Bitcoin -- aftermath

At this writing, Bitcoin's price appears to have stabilized to around $170, but realistically who knows what will happen next?  I spent entirely too much time today watching the action, or at least what of it I could watch.  Bitcoincharts.com, which gathers market data from the various exchanges, was down for much of the day, apparently due to overload.  MtGox, the major exchange for Bitcoin, was running slow all day and printing all over the place.  $120 one minute, $180 the next.  It was hard to tell what was going on, which must have been extremely frustrating if you wanted to buy or sell (Disclosure: I have no position in Bitcoin, nor do I plan to take one).

The price chart, which is like none I've ever seen, sheds a little light on what was going on.  Up to about noon (this and all times UTC) on the 10th, BTC is continuing its steady climb.  It then starts to break back downwards.  This looks like a normal correction for a while.  Dropping back from 260 to 240 or 220 after a tremendous run-up doesn't seem unreasonable.  When the price drops below 210, though, things start to go haywire.

BTC starts to oscillate rapidly between a steadily dropping floor price and a series of higher levels, first 210, then 200, 180 and eventually 150.  One possibility is that someone is trying to support it by putting out a bid of, say, 200, but when that order is filled, the next highest bid is considerably lower (and dropping) and it fills before the next bid of 200 goes out.  After a while of this, a bid of 200 starts to look too expensive to maintain, so the bid goes down to 180, etc.

One thing to keep in mind is that volume here is quite thin.  Even when MtGox got back on its feet, trades were on the order of a dozen or so Bitcoin, and sometimes as small as a single Bitcoin (or smaller; Bitcoins can be subdivided very finely).  It's not out of the question that some of the higher-level trades were someone putting out a high asking price from one account and then filling it from a second account whenever their sell order was the only one showing.  I'm not claiming this is what happened, but such things can happen in thin markets.

Overall volume for the 10th was around 200,000, or about one Bitcoin changing hands every second.  This volume is about 2% of the total pool of 10 million Bitcoin currently in circulation (but bear in mind the same Bitcoin can change hands multiple times in a day).  This looks to be about three times average volume.  Turning over on the order of a percent on an average day is not unusual.  It's the total float that's smallish.  If Bitcoin were a stock, it would be considered small-cap (it was briefly into mid-cap territory at today's peak).

Back to the chart: Between about 6 and 8 pm, it would be fair to say that the price of Bitcoin was not well defined.  I couldn't bring up the order book on MtGox, but when there's that much fluctuation in a price, with the trade price jumping multiple percentage points from trade to trade, the bid/ask spread is effectively quite large.  Large spreads mean that a market maker should be able to make good money by buying at the low end and selling at the high end.  Again, it's not clear that anyone actually was doing that, but the opportunity was there on paper.

What is clear is that if you were trying to trade Bitcoin during that interval, there was a sizable risk that you would end up with a price far off of what you were aiming for.  This is a classic hallmark of a market crash, which, in any reasonable analysis, is what we had today.  Not a healthy correction.  A full-on crash.  There's not really anything else you can legitimately call a 50%+ price drop in a few hours with a huge spread for most of the duration.

After about 8 the spread narrowed down to more normal levels.  When the price crossed back above 150, it settled into a longer-scale damped oscillation (which appears actually to have started around the time the price dropped below 210 and the short-scale fluctuations began to grow).  Again, this is not something that one usually sees in heavily traded instruments, but it seems to have died down now.

I should mention that MtGox claims that its market has been manipulated by DDOS attacks, in particular that hackers have been swamping the exchange so that legitimate traders can't get through, causing said traders to panic and sell at low prices.  The hackers then back off, goes the theory, to let the price recover so they can sell high.

This seems a little implausible to me.   Even if it's true, it's not particularly reassuring.  I would not rest easily if I knew that a small group of hackers could cause my bank account to lose, say, 10% of its value whenever they liked.  It seems more likely, though, that under circumstances like today's the exchange will get much more web traffic in general, since people want to see what's going on, and at the same time the spread will widen because the price is moving quickly and the market is small and not particularly liquid.  But I don't have their server logs.  It's quite possible that Bitcoin is trading erratically for perfectly good financial reasons, and MtGox is getting DDOSed.

[Update: MtGox is now saying that, while they're nearly always under DDOS attack, today's problems were the result of there being more legitimate traders than the system can handle.  That seems more plausible.  It's not clear how many trades MtGox can handle per second.  As far as I can tell it's not a large number, but I can imagine any number of reasons the system might melt down anyway.]

[Another note: It's also possible that some of the funny-looking price action is due to lag in MtGox's servers.  If the price is dropping steadily but the ticker is printing old trades interleaved with more recent ones that might explain some of the small-scale jitter in the chart.  I can't quite come up with a scenario of that sort that would explain the particular pattern on the chart, but I find the general idea that the technical characteristics of the servers can have their own effects on the reported price action pretty plausible.  MtGox seems to be saying basically that.]

[And finally (I hope): Watching the order book on Bitfloor, it's pretty clear what was happening.  Someone (or ones) was sitting on the ask at (say) 120, either trying to support the price, or just trying to get out at the best price they could.  Meanwhile, the bid kept dropping.  Most of the time, someone would go ahead and sell at the low bid price.  Every so often, someone would go ahead and take the higher price, either deliberately or by mistake.  When that dried up, the ask moved down.  That looks adequate to explain the short-term fluctuations without appealing to technical glitches.  The sinusoidal movement towards 160 or so is a different matter.]

So far, I've been describing price action as for any random stock or commodity, but let's consider what this means for Bitcoin as a currency.  Suppose I were to offer you a Bitcoin certificate of deposit.  You give me 100 Bitcoin today, and 90 days from now I give you back 101 Bitcoin.  That's just over 4% annual return, compounded, not too bad these days.  Personally, I wouldn't touch such a thing with a 10-foot pole.  I have no idea what 100 Bitcoin will be worth 90 days from now.  Maybe $100, maybe $100,000.  Who knows?

That's a problem for a currency.  Stability is good for a currency.  Falling by half in short order is not, obviously, but neither is doubling in short order.  Why should I pay for anything in Bitcoin if everyone believes that Bitcoin is going to be worth twice as much in a week?  Bitcoin's price was a problem on the way up, not just on the way down.  Deflation -- which is built in to Bitcoin's fundamental model -- is every bit as troublesome as inflation, and in some ways more so.

Neither inflation nor deflation, though, is nearly as big a problem as volatility.  When the British pound dropped from 2.8 Deutschmarks to 2.4, about a 15% drop, the Conservative party's poll numbers plummeted and did not recover for over a decade.  Though there were other factors, of course, "Black Wednesday", when the government's efforts to prop up the pound failed, is widely considered to be one of the major ones.

By contrast, Bitcoin has settled down to the point where it has been bouncing back and forth in a window of 150-180, about 16%, and still a third or more off its high, while I've been writing this post.

Bitcoin may yet become a stable currency.  The boom and bust of the Dutch tulip mania wasn't the end of tulip farming as a business.   Today's gyrations may not be the end of Bitcoin as a unit of exchange, but if Bitcoin wants to become a serious currency, as opposed to a means of speculation, the recent run-up and general volatility are not how it will happen.

Two more comments on wild and wooly markets

1. Intrade and Bitcoin are two entirely different markets, with little in common beyond operating on the web and more or less separately from the more conventional financial markets.  I don't mean to imply anything more than that by mentioning them in the same post.
2. Much of the recent excitement about Bitcoin has been due to its value increasing sharply lately.  Its value, that is, in dollars.  Just sayin'.

Markets on the wild and wooly internet

Two data points, which I'm not going to try to analyze in detail just yet:

• The market for Bitcoin, which proposes to be an online, anonymous currency, has been on a tear lately, doubling in the last month (at this writing), more than quintupling in the last two and increasing tenfold in the last four months.  Good news if you bought or received Bitcoin four months ago, scary news if you bought yesterday.  The word "bubble" has been cropping up more and more lately, along with the usual explanations why it's not a bubble.
• Intrade, the online betting market which attempts to use the wisdom of crowds to predict events like elections and scientific discoveries, is closed while it tries to sort out some kind of financial irregularity and return to solvency.  The statements on the company's website are optimistic, and they may be right, but such things in general don't have a good record.

The whole point of markets like Bitcoin and Intrade is that they are not (as) subject to the regulations and restrictions of the conventional markets.  But that cuts both ways.

The infinite scrollbar

It's somewhat annoying when sites decide to show, say, the first 20 items of a list on a web page and to get more you have to find the "next" button.  It's nicer to bring up a list you can scroll through.  As you scroll, the size and location of the scroll bar will tell you how much you've got left.

Except when it won't.  Some sites -- particularly social sites, it seems -- will give you a scrolling list, but when you get near the bottom, they hit the server and bring in more items.  Suddenly your scroll bar gets smaller and the space below it grows.  After a while you realize that no matter how much farther you scroll, there will still be some left.  But by then you're hooked.  Just one more page ...

Technically, it's not a bad call.  Browsers can handle pretty big scrolling lists these days, but they probably wouldn't deal well with the full list of, say, hundreds of thousands or millions.  Bringing items in on demand is a nice compromise.  Chances are the human doing the scrolling will grow bored long before the browser's memory limits are seriously tested, and if not it can always throw out items from the top that are now well out of sight.  Score one for AJAX.

Psychologically it's pretty clever, too.  The nice large scrollbar at the beginning says "Come on in!  Just a little bit to look at here.  Won't take too long."  As noted, by the time you see what's really going on, you're drawn in.

Overall, I'm not sure I have a strong feeling about this style of widget.  I guess the convenience outweighs the subtle feeling I've been played.  But not by a lot.

Film studios ... not dead yet.

A few years ago I ran a series of posts (starting with this one) questioning a 60 Minutes piece on online video piracy.  My take was that 60 Minutes was parroting the MPAA's stand on piracy at the time without critically examining it as one might expect from an investigative news program.

I stand by that.

In one segment, director Steven Soderbergh doubted whether films like The Matrix could be made any more, since piracy was putting the studios out of business and keeping them from financing original works from outsiders.  At the time of that interview, Avatar was on its way to grossing an all-time record 2.8 billion dollars on a budget of $237 million.  Granted, James Cameron is not exactly a hollywood outsider (more on that below), but if the studios aren't financing new faces, it doesn't appear to be for lack of money.  Six of the top ten highest-grossing films have been made since that interview, and ten of the top twenty.   Comcast (owners of Universal) has nearly tripled its stock price.  Disney, Time-Warner and Viacom (owner of Paramount) have approximately doubled.

Overal box-office grosses have been basically flat since that interview, which would indeed be bad news for studios, if that were the only way that they made money.  But it isn't.  Video on demand and DVD/Blu-ray releases, with much lower overhead than the box office, have been a standard part of movie releases since before that interview was done.

Home video numbers seem harder to come by than box office grosses, but there's no doubt that, however much illegal copying may be going on, there's plenty of legal rental going on as well.  It doesn't look like the ability to copy bits online is hurting the film industry any more than the ability to copy them on videotape did.

In fact, the folks at South by Southwest seem to think that video on demand is actually helping get original films from outsiders made and seen.  The title of the panel, How I Learned To Stop Worrying and Love VOD, is itself instructive.

Nor do I think anyone seriously sees this as a triumph of the brave heroes at the MPAA against the evil pirates.  Rather, the industry has adjusted to the new technology and figured out how to make money off of it.  Which is their job.

I am not my IP address

It appears that the major ISPs have decided to launch an "education campaign" about copyright violation.  If their filters determine someone using your IP address is uploading copyrighted content, you will get a series of increasingly firm warnings telling you that you may be breaking the law.  And, as some have pointed out, to let you know that your ISP is watching what you're doing and to leave a nice, visible paper trail saying "you were warned".

I say "copyrighted content", but in practice that probably means video, .mp3 files and such.  I doubt that they're trying to catch people uploading the text of The Hunger Games or whatever, even though that's just as copyrighted as, say, Thrift Shop.

Before going on, I suppose this is a good opportunity to repeat the disclaimer: I don't speak for my employer.  I speak for myself, at least on a good day.  Let's throw in the "I am not a lawyer" spiel while we're at it.

On the one hand, I'm not horrified by this.  It certainly seems like a better approach than previous attempts to crack down.  The ISPs certainly have some right to do such things.  Your agreement with your ISP is a private contract.  As much as we value free speech as a principle, when you're paying a private company to convey your speech, they get some say.  Restrictions imposed by your ISP are not laws of congress.  Not to say that there shouldn't be some sort of protection, but any first-amendment case would have to be aimed at the laws regulating ISPs, not at the ISPs themselves.   Outside the US, your mileage may vary ... hmm ... how do you say "your mileage may vary" outside the US?

Likewise, the studios and record labels have a right to protect their copyrights (that is, the copyrights they acquired from the people who actually created the content).  Whatever we may think of studios, record labels, publishers and such, there is a legitimate business to be done in financing, publicizing and selecting content.  The question is whether it's done well or badly, ethically or not-so-ethically, and in what cases it makes sense for the creator to take on that role personally or hire it out.

That said, I'm leery of the basic approach of tying activity to an IP address.  In a typical household, any of several people may be using a given address, and the person paying for the service is generally not going to be aware of what every person in the household is doing at all times.

Neither is it safe to assume that the only people using the IP address in question are living in the house to which the IP address is assigned.  There are plenty of insecure wifi routers out there.  For that matter, there are plenty of deliberately insecure routers out there.  Is a coffee shop with free wifi also liable for whatever its guests choose to upload?

Nor is it that hard for someone uploading copyrighted material to disguise that fact, or plausibly deny it -- and it's a good bet that someone who makes a habit of distributing copyrighted material illegally would positively enjoy confounding The Man.

In short, it looks very easy to get false positives (someone notified of suspicious uploading when it's not their fault) and false negatives (someone up to no good going unnoticed).  If the idea is to "stop piracy", it's unlikely to work any better than previous attempts.  On the other hand, if the idea is to remind people that copyrighted material is protected by law, or start a discussion between the person legally on the hook for the internet bill and the rest of the people using it, that could probably work.

Behind all this is the issue in the title: to what extent can an IP address be identified with a person?  A reasonable analog in the real world is the distinction between a car's license plate and a person's driver's license.  A license plate is associated with a person, and that person bears some legal responsibility for what happens with that car, but if you loan your car to a good friend and that friend gets pulled over for speeding, the points go on the friend's license, not yours.

If the friend runs a red light and gets caught by a camera, though, you'll get the notice, as registrant of the car.  What happens next is a bit unclear, particularly if your maybe-not-so-good friend doesn't feel inclined to step up.

The ISP case seems more like the camera case than the pulled-over case.  Just as (generally) only the car can be positively identified, only the IP address, and not the person, can be positively identified [that is, the numeric address is known for sure ... there are ways, at least in theory, to spoof addresses in the sense that the packets sent to and from that address aren't going where the system thinks they're going].  Again, if the idea is to educate people about copyright law and remind them that yes, companies take this seriously and, by the way, we can see what you're doing with your IP connection, that's probably OK.  But if it comes down to fining and arresting people, the IP address involved had better be just one piece of evidence in a stronger case.

Not that that's much comfort if you have to hire a lawyer anyway.

Password reductio ad absurdum

I was just now logging into a site I hadn't logged into in several months, one for which I wanted to be sure I had a unique password.  Naturally, I'd forgotten the password.  So I clicked on the forgotten password link and chose the email option.  There was also a security questions option.  I should remember to make up some random lies for that, since I'm not going to use it and would prefer no one else did either.

Before too long, an email arrived with a clearly randomly-generated sequence of twelve upper- and lowercase letters.  That's about 68 bits of entropy.  If you could guess a trillion passwords a second [which, scarily enough, is not at all far-fetched], it would still take about 12 years to guess all the possibilities.  I'm not a great fan of passwords in general, except when used locally to unlock something that's actually secure, but that's a pretty reasonable password generation scheme.

So I log in with my new password.  Before I actually get in to the site, I'm told I need to change my password.

Because it's too weak.

Because it doesn't have a letter and a number.

But I'm free to make up any seven-character or longer sequence that does contain a number and a letter,  which does at least filter out all but two of SplashData's top 25 list of weak passwords (all but trustno1 and password1).  Let's just say it's 92% effective at improving password security and leave it at that.

Bad news, good news

Bad news: I'm still getting, shall we say, spurious comments.

Good news: They're pretty much all adhering to The Post I Shall Henceforth Endeavor To Avoid Referring to by Title.

Moral: Be careful how you title your blog posts.

Bonus: The hardly-ever-helpful spell correction I've never bothered to turn off seems to think that when I type "blo..." in a blog post, I really mean "boo".

Note to self: Figure out how to turn that "feature" off.

Hedwig and the Mobile Web

I had no idea of this until I ran across it in a Sporcle quiz:  Actress Hedy Lamarr, best known for her Hollywood roles in the 40s and 50s, and inspiration for Anne Hathaway's interpretation of Catwoman in The Dark Knight Rises, was also co-holder of a patent for "spectrum hopping" technology that eventually came to be used in WiFi, Bluetooth and CDMA.  The actual names on the patent are Hedy Kiesler Markey (Lamarr's legal name at the time) and avant-garde composer George Anthiel, a neighbor of hers who developed a means of controlling multiple player pianos.

This doesn't seem to be the first patent for such technology.  Earlier work by Otto Blackwell et. al. uses essentially the same idea.  Both use multiple frequencies, and both use a shared key to determine how to shift between frequencies.  The main difference appears to be that Blackwell uses telegraph tape as a keying mechanism while Lamarr and Antheil use player piano rolls.  However, there is little doubt that Lamarr's contributions to the invention were real and that the invention is significant.

It's interesting that both patents are presented as secret communication systems, as someone listening on only one frequency would only get part of the message.  However, it doesn't seem like it would take long for an enemy to hit on the idea of listening on more than one frequency and combining the signals.  So maybe I'm missing something [if power consumption isn't an issue, you could fill all the bands with padding -- anything that statistically looked like the real signal -- which would make the combined signal much less useful].  Today we use spread spectrum technology to increase bandwidth or decrease "power flux density" -- which I assume means about what it says.

It's also worth noting that Lamarr and Antheil didn't benefit significantly from their invention, which was not used in practice until after the patent had expired.  Lamarr did receive stock in a wireless technology company two years before her death, but it's not clear whether that came to anything.  Having made and spent millions over the course of her career, Lamarr spent much of her later years broke, and was twice arrested for shoplifting.

One more Twittery data point

The LA Times is clearly comfortable with Twitter, or at least its online version is.  A recent article on the Boeing 787 (aka Dreamliner) seems to consist mostly of tweets.  We see tweets from stranded travelers and tweets from not-stranded travelers commenting on their predicament.  Most significantly, I think, is that Boeing's official reaction is given in the form of tweets.

This seems to be more the exception than the rule, judging by a few other LA Times articles I clicked through to.

What do we mean "mobile device"?

It's pretty clear that mobile devices ... hang on a sec.  What's a mobile device?  According to Wikipedia, it's, um, a small electronic device you can carry around.  But not a laptop.  So a smart phone, a not-so-smart phone, a tablet computer, a camera, an MP3 player, a handheld video game, a pager ...

A few of those have been around a long time, at least by electronic standards.  Somehow, I don't think that most people have devices like this in mind when they speak of mobile devices.  For practical purposes, "mobile devices" means "smart phones, tablets and stuff like that".  More precisely, it's not just mobility that people care about.  It's mobile connectivity, the idea that your mobile device can connect to the world at large and interact with it in arbitrary ways.  The mobile web, that is.

So where was I?

It's pretty clear that mobile devices are playing a bigger and bigger role in people's lives these days.  Lots and lots and lots of people have cell phones, quite a few people have tablets, and more and more do every day(*).  It's also clear that people have adapted to having ready access to the web.  One sure way to know you're out in the boonies, whether for the good of getting away from it all or the ill of being cut off from it all, is not having any bars.

When I was a kid, not that long ago, I like to think, if you wanted to meet someone at a large public place, you would have to pre-arrange -- "Meet me on the west side of the station near the stairs for the subway line."  Now you can just call up your party and ask "Um, hey, where are you? ... oh, there I see you."  If you broke down at the side of the interstate, you'd have to wait for someone come by (unless you had a CB, and a lot of people did, though not necessarily for that particular reason).  Now you just call someone.  And, of course, all the behavioral changes brought on by the web, like pulling down news you're interested in instead of waiting for the evening paper or news broadcast, are possible whether or not you happen to be near home.

So if a mobile device is something mobile that can hook you up to the web, then what we have is a series of less-tethered-to-a-particular-place ways of connecting:

• Ancient times:  If you could connect to a remote system at all, it was through work, or a university or other such institution.  Maybe you could dial in to that system from home, using a honking big dumb terminal.  One way or another you were essentially going over phone lines (even the backbone of the time was a bunch of T1 lines, if I understand correctly).
• BBSs (Bulletin Board Systems) and online services such as Compu$erve begin to appear and personal computers with modems become commercially available.  Now you can connect from home, generally to a world completely different from what you'd encounter at work, assuming your line of work even involved the internet.
• Laptops become widespread.  Now you can connect from anywhere you can lug your laptop, assuming you can tie up a phone line.  By this time you can also plug your laptop in to people's local networks.  Cell phones exist, but using them to connect to the internet is cumbersome at best, and almost certainly very expensive.  Internet cafes pop up.
• WiFi becomes widespread.  With municipalities airports, hotels and commercial chains putting up hotspots here and there, the concept of an "internet cafe" becomes somewhat moot.  Many people can connect from wherever they are much of the time.  Phones are becoming webbier, but in a limited way.
• Present day: Smart phones become widespread.  Apps are developed so that you can interact with your favorite sites without squinting at a web site through a browser.  Phones have enough horsepower to provide a nice, snappy experience, at least where you have coverage.

If mobile connectivity is more important than whether a device will fit in your shirt pocket, and I think in this context it is, then mobility starts somewhere around the spread of laptops.  Certainly by the time WiFi is widespread and home "broadband" access is commercially available, the difference from the present day is more degree than kind (understanding that a big enough difference in degree is essentially a difference in kind).

That's not to say we're not entering a new phase.  We are.  A location-aware phone that is always on and always with you is significantly different from a laptop you have to plug in, power on, log in, etc.  From a technical point of view, designing for a small touch screen is significantly different from a laptop screen, much less a 30" monitor.  Nonetheless, the current phase is just the latest in a series of steps making it easier and easier to connect from anywhere.

(*) It's not always clear what "lots of people" or "widespread" should mean.  Widespread among affluent technophiles?  Lots of people in the developed world?  Widespread in a large portion of the world -- which may be ahead of parts of the developed world when it comes to mobile communication?  I'm bravely sidestepping such questions here, but I wanted to at least call them out.