Inputs & Outputs (Troy Davis, Seattle) http://troy.yort.com Most recent posts at Inputs & Outputs (Troy Davis, Seattle) posterous.com Sat, 03 Sep 2011 08:48:00 -0700 Towards a transparent wireless carrier customer dashboard http://troy.yort.com/towards-a-transparent-wireless-carrier-custom http://troy.yort.com/towards-a-transparent-wireless-carrier-custom

This is the mobile carrier customer dashboard that I want. The annotations tell the story.

I'm hoping that at least one of Sprint, T-Mobile, Verizon, or AT&T will eventually realize that transparency is a differentiator (if only because they run out of other ways to stand out). Most of these dashboard elements are possible with existing data that carriers already collect, and in some cases already have in this form for internal use.

This shows two variations on the same dashboard landing page. Click for larger versions to read the annotations.

Cell_1_annotated-2
Cell_2_annotated-1-1

Same wireframes as a Flickr set.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 28 Aug 2011 10:52:00 -0700 One-click Canon PIXMA MX870 scanning in OS X http://troy.yort.com/one-click-canon-pixma-mx870-scanning-in-os-x http://troy.yort.com/one-click-canon-pixma-mx870-scanning-in-os-x

RSS readers: ignore this. Just documenting this fix for anyone else who has the same problem.

Problem: Canon PIXMA MX870 says "Set the PC to start scanning" when the "Black" or "Color" scan start buttons are pressed.

How I enabled one-button scanning

1. Install most of the OS X drivers and software from canon.com. I think I installed all of the drivers, or at least ran their downloaded installers. As of this writing, that's ICA Driver, CUPS Driver, Scanner Driver, Mini Master Setup. I also installed MP Navigator and IJ Network Tool from the software downloads. Reboot.

2. After installing the "Canon IJ Network Scanner Selector," a printer/scanner icon should appear in the dock. The installer sets up the app to run at startup, which I left enabled. The dock dropdown "Scan images using the operations panel of the scanner" option is enabled. The scanner MAC address is listed and selected in "Open Settings":

Scan-from-pc_settings
Scan-from-operation-panel_settings

3. Run MP Navigator (3.1) and on the main menu, there's an option in the upper right "One-click." Mouseover it and a different menu will be shown, including a "Start scanning by clicking the button" checkbox. This was not the default. I wish I was making this up.
Canon_mp_navigator_ex_-_mx870_series_-

4. On that MP Navigator One-click screen, click Preferences. Note that you may have 2 entries under "Product Name" ("MX870 Series" and "MX870 Series (Network: <Your MAC>)." I disabled "Compress scanned images when transferring" for both product names. On the Scanner Button Settings screen, I changed the paths under "Save to PC" but didn't make any other changes.
Preferences-1
Preferences

5. After making these changes, I was still seeing "Set the PC to start scanning" when I tried to scan. I shut down MP Navigator and restarted the printer (with the PC on) and it started auto-scanning. I didn't restart the PC except after step 1. I'm not sure whether the problem was a one-time issue because the settings changed or a recurring one with the order that they were originally powered on.

Notes

My scanner LCD options (Document or Photo, DPI) are interpreted correctly. Scanning PDFs from the document feeder and bitmap images from the platen both work. Bitmaps from the ADF are not supported (the scanner says to use the platen). I haven't tried PDFs from the platen.

Tested with: OS X 10.6.8, Canon IJ Network Scanner Selector 4.5.0, MP Navigator EX 3.1.3, MX870 driver 10.51.1.0.

Here's the printer options from System Preferences. I didn't make any changes:
System_preferences
System_preferences_driver

 

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 12 Jun 2011 16:42:00 -0700 Zipcar Prize proposal: user-sourced car sharing planning algorithm http://troy.yort.com/zipcar-prize-user-sourced-car-sharing-assignm http://troy.yort.com/zipcar-prize-user-sourced-car-sharing-assignm

Zipcar customers must return a car to the same parking spot that it was borrowed from. That means customers must rent (and pay for) one specific car for their entire trip, even when it will be parked in an urban area for many hours during the trip.

In 2009, I emailed Zipcar about cloning The Netflix Prize for a similar purpose: crowd-sourcing (really, expert-sourcing) a set of algorithms, incentives, and restrictions that would let Zipcar offer one-way rentals. Like Netflix, The Zipcar Prize would release an anonymized set of trip data, parking space locations, and an evaluation method (which might emphasize certain aspects, as Netflix did).

This would be a mix of:

  • incentives: "We'll discount $2 for returning it a mere 5 blocks away from your preferred location"
  • fees: "Returning to this location will cost $4 more"
  • enforced policies, like: must reserve 1 day in advance; one-way trip can't leave a lot empty; only offered at certain urban lots (initially)

The email after the jump has lots more details (slightly formatted and edited). As far as I know, no one has tackled this. Zipcar hasn't and I didn't receive a reply.

The first car-sharing service to pull it off will have an amazing competitive advantage: paying for only what you actually need and the ability to get a car to the right place at the right time.

 

Hi <Zipcar executive>,

Hope this finds you well. I signed up for Zipcar and found that it didn't have the killer feature for me: the ability to return a car to a different lot, even if that spot had to be selected at reservation time. This tweet has a bit more.

Nothing new there, but here's why I'm emailing. Wishing for this feature (and not finding it in the FAQ) led me to wonder whether, as a technical and generally creative guy, I could try my hand at a skunkworks location/availability optimization for returning cars to a second location. Specifically, at:

  • minimizing additional parking spaces
  • maximizing availability of at least 1 car at every lot
  • minimizing distance between user's requested destination lot and system's permitted destistination lot

The first hard part is getting a machine-parsable, anonymized rental history and lot locations, which is why I'm emailing. With an anonymized rental history (where users are identified by GUIDs) and "home" car locations, I or anyone could make 5 or 10 fake scenarios where some percent of users request different destination lots at time of reservation.

It could play out like a Netflix Prize for scheduling. Zipcar would get a ton of press, customers would try to solve one of your most intriguing scale problems, it would go a long way to associate Zipcar with open source and open government (which the Flexcar brand had a stronger association to), and it would cement Zipcar's justification for a $50 late fee as necessary rather than onerous.

At least in metro Seattle, I think you have enough cars to pull it off, especially with a few restrictions, like that you can't return a car to a different destination lot when it leaves the origin lot empty (because all other cars there are already reserved). That restriction would reduce - potentially avoid - any decrease in local coverage, preserving customer satisfaction.

Moreover, that restriction would motivate people to make one-way reservations farther in advance, which would let the system guide folks to alternative destination lots ("You're starting in Ballard. We can't let you return it to 4th & Wall, but we'd love for you to return it to 2nd & Vine 5 blocks away.").

I could even see a $X tax on same-day alternative destination lot reservations, although that negates some of the long-term value it would create for Zipcar. Eventually, you'd want everyone using this with reckless abandon, since it turns customers into your car gofers and makes otherwise-impractical trips affordable.

If something like a Netflix Contest is interesting, or you already have these data files), please let me know. 

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 12 Jun 2011 15:22:00 -0700 2 common problems with OAuth client libraries http://troy.yort.com/2-common-problems-with-oauth-client-libraries http://troy.yort.com/2-common-problems-with-oauth-client-libraries

I posted a long explanation to the fusion-tables-users group about using third-party libraries with Fusion Tables over OAuth. It might also help folks debugging OAuth problems or adding OAuth support to existing libraries. Full text below.

Just an update for the archives and anyone else debugging this. I went through the Python example and it does work for POST requests in the body. I tested CREATE and INSERT.

Here are the 2 things that were tripping up the Ruby GData library coupled with someone's monkeypatched OAuth auth_handler (GData::Auth::OAuth). They basically boil down to not being designed for, or frequently used with, POST requests. From skimming other libraries, these problems are endemic to lesser-used OAuth libraries.

Here goes:

1. The GData::Auth::OAuth only pulled out GET params from the URL, not POST params in the request body. POST params need to be sorted alongside the OAuth parameters when creating the signature base, so this immediately made my signatures invalid.

I saw a couple causes for this in other libraries:

  • designing for GET and then exposing a convenience POST method as an afterthought (without looking at the body params)
  • one person wrote the HTTP client, another wrote the OAuth signer, and a third wrote the Fusion Tables library or GData extension, and a corner case got missed (or callers can sign requests before a body is even defined)

2. Most language built-in URI encoders are designed for x-www-form-urlencoded, with spaces as plus characters. OAuth wants everything UTF-8, ie U+0020 or %20 for space. The confusing part for Fusion Tables is that this works in GET requests: select+*+from+317391+limit+1

.. but that space encoding won't work in OAuth signature hashes (and thus not the request body itself), and will show up as 401 Unauthorized rather than an app error. If you're adapting an existing Fusion Tables library to work with OAuth, this is something to consider.

Finally, if it helps anyone, here's a signature base string for a CREATE statement (private values replaced), for the table schema in the Python example code:

POST&http%3A%2F%2Fwww.google.com%2Ffusiontables%2Fapi 
%2Fquery&oauth_consumer_key%3Ddomain.com%26oauth_nonce 
%3D75556368%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp 
%3D1305155510%26oauth_token 
%3D1%252F98y2rqyfdfhuaiheworh327rahyADYSAIYuioydadio%26oauth_version 
%3D1.0%26sql%3DCREATE%2520TABLE%2520%2527data.csv 
%2527%2520%2528%2527col2%2527%253A%2520STRING%252C%2527col3%2527%253A 
%2520STRING%252C%2527col1%2527%253A%2520STRING%2529

that signature string is for the param:

sql=CREATE+TABLE+%27data.csv%27+%28%27col2%27%3A+STRING%2C%27col3%27%3A 
+STRING%2C%27col1%27%3A+STRING%29

I've tested OAuth POST requests sent as the HTTP Authorization header as well as in the body of the POST, and both work.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 29 May 2011 15:57:00 -0700 6 tasty sandwiches in Belltown http://troy.yort.com/6-tasty-sandwiches-in-belltown http://troy.yort.com/6-tasty-sandwiches-in-belltown

Guest posted on BelltownPeople.com: "6 great sandwiches in Belltown" (Seattle neighborhood). Copied below.

Here's a few well-executed sandwiches in or near our 'hood. Using the most liberal possible definition of "sandwich" and in no particular order:

1. El Cubano, Cyclops

Sweet meets savory: "Roasted pulled pork, sliced pit ham, Jarlsberg cheese, thin sliced pickle, dijon mustard and poblano aioli on a grilled ciabatta." Early-afternoon weekend brunch material here.

2. East Coast or Chicken Chipotle, Mike's East Coast Sandwiches

Fresh off the panini grill at Cafe Two at Antioch College (with Stumptown drip coffee), Forza Coffee at Fisher Plaza, and Motore Coffee (9th & Lenora).

3. New Town Special, New Town Market

I recommend smoked turkey instead of peppermill turkey. The same Boar's Head menu is available at Westlake Specialty Market (7th & Westlake).

4. Your custom deli sandwich, ordered online, Specialty's Cafe

Use their sandwich configurator to build a custom sandwich, then order and pay online for pick up in 15 minutes (yes, this actually works!). It's like they timed a leisurely walk from Belltown to 5th and Union. My pick: the Taguchi Goat Club.

5. Spicy Moroccan Pita, Zeitoon Cafe

"Dolme, hummus, tabouli, lettuce, cucumber, garlic sauce, house sauce, hot sauce and tzatziky." Pro tip: ask for light or no house sauce, and cut it in half before eating or you'll wear some leftovers home.

6. The Gaucho Dip or 410 Burger, El Gaucho Bar

The menu does its job: "Sliced Certified angus Beef prime top sirloin, toasted baguette, chimichurri aioli, english Coastal Cheddar, house au jus, taro chips." For 50% off, pair with a glass of wine and a friend (or an iPad) during "The Gaucho 120" (minutes of happy hour).

Enjoy!

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 22 May 2011 19:25:00 -0700 New RSS feed URL http://troy.yort.com/new-rss-feed-url http://troy.yort.com/new-rss-feed-url

If you're reading this via RSS, please change the feed URL to: http://feeds.feedburner.com/troydavis

I'll make the old URL 301 redirect for a few weeks, but that's not enough for some RSS readers to update their subscriptions (Google Reader, I'm looking at you). Cue manual labor. Paste in http://feeds.feedburner.com/troydavis and you should be good to go.

 

 

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Fri, 20 May 2011 08:22:00 -0700 A bit about preventing toll fraud http://troy.yort.com/a-bit-about-preventing-toll-fraud http://troy.yort.com/a-bit-about-preventing-toll-fraud
Recently posted this reply to the voiceops mailing list. Pasted below or read the original.
On Tue, May 17, 2011 at 3:53 PM, Darren Schreiber wrote:
> Hi folks,
> We have been hit twice in the past two days with calls to 011-252-XXXXXXXX
> (calls to Somalia I believe, and the originating IP is from Pakistan)
 
Others have suggested NCC-specific firewall policies. I'll put in a plug for using per-country-code dialplan routes and omitting really expensive countries.

Obviously that won't work for worldwide wholesale transport carriers. For everyone else, the most expensive CCs to call aren't worth the trouble. There are very few folks with legitimate needs to call, say, Sierra Leone, that aren't served by Skype. They don't represent enough revenue to justify the risk.

Those few legit higher-volume folks are willing to prepay using reliable methods. They're usually apologetic that their countries receive enough fraudulent calls to need such a policy.

Basically scroll through http://www.voicetrading.com/en/calling-rates.html and omit routes for any country that's had a civil war in the past 20 years. Fringe benefit: when a country code splits, you won't get caught with a rate deck hole (see Timor-Leste, St Maarten).

If you want to get slick, have a call attempt to those country codes page your admins as a honeynet (honeyroute?). Somebody's probably up to something.

Doesn't prevent calls to expensive mobile routes in countries you do reach, they're just a lot less interesting to fraudsters (woo, I can call Proximus!?) and the per-minute costs are mostly way lower.

Troy

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sat, 30 Oct 2010 07:56:00 -0700 From concept sketches to live Web page http://troy.yort.com/from-concept-sketches-to-live-web-page http://troy.yort.com/from-concept-sketches-to-live-web-page

I uploaded a few concept sketches, a final sketch, a final wireframe, and the end result of Cloudvox's home page redesign. They're in this Cloudvox Flickr set with some annotations.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Wed, 14 Oct 2009 04:53:00 -0700 Notes on "What Makes Startups Succeed" discussion http://troy.yort.com/notes-on-what-makes-startups-succeed-discussi http://troy.yort.com/notes-on-what-makes-startups-succeed-discussi

4 VCs, a moderator, and a roomful of people. Here's the gist.

Now that we've publicly launched Cloudvox, and anyone can use it (and buy it!), I finally get to see the outdoors again. I went to this panel on 10/14/2009 and took as many notes as I could. I missed some things, and tried not to take any comments out of context.Who

Moderated by Dave McShea of Perkins Coie in Seattle. Notes are chronological over 1 hour. Bold is mine.

 

How do you evaluate a company as an investor?

Sack:

"Accelerating on the downhill" (recession) as much more more important than speeding uphill

Higgins:

With right customers, recession means prospects are reevaluating costs, chance to stand out. Cheaper inputs (staff).

 

What mistakes do you see often?

Higgins:

1) Business plans hard to understand. Entrepreneur unwilling to synthesize down to the real bet they're making -- might mean they don't know it.

2) "We don't have any" competition. Generally that's "meeting over." Too narrow def of competition.

3) Under-rating domain expertise when they have it/have been the customer

4) Not realizing VCs treat a meeting like an interview or date. Can you work with together deeply? Listen! Don't pitch/sell. Testing reactions, pushing buttons.

Mathieu:

Describe investment as series of risks - then help investors calculate market price for your risks.

Not getting 2nd meeting probably means risk higher than you think.

80% * 80% * 80% (series of risks) is worse odds than a coin flip. How can you extract the risks?

Ashida:

Team reduces risk - have these people worked together? Experience is risk mitigation

 

What constitutes differentiation?

Ashida:

"In the eye of the beholder."

At Housevalues there wasn't a patentable one.

Likes technical barriers. Stuff that's hard to do. Doesn't have to be patentable.

Marketing barrier "not as confident that it's sustainable especially on a national basis."

Barriers are truly lower with SaaS: domain/customer expertise must be strong differentiator "because it's just software"

 

Audience: At Amazon, Bezos ranked 25 things to sell before choosing books. How do you sell?

Higgins:

Book market incredibly fragmented, easy purchase.

Contrast with selling infrastructure to mobile where 5 guys decide your success. Consider: Do customers tend to buy new stuff?

Who are adjacent players?

Often best to find industry with lots of established players who just haven't picked up on changes. Like unmanned airplanes (Insitu).

Had tailwinds: Gov't wanted it, incumbents culturally unable to do small cheap product. But run when big player decides it's strategic. Elephants will step on you.

Mathieu:

With BetterBills, Seattle City Light finance group loved new bill format, but 6 months of customer delay.

Competitor emerged who realized that motivated customer was conservation group, not accounting.

Ask who's truly motivated to buy

 

Cash is king. How do you evaluate capital requirements and manage cash?

Mathieu:

Cash matters first, then changes to cashflow (they merge).

You hear all this advice: banks will only give you money when you need it, raise more than you need.

All Star started with $200k. Got profitable in 3 months, went into 2nd market.

From cashflow positive to losing $50k/mo. Wife caught on.

2 changes fixed: 1) marketing must break even on performance 2) tie customer price to your performance.

Cashflow doesn't go away 5 years in, profitable, new controller made many millions worth of payments on same day. Balance -$200k.

Use prepay and annual subscriptions. Biggest customer prepaid quarterly and cut need for outside capital

Sack:

Yeah cash management matters, but so does time: wasting a year of founding team!

No bank balance to measure this. Certain period to see evidence that dream can be reality (~3 years).

"Like cash, time is a resource that goes away"

One company: had epiphany 8 months in, changed directions, 18 months in.

Not exactly where they wanted to be. Should we change again?

No! Won't have made any progress before losing confidence.

 

What VC trends do you see?

Ashida:

Critical how you get money. VCs running out of money - so much budgeted for existing investments.

A year behind and all need 1 more round. Not all portfolio cos are covered.

Non-participating VCs will get crushed. Reduced to common, 10:1 reverse not uncommon

Also 1 person stuck writing $5mm check is way higher bar than 3 sharing.

Finding new outside VC is hard when tainted by non-participating existing VC

I'm probably going to be here long after you're gone (longer than founders).

No escape for us: 7-8 years

 

What habits should entrepreneurs use or avoid?

Sack:

Recurring rituals. Write out and book on calendar.

Daily: blog, tweet, the 1 thing that must get done today.

Weekly: Sun night look at week ahead and pick 1 priority for week.

Quarterly: take time off. Have a weekend.

Mathieu:

Know yourself.

What types of stuff do you just have to grind through? Know what's missing in you and patch holes

Had demo of alpha-stage niche site. Missing: had no idea of was whether anyone would pay - a must fix.

Told entrepreneur "When you leave you're going to go home and say 'I should talk with customers to see whether they'll pay, but first I have to fix this bug and add these features...'".

Not bad thing as long as you know and fill.

Higgins:

After 3 people, entrepreneurs under-manage.

Board emails: at least 1 a week.

Ashida:

1 page "plan of record" so when staff overhears stuff, have reference that plan is not changing. A little formal.

 

What's the 1 big mistake that comes to mind?

Ashida:

"I'm good at this" when it's clear you're not.

Either mis-representing, or poor self-awareness.

Also not asking what customers actually think. Too much trust where a technology appears to fit w/o asking

Sack:

It's not a pitch, it's a conversation.

Engage. What is investor truly interested in? Ask them stuff!

If I leave without having talked, I'm not engaged.

 

Revenue forecasts are a shot in the dark. What should I do?

Higgins:

Agree. Somebody told entrepreneurs that 3rd year should be profitable.

How much does it cost to learn/get to the point where you have some confidence?

Sack:

Forecast is to get comfortable playing with model and levers.

See/tweak unit economics.

Higgins:

Most businesses have an analog.

Sniff test, ie if you're a distribution company and are 10x more profitable than other distributors.

 

What are VCs looking for an in exit strategy?

Higgins:

Least successful slide - phrase "IPO or M&A" useless.

Generally look elsewhere when VCs gets particular about exit strategy.

Ashida:

Might disagree a bit. Security industry has many exits but small - $10-20mm, bought out in year 2.

Should inform your raise, plans. We look at P/E and P/S. Ethanol P/S <1, learn from it.

 

What's the weakest point of a recent deal you actually did? How did you address it?

Ashida:

2 guys from Microsoft. Missing marketing. That was big risk - need to find someone who works well with them.

Solved with a (one!) person.

Higgins:

Not sure it's working yet, but: invested in "3 guys and dog at UW."

Research risk. New ideas every day but maybe not towards product.

"Boring engineering management" stuff - runs an eng mtg every week. Dates, task list.

 

Really early seed-stage capital seems broken. What's the new model?

Ashida:

Disagree that there's not seed money for good ideas. I'm willing.

Symform was 2 guys. Met 7 months before.

More peer review from ideas in Silicon Valley: 95% of bad ideas there get killed by peers.

Sack:

Seed has gotten harder compared to 18 months ago.

"Deal that doesn't get done" is often the best deal: No (or much less) VC relaxes the pressure on revenue.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Wed, 30 Sep 2009 04:02:00 -0700 Opinions from Mark Anderson of Strategic News Service (SNS) http://troy.yort.com/opinions-from-mark-anderson-of-strategic-news http://troy.yort.com/opinions-from-mark-anderson-of-strategic-news

I went to a Q&A with Mark Anderson of Strategic News Service (SNS) and took down some direct and near-direct quotes Mark is unique for sharing fairly specific opinions; right or wrong, that's rare. Notes are chronological over 90 minutes. I tried not to take any comments out of context.

Unemployment:

"Economy has split" "Second-order problems caused by joblessness" "Large sea anchor attached to the American economy"

Currencies:

"Old religion: all currencies traded on open markets" "China and Japan will reverse" past positions (now want weak currencies; US not buying and they are starting to sell to local consumers) Currency buyers and sellers are nations now, making entirely deliberate choices

IP in Asia

"You will notice that IP is not strongly protected in Asia, and that is where all the action is now" "Don't bring the Coke recipe"

Q4 2009

"Q4 is being underrated by almost everyone" "netbook will be the best selling format ever" "I think it's going to be Windows 7" (vs. Ubuntu) "huge Christmas" "PC sales will be positive"

FCC

"Current FCC commissioner is great" (Genachowski)

USD Inflation

how to hedge against the dollar: buy tin for Peruvian shanties (joke) inflation a risk for many or all global currencies, not just USD "total liquidity pool was $36 trillion, and doubled it in 6 years" "huge car wreck that has to come up .. they all know it" "no one has ever done it [quantitative easing] right, so let's do it now" (central bankers perspective)

 

How He'd Distribute SNS in 2009

still probably use email, but hate spam, and still growing problem is identifying senders correctly, and "multiple levels of knowing one another" "it's not Facebook" "Someone's going to figure out what David Anderson [CEO of Sendmail] couldn't do"

Peak Oil & Energy

"there is no peak oil" "that little scam [peak oil]" "need consistent high price for oil. I'm fine with $80 plus or minus $10 for 10 years" "pricing umbrella to convert to something else" (besides petroleum) "ultimately I think energy ought to be free"

Countries as Investment Opportunities

"Australia .. Canada" "I hate Russia" "very careful elsewhere" of Russia (later): "all there is is corruption, kleptocracy, and resources"

Heathcare

"heathcare is destroying the competitiveness of our businesses" "what killed GM" (if you asked them) "I would get rid of all heath insurance companies .. I would dissolve them" "I feel no fear from starting from scratch"

What Problems & Opportunities Keep You Awake at Night?

"market manipulation" "inability of nation to respond to problems" most important trend: "about 2 billion people rise up from UN poverty level of $1/day .. to $2/day or $4/day"

Boeing

"I think Boeing is dead man walking" used to know "never to take crowd jewels of IP outof the country" "EADS has forced them to this" competitors will "all be 10 years [behind]" .. "sounds like General Motors to me" "biggest customer just became biggest competitor"

Smartphones (iPhone specifically)

"Steve's done the world a favor by striking this deal with AT&T" "the best software platform we've ever dreamed of" (smartphones)

Africa

"I don't know" (how to make it self-sustaining)

American Empire

"Yes we are in the decline of the American empire" "we deserve what we got" "we aren't as smart as we think we are" "our promise is so high and our achivement is so low"

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Fri, 25 Sep 2009 13:56:00 -0700 Towards BPM-based "Exercise Radio" Stations http://troy.yort.com/towards-bpm-based-exercise-radio-stations http://troy.yort.com/towards-bpm-based-exercise-radio-stations

Someone, somewhere has the metadata and music chops to deliver BPM-based radio streams. DJs and gym rats will follow. A couple ideas.

The closest are Echo Nest's API (get_tempo) and Last.fm's API (Track.getInfo). Echo Nest's requires uploading the song audio data (which I don't have). Last.fm's can be queried with metadata (artist+song name) yet doesn't provide BPM. This NYTimes Gadgetwise blog post has local file (MP3) and podcast options.

I posted this to the Last.fm Web Services discussion group, and asked on Twitter. I'll update this post if something comes of it.

I prefer to exercise to music, and it's much nicer when the beats per minute matches what I'm physically doing. I think this could happen 3 ways: 1) Faster/slower tempo adjustment of any station. This could be a really awesome subscriber feature. 2) Adding BPM as a new radio station "station type" (from http://www.last.fm/api/radio) and exposing it in the UI as a Tempo dropdown. For example: lastfm://bpm/140 3) A third party app which creates/queues a playlist based on BPM. This would be almost entirely doable with the existing API (get similar artists, add to playlist) if track.getInfo included BPM. There's lots of docs for estimating BPM for a bitstream, but short of someone with a huge music collection, Last.fm would need to pregenerate them and expose it in the API. This API is particularly well thought out: http://developer.echonest.com/docs/method/get_tempo/ (but it too needs the bits; it's not an existing database). Mass BPM calculations would be a killer use for Map/Reduce...

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 13 Sep 2009 18:59:00 -0700 Anatomy of a Malware Ad on NYTimes com http://troy.yort.com/anatomy-of-a-malware-ad-on-nytimes-com http://troy.yort.com/anatomy-of-a-malware-ad-on-nytimes-com

On Saturday evening, Avast displayed a malware warning as I loaded a nytimes.com article.  After some digging, here's the malware I found.

Ad Delivery

nytimes.com article pages include an ad placement with the HTML DOM ID adxBigAd.  From loading a few articles, they seems to rotate between a banner and an iframe. On this article, a 300x250 iframe was inlining this URL: tradenton.com slash ?id=21610438 (note: I don't recommend visiting it, and have URLs are not linked where possible) A comment gave the campaign ID asVonage01_1163613_nyt12, though it was obviously unrelated to Vonage.  tradenton.com was registered Sept. 2, 2009, so it may have had a previous owner.

Injection

tradenton.com serves a 15-line HTML snipped containing this JavaScript:

http://gist.github.com/186462

As anyone who has looked at phishing links knows, this is nasty on a couple levels. It's eval()'ing escaped code, which is almost never needed to serve an ad. Note that the variable action_URL is defined but never used. After unescaping the code, this is what's being run:

http://gist.github.com/186464

What's served by harlingens.com slash includes02.js? Aha! The eval'ed JavaScript is requesting a second Javascript, which hits action_URL:

http://gist.github.com/186466

Malware

Now we're talking. Requesting that action_URL on sex-and-the-city.cn actually serves a HTTP 302 Redirect to protection-check07.com slash 1/?sess=%3DGQx3jzwMi02MyZpcD0yMDguNzUuNTcuMTIxJnRpbWU9MTI1NjgwMI0MaQ%3DN. And we hit pay dirt. It's a fake page for a non-existent antivirus app, which is actually malware. Titled "My computer Online Scan", this page displays this JS alert:

Media_httptroyyortcom_kcjpk

 

 

Popup from malware advertised on nytimes.com

Then resizes the browser window into a full-screen application-style, as if it had become a virus scanner. Some highlights from the static content and JS on this page:

Dont close this window, if your want you PC to be protected.

353 trojans

You need to remove this threat as soon as possible!

Scan procedures finished.

431 Probably harmfull items was found!

 

Here's a screen shot:

Media_httptroyyortcom_grrar

screenshot of web page of malware advertised on nytimes.com

 
Here's full HTML source in a gist viewer. As usual, these phishers haven't sprung for spelling or grammar checkers.

The page also uses IP-based geocoding by inlining its own iframe called geoip.php, which has city-level granularity (though it was off by 1,000 miles for me). The "Full System Cleanup" link goes to /download.php?id=2006-63 on the same server, which serves a file called Scanner-b4ba2_2006-63.exe.

That redirects to /download/Scanner-b4ba2_2006-63.exe, a static file with the checksum 6c5b5669151337ca51ec45b1f5785d02. Running strings on this 167 KB program - too small for any virus scanner - has it requesting administrator privileges, though I haven't done detailed forensics.

Notes

As of Sept. 12, 2009, tradenton.com and harlingens.com resolved to 212.117.166.69. sex-and-the-city.cn resolved to 94.102.48.29. protection-check07.com had 3 A records: 91.212.107.5, 94.102.51.26, 88.198.107.25. Also, I changed indentation and spacing for readability, so checksums on gist may not match source files.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 13 Sep 2009 13:08:00 -0700 Auction Lifecycle for Data Geeks http://troy.yort.com/auction-lifecycle-for-data-geeks http://troy.yort.com/auction-lifecycle-for-data-geeks

I collected stats from my first sell-side eBay transaction: number of watchers, number of bids, and current item price.  Here's what I found: eBay Auction Interest - Chart
Auction Watchers, Bids, and Price Over Time
Larger chart

Specifics: eBay, 7 day duration, start $0.01, no reserve, $167.50 sale, digital camera, July 2009

30-second Summary

  • 30-50% of prospects are trolling for a bargain that probably doesn't exist
  • May be an untapped strategy in bidding at 70% of sale price to "stake a claim"
  • Last-minute emotions didn't affect the price much
  • 7 days may not be long enough for all prospects to discover

What's noteworthy?

  • Ratio of watchers:bids (casual interest:purchase intent).  For most buyers, this auction was a 2-stage process: find & watch, wait a couple days, then monitor & bid.  Visible interest accumulates for 2.5 days, peaking at 11 watchers per 1 bid, then steadily drops to 1.5:1 at sale.

As the end approaches, there are far fewer lookie-loos relative to participants - most have either bid or left (un-watched) - and the ratio sinks. Nobody bids upfront, probably from past experience: each person knows nobody else will bid, so they just watch too.

Auction Ratios
Ratio of Auction Watchers, Bids, and Price
Larger chart

  • Ratio of price:bids (strength & frequency of purchase intent).  Because bidding is idle in days 2 and 3, this ratio starts and stays high ($17 of item price per 1 bid).  Then bids trend smaller for 2 days, dropping to an average of $7 per bid.  Just like a regular auction, the price increase per new bid is smaller later in the auction, though the absolute price increase is large thanks to lots of bids.

Only in the last hour does the dollars per bid spike again, and only in relative terms - small change that happens very quickly.  That's the sniper, who must overshoot because there's only one chance to snipe.  A larger spike here would indicate a desperate sniper.

  • Ratio of price:watchers (strength & frequency of casual interest).  This stays pretty constant throughout the auction until it rises in the last 2 days  I interpret that as bargain hunters bailing (un-watching) while bidding heats up.

Analysis

  • Watchers is linear for the first part of the auction, then bargain hunters start to realize they're not going to get a steal.  They adapt: they un-watch the item before it ends.   Watchers started dropping about 12 hours before the auction ended, when the price was at about 60% of final sale price.   This shows that some buyers still think it's a good use of time to hunt for undervalued items.  That's a challenge with sub-$200 commodity gadgets.
  • Assuming our sample size of 1 was representative, one could fit a line to the price ramp and estimate the ending price of a halfway complete auction.  This actually might not be far off, at least for auctions matching the same specifics (duration, reserve, category, etc.)
  • 3 bids arrived in the last 40 seconds, yet those were the only bids in the last few hours.  I checked the history of automatic bids (where eBay rebids up to your max allowed amount) vs. user-entered ones: only 2 people (winner and 1 other bidder) were online at 11 AM when the auction ended.  Only one of them bid until the last 10 seconds.  Unlike live auctions, last-minute emotions didn't affect the price much.

This reinforces that online auctions aren't impulse-driven, at least for smaller items that can't draw enough live users to start a bidding war.  Someone may get caught up in their own re-bidding midway through the auction, and there's an adrenaline rush for those few who actively bid when it ends, but in this auction there wasn't any going-once gavel pounding.

Conclusions

  • Although the winner asked me a question 2-3 days in, their first and only bid was 7 seconds before the end.  This was destined to be sniped from the very start.
  • No one jumps in and makes a semi-serious bid (say, over 60% of final price) before they need to.  The serious prospects believe that by placing a real bid, they'll increase the baseline and consequently the sale price.  In a sense, we're telling ourselves that we might get a steal by not bidding, and that other people's bid increases are based on the current price more than their willingness to pay.

That may be true when many buyers are already watching an item.  However, I could see making a bid on day 1 that's 70% of final value, and thereby decreasing the number of people who bother to watch it.  Basically, you'd claim the item for yourself, like bluffing in poker.  Assuming the higher first bid translated into fewer watchers, I could see that keeping the final price lower.

  • Prospective bidders may have still been discovering the item 7 days in.  The number of watchers never really flatlined.  While the total number of watchers dropped at the very end, we can't tell whether those folks un-watching were partially offset by new watchers.  Based on how quickly the watchers dropped in the final 12 hours, I'm guessing the short flat-lining was driven by the auction ending.

Would more people watch an 8 or 9 day auction?  Probably.   Whether one of those watchers would be willing to pay more is a much harder question.

Ideas

  • Because eBay doesn't provide an in-depth event history, we don't know when the 2 ending bidders watched the item, nor how they found it (search? what keywords? browse? which category?).  A deep "event log" with timestamps, referral reason, and username could let sellers write custom auction strategy management tools - innovate on selling strategy rather than logistics or sourcing.

I could see charging for that post-transaction visibility, since pro sellers are the only ones likely to refine listing strategy, and presumably they're receiving higher sale prices.  Bigger challenge: Prospective buyers would need to acknowledge a warning that their watch interest would be made available to the seller, whether or not they actually bid.

  • About 1 in 3 watchers explicitly un-watched this item in the few days after it ended, rather than letting eBay roll it off their watch list.  This may mean that eBay can to do a better job of post-auction cleanup or item segmentation, or that 1 in 3 people are really pedantic.
  • There's still room for an auction format which ends 10 minutes after the final bid.  Such a hybrid of "buy it now" and traditional auctions that might actually speed the auction up - nobody will be motivated by end time, and that could front-load the bidding.  Wouldn't take much to be more front-loaded than this auction was.

Note: Bid amount is public-facing current bid, and includes automatic bid. By default, eBay post-auction bid history does not include automatic bids.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sat, 15 Aug 2009 03:20:00 -0700 Unique conference venues in Seattle http://troy.yort.com/unique-conference-venues-in-seattle http://troy.yort.com/unique-conference-venues-in-seattle

I've been asked for unique venues around Seattle for conferences, hack fests, user group meetings, and the like.  Here's venues and types to check out. Feel free to add others. Startup standards & smaller:

Larger:

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 09 Aug 2009 02:33:00 -0700 GMail Wishlist http://troy.yort.com/gmail-wishlist http://troy.yort.com/gmail-wishlist

GMail's already-marvelous interface need not deter our constructive "backseat engineering." Here's my wishlist.

1. Endless popup warnings when replying to Trashed threads. Compose a reply to a deleted (not archived) thread. A warning dialog box pops up and steals focus every 30-60 seconds to say "This thread is in the trash." Yep, just like it was a minute ago. I'm usually typing when dialog box grabs focus, and with keyboard shortcuts enabled, my next few compose keystrokes teleport me halfway through the UI.

Wish: Show the dialog box once when I create the reply, or show a simple message in the compose window instead of taking focus. Then let me type.

2. Awkward handling of seldomly-used labels. I have a few labels that are only attached to 10-20 thread, and many old labels that won't ever get attached to another thread. The labeled threads would be hard to reconstitute through search.

While I can now hide them in the inbox view (yay) and IMAP, and can search for labels when attaching one to a message, it still feels awkward to see "50 more" labels. Some of my label names were chosen to influence sort order ("lists/blah").

Wish: A place to stash archived labels. I'd be happy with an Archive flag on labels, which would display them in the folder list under a single expandable link, or onl "Show Archived" radio button. Existing Manage Labels options (show/hide, Show in IMAP) seem like client app-specific workarounds for not having Archive; show/hide is really "Show in Web." Real hierarchical labels (nested "groups of labels") is more than I need.

3. Compose and Contact links behave differently than labels. Since the Compose and Contacts links are to Javascript targets, I can't Ctrl+click to Compose in a new tab, or right-click and "Open in New Window" on Contacts. I leave the main GMail inbox tab open all the time, and I'm usually already looking at a thread when I want Compose or Contacts. I end up using the Inbox link to open a new tab and navigate from there.

Wish: I think I'd accept a bit more latency for being able to use Compose and Contacts links like I do label links.

4. Can't auto-merge contacts (and until recently, not even a "Merge these 2 contacts"). Also, after manually merging contacts, I'm sent back to the top of the contact list (rather than the previous scroll position), so it's painful to do with lots of contacts.

Wish: "Auto-Merge All," then show me a long list of affected contacts to skim/correct. Show 50 or 100 merged contacts per page, not 1. Stopgap: scroll to merged contact after a manual merge.

5. "All Contacts" has a better memory than I do. GMail adds anyone I email to my "All Contacts" set, yet when composing, I sometimes remember the name of a company/domain name but not an individual.

Wish: In the To field, search contacts' email addresses (domain names, specifically). This already happens when no first or last names are defined. When find-as-you-type doesn't match any contacts, consider waiting a couple seconds then showing "Search Contacts for 'blah'." That way I don't have to delete my partial address, click "To" for the contact picker, and re-type my query.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sat, 13 Jun 2009 05:13:00 -0700 A Handful of Mac OS X Tips http://troy.yort.com/a-handful-of-mac-os-x-tips http://troy.yort.com/a-handful-of-mac-os-x-tips

Some things I've learned over the past few weeks:

  • I love one-finger tap to click. In the week I went without it, I never got used to the extra trackpad resistance at the edges. Also turned tracking speed way up.
  • Avoid carpal tunnel: Alias Cmd+# to switch to a specific Space. If you used WindowMaker or Fluxbox, it's similar. I also have a hot corner (lower left) show all Spaces.
  • There's a big enough difference between free and paid apps to justify paying for software again, and bundle sales happen all the time. See MacUpdate Promo and MacHeist.
  • Get Safari AdBlock, which is based on the superb AdBlock Plus.
  • Change Cmd+Space alias to call Quicksilver instead of Spotlight (and never use Spotlight again). Everyone's first piece of advice is to install QS, and Apple should integrate it into default installation.
  • Gmail Notifier is awesome. Mailplane might be better; the icons, new mail count, and easy Calendar access in Gmail Notifier solve my problem.
  • Campfire+Propane.app is worth its weight in gold.
  • GarageBand was made for cross-country flights
  • Required: NeoOffice, Adium, Fluid.app (and Fluid apps for a handful of sites you care about), Skitch, cdto (open Terminal in current directory from Finder), Dropbox, Transmission

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sat, 21 Mar 2009 04:43:00 -0700 Short, fast micro-whois http://troy.yort.com/short-fast-micro-whois http://troy.yort.com/short-fast-micro-whois

90% of my whois queries are to check whether a domain name is registered, where I don't need any details. Here's a Bash function to check domain availability; type one character, get one character.Problem: I want a responsive checker that I can start in an instant, with almost no typing. It should be omnipresent: accessible from as many desktop windows as possible, without task switching. Rather than showing details, output should be short so I can see my query history evolve. And since most domains are registered (and I want to get past them), response time matters for registered domains more than available ones.

Solution: I have this bash function in my .bashrc (update: two versions by request -- shell script and Ruby). You can download micro-whois here.

http://gist.github.com/82956

 

and voila, zero-effort domain name availability:

$ d yort.com

1

$ d ihopethisonedomainisnotregistered.com

0

 

Registered

$ time d yort.com

1 real 0m0.260s

 

$ time whois -n yort.com

.. [ 60 lines ]

real 0m0.782s

 

Unregistered

$ time d ihopethisonedomainisnotregistered.com

real 0m0.649s

 

$ time whois -n ihopethisonedomainisnotregistered.com

real 0m0.657s

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Fri, 20 Feb 2009 14:23:00 -0800 Temporary code never is http://troy.yort.com/temporary-code-never-is http://troy.yort.com/temporary-code-never-is

Somewhere it's the Third Rule of Software Product Development: never implement a feature poorly because you expect it to be thrown away. Sure, rewriting is expensive, and seeing a permutation of "spend time with no product gain" is thoroughly demotivating. But there's 3 better reasons:

  1. You'll never actually get back to doing it. It will take up permanent residence in the back of your head.
  2. By necessity, other features immediately start hanging off of it. When you do find a free day to blow on rewriting something (among the 5 things you meant to circle back to), it's too late to redo the (a) right way: that 4-hour task is now a 3-day refactor.
  3. Humans can't switch from "write disposable crap" to "write well-thought-out, maintainable, valuable code." The work process is different. Having replaced planning time with dive-in-and-code-code-code, Dumpster-ready features become the norm.

Oh, and it doesn't take that much more time.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 15 Feb 2009 04:58:00 -0800 The anti-NDA http://troy.yort.com/the-anti-nda http://troy.yort.com/the-anti-nda

I recently had someone ask me to sign an NDA so they could share three sentences about their business.  It occurred that while many people have asked for that, I can't think of one who has started and run a business - as President/CEO for a few years or product cycles - or sold one for substantial shareholder gain.  Correlation at least, causality perhaps.

These days I want the anti-NDA: a disclosure agreement.A promise that, in return for my explanation and effort, the recipient commits to share it with three people who they think will care.  Sign a Creative Commons Attribution Share Alike license with a minimum commitment.  Prospective customer, scrappy tinkerer, competitor, beta tester, skeptic, journalist, someone.

Partner?  A mutual disclosure agreement, where we both commit to make ourselves useful by opening doors. The risk to me is not that a stranger will drop everything they're doing, direct meaningful resources toward the goal, know the market well enough to turn a paragraph into a business, make up for starting later, and execute and commercialize it better than me.  The risk is simply that it's a dead end: a bad use of time.

Merlin Mann says it well in Ideas, Execution, and the Rare Auteur:

An idea is no more useful than a coupon for a bag of sugar; show me the finished cake, then we’ll talk. The bottom line is that if you don’t have an amazing, passionate idea and the means to make it superb, you’re probably just a douchebag with an expensive phone. And a stack of NDAs.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis
Sun, 13 Jul 2008 16:43:00 -0700 Self-signed IMAP SSL certs on iPhone http://troy.yort.com/self-signed-imap-ssl-certs-on-iphone http://troy.yort.com/self-signed-imap-ssl-certs-on-iphone

I'm sure somewhere on the planet, there's a second person with an iPhone who doesn't use GMail, and perhaps that person uses their own self-signed SSL certificate for IMAPS.When adding a new Account, iPhone setup will pop up a dialog to confirm the shady self-signed certificate.  Even with that acknowledged, it will try to connect and eventually time out.  The warning doesn't mention (nor prompt to install) the root certificate, which will make the cogs turn.  Put the CA root cert on any Web server (.crt extension and application/x-x509-ca-cert MIME type), then hit the URL in Safari from the phone.

You'll see an Install Profile dialog like in the Enterprise Deployment Guide:

Media_httpyortcomipho_uaflf

No need for the Configuration Utility or Enterprise kit.  The deployment guide says you can also attach the cert to an email, then open that message on the phone. Apple, clicking through the IMAP cert alert should make that cert trusted, or at least warn why it won't work until the root cert is added (and how).

Update: I'm no longer the last person on the planet not using GMail.

Permalink | Leave a comment  »

]]>
http://files.posterous.com/user_profile_pics/825797/_MG_3011_-_color_fixed_579.jpg http://posterous.com/users/3sTyd9SINL8Z Troy Davis troyd Troy Davis