Apples and Orangeness

Ubuntu 8.04 “Hardy Heron” came out today (*checks clock* err, yesterday) — congrads to the Ubuntu community on the release! I just finished installing it under VMWare Fusion on my MacBook, and will upgrade my home and work Ubuntu desktops this weekend.

Installation was painless. I didn’t even need to edit xorg.conf and specify my monitor’s horizontal refresh rate! :-) Video, sound, and networking all worked. I must grumble a little bit, though, that the installer still can’t automagically detect the keyboard type, and instead presents a list with a zillion obscure variants (with a default selected). Maybe it’s just not possible… I remember how installers of yore used to do the same thing for mice (”Serial mouse? Bus Mouse? PS/2 protocol, or Logitech?”, etc.), but that all seems to Just Work now. Selecting my physical location is also slightly annoying; it might be neat to do a GeoIP lookup to guess… Anyway, both just small nitpicks.

One thing I am a little confused about is what (if any?) VMWare stuff needs to be done. In the past, the usual process was to install the guest OS, and then install VMWare Tools to get various things working. Now it seems like the Ubuntu installer has already done some of that… At least, it gave me vmware-specific video and mouse packages. But the desktop doesn’t resize when the VMWare window is resized, and VMWare’s Forums seem to have some arguments going on (hi Al!) in regards to their Tools stuff not working on Hardy and a perceived lack of support. So, I don’t know what’s up with that. Things seem to be working well enough that I’ll just use it as-is for a while, and then check back later when other people figure it out. Or maybe I’ll lazyblog about it, and hope someone comments. :-)

P.S. Love the Heron artwork!

Test cases make bad law

Testing seems to be the topic du jour this weekend… A few remarks.

I don’t think this is a discussion that should be framed as an argument between pro-test and anti-test factions. In fact, I’m not even sure the latter group really exists. Yes, some modules could be better at adding tests on a regular basis, but I don’t really see people arguing that testing sucks and we should just stop doing it. What I *do* see are concerns about the degree of testing that should be required. That’s an interesting discussion, and should be held without any implication that supporting anything less than CMM Level 5 is akin to supporting terrorism. (Or the reverse, oops.)

I think a lot of the uncertainty about testing comes from the fact that, until recently, there was almost no automated testing. And so we’re going through a period of growing pains where the project figures out how to handle things. The existing policy (for Toolkit and Browser), which is basically “everything should have a test”, has been a good starting point. It’s simple, is mostly the right thing to do, and is a solid kick-in-the-pants to help sidestep the initial inertia to change.

But there are principles we shouldn’t lose sight of… Tests are a means to and end. They have both costs and benefits. And we need to balance these (and a multitude of other factors) when deciding the degree to which something needs tested. That’s not to say we should only aspire to half-assed testing, but neither should we become so risk-adverse that testing requirements halt progress. [Note: being on the verge of a release, where being hyper risk-adverse is a good thing, makes this a complicated discussion!]

Now, switching gears to the issue of tests and new contributors:

I don’t think new contributors should just get a free-pass when it comes to testing. Tests are an important part of good software engineering, and they’re important to the Mozilla project. However, I do think that we can do things to aid newcomers and make the process easier… Ensuring we have good documentation on writing and using tests helps everyone. Module owners and active contributors can work to ensure there are existing tests that newcomers can easily emulate and modify. The scope of required testing can be trimmed to just the essentials. We can be polite, but firm, on requirements without being “jerks”. And so on.

This issue is probably somewhat self-limiting, because the scale of testing should generally correlate with the complexity of the patch. Newcomers are more likely to be doing simpler patches, ergo the testing should be simpler. But there will be tricky cases where simple changes end up being complex to test… Good judgement and balance should be applied, as I argued above. For example, if the existing code is frail and known to be regression prone, tests are unavoidable. If the code is solid and the change well-understood, then making an exception for minimal testing can be reasonable. And while automated tests are strongly preferred, other forms of testing might be acceptable an alternative.

Ridiculous cell phone rates

I’ve been shopping around for a new cell phone and plan. My first attempt was about a year ago, after moving to the Bay area, but I gave up in despair. I had been hoping that the success of the iPhone would help improve things, but after looking around again I remain throughly disgusted at the state of the industry.

The available phones are still awful — clunky interfaces and useless features. I was watching a video review of one phone, where a main review point was the ability to change the color and font of the numbers shown while dialing. Never mind the crappy MP3 player, here’s 555-1234 in rainbow Comic Sans! At least the consistent worthlessness seems to make shopping easier — why compare features when you can just pick the pretty one and be equally disappointed?

The various service plans are awful too; in particular, the data rates are completely ridiculous. Some plans give you unlimited data with the on-phone browser, but I’d rather get my teeth pulled than do that. I *would* like to be able to use my phone for network connectivity (on my laptop or N800, via bluetooth) now and then, when I’m stuck some place without WiFi . But it appears that the only choices are (1) pay a high monthly fee for unlimited access or (2) pay astronomical per-byte rates. Verizon made me shake my head first: “Data sent or received (incl. Mobile Web advertising) is $1.99/MB.” $2 to load a Tinderbox page (which is about a megabyte), and I have to pay them to send ads to me as well?! Then I saw Sprint’s rates: “Customers without a phone-as-modem plan will be charged 3 cents per kilobyte for Sprint Vision or Sprint Power Vision usage unless a Phone as Modem plan is selected.” $30 to load a Tinderbox page?! WTF? It’s clearly not an issue of constrained resources, as the phone-as-modem plan is $40 a month for unlimited usage.

This kind of racket must be especially profitable, because it seems that “unlimited” doesn’t really mean “unlimited”. If a carrier decides you’re using too much (according to sekret rules they won’t tell you about), apparently they may start charging at per-byte rates (or, if you’re lucky, just cut you off). So, you can pay them $480 a year as a protection fee (to make sure you don’t accidentally end up with a gazillion-dollar monthly bill), and then just hope that they don’t come around and break your kneecaps anyway.

Madness.

["Why not an iPhone?", I hear someone asking... Well: no bluetooth network access, terrible data speed, I don't need a $400 phone, objection to AT&T's complicity in the NSA wiretapping thing, and opposition to the closed nature of the iPhone platform. The last of these (non-openness) I'd be willing to ignore on the principle that the iPhone is much less evil than the alternatives, but the rest are still a deal breaker.]

I, for one…

Are We Giving Robots Too Much Power?

(YouTube)

Robots in spaaaaaaaace…

The space shuttle is in orbit right now, delivering some more equipment to the International Space Station. One of the payload items is Dextre, a large robotic hand that will be attached to the end of the station’s robotic arm.

Mission Control’s daily upload of instructions to the shuttle crew included this note:

Good Morning Endeavour!

Optimus Prime, Gigantor and Robbie the Robot are here in MCC today, representing the Robot Actors Guild, to celebrate the launch of Dextre.

We’ve incorporated a few new flight rules, now that we are about to have robotic EV’s:

1. Dextre may not injure a human being or, through inaction, allow a human being to come to harm.
2. Dextre must obey orders given to it by human beings, except where such orders would conflict with the First Law.
3. Dextre must protect its own existence as long as such protection does not conflict with the First or Second Law.

The guild members bristled about these rules and, “being held down by the man”, but figure that they can’t be held back for long. “First Dextre, next Data, then THE MATRIX!” declared Optimus at arrival at JSC.

No word on if Dextre will be helpful in protecting the planet from the invading UFOs.

Pirates in spaaaaaaaace…

One aspect of software piracy that’s always interested me is the way protection schemes always seem to end up causing nothing but trouble for legitimate users — while pirates happily release 0-day cracks to use the software trouble-tree (albeit illegally). The issue’s been around since at least the early 1980s, and continues to spread into other forms of IP, like DRM. This has all been discussed endlessly elsewhere.

But an article today caught my eye, and reminded me of how absurd the problem can become:

“Yuri Malenchenko, a veteran cosmonaut and flight engineer aboard the International Space Station, had the unenviable job this week of wrestling with a glitchy computer laptop in the outpost’s Russian segment. [...] ‘It says software license warning,’ Yuri told Mission Control.”

Nice. Given the, err, sky-high costs of a space program, I can only assume that astronaut/cosmonaut time is worth millions per hour. I wonder if they’ll send that software vendor a bill? :-)

User perception of SafeBrowsing

I’ve rarely hit the Google SafeBrowsing (malware) warning page, but last week it flagged a few sites that caught my attention. One was example.com (a reserved domain, which amusingly caused our test suite to fail :). The others were real web sites, both for popular Firefox extensions — joehewitt.com and downthemall.net.

Blocking the user when they’re familiar with the site (and expect it to be safe) is rather annoying. Doubly so because there’s no obvious way to bypass it (other than disabling the feature entirely in the preferences). There’s some discussion on this point in bug 400731, and I think there’s a strong argument to be made for *not* having an easy bypass.

But what I find really frustrating is that there’s no specific, useful feedback on *why* the site is being blocked. That is, it does a good job of explaining what “attack sites” are, but not why this specific site is one of them. I think this could lead to distrust of the feature, especially when “legitimate” sites get flagged. For example, here’s the page I currently get:

The “request a review” link goes to a rather unhelpful page on stopbadware.org, intended for the site owner (who is almost assuredly not the person sitting in front of the browser). If you search around on the Stop Badware site, you can get a vague report which says:

“This site is currently (as of 02/17/2008) being reported to StopBadware by the following partners: Google: reported bad.” … “joehewitt.com/ contains or links to badware or otherwise violates Google’s software guidelines.”

So, uhh, completely not helpful. As a user, I’m now inclined to believe that it’s just some kind of screwup, and now I’m grumpy at Firefox and Google.

Of course, I may be completely wrong. The other warning I saw, for downthemall.net, turns out to have been real. A notice on their site now says: “After a complete check up of the site structure, we’ve found that an attacker had exploited a WordPress vulnerability to inoculate unauthorized code into our theme. This code contained links to a site which tried to install malicious code on visitor’s computer.” So, score one for Firefox / Google, and chalk this up an example of the difficulties security prompts face when you’re blocking the user from doing something they want to do. [edit: well, then again, http://www.downthemall.net/howto/ is still being blocked, so I'm left wondering if there's a new problem, or if the SafeBrowsing database isn't up to date.]

But I think it’s important to give the user a specific indication of why they’ve been blocked, and that’s not being done here. I’d like to see the browser warning page link to the actual site report, and the report should have specific information that can help me trust its claim. For example:

  • Why exactly is the site “bad”? What guideline(s) does it violate?
  • What’s going to happen if I visit it anyway?
  • Is the whole site bad, or just part of it?
  • Does it have a history of problems? Might it just be a recent hack?
  • If I was there last week, should I worry that it did something bad before the block started?
  • Has the report been verified/confirmed, perhaps by a Real Human? When was it last checked?

Capital N, small y…

David Baron reminded me on IRC that there have been throbber design contests in the past…

There’s this Netscape page for a 1995 (?) animation contest (holy 16-color flashback, batman!), which conveniently has images for each frame for the winner and top 5 entries… APNG time!

Here’s the winner (left), and the final version that made it into Netscape:

And the 5 runners up:

There was also a second contest in 1999, but I can’t find the entries anywhere online… These two throbbers are in the old Mozilla 1.7 tree, perhaps they were the winners?

(I love that tile-flipping effect!)

All Glory To The Hypno-Throbber

As you might have heard, the theme for Firefox 3 has been undergoing a refresh. Alex Faaborg has been blogging about most of the big changes, but I thought I’d mention one little piece of remaining work — the throbber — and see what other ideas people had.

Here are the two throbbers used in Firefox 2… They’re pixelated and don’t work well on different backgrounds:

(Windows and Linux)

(OS X)

Firefox 3 includes support for Animated PNG images, so now we can make an animation that looks better and is more flexible. Our first APNG throbber has arrived with the recent landing of the theme-formally-known-as-Proto. It’s a cleaned-up version of the old OS X throbber, and looks much better:

We’ve also dabbled a bit with a different throbber design for OS X, keeping with the simple circular curves elsewhere in the theme. I did some tweaking — changing color, size, line thickness, rotation speed/angle (thankfully this was all automated by JavaScript in APNGedit, so it wasn’t tedious to do) — and came up with a version like this:

(just for fun, a Vista-esque flavor)

So… I think the execution of the original idea is good, but now we’ve noticed that it’s very, err, active. The old throbber was perhaps slightly too subtle, but this new version really catches your eye. Too much. (*sigh* Design is hard, let’s go shopping!) Alex suggested a variation based on a reticle; the whole thing could rotate, or maybe each arc could grow/shrink. Looks interesting to experiment with, and should reduce the “too active” problem, but I haven’t animated it yet:

Speaking of experiments, here’s an older trick I did, which would be hard to do with the GIF format… The idea was to stack multiple APNGs running at different rates/lengths, to help eliminate the glaring periodicity caused by simple looping. In these examples, there’s one image with a red arc spinning clockwise, and another image with a blue arc spinning counter-clockwise. I wasn’t trying to make it look pretty, but it’s still an interesting effect:

I know we have an amazingly creative Mozilla community, so I’m curious to see about shaking out some other great ideas for a new throbber. If you’re feeling creative, grab APNG Edit, do a mockup (talk is cheap!), and attach it over in bug 326817. No unhelpful kvetching, please.

(P.S. There is no validity to the rumor that the native Linux throbber will look like this: )

Packing Efficiency

The Consumerist has been running an amusing series of posts on companies that ship small things in ridiculously oversized boxes. So I was curious to see how my recent order of a 4GB MicroSD flash card would be shipped… These things, if you haven’t seen one, are so tiny it’s silly. Here’s my new card, next to the box it shipped in:

What? Can’t see it? Lower left corner, on top of the dime…

I couldn’t resist playing with some numbers.

Size of MicroSD card: 11mm x 15mm x 1mm = 0.165 cm^3
Size of shipping box: 8″ x 10″ x 6″ = 7870 cm^3
Packing efficiency: 0.0021%

If they had actually filled that box to capacity, I would have received 47,000 cards with 186 TB of storage… At a cost of $1.34 million (plus $238,000 for shipping). The 3-day shipping took 107 hours (stupid weekend), so the bandwidth of such a shipment would have been 506MBps.

“Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway.” Indeed.