Posted on

Macs and Me

“It never stops raining!” ranted the lorry driver. He thumped the table, spilt his tea, and actually, for a moment, appeared to be steaming.
You can’t just walk off without responding to a remark like that.
Of course it stops raining,” said Arthur. It was hardly an elegant refutation, but it had to be said.
“It rains … all … the time,” raved the man, thumping the table again, in time to the words.
Arthur shook his head.
“Stupid to say it rains all the time …” he said.
The man’s eyebrows shot up, affronted.
“Stupid? Why’s it stupid? Why’s it stupid to say it rains all the time if it rains the whole time?”
“Didn’t rain yesterday.”
“Did in Darlington.”
Arthur paused, warily.
“You going to ask me where I was yesterday?” asked the man. “Eh?”
“No,” said Arthur.
“But I expect you can guess.”
“Do you.”
“Begins with a D.”
“Does it.”
“And it was pissing down there, I can tell you.”

– So Long And Thanks For All The Fish (Douglas Adams)

When I try to explain my experience of Apple hardware to people, I’m always aware that I end up sounding like Douglas Adams’ Rain God. My Mac hardware always breaks down in some interesting and unpredictable way. People tell me that I’m exaggerating, it can’t be true that it always breaks down. But I’m not; it does.

To be precise here, every piece of Mac kit that I have ever owned has been replaced because it has stopped working in some way. This is in contrast to the large number of non-Apple laptops and desktop PCs that I have owned over the same period of time. They have all been replaced, while in good working order, because I’ve suddenly realised that I’ve owned them for a long time and there’s probably a newer, better model out there.

I’m not exaggerating here at all. It happens every time. Every. Single. Time.

I know that the plural of anecdote is not data, but here’s what I remember.

  • My first Mac was a second hand Powerbook. The battery stopped working. Because it was second hand and out of warranty, we just lived with using it plugged in. Which was fine (well, not really, but we coped) until the power lead broke because of a ridiculous design which put the most stress on the weakest point. Replacements were stupidly expensive, but we got through two of them before giving up on it.
  • Then there was the Macbook where the battery stopped working if you ever let it drain completely. We tried all of the workarounds that we found on the web, but nothing worked. Turned out this was a known fault. I took it to the Genius Bar two or  three times and each time they replaced the battery free of charge. Good service, I admit, but it shouldn’t be necessary.
  • In the end, it was a different fault that killed that Macbook. Eventually the power supply unit failed completely.
  • I can’t remember which of those first two Macs it was, but at one point we went through a fun period where every time I updated the system software the wifi connection would fail. This went on for about eighteen months. Got to the stage that I had a CD with a backup of the last known working wifi drivers that I could use to replace the buggy new ones.
  • Then there’s our current Macbook. After owning it just a year or two, the rubber covering started to come away from the base. This also turned out to be a known fault and Apple sent out a replacement base that I fitted. Good service again, but annoying that we needed to do it.
  • And finally, a few days ago, the trackpad stopped working. You can still move the mouse, but it doesn’t register clicks. It seems that this is another pretty common fault. Apparently as the battery ages, it expands, pressing against the bottom of the trackpad and preventing it from working properly. I can try loosening the screws to see if that helps but in the meantime, we’re using it with a USB mouse. I’ve got an appointment at the Genius Bar next week to see if they can help.

But I suspect that this Macbook is on its way out. Which means buying a replacement. And that’s always so depressing. Mac hardware is always so much more expensive than the equivalent non-Mac system. And it never works properly (at least in my experience).

I’ve started browsing the Apple web site. And I see that they’ve stopped making the Macbook. It’ll need to be a Macbook Air. Which means it’ll be even more expensive and, astonishingly, less functional – they don’t have a CD/DVD drive.

I know what you’re thinking? If I have such a hard time with Mac systems, then why do I still buy them. It’s not for me. My wife likes them more than Windows systems. But I think that this time we might need to have a Serious Talk about what we’re going to buy.

Posted on

Year of Code on Newsnight

You’ve probably already seen the section on the government’s Year of Code initiative that was on Newsnight last Wednesday. But, in case you haven’t, here is it. We’ll wait while you catch up.

Most of the commentary I’ve seen on this concentrates on Lottie Dexter’s performance in the interview that takes up the second half of the clip. We’ll get to her later on, but the problems start long before she appears on screen. Within the first couple of minutes of the report, reporter Zoe Conway has referred to code as “baffling computer commands” and “gobbledigook”. One lesson that I’ve learned as a trainer is that a sure-fire way to ensure that students don’t understand what you’re about to teach them is to describe it as difficult or complex, so Conway’s descriptions of programming languages are hardly going to encourage people to take up programming. As Conway says “baffling computer commands”, here’s the code that appears on  the screen:

if (distance < radius) {

} else {

} // END if statement

Perhaps the fact that I’ve been programming for thirty years is clouding my judgment here, but I really don’t think that this code is “baffling”. Lily Cole does her best to counter this misinformation – saying that it’s “really cool to see how quickly we can pick it up”. I hope people listen to her and not the (obviously out of her depth) reporter. We then move on to the idea of children being taught to program at school. Various people tell us how important it is and we see a class who are trialing the programming syllabus that will be rolled out nationwide this autumn. Conway then gets to the heart of the issue. She visits East London’s “Tech City” and explains the severe shortage of programmers that the companies there are experiencing. There simply isn’t the supplier of programmers that the UK’s tech industry needs. Anything that addresses that problem should be welcomed. And then we’re back in the studio where Jeremy Paxman is talking to the Year of Code initiative’s director, Lottie Dexter. This is when it gets really weird. Let’s get a couple of things straight. I don’t think it’s a problem that Lottie Dexter isn’t a programmer. She didn’t try to hide that. She was clear about it right from the start. I also think that it’s great that she want to be a guinea pig for the Year of Code by saying that she wants to learn to code over the next year. But I do think that it’s a real shame that before coming to the interview she couldn’t find someone in her organisation[1] who could spend an hour briefing her so that she could sound like she knew what she was talking about. Instead, she just made the whole initiative look bad. Let’s look at some of the things she said.

  • “You can actually build a web site in an hour – completely from scratch.” This is true. I build web sites in an hour all the time. I install a copy of WordPress, choose a nice theme and install a few plugins. Of course, there won’t be any useful content on the site. And it will look like hundreds of other sites out there who also use the same theme. Of course, I can only do it that quickly because I’ve done dozens of previous web sites this way and I have a good idea about what works. Oh, and there’s no coding at all involved in this – so it probably falls way outside of what she was talking about. If I wanted to code up a web site from scratch, the minimum time for a web site that does something non-trivial is probably a couple of days.
  • “I think you can pick [teaching people to code] up in a day.” If you know how to code and you know how to teach, then I imagine that’s possible. But for a teacher who doesn’t already know anything about programming to pick it up in a day is a ridiculous suggestion. At college, I did a course on C which was taught by an experienced programmer and lecturer who didn’t know that particular language and who was reading the standard textbook a week ahead of us. The result was a disaster.
  • “If we start thinking about it now, I think in time for September when this goes onto the school curriculum teachers should feel confident” Colour me unconvinced
  • “I started a campaign last year. And if I had learned to code at school I could have done my own web site, I could have done my own app, I could have done my own graphics. I would have saved a hell of a lot of time, a hell of a lot of money and I think I could have done a lot better.” Sure, doing it yourself would have been cheaper. But I doubt it would have been quicker than having a professional do it. And I’m not at all sure that it would have been better. Or is she suggesting that when everyone knows how to code that we will no longer need professional programmers and web designers? I really hope not (or is that just my professional bias getting in the way?)

Paxman wasn’t much help either. I know he has a rather adversarial approach to interviewing, but was it really necessary to be quite so sneering about the whole idea? He did ask one good question though. He asked why it was necessary to code. And he’s right, of course, no-one absolutely needs to know how to code. But I think there are three reasons why teaching everyone to code is a good idea:

  1. We don’t know who is going to be good at programming. So teaching it to every child seems to be a good way of making sure as many people as possible get to try it.
  2. Even if many children don’t take up programming full-time, the fact they have been exposed to it demystifies it. They will be less likely to see it as a “black art” and will have more idea of what is possible.
  3. People who have some programming experience will be at an advantage over people who don’t. The future is going to be about data manipulation – extracting useful information from reams of data. See, for example, the Hacks and Hackers group.

So, yes, of course I agree with the idea of teaching children to code. The UK is already desperately short of programmers and that demand is only going to continue growing. But I worry slightly that the Year of Code project is just about being seen to do something rather than working out what the best thing to do it. The government have a awesome IT department doing wonderful things. I wonder what input they have had into this process. And please, can someone spend an hour or so explaining the basics of programming to Lottie Dexter before she makes her next TV appearance.

Update: Emma Mulqueeny has been working in this area for many years with her Young Rewired State project. Her reaction to the Year of Code is very interesting.

[1] Although, Tom Morris has severe doubts about the amount of technical know-how within the organisation.

Posted on

Jessica London

Recently, I started getting unsolicited email from a company called Jessica London. They sell women’s clothes and they seem to think that I’d be interested in all of their latest offers. I have no idea where they got my email address from. I know I have never dealt with them so it’s not a case of me forgetting to uncheck the “please spam me” box when registering with them or anything like that. In fact they have been using an email address that I never use for those kinds of purposes.

But I think they’re a real company. So today I decided I’d use the unsubscribe link in their email to see if that would actually remove me from their mailing list. I know this is a risky strategy, but I like to live on the edge sometimes.

The link took me to a page where I could tell them why I was unsubscribing. There was a series of radio button – which means I could only select one of them. It’s interesting to note the reasons that they think it’s worth tracking.

  • Receive too many emails from Jessica London
    Well that’s true, but I don’t think it really gets to the heart of the matter
  • Email content wasn’t relevant to me
    Also true, but misses the point
  • I no longer plan to shop at Jessica London
    I never had any plans to shop at Jessica London
  • I am cutting back my spending on clothing
    That’s not the case. I’ve never spent that much on clothing
  • I prefer to stay connected via Social Media (Facebook, Twitter, etc.)
    I like to connect to people via social media – but not to brands that I have no interest in
  • Other

In the end, I chose “other”, hoping that they would then give me a text box where I could write “because you’re a bunch of obnoxious spammers”. But no such box appeared. So they just know that I had “other” reasons for unsubscribing.

I was left with no alternative other than to write this blog post in the hope that Google will help them discover my actual reason for unsubscribing.

Posted on

Public Wifi

We’re finally reaching the stage where public wifi is becoming ubiquitous in London – at least when you’re indoors. It’s now quite strange to be somewhere that doesn’t have wifi available. But as it’s all supplied by commercial operators, it can all get a bit confusing. I know a few people who leave wifi turned off on their smartphones because they’d rather rely on the 3G connection (which always works) than a wifi connection that doesn’t work because they haven’t logged on to the providers service.

It would be nice if these providers all just used the standard WEP or WPA security protocols. These both prompt you for a password when you connect to the network. Your device can then store the password and always connect you whenever you’re within range. That’s probably how you have your home wifi set up.

But that’s not how the commercial providers do it. They want your to actually log in to the network. That might be so that they can trace each users’ individual network traffic. Or, sadly more often, it’s probably because they want to show you a web page covered with lots of lovely adverts (or collect your email address so they can spam you). This is a rather broken approach as it assumes that the first network request that you make will be to a web page – so that they can interrupt the request and show you their login page instead. Often your first network request might be an app (perhaps Twitter or Foursquare) which won’t know what to do when it gets a login page back rather than the app-specific data that it was expecting.

Recent Android versions try to deal with this (perhaps other platforms do too). As soon as you connect to a network, they make a request and try to work out whether you need to log in. If you do, they will tell you so. It’s all rather non-standard, but it’s the device makers trying to make the best of a bad situation.

If that was the worst of it, then public wifi wouldn’t be too bad. Most people would be happy to use it. But there are two other things that some wifi operators do which serve no purpose other than annoying people.

Remember I mentioned how the network will interrupt your first request and redirect it to the login page? Once you’ve logged in, a polite service will complete your original request and redirect you to the page you were originally trying to visit. A rude service (and there are plenty of them about) will complete the request by redirecting you to another page on their web site – assuming, no doubt, that you can never show people too many adverts.

That’s really annoying. But there’s one more thing that wifi operators do which makes that pale into insignificance.

They make you log in again after a certain period of time. This makes me really angry. Picture the scene. You go to a pub and the second thing you do (after buying a round, of course) is to check in on Foursquare. For that you need to connect to the network, so you jump through all the connection hoops. Then you put the phone back in your pocket and start to enjoy a conversation with your friends. Half an hour later it becomes vital that you know the exact date that “Another Brick in the Wall (Part 2)” reached number one. So you reach for your phone to look it up on Wikipedia. Only to find that you need to go through all the log in rigmarole again.

This kind of experience is commonplace. And it leads to one of two outcomes. Either people turn their wifi off because it’s all too much of a faff (and then venues start to decide that it’s not worth having wifi as no-one uses it) or, alternatively, people keep jumping through the hoops and come to believe that this broken and frustrating experience is just how public wifi has to be. And that’s just not true.

Do you run public wifi? How is it set up? Please consider making it as easy as possible for people to use your wifi. What’s the point of annoying your customers?

Posted on

OpenTech 2013

Yesterday was the (almost) annual OpenTech conference. For various reasons, the conference didn’t happen last year, so it was good to see it back this year.

OpenTech is the conference where I most wish I could clone myself. There are three streams of talks and in pretty much every slot there are talks I’d like like to see in more than one stream. These are the talks that I saw.

Electromagnetic Field: Tales From the UK’s First Large-Scale Hacker Camp (Russ Garrett)
Last August, Russ was involved in getting 500 hackers together in a field near Milton Keynes for a weekend of hacking. The field apparently had better connectivity than some data centres. Russ talked about some of the challenges of organising an event like this and asked for help organising the next one which will hopefully take place in 2014.

Prescribing Analytics (Bruce Durling)
Bruce is the CTO of Mastodon C, a company that helps people extract value from large amounts of data. He talked about a project that crunched NHS prescription data and identified areas where GPs seem to have a tendency to prescribe proprietary drugs rather than cheaper generic alternatives.

GOV.UK (Tom Loosemore)
Tom is Deputy Director at the Government Digital Service. In less than a year, the GDS has made a huge difference to the way that the government uses the internet. It’s inspirational to see an OpenTech stalwart like Tom having such an effect at the heart of government.

How We Didn’t Break the Web (Jordan Hatch)
Jordan works in Tom Loosemore’s team. He talked in a little more detail about one aspect of the GDS’s work. When they turned off the old DirectGov and Business Link web sites in October 2012, they worked hard to ensure that tens of thousands of old URLs didn’t break. Jordan explained some of the tools they used to do that.

The ‘State of the Intersection’ address (Bill Thompson)
Bill’s talk was couched as a warning. For years, talks at OpenTech have been about the importance of Open Data and it’s obvious that this is starting to have an effect. Bill is worried that this data can be used in ways that are antithetical to the OpenTech movement and warned us that we need to be vigilant against this.

Beyond Open Data (Gavin Starks)
Gavin has been speaking at OpenTech since the first one in 2004 (even before it was called OpenTech) and, as with Tom Loosemore, it’s great to see his ideas bearing fruit. He is now the CEO of the Open Data Institute, an organisation founded by Tim Berners-Lee to the production and use of Open Data. Gavin talked about how the n.w.organisation has been doing in its first six months of existence.

Silence and Thunderclaps (Emma Mulqueeny)
Emma has two contradictory-sounding ideas. The Silent Club is about taking time out in our busy lives to sit and be still and silent for an hour or so; and then sending her a postcard about what you thought or did during that time. The Thunderclap is a way to get a good effect out of that stack of business cards that we all seem to acquire.

Thinking Pictures Paul Clarke)
Paul takes very good photographs and used some of them to illustrate his talk which covered some of the ethical, moral and legal questions that go through his mind when deciding which pictures to take, share and sell.

1080s – the 300seconds project (300seconds)
The 300 seconds project wants to get more women talking at conferences. And they think that one good way to achieve that is for new speakers to only have to talk for five minutes instead of the full 20- or 40-minutes (or more) that many conferences expect. The Perl community has been using Lightning Talks to do this with great success for over ten years, so I can’t see why they shouldn’t succeed.

Politics, Programming, Data and the Drogulus (Nicholas Tollervey)
Nicholas is building a global federated, decentralized and openly writable data storage mechanism. It’s a huge task and it’s just him working on the project on his commutes. Sounds like he needs a community. Which is handy as the very next talk was…

Scaling the ZeroMQ Community (Pieter Hintjens)
Peter talked about how the ZeroMQ community runs itself. Speaking as someone who has run a couple of open source project communities, some of his rules seemed a little harsh to me (“you can only expect to be listened to if you bring a patch or money”) but his underlying principles are sound. All projects should aim to reach a stage where the project founders are completely replaceable.

The Cleanweb Movement (James Smith)
I admit that I knew nothing about the Cleanweb Movement. Turns out it’s a group of people who are building web tools which make it easier for people to use less energy. Which sounds like a fine idea to me.

Repair, don’t despair! Towards a better relationship with electronics (Janet Gunter and David Mery)
Janet and David started the Restart Project, which is all about encouraging people to fix electrical and electronic devices rather than throwing them out and buying replacements. They are looking for more volunteers to help people to fix stuff (and to teach people how to teach stuff).

CheapSynth (Dave Green)
Dave Green has been missing from OpenTech for a few years, but this was a triumphant return. He told us how you can build a cheap synth from a repurposed Rock Band game controller. He ended his talk (and the day) by leading the room in a rendition of Blue Money.

As always, OpenTech was a great way to spend a Saturday. Thank you to all of the organisers and the speakers for creating such and interesting day. As I tweeted during the day:

 

But I spent yesterday hacking on something. More on that later.

Posted on

MPs’ Web Sites

When I set up Planet Westminster in 2006 I thought it would be a relatively simple project to maintain. Over the years, more and more MPs would start blogs. Every couple of months I’d add the new ones and everything would be great.

It hasn’t worked out like that at all. MPs’ web sites have proved to be really difficult to keep track of.

The problem is, of course, that the vast majority of MPs have absolutely no idea how web sites, blogs or web feeds work. That’s to be expected. What’s less expected is that many of them seem to get round that problem by delegating the work to people who also have no idea how web sites, blogs or web feeds work.

I’ve just done a clean-up of the feeds I’m currently monitoring. Here are some of the problems I’ve dealt with.

A few MPs (including Douglas Carswell and Caroline Lucas) changed the address of their web feed. Just changed it. No notification as fas as I can see. No attempt to redirect the old address to the new one. Just an old address returning a 404 error. Anyone who was subscribed to the old address would have just stopped getting updates. It’s almost like they don’t want people to follow what they have to say.

Ed Miliband’s web site has just ceased to exist. It now redirects you to the main Labour Party web site. Because the leader of the party obviously has no constituency responsibilities. Or something like that.

John McDonnell seems very confused. In 2007 he had a web site at john4leader.org.uk. In 2010, he was at john-­mcdonnell.­net. Both of these sites are now dead and he’s at john-mcdonnell.net. It’s like no-one has told him that you can reuse web site addresses. I wonder what he’ll do once he’s run out of variations of his name on different top-level domains.

Eric Joyce has just lost control of his domain. His ericjoyce.co.uk address currently goes to an unfinished web site campaigning for “John Smith for State Senator”. It doesn’t look as though Joyce realises this as he’s still promoting the web site on his Twitter profile.

Then there’s Rory Stewart. His web feed was returning data that my RSS parser couldn’t parse. Taking a closer look, it turned out that it was an HTML page rather than RSS or Atom. And it was an HTML page that advertised an online Canadian pharmacy pushing Cialis. Not really what an MP should be promoting.

Stuff like this happens all the time. MPs need to take more notice of this. And they need help from people who know what they are talking about. My theory (and it’s one that I’ve written about before) is that MPs’ web sites and blogs are often overcomplicated because they are developed by companies who come from a corporate IT background and who dismiss the possibility of using something free like WordPress and over-engineer something using tools that they are comfortable with. It can’t be a coincidence that many of the worst MP web sites I’ve seen serve pages with a .aspx extension (sorry – only geeks will understand that).

I’m going to repeat an offer I’ve made before. If any MP wants a blog set up for them,then I’m happy to help them or to put them in touch with someone who can help them. It needn’t be expensive. It needn’t be complex. But it can be very effective. And it will work.

Update: Eric Joyce replied to me on Twitter. He said:

Thanks. It’s being worked on and they seem to have pointed it at an obvious specimen page.

Posted on

Gullible

Did you know that the word “gullible” doesn’t actually appear in the OED?

A lot of people I know spend a lot of time poking holes in tabloid stories. It’s fun hobby for all the family. The tabloids are so bad at checking facts that it’s usually easy to find the basic flaws in things that they print. The internet makes it so easy to check facts that there’s no excuse not to do it. Oh, sure there’s a lot of nonsense out there too but it’s usually pretty simple to separate the facts from the nonsense.

Which is why it’s disappointing when people just don’t bother.

This image was all over Twitter and Facebook when I woke up this morning. It’s a great image. The idea of a sporting hero like Bradley Wiggins having a go at Piers Morgan like that is brilliant. It would be fantastic if it was true.

It’s not though.

And it’s easy enough to find out what actually happened. Both men have public Twitter feeds, it’s just a case of searching back to find the tweets in question. It took me a couple of minutes to find this exchange (it’s from a week ago).

And yes, I was very disappointed @bradwiggins didn’t sing the anthem either. Show some respect to our Monarch please!

— Piers Morgan (@piersmorgan) August 2, 2012

.@piersmorgan I was disappointed when you didn’t go to jail for insider dealing or phone hacking, but you know, each to his own @bradwiggins

— Colm Quinn (@mrcolmquinn) August 2, 2012

See that. The reply isn’t from @bradwiggins at all, it’s from @mrcolmquinn. And he wasn’t even pretending to be Bradley Wiggins or anything nefarious like that. He just included @bradwiggins’ name in the tweet so that Wiggins would see what was going on.

I’m not sure what happened after that. I think that for almost a week nothing much happened. At some point those two tweets were turned into the image above. I don’t who created the image or why they did it. I don’t even know whether they misread the tweets and genuinely thought that the reply came from Wiggins or whether they were trying to cause trouble.

I do know that overnight last night people started to share the image on Facebook and Twitter. And that pretty much everyone who shared it didn’t bother to do the two minutes of research it would take to find out what really happened.

The reply was a good one. Morgan certainly deserved it for being such an idiot about the national anthem. And I’m glad that it got a wider audience. I just wish that people weren’t taken in so easily when they see something that they want to be true.

The next time you go to share something like this with your friends, why not pause a couple of minutes and find out whether or not it’s actually true. Prove that you’re better than a tabloid journalist.

Oh, by the way, it’s not true about the word “gullible” either.

Posted on

Modern Perl for Non-Perl Programmers

Normally I keep my Perl posts over on my Perl blog. But although this post is about Perl, the regular readers of my Perl blog aren’t really the target audience.

That’s because I’m running a training course that is aimed at programmers who don’t use Perl. If you’re a programmer who is interested in learning about Perl, then you should have a look at Modern Perl for Non-Perl Programmers.

It’s a one day course at Google Campus in London on Saturday 6th October. Tickets are £30 and you can book your place by clicking the button below.

Eventbrite - Perl School: Modern Perl for Non-Perl Programmers

Posted on

Android Applications

For the last two years I’ve been using an HTC Desire. In the last few days I’ve upgraded to an HTC One X. Whilst I liked the Desire a lot, one thing that really let it down – the lack of space to install apps. I spent most of the last year with the “short of space” notification on. At times I was running a “one out, one in” policy where I could only install a new app if I removed one first.

The One X has a lot more memory, so I’m hoping that I won’t have so much problem installing apps and can try some new and interesting ones. I’ve started by installing what I consider the essential apps.

Then I installed a few apps that I used to use, but that I had to give up when I ran out of space on the Desire:

There’s one app that I used to use that I can no longer find. I think it was called Movie Finder and it listed all the films that were on at all the cinemas in London (or, perhaps, the UK). If anyone knows what it was – or can recommend a replacement – then please let me know.

I’ve installed some semi-random apps that caught my eye:

  • Gigbeat – Who seem to have beaten Songkick to producing an app that uses Songkick data.
  • Instagram – But it currently doesn’t support the camera in the One X. I’m sure that’ll come soon.
  • Night Clock
  • VirginMedia TV guide – currently just a TV guide, but it’ll be awesome when I get a Tivo as you can program it remotely.

That’s as far as it goes so far. But the Android market (sorry, I mean the “Google Play Store”) is now huge. I’m sure I’m missing out on interesting and useful apps. Or, perhaps, there are better apps available to replace the ones I’m currently using. Is Tweetdeck still the best Twitter client? Is there a better augmented reality app than Wikitude?

What am I missing out on?

Posted on

Internet Security Rule One

Internet security rule one is “do not share your password with anyone”. There should be no exceptions to this rule. If anyone asks you to share your password with them, your answer should always be no.

Sometimes people say “oh well, it’s only a password for [some unimportant web site] – what harm could it do?” And, of course, perhaps giving someone your password for that particular unimportant web site won’t do any harm. But it’s a chink in your armour. By revealing your password for that site you’ve set a precedent. You just might be that little less protective the next time that someone asks you to share your password.

It’s called the Password Anti-Pattern and its shortcomings have been well-documented for several years. I wrote about it with specific reference to Twitter a few years  ago.

There are two levels of problem here. Firstly there’s the fact that you’ve given a third party complete access to interact with the web site for you. If it’s your Twitter password you’ve given away then the third-party service can do anything to your Twitter account that you can do yourself – right up to closing your account.

I assume that everyone can work that out for themselves. But the second problem is more subtle. Obviously any web site where I have an account is storing my password somewhere (probably in a database). And any third-party service that I want to share my password with also stores that password. So what’s the difference?

The difference is that the original web site is (hopefully) following basic password storage principles and storing my password using non-reversible encryption. The third-party site can’t do that. The third-party site needs access to the plain-text version of the password so it can be used to log on to the original web site. Oh, sure, they’ll hopefully store the password in their database in some encrypted format, but it will have to be a reversible encryption so that they can get a plain-text version of it back when they need to use it to log in to the original site.

So if someone somehow gets a copy of the original web site’s database, your password is held in some industrial-strength non-reversible encrypted format. But if they get a copy of the third-party service’s database, they’ll have your password in a far less secure format. If, at the same time, they manage to grab the third-party service’s source code then they’ll know exactly what process to follow to get the plain-text version of your password from the encrypted version.

Of course, you’d hope that their data centre is secure and no-one will ever steal their database or their source code. But it could happen. And the more passwords that you share, the more chance there is that someone, somewhere will get hold of data that you’d rather not have.

There is, of course, a way round this. It’s called OAuth. With OAuth, you don’t need to give anyone your password. You can authorise certain applications (or services) to take certain actions on your behalf on particular web sites. So, for example, I can let Twitterfeed post to my Twitter account without giving it my password. And that’s all it can do. It can’t follow new people, maintain my Twitter lists or close my account.

Twitter is a good example. In 2007 and 2008 a whole ecosystem grew up around Twitter. Many services offered cool and interesting services to add on to your basic Twitter account (Twitterfeed was one of them). But they all needed your Twitter username and password, so anyone who was at all security-conscious couldn’t use them. But in 2009 Twitter implemented OAuth. And, a few months later, they turned off the old authentication scheme so that you now only use OAuth to talk to Twitter.

The remaining problem is that OAuth only works when the original web site has implemented it. And that’s quite a lot of work. There are still many web sites out there which have lots of useful information out there locked behind a username and password with no other way to access it.

All of which brings me to what prompted this post. Earlier today a friend pointed me at a web site which provided a really useful service. But when I looked, it did it by asking for my login details for another web site. I’m not going to name either of the sites involved (my friend works for the third-party site and I don’t want to embarrass her), but it was a really useful service and it made me sad that I couldn’t use it.

Of course, as my friend explained, they had no alternative. The original site didn’t have OAuth support, so the only way they could get hold of the useful data was to log in as the user.

To my mind, that’s not a good reason for implementing the password anti-pattern. To my mind that’s where you say “oh well, that was a good idea – shame it’s not going to work” and start to lobby the original web site for some kind of OAuth support. But that’s not likely to happen as the point of this service is to compare different offerings and make suggestions of how the user could save money by switching to competitors. I can’t really see the original companies being keen to support that.

So we’re left with a situation where this third-party has implemented the password anti-pattern. And, as far as I can see, they’ve made quite a nice little business out of it. But makes me really uncomfortable to see what they’re doing. I’m pretty sure that I can trust them with my data, but I’m not prepared to compromise my principles in order to access this useful service. They are teaching people that it’s okay to share their passwords. And it’s not. It never is.

And it doesn’t stop with this company promoting their own service. On their site they have testimonials from a number of well-known web sites, newspapers and television programmes saying what a wonderful service it is. They have technology correspondents, who I would expect to know better, singing their praises and encouraging people to sign up for the service – telling people to break the first rule of internet security.

It all makes me rather depressed.

Look, I’ll tell you what. I’ve got a really good idea for an add-on for your online banking service. Just leave the login details in a comment below and I’ll set it up for you.