A SIM-card along-with the National ID card?

Taking on from Sanjay Swamy's post at Medianama, I think it's an excellent idea. Sure, there are the rough edges that one needs to smoothen out, but that's the case with any scheme of this magnitude. The kind of opportunities that open if your national ID can be part of your mobile SIM card are amazing. Especially in the mobile banking and m-commerce area.

Picture this: Your bank and telecom provider, both as part of their KYC, will need to know your national ID. Now, if you have the ability to link-up your SIM with your national ID (both smart cards), you can perform a fully authenticated financial transaction through your mobile phone. Just think of the number of services that can be made available to the rural population through such a thing!

The biggest challenge this idea will face is from people getting paranoid about
(a)a telecom operator "owning their identity", and
(b) not everyone having a mobile phone.

The National ID should be a complete in itself even without a SIM or a mobile phone. Something like the new vehicle registration smart cards you get in Maharashtra nowadays. However, it should have a detachable SIM card built right into it. If you want to use the additional features of your National ID, just remove the SIM and plug it in. You can keep your current phone number and even switch operators -- thanks to Number Portability.

The telecom operator (or anyone else on the mobile network) will NOT have access to your identity unless you authorize them during a transaction which requires such an access. It's just that if the SIM and your National ID live on the same hardware (which is, the smart card) you can link them up with ease, as and when required!

ICICI Bank -- Email shy?

Has anyone ever been able to successfully email ICICI Bank? I've tried twice and failed. Today was my second attempt. After being asked a series of questions (four, I think) I finally get this form.

Even after asking my account number (which will give them instant access to all my contact details -- KYC, remember) they still want me to type out my email address, phone number (along with STD code -- mobile numbers don't work), and complete contact address.

And finally, the damn thing doesn't work!

What's wrong with just giving an email address? Saves them from the development and maintenance cost of developing this stupid tool. Isn't customer support on email cheaper than doing it over the phone?

Update: A friend tell me that the form works on IE and not on Firefox. Irks me even more!

Email archival without mailing list software?

I believe that the lack of archives in business communication is a serious enough problem to solve. Especially in these times, when a lot of brainstorming happens on email amongst team members located in different geographies.

I've tried using Basecamp for all business communication and succeeded only partially. Although Basecamp can serve as a good archive for email communication, it just doesn't beat the simplicity of adding any random email address to the CC list when you hit "Reply all". You have to first add a user to a project, then add him to the message, and then reply to the message. This, of course, will work only if the person knows how to use Basecamp. Otherwise, add the additional overhead of evangelizing Basecamp over regular email before getting him to accept this new mode of communication. [1] If something confidential is being discussed, there's also this fear of archiving your trade secrets on someone else's servers.

Probably there's a good use-case to add a new feature in SMTP servers -- an archive header and an email archiving module. If an incoming email has the archive header (X-Archive: true) the SMTP server will archive the email by storing a copy of that email and making it accessible on a web page. All replies to that email (and further replies to those emails) will automatically get archived, regardless of whether they have the archive header or not [2]. The server can also add a footer to each email in the thread to direct the user to the archive. Optionally, the archiving module may also archive email attachments and make them available on the company intranet (or the web).

Various mail clients will also need to be modified to present a user with a checkbox while composing the mail that sets/unsets the archive header.

I think this feature can be easily hacked into postfix (or sendmail) and a couple of open source email clients (like Evolution and Thunderbird).

Alternatively, this can also be achieved by having a record-keeper email ID (something like archive@somecompany.com). Any email CCed to the record-keeper will be archived and available on the company intranet (or the web). The only drawback of this is that the archival chain can break very easily if someone removes the record-keeper from the CC list. This approach can probably be an easier path towards implementation, both from the client's as well as the server's side. (Aren't such archival modules already available?)

If anyone wants to collaborate on this project with me, please drop me an email at saurabhnanda (at) gmail (dot) com. I've been wanting to work on a decent tech project for quite some time now.

[1] Given, recipients of Basecamp messages can now simply reply to messages just like normal email, it's still not perfect. All formatting (even line-breaks) are stripped. And you still have to log on to Basecamp to compose a completely new message.

[2] I think it's reasonable to assume that since the parent wanted the email thread to be archived, it must be archived in its entirety.

In Support of "Top Posting"

All over the web, on mailing lists, especially in the open source geek circles [1], top posting is frowned upon. Even while bottom posting, you're not considered cultured if you don't truncate the parent post to the exact specific part(s) your reply pertains to. I, too, used to follow this religiously until recently.

After three years of communicating with non-geeks (you know, the business and marketing types), I realized that a lot of business communication was simply not possible in the typical quote-reply-quote-reply format that is prevelant on mailing lists. This is because of a couple of reasons, which I'll try to enumerate in the following paragraphs.

One of the reasons given for not including the parent post in its entirety is that anyone wanting to refer to the thread can always look up the mailing list archives. Cultured folk should not waste bandwidth and screen real estate by repeating what is available a click away. This is not the case with typical business communication, which starts between two people (with usually their bosses on the CC list -- to be "kept in the loop"). Along the course of a reasonably sized email discussion, the CC list grows exponentially (believe me)! First the bosses' bosses are added -- if the small fry realize that they'll need to save their ass if something goes wrong. Suddenly something is under the purview of a chappy in some other department and him and his boss and boss' boss are added to the list. Later someone realizes that the legal department also needs to be "kept in the loop". Within no time you're having an orgy on email! With each new addition to the CC list you need a place where the latecomers can read-up on the discussion till then. In normal business communication there are no "archives". The latest email, itself, serves as an archive. I've had a tough time catching up on the discussion where each email was regularly truncated by the participants. I had to piece together more than 25 different emails forwarded to me as the "archive" -- believe me, it wasn't an easy task. Therefore it's much better to preserve the entire thread in the body and add your reply to the top of the email.

A side-effect of not having an archive is that you can't really follow the quote-reply-quote-reply pattern ("Comments inline...") very effectively. If five different people are communicating, you suddenly lose track of (a) who said what, (b) in reply to what, and (c) in reply to whom. With an archive, each post can easily be identified on all three parameters. Take away the archives, and within two or three replies you lose track of (a) and (c) very easily. Inline comments, even in business communication, are useful when each paragraph or point in your email can be answered independent of the others. For example, when you're seeking answers to a list of technical questions. However as soon as you want to reply to the reply of your questions you start losing track of (a) and (c). One decent solution I've noticed is prefixing your reply with your name in square brackets. So, a typical email after a couple of back and forth replies looks like:

* Can I pass the customer's shipping address instead of the billing address in the API?
[Alice] It's possible, but why would you want to do it? You already have the billing address in the DB, don't you?
[Bob] Yes, we do -- but we don't want to share it due to privacy concerns.
[Alice] Okay, then you can pass the shipping address.

I've observed a significant side effect of following the quote-reply-quote-reply model of communication -- especially on tech mailing lists. A lot of discussions regularly morph into flame-wars, mudslinging matches, or "preachers preaching the lesser mortals." Don't get me wrong -- the communication style is not the sole reason for discussions going off track. Obviously a lot depends on the attitude of the people involved in the discussion, but I feel the communication style definitely promotes the degeneration of the discussion. When you read a post you generally disagree with, it's very tempting to pick each line, quote it, and try to rebut it individually. It's very easy to get lost in the trees for the woods.

[1] These are the only circles which seem to have a respectable mailing list culture.

Overestimating users of technology

Most software products assume too much about their users. After reading Alan Cooper's "The Inmates Are Running The Asylum" (at Amazon and at IndiaPlaza) I realized how much I used to presume about a user's comfort level with technology while designing products. I now consciously switch off the developer/geek side of my brain while writing product specs or mocking up UI prototypes.

Here's a post by David Pogue on what everyone assumes that everyone else knows but is wrong. I thought I would know every single thing on the list but was surprised to find a keyboard shortcut that was new to me - using shift + space to scroll up in a web page.

You can tap the Space bar to scroll down on a Web page one screenful. Add the Shift key to scroll back up.

Yahoo! recently released their research findings about an OpenID usability report. They were not surprising:

None of the users had heard of OpenID before, and none of them even noticed the OpenID sign-in box displayed below the traditional email/password login form on the site. [...] Observing these tests was more than a bit frustrating for the Yahoo! OpenID team, and the test subjects may have been distracted by the sounds of the groans and head-pounding coming from the other side of the one-way mirror. Certainly there is a lot of work to be done on the OpenID UX (user experience) front.

(At the risk of over-simplification, OpenID is a common username/password using which you can login to multiple websites without creating individual username/passwords for each.)

Scary: CSRF and REST

The latest exploit to hit the web is CSRF. It's nothing fancy, very simple to execute and understand. In a nutshell:

1. You're signed in to website A


2. You open a new tab and visit website B. Website B is a malicious website (or is a trusted website which has the potential of being malicious because of allowing user generate content-UGC).


3. Website B has an image tag (not necessarily, but the simplest to inject via UGC) which points to a predictable URL on website A. For example, <img src="http://www.a.com/account/delete?confirm=yes" /> which basically deletes your account on website A.


4. Your browser will try to fetch the "image" from website A, merrily sending your session cookie along with the request. And BOOM! On website B you don't get the image ('cuz there is none) but your account has just been deleted from website A.

This is the simplest scenario I've explained. Read the Wikipedia article CSRF to understand how it can be executed in a variety of ways and situations.

Over the past year or so I've been going ga-ga over RESTful architecture and stateless servers. I've tried making URLs predictable and discoverable. Personally, I click on the "keep me signed in" checkbox whenever on browsing the web on my laptop. This just turns my world around!

Does it mean that we now need to make sure we're not signed-in to one site while visiting another? Or that all web applications now have to be stateful and URLs have to be non-predictable? Which means that while generating a page the webserver will have to add a random token to each URL and validate that when the browser requests the URL? The horror!

Any thoughts, anyone? This sounds like impending doom!

Review: Rock on!!

So, last night I was conned into buying discounted paid preview tickets for Rock On screening at Metro Adlabs. I went there all hyped up thinking of catching a glimpse of the Rock On crew and general P3 types crowd. But I was let down. Cast/crew chhodo, acchi ladkiyon ki bhi kami thi! Anyways, but I was not let down by the movie.

Superb music - especially if you like rock (you'll like it even otherwise). Heard such good Hindi rock after a long time - nice lyrics and singing. Superb acting by the entire cast - never knew Arjun Rampal could act well. Superb singing by Farhaan Akhtar.

Movie is a tad slow and dwells upon each character and relationship and lets it build. But, I guess that's required. That's how the audience connects with each character.

Loved the end note - "Don't download the music. Buy the CD!" Heh, I will. Hope you will too. I wonder why these guys don't sell music CDs + posters + t-shirts right outside the movie hall. I'm sure I would've bought a CD without a second thought had I seen a stall right after I stepped out after watching the movie.

PS: Vote for it on the IMDB page for Rock On!!

FM

BMC aur Dharmendra mein ab zyaada farak nahin hai bacha, kutton ka khoon peene mein dono ko aata hai maza!

That's Mallishka on Red FM! Absolutely hilarious.

I'm hooked onto FM these days. Especially Rainbow FM in the mornings and late nights - they play amazing English music. The RJs mostly suck, but the music rocks.

Why do the other stations play the same songs over and over and over again? They haven't yet gotten over Jab We Met. I'm sick of listening to those songs. Get a new playlist guys!

Lazy programmer and why Lisp templates suck

I was reading some random article on Rediff and happened to notice this block shoved in one corner. What caught my eye was the first question - "Are commodity exchanges responsible for price raise of food grains?" - but I got easily distracted by the sheer laziness of the developer who implemented this. Check out the screenshot below:

1 answer(s)
5 answer(s)

I mean for god's sake! On one hand we have people who're trying to teach computers natural language processing, and artificial intelligence; and on the other hand computers can't figure out if was one answer or five answers.

Then I thought, how easy it would be to implement this in ERb:
<%= post.answer_count %> <%= post.answer_count==1 ? "answer" : "answers" %>

And then I got thinking how damn painful it would be to implement this in Lisp and HTML-Template. You'd first have to create a flag for each post indicating whether it had a single or multiple answer. Then you'd have to pass all those flags (or list of flags) down to the template filler function. Then you'd have to put a big TMPL_IF statement in the template to achieve the same thing:
<!-- TMPL_VAR answer-count --> <!-- TMPL_IF single-answer -->answer<!-- TMPL_ELSE -->answers<!-- /TMPL_IF -->
You could of course, for each post, simply compose the exact string to be displayed ("1 answer", "5 answers") and pass that down to the template. But what's the point of having templates if you can't separate view logic cleanly.

Lisp is a great language, which will probably help you achieve a lot of intellectual orgasms (Meta-object protocol, macros, reader macros, etc.) But it sure does need a good templating tool. I tried hacking around in CL-EMB, but it doesn't really cut it.

[End rant]

IIT Kanpur Suicides - Werther Effect/Copycat Suicides?

Yet another suicide rocks IIT Kanpur. Yet another round of introspection. More statement blaming the student-faculty relationship, internet usage, grading system and academic pressure. Media bites with ridiculous statements from, both, the students and the faculty.

I'm not sure how much the situation has changed from my times - and they're not too far in the past, I'm a 2005 graduate - but, I really don't think that the academic pressure is too high at IIT Kanpur. Any lower, and it'll risk getting lost amongst the gazillions of second and third rung engineering institues in the country.

Ditto with the grading system. It's not the best, but it's not the pits either. Every system has its pros and cons. And the cons are not that bad that they'd cause students to start committing suicides over them.

I think the suicides are because of an individual's intrinsic character and the Werther Effect. I first came across the Werther Effect while reading the chapter on social proof in Robert B. Cialdini's book, "Influence - The Psychology of Persuasion." The Werther Effect talks about how a highly publicized suicide can cause a number of follow up copy-cat suicides amongst people in the same situation. And suicides in IIT Kanpur (or any other IIT for that matter) are surely highly publicized. You have it splashed on the front pages of all local newspapers, the in-campus newsgroups would be flooded with posts, discussions in the quads & wings, special committees and reports, etc.

When I first read about the Werther Effect, I scoffed. But, now I've started believing in it. An extract from the Wikipedia article:

The well-known suicide serves as a model, in the absence of protective factors, for the next suicide. This is referred to as suicide contagion. They occasionally spread through a school system, through a community, or in terms of a celebrity suicide wave, nationally. This is called a suicide cluster[1]. Examples of celebrities whose suicides have inspired suicide clusters include the Japanese musician Hide and Yukiko Okada.

I think some psychology/sociology professor from the IITs should be looking at this angle as well. In my opinion, the grading system and the academic pressure is just fine. Let's not degrade the quality of IITs any further - we've got politicians to do that for us!