The common wisdom is that digital photography killed Kodak. Digital images were the secondary effect. Networking was the primary. Kodak’s consumer business is about narrative: they thrived because people wanted to tell stories through snapshots of their lifes. The places I remember, to quote the Beatles. Kodak’s tag line was “Take Pictures – Further” for quite some time, a snapshot of both imaging and sharing the thousand words to do justice to the picture.

Kodak had the first digital camera (I had a consumer version of it; it used a floppy disk and took almost ten seconds per VGA quality image). They own a truckload of patents in digital imaging science, color science, and image manipulation. But their business model was predicated on taking pictures, having them developed, printed, and mailed to relatives in Iowa. It wasn’t just film; it was chemicals, paper, and the photofinishing “mini labs” that popped up in every chain drug store, camera shop and mini mall. As soon as that entire vertically integrated business was challenged by kids with smart phones posting pictures to Flickr, Photobucket, and now Facebook, the consumer business entered its denouement. Doesn’t matter that Kodak invested in Ophoto for digital image sharing, or that they make a really nice waterproof digital video camera. The higher end camera companies were able to continue to push professional grade innovation down into the consumer space, and for hack photographers like me, better glass and effectively zero cost of “wasted frames” meant that I began taking many, many more pictures than before. Every picture I take goes into an email, through MMS, up on SmugMug, or onto Facebook. Kodak adds no value to those processes, so I became a Kodak non-consumer.

Kodak bet against networking. Their business model was not predicated on telling analog stories using digital images. Adobe (Lightroom and Photoshop, not to mention the rest of their suite) and Smugmug (for high volume sharing and archival) represent the endpoints that Kodak could very well have defined had they bet that broadband networks would be cheap, ubiquitous and intimately attached to the vast majority of imaging devices (read: camera phones). They would have created a vertically integrated value chain from image capture to context (borders, ribbons, tags, clean up, editing) to archival to personal narrative. It’s not just the consumer business — Kodak also had a large medical business (X-rays and medical films). If you’ve read stories about remote radiology or remote diagnostics, you’ve seen how networking and digital imaging conspired against Kodak there as well. Both aspects are necessary; simply having great digital imaging but no networking capability means you’re making analog prints and using FedEx as your network layer to get a second opinion.

Moral of the story: You can’t stop Moore’s Law and Metcalfe’s Law from disrupting businesses. If your business model changes as a result of netowrking, you need to figure out how to deal with it. Once the publishers realized that amazon.com is a re-intermediator, not a dis-intermediator, and that building marketing, pricing and distribution relationships with amazon.com would actually increase sales of their entire front and back catalogs, they survived. Everyone who had a Brownie camera, who waited patiently for the fat picture envelope to return from Rochester, New York, is a bit sadder that the Kodachrome is being taken away.

Steve Jobs had stepped down as Apple CEO just earlier in the week, and Sandy and I talked about how Apple went through a variety of phase transitions around of its Chief Executives. We moved from that somber topic onto succession planning, something that I had witnessed firsthand at Sun, and in which he had deeply participated while at Citibank. He said some nice things about Scott McNealy, again, heartfelt and sincere after more than ten years since their last meeting.

Here’s what I took from our chat-with-cheap wine: Stick to the facts when evaluating a peer’s performance. Compliment people you respect whether or not you agree with them and their decisions, because you respect their decision making process and execution. Share personal details to add color but do not boast. Taken together, those rules of executive discource frame reflections on how institutions – companies, universities, associations – change over long periods of time.

Succession planning isn’t hoping that your successor is just like you; it’s finding a leader who figures out how to amplify his or her vision through the senior staff. The successor’s words and actions need to resonate and reverberate through the halls of the company. It’s more music theory than organizational theory; it’s about blending in a new voice in a complex harmony.

Here’s my proposed track listing:

1. 65 minutes. The song is listed as 3:45 on the CD, but it runs 4:30 with two false endings.

2. No Pants. Discovering untold truths, and things better left to the strangest of imaginations, discounting for attendance at sci-fi conventions. Contains the previously unknown Mr. Peanut riff.

3. Mute All Lines. A thoughtful exploration of the tragedies of multi-tasking, especially around children, dogs, and bathrooms.

4. Next Slide. Sampling everything from Gregorian chants to Jay-Z’s sampling of the Doors and superimposed over a synthesized back beat, it’s the soulful anthem of those dying by Powerpoint.

5. Repeat. Heavily influenced by Frippertronics, the middle parts of Philip Glass’ Einstein on the Beach, and the entire catalog of Yngwie Malsteen, this theme and endless variation starts with the most rudimentary of music theory and ends up making Bach glad he’s still dead.

Midway through 1995, Sun Microsystems was riding a wave that wasn’t quite yet attributed to Internet surfing, but had its origins in the tidal forces that made the at sign part of our vernacular. We had introduced a new programming language called Java that May, and during one of our engineering conferences, I sat at rapt attention while our keynote speaker — Steve Jobs — introduced his talk with the trailer for Toy Story. Having learned a small fraction of the interactive computer graphics canon (enough to say “Gouraud shading” with a straight face), I was immediately blown away. The texture mapping, the motion blur, the quality of the rendering — it didn’t seem possible within what was “normal” data center architecture, until Jobs told us how it was done and what part Sun Microsystems had had in the rendering farm that generated the movie, frame by animated frame. The “thank you” poster with Buzz Lightyear and a Sun logo that we received as a party favor at that conference still hangs in my home office. Up to that point, computer animation was an interesting experiment, but it hadn’t entered the mainstream; four months later I was taking my then-four year old daughter to see Toy Story at its Thanksgiving weekend premier, and stayed until the very end to see the sysadmin and server credits.

Toy Story’s release marked the point at which it became socially acceptable to be a nerd. Email, the web, blogging, social media and wireless client devices bled nerd colors onto everyone else, but the summer of 1995 was definitely the tipping point. And Steve Jobs pushed us front and center. Family conversations that opened with “What do you do?” no longer involved companies named Xy-, Mega- or something-ix; they revolved around talking about what computers could do in the social mainstream.

Of course, Steve Jobs took things to the next level of abstraction. After making entertainment a function of computers, he made computing a function of fashion. We love our iPods, iPhones and Macs because of their elegant design; celebrities talk about what kind of phone they use and we follow them on social media sites. We’re all nerds now. We even have our own TV show (and I’m referring to Big Bang Theory, not Eureka or The Guild even though those are equally outstanding answers).

For every comment about Jobs’ style as CEO and engineer, consider this: What if most executive boardrooms, state legislatures, and our Congress functioned with the same ruthless passion? What if a design — for a bill, a strategy, a foreign policy — that was so obviously underwhelming was simply met with “This is stupid” and forced into re-work? What if we worried incessantly about the design and experience of our work product, and let the profits come as a result of a job well done? There are management and leadership lessons beyond those recorded in the Harvard Business Review, but significantly more valuable.

Thanks, Steve, for the impact you’ve had on nerds everywhere. To infinity, and beyond.

Background: Facebook will pre-define lists for you based on your education, work, geography and other easily sortable criteria. It then suggests people to add to those lists, usually based on mutual friendships with those already in the list, or common data such as both having attended the same school. It’s a nice big JOIN problem at its finest.

Problem: I have a friend who is married to one of my fellow Tigers. She and I have mutual friends who are all alumni as well, and I tend to think of her in the “Princeton” category. So I put her in the Princeton list (at Facebook’s suggestion, I should add, again, probably based on common edges in our social graphs).

The Leak: My friend was notified of the list addition and asked to confirm “Princeton” as part of her education (again, assuming that was the criteria that generated the suggestion). Major, major privacy #fail: The fact that I add anyone to a list is private; it’s how I sort my friends and acquaintances and my criteria and grouping algorithms are completely and totally my business.

Unless Facebook would like to tell us that list additions are communicated to the other party, this seems to intrude in my own categorization. What if I create a list called “Ignored Former Coworkers” and add people to it, mostly so that I can avoid their updates that I find distracting? Are they notified of my feelings toward our time together? My guess is that if the list title doesn’t match one of the criteria used by Facebook, there’s no additional information leakage, but my two simple experiments to confirm this weren’t conclusive.

Advice: Create a list for your close friends and family members, and ignore or delete all of the other ones until Facebook figures out how to avoid leaking our non-obvious inclusion criteria.

A radio friend once told me that the best DJ sounds like he’s sitting in your car, talking to just you. Tim O’Reilly told me (25 years ago) that the best technical authors write as if they were teaching you to play a game, sitting next to you. Those styles are conveyed, with <emph>.

xkcd #317

If you’re wondering why the snowman looks a little bare, without pictures, sidebars, or other color commentary, it’s because yours truly was hit by a SQL injection attack sometime on Tuesday night. In this case, it was a thorough attack on every page, post and media library entry in the WordPress MySQL tables, a little bit of SQL that appended a piece of Javascript redirecting the browser to a site that I supposed tries to install malware, collect personal information and otherwise make reader’s lives less secure. I discovered this by accident while noticing that my browser was attempting to access a link that I never put into any posts; within an hour I had edited the index.html for my site, ensuring that all traffic would see an apology and not an attack vector.

Without laying public blame, I’m not sure if it came in through a backdoor in my service provider, or via the front door of my WordPress installation, and my (former) server provider refuses to share logs or other information that might exonerate my own site administration. This is the last straw with said provider; last summer it was performance issues (that were also blamed on me, not their shuffling of MySQL instances) and their continued promotion of add-on services. If I thought their basic services were well-run, I wouldn’t be so annoyed.

Upon discovery, I did what any reasonably panicked person would do: dumped the WordPress content in an extended XML file, wrote some scripts to edit out all of the bad stuff (and remove Google AdWords short codes that were in about 250 entries, since I no longer use AdWords on the site), set up a new hosting account with a new provider (BlueHost, at Brad’s suggestion), and re-loaded all 650+ pages and posts. The longest time pole in the tent was getting the DNS entries updated (since I did two updates, one when I took down the site and one when I moved it to a new provide, and had to wait for the first one to propagate).

There’s still a lot to do — I need to hand-edit the photos (since I didn’t download them first); sidebars, theme work, Google Analytics, and other decoration. At the same time, this forces me to work on a few things that I’ve had in notes but not in action plans – theme updates, cleaning up sidebars, adding in appropriate SEO hooks, and most of all, a conviction to stay up to date with WordPress updates.

Like Frosty, I’m back, need to put that magic hat back on my head, and ready to play again.

Turns out the Image Capture tool (built into Mac OS X, in the “Applications” folder) will see your iPhone as a camera device, and let you download some or all of the photos to a selected folder. This is now right up there with Senuti as one of my favorite “gimme back my stuff” applications.

The more we share, though, the more intriguing it is to see who might be consuming that information. Who doesn’t want to know the people who visit their Facebook profile the most often, looking at pictures or wall postings? It’s the adult equivalent of finding out who put you on the list of the “cute guys” in 7th grade (this never happened to me; I’m guessing here). If we post things in public to share and elicit reactions, why not track the quietest actions?

Because you can’t. Those applications that claim to show you who visits your profile or your “favorite friends” are virus vectors. Here’s how it works: Someone creates a Facebook application with an appealing name. The application promises to give you some personal and revealing knowledge, and in return you grant it permission to look at your personal information. The problem is that the personal information accessible to Facebook applications isn’t sufficient to determine who has visited your profile on that site. It’s not available to applications, and making it available would create privacy headaches that dwarf anything Facebook has in play.

When you grant a “Profile Tracker” (or stalker, or creeper, or anything else that implies unwanted online hovering) application access to your personal information, it typically does the following:

Grabs your email address(es), pages that you like, and list of your friends.

Posts an item on your friends’ walls so that the virus spreads itself.

Uses the information gathered to build a better phishing scam, social engineering attack, or brute force attack. If you, say, use digits from your birthday as a security code like an ATM PIN, or online banking PIN (which is a horrible, very bad, egregiously dumb idea, by the way), and your birthday information is in your Facebook profile, then you have provided more useful information to a potential identity attacker. That’s what these viruses do – they gather information to make more calculated, and therefore more fruitful, attacks on other parts of your online life. Someone with a Yahoo email account is more likely to bite on a Yahoo phishing scam asking for password information for “security purposes” than someone who only uses Gmail.

Bottom line: Be very careful giving any Facebook application access to your personal information. If you think you clicked through on something you shouldn’t have, check your privacy and security settings on your Facebook account. Don’t use easy to derive passwords, especially if you share a lot of your personal information (How many banks use “Name of your pet” as a security question? – I can probably name random people’s pets by looking at their Facebook public pictures; couple that with some banking services page “likes” and it’s much easier to brute force a password reset).

Facebook does track the pages, interests, likes and profiles you visit, and uses that information to govern the advertisements you see on the sidebars, the items that show up in your news feeds, and the ordering of various search results. It’s all very you-centric – not based on what others are clicking through and to, and not revealing anything about others’ browsing histories. It still think it’s creepy that I can comment on someone’s post, and the sidebar advertisement changes to reflect a keyword I might have used in a different context. But that’s the nature of online advertising; removing the annoyance factor also reduces our ability to use social networks as recommendation engines. I’ll keep my eyes front and center on the screen in return for useful information from the well-behaved pages that I follow, and I don’t click on things if I don’t know where they came from.

That’s probably the way we were all taught to behave in public.

My trip east is going to be my third circumscription of a great (eating) circle around the globe, about 21,000 miles in the air over the course of just under seven full days. From meetings with some of our Juniper Networks engineers in Bangalore, I’m going up to Hyderabad for JavaOne, then on to Ho Chi Minh City, Vietnam for a Juniper partner conference. Yes, it averages out to moving just over 100 MPH even when asleep in a stationary bed in Hyderabad. While it’s tough to be away from my family for a full week, I always enjoy visiting India – from eating achar with my eggs for breakfast to the visually stimulating temples that dot the major cities to it’s never the same river of people and buildings and progress twice. Visiting Vietnam for the first time will be a great opportunity to replace the 1968 radio broadcast and cinematic references points that exist in lieu of any first-hand experience in the country.

Each stop will bring me in contact with audiences having varied software development and deployment expertise and experience, and I’m eager to hear what they think is – and should be – possible. And if you come to JavaOne India, you may get to hear me make a Spy vs Spy joke regarding release engineering.

I’ve received two great pieces of advice about speaking to technical audiences. The largest impact has been a lunch conversation I enjoyed with Tim O’Reilly back in 1988, when discussing the details of “Managing NFS & NIS” when “NIS” was still called “Yellow Pages.” Tim’s recommendation was to tell a story – create a narrative out of your material. It has to set out a problem, identify the characters (or components) that will address the problem, and bring the problem to a resolution. Jokes, dramatic tension, and good pictures help move things along. If you tell a good story, people will have an easier time summarizing your talk, and therefore you’ll “stick” a bit more. Now that talks are recorded, slides posted for all to see, and commentary cross-posted to a variety of blogs, the headline summary may drive more attention your way in post-production. And I’m likely to tell people to take out their cell phones, cameras, and iPads, because the commentary stream is valuable to me in judging what worked and what didn’t.

Which brings me to the second piece of advice: Don’t suck.

I forgot who first said that as I was about take the ramp on stage left, but thinking of it always makes me smile, which is the right way to start.