We’ve been checking our DNS servers at Broadsight in view of the recent vulnerability to the DNS system found by Dan Kaminsky. In a nut shell, the vulnerability means that unpatched DNS caches can be “poisoned” into remembering the wrong IP address for a server. If a person, company or their ISP is affected, any or all Internet applications can be redirected to a malicious server. This means that email, web, IM or even software updates could be subverted. For more info, see Bruce Schneier’s Blog

This issue set us off thinking about trust and identity on the net, which is something we keep coming back to. The interesting thing about the DNS problem is that the DNS system is not meant to be very secure. If you want to check who you are talking to on the Internet (or any untrusted network) there are perfectly good technologies to do just that e.g. X.509 certificates, SSL, SSH, etc. The problem is that people are not very good at using them. For example, there are plenty of phishing scams that obscure the real server identity, simply by showing a “fake” address in the visible part of the hyperlink. Many people have revealed their banking passwords in spite of the fact that the certificate must have been invalid or missing. Of course, it’s not all the fault of the users. Many websites that handle sensitive data don’t use SSL (LinkedIn is an honourable exception, by the way). I guess this is partly cost and partly ease of use. Security always takes some time and effort.

So, supposing that your DNS is working properly, all that it tells you is that you are connected to a server that is registered with the name it’s registered with. You don’t really know who runs it or whether they can be trusted. Obviously, many user stick to well known brands like Google and Amazon for this reason. They may trust recommendations via word of mouth (off net or on discussion boards.) There are also some sites that rate other sites, but who guards the guardians? We can see scope for a system of federated delegation of trust, so trust can be securely passed on via social networks. Of course, there are sites that do this internally (notably eBay) and that has been very successful, but is limited to the site in question. It’s also quite one dimensional. Trust should be a richer concept than that. For example, I might trust my accountant to do my taxes and my doctor to diagnose an illness, but not the other way round.

As more of life is conducted on the net, it will more and more become important to present identity and trust in ways that users can understand and use appropriately for the task at hand, from reading wibble on a discussion board right the way up to eCommerce and banking. I think it will be the mid-range activities that will be hardest to get right. Already, the banks are locking down their security, so criminals will be looking for softer targets e.g. pump and dump. Think how effective that would be if someone had subverted the website at the Financial Times?

Saw this on the WSJ stream via Techmeme: yet another refrain about the End of CIO’s as you know it, this time from Rebecca Wettemann, an analyst at Nucleus Research:

There was a time when IT departments could get away with forcing employees to use complicated and hard-to-use software. The average worker didn’t know that better alternatives were out there. But as workers gain experience with consumer-focused software – either in their personal lives or at the office – they’re starting to realize that software can be easy to use and quick to get started on. It started with productivity boosters like instant messaging and collaboration software, but it’s crept into the realm of software that’s traditionally the realm of IT departments, such as sales automation.

“No CIO is going to tell me that [a software project] is going to take 12 to 18 months,” Wettemann tells us. Workers will just find an alternative on their own.

Thats cool - one hopes that the workers will also find ways to integrate it with all the other systems in the enterprise, and maintain and fix it on their own too, and take responsibility for the updates and all the re-jigging required when another system updates itself. (And will decommission it in 6 months time when the next New Shiny Thing comes along )

I didn’t think so…….

This sort of reporting makes this interesting assumption that “user delight” rather than “does it work” is the key determinant of a CIO’s continued employment,. What people like Ms Wetteman don’t get (one suspects because they have little experience of actually running any big IT operation) is its not the User Presentation Layer that is hard to do - which is why N thousand Web 2.0 startups running on shoestrings are blooming. The hard thing is integrating the many complex components at the infrastructure level. A CIO is not fired if the users think an interface is clunky - a CIO is fired if the critical systems don’t work.

But, CIO dinosaurs clearly needs to get their priorities right:

An IT pro’s “job is to pay attention to what is going on out there with the humans in your organization, not the servers”, and…

Managing tech equipment and maintaining older systems will become decreasingly important. Identifying the best new tools early on and figuring out how to get them into the hands of the people they’ll benefit will be the more important skill.

Actually, that is exactly a CIO’s role - with the underlying proviso that it all has to work. One is tempted to see what decisions Ms Wetteman and her ilk would make re rate of adoption of shiny new things if they were actually put in charge of running a company’s IT, and their jobs - and reputation - depended on it.

(Afterthought - that is not to say that better user interfaces are not a good idea, just that they are not a first order priority - consumers, on the other hand, are initially far more “sold” on system UI rather than capability, hence the huge emphasis on that area in consumer systems. There is no doubt that the newer “stuff that works” will be brought into the enterprise, but it will be on a more careful, more selective basis.)

Managers, sales representatives and marketing persons all alike complain every day that they have to deal with tons of mail messages from customers, from team-members, from higher authorities, etc and that this activity takes up a large portion of their day.

One recent study shows that more than one hour of an employee’s (effective) working time is used for reading, replying and forwarding e-mails. The help you cope with this potential problem, here are some tips for managing this burden of email overload.

1. Make a schedule for reading and writing emails. If you are dealing with huge number of emails, it will be better to manage your mails in 3 time periods a day. Morning for reading very important messages and replaying those that require instant reply. Afternoon for reading and replying messages which is meant for that day and evening for checking all other mails.
2. Instantaneously move spam mails to where they should be - spam folder. Don’t waste time reading them
3. Doing internal communication through special company systems like CRM or SFA software. This is more secure and reduces your mail burdens.
4. Telling others to use good subject line and brief mail content.
5. If you software allows for it, use some symbols or acronyms for tagging messages according to their type like URG for urgent.
6. Differentiating necessary messages from unnecessary ones is very important.
7. Creating a specific time for company and team mailing; so that everyone can adjust to that.

Futurists, especially those who claim to have a methodology beyond psychic prediction, tend to rely primarily on Moore’s Law for figuring out what technology will be like 5, 10, or 20 years from now.

But Moore’s Law, which predicts that computing power will drop in cost by 50 percent every 18 months, isn’t some absolute speed limit and some measures of technical achievement are actually moving faster than Moore’s Law predicts.

It’s not that they violate the law (if it even IS a law) but that they take advantage of loopholes like the one where Moore’s Law can sometimes be applied TO ITSELF, leading to even faster change. That’s what’s about to happen to television and why your new digital television probably won’t matter much as a technical standard after 2015.

In order to understand this better let’s first look at the broadband Internet market. I’m an American employed as a cranky technologist by an American television network, so this is pretty U.S.-centric, but there are lessons here for many countries.

Ten years ago, the United States had the fastest and cheapest residential Internet service in the world. Today U.S. residential Internet service, especially broadband, is among the slowest and most expensive. Fortunately, this is likely to change as U.S. broadband Internet services become decidedly more competitive, both in terms of cost and available bandwidth. Unfortunately, U.S. broadband adoption rates are slowing at a rate that suggests ultimate market penetration under 90 percent.

Japan went from being among the most expensive countries for residential Internet bandwidth a decade ago to absolutely the cheapest today. While some of this change can be attributed to technology improvements, most of the change can be attributed to competition, specifically the entry of Softbank BB into the Japanese broadband market.

Softbank BB entered the Japanese market early this decade with loss-leader pricing that forced all the incumbent broadband suppliers to respond in kind, leading to a dramatic expansion of the Japanese broadband market where today residential 100-megabit-per-second service costs less than $20 per month.

This Japanese model does not apply well to the U.S., where there is no broadband provider willing to take the bet-the-farm approach of Softbank BB. The U.S. market also has no true national broadband ISPs that operate on a scale comparable to those in Japan. And the topology of the U.S. Internet is such that the high-bandwidth technologies applied in Japan would not work as well here simply because of a larger rural customer base.

Korea, as it is often wont to do, followed Japan in terms of bandwidth pricing. More importantly the government of Korea made it a national priority to build out the residential Internet infrastructure at government expense.

This was, ironically, in part inspired by the U.S. National Information Infrastructure plan, which was intended to accomplish the same end but failed miserably. Though they took full advantage of $150 billion in tax credits, the U.S. telcos simply did not build the network they had agreed to build, yet their model inspired more successful efforts in Korea, Singapore and other Asian markets.

Of the 30+ nations that can be judged to have residential Internet service superior to the U.S., in case after case that superiority can be attributed to government funding of infrastructure, to largely urban (short-distance) topologies, or to aggressive competition.

In the United States, unlike most of the rest of the world, broadband Internet service has been dominated by cable television companies offering cable modem service on their hybrid fiber-coax systems, with telco xDSL service a less popular broadband alternative until very recently. Cable Internet service was originally coordinated on a national basis through Excite@Home, but with the failure and liquidation of that company in 2001 most cable systems were left to fend for themselves as ISPs, with varying levels of success.

Since few cable TV systems have competition and regulation has tended to concentrate on television — not data — service, changes in price and available bandwidth have been generally dictated by whatever competitive broadband offering came from the local telephone company.

It is important to realize that bandwidth has not been lacking for U.S. cable ISPs, which typically devote to Internet service the bandwidth of one analog channel (usually Channel 80) on their systems. By adding a second data channel or (more often) segmenting their network into subnets, cable ISPs have plenty of aggregate bandwidth at their disposal but have simply not been challenged to provide it given that competitive telco products have been, until recently, limited to 1.5-megabit-per-second downloads.

Technology improvements and business model changes among broadband ISPs appear to be finally leading to significant changes in the U.S. residential broadband market. Technology is always advancing, of course, and the technologies coming into play are DOCSIS 3.0 on the cable Internet side and various forms of Fiber to the Home and Fiber to the Curb among the telcos.

The business model changes involve so-called “triple play” services where ISPs hope to make money from providing not just Internet service, but also telephone and television. The cable TV companies want to steal from the telcos basic phone service while the telcos want to steal television service from the cable companies. Since either possibility requires advanced data services and more bandwidth, users benefit.

DOCSIS 3.0 services will begin appearing shortly, offering up to 150 megabits per second, though it is doubtful that many cable ISPs will jump straight to that level given the emerging xDSL telco limitation of 24-26 megabits per second.

The telcos, notably AT&T and Verizon, are aggressively building out their fiber plants. Verizon is taking fiber directly into the home, but AT&T is taking its fiber only as far as the curb . This ostensibly limits AT&T to xDSL speed limits, though the company can use channel bonding (more than one pair of copper wires per service) to increase speeds if forced to do so by competition. Verizon is rolling out residential fiber service from 30-50 megabits per second but its equipment can jump to 100 megabits per second if needed without requiring another truck roll.

An important secondary motivation for this fiber rollout is that telcos are not required to share such facilities with competitors as they have been required to share copper infrastructure under the Telecommunications Act of 1996. So while there may be competition in the neighborhood from cable modems, once the fiber is in and the copper is out the telcos need never again fear competition from Competitive Local Exchange Carriers (CLECs).

Over time there will be other types of broadband ISPs that may provide competition and thereby spur service improvements. One possibility is WiMax, but WiMax is NOT a service that can compete for true high-bandwidth (above 10 megabit-per-second) service on an economical basis. The same applies for so-called 3G and emerging 4G wireless data services from cellular phone companies, which are also limited in total aggregate bandwidth.

While the number of U.S. residential broadband users is continuing to increase, the rate of that increase is slowing according to several surveys by the Pew Internet & American Life Project. Extrapolating these numbers suggests that ultimate broadband penetration will be comparable to cable TV, or around 85 percent. This slowing of growth may be inspiration for the growing telco vs. cable battle over triple play digital services, with the idea that some telephone users (where market penetration is already 97+ percent) will be induced to buy broadband service to lower their telephone costs.

There is a base cost of around $20 per month for providing broadband Internet service irrespective of the allocated bandwidth based on published cost assumptions of international ISPs. This $20 is essentially the ISP overhead and is unlikely to decrease significantly no matter how inexpensive bandwidth, itself, becomes. So while there has been some moderation in broadband subscription rates in recent years, it has been minimal, with ISPs generally using introductory specials, rather than permanently lower rates, to attract customers.

Broadband customer churn is minimal, probably due to local monopolies and not wanting to give up ISP-branded e-mail addresses, so there is not significant price pressure. Rather, there is pressure to provide greater bandwidth at the same price. Nearly any U.S. residential pricing model, then, will have a base subscription cost of around $30-40 per month but with the ISP allocating increasing amounts of bandwidth for that unchanging payment. In this instance the ISP is generally hoping to make much of its profit on value-added services like Voice-over-IP phone service or movie downloads.

After staying for years at an average 1.5-megabit-per-second download speeds, broadband ISPs are moving to an average of 6 megabits per second in 2007-2008, 24 megabits per second in 2010-2012, and 100 megabits per second in 2014-2016.

Okay, so that’s the bandwidth picture, but what will we do with it? Here’s where Moore’s Law reenters the picture. As processors get more and more powerful they will migrate into many consumer electronic devices, especially televisions. It’s not that televisions will become computers but that televisions will become more and more computerized.

This leads to a very interesting effect. As we’ve seen above, Internet bandwidth growth is already defying Moore’s Law, growing at 100 percent per year with roughly flat prices. Add to this increased processing power in televisions and we’ll get decreasing bandwidth requirements as televisions will be able to run more powerful codecs. Where many PCs today can’t do real-time 1080p video decoding in software, simply throwing in another generation or two of Moore’s Law will eliminate that problem completely.

So bandwidth will get cheaper and cheaper while our entertainment devices will be doing more and more with available bandwidth. Add to this the slow evolution of video standards and we’ll have cheap bandwidth and even cheaper processing power colliding with the wall that is the 1080p HDTV standard, leading to ultra-low per-stream costs for entertainment providers.

To explain this another way, traditionally industry would react to such cheap bandwidth by jumping us all to 2K or 4K displays or maybe 3D, and that might well happen eventually. But until then we’ve decided as a technical culture that 1080p — so-called Full HD — is as good as it gets. Jumping beyond 1080p will require years of haggling and during that time 1080p will become cheaper and cheaper and cheaper to do, leading to that inflection point alluded to in this week’s column headline.

Around 2015 is the time when the cost of sending a separate 1080p video signal to every Internet-connected viewer — or POTENTIAL VIEWER — will be the same as using a broadcast model and sending that signal through the air. After 2015 there will be no scaling limits, no processing limits, no decoding limits. And since individual video streams mean individual commercials with a requisite CPM (cost per thousand) bump of up to 10X, commercial television as we know it will die, replaced by consumers choosing from a menu or recommendation engine what they want to see when they want to see it.

Just follow the money.

Commercial stations will repurpose their bandwidth for alternate wireless services, eventually shutting down their digital transmitters completely. And PBS, which can’t create a marketplace all by itself, will follow.

I’m not saying here that you shouldn’t buy that new DTV, because it will fit into most any emerging system. But I am telling you that the era of the television programmer, where some guy at the network or down at your local station thinks he knows in what order and on what days the audience really wants to watch TV, well that era will be gone forever, seven years from today.