Due to SpinVox’s rather beleaguered year, there have been no noticeable improvements or enhancements in the service they provide.

Enter Ribbit!

Currently in beta, Ribbit promises to be all that SpinVox could be – and more.

The basic premise is the same.  You divert all your voicemail to their service, a caller leaves a message, you get it delivered as an SMS.  Perfect.

Set up was a breeze, enter account information and set up the divert.  They even do a test call to make sure everything is set up correctly.

Compared To Wishlist

So, how do they do compared to my wishlist?

MP3 delivery.

It’s great to receive an email with the transcript, but I’d really like to get an audio file as well.  Useful for record keeping, error checking and blackmail.

Yup – done and done!  MP3s come through email. If your phone picks up your email, you can listen to a message without having to dial in.  Perfect.

MP3 Email

.mobi site.

I’d like to be able to go to spinvox.mobi and see a list of all the voicemails I’ve received – including transcripts and audio downloads.

Again, close to perfect.  There’s a hidden mobile site – http://m.ribbit.com/ which gives you direct access to your transcriptions.  It even lets you dial in to a message or return a call directly from the web site.

Mobile Ribbit

Personal API.

I’d like access to an API for personal use.  To enable me to generate wordles or similar.  To grab all the voicemails from a particular person or containing a certain phrase.

It’s there! http://developer.ribbit.com/- I need to dig around to see what can be done.

Personalised Greetings.

I’d like to set different greetings for different sets of numbers. I keep the same number for work, friends and family. My friends don’t want to hear my work Out-Of-Office message and my work colleagues don’t want to hear my James Bond impression.

I can’t see a way to do this.  It should be possible.  Once I’ve uploaded my address book, I want my mates to get one voicemail greeting, work colleagues to get another, etc.

Along with greetings, I’d like to be able to quickly flick between my regular voicemail message and my out of office message. It’s great fun recording a new one every time I go away for a few days.

Yes! This works!  You can record as many greetings as you like – you can even use your computer’s microphone.  You can swap them over on the web – I’ve not found a way to do it either via IVR or mobile web.

Direct Dial Voicemail.

On Vodafone UK, I can dial 121 before any number and go straight through to voicemail – handy if I want to avoid someone! I’d like a number I can give out which would just go direct to my voicemail.

Not available.  A minor concern.

Website

Ribbit has an incredibly feature packed website.  As well as giving you complete control over your account, you can also use the website to read and listen to all your messages.

Ribbit Web Control Panel

You can also see missed calls. This is wonderfully useful. If you’re out of coverage, your phone won’t ring. Once you’re back in coverage, you can get a text or email from Ribbit telling you who rang but didn’t leave a message.

Shortcomings

Nothing in this world is perfect – let’s look at what Ribbit does badly.

Startup

The welcome text is very poorly done…

Ribbit Welcome SMS

Coming from an unknown number, oddly formatted and no link to the mobile portal. The link presented doesn’t render well on mobile either.

You only get one chance to make a first impression – sadly Ribbit’s first impression is of carelessness.

Accuracy

Always a tricky one to get right.  Take a listen to this MP3 and compare it to the transcribed text.

Hi, Terry. It’s Mom. We’re just about to go over to have a cruise in Hong Kong. It’s the most beautiful place I’ve ever seen. I’m just knocked out. Anyway, we’d love to hear from you speak to you, I guess you can ring this phone. We mentioned we have a cruise and I may answer it. I hope you and Lis well. And I love you lots. Bye.

Pretty damned accurate!  I put this under shortcomings because of the American translation of “Mum” to “Mom”.

Timezones

When your servers are in one country and your users are in another, date- and time-stamps become really important.

Mobile Ribbit

The timestamps in the mobile web version are several hours out.  A minor annoyance – but one which gives people a headache trying to work out why someone is calling you at 6AM!

QA

Notice the “Call Voicemail” link in the image above?

Ribbit Mobile Error

It’s pointing to – I presume – the US dial in number, not the UK one.  There are several little errors like this.  None of them critical, but all enough to remind you it’s in Beta.

Conclusion

Ribbit is close to perfect. It blows SpinVox out of the water in terms of voicemail functionality.

It’s accuracy is good – and it’s upfront about its transcription methods.  It even lets you sacrifice accuracy for confidentiality if you’d rather just have machines listening in.

What will make it sink or swim is its pricing.  Free during beta, it’s promising free automated transcription, with pricepoints of US$10 and $30 for higher tiers of premium human-based transcription.

It’s missing a few “nice to haves” – SpinVox let me reply to voicemails via text-to-voice and would let me update my social networks by speaking a message.

The website and mobile web service need a bit of spit-and-polish – but it is functional.

I highly recommend you sign up for the beta of Ribbit.

Share This

I wracked my brains thinking about how they could have gotten in there before I realised it was a long-dormant friend who had changed their name and avatar.

But, in thinking about how a spammer could infiltrate one’s timeline, I think I came up with a fairly bullet-proof method to spam Twitter users.

I present this as an exercise in devious thinking – and also to show how our assumptions about security can play against us. Remember, hacking and impersonation are likely to be illegal in your jurisdiction.  This information is designed to help you understand how security weaknesses can occur.

Being Evil

Imagine you are a nasty, evil Twitter spammer. Your own mother wouldn’t spit on you if you were on fire – that’s how mean you are. Here’s what you do.

1. Obtain a user’s password.  Admittedly, this is the hardest part of the process. You might use a dictionary attack, use the same password they use to log in to another site, or somehow steal it.
2. Log on to Twitter.
3. Go to “Connections” and see which services they have connected to using OAuth.  For the purposes of this experiment, let’s assume they use Example.com.
4. Go to Example.com and OAuth yourself with Twitter using your mark’s credentials.
5. Here’s where the ordinary spammer falls down.  The ordinary spammer will start sending out messages from the mark’s account.  That’s not the aim of this weakness.
6. From the mark’s account, through Example.com, make your victim follow one of your spam accounts.  An account which exists solely to show adverts to your victim.

Your victim now sees your adverts for pills, poker and porn in their timeline.  With any luck, they’ll just assume that one of their true friends is promoting your illicit wares.

Counter Attack

Most victims will assume that they accidentally followed your spam account – or that one of their friends has been hacked.

Worst case scenario, they unfollow your spam account.

So you just make them follow you again! Remember, you are still OAuth’d to Example.com. You can make them follow as many of your spam accounts as you think you can get away with.

At this point, the intelligent victim will think that their account may be compromised and change their password.

It doesn’t matter! Because you have used OAuth, password changes don’t affect you.  You can continue make them follow as many of your spam accounts as you think you can get away with.

At this point, the really intelligent victim will go through their OAuth connections to look for something suspicious.  They won’t find it.  Remember steps 3 and 4?  You are OAuth’d to a service that your victim trusts.

Because of the way Twitter displays OAuth information, there’s no way for a victim to know when a service was last authorised.

Twitter OAuth Connections

There is no information other than the first time the OAuth was set up.  No last accessed date, no IP addresses, nothing useful.

When following an account, the victim gets no notification of what has happened, when it has happened or how it has happened.  There is no way of them knowing which of their OAuth’d connections have been compromised, nor when it happened.

Their only safe option is to revoke every single OAuth connection.  Then reauthorise.  A time consuming and annoying prospect.

Conclusion

I hope I’ve demonstrated two things.

Firstly, there’s more to spam then just sending out messages.  Forcing someone to read a message is just as annoying.

Secondly, our understanding of security and usability haven’t quite caught up with the new tools which are available to us.  OAuth is still better than giving your password to an untrusted site – but without essential usability changes, a compromised account is a lot more dangerous than the user would suspect.

This “attack” still relies on a victim having their original password compromised.  That’s not a trivial matter.  But security is like sexual health – it only takes one little accident…

Share This

I posted a request asking if there was a pattern to the image sizes and, if not, was it possible to have the sizes returned in the API.

The “standard” open source reply – “fix it yerself” – was predictably swift.

So I did.

The source code is remarkably accessible – although a few more comments wouldn’t go amiss.  This was my first experience with GIT and Github.  It was easy to get the code and, luckily, I didn’t have to dive too far in to its syntax.

I had initially thought about using the EXIF data within the images to get the width and height.  Unfortunately, not every image can be guaranteed to have (accurate) EXIF data.  PHP to the rescue once again with the getimagesize() function.

So, where we previously had

if ($image) $row['image'] = $image;

This becomes

if ($image) {
	list($width, $height) = getimagesize($image);
	$row['image'] = $image;
	$row['image_height'] = $height;
	$row['image_width'] = $width;
}

Many thanks to Matthew Somerville for testing and releasing the patch in double quick time. You can examine the changes made to the code.

So now the API returns,

<image>/images/mps/10409.jpg</image>
<image_height>59</image_height>
<image_width>49</image_width>

Brilliant!

So, I have a problem, I can see how much effort it will be to fix, I suggest a solution, it works and goes into production.  That’s the awesome power of open source.

Share This

#hashtag – As long has there has been a way to search Tweets* people have been adding information to make the easy to find. The #hashtag syntax has become the standard for attaching a succinct tag to Tweets.

The Twitter Engineering Blog

That’s all well and good, but as I discovered yesterday, without standardisation the ability to search falls apart.

I’m not talking about whether you should use the #LondonFire tag rather than #FireOfLondon or #LDNfire. Rather; how does a computer recognise what a valid tag is?

Why Does This Matter?

Search and tracking quickly break down if they are inconsistent.
For example, if you are using #Romeo&Juliet to mark all your conversations about the play you are watching, different Twitter clients will link through to either #Romeo, #Romeo&, or #Romeo&Juliet.  Each search returning potentially different conversations.

What’s The Convention?

Twitter’s website ought to be the definitive source of how hashtags work. This is their main site.

Twitter Website Hashtag

Yet, when we visit their mobile site – we get a completely different experience.

Mobile.Twitter's hashtags

Application Confusion

Because there aren’t any widely publicised definitions for what hashtags are, some applications have a significantly different attitude to hashtags

SocialScope Hashtags

UberTwitter's Hashtag Support

Standardisation

To be fair, the Twitter team do have a standard.  Even if they don’t use it themselves.

They even have some limited test cases and libraries in Ruby and Java.

So, given that Twitter, their implementation and apps all disagree on what a hashtag is, let’s try to work our what they should be.

Anatomy of a Tag

To begin at the beginning.  A hashtag starts with a hash. #.  Simple, no? No.

There are two different hash symbols! There’s the # we all know and love, and there’s ＃.  Looks pretty similar, but in fact it’s the unicode symbol [U+FF03]

Actually, that’s not the beginning.  What comes before the # of the hashtag?

Consider the following examples – which should be hashtags?

• #tag – the # starts off the Tweet
• This is my tweet #test – the # comes after a space.
• This is it.#tag – the # is pushed against some punctuation, perhaps for reasons of space.
• Here we go-#LiftOff – the # is pushed against a -
• I’ve run out of space#OhNo – the # is pushed against some text
• &#nbsp; – the # is part of an HTML entity
• text　#hashtag – the # comes after a “wide space” (U+3000)
• Should I use #tag/#hashtag? The # comes after a /
• Is this valid ##tag – there are two #s

So, we can see it’s a little more complicated than we first thought.

The End

Let’s skip over what’s in a hashtag and as “how do we know that a tag has finished?”

Consider the following examples -

• New album #OMG! – should the ! be part of the hashtag?
• #BreakingNews: dog bites man – should the : be part of the hashtag?
• (is this a #tag) – should the ) be part of the hashtag?
• I like #tags#

We probably don’t want to have any punctuation at the end of our tag.  Can you think of any counter examples?

Yummy Filling

Our language is more than just the letters A-Z. We’ve got punctuation, numbers, symbols and all manner of other glyphs.  Which of them count as part of a hashtag?

Take a look at these examples

• Vote Bush! #Don’t
• My dog died #:-(
• Einstein #e=mc^2
• I’m on bus #123
• I’m giving #110%

Using Twitter’s standards, none of the above render as complete tags.

Foreign Languages

We’ve mentioned accents above.  As we can see in the first example, “funny” characters can cause problems.  Broadly speaking, there are three issues.

1. Accents.  Should the é on #Café be linked?
2. Accents.  Is #Romeo the same as #Ŕöméø?
3. Japanese, and some other languages, don’t use spaces.  Is #tagの valid? What about # 会議中 ?

Exhausted

These are a fraction of the possible problems.  It’s exhausting trying to find all the possible textual combinations and permutations which could lead into a hashtag.  No wonder there is confusion!

Search is a complex, profitable, and useful business.  It’s of vital importance that there is a legitimate, comprehensive standard which all sites and applications can follow.

Share This

Sitting around her in a semicircle, it was like Jackanory for adults. Despite never having read her work in public before, Zoe’s voice rang out loud and clear. She relished the innuendo and succeeded in making her audience dissolve into fits of giggles on several occasions.

This is the sequel to her extraordinary first book, Girl with a One-track Mind: Confessions of the Seductress Next Door

In with the smut, the London A-Z of where she’s shagged, and her thoughts on Rampant Rabbits, was unexpected heartbreak.

Anyone who has followed her blog knows the disgraceful way the Sunday Times treated Zoe. Their obnoxious pursuit of her and the lengths they went to for a “scoop”. I knew the story well. But hearing Zoe reading it aloud brought home just how terrifying it was for her.

The abuse – and there is no other word for it – is evidently still a raw subject. This new book is the product of emotional distance from a traumatic event – hence its delay in release.

It takes supreme courage to survive being exposed in front of your peers. Even more courage to take that experience, craft a book around it and then stand up in front of a group of strangers and ask them to listen to you.

Massive congratulations to Zoe for her outstanding blog and her brilliant second book.

Share This

This sort of knowledge is common in life – but is fatal in computing and design. Take the following tweet I received.

Mawkins

(Mark Hawkins)

@edent @dabr you folks aware ampersands / &s don't seem to work as part of hashtag links?

On 24-2-2010 16:27:19 from TweetDeck in reply to Terence Eden

The complaint was that #tfm&a should be rendered as #tfm&a not #tfm&a.

Everyone knows that’s how hashtags work!

On Twitter’s website, find the page which discusses hashtag syntax. Find where they explain how they should be styled.

You can’t.

And thus implicit knowledge is born. Dabr only looks at letters and numbers in a hashtag. It assumes that any other character is the end of the tag.

Dabr's Hashtag

Without official guidance – implicit knowledge develops.

Has Dabr Got It Wrong?

No. I don’t think so. Take a look at how Twitter on the web renders hashtags…

Twitter's Web Site

…and on the mobile.

Twitter Mobile

So Where Does Render The Full Tag?

Several applications don’t render tags in the same way as Twitter. Take a look at SocialScope

SocialScope Hashtags

Tweetie2

I’ll upload more screenshots if I find examples of “badly behaved” hashtags.  Please let me know if you find any.

What Does Twitter Say?

Twitter has one page devoted to hashtags.  It is a support page for hashtags.  This explains to people what hashtags are.  There’s no detail on valid characters, maximum length, or any of the things which might be useful for a developer or designer.

Edit 2010-02-25

David Dorward has pointed out that there is an official resource. On the Twitter Engineering blog – which isn’t linked to from the developer site – there is a page discussing hashtags and how to validate them. You’ll notice that they are rather circumspect on what should constitute a hashtag.

Conclusion

Standards and guidelines allow developers to create compatible applications.

Without explicit recommendations, developers will diverge as widely as possible.  Twitter – and everyone with an interest in compatibility and usability – needs to ensure that the knowledge they impart is explicit.

Letting people make it up as they go along leads to confusion.

Share This

The 25 Biggest Companies in Mobile. The inimitable Tommi Ahonen pores over the statistics and shows the size of companies according to the money they make in mobile – and only mobile. I may query the use of USD rather than € in the calculations, but the data are still highly interesting.  This is my post of the week!

Mob4Hire launches. There are thousands of handsets on hundreds of networks, how can you be sure your site or app will work on them? If you don’t want to spend hundreds of thousands of pounds building a library of devices and SIM cards, it’s worth looking at a service like this to get a wide range of test cases.

Mobile Wins Gold at Winter Olympics. With more people accessing the mobile web than ever before, MobiThinking takes a look at the explosion in mobile data use around the Olympics. Let’s hope that London’s networks are up to scratch for 2012!

What now for .mobi? With the slightly shocking news that .mobi has been sold to Affilias, what does this mean for the .mobi brand. I’ve a vested interest in this one, as I run a .mobi domain. Will mobile sites migrate to m. a la facebook and twitter? Can .mobi regain the initiative. Important questions.

Free White Paper on Mobile VoIP. This is a detailed look into the prospects of mobile VoIP in 2010. My thoughts? As we move the LTE – an all IP network – is there a long term future for alternate VoIP providers?

App Wars. Native apps vs Web apps vs Widgets vs JIL vs Device App Stores vs Operator App stores. It’s a bloodbath out there – but John Puterbaugh performs some excellent analysis on the main players and issues.

In a similar vein, Apps vs Browsers – Peggy Salz is looking for your opinion.  Will the mobile web splinter between touch devices, normal phones, apps?

Finally, bored with Google and Yahoo? Why not try Gune, a new meta-search engine for mobile.

You can find all my latest mobile focused blog posts at http://shkspr.mobi/blog/index.php/category/mobile/

Thanks for reading!

Share This

It’s one of my gripes with Linux.  If you’re editing a configuration file, you are relying on yourself to sanity check your input – often without knowing what the limits are.

Take these two different examples.

In a text file, we might have:

#Maximum Widgets to fidget
maxW_to-F = 0

Whereas a GUI would show

How many Widgets do you want to fidget?
1 2 3 5

Even if you don’t know the rules behind Widget fidgetting (must be a prime number lower than 7), the GUI won’t let you choose a value that you can’t select. The GUI doesn’t prevent you setting an innapropriate value – just an illegal one. Your config file, however, could be set to any crazy value that a user type – often resulting in “unpredictable” results.

#Maximum Widgets to fidget
maxW_to-F = seventeen

It’s with this in mind that I’ve made the following change to Dabr – the mobile Twitter client.

To Auth or Not To Auth? That Is The Question

Twitter’s API has bug / peculiarity (reported to their discussion board) which causes Dabr to log a user out. Let me explain the steps

• User 1 (@private) has set her tweets to “protected”.
• This means no one can see @private’s tweet unless she allows them.
• @private has not allowed User 2 (@edent) to view her tweets.  She is protect from his view.
• @edent clicks to view @private’s profile.
• @edent can see that @private has 42 friends, 17 followers and 3 favourites.

So far, this is the same behaviour on Twitter’s website as it is through their API.  Here’s the difference

Web

• @edent tries to see @private’s followers and can see their names, profile pictures etc.
• @edent can also see @private’s friends
• @edent cannot see @private’s favourites (or even how many favourites she has)

API

• @edent tries to see @private’s followers, friends or favourites
• Because @edent isn’t allowed to see @private’s info, the API returns 401 Authorisation Required.

This is where things get tricky. Dabr sees the 401 and concludes that the user has invalid credentials.  It then, as a security measure, clears the user’s cookie and logs them out.

This may be a little harsh, but HTTP 401 essentially says that the authorisation has failed.

Fixing It

There are 3 ways that this could be fixed

1. Twitter could rationalise the API to allow access to the same content that a web user gets.
2. Twitter could return a different status code.
3. Dabr needs fixing.

So, how do we get Dabr not to log out when it receives a 401 only under these specific circumstances?

Looking at the code, we can see that Dabr simply sees the HTTP response code.  To fix it we’ll need to pass extra parameters, check where the code was called from, investigate all the edge cases, add more logic to the system, futz around breaking things, etc… etc…

What a pain in the…

Or

Don’t let users do things they can’t do.

If a user can’t see the information – why do we even let them try to see the information?  Why can’t we just get rid of the link?

This is what a user currently sees:

Old Style

We’ve established that they can’t view followers, friends and favourites.  So we can get rid of those links (but not the information).

New Style

(Incidentally, I’ve changed the order of the links.  I’ve tried to group together similar items.  Followers, friends, favourites and lists go together. Then DM. Finally, follow, block, report spam.)

Now a user cannot click through to an unwanted error message.

Or

There is another way round this.  With “Direct Messages” we could do the same thing – simply remove the link if you’re not able to send that user a DM.

Instead, we’ve taken the approach of displaying a suitable error message.

Direct Message Warning

The advantage of this is that the user gets an explanation as to why they are unable to complete an action.

Your Thought?

Which do you prefer? Being unable to click on a link (with no explanation) or clicking on a link only to be given a warning message?

Share This

From the WordPress Blog:

I like to moderate comments when I’m waiting for something: a checkout clerk to help me, the dentist to call me back to the office, a soy chai to be made. I don’t lug my laptop everywhere I go,* so I love it that we have mobile apps that make this possible. I don’t know of any other blogging platform that has mobile apps for iPhone, Android and Blackberry. Do you? [emphasis added]

So if you are one of the 85% of people without one of these high end devices, you are out of luck. No managing your WordPress Blog for you.

This is – as PPK writes in The iPhone Obsession – a colossal mistake.  To ignore the majority of phone and focus significant developer resources on a minority of platforms just doesn’t make sense.

So, how do “ordinary” mobile users access their Blogs’ admin area?

Enter WordPress Mobile Pack

The WordPress Mobile Pack (which I help develop) doesn’t just make your blog viewable on all mobile browsers – it also makes your WordPress Dashboard options available.  Take a look at these screenshots.

Mobile Comment Moderation

This page is simple enough to work on any phone with an HTML browser.  Sure, you can argue that it’s not particularly attractive – but that’s the point of progressive enhancement.  Get it working, then add all the bell, whistles, JavaScript and CSS that you want for high end phones.

No need for an app or a widget. Bookmark your blog’s admin URL and you’re done.  You don’t need to worry about security updates, corporate policies which lock down your device, compatibility with the latest firmware, nothing.

You only need a web browser.

(The more astute among you will notice that this screenshot is from a BlackBerry – rest assured, this page works on all the phones I’ve tried it on.)

Wait! There’s More!

This is the front page of the Admin Panel. As you can see, just about everything you can do on the regular WordPress, you can do on mobile.  Create and edit posts, approve or trash comments, edit the settings.

Admin Panel

Almost every setting which is available to you in WordPress should also be available via mobile.

Settings

Prettifying It

As I’ve said, this isn’t the prettiest pig in the sty. On an Android device, the site takes on a more attractive style sheet.

Android CSS

So Why Use An App?

I think apps have tremendous potential – they’re at their best when they are taking advantage of a phone’s unique hardware / software.  3D graphics, geo-location, accessing the camera etc.

But why would you spent time and money writing an app for moderating WordPress comments? It just doesn’t make sense!  You don’t take advantage of the platform, you duplicate effort across multiple devices, and for what?

If you want broad reach across all of your users’ devices – write a website.  If you want to look cool, waste money and alienate the majority of your customer – build an app.

You can install WordPress Mobile Pack from http://wordpress.org/extend/plugins/wordpress-mobile-pack/

Share This

NB1: I primarily use SocialScope on my BlackBerry. SocialScope’s terms of use prohibit me from showing screenshots of their beta. Hey, guys, I want to show everyone how great you are!

NB2: Screenshots taken on a BlackBerry 9000 running OS 5.0

First Impressions

I’ve never understood the need for a EULA. They’re long, confusing, boring and a terrible way to make a first impression on your customers.  Twitter for Blackberry has a 30 page monstrosity.

EULA Hell

No one reads them, no one cares, find a better way.

Good

This app really shows off the power of the BlackBerry SDK. It’s a pity that more developers don’t make full use of it.

Tweets show up in your message list….

Message Integration

…and can be opened from there.

Open From Message

Images can be sent directly to TwitPic.

Send To Twitter

Apps like SocialScope and UberTwitter also hook in to the OS so that you can click on any #hastag and @name and be taken directly to that page within the app. I wasn’t able to ascertain whether this functionality was available in this app.

Bad

Limited view space.  At best, you can view 2 tweets at a time before scrolling. That’s not a very efficient use of space.

The Tweets Went In Two By Two

Poor navigation.  You can’t simply scroll left or right to move between pages, you need to scroll all the way to the top, or open the menu.

Navigation

The software also doesn’t remember which tweet you were on before you left.  It always refreshes the timeline and jumps to the top.  This is really annoying and it’s a problem solved in both UberTwitter and SocialScope.

Ugly

Missing loads of features that many users have become accostomed to.

• URL expansion.  bit.ly/fjhgkdfhg means nothing – use their API to expand the URL
• Embed images and media. Show a preview of flickr images, YouTube videos etc.  At the moment, it only appears to do TwitPic.
• No OAuth!  This is partly due to Twitter’s broken mobile OAuth support.
• No autocomplete. SocialScope will show a list of your friends when you type @ to allow you to quickly select them.

Conclusion

This app is amazing… if you’ve never used UberTwitter or SocialScope.  I also found it to be marginally slower than the other apps.

Share This

This was a problem I faced when trying to get Dabr to render the ASCII* art produced by Aral Balkan’s Feathers App. Feathers uses line breaks to achieve images like…

〰❀❃ Introducing ❃❀〰
My new iPhone app,
░░░▒█ Feathers █▒░░░

What’s confusing to me, as a developer is the inconsistent way Twitter handles line breaks. For example…

Twitter’s website ignores line breaks.

Desktop Spacing

Twitter Mobile, however, does line breaking correctly.

Android Spacing

Twitter has no style guide for rendering and – if it did – appears to render inconsistently. So, what’s the correct thing to do?

In my opinion, respect the user. If a user has indicted that they want something, it is a developer’s role to implement it (unless it causes severe problems for the system).

How to achieve it?

You could use all sorts of complex regular expressions to get line breaks and convert them.
Thankfully, PHP has this function built in with nl2br() which will give you (X)HTML line breaks wherever a break occurs in the text.

Footnote

*Technically, Unicode Art. But that doesn’t have the same ring to it.

Share This

Thanks – once again – to the clever-clogs at TheyWorkForYou, at least half of the problem has been solved.

The API call getConstituency now has a future parameter.  Adding future=1 to the call will return the constituency the Postcode will be in for the 2010 General Election.

I’ve also made use of TWFY’s getMP API call.  It returns enough detail about the current MP to be useful – including a photo.

So, a valid postcode will get you something like this:

MP Photo

One thing to note about the photos. Each one is a different size. This gives us two small problems.

Firstly there is no guarantee of how small the photo is. Should one MP’s photo be massive, that could cause a problem for the phone trying to download it. All the ones I’ve tried so far have been thumbnail size.

Secondly, because we don’t know the height and width of the image, we can’t put the height and width attributes in the <img> tag.  Not only is this poor HTML, but it will mean that rendering the page will take longer and – depending on the phone – page reflow may occur.

To mitigate this issue, I’m using http://tinysrc.mobi/ – it will automatically shrink the picture to fit the phone.  This doesn’t help with the page reflow issue though.

As for geo-locating Postcodes – I suggest you respond to Ordnance Survey’s consultation and / or lobby your MP.

Until there’s an official source for postcode data, I’ve gone back to using Yahoo!’s geo-location API.  I then pass these co-ordinates on to the Google Maps API.

So, VoteUK lives on.  Next steps are to make sure that all the data I got from the Electoral Commission is valid and build a framework for volunteers to enter their local candidate details.

Share This

Usually, I would be a big fan of this move – especially if it forces password anti-pattern sites like TwitPic to implement the new, secure standard.

This means that you won’t be able to log in to a third party site by giving them your username and  password.  You will have to use OAuth to securely validate with the main Twitter site.

But – as ever – there’s a dark side to OAuth.

Repressive Regimes

One of the joys of Twitter is that its clients are decentralised from the main site.

This means that if Twitter is blocked in your country, you can use a third party client (like Dabr) to access it.

Twitter User -> Dabr -> Twitter API -> Dabr -> User

If Dabr became sufficiently popular to be blocked by an oppressive regime, you can switch to any one of the thousands of Twitter web clients.

OAuth forces you to the main Twitter site.  While you may visit Dabr to start with, you would be redirected to Twitter to complete OAuth.  If Twitter is blocked, you can’t connect.

At a stroke, Twitter has shut itself off to anyone in a repressive country.

This has been picked up by some concerned users.

A (Hacky) Way Around It

There’s really only one way around this problem.  The third party web client has to act as a man-in-the-middle.  There’s a patch for Dabr – developed by cnyegle – which will ask for a username and password, then proxy it to Twitter, get the OAuth token and tweet on behalf of the user.

From the user’s point of view, they are still giving the (potentially untrusted) site the username and password.

Challenge Response

This could be solved by implemented a challenge / response system.

1. Alice visits the Dabr website.
2. Dabr asks Alice for her username (and only her username)
3. Dabr asks Twitter for the challenge associated with Alice’s username.
4. Twitter checks that Dabr is an authorised website (i.e. has signed up for OAuth).
5. Twitter returns the response:  A secret phrase which Alice has previously chosen.
6. Dabr displays this phrase to Alice.
7. Alice knows that Twitter trusts Dabr
8. Dabr asks Twitter for the password challenge.
9. Twitter returns that it requires the 3rd, 5th and last character from Alice’s password (the characters requested change randomly).
10. Dabr asks Alice for only those characters.
11. If Alice provides the correct characters, an OAuth token is granted to Dabr to tweet on behalf of Alice.

This has the advantage of proving that Dabr is trusted (by displaying Alice’s pre-defined secret phrase) and mitigating the risk that Dabr is untrusted (by only revealing part of the password).

Conclusion

This is a very new area, and I’ve not had a chance to read through all of the proposals.  Nevertheless, it remains a fundamental problem that, if you can’t access a site, you need to delegate your trust to someone else.

I’m not a security expert – so I would appreciate someone pointing out the flaws in my reasoning.

Share This

112 is the European wide emergency services number. Wherever you are in the EU, dialling 112 will get you through to the local emergency services. In fact, most GSM networks outside of the EU will also route your call correctly.

This is an important day. Dialling 112 could save your life. Sadly, the UK isn’t doing anything to promote it.

So, what better way to celebrate than by designing a JIL widget to allow you to quickly dial 112 in an emergency? (That’s a rhetorical question…)

JIL Widget

I’ve written before about the JIL SDK and my professional involvement with it.

The JIL SDK allows us access to the telephony subsystem.  This allows us to directly place a call – usually via the native dialer application.  It’s a very simple call, all you do is pass it a string.  It will take 0-9+#*.  So, you can use it to call USSD commands.  Annoyingly, you can’t get information back from the commands – a problem also present in Android.

So, the code is simply

<script type="text/javascript">
    Widget.Telephony.initiateVoiceCall("112");
</script>

That’s it.

Logo

The EU has a logo that they want people to use for 112 promotion.

Their licensing terms are very enlightened (for a government organisation)

Any organisation, institution, company or individual willing to inform citizens of the European emergency number can use the materials informing about the 112 and general logo of the 112 which are available on our website.
Regardless of the size or the branch of economic/social/cultural activity, all the entities concerned with safety and emergency issues are welcomed to use these materials and ideas for their campaigns.

Download

Download and install the widget.

On the Vodafone H1, you may need to dial

*#35767#

to remove the H1’s security check.

If you’re interest in developing for this platform, there’s a €1,000,000 bounty up for grabs.  There’s also a Dev Camp at Mobile World Congress this year.

I work for Vodafone – this is my personal blog, I don’t to speak for them.  All opinions, claims and mistakes are my own.

Share This

For a service which started out operating by SMS, Twitter takes a surprisingly unenlightened view of mobile. It’s main mobile service – http://m.twitter.com/ – is almost completely devoid of useful features. That’s one of the main impetuses behind the development of Dabr. Their latest mobile site – http://mobile.twitter.com/ – is really only suitable for the tiny minority of people who have smartphones.

So, understandably, many people use 3rd party sites like Dabr. They are now faced with a dilemma – give an untrusted site their username and password or try to use OAuth on the mobile.

A few weeks ago came the announcement that OAuth was finally ready for mobile… Was it? No. Once again a “mobile friendly” site designed with masses of JavaScript and guaranteed not to work with the majority of phones on the market.

Here’s how mobile OAuth looks on a variety of popular mobile phones.

BlackBerry

BlackBerry Twitter OAuth

While this looks pretty enough, it doesn’t work. The buttons aren’t clickable. I’ve tried with and without JavaScript. No matter where I click, nothing happens.

Android

The Android’s User-Agent isn’t detected by Twitter as being a mobile phone. While it’s true that the browser is very capable – the OAuth screen is a lot more usable when it’s in mobile mode.

Android Twitter OAuth

So, it works, but it doesn’t look nice.

N95

The N95 makes a good test phone because it’s popular. Probably more popular than the iPhone.

N95 Twitter OAuth

N95 Twitter OAuth

It’s not pretty – but at least it works.

Others

The Sharp GX-10 is my default test phone. One of the first phones with a colour HTML browser. If your site can work on this phone, it will work on any phone. There are no screenshot capabilities for this phone – but rest assured, it does not work.

The three phones I’ve demo’d above are very popular modern phones – AKA the minority. If they don’t work well, what chance for the people using older phones?

Useless! How hard can it be? All it needs is a username field, a password field and a button. That’s just about the most basic page imaginable. It should be child’s play to make it work on mobile.

This was first raised in March 2009 on Twitter’s issues list. It’s currently the most popular bug.

So, we’re stuck in a dire situation. Third-Party mobile sites get access to Twitter users’ passwords because Twitter are unable or unwilling to develop a simple OAuth form. It would be fascinating to know how many of Twitter’s security breaches are down to corrupt or insecure 3rd party sites which leak passwords.

Share This

Subject: Come One! Come All!
Date: Tue, 23 Jan 2001 13:27:51 -0000

Yes, this Sunday our charming colonial cousins will be playing the
American Football Superbowl!!!!!!!

If you’re anything like me you can contain your excitement at the thought
of watching a bunch of Yanks try to play rugby while dressed up like nancy
boys… but come anyway – there’s gonna be beer and nachos… LOTS of
beer… MANY nachos…

So, yeah, Sunday 28 Jan our place some time in the evening. Come or we’ll
cross you off our Christmas Card list. Ooooh – aren’t you scared?

Terry & Stoive
RSVP!

To explain… I was at university and sharing a house with my mate, Stoive. I can’t say that either of us really liked American Football, but it seemed like a good excuse for a party. We invited everyone we knew. Specifically – single girls. More specifically, one single girl.

As it turned out, we never got to see SuperBowl XXXV. It was shown only on Pay-per-view. Our cable provider (NTL, I think) had a delightfully British attitude to making money. We rang them on the Sunday morning, only to be told “Sorry, you can’t order pay-per-view at the weekends. The staff only work week-days.” I’m told that customer service hasn’t much improved in the land of cable.

So our “Superbowl” party became just another student party. The beer quickly ran out only to be replaced by honey vodka and Goldschläger. With the TV off, we were forced – horror of horror – into conversations.

I don’t really know how I wrangled it, but I ended up sat next to the girl I had invited. She was talking, I was talking. But we weren’t talking to each other. I was trying to work up the courage to talk to her. Stoive was cautioning me against eating too much spicy salsa; “Not if you want to get lucky tonight, mate!”

There was a brief lull in the conversations. I turned to her, about to say something which in my head sounded urbane when…

She kissed me.

She. Kissed. Me.

She kissed me.

She kissed me.

Nope. No matter how many permutations I try, I still don’t understand it. I know it happened – I’m still slightly at a loss to explain it.

One thing I do know is that, seven years later, she kissed me again. And we’ve still never watched a Super Bowl.

Share This

Shades of Grey – Jasper Fforde

Jasper Fforde is one of the few truly original writers. The plot is so-so (a mystery, a quest, a conspiracy) but the sci-fi is just the right side of weird. Absolutely no exposition about why the world is the way it is – it’s left to the reader to pick up what clues they can. One of the best books I’ve ever read. Funny, confusing and sweet.

I’d thought that the last Thursday Next book showed how FForde had painted himself into a bit of a corner.  This new universe he has created seems endlessly ripe for possibilities.

The Year of the Flood – Margaret Atwood

Dunce that I am, I didn’t realise until half-way through the book that this was a sequel to the rather brilliant Oryx and Crake.  You don’t need to have read Oryx to enjoy this book.  Much like Cory Doctorow (see below) Atwood’s speculative fiction is a delight.  It’s certainly refreshing to read a sci-fi work with two strong female leads.

Oryx and Crake – Margaret Atwood

I first read Oryx several years ago – the plot is still blisteringly good.  The only downside is some of the references have dated a little (CD-ROMs etc).  Re-reading this immediately after “Flood” was a revalation.  The characters burn brighter for knowing the complementary story within “Flood”.

Neverwhere – Neil Gaiman

I remember a special feature in the Radio Times about the making of the TV series – but I hadn’t found time to read the book until now.  Much like Shades of Grey, the plot is almost secondary to the world which Gaiman has created.  It owes a lot to Hitchikers’ Guide – but that’s no bad thing.

Black Swan – Taleb

For a much hyped book, this really isn’t very good.  The basic premise is sound – unexpected things happen; plan for them – but the writing is turgid, self-important and too folksy for my liking.  I got halfway through the book before I felt like he was repeating himself endlessly.  I don’t think I’ll return to it.

Starship Troopers – Heinlein

Another one that has languished on my “To Read” pile for far too long.  Expertly crafted sci-fi which – as far as I can see – hasn’t dated in the slightest.

Unseen Academicals – Pratchett

Terry Pratchett had lost his way on some recent DiscWorld books.  Too many plot strands and too many in-jokes.  This is a stunning return to form.  I’m not in the least bit interest in football – so I no doubt missed many excellent puns – but this was the funniest book I’ve read in a long while. The plots work well together and there’s jsut the right amount of menacing undertone.

The Diving Bell and The Butterfly – Baudry

It’s a remarkable book – dictated over months by a man who can only blink to communicate.  Essentially it’s a love letter to life.  That being said, I didn’t find it particularly moving or – if I’m honest – interesting.  If you’re missing your appreciation for life, it’s probably a must-read.

The Behaviour of Moths – Poppy Adams

Bit of a random one, this.  It’s a sweet and engaging story which is high on detail and emotion.  AKA chick-lit.  But rather than blather on about dieting, this concentrates on family relationships, the nature of love and self identity.  There’s a beautiful sense of mystery  which is expertly left to the reader to resolve. I didn’t really enjoy reading this book but – oddly – I find myself enjoying the memory of the book.  No doubt it will be made in to a mini-series at some point.

Makers – Cory Doctorow

Once again, Cory Doctorow comes up with a compelling vision of the future.  This is a more accessible read than some of his earlier work.  The human detail is richly expanded.  It seems, though, that it could do with a spot more editing.  The odd repeated phrase and convoluted sentence structure are a mite distracting.  I am also at a loss to explain his fetishising of Disney. Nevertheless, a hugely enjoyable and mind expanding book.

Saint Leibowitz and the Wild Horse Woman – Walter M. Miller

This is the sequel to “A Canticle for Liebowitz” – without a doubt one of my favourite books. I’m at a complete loss as to why this book was published (posthumously). All of the majesty from the original book is gone. It takes a small event in the life of the Liebowitz order and relates it with grinding detail. Similar in tone and scope to a novel like Ken Follet’s “Pillars of the Earth” but without any of the fire, zeal, excitement or – if I’m frank – plot.  This was a slog to read.

Share This

My partner and I, like many married couples, live together.  We speak over breakfast, commute together and send each other emails and texts throughout the day.  But we don’t do any of this on Facebook.

This worries Facebook.  It thinks our marriage may be on the rocks because we haven’t – excuse me – “poked” each other for a while.  Facebook knows the key to a successful marriage is to tag each other in as many photos as we can.

At least, that’s the only reason I can think for what I saw when I last logged in to Facebook.

Click to Embiggen

THANK YOU FACEBOOK FOR SAVING OUR MARRIAGE!

Share This

I’d be delighted to answer any questions you may have. Post them as a comment here, send me an SMS or an email and I’ll do my best to answer.

A quick look over the candidate statements shows that we’re all fairly well aligned. For no reason other than they’re very Web 2.0, I’ve made a Wordle of the candidate statements.

ORG Wordle - Click for Bigger

This work is licensed under a Creative Commons Attribution-Share Alike 2.5 Generic License.
Thanks to those who helped me craft my statement.

Voting is open to members only. Votes have to be returned by 15 February 2010.

Share This

I’ve tested this to work on the Vodafone 360 H1 – but it should work with any JIL handset.

Because it isn’t certified, you may need to dial

*#35767#

to remove the H1’s security check.

The code is very simple.  The JIL SDK allows you to call specific phone application – in this case, all I’ve done is invoked the browser.

<body>
   <script type="text/javascript">
      Widget.openURL("http://m.dabr.co.uk/");
   </script>
   <div>
      Launching Dabr!
   </div>
</body>

One thing to note, if you’re deploying the widgets from your website, ensure you have set the MIME type to “application/widget” – as per the W3C standards – otherwise many devices won’t recognise it as a valid widget.

If you’re interest in developing for this platform, there’s a €1,000,000 bounty up for grabs.  There’s also a Dev Camp at Mobile World Congress this year.

I work for Vodafone – this is my personal blog, I don’t to speak for them.  All opinions, claims and mistakes are my own.

Share This