Adam Smith's Blog

Magic in the software -- what the point and shoot camera industry needs

Point and shoot cameras are being displaced by smartphone cameras, mainly because smartphones are more convenient.

But that isn't the whole story.  In the coming years point and shoots will find themselves under attack from a different angle; software will be easier to write for smartphone cameras, enabling use cases that point and shoots will have to scramble to keep up with.

For example, I take pictures on my iphone using the Dropbox app.  Pictures I take are immediately copied to all of my computers.  Even if point and shoots had internet connections, which they don't, they also don't have app platforms for companies like Dropbox to come in and add value.

There are a ton of apps that remain out of reach to point and shoots.  Just look at the variety of camera apps for the iphone.  Many of those apps would make sense in the point and shoot world.

So here's what I would do if I were a major camera manufacturer: create an app store for consumer camera apps.

Make sure the cameras have large-ish LCD touchscreens.  Maybe even add wifi adapters that can work in a peer-to-peer mode.  Give the apps access to the SD card, let them remix photos, show UI, and even use the wifi to share photos with other nearby cameras.

The magic is in the software.

Unfortunately I don't see this happening.  This is a classic innovator's dilemma situation.  It will start on the low end and work its way up market.

Seven Major Websites that Send Passwords Unprotected, and State Sponsored Deep Packet Inspection

I was having a conversation yesterday with my close friend and roommate Anson Tsai about websites that send user passwords in the clear.  This only matters, in theory, if there's a man in the middle who can read your traffic.

So it was a huge coincidence that China was accused today of coordinating sophisticated cyberattacks in an attempt to access the GMail accounts of some Chinese human rights activists.

Putting two and two together, I started worrying about China's ability to harvest passwords from Chinese users using deep packet inspection at their Great Firewall.

Countries like Iran have also come under attack for spying on its citizens online.  For example it would be bad if Twitter sent passwords insecurely given how instrumental Twitter was during the June elections and how the government was snooping on Internet traffic.

And it's only going to get worse as states get more sophisticated.

So I went through 36 top web sites and sniffed my computer's network traffic while logging in to see if the fake password I entered was sent in plain sight.

Seven of the 36 sites I tested sent passwords in the clear, available for an Internet Service Provider to read.  That's 20%!!

Here are the sites that send passwords in the clear:

• Slide
• Wikipedia
• hi5
• Photobucket
• Gamespot
• Tudou
• Taobao.com

Taobao.com and Tudou are Chinese.  Interestingly, 50% of the Chinese websites I tested were offenders.

In ordinary contexts I wouldn't be worried about this, but because of some states' unique Internet regimes I'd guess that, to take an example, the Chinese government has passwords for at least half of its citizens.

Let's do our best to fix this situation.  I don't know anyone at the Chinese sites but let's push our contacts at the other sites to fix their security bugs.  There are well known, easily implementable techniques for securing passwords sent back to a server.  It shouldn't be a big ask.

It will be difficult because the threats are not immediate or perceivable, but I think as top Internet properties these sites have a responsibility to use basic security practices to protect its users.

Expect a follow up report and please let us know in the comments if you can help or reach out to folks at Slide, Wikipedia, hi5, Photobucket, or Gamespot!

Feel free to retweet.  Here's a link to this post you can share: http://bit.ly/8f4Wsl.

Technology to circumvent online copyright enforcement

This post could also be called “Why it might become civil disobedience to serve up random data.”  You’ll see why in a bit!

Also, this post requires a basic understanding of XOR and how a one-time pad works.

If I serve up Lady GaGa’s latest MP3, I’ll get a takedown notice for copyright violation.

What if a friend and I served up bits that, when XOR’ed together, became the latest Lady GaGa MP3?

A judge would likely find both of us guilty of copyright violation, but it seems like a small stretch of the law.  I wonder if there’s something there…

What if I served up bits that, when XOR’ed with some publicly well known bits (e.g. the Firefox installer), became a Lady GaGa MP3?

I would probably be liable; it’d be strange for Firefox to be found guilty in any way.  You can see the law now: “you are culpable if you distribute something that is intended to be a reflection of a copyrighted work”.  Base guilt on intent and let the court discern intent.

But intent is impossible to discern if both files are pseudo-random.  If that’s the case, are both parties liable?

Seems so until you imagine this at scale.  Any given copyrighted work could be expressed across 10 random-looking files.  Are the copyright owners prepared to sue all of them?  That’s denial of service for you.  But it gets better because some of the hosts might really be innocent; some of the data blocks might be legitimate, for example ciphertext that just looks like random data.

In other words, this system would either (a) circumvent copyright enforcement, or (b) allow me to get any host of random-looking data sued.

Hm.  I can imagine college kids uploading random data to their home directories now, just to help out the effort.

Do you guys think this will ever happen?

Update: There has been a lot of great discussion on this over at Hacker News, in addition to the great comments we've been getting below!

How to Find and Hire Amazing People, Part 4

Hello folks!  This is the final part to the four part hiring series.  Parts one, two, and three are here, here, and here.  As the final part to this series, I want to close us out with a quick thought and links to other great startup hiring reading!

My closing thought is that there are different styles to everything, and your mileage may vary.  There's more than one way to skin a cat.  And so on.

Dharmesh likes to ask employees to work through a dating period of 60-90 days.  Jason Cohen likes to ask candidates to answer some essay questions before an interview.  These guys are both awesome.  You can't just write off these differences.

So you'll develop your own process over time that fits your style, industry, and company situation.

Which is great!  That's part of what makes your career fun and challenging!

Food For Thought

Here are some links to other pieces of writing on the subject of hiring.  I found all of these interesting and thought provoking!  Enjoy!

• Marc Andreesen: How to hire the best people you've ever worked with
• OnStartups.com:
• Why Startups Should ALWAYS Compromise When Hiring
  
• Startup Hiring: Why You Should Date Before Getting Married
• 5 Quick Pointers On Startup Hiring
 
• A Smart Bear: Hiring Employee #1
• Tom Pinckney: Competing with large companies for engineers
• Paul English: hiring religion
• SEOmozBlog: The It Getters

Thanks for reading, and stay tuned for future posts!

Finally, please let us know in the comments if you have any of your own favorite startup hiring reading to contribute to the pile!