Wow, hey! Jonathan Coulton is coming to London!. I've already booked tickets for a friend and I. I heartily recommend that anyone else come along to see the Godfather of Geek Rock.

I just done a minor update to my Introduction to CruiseControl slide show. A huge "thank you" to Siegfried Goeschl, who sent me his changes.

I've just had three very long nights in a row, configuring a new mail server for Lillifoot, and trying to get SpamAssassin working. It's finally working very sweetly, but I pulled a fair amount of hair out getting there.

My configuration is as follows:

• Xen Hypervisor: Dual Core 3.0GHz Intel Pentium 2Gb. I'm currently only running the mailserver as a Xen guest on this right now, but I will add more virtual machines later.
• Mailserver (Xen Guest): I set up a guest and called it mail.exubero.com.
• Operating System: I'm running Centos 5 in the Xen guest. I performed a clean minimal installation (headless), and disabled all services except sshd.
• Services: On top of the above base, the following services were installed:
  • Postfix
  • SpamAssassin
  • Procmail

I was able to install Postfix without too much trouble. After updating the DNS MX records for exubero.com and lillifoot.co.uk to point to mail.exubero.com, we're in business. There were a number of issues in the first day as I worked the kinks out of the configuration (I'm only really an amateur mailserver administrator).

What I hadn't previously appreciated was how much spam my previous ISP had been catching. Not a huge amount, but still in the range of 20-30 per day. Not a problem: off to install SpamAssassin.

I found a very good configuration guide for Postfix, SpamAssassin and Procmail by Robert Bushman. There were very clear instructions with easy to follow steps. All preparation steps worked fine, and I was able to test the configuration without issue. However, after I enabled the configuration in the running server, I got a strange error:

pipe[4403]: fatal: pipe_command: execvp /usr/local/bin/sa-filter: Permission denied
postfix/pipe[4400]: 5ECB0186DD3: to=<joe@example.com>, relay=spamassassin, delay=3.4,
  delays=2.9/0.04/0/0.46, dsn=4.3.0, status=deferred (temporary failure.
  Command output: pipe: fatal: pipe_command: execvp /usr/local/bin/sa-filter:
  Permission denied )

This is saying that the SpamAssassin filter (sa-filter) did not have permissions to run.

The configuration in master.cf shows that the script is run using the new "filter" user I created as per the instructions:

# Spam Filter
spamassassin unix - n n - - pipe
  user=filter argv=/usr/local/bin/sa-filter -f ${sender} -- ${recipient}

Hmmmm... the script worked fine when I was testing it manually, and running under the filter user. Check the script permissions:

[joe@mail ~]$ ll /usr/local/bin/sa-filter
-rwxr-xr-- 1 filter filter 72 Oct 16 01:21 /usr/local/bin/sa-filter

That looks good. I spent a long time researching this particular problem, without much success. The logs were inconclusive, and I couldn't track down anything useful. In the end, I reverted the Postfix configuration changes, and left it for a day.

Finally, researching a related but different problem, I came across a reference to SELinux causing problems with Postfix. With this idea, I tried changing the SELinux policy to "permissive"; suddenly, everything starts working. Wheee! For some reason, SELinux wasn't logging it's usual error messages to /var/log/messages.

Obviously, the more robust solution is to tweak the SELinux configuration to allow the script to run while SELinux is enabled. Dear Lazyweb, If anyone can help me on that one, send me an email and I'll post an update to this article.

Jonathan Coulton's music has been playing pretty non-stop on my music player for the last week now. It's great music, and the lyrics often have a perverse humour based on maths, science fiction and other geeky subjects that really appeals to me. Who else can sing about the Mandelbrot Set without sounding lame?

I've known about Jonathan Coulton for about two years now, after I first heard about him after a mention about his song Code Monkey on the Java Posse, and then again later on Slashdot. I though Code Monkey was a great song at the time, but I didn't look any further then.

Recently, I heard reports of him wowing the crowd at PAX. One thing that really struck me was the description of his reaction to the size of the crowd, which was about 3000 (compared to his normal crowd of about 50-200). All of them were screaming "all we want to do is eat your brains", which sounds grusome, but makes sense if you know that particular song. All this prompted me to check out his music again, which lead me to make my first music purchase in more than three years.

One (other) thing which makes Jonathan's music relatively unusual is the fact that he releases it under the Creative Commons. This means that people are free to make non-commercial derivative works. As a result, there are many amateur and semi-professional videos available, most of them linked from Jonathan's site. Spiff does some excellent machinima videos using the World of Warcraft.

Some of my favorites:

• The Future Soon (Ill probably be some kind of scientist building inventions in my space lab in space)
• Skullcrusher Mountain (I made this half-pony half-monkey monster to please you)
• Mandelbrot Set (Kickass fucking fractal!)
• Chiron Beta Prime (were working in a mine for our robot overlords. Did I say overlords? I meant protectors)

Anyway, enough gushing on about music. More technical content to follow.

This is one of those strange examples of synchronicity. I was moderating a message on the JUnit discussion group, when I came across a message by Lasse Koskela, which reminded me of his upcoming book: Test Driven. For a long time I had been planning to go and buy a copy, because I'm very interested in the subject, and I thought it had been published (I'd seen a message on his blog a few months prior that suggested that it was imminent). A few minutes searching online was enough for me to find out that it hadn't been published yet. That would have been the end of it for the moment, except that a few minutes later, an email arrived from a chap at Manning (the publishers). Lasse had suggested that I might be interested in looking at a review copy, and would I be interested? Sweet!

So the state of play is this: I have a PDF copy of the draft manuscript, which I've printed out so I can scrawl all over it. Should be fun, I'll post a report later.

As I've hinted previouly, my wife and I opened up a new shoe store last month: Lillifoot. A major reason why I haven't been blogging as much lately is because I've been so busy with Lillfoot. We've effectively set up a complete retail business from scratch. It's been an incredible learning experience, as we've had to grapple with real estate agents, builders, suppliers, staff, computer systems and processes. This has been all the more stressful because neither Annie or I had any previous experience retail, not to mention we're both still working in our day jobs. Given the nature of this blog, I'll eventually get around to covering some of the technical issues surrounding getting a new shoe store up and running.

This main point I'll mention today is the website. It's taken me quite a few evenings, but I've finally got a design that I'm fairly happy with - though a professional graphic designer might have a different opinion (hi Sol! Any comments?).

As is usual with me, the site is fully standards based, using semantic markup with cascading stylesheets. Clicking on "view source" shows a very sparse html markup, which enormously simplies the maintenance of the site. Even with that, I think that there is a certain attractive look to the site (though I might change my mind about the hot pink in a month or two!). Stylesheets give you the freedom to change you mind without too much work, though.

Still to do on the site: install Wordpress or Joomla! to enable people other than me to update the site (and the news); get more pictures in the brand pages, and get a webstore up and running. Plenty to do!

Nicolas Seriot wrote to tell me about how he has adapted the exubero stylesheet for his own software: phpMyFlatSite. Not that I'm biased, but it looks very good. :-)

I'm in the process of helping my wife start up a new business venture (more on that later). As a result, we are hiring people to help us. At this stage, there is a large amount of planning involved, and so I have set up a subversion repository where we can share and collaborate on documents.

We have hired Lisa to work for us part time on marketing. She has her own computer running Windows Vista. After getting her to install TortoiseSVN, and giving her a short training course, she was quickly up and running. As Lisa was already experienced in using the File Explorer in windows, she was easily able to grasp the extra functionality and purpose of TortoiseSVN. In this way, I think that TortoiseSVN excels at being an incredibly useful piece of software with a minimal UI that doesn't get in the way. Non-developers can easily use it.

We have also hired Jan as a new store manager. I provided her with a laptop running Ubuntu Feisty. With OpenOffice installed, it makes an excellent document writing tool, and virtually immune to the virus and malware problems that plague Windows. I believed it would be just as usable, until I hit a snag: I couldn't find an equivalent of TortoiseSVN for Linux. Although there are a large number of Subversion clients, most of them are aimed at developers. Non-developers are left to fend for themselves among the complex user interface options that they don't really care about or want to know.

Luckily, after a bit of extra digging, I found the Nautilus Scripts for Subversion, by Marius Scurtescu. From my (and Jan's!) point of view, they give almost the same level of usabilty for a non-developer user. They're even available on Feisty.

I also found them suprising easy to extend. I was able to add two new commands ("Lock" and "Unlock") in moments by modifying existing scripts. I was also able to fix a problem: stderr wasn't being redirected to the zenity input file in all cases. A simple fix was to add a few &> about to redirect io from svn correctly.

I have made my changes available: here are my Updated Nautilus Scripts for Subversion. Marius, if you want to include these changes in your distribution, feel free to take them from here.

The Cluetrain Manifesto struck a chord with me when I first read it. In the eight years since it was published, I sometimes see signs that companies have paid attention to that message. More often, the same old closed shop business practices are seen.

A friend recently started a new business installing and servicing domestic heating systems. Remembering the lessons of the Manifesto, I urged him to start a blog. I put together the following issues he needs to consider. I think it makes a good case why any business should consider creating a blog. It was written with a domestic heating engineer in mind, but the ideas translate to many other areas.

Benefits of a Blog

• Extra business: by updating your blog regularly (for example daily, weekly or monthly), you will gain an interested audience:
  • Clients and friends (and competitors) may subscribe to your blog (or at least look over it every now and then), to see what you've been up to. This will keep you fresh in people's minds.
  • Search engines will notice that you update your site often, and start paying more attention to it, and raising it in the search rankings. People will find you this way.
• Public exposure: there are no other heating installers who have any web presence at the moment (I've checked). You can be one of the first. Once again, search engines will reward your uniqueness (as long as you have interesting content - more on that later).
• Customer confidence: potential customers can gain insight into the work that you do. Hopefully, they will gain some confidence in your work from reading your blog.

Costs of a Blog

• Time spent maintaining the diary, including writing entries and maintaining comments.
• If you become popular, you will have to get a more robust hosting solution. Although there are free blogging services, but it is much better to get all your content within your domain, as search engines will take note that your domain is updated regularly.

Risks of a Blog

• Privacy concerns: you must be very scrupulous about not putting personal information about clients anywhere on your blog. You must state this clearly somewhere.
• Loss of customer confidence: potential customers can be scared off if they read content that doesn't sound professional, or if private details of other clients are discussed. You need to be aware of how potential customers will view the information.

What Content?

As mentioned, keep your content work related, while avoiding any confidential information. Some suggestions:

• Where you were working (to the town/suburb, don't specify street address). This gives search engines a chance to show your site for relevant searches.
• What you did. Be specific. Give brand names and model numbers. Give out the dirt. What's crap? what do you avoid? What's a good brand or model? What's a good technique? What are the trade-offs when deciding one brand or technique over another? This is a chance to prove your expertise in a public forum. Done well, your blog and associated website can become a web authority on the subject.
• What went wrong, and how you fixed it. Show that you're proactive and get things done, customer centric, and so on.
• Add a client feature "Ask a Heating Engineer" or something equivalent. People can email you a question, and you can blog an answer.

All these things will help enormously in promoting your site via search engines. People will tend to search for suburbs and specific model numbers. If you can give some useful experience and advice, you've effectively struck gold.

Taking a Long View

The above advice must be taken as a long term strategy. It is a combination of white hat seach engine optimisation and hopefully interesting content. This takes a long time to gain appreciable results.

In the case of my friend Stu's blog, he has been posting entries for a couple of months now. Traffic is still very low, but increasing rapidly each month. I was pleased to see that because of his latest entry, Google is now returning his blog on the first page for searching for magna clean, and it's the top result (right now) for the search magna clean power flush. This trend will get much better as time goes on.

As I mentioned before, I went to the LondonJava Meetup on Tuesday 1st May. In my usual tardy fashion, I'm finally writing about the night (only three weeks late!).

Tim Bray turned up that night, along with many other regulars. By the end of the night, I managed to work through discussions about CORBA, the weather in Melbourne, XML, the performance of XMPP parsers (very fast, if done well), dynamic languages in general (the phrase "Uniform Access Principle" was mentioned in this context).

By 11pm there were 4 of us remaining: Jez Raynor, Simon Brunning, Tom White and myself. I really enjoyed the night, and managed to add another blog feed to my subscriptions (thanks Tom!).

Tim published a picture of me the night on his blog. This prompted an email from my friend George Petrov entitled "Shiny Forehead". And that explains the title of the this entry tonight.

It looks like there's another LondonJava Meetup on Tuesday 1st May. It's been a while, so I think that it's high time that I turned up.

Ant is a fairly mature software build system. I use Ant in pretty much all of my Java projects. Maven is a newer alternative to Ant that has been gaining mindshare over recent years. As such, a collegue recently asked me why don't we use Maven instead of Ant? On the surface, Maven appears to be a good choice. It automatically handles many scenarios that must be manually handled in Ant. However, there are a number of points that make me quite hesitant to adopt Maven...

Before I go on, I will say that Maven is OK. In my opinion, build automation is of prime importance. A Maven build can be Complete, Repeatable, Informative, Schedulable, and Portable (the CRISP properties of a build that Mike Clark defines). Given a choice between no automated build, and a Maven build, there is only one sensible choice.

However, Ant is still my build system of choice, for the following reasons:

• Maven is harder to extend. Although it can handle probably 90% of projects directly. For the other 10%, it can be very difficult to adapt Maven. Although Maven does have a plugin framework, it is less mature than the Ant task API. (Note the strategic use of invented statistics in this paragraph).
• Maven uses a declarative style. Many people like the declarative style. On the other hand, Ant uses a more procedural style. Personally, I'm more comfortably with the Ant style, as I can explicitly verify every single step that an Ant build will perform. I can't say that for a Maven build. Its more of a "black box".
• I believe that the Ant development team has a much more robust and mature development methodology. I monitor both the Ant and Maven dev mailing lists. I'm much more impressed with the Ant group with their attention to detail (for example, backwards compatibility issues, updating documentation, release milestones). I will readily agree that Maven 2 is a huge improvement over Maven 1, but there are still a number of issues that make me wary:
  • Maven developers don't have cohesive release procedures. For example, Maven 2.0.5 was released a month ago, yet the Maven Antlib is still stuck at version 2.0.4. I can't determine when they're planning to release Maven Antlib 2.0.5.
  • The Maven website lacks cohesion, which makes it hard to find information (for example, try and find the documentation for the Maven Antlib from http://maven.apache.org/). There seem to be multiple links which lead back to exactly the same page, which is a well known mistake in navigation schemes. On the other hand, the Ant website has a terrible design, but at least I can find information on it.
  • As of this moment (12th March 2007 14:44 GMT) the maven download page at http://maven.apache.org/download.html is broken. Although I'm sure it will be fixed soon, these sort of mistakes seem to happen fairly often.
• Ant is ubiquitous in the Java development space. Every single Jave IDE integrates natively with Ant. The same cannot be said for Maven. Although there are a number of Maven plugins, none of them have the maturity or the features available in the Ant plugin ecosystem. For example, you can execute and debug Ant scripts in Eclipse (even setting breakpoints!). Another of my favourites: the yWorks Ant Explorer is just one example of the many third-party tools available.

Anyway, on a more positive note, I think that the maven repository is very well done. Being able to transparently retrieve dependencies without any further intervention is a very powerful technique. I love the fact that I can make use of the repository having to completely switch to Maven through the use of the Maven Antlib. The Ant development team even abandoned their own repository tasks they were preparing for version 1.7 because they thought that the Maven repository did everything that they needed.

This is fairly old news, but I was absolutely fascinated by the "secret" Microsoft documents Evangelism is War. I think it's a very clear insight into why Microsoft is so successful, as well as why they are viewed abhorred in some circles.

Hat tip to Steve Loughran.

Update (Monday, 5th March)

As a number of you have mentioned, the link above to the Evangelism is War article is now invalid. The pdf was hosted on a website called Iowa Consumer Case, which contained all the public domain court documents from the Comes vs Microsoft case. The entire website is now password protected, as reported on The Register a couple of weeks ago. Apparently, Groklaw is collecting all the documents on the page Comes v. Microsoft Exhibits, but the Evangelism is War page doesn't appear to be there yet. If anyone knows the location of this document, sent me an email. In the meantime, a good summary can be found on Amy Stephen's article "State of Iowa Consumers sue Microsoft for Acts of Antitrust".

Second Update (Thursday, 8th March)

Found it again, at http://edge-op.org/iowa/. I've updated the link above.

I've just finished a quick and relatively simple web design project I've done for Stu, a good friend of mine. It's called Gravestock Heating.

Stu Gravestock is starting his new business providing domestic heating services, such as central heating service and installation, gas breakdown work, and a heap more. He did a fantastic job in installing a new heating system in my new house. Now that he's decided to take the plunge and set up his own business, I wish him the best of luck in the future.

The Continuous Integration and Testing Conference (CITCON) was on last Saturday. I've only just got around to writing about it. There are already some other writeups available from the Comments on the Web page on the wiki. Anyway, here's mine...

For me, the most unique thing about the conference was the manner in which it was organised - using the OpenSpace rules. In summary, the rules are:

• Whoever shows up is the right group
• Whatever happens is the only thing that could have
• Whenever it starts is the right time
• When it's over, it's over

It was fascinating to see the OpenSpace rules in action. On the evening before the conference, everyone met up at the hotel. Paul and Jeff started off with by introducing themselves, and then asking everyone in the room to introduce themselves as well. We then moved on to the creating the schedule. We started off with a blank whiteboard for the schedule. Various people had subjects they wanted to talk about (or hear about), and so they got up and wrote down their subject on a sticky note, and put on an empty space on the board. I thought that there might be some problems getting enough sessions, but the board filled up quickly, and was in fact over-subscribed.

After the proposed sessions were posted, we broke up for drinks and informal chats. Everyone had a chance to look at the sessions, and put a mark against every session they thought they would like to see. Anyone could re-arrange (or even combine) sessions on the schedule depending upon popularity, convenience and personal whim. It sounds chaotic, but at the end, there was a remarkably coherent set of subjects arranged. If you look at the photo set I took, there are an interesting series of photos showing how the schedule evolved over the evening and the morning afterwards.

Aside from the scheduling gymnastics, the sessions themselves were very free flowing. Because there were no real "prepared speeches" or similar, each session was very much a collaborative discussion on the agreed subject. I thought that this had many positive and a few negative points. On the positive side:

• Discussions were highly interactive, there was little monopolisation of discussions
• Attendees were drawn into contributing to the discussion just by the mere fact that they were there
• Participants were all very positive and receptive to any discussions

I think the above points can be attributed to the fact that pretty much all the participants in the conference had decided to attend out of their own personal interest. They were all either deeply sympathetic to subject of the conference, or highly interested in learning about it.

The echo chamber effect is a phenomenon that people should be aware of in these situations. I didn't see much in the way of conflicting or dissenting options during the conference. This means that the subject under discussion is either undisputed, or the people with negative opinions are not present.

On the negative side, the main issue I had was to do with the expertise of participants in some sessions. Because there were no prepared presentations before a session started, there was no real guarantee that there would be any unique insights gained. Some sessions degenerated into a group of people sharing war stories about problems they've encountered. However, even in these situations, there was often insight to be gained into a specific problem.

With those points made, I think it was one of the most interesting and dynamic conferences I've ever attended. I think that a lot of the attribution to this can go to the OpenSpaces format and the fact that all the attendees were very motivated on the subject.

These are the sessions that I attended:

• 09.00: Non-functional testing in a CI environment
• 10.00: Continuous code policing
• 11.00: Break
• 11.30: Managing complex builds with Ant
• 12.30: Lunch
• 13.30: How to write GUI tests
• 14.30: Continuous integration anti-patterns
• 15:30: Break
• 16:00: Build telemetry and statistics

In three of the sessions I volunteers to take notes to publish on the wiki. The session rooms all had projectors available, so I just plugged in my laptop and typed notes on the big screen as people were talking. I thought that it was a good way to capture the conversations as they happened.

I believe I got very good value out of all those sessions. In the non-functional testing session I was able to ask people about strategies to start performance testing in the environment at my new job. In the managing complex builds session, I was able to have a good chat with the Buildix guys about their strategies.

In the end, it was great to meet so many CruiseControl enthusiasts, devs and committers. I was hoping to get a good look at some alternaive CI servers, but I only really caught a glimpse of the upcoming Atlassian Bamboo (which was interesting, all the same).

It's like this, see: I've been longing for years to set set up some lava lamps to indicate the current build status (as described by Alberto Savoia and Mike Clark). I'm an expert at CruiseControl, which supports an X10 publisher. All good so far.

Now, to use X10 from Java, there are two libraries you need:

• Jesse Peterson's pure Java implementation of the X10 protocol, which is available from http://www.jpeterson.com/.
• The Sun Communications API, available from http://java.sun.com/products/javacomm/.

First problem: Jesse Peterson's website appears to have disappeared from the net, and the domain is now parked.

Second problem: the Java Communications API download for Windows (which includes the crucial win32com.dll file) appears to have been completely removed from the Sun website.

Luckily, CruiseControl contains both x10.jar, comm.jar and win32com.dll in its own download bundle (although the setup instructions are still missing). Unfortunately, I couldn't finish setting up the equipment at this stage, as my work duties intruded, but a number of people looked very interested in the lava lamps that are sitting above my desk right now. I was hoping to have a successful implemenation report to brag about at CITCON, but you can't win 'em all.

The main worry is that the current implementation appears to be completely unsupported. If both the X10 library and the Java Communications API have been withdrawn, I may have to find a more supported method for integrating the lamps into the build process. It's very disappointing that the Java integration with standard ports is still lacking after all these years.

I went to a job interview recently. I had applied for a role in a team that worked on technically interesting projects, and they were very keen on the use of agile methodologies. From my first impressions, it looked an ideal place to work.

I thought I made a very good impression on technical part of the interview. The interviewers even made reference to my JUnit Anti-patterns article in a very positive manner, which I took to be good sign. It's hard to say sometimes, but I don't think I really made any major mistakes during this phase of the interview.

The one part of the interview that didn't seem to go down too well was the discussion about working hours. The conversation went something like this:

Interviewer: "The core working hours are from 8am to 6pm"

Me: "8am is fine, but I need to leave around 5pm to get home for 6pm (I like to at least see my kids before bedtime). I'm quite happy to make up hours at other times, or from home"

Interviewer: "We would prefer you stay until 6pm. We're an agile shop, everyone does pair programming. You need to be in the office during our core hours programming"

I stood my ground on the subject, as I care deeply about being home by 6pm. We continued on to other issues, and the interview finished up an hour later. I found out later that I wasn't offered the position. This was a vague disappointment (no-one likes to be turned down), but the working hours issue did make me a little wary of the place.

Some issues struck me:

• In a bit managerial reverse judo, they turned one of the top agile methodologies (pair programming) into one of the worst excesses of un-enlightened management (mandatory overtime).
• Surely their developers don't actually pair program 100% of the time. What about bathroom breaks?
• Why on earth do they think they need 10 hour working day as standard? There is plenty of literature that suggests that this is not sustainable. I've done 10, 12 and even 14 hour working days for brief spurts, but not as a regular event. I do want to spend some of the weekday on family matters, as a matter of course.

This was an investment bank, many of which are known for having a culture of long working hours (although this wasn't my experience when I worked at UBS). I have since spoken to other people who work at the place (Hi George! Hi Ben!), and they tell me that it isn't really like that, either. Perhaps the question is just thrown to interviewees to see how they react, and so it was my lack of enthusiasm about long working hours that disqualified me from a job offer. Or maybe it was something else completely.

Anyway, as a bit of happy ending, I did get a job offer at a different company. It's very close to home, so the issue of long commutes don't affect me, and it has a working environment like none I've ever seen before. They did put me through an grueling interview process, that went on for more than 10 hours. In the end, the payback for this time is an excellent working environment close to home with some great people.

This is excellent: IEs 4 Linux. This makes website compatability testing a whole lot easier for me.

In one of those strange examples of synchronicity, I managed to attend two different geek meetups in London on the same night; one was planned (XTC), and the other was a pleasant surprise (London 2.0).

The initial meet-up I went to was the Extreme Tuesday Club (XTC), which is held in the Old Bank of England pub every Tuesday night. I had promised Jeffrey Fredrick that I would plug the Continuous Integration and Testing Conference at XTC.

After chatting to a number of people, I met Patrick Kua (a ThoughtWorker and fellow Australian), who just happened to mention that he was only dropping into XTC for a short time, as he was heading over the London 2.0 meet-up for a demonstration of Selenium. My ears pricked up at this one, and I followed Patrick all the way to the other side of the pub to check out the demo. Hmmmm... in hindsight, it might not have been synchronicity, but rather clever planning by Sam Newman, who organises the London 2.0 meetups. I even managed to plug CITCON again there.

Some other random things that happened during the night...

• I met a Python developer (Christian, I think) in rather awkward circumstances: he had interviewed me for a contract a few days earlier. We got on well at the time, and I must have made the right impression, because they ended up offering me the contract. The awkward part came because I was stalling on giving them an answer, while I'm still waiting on a response for an interview from another company. We had a good laugh.
• I learned a lot about a really clever technique for testing web applications across multiple browsers and platforms using Selenium and Parallels on a Macintosh. Jason Huggins had come over to London for the Google Conference on Test Automation. In preparation for the talk, he was showing all and sundry the nifty wizardry that he would be demonstrating at the conference.
• I found out that APL is still in use (which I was vaguely aware of), and making an impact within agile circles (which was a surprise!) I spoke to Stephen Taylor, who presented a talk at the subject during XP2006.
• I learned that if you meet a woman who calls herself "Dot", you definitely should not ask her "dot as in dot com?". Getting that same comment eight times in one night was starting to grate on her a bit.
• I found that there is a disturbing number of Australians loitering around London
• I had fun, and met a heap of interesting people (using the geek definition of "interesting", that is).

I've been doing a lot of work around encryption lately. One of the tasks involved creating a dialog allowing the user to enter their password for encryption or decryption. One feature I put on this dialog was a "mask password" checkbox. When checked, the password appears as asterisks, meaning the people near the person are unable to see what is being typed. When unchecked, the plaintext of the passphrase is visible.

During review, someone asked why this feature was even available? Wasn't it a security hole?

The problem is that a cryptograpic key requires anywhere from 56 to 128 bits of entropy, depending upon the algorithm. An 8 character password can have anywhere from 8 to 40 bits of entropy, depending upon how rigorous the user is in avoiding dictionary words, or variants thereof, and using non-alphabetic characters. A much better strategy is for users to use unlimited length passphrases, perhaps using "shocking nonsense" as a mnemonic. An interesting discussion on this subject can be found in the PGP Passphrase FAQ.

The problem with unlimited length passphrases is that people (in general) are terrible typists. Without the feedback of seeing exactly what they are typing, they are unable to correctly type in long phrases without error.

Allowing the user to unmask the password as they are typing gives them the confidence to use much more secure passphrases, with the added issue that they must make sure that no-one is watching as they type. In general, this is something the users are much more able to evaluating the risk. Considered altogether, the actually increases the security of the entire process.

The Continuous Integration and Testing Conference (CITCON) is hitting London this October, and there's a fair chance that I'll put in an appearance (pending my other obligations). Details are at http://www.citconf.com/.