the most privacy-concious person I know. Perhaps it's a Google problem. I applaud them for making app permissions so transparent, but the Android Market should maybe force developers to provide a reason for each permission they request. And let's face it, the only apps that should need to know your exact position on the earth are navigation or local interest applications - if we sleepwalk into a world in which we unquestioningly expect apps to want to know where we are, then we've taken a massive wrong turning.

Fox News Foreign Policy

Despite international coverage in the New York Times and CNN, the Murdoch-owned Fox News has so far ignored the News International phone scandal apart from to confuse it with the Anonymous/Lulzsec-style hacks and therefore implying that the News of the World is actually the victim of a data theft attack rather than the perpetrator.

According to the Guardian, they have now broken silence courtesy of everyone's favourite shouty man Bill O'Reilly.

You know look, people are exploiting this situation. It is a bad situation, anyone who broke the law should be held responsible. Everybody knows that. Journalists are citizens too. We break the law, we should be held responsible for it. But here in the United States there isn't any intrusion of this story thus far on News Corp properties, none! Yet you have the New York Times absolutely running wild with the story, front page, front page, front page, column, column, column, vicious stuff and ah it's all ideological! Is it now?

Ah, good old Fox News. Only reporting stuff from the US and countries it's at war with :)

Fun with statistics

I find that whenever someone gives me a figure as a percentage, the first thing I do is subtract it from 100 to see how the figure compares to the opposite. This is usually most useful when watching or listening to adverts. For example, when an advert says "40% of people found they were paying less when they switched to our insurance company", that actually sounds quite braggable on the face of it. But the critical mind should be saying "hmm, that means that 60% ended up paying the same or more", and that's before you get into more detail, such as whether the stats include existing customers or just those switching, etc. Give it a go, next time you hear a percentage as a statistic, try that trick and see if it changes the way you look at things.

I've just seen a brilliantly contrived one on the Channel Five show "Shops, Robbers and Videotape". The episode talks about how drugs and crime are apparently intrinsically linked. At the top of the show, a police officer was quoted as saying that 80% of crime is comitted by only 20% of offenders, and of these some 18% are drug addicts. Well the last time I went to school, 18% of 20% was 3.6%. Subtracting that from 100 means that 96.4% of offenders aren't drug addicts, or at least aren't known to be drug addicts. Even if he actually messed his words up and meant 18% of all offenders, it still means that 82% of offenders aren't known druggies. Mind you, saying "82% of offenders aren't known to be drug addicts" in a show trying to illustrate the link between crime and drug use would have been a bit counter-productive though I guess.

Gibberish

By now, most of you will have seen this [YouTube], it's LA reporter Serene Branson fumbling over her words while introducing an award ceremony on live national news. If you haven't, it's extremely funny, watch it.

Now let's go into depth... I'm quite annoyed at the media attention that this got. Everyone seems to be in one of two camps: the ones who don't realise it's medical and simply find it funny, and the ones who have realised there was a medical reason and are now assuming that she had a stroke, or something far more serious. Take it from me - she was having a migraine. Being a migraine sufferer myself, I know quite a lot about them.

Actual migraines only affect around 1 in 8 people and the vast majority of people claiming to have a 'migraine' are actually just having a bad headache. It's similar to the way that people walking around complaining of flu actually just have a bad cold, they've just never had real flu so they don't have anything to compare it with. So because the majority of people have never had a migraine, there's this common misconception that they're simply bad headaches, which simply isn't true. Migraine sufferers experience loss of vision, loss of feeling down one side of the body, inability to speak, inability to concentrate and increased sensitivity to light or sound, and that's in addition to a sometimes crippling headache. The symptoms are very similar to those of a stroke, apart from the fact that the sufferer normally recovers completely with little or no medical attention.

But while I am slightly annoyed at the complete lack of knowledge that supposedly well-researched news coverage, as well as the general public, seems to have about a common yet potentially disabling condition, I'm somewhat glad that something like this has happened in the mass media. Maybe a few more people will start to understand from now on that migraines aren't just bad headaches.

Going Backwards

Those who weren't familiar with the Blackberry Messenger service (BBM) before the recent civil unrest are probably familiar with it now. It's basically a text message service exclusively for Blackberry phones, but it's free to use. Which, I guess, is a plan that's working for RIM, the company behind the Blackberry brand, because I'm seeing people swapping BBM numbers on Facebook just as much, if not more than their mobile numbers these days.

A less successful 'brand exclusive' communication medium is Apple's Facetime. It's a method of making video calls between iPhone 4 devices. It's not quite as popular as BBM, firstly because of the restrictions (you need an iPhone 4, the other person needs and iPhone 4, and you both need to be in range of a wifi access point because it refuses to work over 3G) but also because people don't like video calls. Proof of this is in the fact that every halfways decent phone for the last five years (except the iPhone) has had video calling functionality, and people simply don't use it - even though the functionality of the universal service works between different makes of handset and also over cellular.

But Facetime and BBM both do something which I consider quite dangerous... they replace a universally accessible service with an alternative that's restricted to one make of handset. Facetime replaces video calling with a system only available to iPhone users, and BBM replaces universal text messages with a system only available to Blackberry users. It doesn't stop there... Facebook have announced an application for mobile messaging, and there are rumours flying around that Google are about to release their own closed messaging system to tie in with Google Plus.

Now, make no mistake, I strongly dislike text messages. People's attitudes towards them are wrong - if you send a message via SMS and get no reply it's far more likely that the message hasn't got to its destination yet, but many assume it's the recipient being rude. Also the cost is outrageous. It's around 10p for a single message, 140 bytes, depending on your network. That works out at £714.29 per megabyte, and to the phone company that's almost pure profit. I get 500MB per month for a tenner on my current data plan, and the phone network are making a profit out of that. The same amount of data would cost me over £357,000 to send via SMS. If you have a contract with 500 text messages, that's only actually 70K of data, so compared to your data allowance the text messages should be pretty much free. Personally I'd love to see a world in which everyone drops text messaging and starts using mobile email instead - it's cheaper by far, even if you're on a flat rate contract, it's easier to filter for spam and unwanted communications, and people know not to expect an immediate reply.

But all that said, I'd rather have text messages as they are today than go back to the bad old days. Remember when text messaging was a new thing? You could only send messages to people on the same network as you, so you had to make sure you bought a phone on the network most of your friends were on, even if that network wasn't exactly what you wanted... it was a pain in the arse. By segregating messaging systems by OS, by handset manufacturer or by social network, we're basically going back to the way things were in the bad old days of mobile messaging. And that's not a good thing.

Google are evil, but everyone else is OK

So here it begins... the Wall Street Journal report that Google are bypassing security settings on certain versions of Safari, specifically the iPhone version. Cue the shitstorm as hundreds of "privacy advocates" start bleating about how Google are 'evil'. Well I'm not going to make excuses, nor am I going to claim two wrongs make a right, but there are a few points that need to be addressed and nobody seems to be doing so.

Firstly, an analysis of what Google are actually doing. In order to make their 'Google Plus' code work, they need to be able to drop what's known as third party cookies on peoples' web browsers. You don't need to know what these are or how they work, but the default security model on lots of browsers these days is to disallow this, as it's a common method that advertising sites use to track you round the web. Maybe Google are doing this, maybe they aren't. Truth be told, they probably are, seeing as how advertising is how they make all their money. But the fact is that Google used this exploit to drop cookies on versions of Safari for which they had been disabled. You'll notice that the exploit was is over a year old, and since then it's become common in Facebook applications, which also rely on passing cookies between IFRAME elements.

So my first point: are Google really doing anything wrong? It's not hacking, it's computer science. They hit a problem, they solve it. The problem in this case is that they can't drop cookies on some browsers. They learn that it's possible to do so using a clever form hack as described in the previous link, and implement it. Problem sorted, they can now drop the cookie they needed, let's move on to the next problem without even batting an eyelid. By the same logic, Google Maps is 'evil' as it uses clever hacks to generate dynamic scrolling maps in an otherwise static web page.

My second point: even if the practice is slightly shady, why is everyone having a go at Google when the exploit has clearly been working on Facebook for over a year? If it really is such a problem, why have Apple not patched the hole? They've had a year to do it. Even if you do consider this frankly quite clever workaround to a programming problem to be wrong, let's bash Facebook as much as Google, and certainly let's bash Apple for not patching a one-year-old vulnarability in their web browser. It's certainly a genuine shame to see Google getting so much stick rather when openly privacy-apathetic organisations like Facebook and companies with a piss-poor reputation for fixing security vulnerabilities like Apple seem to be able to get away with anything these days.

HMV - and why they had it coming

Everyone seems to have an opinion on the fact that HMV have gone into administration. Some think it's the decline of the high street, some think it's the rise of the internet. Some blame the economic climate, some blame piracy, some blame consumers. It seems to me that nobody is blaming the actual cause - the collective attitude of the recorded music industry.

Cast your mind back to 2000. US punk band The Offspring were on the verge of releasing "Original Prankster", the first single from their new album, "Conspiracy of One". At the time, decent legal music download services were nonexistant, and the band decided, for whatever reason, to pre-release the new single as a free download from their website the week before its official release on CD. Anyone could go to the band's official site and download a DRM-free digital copy of the song without paying a penny. This would have been much less of a publicity stunt, had HMV not got stroppy and decided not to stock the single. Despite the song being available for free online and the fact that HMV, supposedly the biggest music retailer in the UK, were refusing to sell it, the song went straight to number 6 in the UK chart on its first week of release, and remained in the top 40 for a month. This should really have been a wake-up call to HMV that they're not as tough as they think they are.

But sadly, HMV are just the tip of the iceberg. The bully-boy attitude is rife throughout the industry. It's a fact of life that the world changes, and you need to change with it in order not to get left behind. Music, specifically the consumption of music, is changing faster than most things. The problem is that for the last 10 to 15 years the recording industry has been spending all of its time and money trying - unsuccessfully - to prevent this change, rather than adapting to it. Instead of embracing the internet as a music distribution mechanism, the recording industry sees it as a threat. Rather than look at the success of Napster as proof that people like to download their music, they see it as proof that people don't want to pay for music. Slowly things are getting better, but it is very slowly. The first music download services involved a mammoth monthly fee and if you stoped paying it you lose access to all your music. iTunes (which is basically Napster that you pay for) is phenominally successful, but it's only in the last few years that you could download songs and play them on your car stereo, as early versions were locked to one piece of software and one brand of MP3 player. And let's be honest - Apple had to drag the recording industry kicking and screaming into business with it, again to get them to let them provide DRM-free songs, and again to let them charge what they want for them. As a small aside - the movie industry also need to get a grip on reality, HMV and Blockbuster are in administration so let's have a decent DRM-free movie download service soon before too many people start relying on the Pirate Bay, who provide exactly that. It's a problem that affects every content-producing industry, not just recorded music.

So to summarise, if every HMV store shuts down, nobody will miss them, they'll just be another relic of the past as children in years to come ask their parents "did you really have to go out in the cold and buy a plastic disc every time you wanted to buy music?". When I was a teenager, the only way to get your music heard was to get a recording contract. These days, anyone can release their music online, and nobody buys CDs any more. The recording industry, HMV included, have excluded themselves from this brave new world, and they only have themselves to blame.

It's your own fault you got conned

A few weeks ago, a blog post started doing the rounds on Twitter.

http://andy-welch.tumblr.com/post/56687596225/wont-get-fooled-again

This is the blog of Andy Welch, a music journalist. I suggest reading the post before continuing to read this, but if you just want a summary, he was conned out of money by some very clever fraudsters.

Of course immediately every self-dubbed 'expert' went into overdrive, analysing the con, placing blame, criticising banks, security and, I'm sorry to say, the victim. In fact, it was a tweet by an ex-colleague of mine, an intelligent person for whom I have a lot of respect, that made me write this post.

In my opinion the con works because in general people have an expectation that when you hang up the phone the call is cut off. In actual fact, only the maker of the call can terminate it (except for 999 calls). If the maker of the call stays on the line, even if the receiver hangs up, the call remains in place. The clever part of the con in question is that the fraudsters had some kind of device for playing phone 'noises' down the phone. They rang the victim, claimed to be from his bank and told him his account had been hacked, and that he needed to ring the number on the back of his card. Once the victim hung up, the fraudsters kept the line open, but played a dialtone down the line. The victim then picked up the phone, heard the dialtone and proceeded to ring the number of his bank, completely unaware that he was still connected to the fraudsters. We're told all the time by security experts that you should never give cold callers any information, and that if you're in doubt you should hang up and ring the bank yourself. The victim in this case followed that advice to the letter, but because of an oversight in the way the phone system works, he still ended up giving the fraudsters the information they wanted, thinking he was talking to his bank.

Discussing the blog post on Twitter the next day, I was quite saddened to hear people dismissing the story and claiming the victim was stupid for falling for the con. In my opinion, the victim in this case (or any case for that matter) is in no way to blame. Saying 'he was stupid' is in the same vein as saying 'she shouldn't have been dressed like that' about a rape victim. It's just not OK. Imagine getting mugged in a town you don't know very well and later being told by a policeman that it's your own stupid fault you got mugged because, unbeknownst to you, that particular part of town is a high crime area. This is exactly what happened. You can't expect everyone to know everything.

Of course, the person making the harmful claims was a technology expert. It's alarmingly common for people who know a little bit about technology to be arrogant about people falling for cons that rely on the victim not knowing how the technology works, and this arrogance needs to stop. I'm happy to say that the victim got all their money back, although not without a lot of hassle, and if there's a silver lining in the cloud it's that he now knows a lot more about how the phone system works, and if he gets a call supposedly from his bank again he'll no doubt use a mobile to call them back, not the line he just used. Additionally, he's written the blog post, so others can hopefully educate themselves on how this con works. But not everyone will read the blog post, and I bet there are still many people out there who don't know about the hanging up flaw on the phone system, and will probably fall for the same con if it happens to them.

We as computer experts will do much better to help educate potential victims in a positive way, rather than knocking actual victims down a few pegs. As long as there are criminals more knowledgable than their victims, these cons will continue, but the onus should not be on the victim, it's on us to help them from becoming victims in the first place. The only people who actively deserve any critisism are the criminals, anything else is blaming the victim, which is never OK.

Lies, damn lies

OK, this is starting to piss me off now.

There are various stories in the local rag (The Echo) about how things are better/worse than last year, most of which completely ignore relevant factors such as weather and the economy, but this one annoys me the most...

Festive drink drive figures up - despite crackdown

Basically, the number of people arrested for drink-driving this christmas is higher than last year. The article goes on about how the police are disappointed that the figure is so high, despite a 'crackdown', whatever that means. Not once in the article does it mention that last christmas most of Hampshire was under about a foot of snow.

Yes, that's right - only those with very short memories would be surprised that the number of drink-drive arrests are up this year compared to last... last year there were considerably fewer cars on the roads due to harsh weather conditions, and probably fewer police cars around too, for the same reason. I bet if they were to report the number of arrests as a percentage of the total cars on the road, rather than an absolute figure, it'd be pretty constant year on year.

Lifelogging

Google Glass is getting a lot of stick in the press. Some think it's wonderful, others see it as a massive invasion of privacy. It's been called 'sousveillance', a term coined by Steve Mann of the University of Toronto. But many will not know that Mann has had something resembling Google Glass for years now.

I blog a lot about various subjects, some of which I'm maybe not qualified to talk about. But I do have a PhD in lifelogging and pervasive computing, so it's about time I said something on the subject of Google Glass and related technologies.

As previously mentioned, Glass is nothing new. It's in the news purely because it's a Google product. There are already many different 'sousveillance' devices, including the Microsoft Sensecam, the Vicon Revue (based on the Sensecam) and the Autographer, not to mention Imouto, the system I wrote myself. Heck, most cyclists I see on Southampton Common have cameras on their helmets, and there are stories in the national press about cyclists who have actually won court cases against discourteous drivers thanks to their video evidence. The only thing Google Glass brings to the table is a novel user interface. Or at least it would have done, had Steve Mann not invented it first.

So is Google Glass a privacy risk? Yes, but not in the way many think. The common fear is that there will be no privacy in a world where everyone has a video camera permanently tied to their head. This is a valid point, but hardly reminiscent of the bleak future painted by George Orwell in 1984. You will still have as much privacy as you always had, in environments controlled by you. Nobody is installing CCTV in your house. Don't forget that the second you step out of your front door and onto the public road, anyone can legally take your photo - at least in the UK. The sad fact is that if you're afraid of Google Glass, then you are very naive, as there are far worse things to be afraid of. Google Glass, and systems like it, do nothing that a normal phone or a cyclist's helmet camera isn't already doing.

But let's go back to those cyclists - I mentioned that cases have been won based on helmet camera evidence. Surely this is a good thing! In a world full of government and private sector CCTV cameras over which you have no control, sousveillance technologies tip the balance of power back to the individual. Let's imagine you're accused of a burglary because the police have grainy CCTV footage of you near the scene five minutes before it happened. If you have a device logging your every move you can prove that you were actually walking away from the scene when the CCTV was taken, and were three streets away when the event actually occurred. It saves an awful lot of arguing if you can prove where you were at any given time. Like it or not, you can't beat Big Brother, so you may as well fight fire with fire and keep things in a permanent stalemate.

Now I've defended lifelogging and sousveillance technologies as aids to privacy rather than infringements, you may remember that I claimed that Google Glass is indeed a privacy risk. The reason I say this is because, like most Google services, it does most of its processing on Google's servers rather than the local device. Pretty much all current lifelogging systems keep local data private and only fetch additional information from the net if they need to augment the local data somehow. Glass does it the other way round, it sends its data to Google and they do the processing somewhere behind closed doors. Google's business motto is "Don't be evil", but it's always nicer to use a system that physically can't be evil, rather than a system that simply promises not to be.

But that said - chill, people. Google Glass doesn't need special regulation, nor does it need a change in the way we work. I know of (but do not practice) methods of silently determining peoples' home addresses from their Smartphone's wifi traffic, which is far more creepy than some bloke wearing funny goggles who may or may not have taken a blurry photo. In today's technologically challenged world it's better to be cautious of the things you can't see rather than the things you can.

More Echo Journalism

The Echo has run a story about how Southampton is the worst area in the south east for fly tipping, topping a list of 67 councils.

http://www.dailyecho.co.uk/news/9859261.City_worst_for_fly_tipping/

Shocking, eh? Well it would be if you didn't have a look at the source data from DEFRA, the Department for Environment, Food and Rural Affairs...

http://www.defra.gov.uk/statistics/environment/waste/flytipping-in-england-annual-statistics/

Ignoring the obvious bias always associated with absolute figures - any statistician will tell you that the main figure should really be incidents per square mile or per 1000 people, rather than just total incidents - I can't help but notice that the data is in fact data for 2010-2011 and was released back in December. Obviously this is bad journalism on the Echo's part for reporting these figures as if they were current rather than eight months out of date. But there is another major factor that has been overlooked here - in the summer of 2011 Southampton's batshit-insane council decided to screw over half the public sector, leading to months of strikes throughout the city. Specifically, where I live we had our bins emptied twice over a period of about four months because the refuse collectors were on strike. It's not really surprising that there was an increase in fly-tipping in the Southampton area during this period.

I've said it before and I've said it again - don't believe anything you read in the paper (particularly the Echo) until you've seen the raw data.

On letting Cowell win

Last year, a large percentage of the population went out in their droves and bought the song "Killing in the Name" by Rage Against the Machine in the week before christmas. The result is that, despite its new release and market hype, the X-Factor winner didn't get to number 1 for christmas, as had happened for several years previously. RATM getting to number 1 for christmas was a triumph, not just for people who dislike the X-Factor, but also for those who remember the days when people actually cared who was number 1 in the charts; for the first time in years I actually sat listening to Radio 1 just before 7 on a Sunday to find out who had won. But everyone remembers it in their own way, and this is why the same thing won't happen this year, as I will explain.

So far this year, I've had numberous requests via Facebook, Twitter and email to buy songs to 'beat' the X-Factor. As early as last summer I was asked to buy something by System of a Down, and just recently I've been asked to buy 'The Bird is the Word', Motley Crue's 'Girls Girls Girls' and even a delightful ditty entitled 'Use My Arsehole as a Cunt'. I'm sure if the sales for all these songs were combined they'd easily beat X-Factor, but none of them can get to number 1 on their own because they just don't have the support of enough people. We're in the situation parodied beautifully in The Life of Brian, in which the various rebellious groups couldn't possibly beat the Romans because they were too busy squabbling among themselves.

I think the problem is that people don't realise why Killing in the Name actually won. The reason is that it had everything going for it. Hard rock and metal fans bought it because it was their chance to get a rock song to number 1 for a change. People with a childish sense of humour bought it because they wanted a song with repeated use of the word 'fuck' to get to number 1. Charitable people wanted it to get to number 1 because RATM are famous for their charity work, particularly in the area of human rights, and the band made it clear early on that they would give all profits from pre-christmas sales to Shelter, the charity for the homeless. Those of us who are sick and tired of the X-Factor being number 1 every bloody year bought it because it was a chance for something different to get to christmas number one, with the added benefit of being able to tell Cowell very clearly "fuck you, I won't do what you tell me".

The problem this year is that we don't have a song that ticks all the boxes. We now have metal fans suggesting we should buy System of a Down, the anti-X-Factor crowd suggesting we should buy Bird is the Word, the purile crowd suggesting we buy the expletive-laden song... there is no one song which, like Killing in the Name, unifies everyone's purpose. And it's for this reason that Simon Cowell's X-Factor whitewash will, once again, happen this year. Does someone care to write and record a song in time for next year? Preferably a catchy rock song, with subtle political or anti-corporation undertones and lots of swear words? Actually, fuck it, just buy 'Dinosaurs Will Die' by NOFX : )

Open letter to landlords who book bands

This weekend the band with which I associate have had two gigs, both made less pleasant by a pub landlord or landlady who clearly doesn't realise "how it works". It seems to me that these days a small minority of pub owners and managers book bands purely because it's the done thing - the bands themselves are more a necessary inconvenience than anything else.

If this is how you think, then please don't book bands. Be a sports pub, or a food pub, or a real ale pub. Don't book bands if you don't actually want them there. Most pub bands do what they do for the love of it, they're not in it to make a profit. If they were, they probably wouldn't be playing pubs. So when a band turns up to a gig in a pub only to be ordered around and effectively told that they don't know how to do what they've been doing for years by some self righteous arse who likes to assert authority, it's more than a little bit irritating. It also doesn't help if you blame the band for not bringing hundreds of adoring fans with them, or taking up space where paying customers might want to stand; pub bands are not an investment. They just set up, play, and leave when finished. Their job is to play music, not sell drinks - that's the pub's job. The band will publicise the gig as much as possible among their friendlies, but they can't guarantee it'll be a blast. After all, if people who want to see a band have a choice of seeing them in a shit hole venue one week or a much nicer pub just up the road the week after, they're going to pick the nicer pub and you can't really blame the band for that.

The sad fact is that we live in a time when pubs and live music are both in the same boat - struggling to survive. We all have a much better chance of survival if we stick together. Most bands are quite reasonable, but they're not your employees. Treat them like human beings and they'll be more than happy to come to an agreement that benefits all parties. Asserting authority, making unrealistic demands and generally treating bands like dirt is only going to piss them off. This isn't helpful for either live music or the pub trade, so why do it? And if you really can't grasp this concept then maybe you should be asking yourself why you want a band in your pub in the first place?

Product Placement

This is interesting [out-law.com]. It seems that although UK TV channels will be allowed to show programs containing product placement from the end of this month, they must be preceeded with a big 'P' logo to allow the viewers to know they're being brainwashed... er... watching such a show.

What I don't get though is why, and if it will affect all the shows on UK TV that already contain product placement... mainly the US shows that we get on syndication. OK, so if you're watching a UK TV show you can be sure it wasn't funded by advertisers unless it has the 'P' logo, but what about other stuff? Will we get a big 'P' before any of the recent Bond movies are shown? And will it matter, considering the product placement in those films is so blatently obvious? It's just like when you go into a shop and it's always obvious when the salespeople are paid on commission just from their sales technique. That said, the OFCOM guidelines clearly state "Placed products and services cannot" ... "be featured in an unduly prominent way within programmes". So yeah, I guess that means no more Bond movies at all then. Or the Transformers movie.

Likewise, why does it matter that the company in question has paid for the exposure when many shows, intentionally or otherwise, already give exposure to certain brands over others (example: every laptop or smartphone you ever see on a BBC technology show seems to be made by Apple)? Are we going to see an entire breakdown of the TV company's finances? What makes the advertising budget so special?

I say, just let it go. Allow the product placement if you must, but if it gets too annoying most smart people will just switch off. I rarely watch any non-BBC channel purely because I get pissed off with adverts.

Salesmen

I'm not one to despise all salespeople. I appreciate that there is a need for salespeople and marketing in general. After all, without such things products wouldn't sell, a large part of sales is to inform. There is an art in sales and marketing, from simply producing a catchy or annoying advert (ie webuyanycar.com) to ensuring your product's name becomes synonymous with its type (ie iPod).

But there is one particular type of salesperson I despise, and that's the one who's so convinced he's flogging a dead horse that he actually has to pretend he's not even a salesperson in order to make a sale. Case in point, today, my front door:

| Doorbell | [ding dong] | | --- | --- | | [Ash goes to answer door, expecting it to be a courier delivering a parcel. Opens door to a man in his early 20s wearing a 'Southern Electric' hat and jacket and carrying a clipboard.] | | | Ash | Hi there. | | Man | Hi, I'm from Southern Electric, here's my ID. | | Ash | Oh, the meter's just round there [points to the side of the house]. | | Man | No, you've actually been flagged on our system. | | [Ash, taken by surprise, goes into his 'suspicious mode' and notices something that until now passed him by] | | | Ash | Hold on - we're not with Southern Electric, we're with a different provider. | | Man | Ah yes, but we're the distributor for this area. | | [A little alarm bell labelled 'bullshit' starts ringing in Ash's head] | | | Ash | So... basically, you're a salesman trying to get me to change provider? | | Man | [avoiding the question] Look... [gets out a map of the UK] if you can see, these areas are Southern Electric... | | Ash | OK, yes, I know what the UK looks like, can we cut to the chase, I'm quite busy. | | Man | Ah ok, if you're busy we can pop some literature in the post for you? | | Ash | Thanks, you do that. |

As a little epilogue, he didn't actually get my name, so if he does put something through the door it'll be addressed 'to the occupier' and will therefore get binned without being read.

Ironically, I'm sure in the sales industry he'd be seen as a master salesman. In fact, had I been a little old lady with not all my marbles, he'd have probably tricked me into signing something that switched my energy supplier without my knowledge and consent, and he'd have been paid a hefty commission for doing so, because sales figures don't actually take into account whether the customer actually wanted the service or not. On the contrary, a good salesman, in my opinion, is one who sells the best product to a customer who actually wants it. Surely if you start to find people don't want to buy your product you'd be much better off finding people who do and selling it to them, rather than trying to con people into buying something they don't want. And if you find that you've descended to the level whereby you have to actually pretend not to be a salesperson at all in order to sell it, surely you should be wondering why? I'm sure the sales industry would be a lot less despised if they started treating people like people, rather than as sales figures.

Science

I was on a plane, travelling back to the UK. To keep me sane, I had with me my Amazon Kindle, a fine example of modern technology, which allows me to buy, store and read books and electronic documents from a single device measuring about the same as a sheet of A5 paper, and less than a centimetre thick. It's a moot point, but I was reading Charlie Brooker's "The Hell of It All", a collection of his wonderfully funny and well-observed columns previously published in the Guardian.

We began final descent. Soon after, the cabin crew did a tour of the passengers, checking everyone had their seat backs and tray tables up, and so on. One of the stewards noticed the device in my hands and asked me if I'd turn it off until after we've landed as electronic devices may interfere with the plane.

Those who have a Kindle or similar e-book reader will know of its power consumption, or lack thereof. The battery lasts weeks on a single charge. Due to its electronic paper screen, it literally only uses power when in wireless mode (which of course I'd had off for the entire flight) or when you're turning a page, it needs no power at all to keep the page unchanged. In fact, even in 'off' mode, it displays a picture of some classic author on the screen, rather than the page you were reading. Even when the battery dies completely, the screen continues to display a message saying that the battery has run out. Basically, turning the device 'off' actually makes no difference to its operation, how much power it is consuming, or how many potentially interfering signals it's emitting. (EDIT: I've since been informed that you can actually blank the Kindle's screen completely when it's off. Happy to plead ignorance on that one.) The only practical difference between off mode and on mode is that in off mode I can't read my bloody book.

Now, I could have explained all this to the steward and continued to read for the remaining 10 minutes of the flight. In a completely rational world this would have been a sensible course of action to take. Sadly we live in a world of irrational people and, knowing this, I decided to simply comply with the request of a less technologically literate person than myself in a bid to avoid unnecessary hassle.

I'm not bitter about the experience, 10 minutes of reading isn't really anything to cry about, but the experience did make me think about the state of the world in general. It made me think about Professor David Nutt, former drugs adviser to the government, who was effectively sacked for doing his job. He advised, with the benefit of scientific knowledge and research, that many illegal drugs were less dangerous than legal drugs such as alcohol. But because his comments went completely against the government of the time's anti-drug stance, his advice was ignored and he was later sacked. Thanks in part to a campaign by the National Farmers' Union, the UK government is currently very close to allowing farmers to kill badgers in order to prevent the spread of bovine tuberculosis even though genuine taxpayer-funded research conducted over ten years suggests that reactive culling is actually counter-productive, and more research needs to be carried out in order to determine why. According to a freedom of information request by the Telegraph last February, some 30% of NHS primary care trusts are funding homeopathy, despite there being no actual scientific evidence that it works better than placebo. Insisting that homeopathic remedies are denied NHS funding will more than likely piss off the British Homeopathic Association, whose website has a prominent "What You Can Do" section encouraging people to write to their MPs and PCTs insisting that homeopathic remedies are continued to be funded by the taxpayer. And my own personal bug bear, being as I am a computer scientist, the Digital Economy Act. This was passed during the death throes of the previous government and obliges internet service providers to spend large amounts of their own money and time policing the internet for the benefit of the movie and music production indutries, something I've blogged about several times before. The act was strongly opposed by pretty much anyone who has the slightest clue about how the internet works, but was eventually passed by MPs due to pressure from the content providers, and has since led indirectly to the ACS:Law scandal and a recent High Court decision to order a major ISP to block access to an entire website just because a coalition of multinational corporations didn't like people having access to it.

So how does all this relate to my previous anecdote about the plane steward and the Kindle? Simple: in order to secure an easy life, we're listening to those who can shout the loudest when we really should be listening to the people with the most knowledge. I don't deny, I'm all for drug reform, specifically the legalisation of marijuana, but if an expert in chemistry and toxicology were to tell me that it's a bad idea, I'll admit I'm wrong. I'm against the taxpayer funding homeopathy, but if someone were to actually show me some genuine scientific data that proves that it's as effective as other, more mainstream types of medicine then I'll happily support it. The sad fact is that the politicians who make the rules aren't in it for what's true and right, they're in it for votes. So long as people who support homeopathy can shout louder than the actual scientists, homeopathy will be available on the NHS, and as long as rich media moguls have more political influence than people like me who actually know quite a lot about technology, then destructive laws like the DEA will continue to be passed. Democracy is flawed; in any random sample of people there will always be more non-experts in a particular field than experts, but democracy is designed to support the majority, even if they have no idea what they're talking about.

I'm not calling for a shift to some kind of meritocracy - although doing so would solve the problem - I'm simply saying that for civilisation to prosper, we need to start thinking critically, forming our opinions based on real science and evidence rather than what we've been taught is right or wrong. Had Darwin and Gallileo simply gone with the beliefs of the masses we'd still believe that the earth is flat, the sun goes round the earth and dinosaurs didn't exist. We as a society must learn not to form opinions unless we know all the facts, accept the difference between what we want and what we need, and above all, only vote for politicians who do likewise.

So in conclusion, I guess what I'm trying to say is that if you're an air steward, and you see some chap on the plane reading a Kindle on landing, just let him finish his book. He'll only end up writing a hypocritical rant like this one otherwise.

Silver Linings

Some of you will notice this site has changed in the last week. Now my tweets, photos and new NP doodles appear alongside the increasingly rare blog posts, the locations bit has been vastly improved and there's lots more music stuff, including an encyclopaedia of my music collection, and a list of upcoming gigs in Hampshire's pubs. Oh, and the poll is back and logins work again, so you can stop moaning at me now.

Most of the cool stuff relies on external content. The music database is all based around open linked data and the textual content comes mostly from Wikipedia. The gigs are screen-scraped from various bands' websites and Facebook, and the tweets on the main page obviously come from Twitter.

So yesterday, as we all know, Twitter went down for a few hours. We all know because the BBC started banging on about it, completely giving away where they get their news from these days :) I kinda passive-tweet, in that I tend to use apps rather than the website and only really check Twitter when I can be bothered. I certainly wouldn't notice if there had been no new tweets for a few hours. I did, however, notice that all the tweets had vanished from the front page of this website. It became apparent to me that my website now has many points of failure rather than just the server on which it's hosted, so I began to write a hotfix.

Now I believe you'll find you can always find my tweets here, even if Twitter is down. Every time the page is reloaded it pulls my new tweets from Twitter and stores them in a local database. If it can't get to Twitter, it simply reads the most recent local copy and seamlessly generates the page from that instead. This should be the case with Last.FM, MusicBrainz and Wikipedia, as well as the BBC's open data, all of which are used by this site to populate its content.

Television Editing In Defence of Fool Us

I notice a lot of talk on Twitter around the time Penn and Teller: Fool Us is on ITV, pretty much every week. Quite a lot of it centres around the discussion of miking up audience members. The usual accusation is that everyone randomly selected from the audience is actually a stooge, and the fact that they're all wearing microphones proves this.

As I was at a recording a few months back, I think it's only fair to set the record straight - there is an awful lot of TV editing during the show but the actual magic is real and live. I think I remember commenting at the time that it's ironic that the magic isn't rigged but everything else is! Basically, if a magician selects a volunteer from the audience they get their applause and walk up on stage. The cameras are cut, and the volunteer is fitted with a radio microphone by one of the techies. They then sit back down and the whole selection sequence is filmed again, and this time it goes straight into the trick. The miking up process is then edited out in post production.

This isn't the only television editing that goes on - ever notice that Jonathan Ross wears the same tie in every episode? The reason is that it's not chronological. For example, the filming I went to had Graham Jolley and Damien O'Brien performing, but both were shown in different episodes when the show was broadcast, presumably so the 'winners' are spread over the series. This of course means that there's about three, maybe four episodes that have me in the audience, even though I only went to one recording. There was also quite a bit of dialogue cut out, one particularly memorable joke during Graham Jolley's act that didn't make TV was Jonathan Ross making fun of Penn's pronounciation of the word 'snooker', only for Penn to jump straight in with "the last person I need lecturing me on pronounciation is Jonathan Ross!". Additionally Penn and Teller get quite a bit longer to discuss each trick than is made apparent on TV.

Yet, I cannot stress enough that despite all these TV edits, every magic trick is shown live, uncut and as performed on the night. So please, while watching Fool Us, don't think it's rigged because it isn't. If you want a show that's rigged, watch The X-Factor : )

The Echo Does It Again

I love how the Echo always manages to make a mountain out of a molehill.

M27 motorway to be closed eastbound for three days, screams the headline. The article begins: "The eastbound carriageway of the M27 will be completely closed for three days, it has been revealed". Yet the very next sentence clarifies somewhat: "The motorway will be closed between junctions four and five on March 9, 10 and 11." So in one sentence, we've gone from the entire eastbound carriageway being closed to one junction being closed eastbound. Still - three days, what are they thinking?

Ah, hold on... let's check the actual source of the news, namely the Highways Agency website. "The work will be carried out during a 32 hour closure of the carriageway, from 9pm on Saturday 9 to 5.30am on Monday 11 March. Fully signed diversion routes will be in place," say the HA. So basically the road will only be closed for one full day plus a bit of night work, and the full day will be a sunday, when most of the traffic on the eastbound M27 gets off at junction 4 anyway.

This doesn't actually annoy me - the Echo, like most tabloids, should be taken with an extremely large helping of salt. What annoys me is that I've already had an email at work (sent to the entire department) from some hysterical loon "warning" people who drive to work about the traffic, making it very clear that they've only read the headline and not the article, and certainly haven't bothered to check the information source. Is it any wonder that urban myths circulate so easily when people actions are based on such inaccurate and incomplete information?

The Information Monopoly

Just recently there have been two new products announced that make it easier to communicate, and keep track of messages by aggregating all your messages from different sources into one place.

The first of these products is the long-awaited Windows Phone (aka Windows Mobile 7) which is a complete re-write of Microsoft's mobile platform to make it less computer and more phone. They seem to have taken a leaf out of Apple's book with a lot of the design choices (ie no cut and paste or multitasking in the initial version) and there are lots of 'silly' things, like an in-built Zune and Xbox 360 integration. However, the main feature that everyone in the tech world is raving about is the fact that it makes messaging so easy, in fact, its simplicity is the main focus of the current TV advert. It does this by turning messaging on its head. You have all these communication methods - SMS, email, Facebook, MSN, etc - on your phone anyway, so why not combine them into an easy 'people' hub where you can sort all your messages by person and subject, rather than have to keep them seperated by delivery method, or in different apps. It also, being written by Microsoft, will probably crash quite a bit.

The other of these products is Facebook Messages. It performs roughly the same task, keeping your email, texts and Facebook messages together. Suddenly all the messages you get sent via Facebook can be read at the same time as your email, you don't have to check them both. And when you send text messages on the go, and then later continue the conversation online via email or chat, you can see the previous text messages there too and refer back to them without having to switch to your phone. It also, being a feature of Facebook, will probably crash quite a bit.

These two services have a crucial difference. Facebook Messages works server-side and Windows Phone works client-side. I will explain. If you have a smartphone, you probably already manage your text messages, email, etc all on your phone anyway, albeit in different apps for each communication type. The only additional functionality that Windows Phone gives you is the ability to view them all in one place. They're still all delivered to and stored on your phone the same way, and as far as anyone but you is concerned, nothing has changed. You don't have to change providers, your email provider doesn't have access to your Facebook posts, Facebook doesn't have access to your MSN, Microsoft don't have access to your text messages, etc etc. The only place where everything comes together is right in your hand, where it belongs. Facebook's alternative is different in that everything now happens through Facebook. You just have one connection - to Facebook - and all your email, texts, chat, etc all have to go through them before they get to you. Of course, to be fair, Windows Phone means buying a new phone, so it's the more expensive option as Facebook's service doesn't cost you a penny. But you do still have to pay for it, in the traditional Facebook currency that is your privacy - and by switching everything over to Facebook you're effectively giving them a monopoly on your personal data.

It's no secret that Facebook is a security nightmare. The fact that it's so easy to view strangers' data makes it an unwise decision to upload anything even remotely private, and many computer security experts suggest that you really shouldn't upload anything to Facebook that you wouldn't put on the public internet... that is, of course, excluding the ones that believe nobody should be using Facebook in the first place. There are many stories of people who have been far too naive on social networks, I personally know of at least three people who have been in trouble with their boss over things posted on Facebook, and there are actually people who have been fired and even killed over things they've put on there. Even if we forgive Facebook's murky reputation, there's always a risk letting one company have control of so much information, as recent news reports about HMRC and ACS:Law show. As I've blogged before, You can never be entirely sure who has access to this information when it's in someone else's care. So why would anyone want to turn their entire communications network over to Facebook, or any other company for that matter?

The answer is, of course, in the question: naivety. People are naive enough to talk about their personal life after 'friending' work colleagues, people are naive enough to post rants about their boss and co-workers online and people are naive enough to talk about everything they've ever done despite the fact that their employer, boyfriend, girlfriend and even the police have access to it. People are naive enough to put their email password into Facebook's 'Friend Finder' and then get surprised when the service starts advertising their presence to their psychotic ex, or some guy they emailed once to exchange insurance details after a prang. People are naive enough to click 'Yes' when an application that claims to be just a silly quiz or gift app asks for permission to access their account even when they're not online. So, when offered a simple method of keeping all their communications together without paying a penny, of course people are going to be naive enough to sign up.

But in reality, nothing is really free and anything that seems too good to be true usually is. People say I'm cynical, negative and paranoid, but can say with 100% certainty that my boss will never see a photo of me drunk.

The Kinect really is awesome

...and not just as a game platform. This article (hat tip to Nik for pointing me to it) describes viSparsh, a system for assisting blind people which is made from a modified Kinect. The Kinect's depth awareness allows the device to determine how far the wearer is from an object and feeds back a series of vibrations, a bit like a car's reverse sensor. Over time the wearer learns to judge distance using the vibrations, allowing them to walk around much more confidently.

The use of a Kinect for good reminds me of the robot built by researchers from the University of Warwick, which uses a Kinect's 3D imaging capabilities to locate trapped survivors in the aftermath of an earthquake.

There are two things to learn from these stories. Firstly, the Kinect is wasted on video games. It's genuinely groundbreaking technology. Secondly, both these stories are examples of the good that can be done when a tech company opens up their hardware to homebrew developers and hobby hackers. Microsoft have very publically announced [eff.org] that they encourage people to use the Kinect in whichever way they see fit, a very different attitude from Sony, Nintendo and even one-time proponents of freedom Apple, who all frown upon the use of their kit for anything other than its intended purpose, and go to great lengths to ensure it doesn't happen.

The Unknown Known

People often ask me why I trust Google more than Facebook. After all, both provide services in return for personal information, both are big US companies based on a clever piece of technology, both were started by university students, and both are worth an awful lot of money. Both have privacy issues, most have been identified and many have been fixed. Both are opt-in, you don't have to use them. The reason I trust one more than the other is simple: the unknown known.

Here's a good example. Check out Google's privacy policy. It states happily that when data is 'deleted' from their services, the data may be retained by Google even if not publically available. Facebook contains no such line, so it's implied that deleting something actually deletes it from Facebook's servers. Yet I had a Facebook profile that I deleted about two years ago, and the photos I uploaded to the account before I deleted it were still accessible to anyone with the JPG URL some eighteen months later. In fact, the only reason I can't access them now is because Facebook changed their URL structure a few months back and all old URLs became invalid; I don't for a minute believe that those images aren't still on Facebook's servers. There are good reasons why the images don't disappear immediately - residual data and backups being the main two. But the fact is that Google announces this up front, and Facebook doesn't. And this is the crux of why I don't trust Facebook as far as I can throw it.

Another issue of contention with Facebook is the Friend Finder feature. You enter your Hotmail or GMail username and password and Facebook logs into your account and hoovers up all the email addresses it can find. It specifically states that it doesn't store your password, but it doesn't mention keeping a login session active and it certainly doesn't say what it does with the emails and contacts that it finds. Someone I know, who has never had a Facebook account, recently had an invite email sent via Facebook saying "[x] wants to be your friend". Contained within the email were suggestions for about a dozen other people she knows, some of whom were family members who had no contact whatsoever with the person who sent the invite. The only way this could have happened is that the family members also used the Friend Finder, and Facebook stored all the connections for future use. Basically, Facebook has a sort of dark network underneath its world-facing one to which you have no access and can't opt out of, Facebook account or not. If you have an account you can delete all your Friend Finder history, but this doesn't really help you if you choose not to have a Facebook account, or if someone who has your email address has previously used the Friend Finder.

Back to photos, you may already know that when a digital camera takes a photo it stores lots of information about the camera as hidden data within the JPG file. The time, the date, the camera settings, make and model. Smartphones with GPS often geo-tag images, meaning that the location in which the photo was taken gets stored as well. When you upload images to Facebook, it processes them to optimise them for web use, and this includes removing meta-data - download a photo from Facebook and load it into an EXIF viewer and you'll see it has no meta-data whatsoever. However, recently Facebook have started trying to encourage people to 'check in' to places they've visited and occasionally you'll get one of your photos shown to you with the message "this photo looks like it was taken in [y]". It gets this information from the geo-tag, which it's been storing, inaccessible to you or other Facebook users, since the photo was first uploaded. It's not that Facebook are trying to do something clever with the geo-tag information, it's the fact that they're clearly storing meta-data and not telling anyone that I have a problem with.

There is a movie called The Social Network, which tells the story of the creation of Facebook. The opening scenes show founder Mark Zuckerberg building a collection of photos of every Harvard student without their knowledge or consent, and hosting it on a public server for everyone to see. Zuckerberg's complete contempt for anyone's privacy is illustrated further in an infamous leaked IM conversation between Zuckerberg and an anonymous friend. He offers his friend personal info from Facebook's database. When asked how he got the data, he simply replied "They 'trust' me. Dumb fucks." Zuckerberg is still running Facebook, and probably has complete access to all sorts of information about you, whether you use his website or not. At least the information Google collects is used in their products and services to their users, and not just hoarded away where only the site admins can see it. Google even has a dashboard feature where you can see exactly what information they have on you and with whom they're sharing it, which gives you the opportunity to delete information if you don't want it shared. Facebook has no such feature.

So, to summarise: Google take your information, are completely transparent about what they're collecting and how, and give you something useful back in return. Facebook take your information, often without your knowledge or consent, fuse it with information they've conned out of your friends and family, and then hide it away, sometimes even denying they have it. It's not really surprising that I trust Google more.

Translucent Privacy

Just recently there's been a lot of hoo-hah about information privacy. I think it started with the almighty cock-up at ACS:Law - effectively they were hacked and all their company email was leaked onto the internet. The emails contained lists of people accused of online piracy (that's accused, not convicted). Now there's legal challenges left right and centre from ISPs against legal firms trying to get customer information so they know who to sue. The farcical Digital Economies Act obliges the ISPs to simply hand over all information requested, but then that's what you get for passing a piece of legislation that most MPs clearly didn't bother to read.

DEA rant aside, I've received a lot of privacy-related stuff from lots of companies recently. My ISP has contacted me with a copy of their privacy policy, and my credit card company has done the same. Any company of which I am a customer I have actually looked for their privacy policy. And although they give lots of information - my credit card company for example gives two A4 pages of text about what information they collect and store, how they collect it, how it's used, etc - none of the privacy policies I've seen so far actually answer the two most important questions I have about my personal data: how it's stored, and who has access to it.

I got a sales call from my phone company the other day, they asked me how much on average I spend a month. I simply answered "if you really are from my phone company then you can tell me", to which I was told that the sales team only have access to names and phone numbers, not to actual customer records. Which actually annoyed me. Firstly, if they had access to this information they could tell I spend very little on my phone bill and am therefore highly unlikely to want to upgrade to a more expensive service. But secondly and more importantly, this implies that the information the phone company actually owns, ie my phone records, is treated with a higher level of security than my personal details. I'd love to know exactly what parts of my personal information are accessible to which parts of the company, but the privacy policy makes no attempt to tell me, and if I perform a freedom of information request I'll only get the data they hold on me, not who has access to it.

Additionally, the ACS:Law cock-up happened because ACS:Law don't encrypt their internal email. Not only that, but BT have since admitted that they've sent customer details across the internet in plain text email without using any encryption or security whatsoever. This genuinely concerns me, and I'll certainly think twice about using BT for anything in the future. But what worries me the most is that BT and ACS:Law clearly both have a very lapse attitude to information security - so how many other companies have the same attitude? You can't tell simply with a freedom of information request or a privacy policy if a company has a competant information security policy... or indeed any security policy at all.

My solution? Simple: along with each privacy policy should be an information security policy. In the same way that a company is not allowed to store personal information unless they provide a privacy policy outlining what information is collected and how it is used, I believe that no company should be allowed to use, collect or store personal information unless they also provide an up-to-date document describing their information storage systems, what level of security is being used, and who has access to it. Perhaps there should even be a requirement that anyone storing personal info should be required to make their security systems available for independent inspection, although I see how certain industries (ie defence) might have a legitimate problem with that.

I think the biggest problem with storing personal information in the digital age has nothing to do with evil intent, it's ignorance that's the biggest problem.

Tweeting Television

I was going to do a post on tweeting TV a while back, after reading Krishnan Guru-Murthy's blog post on the subject. Now the BBC are on the bandwagon too, I thought I'd put in my thoughts on the matter.

For those who've not experienced a TV show 'augmented' with Twitter, then please do. Even if you don't use Twitter, you can use services like monitter.com to view live feeds of tweets containing a particular term. On twitter we have 'hashtags' to denote subjects, and many TV shows actually display their officially recognised hashtag on the screen at the beginning. For example, Watchdog is #bbcwatchdog and Have I Got News for You is #hignfy. The Apprentice (#bbcapprentice) is particularly entertaining if you are watching the show while at the same time sat on Twitter; some of the comments from various people better than the show itself, and of course Twitter users can get away with saying far more offensive things than can be broadcast on prime time BBC1. I actually had the idea a while back to write a VLC plugin or something that cottons on to what you're watching, determines the appropriate hashtag and displays tweets on-screen alongside the TV show, but that's a "to do" for me and I'm sure someone else will do it quicker and better than I can, if they haven't already done so.

So in all, I think tweeting TV shows is great. But there is a problem - not everyone gives a shit. I follow over 100 people on Twitter, all of whom are interesting and/or funny. But some of them occasionally post streams of drivel about a TV show I'm not watching or in which I have no interest. A top example is the X-Factor (#xfactor). My views on a rigged karaoke contest run for Simon Cowell's personal benefit aside, some TV shows just aren't interesting to everyone. Heck, I'm sure every time I tweet something about Doctor Who I get people thinking of unfollowing me. You can block users, why not hashtags? Twitter could even sell statistics to the TV companies for market research purposes, how cool would that be? You could tell how popular a show is by comparing hashtag uses with hashtag blocks. And at the same time, even the most considerate Twitter user would be more eager to tweet about what they're watching knowing that their followers have the ability to block the hashtag if they don't care about it.

So there we go - my to do list. Implement Twitter client with 'hashtag block' function, and implement some kind of hashtag detector using the BBC's linked data. I may be some time.

What I meant by Proper Coffee

I've been known to gush in the past when I find a coffee shop that sells what I consider to be 'proper' coffee. I'm also famous for my hatred of Costa and Starbucks. This is not an anti-capitalism thing, they simply sell coffee I consider to be very poor quality. Starbucks in particular are well known for their brewing method of burning the beans so that they can happily change bean or supplier and not affect the taste of the coffee, because all individual flavour and character from the beans is removed when they're burned. I don't know about Costa, but judging by the taste of the stuff they probably do the same thing.

It's also come to my attention that an espresso is nowadays considered to be a coffee. I disagree, albeit only in the way that a Coke is not a Pepsi. Yes, it's brewed with the same type of beans, but it's done at high pressure to get the maximum strength out of it. Italian coffee, usually brewed in this way, has come to be considered a deliacacy, but I personally can't stand it, in the same way that I don't actually like belgian chocolate. That's my personal opinion and I'm fine with the fact that I'm a minority. But espressos can be modified in so many different ways, to the point that trendy coffee shops simply sell variations of one espresso and call it variety, and it annoys me that so many so-called 'coffee shops' actually have bugger all in the way of variety, and society considers this acceptable.

Let's just have a bit of a rundown, shall we?

| Espresso | A small 'shot' of coffee, pulled at high pressure. | | --- | --- | | Lungo | An espresso with double the water | | Americano | An espresso with water added to it | | Latte | An espresso added to frothy milk | | Cappuccino | An espresso with frothy milk and chocolate on top |

See the pattern here? That's right, it's all just bloody espresso. I bring Starbucks and Costa into the argument because they take it to the nth level, you can get all sorts of weird and wonderful caffiene-based drinks and it's all made using the same coffee. It's like a pub only having one type of lager but claiming variety because they sell lager, lager shandy, lager and lime and lager tops.

So what do I consider a proper coffee shop? Well, one that serves more than one variety of coffee basically. I personally like my coffee either drip-brewed or brewed in a cafetiere. Good coffee is like good whiskey, you need to start with a good bean, and brew it properly. Also like whiskey, blends are acceptable. Personally I like medium roasted single-bean Nicaraguan coffee, but I'm quite partial to Taylor's Lazy Sunday as a blend. I do hate espresso though, and I certainly don't like the 'trendy' coffee shops that are becoming more common across the western world. It's a rare treat to be able to sit down and try several different coffees, I remember the most pleasant flight delay I ever had was at Cologne-Bonn Airport in 2011, the coffee shop there has coffee from all over South America. I recently found a similar cafe in Edinburgh. Sadly, for me at least, this is the exception rather than the rule - you ask for coffee in most places and you just get an americano. So next time I'm ranting about 'proper coffee', you know what I'm on about.

Why I Won't Sponsor You

Just recently, everyone seems to be taking up long distance running. Nothing against this, obviously, it's a good way to keep fit. The London Marathon has been running (pardon the pun) for years, and people generally do it once and get sponsored to do it. But I agree entirely with David Mitchell's views on running marathons for charity. Why should I as a sponsor pay you to do something that you probably enjoy doing anyway? Hundreds of people go running weekly, even daily, and don't expect to be sponsored. I'm happy to give money to charity, and I do. I just don't see why just because you've decided to run a race, I should give my money to a charity of your choice rather than mine.

As an aside, people generally have a kind of pro-charity bias. A while back I started suggesting the Mafia do a naked calendar. I've got lots of people interested already (OK, Kath is interested already, but I'm working on others). Thing is, every time I suggest it, people say "that's a great idea, you should do it for charity!". No! I should do it because I think it'd be funny! And if there is going to be any financial benefit in doing so, why should I give it all away?!

But I digress. The point of this rant: the Race for Life. If you're running the Race for Life, I have no problem with you. In fact I support you 100%, by all means do it. You'll get fit, you'll feel good, there are no reasons not to do it. But don't expect me to sponsor you. Why? Well, firstly everyone seems to be doing the race for life. If I sponsor you, I've got to sponsor everyone else I know too. Suddenly I'm giving away a month's disposable income in one whack, assuming I don't want to default on my mortgage. Secondly, I don't support cancer research, it gets more than enough money. The reason we don't have a cure for cancer is that the research is still ongoing, not because it's underfunded. There are plenty of companies investing in cancer research because they stand to make millions once a cure is found. Throwing more money isn't going to speed anything up, and that money would be much better spent on other things which kill people or make lives miserable, such as Alzheimers, or AIDS, or human rights abuses. If you want me to sponsor you and you're giving the money to Alzheimers Research UK or Amnesty for example, I'm much more likely to sponsor you because they're causes I support, but by its very definition the Race for Life is run by Cancer Research UK, and therefore you kinda have to give your money to them. Third, see David Mitchell's video, linked above. As he rightly says, long distance running is an incredibly inefficient way of raising money. If you were to put aside all that training time and get a second job, you'd make far more money than you could do in sponsorship. I've done only one mad charity thing in my life - shaving my head. It took five minutes, no effort, and I made over £1,000 in sponsorship which I gave to a local charity that provides support for terminal cancer victims. Training for a race takes months, if you made £1,000 every five minutes you could buy most medical research centres. And one final, albeit petty reason for not supporting the Race for Life - I don't like the word 'race', it implies competition. Surely lots of people supporting a common cause doing something special together is a co-operative event, not a competitive one.

So please, if you ask me to sponsor you to do the Race for Life and I decline, don't be offended. I'm not heartless, I'd simply rather give money to charities that will benefit more from my donation. And, noble and selfless though your actions are, I'd rather give to charity for my own reasons.

Why I don't shop in Boots

I've not shopped in Boots for ages, for reasons I will give in this post. Most of this information is available elsewhere on the web but it was only this morning, when I was accused of being grumpy for moaning about them that I decided to actually type something to justify my alleged grumpiness.

Firstly, the obvious, price. A box of Boots own brand Ibuprofen is just under a quid, I can get the same thing in my local supermarket for less than 30p. Ask any doctor and they'll tell you that ibuprofen is ibuprofen, and they're probably all made by the same company anyway.

Secondly, the tax issue. The current government are cutting things left right and centre (specifically within the NHS) while various big companies get away without paying much tax. Boots is one of them, thanks to their move to Switzerland a few years back. In fact, it's estimated that Boots' tax avoidance costs the UK economy £100 million a year ... imagine how many hospitals could be built or maintained with that money. Basically, if I lived next door to an individual who was screwing the system that I pay for through my taxes, I'd report the bastard. And as I can't really report Boots because the government already know (and evidently don't care) that they're tax-dodgers, I do the next best thing which is to make sure they get none of my money and encourage other decent taxpayers to think likewise.

Thirdly, they're bullshit peddlars. Fair enough, selling mythical crap like magnetic bracelets isn't really a crime, but the website quite clearly claims that the product "allows oxygen and our own natural pain and stress relief chemicals - endorphins, to flow more efficiently around the body, helping to combat free radicals, pain, stress and fatigue", when there is absolutely no evidence to suggest that this is true. In fact, in the US it's illegal to market magnets as medical devices for precisely that reason. As if this isn't enough, they also hide adverts within their "Web MD" site, a site supposedly offering medical advice, which in some cases is just plain dangerous. For a great example, see this page, a 'myth vs fact' type page arguing that sugar at breakfast time is actually perfectly harmless. The document, despite the small disclaimer saying the content is provided by their sponsor (who happens to be Kellogs, the breakfast cereal manufacturer), reads like a genuine medical guide, with references and everything. It's only when you actually bother to check the references that you discover that their main source is a paper by 'nutrition consultants' Sig-Nurture. The firm's website claims that their business is "to strengthen the evidence-base for your company’s policies, strategy, marketing and claims", and the paper being cited clearly states that the work was supported by a grant from the Kellog company. So much for actual science, then.

Don't get me wrong, there are other companies that probably deserve boycotting just as much as Boots. Vodafone recently had their tax bill written off, costing the taxpayer billions. Philip Green, CEO of the Arcadia Group which owns Top Shop, BHS, Dorothy Perkins and many other well-known high street chains, gets around his tax bill by having everything he runs channeled through his wife, who lives in Monaco. And at least Boots do actually sell real medicine among the new-age alternative homeopathic horseshit, unlike Julian Graves or Holland and Barrett. But I just feel that Boots have let me down, almost to the point of offending me, in many ways and they don't deserve my custom. If me giving a shit about the economy, science or the contents of my own wallet can be construed as grumpy, then so be it.

Why a tax on fizzy drinks would be a stealth attack on the NHS

There have been lots of proposals in the past to tax unhealthy food, particularly fizzy drinks. Just recently the Academy of Medical Royal Colleges has called for quite a lot of things that sound quite sensible to me. A ban on adverts for unhealthy food before the watershed is probably a good thing, and extra government money for weight loss surgery is a proactive thing to do in a supposedly increasingly tubby society. But there are a few things I'm not so sure on. Firstly, a ban on fast food outlets in hospitals sounds sensible at first, but I imagine the hospital in question rents its space out to McDonalds and Burger King at quite a high rate, so unless there's something else with which to fill the space, this might not be as clever as it sounds, financially speaking. But the biggest problem I have is with any suggestion to tax unhealthy food or drink.

To be honest, I have a real problem with anyone who moans at obese people for health reasons. You see shows all the time on Channel 4 showing the effects of over-eating, and they all contain the same claim: that over-eating is costing the NHS millions per year. That may be true, but if you use this argument to tax unhealthy food, surely there needs to be a tax on every football sold! After all, playing football increases your risk of pulled muscles, twisted ankles and even broken bones, which must cost the NHS quite a bit every year too. If you victimise fat people for costing the NHS money you must also victimise sportspeople, and people who work in high-risk jobs such as firefighters. Arguing that any one portion of the population is costing the NHS more money than another is completely missing the point of the NHS in the first place. Sure, we could charge people based on how high a risk they are according to their lifestyle, but if we were to do that we may as well scrap the NHS and everyone can sort out their own private medical insurance.

Of course I'd never suggest such a thing - I'm not fond of nationalism, but I do confess to having a certain amount of pride when I tell people that I live in a country where anyone, rich or poor, can see a doctor and get fixed if they need to. Health is something that simply cannot be left to the private sector, as their priority is to make money rather than making people better. If the NHS were to disappear there are large numbers of people, almost certainly some of whom you know and love, who would suddenly not have access to healthcare, either because they can't afford it, or because they have pre-existing conditions that make private medical insurers wary of covering them. I cannot stress this enough: we need the NHS. It is the single greatest thing about the UK.

National Insurance is a tax. It is paid by all who can afford to do so. In return for this tiny contribution, we get the NHS. If we start taxing people more likely to end up in hospital at a higher rate (and this includes taxing things that are considered unhealthy) then we're undermining the integrity of the NHS. Any one of us could end up needing urgent medical treatment tomorrow, and yes, many hospital visits could probably have been prevented if the circumstances were different. You may not have needed that stomach pump if you hadn't got drunk. You may not have needed that heart surgery if you'd have kept your weight down. You wouldn't have broken your leg had you not been playing football. The beauty of the NHS is that it doesn't care about blame, it just makes people better. That's a beautiful thing, let's not lose it.