But I’d like to have them on my Android phone as well, even when I don’t store company data on the device. People lose their phones. All the time. And there’s private data on there that should better be kept secret.

I feel uncomfortable carrying around a device which has more than 300 contact data sets, lots of personal email and also knows password to some of my accounts on the web. And I’d gladly buy an Android device that properly protects my data.

Oh, and no, all the apps available in the market that offer password stores or document encryption are just not the way to do it!

Customers have to specifically decide on a feature set, not just on the platform

It’s not enough to get “an Android phone”. There are two major differentiators on the Android platform that requires customers to look close to really get what they want: 1) the OS version and 2) the specific device capabilities. These two are interconnected (a device usually only comes with one specific OS version), but two devices with similar hardware can perform quite differently with different OSses.

The major differences customers can experience are along these lines (in no specific order):

• screen size
• networks supported (3G/WiFi,GSM)
• keyboard / touchscreen
  • multi-touch or just single-touch
    • (in the multi-touch case there are different qualities of multi-touch as well (number of simultaneous touches supported, robustness of detection)
• camera
  • sensor quality
  • flash (yes/no/type)
  • front-facing camera (yes/no)
• GPS (yes/no)
• pre-installed apps*
• fundamental look and feel of the apps on the device*
• availability of fundamental apps like navigation*
• availability of tethering
• size of internal memory
  • this is a big issue because pre-2.2 devices cannot install applications on SD cards and this limits the amount of installable apps dramatically
• Google certification*
• enterprise security features *

the items marked with a * will be subject to a future post because they require more detailed discussion

Many of these options that are not prominently advertised (and as such taken as a platform capability) make a difference for the applicability of your Android device (tethering? fundamental look and feel?). Also, all these options may lead to a Paradox of choice situation.

Now, to me it seems that the mobile devices market is mostly defined through devices, not so much through platforms, but that may be changing now. Apple delivers the iOS for different devices and Motorola calls it’s devices the Droids, so platform may be important.

The questions that remains to be answered: What are the defining properties of the Android platform from a customer perspective?

The Samsung mail client

Samsung has put their own email client with IMAP/POP3 support on the phone. And I’ve never used an email client with so many fundamental flaws:

• it considers all mail it has not read itself to be unread on IMAP. (Yes, IMAP!)
• you cannot copy text from received emails (!!!)
• it does not support threading
• folders are shown as an horizontal bar at the top. This is not helpful if you have 50+ folders
  • oh, and you cannot move/copy mails to folders anyway
• the “new mail” notification does not show subjects, only number of mails received
• responding to mail does a fullquote and puts the text to the top; and no, there’s no way to do it another way

And I forgot, it looks really ugly.

Fortunately there’s K9Mail on the Android market that does most of these things better. But for an out-of-the-box experience (how many people exactly will be spending time looking for alternative clients) this is really bad. You can do better, Samsung.

Samsung's Mail app

One of the most notable things (a 3rd generation iPod touch being my companion for over a year now) is the less-than-stellar performance of most things on the Samsung. I believe it’s caused more by the software than the hardware, the Samsung Galaxy sports a 1GHz processor and 512 MB of memory.

My most prominent (and hardest to bear) examples (using the unofficial Froyo images found on the web; performance was worse in 2.1):

• clicking buttons often  does not offer any feedback (> 30% of the cases, more like 70% if the phone has been running for some time)., so you’re always wondering if the phone actually recognized your clicks  This makes for a terrible user experience since it often takes 3-10 seconds to launch applications.
• When someone calls you, the phone rings, the screen goes dark and after around 3 seconds the screen lights up again and you see who’s calling. This is pretty ugly for a device that’s dominantly a phone! (This was really bad with 2.1, around 10 sec)
• The clock runs 7 minutes late after a single day of use. The C.L.O.C.K, can you believe it?
  
• battery drain is really bad. Even mild use of 3G (downloading one small app, checking facebook once, twitter twice) means that the battery is down to 25% ofter one day (no phone use). This means you cannot take this device with you (on a trip) if you cannot be sure that you can charge it overnight. This also makes the navigation applications useless because the battery will not survive a trip longer than 2-3 hours.
• applications seem to use blocking updates which makes the system unresponsive (instead of updating in the background in a separate thread). This should be blamed on the applications (since background updates are even advertised as best practice by Google) but the prevalence of applications that present a “wait or force close” screen after updates is high. Even Google’s Listen stalls on me every few minutes. I hope, developer education will solve this one.
• You see the “force close” screen much to often. This is almost certainly caused by generally low quality of apps in the Android market but even apps delivered stock with the phone crash way to often.

These are my top-level frustrations and I think there are conceptual reasons for them:

• The code produced by the Dalvik VM is still much slower than machine-specific code.
• the Android OS gives applications a lot of freedom (which is a good thing), allowing them to do things in a non-optimal way
• there is no review of applications enforcing strong quality standards. This is two-faced. It allows for innovation and crazy ideas but allows for a lot of bad user experience. I guess, even the apps produced by Google, Facebook or twitter might be better if they had to go through an Apple store-like review process.

In the end, it’s still really hard to write good, working software. It’s even harder to write software that has a good user experience. And it’s still a lot harder to do this for smartphone-type devices where functionality is more limited and user experience is the only thing that really counts.

I love that now there i strong competition to the iPhone, but (at least for me) Android does not deliver, yet. But I’m not giving up. The platform does have a lot of interesting concepts (think of Intents, e.g.).

Google wird nicht müde, in unglaublicher Geschwindigkeit großartige Dienste zu veröffentlichen, das Web voranzubringen und sich überall einzumischen, wo es was zu verbessern gibt, sei es Bildung oder Umwelt. Natürlich gibt es für sämtliche Google-Aktivitäten plausible ökonomische Gründe (manchmal mit ein bisschen Altruismus gewürzt), aber Google weiss, wie fragil seine dominante Position ist. Wenn die öffentliche Wahrnehmung von Google kippt, war’s das. Ein größerer Google-Hack mit Zugriff auf private Daten könnte dies verursachen..

1. Why? (What is their motivation for offering the service?)
2. What’s not on the table (yet)? (What are some possible additional uses of the service (or the data it produces) which are not obvious today or even explicitly denied by the provider?)

Both questions often don’t have definite answers because one is usually acting out of imperfect knowledge. That’s why I’m asking you, dear readers, to be creative and come up with some answers to them in the comments. I’ll start with some ideas of my own…

Why?

• As Google earns its money on the web, what’s good for the web is also good for Google. Faster loading of web pages is obviously in Google’s interest. Asynchronous HTTP calls (AJAX) used by many web pages (and especially by Google’s services) affect responsiveness of web applications and as such directly influence the user experience. (I’m not sure how big the number of DNS requests initiated by AJAX calls is, as they usually refer to a small number of known addresses).

What’s not on the table (yet)?

• Google has an interest in controlling the application layer part of how the web works (the introduction of SPDY points in a similar direction). This enables them to influence the technology used in the web and to push forward technology that most fits their needs. One should be aware that this behavior could lead to Google gaining a dominant role in deciding on how web protocols work.
• What can you actually do with DNS request data? You have the requesting IP address and the host name requested. You cannot use cookies for identification as in the web. NAT prevents clear identification of the source of some requests (IPv6 will eventually get rid of NAT and solve this “problem”). But hey, this is Google! They also know a good part of what goes on in the web after the DNS request has been made. If there’s a DNS requests for domain A by client address X and an HTTP request for the IP address of domain A by the same client X (which Google may now be able to identify using cookies; using Google Analytics, Google may be able to correlate requests for a web page and the corresponding request for the Google Analytics), you can actually identify clients using DNS. What does Google gain by that? I’m actually not sure. Google can relate activities going on outside the web (mail, news, etc.) and extend their profiling abilities. Monitoring behavior outside the web might be remotely useful for Google, but after all, they’re a web company.

Intermediate conclusion

I think making the web more usable by increasing responsiveness and gaining a little influence on the web architecture might be good enough reasons for Google to offer a DNS service. But there’s probably so much more to Google’s rationale. What might the data Google gathers be useful for? They are all about data, there has to be something in there for them. What are your ideas?

DB Service Store: Angebot der DB/S-Bahn. Kann selbstverständlich keine Dienstleistungen der BVG anbieten.

BVG Service Tickets (Geschäfte mit gelbem Würfel): Verkauft Karten gegen Barzahlung. Keine Abos.

BVG Service Tickets and more (Geschäfte mit gelbem Würfel): Verkauft Karten gegen Barzahlung. Keine Abos.

BVG Service Tickets and more (Geschäfte mit gelbem Würfel + Aufschrift “alle Fahrkarten”): Verkauft Fahrkarten gegen Barzahlung. Keine Abos.

BVG Reisemarkt: Verkaufsstellen, die angeblich alle Fahrkarten und auch Dienstleistungen zu Abos leisten. Nicht zu verwechseln mit “Reisemarkt”. Sind bei BVG zentral gelistet, aber häufiger ausserplanmäßig geschlossen.

“private Agenturen”: Anscheinend der offizielle BVG-Oberbegriff für “BVG Service” und “BVG Reisemarkt”.

Reisemarkt: Kioske an U-Bahn-Steigen. Verkaufen manchmal einfache BVG-Tickets aber keine Abos. Nicht zu verwechseln mit “BVG Reisemarkt”. O-Ton: “Mit der BVG haben wir nichts zu tun. Aber, wer will das schon”.

BVG Fahrkartenausgabe: Informeller Name (von BVG-Personal verwendet) für die “großen” Verkaufsstellen z.B. am Zoo. Alle Dienstleistungen der BVG, inkl. Abos erhältlich.

BVG Schalter: Hier erhält man (O-Ton BVG) “individuelle Fahrplanauskünnfte”, “Informationsmaterial (BVG-Atlas, VBB-Fahrplanbuch, Verkehrsnetzübersichten etc.)” und “Persönliche Beratung zu allen Fragen des Abonnements”. Wo genau sich diese befinden verschweigt die BVG allerdings.

BVG-Verkaufsstelle: Hier “erwartet Sie unser freundliches Personal”. Scheint ein Oberbegriff für die Schalter mit allem Dienstleistungen (inkl. Abos) zu sein. Wird oft in einem Zug mit “Schalter” genannt, ist möglicherweise synonym.

BVG-Kundenzentrum: Das große Kundenzentrum in der Holzmarktstraße. Wahrscheinlich alle vorstellbaren Dienstleistungen erhältlich.

Fazit

Umweltkarten nicht im Internet bei der BVG kaufen. Dann kann man auch die DB Service Stores benutzen. Und außerdem muss man für die Startkarte sowieso zu einem der “speziellen” Läden gehen.

I looked at WordPress while writing my Diploma Thesis and found that WordPress lacks important means for consistent type-checking:

1. There is no centralized definition (regexps and constraints) for all the data ‘types’ WordPress uses
2. There is no general agreement on exactly when and how input and output filtering and sanitation take place. This leads to ad-hoc solutions like the one causing the current vulnerability.

What WordPress really needs is a better architecture that solves the two problems stated above and as such makes vulnerabilities like this recent one very unlikely, not ever more ad-hoc hacks. Unless the WordPress project is willing to spend considerably effort on the architecture, using WordPress for professional means will become an intolerable liability. Software Engineering is about long-term stability and dependability, established in the process, not about “if you update your WordPress every few days, you’re safe” (as Matt Mullenweg suggested).

Der Camper steht schief am Hang, einen anderen Platz haben wir nicht mehr gekriegt. Sei’s drum! Es fängt an zu regnen…

Wir Anfänger: Natürlich keine Gummistiefel dabei. Bisher immer Glück gehabt. Der Rest der Welt hat natürlich welche. Schreckliche Farben und Muster, die kein Clubtür passieren würden. Aber hier ist ja Festival. Wir waten durch den knöcheltiefen Schlamm… Wenigstens die Tanzflächen sind mit großen Platten ausgelegt. Fanta 4, die Chemical Brothers, 2Raumwohnung, Paul van Dyk, alle entschädigen sie für den zwar schwachen aber trotzdem das Gelände in eine Schlammwüste verwandelnden Regen.

Und dann der Sonnenaufgang über dem See!

Den verregneten Nachmittag im trockenen, warmen Camper mit Pokern verbracht. An den Regen hat man sich gewöhnt. Die zweite Nacht ist ebenfalls großartig.

Erschöpft machen wir uns Sonntag auf den Heimweg. Fast! Der Camper ist eingesunken und lässt sich nicht mehr bewegen. Die freundlichen Herren in Gelb, die wohlweisslich sogar schom mit einem Schlepper auf dem Festival vertreten sind schaffen es unter hoher Beanspruchung der Kupplung zumindest das Gefährt zu bewegen, mitnichten aber auf einen festen Untergrund zu befördern.

Das allgemeine Chaos bei der Abreise rief die ortsansässigen Bauern auf den Plan, die sofort ein passendes Geschäftmodell hatten: 5 Euro für einmal abschleppen mit dem großen Traktor. Die Nachfrage war erwartungsgemäß groß. Immer hinten anstellen.

Sonntag abend: verspätet, erschöpft, glücklich, SonneMondSterne 2007 gesehen. Gerne wieder!

Die Moral: Thüringer Bauern schauen dem Wegfall der EU-Agrar-Subventionen gelassen entgegen. Die verdingen sich dann als Abschleppdienst für verpeilte Städter.