Making users the 'client' not the product (becoming an 'Data Guardian')

There is space in the market for a company to become an Data Guardian for the digital trails and activities created everyday by everybody that users the Internet.

This would be a service provided to the end user (person or company) that would store and anonymize the user's data (as stored or used by 3rd party services), in a way that the user would be able to control who, what, how and when their data is shared and used.

In practice this means that the user would stop being 'the product' (whose data is used and sold without his/her control), and would become 'the customer' (able to control/manage its own data).

RIP 'Belly Cruz', 12 year old Labrador

Today was a sad day :(

We had to put our 12 year 'belly' to 'sleep'

She got hit by a brain tumour a couple weeks ago, which left her without being able to walk and without any quality of life.

But what we have to remember, is that she had a great life, fully of joy and happiness (although she never managed to catch the squirrel, even after hundreds of attempts).

She was able to keep a mental map of every single plate/pot/pan that had not been licked (yet), and was always super excited to find our house (after going our for a walk).

She will be missed ... our silly dog....

Google Location tracking is a step too far for me (but its good they expose it)

Today, I was looking at my  Google Dashboard 'Account Activity', when I noticed the 'Location Tracking' section, which when I realised what it really meant, was quite freaky (and Big Brotherish).

The good news is that at least Google exposes this information, and provides a way to say 'no please' (which as you can see below I exactly what I did).

What would be really good/important, is if everybody that currently holds/collects this type of data (from other businesses/startups, telecom companies, GCHQ/NSA/Other-3-letter-gov-agency, XSS infected websites, owners of compromised browsers, etc...) would at least expose the fact that they are collecting and storing it (ideally there would also be a way to op out).

Another worrying behaviour that missing from the Google Dashboard is the mapping of 'who has current access to this information' and 'who had access to it in the past (both human and bots)'. This is relevant not just for Location Tracking data, but also for the other types of data/information/knowledge Google stores about me (and you, and your kids).

Of course that the fact that I asked Google not to track this information (and that they don't show it to me anymore), doesn't mean that they still not capturing it.

Ironically given the current 'everybody is potentially guilty' mentality of the security agencies today, I bet that asking for the location data NOT to be stored, is seen as a 'red flag' and most likely will meant that others WILL indeed start tracking my location (if they are not already).

Just added Flattr to this blog (I wonder how much Flattrs I will get?)

After Just Signed up for Flattr, what do you think of it? I decided to give it a try in this blog, since after all I'm also a content creator (and have recently reached my 1000 blog post).

What is interesting is that adding Flattr to this blog feels better than when I tried using Google AdSense (see Just disabled AdSense for this blog).

I guess the difference is that by adding AdSense to my blog I was exploiting my readers and benefiting from the 'getting out of control' ad industry (whose business model is to monitor and spy on everybody).

While by using Flattr I basically asking my readers to support me (if they like a particular blog post or content).

I also fell that it is a better relationship with the readers, since AdSense kinda pushes for the 'blockbuster post' with as much traffic as possible, where Flattr will (I hope) reward good and solid content, that added value to the reader, and that the reader liked enough to want to support it (lets see what happens :)  ).

For reference here is how I added Flattr to this blog:

Just Signed up for Flattr, what do you think of it?

While reading the Eclipse Memory Analyzer (MAT) - Tutorial I noticed a link to https://flattr.com which is a micro-payment solution for consumers of content to support the content creators.

Here is more info about Flattr:

• How Flattr works , Where can I flattr? , FAQ , Contact (Sweden and in London UK :)  )
• Flattr Wikipedia Article
• Bootstrapping a Podcast Economy with Flattr
• Twitter cuts off another payment service: Flattr is told to stop tying Favorites to money  and Twitter is forcing us to drop users ability to flattr creators by favoriting their tweets

Here are the steps I took to register:

Book: Sum: Tales from the Afterlives

I just finished reading Sum: Tales from the Afterlives by David-Eagleman, which is a small and easy to read book with lots of great ideas and concepts.

The books is basically 40 mini sci-fi stories about possible scenarios that could happen after we die.

Ironically, and predictably, the side effort of reading these possible scenarios, is to appreciate even more the live we currently live on :)

David is also the author of  Incognito: The Secret Lives of The Brain, which is a book that I started reading on a Kindle, loved it, but never finished. This is another good example of why Kindle/eBooks don't have the same connection with the reader as physical book (see Physical Books are the best technology for reading for a better analysis of why I think that happens).

I have now bought a physical copy of  The Secret Lives of The Brain  and am looking forward to reading it property :)

Lockhart's Mathmatician's Lament, Math's should be treated as Art and the 'dangerous idea' that Zero is

I have a problem with how maths is being taught to our kids.

The best description of the problem I've read is Lockhart's Mathmatician's Lament since it really touches on the fundamental problem that we (as a society) have created:

Maths should be taught as Art, just like Music or Painting , instead of the current 'force feed abstract non-real-work complex set of instructions and concepts'

If you have not read his amazing paper (and you can just start with the first 10 or so pages), do it NOW since it might change how to think about Maths and how they are taught in school.

Bill Gates would had changed to world more if he had bought and open sourced the Windows XP code base

I was reading the Wired Magazine that Bill edited and although Bill has done amazing things with his philanthropic activities, part of me things what would had been achieved if he had bought from Microsoft the Windows XP Operating System and Open Sourced it?

Here is an alternative reality that might had been much better for him and the world:

Just donated £50 to Wikipedia

Similar to what I did last year (see Improved Wikipedia funding page, why OWASP needs something similar, and who buys OWASP Corporate Memberships  and Lovely 'post help' email from Wikipedia) I just helped keeping Wikipedia open and independent.

I really like their 'please help us' text:

The power of not being in power (and being ignored)

I think helps a lot to give clarity and focus to ideas when the 'idea maker' doesn't have enough power to 'force' their execution (or adoption)

I've talked about this before in You will not have your best ideas when you are in a position of Power and it is something that more and more fell that is needed.

As somebody who has a lot of opinions and ideas (see I wish that OWASP in 2014 ....) I think it is very healthy that once I Stepped down as Board Member I was able to (eventually) write freely about An Idea of a new model for OWASP

What if minecraft was open source? (it would be an amazing learning tool)

Last week I did my 2nd CodeClub session where we tried to use a Minecraft server in the class (see Setting up a CraftBukkit based Minecraft server on OSX (Nov 2013) )

And it was a painful experience.

There where a ton of technical probs and most (if not all of them) were caused by the fact that MineCraft is not open source and needs to have a 'call home' function to make sure the clients have a valid license (i.e. there is an authentication step when connecting to a Minecraft server which forces the clients to be online, and introduces a number of issues).

This got me thinking about the hidden costs of the 'Minecraft closed' world, and how much more of an impact it would have if it was open source (and freely available to more kids).

The hidden costs of closed words (in reference to Disney/Pixar animations)

I just watched the Disney movie Frozen (with the kids), which is basically a re-cast of the characters and technology used on the Tangled movie.

What I really found interesting was how the kids (8 of them) really had no idea what I was talking about when I mentioned "...well ... they grabbed the same Software and Character's Programming used in Tangled, added a change of clothes and programmed a new story..."

Basically the concept that there is a HUGE amount of programming and technology behind these movies (Pixar, Dreamworks Animation, Walt Disney Animation, etc...) is completely alien to them.

Juno probe captures movie of Earth-Moon 'dance' (and how small we all are)

Very cool movie showing how small we all are:

What really hurts ... is not being defended by your peers/friends

As somebody who has a strong opinions and likes to do stuff, I found myself sometimes in situations where I step a little out of line and do offend/hurt others (see also Why do others think that I'm "hard to deal with" and that "I don't listen").

This means that I tend to be on the receiving end of some criticism, which I've learned to accept (and not argue back, even though I could). Sometimes it is better to just accept the mistakes and let the other side have their say, specially if they are right and some of their feelings where hurt.

Occasionally when that I happens, I get the question "Doesn't it hurt to be on the receiving end of that criticism?" (which is a variation of "doesn't it hurt to be so misunderstood on what you are trying to do?" )

Blogging is like speaking to my 'Future Self'

Speaking to our 'Future Self' is a concept that I have been thinking and rationalising lately.

Looking back I can see that I have been doing it for a while, but I think the first time I wrote it down was on this tweet:

SI Open Sources the Eclipse Plugin-development toolkit that I developed for TeamMentor

For the past couple months I have been working on a Eclipse plug-in for TeamMentor (see Programming Eclipse in Real-Time (using an 'Groovy based' Eclipse Plug-in) , Opening up a native Chrome Browser window inside Eclipse (raw version) , Injecting HP Fortify Eclipse Plug-in Views into HP’s WebInspect UI  and Two Videos showing TeamMentor Eclipse Plugin integration with Fortify Eclipse Plugin (as shown in HP Protect 2013 conference) ).

I had a number of culture chocks coming from a C#/VisualStudio/O2Platform/REPL world into a Java/Eclipse one. The biggest one by far was the loss of 'semi-real-time' code execution that I have in Windows/C#. I used the O2 Platform REPL (and Resharper+Ncrunch VS plugins) to have a proper TDD development mode (i.e. high effectiveness and productivity), and in the Eclipse world (specially in plugin development) I had a 10 to 30 sec delay before seeing the result of any code or UnitTests execution! (which is 95% slower than what I was used to)

So, as I guess it is typical of me, I didn't just create an Eclipse Plugin. I created an 'Eclipse Plugin to create/develop Eclipse Plugins' (think of it as a 'Groovy based Eclipse Plugin where the Groovy scripts have access to the Eclipse Objects of the Eclipse instance running those Groovy scripts' :)

4 Million USD to build a secure Operating System to run Secure websites?

Is that too expensive or a great investment?

Well ... I meet a great friend at AppSec USA that already built a secure OS (based on Open Source technology) years ago in a company that failed (i.e. went bust at great personal cost). He is one of the most cleaver guys I know, and he and his team built (at the time) an OS that powered a very high-profile and targeted website that was NOT compromised.

The only catch is that their previous efforts was done under a 'closed software' platform, and my view is that such creation needs to be done under an Open Source model. This would allow the code to be peer reviewed and checked. Just like crypo, a secure OS needs to have the highest degree of assurance.

And since we can't really have a 'Secure Website' without a 'Secure OS' , I'm sure we will see multiple 'Secure OSes' in the future. My only doubt is if my friends' creation will be one of them.

So how do I got to the 4 Million USD value?

Updating my bio description (as of Nov 2013), now more 'developer focused'

My current bio is quite a bit out of data and it looked like this:

Dinis Cruz is a Security Consultant based in London (UK) and specialized in: ASP.NET/J2EE Application Security, Application Security audits and .NET Security Curriculum Development. For the past years Dinis has focused on the field of Static Source Code analysis, from May 2007 to Dec 2009 he worked as a independent consultant for Ounce Labs (bought by IBM in July 2009) where during active security engagements using Ounce's technology he developed the Open Source codebase which now is the foundation of the OWASP O2 Platform. Dinis is currently focused on making the O2 Platform the industry standard for consuming, instrumenting and data-sharing between the multiple WebAppSec tools, the Security consultants and the final developers. Dinis is a also active trainer on .Net security having written and delivered courses for IOActive, Foundstone, Intense School and KPMG (at multiple locations including BlackHat), and has delivered a number of presentations and keynote speeches at multiple OWASP and Security related conferences At OWASP, Dinis is the leader of the OWASP O2 Platform project.

This was used in a number of places I presented recently (for example http://appsecusa2013.sched.org/speaker/dinis.cruz) and it not an accurate representation of what I'm currently focused on.

Physical Books are the best technology for reading, and bookstores should 'give' an eBook with every physical book published

I just bought 5 books at a really nice book store in central London and it is amazing how:

1. these bookstores are still afraid of the digital world 
2. don't have the confidence to say: 

"... If you buy a physical copy, we will give you (or sell for 10%) the eBook version. 

 ... the reason we 'give' you the eBook, is because the 'real' book is much better, but there are places were you might want to use the eBook.."

This is something that I already talked about it in my Why doesn't Waterstones (UK BookStore) also upsell kindle books? post (which has more ideas on what bookstores should do to provide a better service to readers).

Microsoft should sell Fully Patched Windows XP licenses (or open source it)

Microsoft should sell Windows XP because its newer operating systems should be so much better than Windows XP that its customers would be happy to buy the newer versions.