Archive for July, 2007

wherethehellismatt.com

Friday, July 6th, 2007

This video is so cool! I thought to myself, there’s no way I am not gonna immediately post this on my blog! (note the double negation)

I’ve always wanted to travel the world, and this guy is definitely living my dream.

Whoa. I am jealous. Seriously.

Update — If you like the clip above, here are the outtakes (so cool too!)

Update 2 — This reminded me of a website I bookmarked. It lets me travel and see the world, all from my desktop. A poor man’s vivid dream tool, it’s pretty cool. So cool, it was acquired by Google. Do check it out! http://www.panoramio.com/

How long can you ride the wave of a single good idea?

Friday, July 6th, 2007

Ever since Shai Agassi left SAP AG (where he was in the running to be co-CEO), he has started a blog describing the many interesting things he is doing, to change the world. His posts are well thought out, requires research, due-diligence, careful observation, and just plain good-old business acumen. Shai is a technical guy (has a BS in computer science from Technion, a reputable educational institution in Israel), so he understands inherent intricacies of technical systems, yet he also has the ability to see the “big picture”, and knows what it takes to run a sustainable big tech company. Those two skills of his that I admire and hope to achieve.

Today, I just read a blog post of his, in his discussion of growth through innovation. He says,

[On Singapore’s leadership success, that comes from treating the island state as a large company] To a certain (much larger) degree, China applied the same model to create modern China over the last few years. Where most countries need one good idea every 5-10 years and can ride the wave of that idea for a generation, China needs to create one of those big ideas pretty much every 5-10 months at their scale. So what is the next big idea – because if you are a small country, like Israel or Singapore, you just can’t wait for the wave to hit the shore, you have to start paddling before the wave comes.

I’m musing over the similarities of running a big country vs. small country with running a big corporation vs. a small startup. If a startup can be built around a single good idea (and then ride that wave for say 5 years), it’s not too far fetched to say that a corporation 10X the size of the startup would have trouble competing in the marketplace if it was also churning out only 1 good idea every 5 years. I guess that’s why huge corporations churn out patents at the rate of a few per day? I remember Carly Fiorina using the number of patents filed by HP as one of the metrics to measure HP’s rate of innovation.

At any rate, reading this post by Shai just reminds me the importance of not falling into complacency. One good idea will only last so long, and in order to sustain a business, you better start thinking of your next good idea before the wave of the current good idea dies out. If you’re a big company, you will probably need a pipeline of good ideas. The process of building this pipeline should be formalized, with each idea vetted and tested out for soundness. In a startup, you can afford to be more ad-hoc and probably just yell over to the guy on the other side of your wall to bounce ideas, but in a big company, your “next-door” co-worker may be in Israel, Beijing, Dublin, or Paris (mine are) — I tried yelling really hard but apparently not hard enough. You can try but I wouldn’t recommend it.

So a question I would pose to my readers is, regardless of what type of business you are in, what is that next idea that you will come up with that will be the basis of that next wave, that your company can ride on for the next 5-10 years?

Shai is a good problem solver. He works by looking at the larger problem, and then breaking them up into smaller pieces, and solving those first. Then summing up those solutions to solve the bigger problem. That sounds a lot like the divide-and-conquer algorithm CS geeks learn.

Shai’s original blog post on this is here.

Cell phones for multiple factor authentication

Monday, July 2nd, 2007

So I was thinking about this today, you know how people carry around those key chains with a seemingly random number generator that’s used as a password? I have one issued by my company, and the way it works is, to access this thing (this resource, whatever, I’m trying to be generic about it), I type in the number showing up on my key chain at that very second, PLUS my password. You can read up more about two-factor authentications here.

Basically, the upside of using this RSA SecurID key chain I have, is that even if someone were to find out what my password is, without knowing the number showing up on the key chain (which changes every 60 seconds), my password is useless. So they would require physical possession of my RSA SecurID token. This is great, because if my password got leaked to say, some random guy in Russia, and I’m here in the US — he is going to have to come a long way to get my token, that is, if he can get it out of my kung fu grip. Likewise, the possession of my SecurID token without knowing my password is equally useless. I could show you the number on the token, but without my password you can’t gain access to anything.

I realize that some banks actually issue these hardware random number generator “tokens” to customers. Now that’s a great security practice, but these tokens are not cheap. I think they cost about $20-40 per unit. I’d imagine how costs would stack up once the number of customers start growing. Anyway, so my idea is this — we know that most people today have cell phones, and most people have a cell phone service where they have caller-ID (the ability to see the number that is calling them). Let’s say a big bank here in the US were to buy up 1,000 phone numbers. Then, whenever their customer wants to login to their website online — one of these 1,000 phone numbers would call the customer’s cell phone. This number would be then used in conjunction with their password to access the site.

Basically, we’re turning your cell phone into a RSA SecurID token. If some bad guy knew your password, UNLESS they also have possession of your phone, they won’t know the right number to punch in. They could guess, but first of all, they would need to know the 1,000 numbers the bank first possesses. That’s hard to figure out. The bank could do better than 1,000, perhaps 10,000. And, they could rotate the numbers. Meaning, buy 1,000 phone numbers, use these for 2 weeks, sell off these phone lines for another new 1,000 numbers.

The other requirement would be that after one of these 1,000 numbers call you, if you do not login to the website within say, 3 minutes, it will be invalid. So if you take longer than 3 minutes (perhaps you got interrupted, picked up a phone call, whatever), then the bank will just have to call you from another number.

So let’s recap how difficult it is to break this system. An online bank robber would have to know your password, and steal your phone. What if they have your password but dont have the guts to steal your phone? Can they do without the phone? Let’s see what they would have to guess without your phone.

  1. US phone numbers have 10 digits. Each digit goes from 0 through 9. So anything from 000-000-0000 to 999-999-9999 is possible. That’s 10 billion numbers
  2. Of these 10 billion numbers, you have to figure out how many of these actually belongs to the bank. Let’s take a conservative approach and say the bank has 1,000. So your odds are 1,000 divided by 10 Bil or a chance of 0.0000001. That’s a pretty darn small number. As a virtual bank robber, you wouldn’t know this exact number anyway. Unless you have an insider working for you who knows. This should be a highly guarded secret
  3. Now let’s say, these 1,000 numbers change on a bi-weekly basis. The numbers were hard to guess to begin with, and now they are constantly changing. So if you knew that a bank had 123-456-7890 as one of it’s numbers today, that may no longer be true tomorrow.

The added security benefit is this: If you were at the beach and you saw one of these numbers call you, you would know instantly that someone is trying to login to your bank account online.

There are many variations of this, such as, you could have a bank call up your cell phone from the same number over and over, but instead of looking at the number that just dialed you via caller ID, you pick up the phone, and a machine’s voice reads out loud at 10 digit number to you (great for customers with no caller-id). Or, the bank sends you a SMS text message with some number (also great for people with no caller ID). Whatever. The point is, your cell phone could be used by the bank as a second authentication mechanism.

For customers who don’t have cell phones, they probably don’t have electric in their homes. So they probably won’t need a bank account anyway. Or if they did, they wouldn’t have computers, so there would be no need for this anyway :D And this business model “scales” very well. The bank pays the initial cost of having such a service in place, and then for every new customer, there’s virtually no additional cost. With the RSA SecurID token, they’re paying $20-40 for EVERY single customer they sign up.

Perhaps now that I’ve said this, I’ll hear of a startup doing exactly this, and then selling it to banks.

Update 7/5/2007 – http://www.pcbanker.com/ has some of the best interest rates for CHECKING (not savings) account, and they provide their customers with the RSA SecurID tokens. Thanks Nigel.

I will always do the right thing (core value of mine)

Sunday, July 1st, 2007

Recently, a good friend of mine commented to me about how someone (let’s call him Mr. X) that I used to work with and I disliked, isn’t so bad of a person as long as one did not work with him. My friend said that because I had a bad experience with Mr. X, I’m not his friend today, but for those who have never been a colleague of Mr. X, they would be his friends. The point my friend was trying to make was that this guy was not a jerk outside of work, only at work, and that I would be Mr. X’s friend if I had never known him at work.

My reply to that was that, assuming that I never worked with Mr. X before, and became his friend, if I at a later date found out what a jerk he was at work, I would be lesser of a friend. Eventually becoming a non-friend. I rarely part ways like that with friends, but it has happened before. Relationships are two way streets. Last year I parted ways with a friend (in a less than desirable term), because I was giving up too much, and the relationship was just too lop-sided. That was someone else, not Mr. X.

Back to Mr. X. Why would I not be his friend, if he was only a bad person at work, and he wasn’t doing anything bad to me?

The answer was simple, and I didn’t even have to think hard. The values Mr. X stand for, and the actions that he exhibit, are against my personal core values.

I have a set of core values, and core values to me, are a standard that I will hold myself to, NO MATTER WHAT. My core values are carefully selected, and I will continue to practice my core values, even if the world shuns them. That’s an important test. When you build your set of core values, remember that they must pass the “popularity test”. If something you do suddenly becomes unpopular, and you decide to no longer do it, then that’s not a good core value. A core value is immutable, so carefully pick them.

One of my core values is: Doing The Right Thing

If that sounds vague to you, then what about Google’s core value of “Do No Evil”? Anyway, this value of mine basically means that, given a particular situation that I am in that requires my action, I will act according to what I think is the right thing to do. And this is something I will do, even if means that I have to make an unpopular choice. This is my standard that I have set for myself, feel free to bookmark this blog post and hold me accountable to what I have just said, should I future forget, and make a decision that’s not right.

Back to Mr. X. In my opinion, he does a lot of things at work to other people, that are not the right thing to do. But it’s not exactly blatantly wrong either, so he continues with his behavior. But deep down inside of me, it’s not right by my books, and I’m glad I don’t work with Mr. X. anymore.

The great thing about bad experiences, is that you learn from them. Granted, I haven’t learned what to do from Mr. X, but I have learned what NOT to do. Lots of it. I’ll describe my thoughts of an ideal person that I strive to be, and the things that I don’t want to be (and strive NOT to do).

Authenticity, transparency, and consistency

I like people who are authentic. The reason why I rank backstabbers worse than serial killers, child rapists, etc. is because backstabbers do it behind your back, while pretending to be your friend. To me, this is kind of like the Sarin attacks on the Tokyo subway. Those poor victims never stood a chance. The Sarin liquid is colorless, tasteless and has no odor. If those bad guys had the balls, they should have used guns or something. If someone is to kill me, do it to my face. Don’t do it behind my back. You declare war on a country before attacking. You don’t attack before declaring war.

Anyway, Mr. X was not exactly a backstabber, but he was a two-face bastard (in my book, a two-face bastard is not a full-fledged backstabber, but is on the right track to becoming one). Mr. X’s relationship modus operandi at work could be summed up as: If you were higher ranking than him at work, or if he thinks that you could help him, or indirectly do something to help him, he would be nice to you. Maybe even kiss your ass. However, if you are lower ranking than him, or if he knows there’s no way you could help him, or indirectly help him, he treats you like a second-class citizen. He’s not outright rude or anything, but a tad dishonest, sometimes even doing something to prevent you from advancing faster than him.

If you’re going to be a dick, by all means be a dick to everyone. Be a dick to people who you know can’t ever help you, and also the people who you know can help you. If you’re going to be a nice person, then be nice to everyone. Be nice and kiss your boss’s ass if you must, but also be nice to those who you know cannot help you. In short, don’t be a two-face bastard. Be consistent.

Mr. X would sell you something he himself wouldn’t buy. I simply can’t trust Mr. X, even when gives me advice, because sometimes the advice he gives me, is really in his own interest, not so much for me. Sometimes the so-called advice for me, really has nothing in it for me. It’s kind of like when someone says to you, “Hey, would you like to wash my car? It’s a great work out, and you look like you need a tan.” But phrase that in such a way that it looks like it benefits the person washing the car, not the owner of the car. “Hey, seriously, if you don’t do as I advice you to do, it’s really just bad for you. You should do it for your own good.”

Please. I wasn’t born yesterday. How about you do it first, and I’ll do it after I see you do it?

Authenticity helps build trust. When we trust each other, we can move forward and get real work done. We don’t spend time second guessing each other for a hidden agenda. I was constantly second guessing Mr. X. I can’t describe what a pain it is, living such a life of having to constantly second guess the people around you. Just to contrast, my current VP of Security Research Dan Hubbard is an awesome guy — I don’t second guess what he says. He tells it like it is, no beating around the bush, no having to look for double meanings. The team moves forward faster, without distrust. How do you unify a team to tackle a challenge with each member not trusting each other, and looking out for themselves only? YOU CAN’T.

Helping others succeed

Mr. X played the corporate big company political game of “playing your cards close to the vest”. Matter of fact, he regularly stole my best cards to be played as his, and amazed everyone with his winning streak. He hoarded valuable information and disseminated them based on the importance of the recipient to him, arguably an unfair but effective method of gaining control. The only problem is, he couldn’t find any valuable information on his own, so the valuable information he disseminated to others, were basically cut-paste jobs from my emails I sent him. Oh, the cut-paste email job conveniently strips out all indications that it he got the information from someone else.

In my opinion, that era of information hording to be powerful in the corporate work place is over. Look at the Web 2.0 phenomenon. Everyone is sharing information. The person who shares the most to benefit society, is considered the more powerful. They help others succeed. The person perceived to be full of valuable information but could possibly be a phony, IS NOT AS VALUABLE as the person who can actually deliver some value to you. If I knew you need something to be successful, and if I could not personally deliver it to you for your success, but if I knew of someone who can, I would introduce you both. I will admit I can’t help you with my own two hands, but that doesn’t mean that I can’t help you by connecting you to someone I know who can.

Given the choice of being perceived as someone true but not, and actually being someone true, but not necessarily perceived as such — I would pick the latter. If you’re a fake, eventually people will find out.

Also, I rather help others by giving them the ability to help themselves, rather than to force them come to me every single time. This is the “teach a man how to fish” philosophy. I rather teach you how to fish, than you give you a fish. I’ll give you a fish if you want, but that’s only a short term immediate benefit, and not sustainable in the long run for either of us. To contrast this with Mr. X, he would give you a fish for today, because he knows you will have to come back to him tomorrow. And he will do his best to actively prevent you from learning how to fish on your own.

They say that the people around you rub off on you. If you surround yourself with successful people, you too, would be successful. If that is so, then if I make the people around me successful, I too would be successful. Mr. X saw it as a zero sum game (if you win, I lose; so if I see you moving faster than me, I will slow you down). I disagree with that.

I observed that it’s mostly the little people who try to display their rank and power. The people with rank and power already know they have it, and don’t waste time proving it to their rank-and-files. Mr. X was slightly above rank-and-file, but he definitely made it known to others about whatever little power he had. I guess he forgot to check his ego at home before coming to work today. Again. Mr. X would be much more successful if we were back in the WWII era.

Keep away from people who try to belittle your ambitions. Small people always do that, but the really great make you feel that you, too, can become great.
– Mark Twain

To sum up, I knew about Mr. X’s two-face bastard attitude, my core values were mutually exclusive of his (some even conflicted), I could NOT operate autonomously, and our unfair lop-sided relationship resulted in my constant uncertainty and fear. He was impossible to read, was full of hidden agendas, and I had to constantly second guess him. That sealed the deal, my deal to resign, that is — and I left.

Hopefully I have not painted the picture that I am a saint — for I am not. I did have my naive moments, which I have since learned from. One of the great things about working with assholes, is that it builds character. I know that might sound cliche, but I speak for myself.

One of the reasons why I first started blogging, was to improve myself. I quickly found out that blogging provides transparency, as in, the internets will know what I’m about, and they can decide for themselves what they think of me (which I totally respect, good or bad). That reinforces that I need to be good, or else people would know that I’m actually bad, pretending to be good.

The other aspect I like about writing my blog, is that anybody reading my blog, can hold me accountable for what I say. Granted, I might sometimes write something when I’m half asleep, so that might not make much sense — but if you do the right thing, and judge me only by the well thought out articles that I really poured my full honest judgement into, .. then feel free to hold me accountable to what I say.