3D Secure coming to Bank of Ireland credit cards

My credit card statement warned me today that

3D Secure is launching at the end of March. This free, automatic online security service will make spending online safer than ever!

The promotional insert contained more reassuring messages:

• as secure as possible
• verify your identity by answering four questions [name, CVV2, date of birth and mother's maiden name]
• we will also display your personal greeting giving you added comfort that it is Bank of Ireland who are asking you to enter your 3D Secure Password

Of course, from Murdoch and Anderson's paper we know that 3D Secure is worse than ineffective. So I have questions for Bank of Ireland:

1. Do the terms and conditions move the burden of losses by fraud onto the cardholder?
2. Is the Access Control Server outsourced? If so, to whom? What are their practical incentives to maintain high security standards?
3. What is the official policy on selecting a CA for the ACS SSL certificate? If there isn't one, how can cardholders protect themselves against compelled certificate creation attacks?
4. What will happen if a fraudster with my card details uses the forgot password procedure in an attempt to negate the benefit of 3D Secure? Will I still be stuck with the cost of the fraud?
5. Can I be authenticated by something better than a password, for example a DDA card reader?
6. Can I get an automatic notification every time there is an authentication attempt on my card number?

I couldn't find any information about this on www.bankofireland.com, so I'll phone them tomorrow and post the result. I'm sure it will be comforting.

Lookalike

IPv4 breathes its last

The good news: every member of RIPE can get a /22. The bad news: you'll never get any more IPv4 allocations, ever.

Woodall Free Riding

or How to Cheat in the Irish Election

There's a way to exploit a minor security hole in the rules for counting votes in Ireland's general elections. It isn't new but for some reason it isn't fixed. The upshot is that if you know what to do, you can increase your voting power at the expense of some other voter without breaking the law.

It's called Woodall Free Riding, and it was discussed in an article by Markus Schulze in issue 18 of Voting Matters. It takes advantage of the following simplifications in Ireland's electoral law:

Where the votes credited to a candidate deemed to be elected whose surplus is to be transferred consist of original and transferred votes, or of transferred votes only, the returning officer shall examine the papers contained in the sub-parcel last received by that candidate and shall arrange the transferable papers therein in further sub-parcels according to the next available preferences recorded thereon.

(Section 121(3) of the Electoral Act, 1992; my emphasis.)

where:

“next available preference” means a preference which, in the opinion of the returning officer, is a second or subsequent preference recorded in consecutive order for a continuing candidate, the preferences next in order on the ballot paper for candidates already deemed to be elected or excluded being disregarded;

(Section 118 of the same Act; still my emphasis.)

This is unfair in two ways:

1. When a candidate is elected, the lottery which decides which ballot papers get to be transferred is biased. Only the ballot papers in the last received sub-parcel are considered for transfer. The original ballots, and all previous transfers, are unfairly disqualified from this lottery.
2. Whenever a ballot is transferred, but the next preference is for a candidate who has already been elected, then fairness demands that the transferred ballot be subjected to the same surplus-lottery as the other ballots for the elected candidate. But in Ireland's rules, the transferring vote moves on to the next preference 100% of the time, at the expense of the ballots that were in the lottery.

How you take advantage of this is simple: you give your #1 preference to a no-hoper, your #2 preference to your real #1, your #3 preference to your real #2, and so on.

Let's say that your real preferred candidate is Bicycle Repair Man, and that your selected no-hoper is Mr. Creosote. If you vote honestly, then Bicycle Repair Man gets your #1. If you engage in free-riding, then Mr. Creosote gets your #1 and Bicycle Repair Man gets your #2. Let's see how this changes the outcome.

First, consider the case where Bicycle Repair Man reaches the quota on the first count. If you vote honestly, your ballot paper has a small chance of being randomly selected for transfer as part of the surplus, but it has a large chance that it will sit idly in the Bicycle Repair Man pile. But if you vote #1 for Mr. Creosote, then your ballot paper will almost certainly transfer when he is eliminated — so you get your favourite guy elected and your vote continues on to your second choice. It's like getting a free extra vote.

The other case is where Bicycle Repair Man fails to reach the quota on the first count. If you vote honestly, then your ballot paper will never transfer anywhere, even if Bicycle Repair Man gets elected through transfers later. But if you vote #1 for Mr. Creosote, then your ballot paper will transfer to Bicycle Repair Man as soon as Mr. Creosote is eliminated. In that case, you're still helping your favourite to get elected, and your ballot paper has a good chance of transferring further (because it's now in Bicycle Repair Man's last received sub-parcel).

There is a small danger with this technique. If too many people pick the same candidate as their no-hoper, he might get elected! Mostly, however, it's worth the risk.

Lame duck mode

I'm quitting Google. I have a couple of offers already, but I'm looking for a promising Ireland-based startup that could benefit from having someone like me around. Who wants to interview an ex-SRE?

The Single Transferable Vote in four easy pieces

It wasn't long before pointy-haired talking heads appeared on the BBC to bad-mouth proportional representation. Here's a simple guide to explain proportional representation by the single transferable vote (the style mentioned in the UK Liberal Democrats' manifesto). It assumes that you're already familiar with plurality voting (first past the post) as it's practised in the UK and the USA.

Start with plurality voting. Each voter marks a ballot in support of a candidate, and the candidate with the most ballots wins.

First reform: If nobody gets 50%, eliminate the bottom candidate and try again.

If someone gets more than half the vote, they've won. But what happens when nobody gets there? In plurality voting, the candidate who's furthest ahead gets elected anyway — this can elect a massively unpopular candidate if the opposition is split among several candidates! In STV, when nobody gets enough votes to be elected, you eliminate the candidate with the fewest votes. Then you start all over again as if that candidate hadn't been on the ballot paper. You can think of this as getting your vote refunded to you so you can cast it again if the election didn't produce a proper result the first time.

Second reform: Preference voting.

It would be a major pain if everyone had to keep coming back day after day to vote again as candidates get eliminated. A much better idea is to get each voter to rank all the candidates in order of preference. That is, you mark a 1 (not an X) by the candidate you want to vote for, then you mark 2 by the candidate you'd vote for if your first preference was eliminated, then mark 3 by the candidate you'd vote for if 1 & 2 were both eliminated, and so on until you don't care any more. Now, when a candidate is eliminated, the ballot papers for that candidate can be re-examined so that each one is transferred to the voter's second choice. This is quick and simple to administer but it relies on voters' ability to write down a sequence of numbers in ascending order — a test failed by about 1% of voters in Ireland in every election.

So far, these two reforms have given us the Alternative Vote system, sometimes called the Instant Runoff Vote system. It eliminates the need for voters to hold their noses and vote for the lesser of two evils. Instead, you can cast your first-preference vote for a candidate you genuinely support, and use your second preference to arrange for your vote to transfer to someone who will probably have a chance of being elected. No more tactical voting, and you don't ever have to worry about wasting your vote on an also-ran. Now, let's do something about proportional representation.

Third reform: Multi-member constituencies.

Plurality voting systems are not proportional because everyone who didn't vote for the winner goes unrepresented in parliament. With only two parties (or an alternative-vote system) this can be up to 50% of the voters — in the UK, it's usually more. As a general rule, the more people are unrepresented, the more seats are disproportionately allotted to the larger parties. In STV, this fraction is kept low by returning 3–5 members of parliament from each constituency. This limits the unrepresented fraction to 17-25%, which is a great improvement.

To be elected in a 3-member constituency, you need to get over 25% of the vote. In a 4-member constituency, you need over 20%. In a 5-seater, you need more than 16 2/3%. The formula giving this winning threshold (called the quota) is 100% / (1 + number of seats). (There are variants that use different formulae, but I'm describing the simple system used in Ireland.)

Now you have several local MPs, and they have to compete with each other for voter approval throughout their term. They hate this. It's great.

Fourth reform: Transfer surplus votes.

This is the tricky bit. If a party gets 50% of the vote in a 4-seat constituency, they should win 2 of the seats if the result is to be proportional. But if one of their candidates gets 45% of the vote and the other gets 5%, it's unlikely that second candidate will get elected. This needs to be corrected.

The solution is to transfer elected candidates' surplus votes (the extra ones they had after reaching the quota) in the same way that eliminated candidates' votes are transferred. The trouble is this: which ballot papers get transferred, and which ones don't?

The simplest thing is to pick them randomly: if the quota is 10,000 votes and a candidate gets 12,000 votes, then 2,000 ballot papers are randomly chosen to be the lucky ones that are transferred as the surplus; the unlucky remainder sit out the rest of the election.

The best thing is to apply a fractional discount to the ballot papers and transfer them all. Using the same numbers, each of the 12,000 ballot papers would be marked (for example, with a sticker) to indicate that each one was worth only 1/6 of a vote, and they would all be transferred. Together their value is (12,000 × 1/6) votes, which equals 2,000 votes.

(In Ireland, we do something which is neither simple nor right. You probably don't want to know. If you really do want to know, search for last received subparcel and Woodall free riding.)

Recounting in this system is much simpler than you might imagine. As the count progresses and votes are transferred and discounted or sampled, the physical ballot papers are bundled and piled separately. Recounting means checking each bundle to make sure that it contains the number of papers it's supposed to and that it contains no miscategorized ballots — the rest is simple arithmetic.

There is some dispute over what should happen to transferred votes when the next preference is a candidate who has already been elected. It isn't important which exact system is used so long as those votes don't get a free onward transfer without being subject to the same discounting or random selection that the other ballots for that elected candidate had to suffer. (Ireland, again, does this wrong.)

One final warning about STV: If you end up with a government who ruins the economy, you can no longer blame your antiquated, easily-abused voting system. There is therefore no easy way to avoid the unpleasant conclusion that you got the government that you deserved, good and hard. Cognitive dissonance will keep people searching for a more palatable explanation, which might not be a healthy one for the nation.

PoS3

As an owner of a Sony Playstation 3 console and a user of the Playstation Store, I have recently joined the Registration of the trophy information could not be completed. The game will quit. (8001050F) club. When this first appeared, the system time reset to Dec 31 and a decade ago. Now I can't sign in to the Playstation Network or even run Assassin's Creed 2 (a game with no network features). Sadly, resetting the time manually and trying again didn't fix anything. Neither did disabling the Internet connection setting. So it looks like the major symptoms are not causes. Something else is broken.

The timing (2010/03/01) and the clock-reset have led to widespread speculation that it's a Y2.01K event, which seems plausible. It's reinforced by the news that this doesn't affect newer ("slim") PS3.

I have a horrible feeling that Sony is trying to put off confirming another rumour: that the clock-reset has tripped a DRM wire, and that the PS3s are now defying their rightful owners in the mistaken belief that we are all freeloaders. Part of me hopes this is the case, because it will be a large stake in the heart of this trespass-on-owner's-property DRM that has become popular in recent years. We might even get a judicial precedent out of it.

Another part of me just wishes the best of luck to my unknown colleagues in Sony who are doubtless trying desperately to save the product line. Good luck, guys.

Open link in Google Docs

Since hearing about the way to link to a page in Google's Document Viewer, I've been using it enough that I want a quick way to do it. So I added this to the end of the [Link Popup Menu] section in the menu/standard_menu (1).ini file that Opera created when I made a custom menu setup:

Item, "Open link in Google Docs"= Go to page, "http://docs.google.com/viewer?url=%l"

Very handy for browsing Government websites, where most of the useful information is hidden inside Word files.

Mark Coughlan on political donations in Ireland

This is a wonderful article, although the content is somewhat sickening. I can add this to my short list of political litmus tests, along with support for the Taoiseach's Eleven (e.g. pages 47-48 of the 2004 Report on Seanad Reform), the Voteless Dáil (moved by Mary Hanafin), and the Unnumbered Envelopes.

Job titles

During this morning's Leader's Questions in the Dáil, Éamon Gilmore accidentally coined the fortuitous phrase back bensioners, a portmanteau of back benchers and pensioners. Sadly, the official transcript only records his immediate correction of back benchers.

In case it isn't obvious: Government back benchers arrive in the Dáil chamber long enough to press a button according to the Chief Whip's direction. Once upon a time they would have insisted that they know what they're voting for, but that's untenable now that the Order of Business routinely include orders to have a single vote on whichever amendments a Minister wants.

So, Government backbenchers do no work but they continue to get paid well. Back bensioners indeed.

Simplified Software Process

After I raved a bit about the joy of test-driven development, a coworker pointed me at this tongue-in-cheek review, and I nearly ruined my keyboard when Figure 3 loaded.

Performance-based rewards considered harmful

One of this year's TED talks was seriously counterintuitive but extremely well-founded. Dan Pink's talk on extrinsic and intrinsic motivation illustrates the scientific conclusions that high financial incentives for success increase the length of time taken to solve a cognitive problem.

The research establishing this result is clearly referenced (“Large stakes and big mistakes” and “Incentives, Decision Frames, and Motivation Crowding Out — An Experimental Investigation”). The implications are huge: higher bonuses don't lead to higher performance when the problem is nontrivial (don't tell your local bean-counter). Pink's alternative motivators (autonomy, mastery and purpose) aren't as well-founded, but they have a certain intuitive appeal.

Dutiful plug: Google Code University

Google has collected and published a compendium of useful computer science courseware, and given it the slightly dramatic name of Google Code University. I normally avoid plugging my employer's various offerings, mainly because there's no way to be unbiased about it. But after the disappointment of Open Courseware, this actually looks useful.

(Not that Open Courseware doesn't deliver a lot, by the way. It just promises far, far more.)

code.google.com/edu seems to have substantial content for each title, and (with the possible exception of the occasional Powerpoint data file) the content looks pretty good. I'd have found that stuff useful during the summer before I started college. Even when you correct for the fact that most ef it hadn't been invented way back in 1990.

Socializing the Weather

I came back to Ireland from the US in 2000, and was immediately disappointed by the weather service. I don't mean the perpetual overcast (though I was also disappointed to see I hadn't imagined it after all). I mean the way Met Éireann tries to sell the forecast information it compiles, in spite of the fact that it is paid by the taxpayer to do its work — it is part of the Department of Environment, Heritage and Local Government.

In the US, the forecasts are similarly funded but then they're made publicly available. They're on the NOAA website; they're broadcast regularly on dedicated radio channels, and (if you're a pilot planning a flight) you can even make a free call to 1-800-WX-BRIEF and get a customized in-person professional weather briefing. My favourite was the technical brief which gave fascinating insights into the levels of certainty of the forecast.

Now look at Ireland's Met Éireann. The most detailed forecast available from their website (a site which is useless without Javascript, by the way) is actually less detailed than the text on Aertel page 161. There's a phone service too, but it's a premium-rate telephone number, and I suspect it's a prerecorded message rather than an in-person briefing (and no, I won't pay to find out). For pilots, there are Self Briefing Units installed at major airports — no trained weather briefers for you, and you're SOL if you want a briefing when not at one of those places.

In the US, this would be a hideously-embarrassing way to run a government service. It indicates inadequate funding without implying cost controls, and it combines the inefficiency of the government budgetary process with the costs of collecting money from service users and of investing in measures to stop those users getting that service for free.

And it's all for nothing, because the information is quickly exported and aggregated with the free information available in the rest of the world. A search for [eidw taf] (even on the Bing engine) immediately shows links to places like all met sat which not only report the current Terminal Area Forecast, they decode it into English so you don't even need the TAF Decoder Ring.

Ha, ha, etc.

Aughts, Teens, Twenties, Thirties, ...

It really annoys me to hear people refer to this decade as “the noughties”. Even the BBC, who should know better.

I recall seeing recorded interviews with some right old codgers who talked about “the aughts” and “the teens”, meaning the first decades of the 20th century. These are good solid woody words. There's no reason to resort to inferior neologisms.

However, by the end of this year, I fully expect to sit nervously twitching as otherwise-sensible people look forward to the Teenies, or the Tenties, or the Naughtiers, or something equally saccharine and unforgiveable.

By the way, if you got here by searching for [naughty teens], then I'm sorry. As a sort of apology, please accept this link to a popular destination for [coprophagia video].

Leaving Cert English selected answers

The themes in Macbeth are juicy and addictive like opal fruits with nicotine.

Some of the most appalling prose (and, rarely, some of the most appealing) is making the rounds in the form of the smuggled answers to Leaving Cert English papers from this year.

Plug: a Browser Security Handbook

My employer has published a Browser Security Handbook advising authors of web applications about the various security risks involved, a subject that is ridiculously complex. Yay.

POSIX time_t is not UTC

For years, I've been pretending that time_t is a better representation of time than any combination of year, month, day, etc. That's because it's a linear representation of time that can be subjected to arithmetic. In particular, it's monotonically increasing.

Well, that's not true on POSIX systems. On POSIX, time_t is said to be based on UTC, but it ignores leap seconds! Considering that UTC is defined as TAI minus accumulated leap seconds, that's one giant opt-out.

The official line (from SuS v3) on leap seconds is "applications which do care about leap seconds can determine how to handle them in whatever way those applications feel is best". OK, quick question: your application, which cares about leap seconds, calls time() and gets 915148800; what time is it? If you need to know, you're out of luck; compliant POSIX systems stepped their clocks back a second during the leap second. If you have a drug-delivery system that's based on POSIX, don't use it if a second's too much drug will harm the patient.

In fact, POSIX time_t is an encoding of a Gregorian calendar time (year, month, day, hour, minute, second). The POSIX committee considers it more important that time_t is consistent between machines, than that it should be correct. Consequently, the description in the man pages and standards of time_t as "seconds since the Epoch" is a lie.

It violates POSIX to set your system clock to return the actual number of seconds since 1970-01-01T00:00:00Z! Right now (2008-12-05) it should be the number of seconds since 1970-01-01T00:00:23Z; from the start of 2009 it should be the number of seconds since 1970-01-01T00:00:24Z. If you try to use difftime to compare a time from 2008 with a time from 2009, you'll get the right answer minus one.

This is clearly crazy. If you want to ignore leap-seconds, use TAI and accept the drift. If you want to ignore leap-seconds but stay close to UTC, stick to year/month/day/hour/minute/second (i.e. struct tm). If you want accurate intervals and not necessarily accurate calendar times, use a monotonically-increasing count of seconds since some definite time in the past. Unix made its choice clearly and precisely; POSIX is wrong to change it, and STUPID BAD WRONG to change it while pretending it's the same.

[Edited: I had the wrong offsets in the fifth paragraph.]

[Update: Someone pointed me at an old message titled History of IEEE P1003.1 POSIX time which explains a lot.

Crayon Physics

The most awesome game ever.

Security Excuse Bingo