SNMPv3/USM, unfortunately, does suffer from some elements of man-in-the-middle attacks. But these are poorly understood and certainly not well documented (if at all). This document attempts to describe the weakness inherent in the SNMPv3/USM protocol.

Background and Conventions

Although this document coves some of the necessary background, it’s still expected that the reader already understands how SNMPv3 with its User Based Security Model (USM) works. The details of the SNMPv3 protocol and the USM-subprotocol aren’t discussed in this write-up.

It’s also expected that the reader is familiar with the USM concept of “discovery”, which can be summarized at a high level as this: a manager is allowed to send a “probe” message to an agent and the agent should return a “report” message that says “I’m using securityEngineID 1234″. An important element of this discovery request and response process is that it’s fundamentally unauthenticated. There is no proof that the agent responding actually is the right agent. The belief is that because future requests and responses are authenticated and use a key only known to the agent the manager wants to communicate with that the unauthenticated discovery request isn’t a big deal. But, in fact, it is and it does open the door for certain types of man-in-the-middle attacks.

USM contains a key-localization process provides the ability for the administrator to provide only a master password or a master key and the management software can transform that key through a series of one-way hashes into a key which is unique to each agent that the packets are destined for. Though this does prevent keys stolen from one agent from being used to break into another, it doesn’t help in the problem described below as will be shown. It won’t matter if the key localization process is used or not; they could have been randomly generated for each remote agent.

For documentation simplicity I’m only showing the use of one key in this document. But in SNMPv3/USM there are actually two: one for authentication and one for encryption. For purposes of the discussion, however, we can treat the keys as a “pair” and any time one is affected then so is the other.

SNMPv3 also has the notion of a contextEngineID, which is not discussed in this document as it is not relevant. Only USM’s specific securityEngineID is relevant to this discussion.

Typical Real-World SNMPv3/USM Start-Up Sequence

Pictures are always easier to understand, so let’s pretend we have the following network setup. Agent B will be colored red in these pictures since in the examples below we’ll consider it to be a machine which has been taken over by an attacker.

Typically a management station starts talking to an agent for the first time over SNMPv3/USM it will send an an securityEngineID request. And, of course, the agent sends back a response with its own securityEngineID:

At this point, the management station can start sending authenticated and encrypted traffic to the agent by using the authentication and encryption key assigned to the given securityName for the remote agent. Each agent has its own unique key pair that the manager uses to communicate with it and internally the manager has a table (the usmUserTable) of all the users and keys for the agent it wants to talk to.

The Attack

The problem with this situation is that the manager uses two values in order to look up the key for a given communication.

1. It uses the securityName value it was given by some dialog box or command line option. In these diagrams this value is “userJoe”.
2. The securityEngineID that it potentially learned from the discovery process.

But Discovery Results Aren’t Authenticated

Assume in the diagrams that Agent B has been compromised and it’s keys are now known to the attacker. Normally traffic sent from the manager to Agent A should be authenticated and encrypted with Agent A’s keys. This means that Agent B shouldn’t be able to see or respond to requests sent to Agent A because it doesn’t know the right keys.

But, if an attacker has compromised a device that is able to see traffic destined for more than just itself (e.g. when connect to a hub or truly in the middle of the path) then there is a problem if it can also spoof traffic. All it has to do is spoof responses to other addresses with its own securityEngineID for any securityEngineID probe that comes it can see. It will have to do this faster, of course, than the real agent can respond (but that can frequently be easily helped by launching DOS attacks). The end result is that the manager will get back a packet in response to it’s securityEngineID probe with a packet that looks like it was from Agent A but internally has a securityEngineID for Agent B.

Now, the manager thinks it has the right securityEngineID for Agent A, but in fact has the wrong securityEngineID for it (i.e. it has “engineIDB”). It uses this securityEngineID (“engineIDB”) in combination with the operator-provided securityName (“userJoe”) as indexes into it’s user/key table to figure out which key to use for protecting traffic. This look-up succeeds in finding a key, but has in fact found the wrong key for the agent it wants to talk to (Agent A). Instead, it finds Agent B’s key and starts its communications using KeyB.

Agent A will actually drop any requests that fail authentication (possibly sending a notification; but more on that later). But Agent B no longer even has to beat Agent A’s response back to the manager so there won’t be a race any longer and Agent B has successfully captured the entire communication stream until the manager looses its knowledge of Agent A’s securityEngineID again.

What Power Does This Leave Agent B With?

This only buys Agent B two things:

1. The power to receive and decrypt traffic that was intended for Agent A. Typically GET and GETNEXT requests from a manager shouldn’t have anything but OIDs in them (though from an analysis point of view it might contain information about what functionality Agent A is supposed to have). SET requests, however, might have more interesting information encoded into the values that might be worth “stealing”.
2. The power to spoof Agent A and return fictitious data from it. Agent B can now adequately pretend to be Agent A and thus can return bogus data as well as pretend to have acted as if SET requests had really been processed. This lets untold number of bad things happen, including convincing a management station that a device is fine when it really isn’t, under-reporting bandwidth usage, etc…

Protecting Yourself From The Attack

There are only a few choices when considering what to do about this attack:

1. Understand the weakness and be OK with it. Just don’t be ignorant of it.
• Understand that:
  • Management data sent from the management station can be stolen.
  • An agent can be “spoofed”. A management application may think it’s talking to agent A which has possibly:
  • Accepted and acted upon SET data.
  • Has returned real and true values that you can trust to be from that agent.
• Protect yourself as best as possible:
  • Leaving your management applications long-running so they memorize securityEngineIDs can be helpful (though if the attacker succeeds at any point, you’ll believe he’s the right agent for a longer period of time so it’s still a trade off).
  • Doing a “leap of faith” type approach and believing the first securityEngineID and expecting it “from then on” (even if the management station is shut down; though I don’t know of software that stores securityEngineIDs in persistent storage.).
2. Don’t use the securityEngineID discovery process and pre-populate the management database with the real expected securityEngineIDs extracted from their consoles. Unfortunately, this doesn’t scale well. And thus I don’t know of a single person who actually manages their network this way.
3. Use different securityNames on every agent. Unfortunately, this doesn’t scale well either. I don’t know of a single person that manages their network this way either.
4. Use another form of SNMPv3 security, such as SNMP/SSH transport or the upcoming SNMP/(D)TLS transport. These forms of SNMPv3 don’t suffer from this weakness but have only recently been defined by the IETF and aren’t widely implemented and deployed.
5. Only run management commands over a protected physically separate and entirely switched network. Fortunately, this is frequently common practice. Though it doesn’t necessarily eliminate the threat depending on which network components have been broken into, it should help reduce the threat significantly.

Questions and Answers

Does This Attack Work If Not Man-In-The-Middle?

The short answer is “no”.

The longer answer is that if the attacker can’t see the traffic, then they’d have to be able to guess the manager’s messageID and time the securityEngineID response appropriately.

But even if they could do that, it doesn’t help much unless they can see the traffic since they won’t see what they can now decrypt and respond to. The attacker can’t easily respond to what they can’t see (without an unreasonable amount of guessing of packet contents and timing).

The best an attacker can hope to accomplish would be a denial of service attacker because the manager would fail to communicate with Agent A while the securityEngineID mismatched.

What About Authentication Failed Notifications?

If all the agents are configured to send out SNMPv2-MIB::authenticationFailure notifications then in theory the manager would receive a notification every time agent A received a packet that wasn’t authenticated with the proper key (keyA).

This is true and maybe helpful if authentication-failure notifications have been turned on. But the evil Agent B entity may find it possible to spoof securityEngineID query responses from the management’s notification receiver to stop INFORM notifications from being encrypted with the right authentication key thus causing the notification receiver to drop the notifications. TRAP notifications are sent using the local (correct) engineID so this attack won’t work on them.

Many of my friends and family have been confused over the differences between Facebook and Twitter. (Most of the confused use one and simply don’t know what the other is). There has also been a lot of speculation on the net about how Facebook has been slowly trying to take on twitters surge in popularity through their adoption of Twitter-like-qualities.

This write-up documents some of the important differences between the systems so that you can decide which is best for you and how you should think about using each one.

First the Similarities

The core part of both Facebook and Twitter surround “status messages” that you and your friends post to stay in touch with each other. Messages like “just got back drom the new star trek movie” will frequently start an online discussion between those you know about how successful the new film was as a “reboot” of the old series. More boring messages like “I just woke up” will only stir up the electronic version of crickets and will provoke little conversation.

On to the differences…

Openness

Facebook was designed as a web-browser based service: you log into their site through your web-browser to see status updates from your friends mixed with their advertisements.

Twitter has, since it’s early days, provided a programming interface (API) to it’s service. This interface let’s programmers write applications that check for new tweets, submit your own status messages, etc, all without actually visiting Twitter’s web page. The result is that there are many many applications and ways to interact with Twitter content besides just navigating to the twitter web page. The most popular ones tend to be the ones that sit on your desktop or in your toolbar and notify you when new tweets arrive.

Openness of the Data

By default, Facebook hides all your data so only friends (and approved game applications) can see your status updates and personal information.

Twitter is the opposite though, for both good and bad. It defaults to posting your messages publicly for the world to search through.

This, by far, is the biggest in usage differences. If you end up using both systems, just think before you post who your audience is. But more importantly, I like it this way. There are many updates that I post to both systems because I either don’t care or actually want them heard widely. The announcement for this blog posting, for example, I’ll submit to both services. I also tend to post smaller and more frequent comments to just Twitter. And much more personal comments to just Facebook.

Update Frequency

Because of the open API and extensive external application support, Twitter is more in your face 24/7 and integrates into your day rather well. The result is kind of a constant connection feeling with lots of friends, services and celebrities. The ability to tweet quickly in seconds is always present because somewhere on your screen you already have an open box waiting for you to type in your latest pontification. There are even application plugins that monitor what you’re doing and provide a tweet on your behalf (such as every time your music player switches songs). Many early tweeters make the mistake of tweeting way too much and let you know all about their third bite of a taco bell buritto you probably don’t care about. (They also quickly lose their followers). The better twitterers post only interesting thoughts and activities.

Facebook on the other hand is designed for less frequent status updates and less frequent review of your friend’s updates. Most users log into the site a few times a day, respond to the discussions, update their status (maybe) and play a game or two. It’s designed to be a “visit when I have time site” and is not designed to let you know that your BFF just put on her left sock.

But the instant notification ability of Twitter is what makes it far superior for service broadcasts. Many important services today have twitter feeds for major events (eg, the White House, the RedCross, CNN Breaking News or even Earthquakes that occur near San Francisco) so that you can be instantly informed about events happening at a given instant.

Twitter has also always had the ability to send and receive cell phone text messages. You can have the service text you when your favorite friends update their status and likewise you can update yours by sending a text too. Many smartphones have Facebook applications or web browsers, but twitters SMS tie-in is, again, designed to make you feel continuously connected (no matter how old your phone is).

Status Update Size

Twitter messages have a size limit of 140 characters, which isn’t much (note how easily it fits into a 160 character SMS message? Surely their choice of size was deliberate!). Twitterers learn to abbreviate and be witty in a very small space.

Facebook, however, lets users write multiple paragraphs about their current thoughts. This works much better for ideas you just can’t convey in a short burst. Twitter is referred to as micro-blogging, and Facebook is in between Twitter and a full-size, long-winded blog like this one.

Data vs Presentation

Another major difference between Facebook and Twitter is the presentation. Twitter is all about the content and the data. It doesn’t concentrate on presenting it in fancy graphics on their site (though many desktop applications actually look much better than the Twitter home page). Twitter just wants to bring you data fast and it excels at doing just that.

Facebook, on the other hand, is a complete package. It’s like the “Hotel California” as it wants you to never leave. It’s entrance hall is splendidly decorated with fancy graphics, profiles, pretty colored reply boxes, etc. Every link from Facebook tends to take you to another Facebook wrapped external page or application so you’re always encouraged to return to Facebook immediately. But, their web interface is a beautiful blend of simplicity and function (apple would be proud).

Twitter is also just status messages only with no extra features, while Facebook is constantly tempting you to take a new quiz or play a new game. Facebook’s interactive and highly-addictive multi-player games are wonderful distractions and suck up hours of your time. Twitter almost seems dull after having spent an hour trolling around Facebook’s site.

So which should you use?

You’ve probably guessed my answer by now: Both!! I have both a Facebook and a Twitter account and use them both daily. I love them equally, but for very different reasons. Facebook is a collection of conversations with friends and family. But Twitter has actually helped me make new friends through it’s openness.

The truth is, they’re very different beasts that serve fairly different purposes. Regardless of what Facebook does to become more Twitter-like it may not matter if the users don’t want or use the Twitter-like changes (I for one like the differences). If Facebook adopts many of the Twitter attributes of openness it will mean losing out on an important aspect of Facebook: your status updates go to your friends and family and people you trust.

So I suggest you try them both and hopefully you’ll even use them both. They’re free, after all. What do you have to lose (but time)?

These days if you play FarmTown and you visit “The Marketplace” in order to sell some goods, get hired, or whatever you’re likely to find occasionally that random people follow you back home to your farm when you leave. This seems a bit odd to many people. I mean, if you go to your local grocery store and some random person followed you back to your house you’d probably call the police right? In fact, this is the whole reason we have these things called “locks” on our front doors. To prevent everyone, including friends, from randomly entering our house. Farmtown, however, doesn’t have locks. (Fortunately there isn’t much they can do in your farm so it’s not really a huge concern)

Why people are doing this in facebook too I’m not sure. I suspect that they’re looking for a job (ie, they want to work in your fields for cash) and they’re hoping you’ll hire them.

My Wife’s Solution

So, my wife had a smart idea: never hire them. In fact, make sure you can’t. She does this by clicking on them and then clicking “ignore”. By doing this you add them to the list of folks that are functionally “banned” from your view of the game. The result is that no matter how much they beg you for a job in the marketplace in the future, you’ll never see them and will never hire them. Plus they immediately disappear from your farm as well.

I thought this was a great idea to solve the annoying-farmers problem.

Cheat??? Why??? Well, after posting my previous blog entry about FarmTown cheating I noticed a huge number of Google and other search engine hits by people looking for “how can I cheat at FarmTown”, etc. Apparently I’m not alone in the desire to overcome FarmTown boredom.

There is a huge amount of wonderful pages devoted to farmtown data, but not as much about advice about how to play efficiently. For those just looking for how much stuff costs, what level you get it at, etc, I recommend
Uncle Joe’s Farm Town Addicts Site

Today’s Progress

While working diligently away on my farm today and jumping from level 19 or 20 (I forget) to level 24 I:

• Ate a wonderful father’s day breakfast with my family that was prepared by my wife
• Filled up the car with gas
• Packed the car
• Went shopping
• Played a game of pool
• Read to my daughter

Motivation

Well, simply put I wanted to be level 27 so I could buy rivers. I didn’t get all the way there today, but I made a good leap forward. The problem with farmtown is that after the first 15 levels or so it gets very boring when it comes to the farming aspect itself. Not the building pretty pathways and stuff aspect, but the aspect of cultivating a huge set of crops just to try and get more experience points.

This, in my opinion, is a fault of FarmTown’s. They should, after a certain level, make it easier to clear and plant a field full of crops with one “select a rectangle” type motion. It’s cute when you first start to plant each square, but boy does it get boring by the time you get up there in levels. And because levels get harder and harder to achieve the level reward is less and less (aside from the financial increase, which is constant).

FarmTown isn’t the only game with this problem. It dates back to any large “build an empire” type games including empire (the old ascii text game for those that remember it) to warcraft and to the latest in the line: FarmTown. Maintaining a huge set of maintenance tasks gets dull and dry.

But… I really wanted to be level 27. I just didn’t want to spend the time.

Enter The Cheat

Ok, it’s not a “real” cheat. It’s well known, as I’ve discussed previously that you can turn FarmTown cash into FarmTown experience points. The cheapest way to do this is by adding hay bails to your farm. At the end cost of roughly 1 experience point per 10 FarmTown coins spent the hay bails are the best return.

But, it’s boring putting out a gazillion hay bails too, so why is that any better? It provides you increased speed at yet more boring work.

Or does it. I handled this by recording mouse clicks with a mouse event recorder and then playing them back. I’d buy a hay bail and then sell it. And then tell my computer to repeat the process over and over for me while I went and did something else.

Sure, occasionally it would mess up and start trying to place a bail on another, but in general it worked and I got a lot of house-hold chores done instead! Yay! I’m level 24 now!

So if you want the amount of coins you have divided by 10 in experience points, you might give this approach a shot. I don’t have software to recommend to you (see below for my linux notes) but I’m sure if you search for some for your OS of choice you’ll find something. I know stuff exists for windows, and I suspect for OSX as well.

Advice for FarmTown Developers

Don’t get mad at the people that want to cheat. Fix the issue within the game. I’ve noticed that a lot of my friends simply stop playing near level 28 or so because it’s just boring after that. You’ll loose customers unless you can fix the boring aspect of the higher levels. Add something else for them to do instead that captures their interest again.

Final Linux Geek Note

Turns out that all the linux event recording software is dated and doesn’t work. There is some playback software though. I wrote a quick script to wrap around xte from xautomation to record and then replay what I needed.

[Update: make sure to read my follow on article as well: How I Cheated at FarmTown Today]

Any game, is of course, accompanied by a number of different ways you can attack the problem of “how do I get a high score as quickly as possible”.

Facebook’s FarmTown game is highly addictive to many people and some of my friends have spent endless hours carefully laying out rice fields for harvest two days later.

Status in FarmTown

There are really only two things worth achieving in FarmTown: Money and Levels/Experience Points. Money is earned by planting and harvesting crops (or better yet, having someone else harvest your crops for you). And, if you harvest someone else’s crops then you get some extra cash too (it’s a good deal for both sides). The fastest way to get cash is to go hang out in the market place and beg people for jobs harvesting their fields.

But experience points you only get by either plowing, planting crops, visiting friends farms, or building infrastructure. Now, you can only visit your friends for experience points roughly twice a day. And there is only so much space on your farm so after you’ve filled you soil with crops and farming infrastructure (virtual barns, paths, scarecrows and hay bails) you have to sit back and wait until the crops are ready.

Or do you…

[Update: as people have pointed out in the comments and as I discuss in How I Cheated at FarmTown Today using hay bails for converting cash to experience points is more efficient]

Many people have figured out that planting grapes earns quick experience points because in 4 hours their ready again. Yes, they’re not worth much but they do turn around quickly. Thus if you’re shooting for straight XP then grapes seem like the right way to go.

But there is a better way:

1. Plow your whole field per normal (20 coins per square and it’s worth 1 XP)
2. Plant grapes in your whole field (also 20 coins per square and it’s worth 2 XP)
3. Buldoze them over immediately (gasp!!!)
4. Go back to step #1

(and for you slashdot readers add in “Profit!” somewhere)

See… If you’re willing to spend the cash (40 coins) and the time (something you’ll admittedly never get back) then you can earn 3 XP points per square. Quickly. Keep repeating till your out of cash. You’ve probably just levelled up quite a bit.

When you run out of cash, go to the market place and beg people for a job to get more cash. I bet following this formual you could go from level 1 to level 20 in a day without breaking a sweat on anything other than your index finger.

Begging for jobs

Having done a bit of job begging, here’s my advice: be smart, be witty, be silly. You’re much more likely to get a stranger to hire you than if you just keep chanting “hire me”. When I’ve simply made funny jokes about wanting to get hired I’ve gotten jobs much faster than the others around me that were closer to “annoying”.

After all is said and done

Go outside into the real world and mow the real lawn. You probably need it at this point.

Many people have asked me in the past to explain how in the world I handle so much E-Mail. Since it’s such a long story consisting of many parts, I rarely answer it. Also because I think it’s easier to describe using diagrams, examples and sciency looking graphs. In fact, it turns out, that even describing how much mail I get, and why I get so much, is a story in itself. So this is part #1 of like 2 that describe my E-Mail setup. This first part consists entirely of a description of how much mail I get in the first place. Believe you me, it’s quite a bit.

So, how much raw E-Mail do I get?

So before this, I actually wasn’t even sure. It turns out that the answer is simply put as “a lot”. A whole heaping lot. Much of it is, of course, spam (I don’t have an exact percentage at the top of the article). But even assuming that it’s 90% spam, which likely isn’t the case, I still receive a lot of mail. And it’s all my fault because, simply put again, I want that much (gasp). Ok, maybe not the spam.

So let’s start off with some (sciency) graphs showing the raw numbers of E-Mail that I attract. To really understand it all, I need to break it down into chunks and study each piece.

The Long Haul: Mail Per Month

The first graph below shows the amount of mail per month that I received over the last year-ish.

Mail Per Month

The important thing to notice in the above graph is that the amount of mail I receive isn’t even consistent month to month as it ranges from 6500 in a month to almost 13,000. Sure, February has less days in it so you’d expect it to be lower because all months were not actually created equal. But even those slight variations don’t account for the huge swing in differences from month-to-month. Some of it certainly is because my work-load with respect to communication comes and goes. Some months I simple receive a lot more mail for work related projects than other months (usually as deadlines approach and panic ensues).

But the biggest reason for the fluctuation is that spam comes in waves too. Just looking at my day to day E-Mail it’s always amazing how much the incoming spam varies. Some of my email addresses (I have many) are widely published and thus widely harvested by the evil address-collecting spam machines. This results in a huge amount of my mail being spam, unfortunately.

But beyond that, you can see trends in the graph where, for a while, there was a significant drop in incoming E-Mail. This was because a major spam ring was taken out of service a while back and that’s where the huge dip comes from (you should have had a spam dip in that time frame too). However things are unfortunately back to spam-normal again. Do you feel like all of a sudden you’re getting more spam than you used to? Well, you’re not alone. Eventually the next spam king-pin took over and we’re back to an abysmal spam rating of something like 90% on-average spam. The peace was nice while it lasted, but now I’m back to evaluating whether my rich Nigerian uncle really did leave me a fortune or not. Fortunately if he didn’t, it turns out I have 1094 other rich Nigerian uncles who also amassed a small fortune if only I could pay the wire-transfer fee to get it safely into my bank account.

The Shorter Haul: Mail Per Day

The next graph shows the amount of mail per-day that I received mostly during the month of May (2009).

Mail Per Day

There are a couple of interesting actifacts that you can hopefully spot in this graph as well. You’ll notice that has a definite repeating cycle. The cycle is simply this: the low spots are on the weekends. I.E., by far the most mail I receive comes during the work week. This isn’t surprising to me since much of the mail I receive is work related in the first place. Which begins to tell you how much mail I receive for work-related purposes.

Ok, But What Exactly Is It All Then?

There’s the real question. If I get bombarded with so much mail, how much do I actually read??? So, lets pick a day. Ok, let me pick a day since you couldn’t help me there. I picked June 3rd, 2009 which is a Wednesday.

On Wednesday June 3rd, 2009 I received 4514 individual pieces of email. Now, lets quickly do the math shall we? If I tried to read all of that and I did so in, say, a 10-hour period (8 hours for work and 2 hours of reading just the personal mail) that would be 4514/(60*10) = 7.523 email messages per minute that I would have had to read. Though that might be possible if they were all short, I assure you that the people I correspond with are not well known for writing short, brief messages. Long winded rants are, unfortunately, much more common.

Weeding Out The Spam And Rich Uncles

So, the first thing we need to do is remove the auto-discarded spam and duplicate messages (I have a nice filter that removes duplicates so that I’m never bothered twice because someone put me on both the To and the CC line or because I’m subscribed to multiple mailing lists that the message went through). It turns out that in the 4514 messages, I auto-discarded 3163 of them. That’s roughly 70% of them. Since that’s most likely spam, that’s probably close to the real spam percentage that I receive: 70%.

Looking At What’s Left

That leaves only 4514 – 3163 = 1351 messages left to handle. And if I had 10 hours to sift through 1351 messages in my INBOX I could do so at the leisurely rate of 2.25 messages per minute. That’s almost doable (at least if I blacklist a few of the people that mail me the most long of the long winded rants).

But here’s the real secret. Of all those 1351 messages, only 10 actually ended up in my INBOX. That’s important, so let me repeat it. In bold. Only 10 messages actually ended up in my INBOX. And there’s the secret to my success: everything else gets filtered out and placed somewhere else. In fact, if you really look at how I treat mail it turns out I have lots of INBOXes. The one that only received 10 is the one that is just mail sent to my personal account. My work addresses only received 16 to the work INBOX equivalents.

Dealing With Mail in Clumps

So what is really happening, behind the scenes, is that my mail for the day actually got sorted into 44 different places. Not just 1 or 2, but 44. That lets me sort and prioritize my mail so that the important stuff I can see right away in small INBOXes and they don’t get lost in the bulk of the rants.

In the rest of the mail: 638 messages went to a folder for fedora developers consisting of auto-generated emails describing upcoming changes to the operating system. Another 110 were long winded rants about the same operating system that went to a discussion folder (at least I bet they were long winded rants; I didn’t study most of them in detail). 102 were about my favorite linux-based TV recording software: MythTV. Another 120 E-Mails were messages that were most likely spam but placed in a folder for me to double check them because the spam-filtering software wasn’t confident enough to just throw them away without my help.

And so on. You don’t want more of a breakdown than that. Trust me.

Thank You For Waiting;

You’re Message Important To Us Me

That being said even my real INBOX occasionally turns into a black tar-pit where it seems I can never stay afloat. Even with only 10 messages going into it for a particular Wednesday I’m not perfect and frequently I “mean to respond later” but fail to get back to it in a timely manner.

The important thing is that the people that really matter (you) do end up in my highest priority folder (assuming you’re not one of those long-winded ranting folks). Everyone should filter their mail to put their most important email messages first in their lives and let the others stew until they’re nice as savory. I’m going to come back at some point in the not too distant future (I hope) to provide additional guidance for “getting ahead of your email”.

I’ve actually learned something from this long winded analysis too. So I’m glad I wrote it up. What I’ve learned is that I should have a severe headache and should step quietly away from the computer. So I think I will.

Anyone who’s talked with me about computers and communication know that I have wanted to rewrite the email architecture and have a lot of good ideas about what is needed to make it happen. Well, yesterday the folks at google trumped me. And boy did they.

Now I’m not one to generally proclaim ahead of time that something is going to be the next big something. In fact the first time I opened a web page back in the 90s long before most people had heard of “http” I merely thought “yeah, that’s nice but nothing amazingly new”. Even http was a minor improvement on other things. The famous web 2.0, that brought us many cool webpages like google maps, facebook, etc, were really just minor steps forward in technology that I again thought were cool, but nothing outstanding.

For the first time, I’m here to say: Google Wave will indeed change the world. Or the way we work with it. It’s the first technology that has ever caught me completely off guard.

Learn About It

The best way to learn about it is to watch the demo video. You probably want to watch at least from about 0:05 to 0:15 on it to get a feel for how cool it is. The trick, I think, will be to stop watching it as it keeps rolling out new things as you watch it (the interesting non-geeky content is a full hour long, out of the hour and a half). Though the video is targeted for developers (and as a developer it targets me perfectly), but it’s not so geeky that everyone else will be annoyed.

I May Actually Quit Using My Current Mail Reader

I’ve tried, over the years, to move away from the mail reader I use today (something 99% of the population have never heard of: Gnus). The reason I have never succeeded in finding anything else that would fit my bill is that gnus helps me manage email like nothing else can. Yesterday, on May 28th 2009, I received 4661 pieces of email. Now, certainly a large portion of that is spam. But a lot of it was stuff I needed to at least consider and the power of gnus lets me sort it appropriately so I can actually handle the load. But that’s a whole other subject for another time (many people wonder how I do it; I should write it up sometime too).

Google Wave, on the other hand, may finally offer enough of a new enough complete change in the way communication happens that I’ll actually be able to keep up with the level of communication that I need.

Features

It provides real-time updates, shared tagging, proper thread control, reduced bandwidth, retroactive publishing a conversation to a new person. All these features are likely enough to actually pull me over. There are issues as well, and I’ll probably document those later, but on the whole they’re a fantastic change in thinking and are a lot along the lines of how I’ve wanted to revamp things but I think they’ve succeeded in taking to a level further than I was thinking.

It’s really like mixing email, web, chat, and usenet news all together in a single form. Or it looks like it at least. Kudos on taking the best of all those highly useful worlds and actually getting them to fit together.

And they already have it working on android and the iphone!

The Right Developmental Path

One of the reasons that I don’t use gmail much, or many other web-based solutions is that I don’t necessarily think that http and javascript are always the right tool for every job. Yes, javascript turns websites into wonderfully interactive sites, but in the end I still prefer writing text/editing into speedy local applications (I’m saying this while typing into a web page, oddly enough).

With waves, however, they’re extending both the web API and the protocol definition itself to the world. The protocol is based on XMPP, which is the standardized version of Jabber, and this is huge. This means that people will be able to write import/export components for waves and thus you can actually continue to edit in something else and publish it as a wave later.

Kudos to their forward thinking about the realm of standardization and allowing data access to other types of applications and programming languages. This is what will make it huge.

There is always a but…

I do wonder about some of the negative communication aspects that could happen. Centralized data storage about a conversation thread is a great thing when the data is generally public in the first place.

However, we still need to be careful when transmitting important information. Wave provides the ability to grant someone retroactive access to a wave. Imagine having a wave discussion and then suddenly excluding person X from a branch of it and then later intentionally or accidentally granting person X access again. Imagine how they’d feel when they realize they’ve been excluded. This happens all the time in email, but when in email when person X sees part of the conversation again he likely didn’t see the message that said “I’ve excluded person X because …”. This is really just a new management issue, but by far the benefit outweighs the negative.

(and there are more odd use cases, but certainly the benefits will outweigh the oddities of them as well)

I Can’t Wait…

And I’m not sure I’ve ever said that before about an upcoming technology.

It’s been long debated how much time computers actually save in our lives. Multiple productivity studies have shown that after spending quite a bit of cash to bring an office into the modern age the increase in productivity is actually very low (if I recall, most studies said around 8%). But I’d argue they’re still worth the cost outlay but not because they provide an increase in productivity.

Pencil, Paper and Typewriters

Our tools were simple before computers. If you needed to do a bit of math, you simply did it. Those were the days! The problem came when you needed to do a whole lot of math. Repeatedly. Over and over. Sure it could still be done but it was mind-numbingling boring. Calculators improved things by removing the tediousness of the math calculations and allowed significant improvements in the data crunching per hour metric. Calculators actually provided significant increases in productivity, for the few that actually needed them for their job. Certainly McDonalds couldn’t possibly serve so many customers if the cashiers actually had to calculate the correct change for every transaction.

Enter the Modern Era

And then came computers (big ones at first that only did small things followed by small ones that do big things). Computers, like calculators, save time for certain tasks (but be careful what tasks you pick, which is likely going to be a future topic in its own right). Now when you’re plugging away on your budget and trying to figure out how to assign more money to the important mini-golf green-fees row you can twiddle all the other rows as needed until everything balances out ok (who needs healthy organic food when there is balls to hit into a castle). And remember when you wrote that paper in college (about the average hair density on a baby bunny vs a adult bunny or something like that)? That backspace key sure saved you compared to the time it would have taken you to use a typewriter. (for those that never had to use a typewriter, you’ll have to trust me on this one; for those that couldn’t use computers to write college papers, you’ll have to trust me too.)

But did you really save time?

Or did you simply redirect your time?

Virtual Housecleaning

Congratulations, you now inhabit two residences. You’re physical residence is probably getting slowly covered in dust and dirty dishes. It requires regular cleaning and maintenance to stay on top of it all. Well, I hate to tell ya but you probably spend a measurable amount of time cleaning up you desktop, organizing your bookmarks, deleting old files, installing and upgrading software, training yourself how to create power-point slides full of animated circles and arrows. (If you’re not doing these things, your disk is probably a mess. But hey, maybe your house is a mess too.)

When was the last time you moved? Some of you are hopefully quickly wondering “did he mean move physically or virtually?” Well, both. They both take a lot of effort. When you get a spiffy new machine, you have to move your old data (boxes of unused junk) from your old residence to your new one. You need to replace older software (cat-scratched furniture) with better versions with fancy-dancy graphics (untorn fabric with polka-dots).

But who cares?

Ok, now that I’ve convinced you that you haven’t saved any time by owning a computer (I have convinced you, right) you should disregard your sudden depression about this and exchange it for relief that you’re no longer bored. Everyone at some point has a chore so monotonous that you’ve nearly fallen asleep doing it. (Or maybe actually fell asleep!) Computers relieve much of the boredom and monotony and replace it with mind-expanding tasks like learning where your menu item moved to when you upgraded. Your boredom may have changed to anger when that animated paperclip poped up yet again. So the next time you’re dragging text around as you reorganize a well composed email just think back to the days when you retyped an entire paper because you forgot the transitioning sentence between the 3rd and 4th paragraphs. Put on a smile the next time you defragment your hard disk to speed up your aging equipment since it may someday save you from the monotonous chore of manually recalculating your household budget. And most importantly: where there is less monotony in life there is more learning and more brain activity. This will keep your brain healthier into your old age (assuming you at those organic veggies). Now go check you email and clean out your inbox. It’s been a while. Poking someone on facebook can wait while you do your virtual chores.

This is by far one of my best computer-based inventions, and yet is the most simple think I’ve ever come up with and installed. The origin is simple: I hate cleaning up old files on my system. When I started thinking about it, most of my files were things that I really only expected to have a short life-expectancy. You know, like those silly pictures people send you. Or Word documents you need to open and read once. Or … you get the point. I decided that most of these fell into four basic timing categories:

1. Files that were truly intended to be short-lived.  On the order of hours.
2. Files that I needed only for today.
3. Files that I needed for a bit longer, but not a really long time.  Like a week.
4. Files that I needed for something on the order of a month.

So I created 4 directories (folders to some of you) and made them be auto-cleaned on a regular basis.  The cleaner would remove things that hadn’t been looked at within the time period I selected for the folder.  It’s as simple as that.  The 4 directories I created were called h, d, w and m.  You can probably guess what each one means.  I put them as subdirectiories of ~/tmp but you could put them anywhere.

This example implementation assumes unix-like OS which is pretty much everything but windows. But I know there are cron systems out there for windows too. The important aspect of cron is that it lets you run commands on a regular and scheduled basis.

Here’s the crontab entries for my auto-cleaning system.  I used tmpwatch on my system but you just as easily use the find utility as well.

11 2,7,11,15,19 * * * /usr/sbin/tmpwatch 1 /users/hardaker/tmp/h
21 2,7,11,15,19 * * * /usr/sbin/tmpwatch 24 /users/hardaker/tmp/d
31 2,7,11,15,19 * * * /usr/sbin/tmpwatch 168 /users/hardaker/tmp/w
41 2,7,11,15,19 * * * /usr/sbin/tmpwatch 744 /users/hardaker/tmp/m

That’s it!  Drop things in the various folders based on how fast you want them auto-removed and you’re done.

The month based folder is the most interesting.  Basically stuff I put there is stuff that I expected to look at but if I forget to ever look at it within a month, it’s likely I never will.

For those needing first help with cron, run crontab -e and cut and past that into your editor when it pops up. Done!