Best way to test your apps? Let the tech writers do it!

From more than twenty years involvement with software companies, I can attest that the best person(s) to test (at least UAT) your software is the person writing the end user documentation. Heck this is the primary person to understand new software as it is being developed. Being able to know and experience what you are describing for new people helps uncover many issues that may otherwise only come to light after wide release.

Listen to this person's experiences in a recent podcast.

Built-in Privacy? Why do we need the government to tell us to design apps that way?

What is the FTC proposal, "Privacy By Design"? This U.S. government agency charged with protecting the public when it comes to commerce says companies should build privacy protections into their businesses and services from the get-go. This includes “data security, reasonable collection limits, sound retention and disposal practices, and data accuracy.” In addition, the FTC recommends that companies maintain these standards for data management for the life of a product or service.

We all agree with the FTC that most privacy policies are “generally ineffective” at explaining to users what types of information they are handing over to companies because most are “too long, are difficult to comprehend, and lack uniformity.” For this reason, the FTC proposes that all privacy policies “should be clearer, shorter, and more standardized.”

The agency's privacy guidelines could raise issues for e-commerce and online advertising. The policy outlined by the agency applies to nearly all companies “that collect or use consumer data that can be reasonably linked to a specific consumer, computer, or other device.” Due to the financial burden of the initial proposal, the FTC updated the final version to exclude business that collect data from fewer than 5,000 customers per year, and do not “share data with third parties.” However, this is a common sense approach, one that web services, mobile apps and any internet-based software developer should be already doing.

Read the full report here.

Using the Cloud... To start your car?!

With the software-intensive automobile, updates to your car's operating system (you knew your ride had an OS, right?) is typically a "sneaker net" operation. Your dealer plugs a USB drive into the iPod port, and updates the code that controls the gasoline-air mixture of the fuel injection system, or some other mission-critical onboard process.

Mercedes now utilizes a wireless system (that normally carries entertainment and an OnStar-like safety network) to update its products remotely -- much like Software Update on your Mac or IPhone.

http://www.txchnologist.com/2012/new-york-auto-show-upgrading-auto-software-in-a-flash

So let's keep our eyes open for the first Merc hacking incident!


- Posted by Tom/Bluedog

Guest blogger says, "Try searching the web for a better deal on Content!"

Guest written by our friend Solomon Thompson
.
When you are looking for a television cable company it is really important to scour the internet for all the good deals you can find. You will see that there are a million sites out there talking about how they have the best deal or the cheapest connection fee or the most channels etc. I decided to go with directtv.com about a year ago and I have been really happy with the service and the extras that come along with it. I thought I would share that even though all these other companies may claim to be the best and the cheapest there is no way that they can compare to the whole package that I found with Direct TV. I have all the channels I could possibly watch as well as multiple DVR boxes for the different televisions in my home to record multiple shows at once. I also love the mobile feature where you can schedule or edit any recordings right from your mobile smart phone. Go to their site and check it out for yourself.

Encryption followup

Not sure I completely agree that the author's perspective, that this particular approach to enciphering data will be the "big breakthrough" in cloud security, but the article is worth reading for two reasons, IMHO,

- A novel approach to a way to ensure security of data; this method seems to offer a compelling means.

- It illustrates why the use of patents to secure investment in a new technology is a double-edged sword.

By making the monopolistic use of a technology possible for inventors, the theory goes that inventors are motivated by the potential profits. On the other hand, useful inventions are denies by artificially maintaining high prices.

This particular approach utilizes homomorphic concatenation (concatenating two fragments of ciphertext, and can be found in RSA's approach as well as others. When considering cloud computing, "encrypting in the cloud" (on the server side) might not make the most sense. But because one buys computing resources on as-needed basis, it is very easy to increase the number of available servers when peak usage occurs, and reduce the number when not needed. While you can secure the channel to the cloud resource (via SSL), what do you do with the data on the persistent storage side?

As Craig Stuntz explains, what if it were possible for a user to upload their information encrypted under a public key? Then their data would be secure. This is possible today, but the server-side resource would be unable to act on the data. If, however, the encryption method used was also fully homomorphic, then the cloud-based web service could do all of the work without first decrypting the user’s information. The output of would still be encrypted under original public key. In fact, you'd be providing a valuable service without ever decrypting the end user's data.

Read more...