With "English" characters, that's fairly easy.

When a computer sees the character 1 it's really seeing the Unicode character U+0031. When it sees 2 it's really seeing the character U+0032 and so on.

The Arabic numbers we use (0 - 9) have an identical ordering in Unicode. This makes it very easy for a computer to sort "Western" numbers.

But for Chinese... Well, it's complicated!

Counting in Mandarin Chinese

Here's a very quick primer on Chinese numbers.

一 = 1
二 = 2
三 = 3
四 = 4
五 = 5
六 = 6
七 = 7
八 = 8
九 = 9
十 = 10
十一 = 11
十二 = 12
二十 = 20
二十一 = 21
二十二 = 22
一百 = 100
一百一 = 101
一百二十三 = 123

In Base-10 the length of a number reflects its size. A 4 digit number is always bigger than a 3 digit number.

In Chinese, a 3 character number like 四十二 (42) is longer than a 2 character number like 九十 (90), yet its value is smaller.

But that's not the worst of it!

Because of the controversial process of Han Unification - a whole bunch of Chinese, Japanese, and Korean characters (CJK) are lumped together in the same Unicode code block This leaves us with the somewhat weird situation where a number's numerical order doesn't match the order in which they're presented in Unicode.

Here's how the characters are represented:

Which, if my sorting is correct, gives us an ordering of: 1 7 3 2 5 9 8 6 10 4

This makes it impossible to perform even a basic sort of a simple list of numbers without first doing some complex fiddling to transform the characters into numbers first.

It gets even more complicated.

Anyone who has tried to sort a list of files with numbers in their name, knows that computers don't always see the world in the same way as humans. It's quite common to see a sorted list which looks like this:

10.mp3
11.mp3
1.mp3
20.mp3
2.mp3
3.mp3
4.mp3
...

Why? Because sorting by "text" is different to sorting by "value".

How do Chinese file names get sorted? Here's Ubuntu's File manager trying to sort some files with Chinese numbers in them:

Yet another ordering! Why? It turns out that there are lots of ways to sort Chinese characters.

In this case, the characters are sorted according to the "English" pronunciation order! That's the equivalent of sorting the numbers 1 - 10 alphabetically: eight five four nine one seven six ten three two.

Can we make it even more complicated?

Of course!

Let's include into the mix some Gujarati digits. They look quite similar to our familiar Arabic digits and, like Arabic digits, have a sensible Unicode ordering.

Imagine a folder with the files 1, 2, 3, 10 - with the numbers in Arabic, Chinese, and Gujarati. How would you expect the files to be sorted? Should 1 and 一 be grouped with Gujarati's ૧?

Naïvely we might expect the order to be 1, 2, 3, 10, ૧, ૨, ૩, ૧૦, 一, 二, 三, 十.

Ubuntu handles it two different ways. In the GUI, the files are grouped:

On the command line, we find yet another weird way to order files:

10.mp3
૧૦.mp3
1.mp3
૧.mp3
2.mp3
૨.mp3
3.mp3
૩.mp3
一.mp3
三.mp3
二.mp3
十.mp3

Would any human expect an ordering like this?

What's the solution?

I've complained before that modern computing tools often ignore modern languages. Usually it's not outright racism - just an ignorance of how the world works and how people interact with machines.

The correct way, in my opinion, is to have context aware tools which empathise with what the user is trying to achieve.

There are several algorithms for converting "Chinese numbers" into "Arabic numbers". When a tool encounters a character which represents a number, it should assume that the numerical representation contains semantic meaning.

Yes, it might be hard work - but that's what computers are here for. They do hard work so humans don't have to. And if your computer can't even sort files in the correct order, what else might it be getting wrong?

BBC News Technology

@BBCTech

Computer science exam had coding errors bbc.in/2eHHa0Cbbc.co.uk
SQA admits 'coding errors' in computer science exam
Scotland's exam body admits to a series of mistakes in one of this year's computer science tests.

---

As a professional computerist, I was intrigued to see what our fine young minds are being tested on. My memories of "computing" at school was being taught MS Word Version 2 (yes, I am that old). So, let's take a look at the paper - and its criticisms.

The original paper is available to download as a PDF. As a small disclaimer, I've not studied for this exam, and haven't been taught in a school for many years. The answers are how I would answer - without reference to a search engine.

1 Convert the decimal value 227 into the equivalent 8-bit binary number.

Bit of a tough start! For only one point? Good to get the fundamentals in early though.

Do they have a calculator? Hmmm, my conversion is a little rusty. It'll be 128 + 64 + 32, that gets us to 224. So add 3.

00000011
00100000
01000000
10000000
=
11100011

2 Explain why it is important that program code is readable.

Frankly, anyone who can answer this question - and then apply it to real life - is doing better than most professionals. I'm answering "It makes it easier for others to understand what you are trying to accomplish."

3 Explain why a database should not be stored in ROM memory.

I'm assuming the answer is "ROM means Read Only Memory. This means your can't update your database." Not the last "trivia" style question.

4 Give one reason of using this type of selection.

You can argue whether UI elements are computer "science" - but it's a fair question for a single mark. Radio buttons allow you to select one - and only one - answer from a list.

5 State the function of a processor’s registers.

Whoa! OK! Bit of a departure from the last question. Off the top of my head I'd say something like "Extremely short term memory built into the processor where numbers are directly manipulated." Is that right? Damn...

6 Anti-virus software may be included in a security suite.

State two other types of software which should be included in a security suite.

Again, computer science vs ICT raises its head. Incidentally, "Firewall" is the first thing that jumped to my head. And then... Errr... Spam filter? That feels like a weak answer.

7 Criminals can steal your identity by using keylogger programs. State two other ways in which identity theft can be carried out.

Little bit of infosec here! I'm going to say "shoulder surfing" and "Man-in-the-middle attacks".

8 A novice is one type of user of an information system. State one other type of user.

Errr.... "Expert"? Bit bemused as to why this question is here. Seems out of place with the others.

9 This code design monitors the temperature of food as it is reheated.

Line 1 RECEIVE temperature FROM (REAL) 
Line 2 WHILE temperature < 82 DO
Line 3   SEND “temperature too low: continue to reheat” TO DISPLAY
Line 4   RECEIVE temperature FROM (REAL) 
Line 5 END WHILE

Explain what will happen in lines 2 to 5 if the sensor detects 63°.

OK, so this is pseudo-code. Probably a good idea - unless the entire syllabus has standardised on a specific language.

I suppose the answer is "Because the temperature is lower than the condition, the instructions on the inner loop will be carried out. If the temperature stays at 64, the loop is never ended.

10 Lucy is looking for a summer holiday on-line. She wishes to leave on 22nd July from her local airport, and early in the afternoon.

State which database operation is being carried out as she uses the website.

I'm not sure Lucy cares about the back-end system, but let's see. As there's only one line of space, and one point, I'd answer "A search". Although perhaps "An SQL SELECT ... WHERE search" is better?

11 Translators are used to convert high level languages into machine code. Identify each type of translator.

This translator program reports errors at the end of translation.

This translator needs to be present in memory each time the program is executed.

Compiler and Run Time. Useful to know, glad to see this is being taught.

12 A running group has 16 members. They are taking part in a marathon.

Using pseudocode or a programming language of your choice, write the code which will take in each runner’s time for the marathon.

Do I get bonus points if I write this in Assembler?

This is a slightly weird question. How are the times being entered? Should there be any error checking? Should the data be stored?

Anyway

for ($x == 0; $x <= 15; $x++)
{
   $time = get_input("Please enter the runner's time");
   insert_into_database($x, $time);
}

That'll take in 16 times and do something with them.

Writing pseudocode is a useful skill. I'd like to have seen a bit more of it in this paper. Or at least on a more challenging problem.

13 Before launching the website below, it is tested. The testers complain about the effectiveness of the website’s navigation.

Identify two examples of poor navigation, stating what could be done to improve the situation.

No worse than some of the production websites I've seen ;-) Also, no real way to know if alt tags have been used, ARIA etc.

I count...

• Nav bar at top doesn't have understandable text. Should be in English.
• Login box doesn't say what should be entered in each field. Placeholder text should say what each field is for (username, password, pin, etc).
• Down arrow has no context. Should have text explaining where it will take the user.
• Radio buttons and check boxes have inconsistent designs. Make them recognisable.
• Radio buttons and check boxes are visually indistinct. Use a unified design.

A good exercise for anyone interested in web design. Keeping a critical eye is crucial.

14 State the type of network which has no centralised storage.

Eh? What? Bit of a curve ball... Ummm.... Dare I utter the words "Blockchain"? Wait, is that technically a network? Errr... I don't know what they're getting at here. I vaguely remember network topology from university. Token Ring? Surely they're not teaching that obscure piece of tech?

I'll go out on a limb and say "Star Network". It's good to teach about different network types - but this question really needs something more to test the student's knowledge.

15 FlightCrazy is a new company offering a flight booking service to business customers. They want to set up a database to store flight details. A researcher starts to gather information from airport timetables about available flight times.

Oooh! A good clutch of Database questions.

(a) If the full database is created as a flat file, explain why “RouteID” is not a suitable primary key for the table.

Primary keys should be unique.

(b) Describe two problems in creating this as a flat file database.

Hmmm... Are they asking for problems with flat files specifically or in the way this has been created?

I'll punt with "Flat files can't be optimised for searching". And inconsistencies in naming - for example "Monday" and "Mon".

(c) FlightCrazy decide that using a flat file database is not suitable. State a more suitable type of database.

Relational? I mean, I'm guessing they don't want NoSQL?

(d) State the field type that should be used for “Aircraft Code”.

Integer... No! Wait! There are some strings in there. VARCHAR(3)? But what if later codes have more than 3 characters. Let's settle for String.

And the questions keep on coming!

(e) During the development of this database the following input form is created.

(i) State one suitable type of validation for the Departure Airport field.

I'm stumped by what they're asking here. Is it as simple as "if exists"?

(ii) Complete the table below to show suitable data values to test the Number of travellers field.

Say what now? I've never heard of exceptional and extreme data.

I assume "exceptional" means something like typing text into a numeric field.

I also assume that "extreme" means trying an SQL injection.

(f) During the testing of the completed database all the flights from Glasgow to all airports in London on the 8th June were found. The following output was produced.

Describe how the above results have been sorted.

Oooh! A good one. Naively you could say "by price" - but how are the duplicate prices sorted? It's not by airline. It's not by Journey time. It's not by Destination. It looks like it's "First by price, then by time."

Might have been a good idea to ask how the SQL query should have been formed.

And that's the end of the Database section. Some fairly good questions for a 16 year old audience there. Nothing too taxing, although I'm confused by some of the terminology (which may well be my outdated learning).

Now it gets tougher!

16 A Maths game is designed for primary school pupils to test number ordering. In the game the pupil is asked to enter two integer numbers. A third integer number is then randomly generated and shown to the user.

The user must then state if the random number is:

• lower (l) than the two entered numbers
• higher (h) than the two entered numbers
• in the middle (m) of the two entered numbers.

A design for the code is shown below.

SEND randNum TO DISPLAY
GET guess FROM (CHARACTER) KEYBOARD
IF guess = “l” AND randNum < numOne THEN
   SEND “Correct it is lower” TO DISPLAY
   SET score TO score + 1
END IF
IF guess = “m” AND randNum >= numOne AND randNum <= numTwo
   SEND “Correct it is in the middle” TO DISPLAY
   SET score TO score + 1
END IF
IF guess = “h” AND randNum > numTwo
   SEND “Correct it is higher” TO DISPLAY
   SET score TO score + 1
END IF

Youch! That's a lot more info than any previous question. Here we go!

(a) When the two numbers are entered the program should ensure that numTwo is always a higher number than numOne.

Using pseudocode or a programming language of your choice, write several lines to represent this input validation for line 2.

Hmmm... Are we assuming an integer, or something else?

IF (numTwo.type == number AND numTwo > numOne)
   (continue)
ELSE
   SEND "Second number is less than first number" TO DISPLAY

Is that enough?

(b) When the pupil enters their answer it is stored in a variable called “guess”. State the data type stored by the variable “guess”.

Again, tricky. I want to say take it in as a string, then turn into a float.

(c) The program is run with the following data. State the output from the program.

Correct. 10 is between both. Useful to see if people can step through program code.

(d) The program will have to make use of a pre-defined function.

State the pre-defined function used and describe its purpose.

The only thing I can think of is the random number generator. Am I missing something? Would we count comparison operators? Probably not.

(e) Using line numbers, describe how the code could be adapted, allowing the user to play the game 10 times using the same values for numOne and numTwo but a different random number each time.

Well, between line 2 and 3 we want to insert a WHILE loop which counts up from 0. And an incrementing counter at the end.

17 John has been asked to design a website to promote an event being held to raise money for charity.

The organisers of the event provide this diagram showing the pages required and how they should be organised.

(a) What type of navigation structure is required for the website?

Tree. I think... I've never really had to think about it.

(b) State a design notation that John could use to design the layout of the pages.

I'd usually just use path-names. Is it that simple? Or do they mean a notation like UML?

(c) The homepage contains hyperlinks. Describe the function of a hyperlink.

A communist plot by TIMBL to enslave the western world!

To be fair, you could write a decent essay on all the uses of a link - semantics, usability, data structures. But as this is a one-point question, I think they just mean "to allow a user to easily navigate to another web destination."

(d) John begins to build the website and stores all the files and resources on his hard disk. Here is the file structure for the website.

(i) State the type of data you would expect to be stored in the dance.avi file.

Bah! I hate these style of question. Besides, .AVI is such an ancient format. It's a container for video and audio.

(ii) State the relative address John should enter on the display.htm page to link to dunk.gif.

resources/dunk.gif - note the lack of / at the start. I suppose an alternative might be /activities/resources/dunk.gif. Might have been a good idea to ask why /resources.. wouldn't work.

(e) John wants to include an external link to the charity and asks the event organisers to find out the URL.

(i) Explain what is meant by an external link.

A link which will navigate the user away from the domain they are currently on.

(ii) State what the letters URL stand for.

Poor question IMO, IDK when I last needed to know what it meant.

The words "Uniform Resource Locator" is a silly phrase.

(iii) The organisers give John a photograph file from the charity which measures 5 inches by 7 inches with a resolution of 600dpi and 24-bit colour depth. Calculate the storage required for the photograph.

State your answer using appropriate units. Show all your working.

MATHS! FINALLY! Bit of a cumbersome way of phrasing it, but let's give it a go.

Total number of pixels = (5 * 600) * (7 * 600) = 12,600,000 pixels.

Total number of bits = 12600000 * 24 = 302,400,000 bits.

Bytes = 302400000 / 8 = 37,800,000B

KB = 37800000 / 1024 = 36914KB

MB = 36914 / 1024 = 36MB

I'd expect to see something here about lossy vs lossless encoding. Or why this filesize is problematic for use on the web.

18 A software development company decide to review staff knowledge of computer related legislation.

Mikal is asked to create an app covering a range of legal issues.

(a) When Mikal records an introduction using audio software, he is prompted to select the sample rate.

Select sampling rate:

• 22050 Hz
• 44100 Hz
• 96000 Hz

(i) Describe the effect on the size of the sound file if the highest sample rate is selected.

I've no idea what this has to do with legal issues. The higher the sample rate the larger the file.

(ii) After recording, Mikal exports the file as a compressed file. State a suitable standard file format he may have used.

I'd write .MP3 on here - I'd be worried that they wouldn't know what FLAC, OGG, or any other esoteric codec was.

(b) Mikal develops an interactive quiz for the app to test the staff’s knowledge of legislation. The first question is about this recent article from a newspaper.

(i) State the offence that has been committed under the Computer Misuse Act in this article.

OK! Now this is a legal issue! But which specific offence? I've no idea. I'm guessing "Unlawful access" - which is a bit question begging. I hope they're not looking for the exact reference!

(ii) Describe another offence under the terms of this Act.

Proper little Wikileaks going on here. This is taxing my knowledge. My first thought is "changing data without permission" - but that's too similar to the above. I'll go with "intentionally disrupting the performance of a computer without permission" - for example sending a DDoS.

I love that kids are being taught about the law. Excellent idea.

(c) The next question that Mikal creates for the quiz is about another article.

"A man was arrested after he cloned his neighbour's phone."

Name the law which may have been broken in this case.

WTF? OK, learning the law is good - but this isn't computer science. I've zero idea which specific law is broken.

(d) In line with Health and Safety legislation, the company provides adjustable seating and guidelines on maintaining good posture.

Mikal finds graphics on a website that he can use to illustrate his next quiz question.

(i) Explain why he might need to seek permission to use the graphics legally.

Actually, talking about posture might be good on a CS exam. Physical issues are a real pain to deal with.

Anyway, let's go with "The copyright owner of the image may sue for misuse of their intellectual property." Incidentally, I hope my critique of this paper falls under fair use!

(ii) Mikal uses the graphics to create question 3 for the app.

Question: 3 Total Score: 2

Using pseudocode or a programming language of your choice, write the code to show how the total score is calculated when the user answers question 3 correctly.

Errrr.... This is one of those questions that people complained about. How many points is each correct answer worth?

$answer3 = get_input();
if ($answer3 == "A")
   score++

(e) When the staff member takes the finished quiz, the app sends their details and their total score to a database file.

State two rights that the staff member has under the Data Protection Act with regard to their own data.

Another rapid switch! I mean, it is great that the DPA is being mentioned, but a bit weird to do it here.

I'm going with "Right to examine the data held about them" and "Right to correct any mistakes."

Blimey! Still not at the end of the paper. I'm not sure I'd have got this far in the allotted 90 minutes.

WARNING This is one of the questions which attracted a lot of complaints. See if you can work out why!

19 Gillian designs a program to calculate how much it costs to get her dog Penny groomed. The design is shown below.

SET total = 0
DECLARE all costs INITIALLY [35.00, 36.00, 40.00,35.00,42.50]
FOR EACH cost FROM all costs DUE
   SET total=total+cost
END FOR EACH
SEND “The total cost = £“&total TO DISPLAY

OK, that program is a bit weird - but it is pseudocode, we don't expect syntactic brilliance.

(a) Describe the data structure that has been used to store the individual costs.

It's an array.

(b) Gillian writes and tests her program. It works perfectly calculating a correct total of 188.50.

(i) With reference to line numbers, explain how the program calculates the final total.

Line 1 initialises a variable and sets it to zero. Line 3 loops through the array of costs and adds each to the variable.

There are three points available, so I think I've missed something.

(ii) Describe how the contents of the variable total would be stored in the computer’s memory.

WHAT? I don't care! I'll let the compiler take care of that. It is good to get some low-level stuff in the exam. For two points, I'm guessing... "A block of memory of a specific size is reserved for the variable."

(iii) Gillian edits the program with the following data: [35.00,36.00,40.00,35.00,42.50,45.00]

The output is still 188.50.

A Explain why the output is still 188.50.

B State how this error could be corrected.

Debugging is a vital skill - but I really can't see what's going wrong here. Perhaps DUE should be DO? I don't know.

(c) Concatenation has been used in line 6. State the purpose of concatenation.

It... it sticks strings together...? Err... Let's try "It allows a variable to inserted into a string which can then be displayed."

20 Sue uses a website called “Check your Defences!” to learn more about keeping her computer and data safe.

aside I totally love the retro browser screenshot!

(a) Explain the purpose of a firewall.

Keep the Wildlings out of King's Landing? No! That's an ice wall.

A firewall detects whether a connection to or from the network is authorised.

(b) Explain how encryption can help keep data safe.

More Wikileaks! Encryption ensures that only people with the decryption key will be able to view the data. Modern encryption is resistant to brute-force attacks.

I'd have expected a bit more of a technical question - this seems rather basic.

When Sue tries to download the mobile app onto her tablet PC, she gets the following message:

"This app is incompatible with your device - Check your Defences!

System requirements Android 4∙4 or higher, 1∙6 Ghz, 2Gb RAM, 32Gb"

(Gb? Gigabits? A genuine mistake, or designed to trip us up.)

She checks the specification for her tablet PC.

• Size: 267 x 187 x 8 mm
• Weight: 65 kg
• 1∙83Ghz/2GB RAM/16GB
• Battery life: up to 8 hours
• Display: 8∙3” full HD, 10 point multi-touch
• Operating system: Android 4∙1
• USB 3, micro HDMI, microSD card slot 3∙5 MP camera
• Microphone
• Stereo speakers
• Headphone jack
• Wi-Fi

(WHOA! A 65KG tablet. Not exactly portable!)

(c) (i) Sue’s tablet has a range of input and output devices. Identify one of each of these items on Sue’s tablet.

Inputs could be the touch screen, the camera, the mic. Theoretically you could transmit some data back via HDMI, but I would class that as a "showing off" answer. Outputs are the display, the speakers, the headphone jack.

This is back to the basic ICT questions which I hoped we'd left behind. Not very encouraging.

(ii) Identify one interface type on Sue’s tablet.

Again, I'm left in confusion as to what's being asked here. The Universal Serial Bus is an interface - but so is the touch screen...

(iii) Describe one function of an interface.

What? This seems poorly worded. I think they want me to say "To allow data to be exchanged from one device to another."

(iv) Give two reasons why the app is incompatible with Sue’s tablet PC.

Her tablet has a lower version of the operating system. I assume that the 32Gb on the requirements means storage space - but her tablet has 16GB. To my mind sixteen gigabytes is a lot more than 32 gigabits... But I think I'd take a punt and assume there's a mistake in the question.

(d) Sue’s friend Jack views the website on his smart phone but the home screen looks different to the desktop version Sue had been using.

Describe one reason why the user interface on the smartphone version is designed differently to the version Sue had used on her desktop.

There's only one point on offer here. Pity, this would be an excellent chance to write about progressive enhancement, media queries, responsive design.

I'll stick with "Mobile users interact using a finger, this is a less precise interaction than using a mouse, so link targets should be bigger."

LAST QUESTION ALERT!

21 A software developer is creating an online booking system for a bowling alley. Customers can book a bowling lane for a maximum of 4 people playing a maximum of 3 games.

The developer has used a flow chart to produce the program design. Part of the design is shown below.

a) (i) State one benefit of using the design notation shown above instead of pseudocode.

Flowcharts! Yay! I might be going delirious at this point...

"Flowcharts allow people to easily visualise how a program works and, hopefully, spot any mistakes."

(ii) Name the algorithm illustrated in the bowling alley program design.

Grrr... More trivia! And, frankly, it is hardly an algorithm. Frankly, I've no idea what they want as an answer. Nor why it is relevant.

Using pseudocode or a programming language of your choice, complete the conditional statement at Line 3 below to implement this section of the design.

__________  numPlayers __________  and numGames  _______
SEND “Booking Accepted” TO DISPLAY

This is VERY CONFUSING!

Perhaps IF numbPlayers <= 4 and numGames <= 3?

(c) The program is tested using a set of test data.

(i) Complete the table below to show three examples of test data types and the expected result for each type.

ARGH! Back to testing. I mean, yay testing, but what are the test data types again? Extreme and Abnormal?

The last one has a result of Booking rejected. But I've no idea what the data types are. I'm guessing "normal" and "abnormal"?

(ii) The character “£” is entered as a test value for the number of players. This causes the program to crash. State the type of error that would cause this crash.

Depends on the language. I'd say "Type exception" maybe "Cast exception"?

(d) Error detection and correction in a program is easier if the code is readable. State one technique that can be used to ensure readability of code.

And we're back where we started! I'd go with "Clear variable names which don't use abbreviations." I wonder if they'd value an extended discourse on tabs vs spaces?

And Breathe!

That was a lot tougher than I expected. I wasn't doing it in exam conditions, but I felt the pressure.

The obvious mistakes didn't help my nerves but, guess what, the real world isn't perfect either. Computer Science is the art of trying to fit the messy analogue world into a pure state of binary bliss.

Conclusion

I think that's a pretty good computer science paper - especially for students who may only have studied it for a couple of years.

I think it leans slightly too far towards ICT but I'm pleased with the mentions of usability, good design, security, and the law.

There are a few "Trivia" questions. The "What is this thing called" style - I'm not a big fan of them. Far better to test the understanding of the design, not the name. Similarly, the legal questions veer into the obscure.

Some of the technology is a little out of date - but it's such a fast moving space, talking about file-formats which have only recently become popular might disadvantage people without the time to keep up.

So, are the mistakes "a disgrace"?

There should be spaces between array elements - but part of computer science is reading poorly written code.

Some of the pseudocode is typed incorrectly - but that's the nature of pseudocode.

The unit confusion is annoying, and could trip up someone with an eye for detail. That's a shame, but not a showstopper.

I'm not a teacher - and I have no idea what is on the syllabus. All that said, I've met Computer Science graduates who would struggle with some aspects of this paper.

I think us geeks often over-estimate how much we knew when we were kids. When I was 16, I thought I was 1337 (back when that meant something). I wasn't. I couldn't have passed a paper of similar complexity.

I think this represents an excellent foundation for anyone wanting to studying computing.

My Score

You can read the marking instructions online as a PDF

I scored... 59/90. Yikes!

Most of the dropped points were where I over-thought the question, and a few where I was missing basic knowledge (mantissa!). Perhaps I'd have picked up a few points if the marker knew the subject well.

Some, I just screwed up the answers. I wasn't specific enough in saying that the database results had been sorted in descending order.

Based on the published grade boundaries, I think I just about scraped an A.

How did you do?

A few years ago I got the Chinese domain name 莎士比亚.org. You can browse to it, link to it, and send email to it. Or can you?

When I tried two years ago, none of the major email providers supported sending to non-ASCII email addresses.

Today, I tried again with six of the big "Western" webmail providers. How did they do?

Show Me The Data!

I tested by trying to send an email to test@莎士比亚.org and the Punycode representation test@xn--jlq54w7ypemw.org

Winners!

Both Gmail and Outlook failed the last time I tried them - I'm very pleased to say that both of them now support sending to Chinese addresses.

One strange thing to note, when looking through Outlook's message details, I found this example of Mojibake.

Losers!

Yahoo

The biggest loser is Yahoo. Very strange considering Jerry Yang, their founder, is Taiwanese-American. Even stranger given Yahoo's continued dealings with China.

The Yahoo webmail portal simply wouldn't let me send to a Chinese domain name.

The Punycode representation appeared to send but immediately failed.

iCloud

Apple's much-vaunted "It Just Works" philosophy obviously doesn't extend to International email addresses. It accepted the Punycode but gave this delightful error message on the Chinese domain.

OWA

Microsoft's Outlook Web Access got very confused and tried to look up the email address in the local directory.

Errr?

⭐ FastMail

Lots of people recommended that I try Fastmail - it really didn't like the look of the Chinese domain and painted it with a red error colour. That said, it sent the email without further complaint.

What about a Chinese Local-Part?

Email is a venerable protocol. That's a polite way of saying it is old and outdated. The local-part of the email address (test@) is generally restricted to a handful of 7 Bit ASCII characters. None of the email providers I tried would let me sign up with a Chinese name. So no 你好@yahoo.com for me!

But what happens if you're foolish enough to try to send an email to 你好@莎士比亚.org?

Well you'll probably get this error message:

In 2012, RFC 6531 defined how International Email Addresses should work. Over four years later and support is still not widespread.

It's 2016 and the majority of the world can't send an email to their preferred name.

As a first-time user, I want to log in with Facebook, so that I don't have to set up a new account.

Fairly easy, right? Stick enough of those up on a wall and you've got yourself a party!

If you've ever played an RPG or Roguelike game, you'll be familiar with how your character can evolve throughout a game.

You put on a cursed ring! Your attacks now do 10% less damage!

(A typical debuff)

So, let's apply a little video-game learning to our user centred design.

I've written previously about drunken user testing - being sloshed is a temporary physiological and neurological impairment. One that may affect the majority of your users. I remember trying to order a Chinese takeaway using an app while inebriated - it didn't end well!

Now, you wouldn't necessarily rewrite all your stories with "As a ^drunk user, I..." but it is certainly worth scribbling out a few stickers which you can overlay on existing stories. How do you change your design and your code if you assume the user is a lush?

There's a serious point here (somewhere). Minority users often have exactly the same desires as majority users - but they may need a different way to achieve them.

For example, a blind user will almost certainly want to use the full functionality of your site. Is it enough to just have one user story saying:

As a blind user, I want the site to comply with accessibility best practices, so that I can use it effectively.

I don't think so. I mean, it is better than nothing, but almost every story should be tested against a variety of variables.

Of course, just as in video games, sometimes our users receive a little boost - an Enchantment - which makes them better able to perform some tasks. How should we cope with users who are better than we are at using our system?

Finally, Equipment. Some of you are reading this blog post using an extremely expensive, high powered computer, with a massive screen and jiggaflops of RAM - others are having bytes transmitted via carrier-pigeon and carved into a potato.

I've quickly jotted down some typical amendments which can be applied to most user stories.

(Feel free to argue about exactly where each of those item should go - you get the general idea.)

If you're playing a game and are armed with only a cursed wooden spoon and flammable armour, it is unlikely you'll beat the dungeon's dragon boss. Similarly, a tired user with Parkinson's and an old BlackBerry running on 2G, may find using our service difficult.

Think about what attributes you can add to your user stories. Randomly sprinkle them through your design process. Help developers and designers understand that there's no such thing as a typical user.

Addendum

This discussion was sparked off at a design day. A very lovely agency had written out some lovely user profiles for us. You know the sort "Dave, 35, busy juggling 3 kids and love of golf" and "Denise, 22, wants to keep up with technology" that kind of thing.

They seemed rather put out when I started adding my own notes to them. Little speech bubbles saying:

• I am secretly gay.
• I am drowning in debt.
• I am a victim of domestic violence.
• I am wanted by the police.
• I am embezzling money.
• I am getting a divorce.
• I am a social media troll.
• I have PTSD.

Not things which normally go on to a persona - but real problems which affect a lot of our users. We can't assume everyone who interacts with our stuff is happy, healthy, and honest.

Some of our personas should reflect the ugly reality of humanity:

As a racist, I want to be able to send offensive messages, so that I can assert my dominance.

How do we cater for these stories? I don't mean "how do we make a racist social network?" but rather "how do we minimise the harm from or to this sort of user?"

I'm not trying to criticise User Stories - I'm saying that we should consider that a typical user gets tired, has low battery, may want to hide an aspect of themselves, needs some protecting, and often changes throughout the course of the day.

So, Product Owners, it is time to level up! Or, as I prefer to say, +1 to inclusiveness.

In order to co-ordinate things better, we'd like to invite you to our exclusive Slack Channel!

A variety of rude words danced around my brain. I think this makes the, what, 9th? 10th? Slack that I'm part of.

Don't get me wrong, I like Slack as a service - but it only really works if you have One Slack Team To Rule Them All.

I've just got a new tablet - so I need to sign in to Slack TEN TIMES! How is that an acceptable user experience?

Oh, and then I have to do it all over again on my phone.

Terence Eden is on Mastodon

@edent

Replying to @edent@SlackHQ I've been invited to a new Slack. How do I automatically sign in on my laptop, phone, & tablet?

---

Slack

@SlackHQ

Replying to @edent@edent You'll have to sign in on each one Terence! Sorry for the trouble.

---

sigh fine. Whatever.

So I go to sign in. I have to give an email address - I can't use one of the half-dozen social sign-in providers I use. That also means I have to give my first and last name, and a preferred username. Tiresome.

I have to set a new avatar image - because it's not picking up from my Twitter, Skype, Facebook, etc.

And then, to add insult to injury, I have to change the default timezone - because not everyone lives in California.

This is a scaling issue. Each time I get a new device (a few times a year) I have to go through this time-consuming and annoying rigmarole. Each time I get invited to a new Slack (hey, I'm a popular guy!) I have to faff around setting it up, configuring it, and maintaining it.

Look, I get that some Slack Teams need 2FA and all sorts of custom stuff - but why should I as a user care about that?

I want:

• One Slack account - which has my avatar, timezone, username, preferences, teams, and so on.
• errr...
• ... nope, that'll do.

Sure, if my Top Secret Slack imposes extra security requirements on me - present them when I sign in to my account. Or let me have a separate password. Or mandate 2FA for everything. I don't care. I'm just tired of feeling dread whenever I think about joining a new Slack team or setting up a new device.

I'm only human.

There was the .com and the .org and the .net and it was good.

And, I mean, there were probably a few others - but that's all people cared about.

Go Forth And Multiply

And THE LORD sayeth "Hey, do people want country codes? Like .UK, .FR, .DE?"

And the people were all like "Duh! Yeah!"

Except for the people of the American United States. For they gnashed their teeth and wailed "We invented the Internet. There's no way we are going to use .US. We'll take the top level, thanks."

And many did wonder if they should have let them have .USAUSAUSA!

The Descent Into Madness

And some people were not satisfied. And lo! They asked for more domains and THE LORD shrugged and said "Eh. Sure. Why not?"

And thus .mobi and .biz and .tel and their brethren were born. Yet no one used them. Dust returned to the land. Still the people cried out for more.

The End Of Days

In that time, a certain man was heard to say "Wouldn't it be cool if we could have .Nokia? Or, like, any top level domain we wanted?"

The wise elders spat on the ground and sang as one "That is the dumbest idea that we ever heard. Literally, what is the point?"

But the people of the valley were vain, and each man wanted his own top level domain.

So rang out the cry "Open up your wallets and prepare to have them emptied."

And the people of the valley emptied their wallets. And it was bad.

The Great Confusion

In the great accounting house, a young scribe grew weary. "Why do I not have a domain, oh Lord?" he prayed.

And THE LORD appeared in front of him in the vision of a burning bunch of pink-carbon-paper which really should have gone to Janice in Accounts-Receivable last week.

"ALL COUNTERS OF MONEY SHALL HAVE A DOMAIN!"

And so it was that the young man was asked if he wanted a .accountant domain managed by Famous Four Media Limited, or if he would prefer an almost identical but subtly different .accountants domain managed by Donuts Inc.

The boy trembled. "How am I to tell the difference, oh Lord? Won't there be a confusion upon the land?"

"THAT'S A GOOD POINT. YOU'D BETTER BUY BOTH JUST TO BE ON THE SAFE SIDE." And THE LORD did vanish.

And their was much confusion.

How Much Confusion?

(I've stopped writing in that spoof-Biblical style now)

Take a look at the latest list of top level domains.

Here are all the domains which I think are easily confusable - or seemingly duplicates. Some are brand new, some are not.

• .accountant
• .accountants
• .chanel
• .channel (As in "TV Channel" not the French Fashion House)
• .fan
• .fans
• .game
• .games
• .loan
• .loans
• .market
• .markets
• .mobi
• .mobily (Completely unrelated, but quite similar)
• .onl
• .online (seriously, .onl's advert says "As short and catchy as .com - As universal and practical as .online"!)
• .paris
• .pars (An easy typo to make)
• .photo
• .photography
• .photos
• .prod
• .productions
• .review
• .reviews
• .sex
• .sexy
• .tech
• .technology (Again, separate companies managing these similar domains)
• .theatre
• .theater (OK, the Yanks and the Brits spell this differently!)
• .tkmaxx
• .tjmaxx (These are both the same store group, but it's called TK Maxx in the UK to avoid confusion with the similarly names TJ Hughes)
• .watch
• .watches
• .win
• .wine
• .vin (This is a controversial issue in the wine world)
• .work
• .works

I'm sure there are a few I've missed - but that's already a huge scope for confusion, impersonation, and duplication.

To be fair, some of the domains will only allow registration from authorised parties. So you won't be able to register "Clippy.microsoft" - unless you work there.

Oh, and my favourite?

.zip

Because it will be the cause of great parsing confusion.

Terence Eden is on Mastodon

@edent

Grrr... Because .zip is a valid TLD, it's impossible to know whether example.zip should be a URL or a filename.

---

The Internet is broken - let's throw it out and start again.

This morning, I was confronted with a rather bemusing error message on my WordPress blog:

Ok, so this should "never happen" and yet somehow it has. I wonder what on earth the error code means? I selected the error code and Googled it!

I just copied and pasted the error message into Google and got back a set of meaningless results. Why?

Most search engines treat the minus sign as an "excludes" operator. Suppose I want to search for information about the Python programming language, but I don't want any results about snakes; Google lets me search for "python -snake".

In this case, Google is searching for every error code except for the one I want!

If we remove the - sign, the correct results are returned.

I've raised this as an issue with the software.

Remember, your error messages should be meaningful to the user. It should contain a clear explanation of what has happened and how the problem can be fixed. It should also be easy to search for information about the error. This message, sadly, fails at all three of those reasonable objectives.

sigh Annoying but probably necessary.

The problem was, every time I tried to change my password, it told me that my old password was invalid. The one that I'd just used to log in. I use the incredible LastPass Password Manager - so I knew I wasn't typing it incorrectly.

It took a few tries, but I finally figured out what was going wrong. When I'd set up the account, LastPass had generated a secure 32 character password. But the "old password" field had artificially restricted passwords to a maximum of 20 characters.

Well, that's easy enough to change! Crack open Firefox's Inspect Element tool, change the maxlength value, and submit again.

What utter cockwombles.

Can you see any mention of a maximum length in the password rules? Minimum, sure, but no max.

Naturally, this 20 character restriction isn't enforced on the login page.

Take a bow, "Willis Towers Watson", your web developers are actively making the world a worse place. I'd ring you up to complain, but naturally you're closed on a Sunday.

I found a curious case where some WebP images are rendered upside down!

On the left is Opera for Android, centre is Chrome for Android, and on the right is Firefox for Android. Firefox is the only one which renders the lower image correctly. The upper image is also WebP.

This also seems to affect iOS.

Terence Eden is on Mastodon

@edent

Replying to @paulglavin@paulglavin so I'm not seeing things? That's good to know. Any chance of a screenshot?

---

Paul Glavin

@paulglavin

Replying to @edent@edent I can't guarantee you're not seeing things! pic.x.com/o48z3ywmlq

---

The original article has since replaced the WebP images with standard JPGs - but I managed to grab one of the images before they were removed.

(Photo via David Wilfert)

I'm not sure if my Android phone has somehow mangled the file when it was saved, or whether the image was like that to start with.

There are, I suppose, three possibilities.

1. Both iOS and Android have a bug with rendering some WebP images.
2. Buzzfeed's CDN has a bug which rotates some WebPs - and doesn't serve them to Firefox due to lack of support.
3. A collective hallucination.

For now, I'm tempted to put the blame on a buggy image conversion - that seems to be the simplest explanation. Either way, a salutary reminder to check your content in several different browsers.

I am a Grade A+, certified, undeniable plonker.

The man in the hire car office looked at me with barely concealed contempt. Fair, really. He'd asked for my Driver's Licence and I'd collapsed to my knees at the sudden realisation that the slim plastic card was 1,700 miles away from the Canary Islands.

"I am sorry sir, but there is really nothing I can do."

My wife was hobbling around on crutches due to a sprained ankle and we were staying in a villa literally off the beaten track. A week of getting taxis everywhere would be expensive - assuming they could even find our lodgings!

Then, inspiration struck! I remembered that as part of the changes to the UK Driving Licence, the DVLA had created an online portal to allow you to share your licence information with hire car companies.

I ran to the only spot in the villa with WiFi, connected my phone, and hurriedly entered my information into https://www.gov.uk/view-driving-licence and was instantly rewarded with...

A blessed PDF containing all my information and a code with which to view the information online.

Would that be enough? My wife - who is far more intelligent, practical, and resourceful than I - suggested that I check directly with the hire car company's head office.

Woo!

Yet, another taxi back to the airport. The gruff gentleman had been replaced with an amiable woman who, on presentation of my credentials sadly sighed and said "Ah, no. It is impossible. Full licence only."

I pleaded with her and showed the email from her HQ. She sighed again and dialled the phone. There was a period of intensely fast Spanish, some of it shouted. It culminated with "¿Si? ¿En serio? ¿Si? ¿Estás seguro? OK!"

She put down the phone, looked me in the eye, and said "The British are very strange. Everything on the Internet!" She duly took down my details, photocopied my phone, and handed me the keys to a turquoise Citroen.

So, a million thanks to the digital elves at DVLA. Their dedication to making the UK a leader in online infrastructure provided me with tangible help when I needed it most.

Take a look...

This is Google's default logo on its regular grey background.

The contrast ratio between the yellow and grey is 1.50. That fails to meet current accessibility guidelines.

This is just awful - I find it quite hard to read, especially for long passages. The text seems to shimmer about the background.

The logo is also often found on a pure white background with similarly poor results.

Against white, it is somewhat more readable - but it's nowhere near to a suitable contrast ratio

According to Google's own guidelines:

Text should maintain a minimum contrast ratio of at least 4.5:1 (calculated based on luminance values) for legibility. A ratio of 7:1 is preferred.

Material Design - Typography

Don't get me wrong, it could be a lot worse! But it really is unfortunate that their logo contains a central character which is so out of kilter with the background that it becomes a distraction.

The realization of the new identity required the collective work and diligence of hundreds of Googlers, in different roles, spanning the entire organization.

Evolving the Google Identity

Sadly, it would seem, none from the accessibility department.

For example, suppose you don't need to include the русский алфавит - you can immediately drop 66 letters (upper- and lower-case), a whole load of accents, and a bunch of other Cyrillic stuff. That's up to 400 fewer characters - a huge space saving.

Here's how the Font Squirrel Webfont Generator handles subsetting:

Depending on the font you start with and the characters you anticipate you'll need, you can easily optimize your webfont size more than any Brotli compression could hope to manage.

Now, what do all good computer programmers know about Premature Optimization?

So, some clever web designers have realised that they can eke out a few more microseconds of performance if they drop all of the weird characters from their fancy web fonts and stick to good ol' fashioned US-ASCII.

Which has this unfortunate side effect.

As you can see from these two examples, there's a designer somewhere wailing and gnashing their teeth at the sight of these abominations. All that hard work - and cost - of choosing the right font ruined, because someone thought they'd drop support for European accents.

Is this worth it? Let's take a look at the New Athena Unicode font as a good example.

New Athena Unicode is a freeware multilingual font distributed by the American Philological Association. It follows the latest version of the Unicode standard and includes characters for English and Western European languages, polytonic Greek, Coptic, Old Italic, and Demotic Egyptian (and Arabic) transliteration, as well as metrical symbols and other characters used by classical scholars.

The font contains 1825 glyphs - the TTF is 690KB. Once converted into the heavily compressed WOFF2 format, it's 149KB. Using the FontSquirrel subsetter to get just the common English language characters results in a WOFF2 font of 17KB. Tiny!

Ok, that's a pretty decent chunk saved - but at the expense of the most European languages. Adding back in French, German, Italian, Polish, and the Latin set takes the font up to 35KB. Yes, the size has doubled - but I'd argue it's now several times more useful

Be smart. Do you really need extended punctuation like ‰‱′″‴‵‶‷‸‹››※‼‽‾‿⁀⁁⁂⁃⁄⁅⁆⁇⁈⁉⁊⁋⁌⁍⁎⁏⁐⁑⁒⁓⁔⁕⁖⁗⁘⁙⁚⁛⁜?

No, probably not. Strip it out. But take a look at what you do use. There's no "correct" answer for this, by the way. If you're confident that your reporters are never going to interview someone with a Polish name - leave out those letters. Or, have your database regenerate fonts on the fly when it receives a previously unseen character.

But please don't pretend that these "unusual" characters don't exist! You're publishing on the World Wide Web - act like it.

It's hard wandering around seeing the mistakes which are made by designers. Perhaps it's poor keming on fonts, or a hotel room light switch which makes no sense, or - in my case - bogs.

Lots of toilets incorporate a "dual flush." Press one button to unleash a deluge sufficient to sink all but the hardiest of bowel-movements, press a different button to release a trickle designed to gently dilute the user's micturations.

I've often visited lavatories where I was unsure of which button to press - but I think this is the first time I found a toilet which blocked its own buttons!

The only way to access the buttons is to manhandle the toilet seat, or attempt to curve your fingers as to avoid touching the filthy thing.

But wait! There's more! As all Usability Experts™ know - a sign is an admission that you've failed to create something intuitive. Let's take a closer look.

It would appear that there really is no need for two buttons. Neither works by itself - the only way to flush is to simultaneously depress both. Not quite practical with one hand.

Here's how a sensible loo would work.

• Finish the shameful business in hand.
• Rotate body.
• Use finger of one hand to depress button.

Here's how this crapper works.

• Contemplate what it's like cleaning peanut butter out of a thick pile carpet.
• Rotate body.
• Read sign.
• Close lid.
• Use both hands to activate dual button flushing system.

What a palaver, eh? Nul points!

In this clip from "Back To The Future" we get a brief glimpse at the controls for setting the destination date:

Ok, we can forgive Brown for not sticking to ISO-8601 - that is the eminently sensible Year-Month-Day-Hours-Minutes-Seconds format - the standard was finalised in 1988, a few years after he allegedly built his time machine.

But why are the "Destination Time" LEDs red - the universal colour for stop/warning? The "Present Time" LEDs are green - not great for men with colour-blindness.

AM/PM are positioned before the hour marker. WTF?

Generally speaking, humans read top-to-bottom. So having the "Destination Time" label in the middle of two displays could prove confusing.

There appears to be no "Seconds" setting - is this level of precision acceptable?

Let's move on and take a look at the sequel - the imaginatively named "Back To The Future Part 2":

OMG! In this latest revision, the AM/PM labels have swapped position!

It's unclear if this is a conscious design choice, or whether the labels have fallen off and been carelessly repositioned. This could lead to the unwary user arriving 12 hours before or after they expect. That is not a great user experience!

Finally, let's take a look at Part 3

Well isn't this just fanfuckingtastic!? The AM/PM has switched again! What utter contempt the designers are showing for their user.

It's obvious that the LED lighting isn't sufficient for either use in bright sunshine - or for viewing from the driver's position.

The label is "Departed Time" - rather than "Time Departed" which would keep it consistent with the other two labels.

And, if that weren't bad enough - take a look at the "Month" section. Yup, it has gone from being JAN/FEB/MAR etc - to a two digit representation!

Oh, and apparently, there's no support for TimeZones. FFS...

Seriously, if you are planning on designing a time machine, please don't take any advice from this nutcase!

I've been using Android - Google's mobile OS - it since before it was launched. I now love and loath it in equal measure.

Consider the simple act of sharing a piece of content. A fairly common activity which the OS should be able to handle in a standard manner. Yet Google's own apps each have a radically different way of completing this basic task.

Let's take a look at the latest versions of Play, Maps, YouTube, Chrome, Google+, and Docs - all running on Lollipop.

1. Google Play, has the normal Share Icon.
2. Google Maps hides the option in a menu.
3. YouTube has two share buttons, neither of which look like the one in Play.
   
4. Chrome hides the option in a dropdown (weird how it floats over the menu button, unlike Maps).
5. Google+ takes us back to the regular share icon (with no text label).
6. Google Docs uses a floating bottom menu (what?!) with a yet another icon and a "Send file" text label.

That's at least 6 different ways to share content in Google's official Android apps. There may be more, but those are the only ones installed on my phone.

Ok, so we've decided to share some content in a standard Google app. What does the share menu look like?

1. Play has a simple list of sharing destinations at the bottom.
2. Maps has a big grid of sharing destinations.
3. YouTube has a different grid with even larger icons - three of which are set off from the rest with no explanation. Oh, and a "Copy URL" button in the top right.
   
4. Chrome has a pop-up over the centre of the screen - the icons are yet another different size.
5. Google+ only lets you share with other G+ users. Bless!
6. Finally, Drive takes us back to the bottom menu style.

Bonus points to anyone who can figure out the order of the sharing options. It's neither alphabetical nor usage based.

I can't keep up with this. I'm trying, I really am, but every time I try to share something I just don't know what I'm going to be faced with. And, even when I can figure out where the share button is hidden - there's no easy way to find the app to which I want to share.

sigh

There have been many attempts to standardise a sharing icon - but none of them have succeeded.

Google does not define a sharing icon in its Material Design guide. Its teams seem free to pick and choose any one they like - or ignore it all together.

This mishmash approach to Android has been festering for years. Three years ago, I was blogging about Google's constantly shifting menu button - something they've nearly fixed!

Remember, these aren't independent developers re-inventing the wheel. These are flagship apps produced by one company. It's clear there's no-one at Google responsible for consistency or user-experience across their services.

Android is a runaway success - that's clear - and fiddling round the edges is unlikely to dramatically change its trajectory.

And yet... These little irritations begin to grate until they build up into an overwhelming torrent of confusion - just as they did for Symbian and BlackBerry. As it gets more complicated to perform everyday tasks on Android, people will look for a device which values simplicity and consistency. Google desperately needs to avoid sharing the same fate as those moribund platforms.

He has a set of Lifx Internet Controlled Lightbulbs. They're great fun, but have some seriously screwy ideas about how people live. One key design of the app is to allow you to automatically switch off all your lights when you exit your house. That's pretty nifty, right?

I am still chuckling at the mental image of all the lightbulbs in my house shutting down when I leave the house leaving my wife and kids to complete their morning routine in darkness.

Ah. Yes. Family. People tend to acquire partners. Occasionally smaller people spring out of nowhere. Sometimes it's just the humble housemate stealing your dishes sharing your living space.

According to the UK's Office of National Statistics - only 28% of households contain a single occupant. The majority of people live with other people. Hell, I suspect a fair few of those single households have occasional visitors and overnight guests.

So, why do so many apps and services seem to be utterly hostile to their users' diverse lifestyles?

Pause The TV When I Receive A Phone Call

I use the Yatse Remote Control App for Android. It has a really useful plugin which pauses whatever I'm watching when I receive a phone call. It even displays the name of the person who is calling on the TV.

This makes a fairly radical assumption: When the TV is being watched, it is only ever me watching it.

Take the following scenario. I'm busy cooking up some spicy vegetarian curry in the kitchen. My wife, after a hard day's work, is watching Game of Thrones in the lounge. Suddenly, I receive an urgent call from work! Now, my wife's viewing pleasure is interrupted and she has to scrabble for the remote control before she can watch watch more beheadings.

How can we fix this? Do we need some complicated pop-up which asks every time the TV is on who is watching it? Should I set up a webcam with facial recognition to detect who is staring at the goggle-box? Maybe we can change add an option to the phone screen which says "Answer and Pause"? Could I use Bluetooth proximity beacons to work out which room my phone is in? What if the phone's microphone listens out for the TV? How about... How about... How about...

There is no perfect solution to this. It requires a degree of subtly which simply isn't quite feasible yet. Users demand a near-human level of empathy and understanding; "know what I need without me having to interact".

This problem is not solvable. Not yet.

We're at a near-future inflection point where we can see what will be possible, but hate that it is not.

Dan is absolutely right. We need to design services which account for mixed households, dodgy WiFi connections, visitors to the house, emergencies, delusions, and mistakes.

As users, we have to realise that our devices aren't sentient. There's no point in getting annoyed with an app for failing to "Do what I mean - not what I say!"

The future is coming slowly. Before too long we'll just assume that our phones will automatically ignore phone calls when the TV is showing the final of the Great British Bake Off - and that our lightbulbs will keep track of how many people are in each room.

For now, though, we have to sigh and make to with this wondrous technology which isn't quite good enough. Humans, eh? We're picky bastards.

Here's a quick run-down of its features.

HTML5

A fairly miserable score of 268 out of 555 points on http://html5test.com/ The screen is 1280*480 with good visibility. It's slow to scroll and, even with the touchpad controller, a pain to navigate.

User Agent

It reports as this unholy mess. Chrome 15 on Windows XP. Helpful! Oh, the IP address is in Germany because - I presume - that's where BMW's proxy is. Connectivity is provided by Vodafone's 3G network.

Security

The browser kept popping up with this certificate error. I'm not sure if it's the proxy, or the browser which is causing the failure to validate certificates.

Options

There is an options menu. Cookies are blocked by default, there's a flash player! Flash! In the car! I ticked the "sound" option and visited an HTML5 sound test page. MP3 is supported. Impressively, so are Ogg and WebM!

Video

Some HTML5 video is supported - although playback is a bit jerky. Audio support is variable.

So, let's try out YouTube - the biggest video site on the planet!

Well, that's underwhelming. I wonder what is up with the Flash player on this thing.

A quick (slow) visit to Adobe shows us part of the problem -

An ancient Flash version. Which means you can expect to see a lot of things like:

Tabs

One thing that surprised me was the ability to have multiple tabs. Considering how slow the browser is, it's useful to load up a site in one, then read another tab while waiting for it to load.

Open too many tabs (3 in this case) and you get this somewhat confusing error message.

There's no obvious way to close a tab...

You can always go into your history to see what you were reading before the browser flamed out.

Headers and Proxy

A fairly sparse set of headers are sent by the UA.

The proxy is by M-Way Solutions. I'm not sure if it's the proxy, or Vodafone, but there is some severe picture compression going on:

Rendering

For regular web pages, the rendering is competent - if slow. Here's my blog:

CSS rounded corner and webfonts all work.

But there is a glaring omission. The Unicode support from the browser is atrocious. Want to view Emoji? This is what you'll see -

☹

Overall

This is a shitty browser. It's slow - and that's not the fault of the 3G network - rendering takes forever, scrolling is awkward, mouse pointer precision is poor, and has limited support for modern web technologies. Along with the frequent SSL certificate warnings, the UA is probably vulnerable to modern attacks.

If you want to pay £95 per year to browse the web while sat in a motorway service station, I suggest you buy a cheap Android tablet and a PAYG SIM. Browsing will be a lot less frustrating, and you won't have to put up with seeing this error message constantly.

But, apart from that, the i3 is a great car!

Four years ago, I got the latest Evoluent Vertical Mouse. It's a great device, but it's starting to show its age a bit.

So, time for a new model. I'm doing a lot of travelling, so a wireless mouse is a must. Sadly, the Evoluent Wireless Mouse is £75. As good as their mice are, I wanted something cheaper - so I wouldn't feel terrible if I lost it or got damaged.

At around £25, the ZeleSouris looks like just the job. It's vertical, wireless, and has thumb buttons.

The ZeleSouris is incredibly light with well placed buttons for larger hands. I found the middle click button to be slightly stiff, but I'm sure I'll get used to it.

As a vertical mouse, it does its job admirably - and at a very reasonable price.

It has an integrated wrist rest - which is detachable. Personally, I find it comfortable. I also like the plastic ridging on the side - makes it a lot easier to grip than the smooth Evoluent.

Talking of the Evoluent, the ZeleSouris is roughly the same size:

The mouse works flawlessly - I plugged the dongle in to a Linux machine and it just worked. I assume it will also work on Mac and Windows.

The only downside is that the dongle doesn't use BlueTooth. Instead, you get

Although the dongle doesn't jut out too far from a laptop, it seems daft not to use BlueTooth - especially given that every computer and phone now has it built in. It also means you don't get to monitor the battery life - and it introduces some (theoretical) eavesdropping concerns.

The dongle has a little carrying hole in the bottom of the mouse - it's not spring loaded, but it's tight enough that it won't accidentally drop out.

Let's take a look at the bottom of the mouse:

The battery compartment takes 2 AAA batteries - which are included).

There's a an on/off switch. Not too fiddly - but I think it could have been placed on the top of the mouse rather than the seldom-used DPI button.

The DPI button on the top should change the speed at which the mouse moves. On the Evoluent, it's really noticeable. On the ZeleSouris, it doesn't seem to make much difference. There's no status LED to tell you which setting it is on.

As a minor point of interest, the mouse is actually a re-badged Delux DLM-618 if you're looking for alternate reviews.

Linux Button Remapping

A quick lsusb gives the device ID of 279e:024e.

By default, the button mapping is:

1   Left Click (Index Finger)
2   Middle Click (Middle Finger)
3   Right Click (Ring Finger)
...
8   Bottom Thumb
9   Top Thumb

Running xinput list shows that the wireless adapter registers as both a keyboard and a mouse. Very odd!

⎡ Virtual core pointer                      id=2    [master pointer  (3)]
⎜   ↳ 2.4G wireless USB Device 2.4G wireless USB Device id=13   [slave  pointer  (2)]
⎣ Virtual core keyboard                     id=3    [master keyboard (2)]
    ↳ 2.4G wireless USB Device 2.4G wireless USB Device id=14   [slave  keyboard (3)]

I like to have the bottom thumb be the left-click. The lazy way of customising this is

xinput set-button-map 13 0 2 3 4 5 6 7 1 0 10 11 12 13 14 15 16

That turns off the Index Finger and Top Thumb, and assigns Left-Click to the Bottom Thumb.

sudo nano /usr/share/X11/xorg.conf.d/91-zelesouris.conf

Use the following as a template

Section "InputClass"
        Identifier      "ZeleSouris"
        MatchUSBID      "279e:024e"
        Option "ButtonMapping" "0 2 3 4 5 6 7 1 0 10 11 12 13 14 15 16"
EndSection

Reboot and your button mapping will take effect.

This is a case study focusing on the usability of encryption systems as used by political dissidents in Apartheid era South Africa.

Background - South Africa

Between 1948 and 1994, the nation of South Africa was ruled by an ethnically white minority. They set in place a system of government – known as Apartheid - which suppressed, brutalised and discriminated against other races.

The African National Congress (ANC) was formed in the early 20th Century² with the explicit aim of bringing "all Africans together as one people to defend their rights and freedoms." In 1960, it was outlawed by the ruling National Party³ and was subsequently branded a terrorist organisation by many nations⁴.

Activists working for and on behalf of the ANC were placed under intense scrutiny by the National Party and its allies. In order to safeguard their communications, the ANC needed to develop, deploy and successfully use digital encryption.

The primary source of this information comes from the ANC's monthly journal "Mayibuye". In 1995 they published a series of articles on their encryption efforts, collated in a single article: "Talking To Vula"⁵

Lines of Communication

With the ANC's leadership under extreme surveillance by a technologically superior aggressor, communications between the leadership and members were subject to interception and disruption.

Poor communications had determined the shape of our struggle. It was because our fighters and cadres could not communicate with their leaders and between themselves that the underground never developed and People's War never became a reality. "Talking To Vula"

The ANC's typical method of encrypting communications in the late 1970s was by the manual use of One Time Pads (OTPs).

While OTPs represent a theoretically uncrackable encryption, they have two fundamental flaws :

• It is difficult to distribute an OTP; it wasn't until the late 1970s that key-exchange over a public channel was solved using the Diffie-Hellman Key Exchange⁶.
• OTPs often suffer from unrecoverable errors introduced by flaws common in manual transcriptions⁷.

Activists had to manually encipher messages - a tedious and error prone process - and then manually transcribe and decipher the messages they received.

The lack of digital communications required that messages be physically distributed. This increased the latency of communication to the speed of international postal services.

It was always the same pattern: comrades would go back home feeling enthusiastic and begin by sending a series of messages. They soon came to realise that it was a futile activity as it took so much effort to say so very little and the responses, as few and far between as they were, contained little encouragement and advice.

"Talking To Vula"

These activists were fighting to free their country from the yoke of a repressive and racist government. Yet they found the long-winded process of protecting their communications just too hard.

Security is usability.

Operation Vula

The growth of the Personal Computer industry in the 1980s made digital computing increasingly affordable. The ANC's technical committee began to research digital encryption and communication over the telephone network using modems. This was known as "Operation Vula"⁸.

Modern cryptographic science frowns on the sort of self-created encryption algorithms used by Operation Vula; such algorithms often contain subtle weaknesses of which their creators are unaware^{9 10}. However, developing bespoke encryption systems was a common occurrence in the 1980s – mostly due to the United States Government forbidding the export of encryption software¹¹. This meant that strong, audited encryption was not widely available to the public.

The introduction of computer-based encrypting revolutionised the revolutionaries so that with little effort it was suddenly possible to communicate over vast distances with (apparently) total security. Messages could be long and complex, and the latency of response times were reduced.

This home-made encryption flourished for several years before it came crashing down¹².

It failed not because of technological weakness - but because of human weakness.

Usability

Maintaining secrecy is hard. Attaching computers to modems and loading secret codes is still a lot easier than the mind-numbing process of hand powered encryption; but it is an extra burden.

Individuals were careless. They knew that organising against the government could result in torture or death. Despite that, it was hard to act with 100% vigilance.

The details of Vula that the regime released to the press revealed that indeed a number of important documents had fallen into their hands. It became clearer by the day that the comrades in Durban had violated all the rules of security that we had so assiduously tried to impress upon them. Data files of confidential information were kept "in clear" on disk and keywords and key books must have been easily obtainable. The minutes of an entire underground conference were quoted by police as evidence of the plot to overthrow the government.

"Talking To Vula"

These communications were not between "hacktivists" doing it for "teh lulz", lovers exchanging sexts or business people protecting their Intellectual Property. It was between freedom fighters working against a sadistic and murderous government. Failing to maintain security would not just end with their families being tortured - it could mean the disruption of an entire political movement.

And yet that threat still was not enough to keep people acting in a security-conscious manner. "Talking to Vula" concludes with the lessons the ANC learned from running their encryption programme:

Without first-class communications you cannot carry out a successful underground operation. "Talking To Vula"

"First class" does not just refer to the technology powering the system, but also the usability of the security.

Barriers

We know that commonly used encryption programs often have fundamental flaws (such as the recent POODLE¹³ and HeartBleed¹⁴ vulnerabilities), that state-based agencies have deliberately weakened encryption standards¹⁵ and that there are theoretical attacks on cryptography using quantum computing¹⁶.

Let us assume for now that via some combination of Vernam ciphers¹⁷ and Perfect Forward Secrecy¹⁸ it is possible to create an encryption scheme which, if used correctly, can withstand sustained attack from determined adversaries. The correct use of encryption relies on, at a minimum, the following behaviours :

• Users understanding why encryption is necessary.
• A provably secure way for users to generate encryption keys.
• Securely storing the encryption keys.
• Exchanging keys.
• Validating that the keys are trusted by the recipient.
• Correct enciphering of messages.
• Correct deciphering of messages.
• Validating the provenance of messages.
• Securely storing or destroying messages.
• Updating behaviours and technologies in the light of emergent threats.

If any of these behaviours are weak, the entire encryption scheme becomes vulnerable.

The Challenge

Is it possible to create a system that simultaneously satisfies the conditions of desirability (the understanding of its necessity) and usability (the inability to use incorrectly)?

Modern systems like GPG and Keybase.io have improved on the usability of older encryption systems – but they still require the user to act in an almost perfect manner.

A recent high profile case illustrates that, despite the improvement of these systems, intelligent and committed users still make basic mistakes :

David Miranda was carrying password for secret files on piece of paper

A journalist’s partner who was detained carrying thousands of British intelligence documents through Heathrow airport was also holding the password to an encrypted file written on a piece of paper, the government has disclosed.

Daily Telegraph. 2013-08-30

This careless attitude was present 23 years earlier, during Vula :

[Ghebuza's] assistant was in the habit of moving around with Ghebuza's program and "key" disks as well as his data files. This was against all the rules though we had always suspected that some of the comrades were less than meticulous about observing them.

"Talking To Vula"

Users will seemingly do almost anything to bypass security in the name of convenience^{19 20}. From writing down passwords^{21 22} to pointing a webcam at a VPN token²³, these behaviours completely negate any of the protection provided.

Users are left with, at best, a placebo security measure.

A comprehensive encryption programme has to account for the fallibility of human nature.

Ubiquity & Transparency

Usability of encryption relies on two essential factors: Ubiquity and Transparency.

Until the release of the Firesheep software²⁴ it was assumed that websites only had to protect the login portion of their services with HTTPS. Firesheep showed how every interaction with the site could leak login information to an observer.

The only way to guarantee the security of users was to ensure that every single interaction with the site was secured. Ubiquitous security became a necessity.

Similarly, it used to be common that in order to securely access a site like Facebook or Twitter, a user had to remember to enter the URL with the "https://" protocol, or they had to manually set an option to enable security.

By having the website insist on using HTTPS and enforcing it for all users at all times, they removed the need for the user to have to constantly check their security settings. This mode of operation means that encryption technology does not get in the way of the user's normal use of the site. Users do not have to undertake manual actions to enable encryption.

An excellent example of this can be found in my research into British Police websites²⁵. Several forces run online crime reporting tools, enabling victims to send in details electronically.

Despite the obvious legal and moral need to protect such sensitive information, I discovered that 18 of the forces did not provide any website security. Six of the sites had encryption available but did not force visitors to use it. This meant that users of the site would have to manually manipulate the URL to select a secure method of communication.

Conclusions

Even minor transgressions in the correct use of security can offer an adversary the opportunity to penetrate a user's defences. Users have to continually protect themselves against an unending onslaught of criminals and state-backed hostiles.

"Remember we only have to be lucky once. You will have to be lucky always."

Anonymous IRA Spokesman²⁶ referring to the 1984 Brighton hotel bombing.

In order to make encryption practical and to extend the benefits of secure communication to as many people as possible, we have to find ways of making users as "lucky" as possible.

The challenge for future security systems is to protect users from their own fallibility whilst being as unobtrusive as possible.

But Twitter seems to think so.

When I share a link to Twitter on Facebook, this (sometimes) happens.

And sometimes, I get this delightfully mangled Unicode atrocity!

So, what's going on?

When Facebook wants to display a link, its servers send a quick web request to the URL that the user has typed into the box. When Twitter receives that request, it looks at where it has come from and tries to localise its content.

If you're a German, you probably want the Twitter website to be in German. That's fairly sensible. But when you receive a request from one country on behalf of another, what should you do?

Here are the headers which Facebook sends with every request.

User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Accept: */*
Accept-Encoding: deflate, gzip
Range: bytes=0-524287
Host: example.com
Connection: keep-alive
IP: 31.13.110.120

That IP address, according to most geolocation databases, is from Ireland - however some list it as being Swedish.

Twitter is, arguably, doing the right thing here. They're seeing an IP from Sweden, and serving it up a Swedish page.

Yes, their IP database is out of date, but even if it wasn't I'm not sure everyone on Facebook want to be reading in Gaeilge or English.

Facebook knows what language the user speaks. It really ought to be including the HTTP "Accept-Language" header in its requests.

It's really easy! All that HTTP request needs is:

Accept-Language: en-gb;q=0.8, en;q=0.7

That means "I want British English, but I'll accept any other form of English".

Hey presto! Twitter will see a request from Sweden / Ireland and rather than dumbly looking at the IP will make an intelligent choice based on the user's language preferences as determined by Facebook.

I spoke to someone informally at Facebook about this. They claimed that this is a user privacy measure. Facebook sending your language preferences to a third party could be an unwanted invasion of privacy. Personally, I think that's a load of rubbish. Could an attacker send you a specially crafted link and find out that you secretly read Facebook in Pashto? Perhaps. But because this doesn't happen all the time, I suspect it's just a piece of sloppy engineering.

As we say in Sweden, "Ibland användbarhet innebär att arbeta lite hårdare för att se till misstag i andra företags datorer påverkar inte dina användare negativt!"