by Brendon J. Wilson

Christmas Posters For My Team

Now, more than ever, development teams need ritual and appreciation to build cohesion, psychological safety, and a shared sense of purpose and belonging. I wanted to share a little project I did this past Christmas to build a little bit of that with my team.

Christmas is often a time of anxiety. In workplaces there’s always the question if co-workers celebrate Christmas and if folks will be giving tokens, however small, to each other to celebrate the holiday. In the past, I’ve tried to give my team and co-workers something small, not necessarily Christmas-related, to recognize the journey of the past year and the journey ahead in the upcoming year. Two years ago, I gave each of my team members a Daruma—a Japanese goal-setting doll—with the hope they would place it on their desk and use to set themselves a personal goal for the upcoming year. It would also form a conversation piece amongst the team (“What’s your goal?”) and provide a small visual cue to outsiders dropping by the team’s desks that we were all part of the same team.

Daruma are a great gift because they’re relatively inexpensive (no guilt that you got folks something, but they didn’t get you something), and they have a great ritual associated with them. The dolls come with blank spaces where the eyes should be, and at the beginning of the year, you color in the left eye of the Daruma while visualizing your goal for the year. Then you place the doll in a prominent place where it can remind you of your goal throughout the year. Later, once you’ve achieved the goal, you color in the other eye. Traditionally, you burn the doll at the end of the year.

This year, I wanted to do something a bit more personal to bring a fitting close to a challenging year, and to ground the team’s thinking as we enter into 2021.

I’ve always been an avid collector of quotes from history, thought leaders, and other witty people. Some people read horoscopes. Some people collect stamps. I curate the words of people smarter than me that capture a key insight about the world and which provide me with comfort, motivation, inspiration, or joy in the midst of adversity. This year I chose to give each team member a poster with some of my favorite quotes, each one chosen specifically for the team member. In some cases, the quote captures something unique I know about them, their interests, their world view, or their role in building Alexa. In other cases, the quote was a call to action for the team member to build on their unique value—encouragement to keep pushing themself and their peers to raise the bar. For those team members that I hadn’t gotten the opportunity to know better or who are new to the team, I chose quotes that capture where they are in their journey with their career at Amazon and the value I hope they will bring to the team in 2021.

I built the posters using Amadine (a great, inexpensive illustration program, highly recommended) and chose a palette for the posters from Spectrum IV, a well-known “hard-edge” painting by Ellsworth Kelly. Hard-edge painting was an innovative category of abstract art associated with California in the 1950s that combined geometric abstraction with intense colors. Spectrum IV is from a series of eight collages Kelly created in 1951 titled Spectrum Colors Arranged by Chance I to VIII, wherein Kelly created each collage using a different process by arranging colors chosen randomly using numbered slips of paper. I felt that the combination of strong colors and the process Kelly used were a perfect metaphor for the process of building a team: combining bold individuals with unique attributes, brought together by chance, to create something entirely new. For individual contributors, each poster features a different color from Spectrum IV, also chosen by chance. For managers, their poster encompasses all the colors of Spectrum IV and represents their role in combining and unleashing the unique gifts of their team.

Beyond the value of providing something personal, it was also my intention that this would be something that each team member hangs somewhere in their workspace while we continue working from home into 2021. I’ve already spotted a few of the posters hanging out in the background of a few of our team’s video conferencing calls, and had a few personal conversations with team members about the quote on their poster.

It doesn’t take much to make a thoughtful connection with your team — why not try something like this with your team in the future?

in Personal 0 comments
Apple unveils Face ID
 by Brendon J. Wilson

Worried About Face ID?

There’s been a lot of noise in the two weeks since Apple announced the new iPhone X and its new Face ID solution. Much real and virtual ink has been spilled about the technology’s dire consequences for privacy and security, much like in the aftermath of the Touch ID announcement in 2013. People don’t seem to recall the controversy of Touch ID, or how most of the doomsayers at that time were largely proven wrong in their assessment of that solution.

This post attempts to step back and provide an omnibus examination of the concerns with Face ID.

What is Face ID?

Face ID is a biometric system for recognizing a user against a biometric template of their face, previously captured during device configuration. Face ID relies on Apple’s TrueDepth camera, a sensor capable of measuring 3D images of a user’s face with a combination of an invisible infrared flood illuminator, an infrared dot illuminator, and a camera that can detect infrared.

The TrueDepth sensor on the iPhone X

The process uses structured light scanning to extract 3D data from 2D images and projected light patterns. Infrared light allows the process to function under a variety of lighting conditions, as well as to sense through obstacles such as sunglasses.

Is Face ID Secure?

Evaluating security requires a structured evaluation framework (such Schneier’s attack trees approach), but a high-level approximation of the answer can be achieved by answering three questions:

  1. Where is biometric data stored?
  2. Where are biometric operations performed?
  3. How effective is biometric matching?

Where Is Biometric Data Stored?

Apple has released its Face ID Security Guide, which confirms earlier statements by Craig Federighi indicating that the security model of Face ID is very similar to that of Touch ID. Like Touch ID, biometric templates captured by the TrueDepth camera are processed and stored locally in the Secure Enclave, a dedicated security coprocessor. The biometric data is never exported from the Secure Enclave to the main operating system processor.

Where Are Biometric Operations Performed?

As with the biometric templates, and all biometric matching and training for Face ID also occurs within the Secure Enclave. However, biometrics can do more than verify a user against a stored biometric template; they can also be used to gate access to sensitive data. But how such sensitive data is protected?

In the case of Touch ID, iOS enabled the fingerprint sensor to be used to gate the use of a cryptographic key created by an application. This feature allowed applications to generate keys to protect data, and required the user to touch the fingerprint sensor to approve the use of the key for a cryptographic operation. As with the biometric operations, all cryptographic operations for Touch ID are performed in the Secure Enclave (although it turns out that private keys could be exported until iOS 9 added a new flag to make private keys non-exportable).

Face ID has followed a similar pattern, allowing Face ID to be used to gate Keychain-protected items using the existing touchIDAny or touchIDCurrentSet ACL flags. Applications that support Touch ID will automatically support Face ID without requiring any code changes by the developer.

How Effective Is Biometric Matching?

An additional concern in biometric systems is how well the system defends itself against a malicious attacker presenting a fake biometric. These systems extract features from the sensor data to create a biometric template during the set up (enrollment) process; to check someone’s identity, the system captures another set of data from the sensor, extracts features, and then compares how “close” these features are to the stored template’s features.

As a result, these systems are probabilistic, otherwise they would never work, even with the right finger / biometric. Subsequent captures, even from the same biometric are never identical for a variety of reasons (limitation in the resolution of the sensor, dirt / environmental noise, positioning of the biometric, etc.), and hence there’s always “wiggle room” in the matching process. It is through this gap that attackers attempt to squeeze themselves.

Could a hacker bypass Face ID? In all likelihood, the answer is yes, if history is to be any guide: less than a day after the public release of Touch ID-enabled devices, German hacker “starbug” demonstrated how to spoof the Touch ID sensor using a lifted fingerprint, wood glue, and a printed circuit board.

A year later, the same hacker demonstrated how to replicate fingerprints using photos taken with a standard digital camera. The 2D face recognition on the Samsung Galaxy Note 8 was similarly fooled by a 2D photo, an attack that Face ID’s use of 3D sensing and infrared defends against.

With Face ID, spoofing concerns have again been raised. However, based on the information released by Apple so far, Face ID is likely to be more secure than Touch ID. Touch ID has a false acceptance rate (FAR) of 1/50,000, assuming only one enrolled fingerprint; enrolling multiple fingers increases the false acceptance rate (two fingers = 1 / 25,000, three = 1 / 12,500, etc.). In contrast, Apple has stated Face ID has a FAR of 1 / 1,000,000. And, as pointed out in the wake of the Touch ID spoofing attacks, bypassing a device-based biometric matching process requires significant effort and, more importantly, physical access to the device. Without physical access to the device, possessing a biometric capable of spoofing the sensor is useless.

What Are the Real Risks of Face ID?

Attacks on the Secure Enclave

The security of Face ID and iOS as a whole is heavily dependent on the security of the device operating system, the kernel, to both enforce authorization rules around data, and protect device secrets. The Secure Enclave plays a central role in ensuring the protection of data, and the enforcement of authorization rules on the device. Even specialized security environments may have vulnerabilities that allow an attacker to gain access to a device and its data (as we saw with the successful attacks on the Qualcomm implementation of TrustZone, as cousin of the Secure Enclave).

The bar for such attacks is very high, and Apple continues to make significant investments to raise that bar. Should such an attack be possible, it’s likely that only the most adept attackers (such as nation states) would be capable of exploiting it.

In this case, this is not a problem that is unique to Face ID. What might be unique is that attackers may be able to extract copies of the 2D infrared images of your face, and the biometric features extracted from the depth maps created by the TrueDepth sensor. That information might allow an attacker to gather facial information for a large-ish number of end users. However, given that the average citizen is caught on camera 75 times a day, this does not seem to be the easy path for an attacker to gather such information.

Novel Face Biometric Attacks

Face recognition has some unique challenges versus fingerprint recognition, such as the ability to distinguish twins. something that Apple did call out in both its presentation and in its security guide.

That said, Apple claims the TrueDepth camera is able to distinguish twins based on the high resolution of its sensor and minute differences between twins. However, even if Apple can’t distinguish all twins (they note that for identical twins the “probability of a false match is different for twins and siblings that look like you”, and recommend using a passcode to authenticate), one should consider that twins comprise about 3.35% of births according to the CDC. That’s a fairly small percentage of the population to be concerned about. And, again, your evil twin needs to have physical access to the device (though for twins, that’s probably not a stretch of the imagination).

While I’m not aware of any public demonstration of a spoof attack against the TrueDepth camera (or its close cousin, the RealSense camera employed by Windows 10 devices), I have no doubt that someone will figure out how to do it. It could be something high tech that confounds the AI (such as these glasses that fool 2D face recognition systems), or something relatively low-tech (like a 3D printed mask generated from a single picture of your face). Apple claims to have thought of everything (even the mask-based attack), but I have no doubt someone will find a way.

Targeted Device Attacks

If you accept that the Secure Enclave does its job to defend against remote, scalable attacks, then what remains is attacks on a device in the possession of the attacker. Targeted attacks—those where an attacker has access to the device and the biometric—are extremely difficult to defend against.

For example, the adoption of Touch ID revealed a number of pragmatic issues in deployment. Parents had to worry that their kid might touch their finger to the Touch ID sensor while they slept, thus approving hundreds of dollars in purchases. Banks worried about “friendly fraud” by a disgruntled spouse whose fingerprint was registered on their partner’s device, thus enabling them to clear out their partner’s bank account. And civil liberties watchdogs worried that biometrics could erode protections against violation of the fifth amendment protections against self-incrimination, unlike PINs (which law enforcement cannot compel you to disclose).

While Face ID eliminates the “friendly fraud” risk (as you can only enroll a single face), most of the other risks remain. Apple has attempted to limit the risk of targeted attack by adding stronger lockouts when the wrong biometric is presented multiple times (as happened in the Apple demo), requiring attention for authentication (detecting that your eyes are open and directed at your device), and the ability for the user to trigger the device to fall back to PIN authentication by hitting the power button five times.

However, these do not eliminate that risk entirely. Users facing the risk of a targeted attack are recommended to avoid biometrics are rely on a PIN.

However, even that may not be enough as researchers have demonstrated successful attacks to guess user’s PINs based on subliminal channels, and many users continue to set poor PINs. As we saw earlier this year when border agents forced a US-born NASA scientist to give up his device’s PIN, indicating that avoiding biometrics won’t help you in all situations; although a law enforcement officer that forces a user to unlock their device may render any obtained evidence inadmissible in court, that’s only a comfort if the rule of law applies. Around the world, some users’ threat model may be quite different:

XKCD on how security really works

Acceptance of Server-Side Biometrics

One final risk is less about the technology and more about public attitudes towards biometrics.

Many civil liberties advocates are concerned that the propagation of biometrics in mobile devices may acclimatize citizens to the idea of biometrics being used by governments, ultimately leading to Orwellian outcomes. That’s a reasonable concern, but that’s not something Apple itself can address other than by advocating for client-based (versus server-based) biometric solutions. Already, fingerprint biometrics have been deployed in Japan in ATMs for over a decade, iris biometrics have been deployed in India for over one billion users, and the customs agencies globally already use fingerprints and photos to identify travelers at the border. It’s not clear that Apple Face ID will significantly accelerate government biometric adoption beyond its current pace.

If anything, Apple has set a high bar for biometric systems that is being emulated by Android and by Android OEMs. Even the US National Institute for Standards and Technology (NIST) has indicated that client-side comparison of biometrics is preferred in Special Publication 800-63B.

Recommendation: Focus on the Positives

It may not be perfect, but Face ID continues the trend of biometrics delivering both better security and increased usability. That’s a good thing.

Increased Protection of Devices by Default

For all the potential pitfalls of Face ID, it’s important to realize how it continues the trend of improving the vast majority of users’ security. Before Touch ID, only a small percentage of users employed PINs to protect their devices; anyone could lift a device, and have full access to your device and its data. After Touch ID devices had available for a year, 89% of users with Touch ID-enabled devices protected their device against this attack. Face ID will probably only improve this.

Reduced Reliance on Passwords

Touch ID and Face ID open the possibility of moving away from passwords, the toxic waste of online security. For most people, the worry is not that a twin with access to their device will be able to bypass Face ID, but rather a remote attacker who compromises Yahoo will be able to recover millions of users’ passwords and use it to access other accounts (because users typically reuse their password everywhere). By moving towards authentication standards like FIDO that can leverage Touch ID or Face ID to protect online accounts against remote and scalable attacks, we’re dramatically strengthening the defenses that attackers must overcome to compromise our accounts.

in Technology 0 comments
 by Brendon J. Wilson

How A Game Can Make You A Better Storyteller

At heart, Product Managers should be great storytellers. They should be able to craft compelling narratives to justify a new initiative. Or outline a heroic quest to incite engineers to build that next great product. Or conjure enchanting tales that sales and marketing can use to sell the product.

Not everyone can spin a tale that makes their audience lean forward in anticipation. Storytelling is a muscle, one that requires constant workouts.

Enter True Story

A longtime friend, Kevin Cheng, introduced me to a card game called True Story. On the surface, True Story is an icebreaker game that individuals can use to get to know each other. But, its true purpose is to refine your ability to structure stories in a compelling manner. True Story is a “head fake” learning activity like those Randy Pausch detailed in his “Last Lecture“:

We don’t actually want our kids to learn football. We send our kids out to learn much more important things: teamwork, sportsmanship, perseverance. And these kind of “head fake” learnings are absolutely important. You should keep your eye out for them, because they’re everywhere.

Playing the Game

Each player gets two new cards in each stage of the game, with each card providing a storytelling prompt. Prompts are open-ended, and include koan-like statements, such as:

School Days

Lessons learned
Playground is the real classroom
Show’em what you’ve got

There are three stages in the game, with each stage building on the prior one. Player get two new cards in each stage, and select one card to use according to the instructions for the stage. Each stage guides players to focus on one component in the structure of a good story:

  • Stage 1: Players tell a sixty second story to “paint the scene” on a memory inspired by the prompt card. Players describe the sights, sounds, smells, tastes, sensations, and feelings of the memory.
  • Stage 2: A three minute story where the player expands a memory into a story. The player begins by setting the scene as in Stage 1. Unlike Stage 1, this story continues until something changes and forces them to react. The change could be something in the storyteller, or the conditions around them. The story comes to a conclusion, but without any reflection.
  • Stage 3: A five minute story where the player concludes the story with a self-reflection. Stage 3 builds on Stages 1 and 2, but concludes with the storyteller the meaning of the experience. Ask yourself: what did you learn about yourself or the way the world works?

Observations

I have players break into groups of three or four to play the game. After each stage, we reconvene to discuss some open-ended questions:

  • What stories or parts of a story did you find especially compelling?
  • Why was it compelling? What memories or feelings did it evoke?
  • What unique tricks did a storyteller use to transport you into the setting for their story?
  • What thoughts did the storyteller evoke as you listened?

Stage 1 is the hardest for players to execute. For one thing, telling a story to other people is very personal, even when it’s about the most mundane of topics. Players are vulnerable, nervous about sharing their experiences, and even “doing it right”. The room has the same jittery quality of a high school game of “Truth or Dare”. Some players will even try to bargain for new cards (“Oh, I can’t tell a story about this!”).

Stage 1 is also hard because most people struggle to limit themselves to setting up the story. Players will rush into the thrust of the story without “setting the stage” first. This makes life difficult in Stage 2 and 3. When you fail to “set the stage”, you end up confusing the audience when you backtrack to fill in the missing context.

Once Stage 1 is over, things get easier. Players have heard some examples from other players, and tend to relax a bit. Despite the slow start in Stage 1, players are enthusiastic to get into the remaining stages of the game. The atmosphere in the room turns positive and collegial. And the volume level definitely goes way up during the following stages.

After the game’s conclusion, players usually continue to analyze stories long afterwards. Stories are the glue that bind people together, enabling better relationships. If nothing else, playing True Story might help you build a better team.

Implications for Product Managers

Product Managers should realize that everything is a story. That new project you want to start? That’s a story. The customer need that you’re trying to convince engineering to address. That’s a story. The messaging you want your sales team to absorb? Story. If you can spin an epic tale, driven only by a two word prompt on a card, you can tell a story about anything.

Of course, the important takeaway is how to tell that story.

Stories have structure: a beginning, a middle, and an ending. Omitting those elements confuses an audience. At best, the audience will do nothing. At worst, they’ll resist your proposals because they can’t figure out what the heck you’re talking about.

Both Product Management and storytelling are exercises in empathy. PMs need empathy for the problems of customers, partners, engineers, and management. Storytellers need empathy for the characters, their struggles, and the listeners. They are two sides of the same coin.

In the world of Product Management, much of the focus these days is on data and analytics. But raw data doesn’t tell you why someone did something. Why did the user click on that? What did they think it would do? Why didn’t they click on that? What’s going on in their lives? Their minds?

Customer development interviews help people tell their stories to PMs. But as a PM, your job is to synthesize those stories into a compelling narrative to provoke action. Playing True Story will enable you to craft these stories and inspire action.

Other Sources of Inspiration

If you’re looking for other sources of storytelling inspiration, check out these podcasts:

I’m also a fan of a few writers that do a great job of making business topics compelling to a wide audience. I recommend checking out books written by Steve Johnson, Malcolm Gladwell, Michael Lewis. I also recommend Stephen King’s “On Writing” for its strong advice on the craft of writing.

If you’re looking to play the game yourself, see the end of this slide deck for a few example prompt cards for your use. If you need more, why not head over to True Story and buy the game?

in Product Management 1 comments
 by Brendon J. Wilson

Stop Blaming Users For Bad Passwords

Another year, another vendor study about how users choose absurdly bad passwords to protect their precious online accounts. This year’s study came courtesy of Keeper, while prior years’ reports (for 2015, 2014, 2013, 2012, and 2011) came from SplashData, a password management service for small businesses. Spoiler alert, the most used password this year is the same as last year: ‘123456’.

Every time I see one of these “studies”, I die a little inside. It’s not because poor passwords aren’t a real problem – they are: proper authentication is critical to defending the mobile and desktop internet applications of today, and the Internet of Things applications of tomorrow. I hate these reports because they blame the victim, the user.

Oh sure, these articles might levy some small admonishment aimed at applications (“the bigger responsibility lies with website owners who fail to enforce the most basic password complexity policies”), but by and large the unspoken message is “look at how stupid users are for using one of these passwords.” These click-bait articles are designed to deliver a dose of Schadenfreude to the reader, and allow them to wallow in smug superiority while they giddily guffaw at gems like ‘123456789’ (“Oh look, some moron actually thought that was better than ‘123456’—what a dolt!”).

Everybody knows bad passwords are a problem. Everybody knows you shouldn’t re-use passwords across multiple sites. Everybody knows you should pick a password with a mixture of characters, but not a dictionary words (except, well, if you’re using a passphrase, in which case you should use dictionary words, but only the right way). Everybody knows all of this, and much more.

There’s just one problem: users just don’t care.

Just look at the stats over the last 5 years: some variant of ‘123456’ has appeared at or near the top of every one of these lists. Who’s the bigger idiot: the user for whom ‘123456’ keeps working and with little or no obvious adverse impact, or the apps and web sites that allow such bad passwords in the first place and ultimately suffer all the reputation damage or regulatory fallout?

These kinds of articles do little to advance awareness of a real solution to this problem, nor do they make much of an attempt to do so. It’s telling that such articles rarely mention the very real advances being made to address the problems posed by passwords, such as:

On that last item: there’s literally no reason to even ask the user for a password anymore. App developers can use both Touch ID and FingerprintManager to build password-less authentication schemes like FIDO (check out the video below). Right now. Today. Like, as I’m speaking to you. There’s even commercial SDKs that developers can just plug into their app to perform this function with minimal additional code.

Instead of blaming the user, how about apportioning some blame to the apps and their developers? How about calling out the applications that allow such ridiculously poor passwords? How about shaming sites that actively disable password managers? How about some link-love for sites like TwoFactorAuth.org, which catalog which sites do and don’t support strong authentication options, and enable users to demand better?

But of course, that’s not the purpose of these articles. The articles aren’t about getting rid of passwords. They’re about positioning a vendor’s technology as a solution to this problem. Yes, a password manager when used properly is better than nothing. Yes, adding SMS two-factor authentication will reinforce poor passwords.

But passwords are an addiction, and these bolt-on half-measures are methadone. Heroine is bad, they say, but let’s not be too hasty about going cold turkey.

It’s time articles like this called out apps and developers to kick the password habit.

in Opinion / Technology 0 comments
Alipay's offices in Hangzhou, China
 by Brendon J. Wilson

How Alipay Hacks Its Culture

If you’ve had the opportunity to work with a company in an Asian country (and China, Japan, or South Korea in particular), you’ve undoubtedly observed a marked difference in the role of hierarchy in their culture. These countries feature a high power distance index (PDI) where “lower ranking individuals of a society accept and expect that power is distributed unequally”. For example, China has an high PDI of about 80 versus the United States’ PDI of 40 and Western European country’s PDIs of between approximately 25 and 40 (see PDIs by country).

In high PDI cultures, authority is centralized and subordinates are unlikely to approach and contradict their bosses directly; unfortunately, elevated PDI has an adverse impact on innovation. Research on the correlation between power distance and innovation has shown “a strong negative relationship between Hofstede’s dimensions of power distance and GII innovation scores as well as a strong positive relationship between individualism and GII innovation scores.”

Translation? If you can’t tell the boss he’s wrong, then bad ideas proliferate while good ideas stagnate.

However, many organizations are trying to break with traditional attitudes, promote flatter hierarchies, and encourage innovation. I got to see one such effort firsthand during a recent project working with Alipay in Hangzhou (we were enabling Alipay to use the Samsung Galaxy S® 5 fingerprint sensor to authorize mobile payments).

The key to Alipay’s strategy starts with a simple idea: how do people address each other in conversation?

Here’s what “Kiss, Bow or Shake Hands” has to say about how people address each other in China in a business setting:

The Chinese are very sensitive to status and titles, so you should use official titles, such as “General,” “Committee Member,” or “Bureau Chief” when possible.

and:

Most people you meet should be addressed with a title and their name. If a person does not have a professional title (President, Engineer, Doctor), simply user “Mr.” or “Madam,” “Mrs.,” or “Miss,” plus the name.

Every time you talk with someone in your organization, you are being constantly reminded of both their rank and your rank in relation to them. Hence Alipay’s tactic to change the cultural status quo: remove this constant reminder of a person’s rank from daily work.

The first thing a new Alipay employee does when they join the company is choose a nickname (typically a character from Chinese history, literature, or popular culture). From then on, that’s how people know them. No more “Director <name>” or “Manager <name>”; now it’s “Zhu Bajie” (a character from a famous Chinese literature classic) or “One Night” (???).

In practice, what I observed in my time at Alipay seems to speak positively of their efforts. Unlike other projects I’ve worked on in Asia, the project at Alipay was punctuated by a completely different dynamic. There was the kind of constant communication, rapid-fire discussion, and open back-and-forth disagreements that would be strikingly familiar to anyone from Silicon Valley.

What small hack could you put in place to change the culture of your organization?

in Business / Culture / Product Management 2 comments
 by Brendon J. Wilson

Three Features That Spotify Needs

Spotify Logo

For Christmas, Ashley gave me a Premium subscription to Spotify (the “all you can eat” music subscription service). I’ve been really impressed with the quality of the music, the selection, and the mobile application’s capabilities. It’s a whole different world when you can access the majority of humankind’s music at the touch of a button. Finally, someone has figured out how to make people stop pirating material: publish it all, publish it now, and publish it at a reasonable price that nullifies most people’s reasons for pirating music online.

That said, there are still a few features I would like to see added to the product to really make it shine. While Spotify does have capabilities for developers to build applications on top of Spotify, the current selection of applications are a bit weak. In many cases, they’re almost purely marketing ploys for various brands. Here’s some suggestions for apps that Spotify should either build themselves or encourage others to build.

Shazam Integration: Audio Discovery + “Bookmarking”

Shazam was a savior for me for a long time – nothing like being able to have a definitive answer to the question “what song is that they’re playing in this movie/theatre/coffee shop right now?”. However, using Shazam with Spotify is currently a multi-step process: open Shazam, tag the song to determine the song and artist, then switch to Spotify, search for the same song/artist, and add to a playlist for future listening.

Instead, as a user I want to be able to pull out my phone, start Spotify, and hit a button to determine the song and add it to a list for future listening. Think of it as the equivalent of Instapaper or Pocket, but for music instead of articles on the web. I should be able to use Spotify as a way of collecting interesting songs, wherever I hear them, and then queuing them for future listening.

Nike+ Integration: The Perfect Running Playlist Generator

When I go running, the music being played has a noticeable impact on my pacing. I regularly use the Nike+ running application my iPhone to play a running playlist, but the only music playback options are to play a pre-existing playlist in either a linear or “shuffled” order. My options to are either to spend a bunch of time building playlists, or to have a sub-par performance when a cool-down song comes on when I’m right in the middle of my run.

As a user, what I want is a way to have Spotify automatically generate a running playlist, based on the artists I follow or a radio station I’ve created. As an input to the process, the application should ask me about how far I intend to run or for what period of time. These inputs could be used to drive the selection of songs whose tempo match my target running pace, resulting in a subconscious signal to me to speed up or slow down my running pace. This playlist should be linked to the Nike+ running application, so that I can trigger this feature as the playlist for my run.

Life Soundtrack: Location/Context-Aware Radio

Often when I travel, I create a playlist to match the destination. Whether it’s a roadtrip where I’ll be driving to a destination or wandering around a strange city, I like to have music that I associate with a place. For example, nothing beats bursting through the doors of Healthrow Airport with The Clash’s “London Calling” at eleven, or strolling past the British Houses of Parliament with The Beatles’ “Tax Man” reminding you of one of life’s unavoidable certainties.

What I’d like to be able to do is have Spotify generate a playlist for me on the fly, based on my location. This playlist would select songs and artists that have a connection to my current context, including inputs like my physical location, the time of year, and my speed of travel. Combining that information with data about artists (where they were born, lived, performed) and songs (lyrical context, references to the current location, place where the song was written) would allow Spotify to construct a nuanced playlist that reflected my current surroundings, and provided a perfect backdrop to life.

in Culture / Technology 1 comments
 by Brendon J. Wilson

The Death of “Stuff”

With our recent move to Silicon Valley, I indulged one of my guilty pleasures: getting rid of stuff. While I know this vice smacks of OCD, there is nothing I enjoy more than rummaging through the stuff I own, turning the object in question over in my mind and thinking, “Do I really need this any more?” And of course, this habit extends not just to the paraphernalia I already own, but to every other piece of stuff that threatens to enter my orbit.

It’s becoming easier than ever to simply not own things. A quick inventory of goods in the house reveals that most are being replaced either by substitutes that take up less space or, in extreme cases, no space at all:

  • Television: Gone is our behemoth Sony Wega, with its bulging CRT. Our new flatscreen is probably one-hundredth the volume, despite the fact that it has a larger screen. And, if we were so inclined, we could hang the TV on the wall and forego the media stand.
  • Music: I haven’t handled a CD for the past five years for any other purpose than to rip it in iTunes and shove it on our networked hard drive. With services like Spotify and Pandora offering subscription-based music for less than the price of a CD per month (free for Spotify if you’re listening from a laptop), even the compact form of the hard drive seems overbearing and unnecessary.
  • Movies: While I was never one to collect DVDs, a small collection of favorite titles accumulated nevertheless. But with on-demand services like Xfinity and Netflix able to provide just about any movie to us any time we want, the idea of holding onto data-imprinted plastic discs seems quaint at best.
  • Books: The family bookcase suffered the most significant losses during our recent move, with the size of our library declining by half. So long dead-tree technology, hello Kindle DX, and Kindle app for iPhone and iPad. It would appear bookcases may be a thing of the past (a fact that has not gone unnoticed by IKEA). One Billy bookcase down, one to go.

The exercise got me thinking about how this trend could dramatically reshape society if applied across the entire population. Households have doubled in size since the 1950s while the average family size declined by almost a third resulting in a significant increase in the per-capita size of housing. But do we really need all that space anymore? It makes you wonder what other services or product innovations could drive down the size of households?

In the opening chapter of “Natural Capitalism“, the Rocky Mountain Institute examined a number of small changes that could be made to the modern car to create what they term a “hypercar”. Simply changing the car body’s material from steel to carbon fiber resulted in an interesting feedback loop:

  1. If the car is made of carbon fiber, rather than steel, the car will be lighter
  2. If the car is lighter then the engine doesn’t need to be as powerful
  3. If the engine doesn’t need to be as powerful, the engine can be smaller
  4. If the engine is smaller and less powerful, then the car doesn’t need a large transmission or brakes

And so on; one small change begets a virtuous cycle of reduction. I suspect we may see something similar happen as many of our consumer goods get replaced by services, especially those than can be delivered electronically.

Of course, just like the hypercar, eliminating the assumption that goods need to be delivered physically has dramatic consequences for the supply chain that previously delivered the physical good. While the most readily visible consequence is the slow death of retail stores, the impact of the shift to electronic goods goes much deeper. Applying the same logic as before:

  1. If the good can be made of bits instead of atoms, the good can be delivered online
  2. If the good is delivered online, then the good doesn’t have to be transported to the customer
  3. If the good doesn’t need to be transported to the customer, then the good’s supply chain no longer requires raw materials (paper, plastic, cardboard, metal), physical stores or warehouses, transportation, or fuel
  4. If the good doesn’t require those materials or infrastructure, then it doesn’t require labor to mine the resources, or manufacture and transport the goods, and significantly reduces the labor required to sell the final product

I suspect (probably incorrectly) that most of the consumer goods that can be “digitized” have already been digitized (books, movies, music) and the pace of change for those industries will decline — there’s only so much extraneous stuff we can eliminate from our households. However, as Marc Andreessen pointed in his epic “Why Software is Eating the World” article, this trend is just getting started within government and industry.

in Technology 0 comments
 by Brendon J. Wilson

Rails 3 on Dreamhost via Capistrano

Dreamhost has started rolling out Rails 3.0.3 to its servers; however, there’s a couple of snags that may prevent you from quickly and easily deploying a Rails app. I’ve spent the better part of a couple of hours overcoming these challenges, some of which might have been due to me climbing the Rails 3 deployment learning curve. I was running into all kinds of problems with “500 Internal Server Error”, as well as being unable to get the required gems installed properly, including the required native extensions.

Allow me to save you some time.

First problem: the bundle executable isn’t in your PATH environment by default, either for login shells or non-login shells. The fix is simple – just add the right path to your .bashrc and .bash_profile: export PATH="/usr/lib/ruby/gems/1.8/bin:$PATH"

Second problem: you need to make sure to use bundle install properly to resolve and install your dependency gems. Simplest solution is to add require 'bundler/capistrano' to the top of your deploy.rb.

Those two small additions will resolve problems deploying Rails 3 apps via Capistrano on Dreamhost. Happy coding!

in Technology 2 comments
 by Brendon J. Wilson

We Are The Walking Dead

Lately, I’ve been devouring Robert Kirkman’s “The Walking Dead”, a comic set in a post-apocalyptic zombie wasteland with a narrative focused on the daily lives of the non-zombie survivors. It sounds bleak, but it’s a good drama piece on how things fall apart in a crisis whose scale is beyond any individual’s comprehension.

I’ve started to see it as a bit of a parable for the current global situation and the probable future scenarios that await us: the constant hunt for food and shelter, and the vigorous and brutal means used to secure those same essentials. While most of the population of our world hasn’t turned into actual zombies, there’s a lot of parallels between our world and that of the comic.

Consider survival. Regardless of your current financial situation, you will be affected by the crisis and your ability to maintain your quality of life will face increasing strain. Are you prepared? I remain dumbfounded at the shabby state of Canadian and Americans’ finances, and individuals’ overall lack of restraint or planning. A quick run through the numbers courtesy of GreaterFool.ca shows that there are a lot of people out there who:

  • Lack of significant savings: According to Garth, seven in ten Canadians have no corporate pensions, sixty per cent have no money saved, and only five in ten have RRSPs. Of the fifty percent of Canadians that do have an active RRSP, the average amount saved is a little over $40K.
  • Have significant debt: Canadian families owe $1.45 for every dollar they earn, and carry an average debt of more than $25K.
  • Are overexposed to risk: Canadians are funneling a more and more money into real estate. Average cost of a house in Vancouver is upwards of 8x on average household income.
  • Are at or nearing retirement: There are nine million boomers comprising 32% of the population of Canada. The country is aging, and it’s only going to get worse. Oh, and we’re not alone.

No sweat, I hear you saying, I’ve sorted my own finances out. Which is just fantastic – at least someone’s been thinking ahead. In preparation for the Financial Zombieland that awaits us, you’ve at least been stockpiling cans, guns and ammunition. You’ll at least make it past the first wave of the outbreak.

Unfortunately, the fallout of the crisis will last slightly longer than a winter storm that knocks out the power. It will also dramatically reshape our society – permanently. While your larder may be full now, I believe the breadth and depth of the crisis will conspire to drain your reserves slowly but steadily in a number of ways:

  • The safety net will slowly disappear: Governments, being borderline insolvent, will look to dramatically trim expenditures while expanding taxation. One only has to look at the four-year “plan” in Ireland, and the economic restructuring in England to get an idea of what’s on the horizon for previously government-provided social services.
  • Things will cost more: Anyone who’s been paying attention has noticed that resources are becoming more hotly contested. China is playing chicken with the IMF by gobbling up resource rights in Africa in exchange for infrastructure, a flagrant violation of IMF’s rules that require those rights to be used to pay each African nation’s outstanding debts. Not only will resources cost more, but demographics and entitlements will force governments to find new sources of revenue. Read that: raise taxes.
  • Growth will be constrained: The natural response on the part of consumers and companies will be to find ways to conserve cash. In the wake of the economic crisis, US savings rates have increased dramatically. Canadians, believing they’ve avoided the worst, have decreased their personal savings rates; however, this will change as it becomes clear that no one can escape the grasp of the global economic decline.

The upside of this reshaping of our society is that it might be just what we needed. Just as in “The Walking Dead”, this crisis may have an upside. If nothing else, it may force us to shuffle our personal priorities. Perhaps we’ll reduce our consumption, redefine how we work, and reverse some of the global destruction we’ve wrought.

in Business / Opinion / Politics 1 comments
 by Brendon J. Wilson

We’re All Anguilla Now

Times are interesting, and only bound to get more wooly. While this blog has been on an unofficial hiatus, one part of Douglas Coupland’s piece in the Globe and Mail (“A radical pessimist’s guide to the next 10 years”) caught my eye enough to demand a personal anecdote in support of his conclusions:

7) Retail will start to resemble Mexican drugstores

In Mexico, if one wishes to buy a toothbrush, one goes to a drugstore where one of every item for sale is on display inside a glass display case that circles the store. One selects the toothbrush and one of an obvious surplus of staff runs to the back to fetch the toothbrush. It’s not very efficient, but it does offer otherwise unemployed people something to do during the day.

A couple of years ago, Ashley and I were living in Anguilla, a British protectorate in the Caribbean. It’s a small island with a similarly diminutive population and economy. At one point we had to visit the immigration office to get appropriate documentation added to our passports to allow me to work. At the door, we were greeted by an immigration employee who instructed us to sit in the chairs until we were called. There was no one else in the office, but we did as we were told.

Despite the lack of other patrons, we waited for ten minutes until a second employee called us up to the counter. She asked us a few questions and eventually asked for us to provide our passports. When we surrendered our passports, the second employee handed them to a third employee, who dutifully noted our passport numbers in a large, leatherbound ledger.

Keep in mind that this was, by all accounts, rush hour in the immigration office and we were the only patrons. One couple being served by three separate employees for a single transaction.

At the time, I thought it was a unique incident; however, ever since returning to North America I’ve noticed similar patterns with increasing regularity. Whether it’s the DMV, customs, and even areas of the private sector, the pattern of surplus labour leading to invented jobs and weirdly inefficient processes has become inescapable. In my eyes, we’re all Anguilla now.

in Opinion 0 comments