Shave and a haircut: two bitcoins

Someone the other day was mentioning Bitcoin, which calls itself the first decentralized digital currency.  Regular readers of this blog, a select group to be sure, will probably not be surprised that this sent my not-so-disruptive-technology sensors into high gear.  So what's a decentralized digital currency?

Virtual worlds often have virtual currencies, which citizens can earn by doing various things in the virtual world and which they can exchange within the world.  In at least some cases these virtual currencies have leaked into the real world, or been tied to real money to begin with, not always with happy results.  One can view Bitcoin as abstracting that process and removing it from the confines of a closed, proprietary virtual world.

Bitcoin uses a modest ensemble of established crypto techniques to create a public audit trail certifying that a particular person has generated a Bitcoin, or that one person has exchanged some possibly fractional amount of Bitcoin with another (and by "person" I really mean "whatever has control of a given private key").  Generating bitcoins and certifying transactions requires a non-trivial amount of computation, much as generating money in a virtual world requires a non-trivial amount of whatever one does to earn money in that world.

There are various safeguards to ensure that each unit of Bitcoin has exactly one owner and everyone has a consistent view of who owns what.  That view can change over time.  In other words, Bitcoin meets some basic requirements for a currency: It is transferable, limited in supply and difficult to duplicate or forge.  So far, so good.


It occurs to me that there is actually already a very widely-used decentralized digital currency, namely money.

While it is still possible to exchange cash for goods and services, an awful lot of commerce gets done without it.  Instead, various banks and other entities simply increment and decrement balances in various accounts.  If I pay you, my balance goes down, yours goes up and one way or another our banks and various intermediaries get to take a cut.  This is certainly digital, and it's certainly currency.  It's also decentralized, in that there are many banks, particularly once we move into the international arena, and not even the various central banks have complete control of what happens.

However, it's not as radically decentralized as Bitcoin aims to be.  Bitcoin aims to take out all intermediaries.  If I pay you in Bitcoin, everyone in the system will be informed, reasonably soon, that I now own that much less Bitcoin and you own that much more.  All participants are an essentially equal footing.  There are no banks, clearinghouses or other such entities at all.

More precisely, everyone learns that whoever controls my private key has that much less and whoever controls yours has that much more.  Whether anyone knows who controls what keys is a separate matter.    Bitcoin uses pseudonymity -- known names tied to possibly unknown entities -- to recapture some of the anonymity of cash transactions.

The Bitcoin documentation is very careful to make the classic economical distinction between value in use and value in exchange.  The computational work done in producing Bitcoin and validating transactions is not inherently useful.  It basically consists of guessing numbers until one the right one comes up (technically, one that contains a given bit string and hashes to a particular value).  The value, if any, comes of people being willing to use Bitcoins in exchange, that is, as currency.  This is no different from printed pieces of paper or numbers in databases or, for that matter, materials like gold whose prices -- that is, their exchange rate with paper currencies -- are largely decoupled from their practical uses.



So this looks well thought through and doesn't seem wildly implausible.  Why was my spidey-sense tingling?

In trying to make sense of this I went back and reviewed the concept of currency.  Except there doesn't seem to be a nice, crisp, near-universally accepted concept of what makes currency work.  Scarcity is required, in the sense that the supply of currency must be bounded, albeit typically large.  Gold and other precious metals are hard to produce.  Coins are limited by fiat -- the king's mint will only put his face on so many coins, and woe betide the counterfeiter -- making it less important what the coin is made of.  Notes carry this one step further.  Clearly it doesn't matter much how much the paper and ink is worth, only that it's difficult to duplicate the note itself.

Numbers in databases are completely abstract, and they seem to work fine.  So why not Bitcoin?

At the end of the day, currency has to be exchangeable for something useful, for example, food.  This can only happen if the person accepting currency in exchange can be confident that they in turn will be able to exchange it for something useful to them.  Bitcoin works hard to ensure that it will behave essentially like physical cash and carefully-regulated changes in bank balances, but that still doesn't make it a currency.

And that's the crux of it.  Will people trust that Bitcoin will remain exchangeable?  What is the mechanism for maintaining confidence?  Typically, this confidence is based on confidence in a government, but other systems work as well.  Failed states may continue to circulate currency well after the government has collapsed.  Some countries are perfectly happy to use another country's currency.  Local communities have been known to create their own currencies which rely on the communal bond among members.  All of these and more can work, so why not Bitcoin?

Well, maybe it can.

The best measure I can think of for the viability of a new currency is how it converts to and from existing ones, and there are Bitcoin currency exchanges which do just that.  From what I can tell, the jury is still out, if only because Bitcoin hasn't been around that long yet.  Bitcoin is currently trading around $14, but it's been as high as twice that in the past couple of months and much, much lower not long before that [and on 28 November 2011, around $2.75, less than 10% of the all-time high ... given that the earth shook slightly when the Swiss Franc dropped from around $1.27 to around $1.16 and that Sterling's fall from 2.80DM to around 2.55 helped bring down a government, this sort of volatility does not look good ... my source for the price, mtgox.com, is now offering options and margin trading on the bitcoin, just in case anyone wants an even bigger adrenaline rush -- D.H.].  On the one hand, a non-zero value is encouraging, but on the other, that sort of volatility doesn't inspire confidence.

Personally, I don't see much reason to use Bitcoin in any significant way.  Money has worked fine so far, and if the US dollar should collapse, I'm not exactly convinced that Bitcoin would become a safe haven.

Messin' with the buttons again

It took a couple of tries, because the template I use is a fairly old one, but I've made a couple of tweaks to the buttons at the bottom of posts

• The old hand-crafted Digg widget is gone.  So far as I'm aware, no one has ever Dugg this blog.
• The old email button is gone
• In its place is an all-singing all-dancing set of share buttons, comprising (as I write this)
• email
• share to Blogger
• share to Twitter
• share to Facebook
• share to Google Buzz
• +1 -- a quick way to say "I like this", should you ever be so inclined

and of course, if you just want to read the post and be done with it, you still can do that, too.

Wikipedia tics

I'll say it again: Wikipedia is great.  I use it all the time.  It does its job astoundingly well, particularly given that when it was first getting started any sensible person could have told you it couldn't possibly work.  Anyone can edit it?  Anyone can write anything about anything?  And people are going to depend on it for information on a daily basis?  Riiiight.

But it does work, thanks to countless hours of effort from dedicated Wikipedians hammering out workable policies, nurturing the culture behind those polices and putting those policies into practice by editing a stupefying number of articles.   It is this endless stream of repairs and improvements that keeps Wikipedia from devolving into chaos.  It's a wonderful thing, but wonderful is not the same as absolutely perfect (for starters, one is achievable and the other isn't).  Anyone who's read Wikipedia more than casually will inevitably have a few pet peeves.  Here are some of mine (and yes, I do try to fix them when I come across them, time permitting):

• Link drift: Article A includes a link to article B.  Article B gets merged into article C and the link is changed to point to article C -- not the section, but the whole article.
• More link drift: Article A includes a link to article B.  Someone creates an article on a different meaning of B.  The article for B becomes a disambiguation page, and the article on A continues to point to it.
• Digression:  Article A has some connection to topic B, which people Need to Know More About.  Instead of just providing a short summary and linking to the article on B, an enthusiastic editor gives the complete story of B, in nearly but not exactly the same form as in the original article (or, the digressive section moves to its own article, but the section later regrows).
• I'm really into this: An article is stuffed with unsourced Things You Didn't Know about the topic, often to the point of downright creepiness.
• Some say ... yes, but some other people say ... yes, but ... :  People feel strongly about topic A.  Generations of editors qualify each other's statements until the article reads like a pingpong match. Usually an effort is made to collect the clashing statements into one section, but that doesn't always keep them from escaping into the article at large.
• Actually, everybody gets this wrong:  An editor makes a great point of declaring some piece of common knowledge incorrect without bothering to check if this is really the case.
• This is a very important distinction:  Instead of saying something on the order of "not to be confused with [link]" or such, an editor feels that it's worth including a sentence or two on either side of some valid but not earthshaking distinction emphasizing how crucial it is (see previous item if the distinction in question is invalid)
• Take it to the discussion page, please: A discussion that ought to be lightly summarized is hashed out in excruciating detail before our eyes.
• Oh look, I can write a textbook/conference paper, too!:  Editors seem to make a special effort to pepper their writing with the mannerisms of their professors or other authorities.  Math articles seem particularly prone to this ("clearly ... it turns out that ...").
• My home town/band is the awesomest:  Material on a place or group reads like your cousin showing you around on a visit.  I actually don't mind this, so long as it's not too overboard, even though it generally runs somewhat afoul of Wikipedia's notability policy, because how else does one find out about the Anytown Moose-waxing festival or the real meaning of "incandescent oak" in that one song (don't go searching for those -- I made them up).
• This article reads like it was written by dozens of different people over the course of several years:  Well, yeah.  The real magic of Wikipedia is that relatively few articles read like that, particularly if they really have had a chance for dozens of different people to work on them over the course of several years.
• [One other tic occurred to me not long after I hit "Publish": Gratuitous wikification.  To "wikify", in wiki parlance, is to make an ordinary term into a link to the article for that term.  It's one of the things that makes wikis wikis, but sometimes people seem to go randomly overboard, occasionally with fairly odd results.]

Wikipedia's strength is in its transparency.  For the most part, you can see every draft of every article if you want to, every mistake, every correction, every paragraph in need of tightening, every statement in need of a reference, every quibble, every pointless edit war -- in short, everything that a normal publication, encyclopedic or otherwise, goes to great lengths to hide.  The downside is that flaws like the ones listed above are also there for all to see.

The upside is that we get Wikipedia.

This password madness has got to stop

It's well known that people like to choose bad passwords, and for years other people have suggested rules for making passwords more secure.  I'm not really sure why it should be happening now in particular, but it seems that every site that has a password must now jump on the bandwagon and have a password policy enforcer.

And of course, they're all a little different.

Fortunately there are plenty of possibilities.  Here's a do-it-yourself guide in case you think your site needs one.  First, pick any two of

• The password must contain at least one number
• The password must contain at least one lowercase letter
• The password must contain at least one uppercase letter
• The password must contain at least one special character

Next flip a coin to pick one of the remaining two to disallow.

Now pick a minimum length.  Back in the day, when computers were much slower than they are now and it wasn't fairly easy to get a gazillion computers to cooperate (with or without the owners' consent), the recommended minimum length was eight characters.  Today it should probably be more like 12 or 14.  So make sure the minimum length is at least six.

Now set a maximum length of 8.  Why a maximum, given that all other things equal, longer passwords are stronger, and the whole point of the exercise is to encourage strong passwords?  Don't know.  Probably whoever put the database together remembered the old eight-character rule and decided that should be the maximum.  But 8 is a magic number for passwords and everyone else does it.

Finally, add an arbitrary hidden restriction.  For example, if the password has to have a number, make sure it can't be the first character (yes, I ran into that one).  If it has to be a special character, quietly disallow '$' and '!'.  Something like that, just to reduce the strength and make people work a little harder.

Voila.  You now have a password policy.  If I did that math right, there are three dozen basic policies, times however many arbitrary rules there are, so there are easily hundreds of possibilities.  Chances are fair that your poor user will never have encountered your exact policy before and never will again.

Chances are also fair that once they jump through all your hoops (bonus points if this is all happening on a smartphone or tablet), your poor user will have never come up with that particular password on the spot before.  That's good, since sharing passwords can be dangerous.  The only drawback is that poor user is liable to forget this ad-hoc password within five minutes of logging in.

So urge them to write it down "some place safe."

Then have them pick three or four secret questions and answers for when they have to reset the password next time they log on.  But that's a different rant.


If you feel you need further security advice, you can always consult a real expert.

Now available in sleek mobile templates

Blogger offered me a new feature to turn on, and it looked cool, so I turned it on.

If you're accessing this on a mobile device, you should now see the blog in a much less cluttered format, better suited to the small screen.  I haven't tried it from a mobile device yet myself, but the preview looked good.  Hope you like it.

Whither Tuvalu?

The sea has been rising and will pretty clearly continue to rise.  This is not cause for immediate concern to citizens of Utah or Kyrgyzstan, but it's of great concern to citizens of countries such as Maldives (highest elevation 2.3 meters) or Kiribati (a few meters).  Or Tuvalu (4.5 meters).

Bear in mind that an island nation does not have to be completely inundated to become uninhabitable.  As the sea rises, the water inland becomes brackish and plants stop growing.  Storms become more destructive.  Even normal tides can become problematic and, leaving that aside, the amount of land, say, two meters above the sea will typically be dramatically less than the amount one meter above the sea.  It's a serious concern.

The Economist considers the worst case of an island nation becoming completely uninhabitable.  International law is unclear on this, there not being a lot of precedent, but the article speculates that, while the residents of the nation may be displaced and the nation itself no longer meet the criteria of having a clear territory or a permanent population, yet a nation might still remain a legal entity.  This matters because under this scenario the nation would still retain assets.

The most obvious asset is the territorial claim under the law of the sea (mainly territorial waters of 12 nautical miles and an economic zone of 200 nautical miles), but in the case of Tuvalu there is also the .tv domain (Maldives and Kiribati have their own domains of course, but haven't been able to exploit them economically the way Tuvalu has).  I've written before about how this didn't pan out to be quite the bonanza it was originally hoped to be, but according to Wikipedia it does bring in $4 million a year, or about $400 per year per capita under a contract expiring around 2012.

It's not clear what price the domain might fetch in the next round of negotiations, and in any case it would be small compensation for losing one's homeland, but amid all the sadness it's remarkable that perhaps some day the proceeds from a piece of virtual real estate will help sustain a virtual nation.

Sometimes they do listen

My correspondent who complained of bank's website putting "Complete Transfer" on a button that did not, in fact, complete the transfer is happy to report that the button now says "Continue Transfer".

Yay!

Kids, don't try this at home. Really. Don't.

Whenever I grab a spare moment from not being a lawyer and not being a security expert, I try to find time to not be a research chemist.  Fortunately for all of us, not only have more capable souls taken up that profession, but some of them have seen fit to blog about it.

Along with some interesting commentary on the pharma business and such, Derek Lowe's In the Pipeline includes two fine collections of hair-raising tales, under the headings of Things I Won't Work With and -- less extensively and not quite so entertainingly -- Things I'm Glad I Don't Do.  Some of it's a bit technical, but Lowe does a good job explaining things in a way someone with only basic knowledge of chemistry can understand.

And who am I to complain anyway?  I try to write in such a way that a non-compugeek reader can substitute "peanut butter" for terms like "sliding window protocol" and still get the gist, but I can't promise success in that regard.  At the very least, the non-chemist can substitute "exploding, highly-toxic and malodorous peanut butter" for most of the chemical terms and get the general drift.

Which, one must admit, does give the chemist a bit of a leg up.  I doubt I'll ever get to grace a post here with turns of phrase like

• ... the resulting compounds range from the merely explosive ... to the very explosive indeed
• Fragrance expert Luca Turin has described isonitriles as "the Godzilla of scent", and that's accurate, if you also try to imagine Godzilla's gym socks.
• ... water ice (explosion, natch), chlorine ("violent explosion", so he added it more slowly the second time), red phosphorus (not good) ...
• A colleague of mine made some in graduate school, and came down the hall to us looking rather pale.
• It reeks to a degree that makes people suspect evil supernatural forces.
• ... it’ll start roaring reactions with things like bricks and asbestos tile.
• It is, of course, extremely toxic, but that's the least of the problem.
• Read the paper and be glad that this wasn’t your PhD project.

On the other hand, none other than Gordon Moore (of Moore's law fame) got his start in the sciences blowing things up back in the days when a child's chemistry set had Real Chemicals in it.  In their own way, wild-eyed-crazy chemistry experiments are just as much a part of the web's DNA as cryptographically secure pseudo-random number generators peanut butter.




(When I was typing the first sentence, I missed the 'e' in "being."  Blogger's spell checker flagged it.  Yep.)

Really? I never mentioned Snopes?

Well that obviously needs fixed.

On the off chance that you haven't heard of it, snopes.com, more formally the Urban Legends Reference Pages, is the first place to go whenever someone forwards you a forward of a forward of ... a forward of an email containing some compelling factoid or tale.

All things considered, the signal/noise ratio of the web is surprisingly high.  Some sites, like Wikipedia, improve that ratio by (in aggregate) adding useful information.  Snopes does this as well, but also helps filter out the noise.  Given that it's a two-person operation (Barbara and David Mikkelson, who met during the days of alt.folklore.urban), one could make a strong case that Snopes accounts for more signal/noise improvement per person than any other site, if "signal/noise improvement per person" weren't such a geekily silly measure I'm not sure even I can use it with a straight face.

Crucially, Snopes does not set out specifically to debunk legends, though it may seem that way since only a small minority end up confirmed as true.  Rather, it sets out simply to document the known facts, track down how the various legends and rumors have circulated and if possible where they may have started, calling police departments and local officials to actually ask if something happened, and generally doing the journalistic legwork that too often gets bypassed in pursuit of a good story.

The Mikkelsons manage to do all this in evenhanded good faith and with a well-pitched sense of humor. Think of it as MythBusters for the web, albeit without Jamie's epic mustache.


Postscript: It occurs to me that studying the proliferation of urban legends ought to be a potent vaccine against taking the notion of "the wisdom of crowds" too far.

What's the Garden City Telegram saying today?

Ran across this while browsing through the news:  Newseum.org keeps images and readable PDFs of the front pages of hundreds of newspapers from dates it considers historically significant.  For copyright reasons, only selected front pages are available, but when they are the selection is impressive.

Navigation leaves a bit to be desired. Links from a particular front page to next and previous from the same paper would be nice, for example.  Nonetheless, it's a cool idea.

"When I use a word, it means just what I choose it to mean"

Another one in over the transom:

I have accounts at two different banks.  It's usually not a problem, but sometimes I need to transfer money from bank A to bank B.  I was happy to find out that bank B can do free transfers from other banks, after you've set things up.  It takes three days or so to clear, but that's generally no big deal.

All you have to do, once it's set up, is go on their web site and select "Transfer from outside the bank".  You select an account that you've already set up (bank A in my case).  You fill in the amount.  You select how you want the transfer done.  Actually there's just one choice: three-day free transfer.  At the bottom there's a button labeled "Complete Transfer"

So you click that button.  Another page comes up confirming the details you've just put in.  Great.  You're done.

Not so fast.

Three days later, there's no money transferred.  Contact customer service.  No, we don't see any record of it yet.  Please contact the bank where you initiated the transfer.

You're the bank where I initiated the transfer.

Sorry, don't see any sign of it.

Then you go back and try again.  You fill in the form.  You click on "Complete Transfer".  You see the same page with the details you just put in ... 

... and you think to scroll down to the bottom, which is cut off by your browser window.  At the bottom is a button that says "Send Transfer".

Didn't I just complete the transfer?  Guess not.  Click "Send Transfer".  The window goes gray and a spinny thing spins for a while.  Then you get a different window and a confirmation number.  Three days later the money is there.

Would it have killed anyone to have labelled the first button "Continue" instead of "Complete Transfer"?

Indeed.

[There's a happy ending, as announced in this post: The bank changed the text.  Yay!]