Nouveau modèle de permissions pour les aggrégateurs financiers

Un récent article de CyberPresse (que j'ai découvert via @MvtDesjardins, merci!) nous rappelle ce que l'on savait déjà: les aggrégateurs de transactions financières, bien qu'extrêmement utiles pour simplifier la gestion d'un budget (je suis un grand fan de Mint, et autrefois de feu Wesabe), présentent certains risques théoriques.

On y lit aussi un fait fort intéressant - et que j'ignorais jusqu'ici - soit que les institutions financières considèrent que l'acte de fournir à un aggrégateur comme Mint.com son NIP d'accès bancaire constitue un bris de confidentialité du NIP (les dégageant de leurs garanties vis-à-vis les opérations non autorisées). [Note: Je ne sais pas comment une banque arriverait à prouver qu'un membre possède en effet un compte sur sur un quelconque aggrégateur de transactions et a volontairement divulgué son code d'accès - la défense "ah, non, ce n'est pas mon compte, quelqu'un d'autre a dû voler mon NIP et l'enregistrer là-bas", semble plausible. C'est une discussion pour un autre jour.]

De l'article:

Ursula Menke n'en déconseille pas l'usage. "Nous suggérons des précautions, indique-t-elle. C'est une question de bien peser les risques et les bénéfices de ce genre de service."

C'est une recommendation totalement vide, car il n'y a en fait aucune précaution possible; soit on fait l'usage d'un tel service (en divulguant notre NIP à une tierce partie), ou on s'en passe complètement.

La faute pour cette situation (que, je prédis, n'est que temporaire, car c'est réglable, bien qu'un peu difficile) repose sur les banques, qui voient leurs services en ligne évoluer à un rythme glacial comparé au reste de l'industrie des services sur le Web. Nous avons besoin de nouveaux standards de transfert de données et de délégation de l'identification des usagers. Je m'explique: Le vrai problème dans tout ça, c'est qu'il n'y a actuellement aucune granularité dans le contrôle d'accès qu'un usager peut offrir aux tierces parties; c'est tout ou rien.

Il m'est actuellement impossible de fournir un accès lecture-seulement de mes transactions financières. Je dois fournir à un aggrégateur de transactions l'accès total à tous mes comptes, et les systèmes de ma banque ou caisse populaire n'ont aucun moyen de différencier un service automatisé d'un réel usager et d'appliquer des permissions différentes le cas échéant.

C'est un problème très commun dans notre industrie (en fait, GMail, Facebook, Twitter et autres ont tous eu ce problème à leurs débuts et ont dû le surmonter), et pour lequel il existe des solutions relativement simples (qui servent, au minimum, d'inspiration). N'importe-quelle archive d'informations personnelles de grande valeur pourrait me permettre de créer des jetons d'authentification afin de donner accès à un sous-ensemble de mes données à d'autres services. Du coup, on élimine totalement la divulgation des crédentiels d'authentification aux tierces parties, on permet aux consommateurs d'offrir différentes permissions à différents services, et on peut rétracter l'accès d'un service à nos données sans impact sur les autres, en invalidant le jeton associé à ce service.

Ça prendra sûrement des années, mais la balle est dans le camp des banques et des caisses populaires, qui sont les seuls à pouvoir régler ce problème.

Fantastic UX Design: the Google Chrome Developer Console

Yet another example of where the simple Chrome UI betrays the huge amount of thought that must have gone into its design and development: this is a log console done right.

If you scroll to any point in the Chrome 10 developer console while new logs are being appended to it, the scrollbar position  stays where you are and the logs are locked in place for your inspection:

However, if you scroll down to the very bottom of the window and release the scroll bar, then you get "tail -f" functionality - the window scrolls down automatically with new logs:

To pick just one example to contrast, Wireshark used a toolbar button to control this behaviour (below), while Google Chrome "just works" and does the right thing without any clutter.

Coffee Shop Subscriptions

It just occurred to me that I’ve never heard of a coffee shop subscription.


Many coffee shops already have loyalty cards, where each 10th coffee is free. This is going further (way further) in the same direction: offer a monthly all-the-lattes-you-can-drink subscription! Consider that repeat daily business is the name of the game for these places, and it’s a wonder that we’ve never seen it tried - can anyone figure out how to price the subscription to maximize revenue?

A few thoughts:

• You’d have to tie it to an individual and make it non-transferable. I think you could profitably supply me with all the lattes I can drink for a fixed price, but there’s no way it’s profitable if I buy a single subscription for my entire office.
• The right price from the consumer’s point of view would be a bit less than the cost of 18 lattes (5 per week x 4 weeks/month x 0.9 to account for loyalty cards).
• The right price from the coffee shop’s point of view is higher than that - they’re taking a risk that I won’t start drinking three a day. I imagine they can do this because the marginal cost of making more lattes is small compared to their huge fixed costs. 
• In exchange for this risk they’re getting guaranteed revenue, in advance, and the guarantee I won’t ever step foot in a competitor’s shop. You can have two loyalty reward cards and go to whichever shop is closest, but there’s no way you’d ever buy two subscriptions to competing shops.
• To mitigate the risk of abuse you could ignore the one-a-day market and target only the two-a-day heavy purchasers (since there’s an upper limit to how much coffee it’s practical to consume). Price it below what it would cost to buy two a day for a month. You’ll probably convert a bunch of your one-a-day drinkers to the subscription for a little more.
• You could market this as a conspicuous luxury item: make it a nice thick golden card that status-seeking scum-sucking yuppies will proudly flash at the register.

Dark Days

This is the first time I've ever seen an animated graphical ad right on one of Google's main properties.
And there's no link below the ad to report it as offensive.
And it's in Flash! Argh.

Window Management for Compulsive Neat-Freaks

On the Mac, I'm a bit of a SizeUp junkie - it becomes so much an intuitive part of your computing experience that its command keystrokes eventually get baked into your fingers' muscle memory. I bought a license, and after a few months of use, I couldn't even tell you what the key bindings are, my fingers just... know them.

Praise for Winsplit Revolution

As soon as I reach the office though (to sit down at a Windows XP workstation), I feel like my multi-monitor setup is messy and slow in comparison. This week's discovery of Winsplit Revolution changed all that, it's exactly what I wanted it to be - "SizeUp for Windows". Now my obsessive-neatness tendencies are catered to and I can setup beautiful grids of terminals, browsers, and editors.

I'm not really one of those compulsive tweakers and customizers who must absolutely change and configure every aspect of their graphical shell; I prefer when software just gets out of the way, lets me work and read, and doesn't obstruct my feeling of being in control of the machine. Windows itself, without keyboard shortcuts, makes you feel like you're interacting with a computer, not the apps themselves - the power of this kind of tool is that it gives you the illusion of apps reading your mind and moving to the right screen/edge/corner with a few twitches - the OS isn't standing in the way.

Caprica: familiar places

I sat down to watch Caprica this week (Season 1, Episode 6) and I was so surprised to recognize the location where the Graystone cocktail party was held!

It's quite clearly filmed in Gatineau's Canadian Museum of Civilization!

The Graystones dancing (filmed in the great hall of the museum):


For comparison, here's a shot of that hall; note the columns and totems in front of the window:

Photo Credit: flickr user Яick Harris

This shot, a few seconds later, prominently features one of the museum's Inuit sculptures. If I recall correctly, it's somewhere up on the second floor.


I wonder when this was shot - it looks like summer outside, which means if the view isn't retouched too much, it was shot before this winter?

BMO annual report: making your neighbours think you're getting porn since 2010

My small apartment building has a single, shared, mailbox. What's running through the mind of my neighbours as they bring in BMO's annual report and leave it on my doorstep?

15 Minutes With Windows 7

i wanted to like it


Photo by: Flickr / techedlive

Windows is weird, you know?

It's all at once the huge commercial success everyone is using and develops for, and a retarded kid with down's syndrome everyone hates but you kinda-sorta-want to see him do something great.

I've been using Windows XP at work for years, and I've totally skipped Vista. Hadn't even tried it (until 2 weeks ago). Sure, I don't like XP, but I've grown accustomed to its rough edges and I can live with the bad parts (at least once cygwin is installed).

I'm setting up a new build server right now, and the machine just got racked up and paved with a fresh install of Windows 7. I was curious to see what 9 years of development time since XP have brought; I don't really care much about the look, I'm mostly interested in the GUI getting out of the way and letting me be productive. In this case, that means installing the latest JDK, Apache Ant, Subversion, CruiseControl, Cygwin, adding an ANT_HOME environment variable, adding Ant and the JDK tools to the $PATH, etc.

I don't mean for this to be a contrived, unrealistic, test to point fingers... this is really what I need to do today: pull up a few terminals, install some dev tools, setup auto-builds, and get productive. I spend a LOT of time at the command line, so this is the perfect test case for me: how good is the Windows 7 terminal after years with this old one: no tabbed shells, no resizing of the window, awkward copy and paste?


Fast forward 9 years:

Drat.
Still can't resize that window. But it looks prettier, right?

Next let's add an ANT_HOME environment variable for this user and add the JDK tools to the PATH. This is really annoying in Windows XP because your PATH is probably a mile long and you can't resize the window:


Maybe it's better now:

Well, it's more blue. And it... even took more clicks to get here.

So that was a fun first 15 minutes with the latest and greatest.

To be fair, I hear there's some really great system administration tools in there, so I'll stick with it and see... I wonder if there's a way, now, to see which processes have which files open, in a default OS install? You know, like lsof?

Pre-emptive snarky comment:
- Oh, I suppose editing your ~/.bashrc is faster?
- Actually, yes, I'm pretty sure it is. (⌘+space, termi <ENTER>, vi .bashrc <ENTER>)

What made them think this was OK?

I've gotten SMS from Fido before to announce service or rate updates, and I've found it tolerable because it was probably the only way to reach their subscribers.

This, however, is most definitely not OK:


Fido: Interrupting me with SMS spam that makes my phone ring, in order to ask for money for something completely unrelated to my phone service is not acceptable under any circumstances. It is offensive, unprofessional, and disrespectful of our relationship.

GPS metadata in iPhone photos

I'm usually faaaar up on the "share everything with everyone" scale, but this actually surprised even me, and I should've known this already. I don't think the behaviour is wrong, but it's definitely something to be aware of. I'm talking about the location data in EXIF tags in photos taken with an iPhone 3G/3GS.

I took the following photo at Bridgehead last weekend. Turns out if you email that photo to anyone from the phone and open it up, there's location metadata included in the file:


OSX even includes a handy little "Locate" button in the inspector. Clicking it opens Google Maps in your default browser, which locates the photo pretty damn near where I actually took it:


Spookily accurate.

The potential usefulness of this is terrific and outweighs the downsides (think "view pictures posted in last 2 hours, taken near this fire"... crowdsourcing the news), but it's definitely worth keeping in mind from a privacy point of view.

Les Grillades (Ottawa)

Today's food post is a bit weird: I'm giving a big thumbs up to a restaurant without being able to write much about what I had there, for the simple reason that I'm talking about Les Grillades [85 Holland ave], and they serve Lebanese food, which I'm not very acquainted with. So... here's my fantastically uninformed post about a Lebanese brunch.

I went in for Sunday brunch with no idea what to expect, and let me tell you, this isn't a typical Ottawa greasy shawarma shack! This is a real restaurant.


We started off with a bit of turkish coffee.


A plate of fresh veggies awaited us as we sat down. Incredulous, I inquired of one of my Lebanese companions: "So you just eat... the onions... raw? Really?" I'm certainly not known for turning away from raw foods, so I dove in carefully with some green onion (verdict: not bad, but apologies for my breath afterwards):


Then the brunch dishes started arriving. We didn't actually order anything specific, just "brunch". I was introduced to Labneh, a sort of strained yogurt (delicious!):


Some meat and cooked cheese:


And what was probably the best dish we tasted: this was made from fava beans, it was extremely tasty, and I was told the name (possibly 'Foul'), but it was unfamiliar and escapes me now:


All in all, loved it, and at around 100$ for a table of 6, quite reasonable.

Tourtière HOWTO

Guests and co-workers have asked me to share the recipe for tourtière (meat pie) and for pie crust. I'm hoping this illustrated HOWTO can serve as the reference I point them to.

Pie Crust

These instructions are for 1 crust. You need 2 (top + bottom) per tourtière, so we'll make 4 of these. I make them individually in the food processor. I use the same kind of crust for dessert pies as well, this works for everything.

1.25 cups flour
1/2 tsp salt
1 tbsp sugar
1 small stick of butter, chilled (~110 grams)
~1/8th cup of ice water (as required)

Combine the flour, salt, and sugar in the food processor.


Cut your chilled stick of butter into little pieces.


Start the food processor and quickly throw in about one piece of butter per second. This should take about 10 seconds and break up the butter into tiny clumps. When you're finished, it should look like this:


Add 1/8th cup ice water (or a little more, as required) in a very slow thin trickle while running the processor. The dough will rapidly start clumping up and after about 20-30s will form a single ball. Don't use too much water! It shouldn't stick to your fingers, it should stay in ball shape when handled.


Press it lightly onto a counter, then wrap in wax paper and chill for 30 minutes. When you take it out of the fridge, let it stand for 5-10 minutes so it softens and is easier to work with.

Filling

(makes two)
1 red onion, finely chopped
1 white potato
2 cloves of garlic
2 lbs ground pork
1/2 lb ground beef
1/2 cup beef broth
spices (basil, nutmeg, cinnamon, bay leaf, cloves)

Dice your potato. Cook it in boiling water with a bit of salt for 10 minutes (until tender), then drain and reserve.


Chop up the onion and mince the garlic.


In a large skillet or casserole, cook the onion and garlic in a bit of vegetable oil until tender, about 3 minutes.


Add the pork and beef. Let it cook on high heat about 5 minutes, stirring frequently. Add some salt and pepper, the spices, and the beef broth. Turn down the heat and simmer for 30 minutes, stirring from time to time to make sure all the meat cooks evenly and the beef gets mixed well with the pork. It looks like this when you just start cooking:


After 30 minutes, take the meat off the heat and let it cool down. Go back to your potatoes and mash them up:


Then combine them with the meat

Roll the Crusts

While your meat mixture continues to cool, it's time to prepare the crusts. Flour your work surface and plop down the first ball of dough. I like this cutting board, it has a gauge to help with shaping.


Now roll it out so it's bigger than your pie tin. [Note: never buy a teflon rolling pin like this one, it's junk. Get a proper wooden one.]


Place it in your pan and run a knife gently around the edge to cut off the overflow.


Spoon in your meat mixture into both bottom crusts. Brush some beaten egg onto the edges to help seal the top crust.


Place the top crust on top, and brush the whole surface with some more beaten egg. Use a fork to texture the edges and seal both crusts shut together.


Bake at 375F for about 60 minutes.


Done! Make this 1-2 days before you're ready to eat, it's better after a day or two.

Nostalgia

Remember when this was the most minimalist, uncluttered homepage on the web?

Design anti-pattern: "Results per page"

Can we please leave this behind:

Designers, you drew up the results page, you know how many results it scales to while remaining usable. So just pick that and be done with it.

A lesser sin (also pictured) is choosing the sort order at query time. Just pick for me, and give me visual indicators that I can re-sort right on the results.

Learning with Bridgehead

Earlier this week, I had the immense pleasure of attending Bridgehead's course on coffee / espresso. The crowd was awesome - all coffee lovers looking to take their espresso-making skills up a notch. Held at The Urban Element, which I've been dying to visit for some time, the course covered two main topics:

The first part (by Mr. Ian Clark), on identifying flavour components of coffee, tasting demonstrations, etc., was interesting but of limited everyday use for me. I (and I suspect I'm far from alone in this) tend to find one or two varieties of beans I like and always go back to those. Still, lots of fun.



The second half (by Laura Perry), gave me much to think about as I prepare my customary morning latte. When pulling an espresso shot, I've often been focused simply on trying to coax my equipment into getting the extraction time right, with little attention given to tamping technique and temperature control.

Biggest discovery of the class? The amount of coffee Laura packs into a portafilter. I've probably been under-dosing my shots for years now!