and St Pancras Station Unveils Its Christmas Tree - And It's Wicked By londonist.com Published On :: Mon, 04 Nov 2024 12:29:00 +0000 A fir tree in fairytale form. Full Article London Things To Do Christmas in London St Pancras Station christmas tree CHRISTMAS 2024
and Free And Cheap Things To Do This Week In London: 4-10 November 2024 By londonist.com Published On :: Mon, 04 Nov 2024 12:30:05 +0000 Things to do for a fiver or less. Full Article London Free & Cheap free and cheap events free and cheap LONDON ON A BUDGET FREE AND CHEAP LISTINGS
and Warm Your Cockles At London's Best Winter And Christmas Pop-Up Bars By londonist.com Published On :: Tue, 05 Nov 2024 10:00:00 +0000 Igloos, rooftops and ski lodges. Full Article London Drink Christmas in London Food & Drink cocktails rooftop bars Winter christmas Drinks POP UPS CHRISTMAS 2024
and Where To Dine And Drink In An Igloo In London This Winter By londonist.com Published On :: Wed, 06 Nov 2024 09:54:00 +0000 Book riverside igloos and rooftop domes for your festive socialising. Full Article London Christmas in London bars rooftop bars restaurants christmas Christmas Party christmas in London London Restaurants COPPA CLUB GLOBES IGLOOS WINTER IGLOOS CHRISTMAS IGLOOS SNOW GLOBES DOMES COPPA CLUB TOWER BRIDGE COPPA CLUB IGLOOS 2024 WINTER 2023 IGLOO RESTAURANTS CHRISTMAS 2024 WINTER 2024 ROOFTOP IGLOOS RESTAURANT IGLOOS
and Christmas Shows In London 2024: Fantastically Festive Theatre, Dance And Comedy By londonist.com Published On :: Fri, 08 Nov 2024 09:30:00 +0000 Nutcrackers, Snowmen... and A Very Naughty Christmas. Full Article London On Stage Christmas in London christmas nutcracker la clique the snowman christmas shows Christmas theatre christmas in London LONDON AT CHRISTMAS CHRISTMAS THEATRE SHOWS CHRISTMAS 2024
and Why Does The City Of London Cross Some Bridges And Not Others? By londonist.com Published On :: Sat, 09 Nov 2024 10:00:03 +0000 Boundary anomalies, ahoy! Full Article London Maps bridges maps City Bridge Trust
and Free And Cheap Things To Do In London This Week: 11-17 November 2024 By londonist.com Published On :: Mon, 11 Nov 2024 12:30:06 +0000 Things to do for a fiver or less. Full Article London Free & Cheap free and cheap events free and cheap LONDON ON A BUDGET
and Trollied: London's Obsession With Meals (And Drinks) On Wheels By londonist.com Published On :: Tue, 12 Nov 2024 07:51:10 +0000 "Clang clang clang went the trolley..." Full Article London Food & Drink Features Opinion TROLLEY MARTINI TROLLEY CHEESE TROLLEY
and Hyde Park Winter Wonderland 2024: A Guide To Visiting London's Huge Christmas Festival By londonist.com Published On :: Wed, 13 Nov 2024 10:12:02 +0000 When to go, what to see and how to save money. Full Article London Christmas in London Winter Wonderland christmas in London HYDE PARK WINTER WONDERLAND LONDON AT CHRISTMAS WINTER WONDERLAND HYDE PARK WINTER WONDERLAND TICKETS WINTER WONDERLAND MAP 2024 CHRISTMAS 2024
and Sky and Now team up with Dogs Trust for pop up Bonfire Night channel By www.shinyshiny.tv Published On :: Fri, 25 Oct 2024 15:27:40 +0000 Nearly half of all dogs are affected by Bonfire Night displays, with 45% of owners saying their dog is not calm when they can hear fireworks Sky and NOW have […] The post Sky and Now team up with Dogs Trust for pop up Bonfire Night channel appeared first on ShinyShiny. Full Article Pets Bonfire Night dogs pets
and Spanish brands triumph in Which? rankings of international hotels By www.shinyshiny.tv Published On :: Wed, 06 Nov 2024 00:01:12 +0000 A new Which? survey of the best and worst international hotel brands shows well-known brands languishing near the bottom of the table, as three Spanish-owned chains take joint top spot. […] The post Spanish brands triumph in Which? rankings of international hotels appeared first on ShinyShiny. Full Article Holidays Tech holiday hotels Iberostar
and VW and Rivian launch joint venture, Elon Musk to lead ‘DOGE’ By www.shinyshiny.tv Published On :: Wed, 13 Nov 2024 11:24:59 +0000 Volkswagen Group (VW) and Tesla rival Rivian have launched a joint venture, with the German car giant increasing its investment in the partnership. The two companies say the deal is […] The post VW and Rivian launch joint venture, Elon Musk to lead ‘DOGE’ appeared first on ShinyShiny. Full Article News Tech DOGE Elon Musk Rivian VW
and ...And Now For Something Completely Different By belledejour-uk.blogspot.com Published On :: Mon, 11 Jul 2011 19:45:00 +0000 This is not about sex, and not about The Sex Myth. This is about the old blog, and the growing scandal in News International's paper the rules they played by. And as Prince Humperdinck so eloquently put it, I always think everything could be a trap.Very early on in blogging as Belle de Jour, I had an email address associated with the blog. It was with one of those free email providers and not very secure. Later, I wised up a touch and moved to doing everything through Hushmail. But for some reason I kept the old email up and running, and checked it occasionally.So on the day of the book's release in the UK, I logged on to a public library computer in Clearwater, Florida, and had a look at that old account. There was a new message from someone I didn't recognise. I opened it.The message was from a journo at the Sunday Times. It was short, which struck me as unusual: Come on Belle, not even a little hint? There was an attachment. The attachment started downloading automatically (then if I remember correctly, came up with a "failed to download" message).My heart sank - my suspicion was that there had been a program attached to the message, some sort of trojan, presumably trying to get information from my computer.Now, I understood the papers regarded all of this as a game. There were accusations that the anonymity thing was a ruse to pump sales. It wasn't. I was really afraid of losing my job and my career if found out. But I knew the rules they played by. And as Prince Humperdinck so eloquently put it, I always think everything could be a trap.I did several things:1. Alerted library staff that I thought there had been a virus downloaded on to the computer, so they could deal with it.2. Phoned a friend who knew my secret. I explained what happened. He agreed to log in to that email account from where he lived, halfway around the world, open the email and send a reply, so they would have competing IP address information.3. Alerted the man who owned the .co.uk address pointing to my blog, someone called Ian (who to my knowledge I have never met). He confirmed he had been contacted by the Times and asked if I was indeed in Florida. He told them he didn't know (which was true).Point 3 is the part that makes me think my suspicions were correct. I hadn't replied to the message from the computer in Florida, so why would they have a Florida IP address? They did get a reply from "my" account, but it would have had an IP address from Australia.(It's been suggested on Twitter that this could also have been because of a read receipt or embedded images. However, if my memory serves - and it usually does - the service I used did not send read receipts and I had images/HTML off as a matter of habit. There could of course be other explanations for what happened, but it is certainly true that the Times were trying hard to find me. Thanks for the comments, I hope this answers any concerns.) Full Article
and The Sex Myth: extract and first interview By belledejour-uk.blogspot.com Published On :: Fri, 13 Apr 2012 15:05:00 +0000 The Telegraph have now printed an extract and the first interview about The Sex Myth. Positively chuffed to see "be an ally" in print. (Especially on Friday the 13th, which is fast becoming the date when sex work allies are urged to speak out.)If you'd like to find out more about the book, and would like your copy of The Sex Myth signed, why not join me in London or Nottingham next week? Full Article interview writing
and How To Blog Anonymously (and how not to) By belledejour-uk.blogspot.com Published On :: Thu, 10 May 2012 08:00:00 +0000 Further to yesterday's post, this is a list of thoughts prompted by a request from Linkmachinego on the topic of being an anonymous writer and blogger. Maybe not exactly a how-to (since the outcome is not guaranteed) as a post on things I did, things I should have done, and things I learned.It's not up to me to decide if you "deserve" to be anonymous. My feeling is, if you're starting out as a writer and do not yet feel comfortable writing under your own name, that is your business and not mine. I also think sex workers should consider starting from a position of anonymity and decide later if they want to be out, please don't be naive. Statistics I made up right now show 99 out of 100 people who claim 'if you have nothing to hide you have nothing to fear' are talking out of their arses.The items in the list fall into three general categories: internet-based, legal and real-world tips, and interpersonal. Many straddle more than one of these categories. All three are important.This is written for a general audience because most people who blog now do not have extensive technical knowledge, they just want to write and be read. That's a good thing by the way. If you already know all of this, then great, but many people won't. Don't be sneery about their lack of prior knowledge. Bringing everyone up to speed on the technology is not the goal: clear steps you can use to help protect your identity from being discovered are.Disclaimer: I'm no longer anonymous so these steps are clearly not airtight. Also there are other sources of information on the Web, some of which are more comprehensive and more current than my advice. I accept no responsibility for any outcome of following this advice. Please don't use it to do illegal or highly sensitive things. Also please don't use pseudonyms to be a dick. This is also a work in progress. As I remember things or particular details, I'll amend this post. If you have suggestions of things that should be added, let me know.1. Don't use Gmail, Yahoo, Hotmail et al. for your mail.You will need an email address to do things like register for blog accounts, Facebook, Twitter, and more. This email will have to be something entirely separate from your "real" email addresses. There are a lot of free options out there, but be aware that sending an email from many of them also sends information in the headers that could help identify you.When I started blogging, I set up an email address for the blog with Hotmail. Don't do this. Someone quickly pointed out the headers revealed where I worked (a very large place with lots of people and even more computers, but still more information than I was comfortable with). They suggested I use Hushmail instead, which I still use. Hushmail has a free option (though the inbox allocation is modest), strips out headers, and worked for me.A caveat with this: if you are, say, a sex worker working in a place where that is not legal and using Hushmail, you could be vulnerable to them handing over your details to a third party investigating crimes. If you're handling information some governments might consider embarrassing or sensitive, same. Google some alternatives: you're looking for something secure and encrypted.There are a few common-sense tips you can follow to make it even safer. If you have to bring people you know in real life in on the secret, don't use this email address for communicating with them even if only about matters related to your secret (and don't use your existing addresses for that either). Example: I have one address for press and general interactions, one for things related to my accountant and money, and one for communicating with my agent, publisher, and solicitor. I've also closed and opened new accounts over the years when it seems "too many" people are getting hold of a particular address. Use different passwords for each, don't make these passwords related to your personal information, and so on.I unwisely left the Hotmail address going, and while I did not use it to send mail, I continued to read things that arrived there. That led to this failed attempt by the Sunday Times to out me. It was an easily dodged attempt but something I would have preferred to avoid.People can and do register internet domains while staying anonymous but I never did. Some people registered domains for me (people I didn't know in person). This led to a couple of instances of them receiving harassment when the press suspected they were me. In particular Ian Shircore got a bit of unwanted attention this way. Because all I was ever doing was a straight-up blog, not having a registered domain that I had control over was fine. Your needs may be different. I am not a good source for advice on how to do that. But just in case you might be thinking "who would bother looking there?" read about how faux escort Alexa DiCarlo was unmasked. This is what happens when you don't cover your tracks.2. Don't use a home internet connection, work internet connection, etc.Email won't be the only way you might want to communicate with people. You may also want to leave comments on other blogs and so forth. Doing this and other ways of using the Web potentially exposes your IP address, which could be unique and be used to locate you.Even if you don't leave comments just visiting a site can leave traces behind. Tim Ireland recently used a simple method to confirm his suspicion of who the "Tabloid Troll" twitter account belonged to. By comparing the IP address of someone who clicked on to a link going to the Bloggerheads site with the IP address of an email Dennis Rice sent, a link was made. If you go to the trouble of not using your own connection, also make sure you're not using the same connection for different identities just minutes apart. Don't mix the streams.The timing of everything as it happened was key to why the papers did not immediately find out who I was. The old blog started in 2003, when most press still had to explain to their audience what a blog actually was. It took a while for people to notice the writing, so the mistakes I made early on (blogging from home and work, using Hotmail) had long been corrected by the time the press became interested.Today, no writer who aims to stay anonymous should ever assume a grace period like that. It also helped that once the press did become interested, they were so convinced not only that Belle was not really a hooker but also that she was one of their own - a previously published author or even journalist - that they never looked in the right place. If they'd just gone to a London blogmeet and asked a few questions about who had pissed off a lot of people and was fairly promiscuous, they'd have had a plausible shortlist in minutes.After I moved from Kilburn to Putney, I was no longer using a home internet connection - something I should have done right from the beginning. I started to use internet cafes for posting and other activities as Belle. This offers some security... but be wary of using these places too often if there is a reason to think someone is actively looking for you. It's not perfect.Also be wary if you are using a laptop or other machine provided by your workplace, or use your own laptop to log in to work servers ("work remotely"). I've not been in that situation and am not in any way an expert on VPNs, but you may want to start reading about it here and do some googling for starters. As a general principle, it's probably wise not to do anything on a work laptop that could get you fired, and don't do anything that could get you fired while also connected to work remotely on your own machine.3. There is software available that can mask your IP address. There are helpful add-ons that can block tracking software.I didn't use this when I was anonymous, but if I was starting as an anonymous blogger now, I would download Tor and browse the Web and check email through their tools.If you do use Tor or other software to mask your IP address, don't then go on tweeting about where your IP address is coming from today! I've seen people do this. Discretion fail.I also use Ghostery now to block certain tracking scripts from web pages. You will want to look into something similar. Also useful are Adblocker, pop-up blockers, things like that. They are simple to download and use and you might like to use them anyway even if you're not an anonymous blogger. A lot of sites track your movements and you clearly don't want that.4. Take the usual at-home precautions.Is your computer password-protected with a password only you know? Do you clear your browser history regularly? Use different passwords for different accounts? Threats to anonymity can come from people close to you. Log out of your blog and email accounts when you're finished using them, every time. Have a secure and remote backup of your writing. Buy a shredder and use it. Standard stuff.Another thing I would do is install a keystroke logger on your own machine. By doing this I found out in 2004 that someone close to me was spying on me when they were left alone with my computer. In retrospect what I did about it was not the right approach. See also item 7.5. Be careful what you post. Are you posting photos? Exif data can tell people, among other things, where and when a picture was taken, what it was taken with, and more. I never had call to use it because I never posted photos or sound, but am told there are loads of tools that can wipe this Exif data from your pictures (here's one).The content of what you post can be a giveaway as well. Are you linking to people you know in real life? Are you making in-jokes or references to things only a small group of people will know about? Don't do that.If possible, cover your tracks. Do you have a previous blog under a known name? Are you a contributor to forums where your preferred content and writing style are well-known? Can you edit or delete these things? Good, do that.Personally, I did not delete everything. Partly this was because the world of British weblogging was so small at the time - a few hundred popular users, maybe a couple thousand people blogging tops? - that I thought the sudden disappearance of my old blog coinciding with the appearance of an unrelated new one might be too much of a coincidence. But I did let the old site go quiet for a bit before deleting it, and edited archived entries.Keep in mind however that The Wayback Machine means everything you have written on the web that has been indexed still exists. And it's searchable. Someone who already has half an idea where to start looking for you won't have too much trouble finding your writing history. (UPDATE: someone alerted me that it's possible to get your own sites off Wayback by altering the robots.txt file - and even prevent them appearing there in the first place - and to make a formal request for removal using reasons listed here. This does not seem to apply to sites you personally have no control over unless copyright issues are involved.) If you can put one more step between them and you... do it.6. Resist temptation to let too many people in.If your writing goes well, people may want to meet you. They could want to buy you drinks, give you free tickets to an opening. Don't say yes. While most people are honest in their intentions, some are not. And even the ones who are may not have taken the security you have to keep your details safe. Remember, no one is as interested in protecting your anonymity as you will be.Friends and family were almost all unaware of my secret - both the sex work and the writing. Even my best friend (A4 from the books) didn't know. I met very few people "as" Belle. There were some who had to meet me: agent, accountant, editor. I never went to the Orion offices until after my identity became known. I met Billie Piper, Lucy Prebble, and a couple of writers during the pre-production of Secret Diary at someone's house, but met almost no one else involved with the show. Paul Duane and Avril MacRory met me and were absolutely discreet. I went to the agent's office a few times but never made an appointment as Belle or in my real name. Most of the staff there had no idea who I was. Of these people who did meet me almost none knew my real name, where I lived, where I was from, my occupation. Only one (the accountant) knew all of that - explained below under point 9. And if I could have gotten away with him never seeing a copy of my passport, I damn well would have done.The idea was that if people don't know anything they can't inadvertently give it away. I know that all of the people listed above were absolutely trustworthy. I still didn't tell them anything a journalist would have considered useful.When I started blogging someone once commented that my blog was a "missed opportunity" because it didn't link to an agency website or any way of booking my services. Well, duh. I didn't want clients to meet me through the blog! If you are a sex worker who wants to preserve a level of pseudonymity and link your public profile to your work, Amanda Brooks has the advice you need. Not me.Other sources like JJ Luna write about how to do things like get and use credit cards not tied to your name and address. I've heard Entropay offer 'virtual' credit cards that are not tied to your credit history, although they can't be used with any system that requires address verification. This could be useful even for people who are not involved in sex work.Resisting temptation sometimes means turning down something you'd really like to do. The short-term gain of giving up details for a writing prize or some immediate work may not be worth the long-term loss of privacy. I heard about one formerly anonymous blogger who was outed after giving their full name and address to a journalist who asked for it when they entered a competition. File under: how not to stay anonymous.7. Trust your intuition.I have to be careful what I say here. In short, my identity became known to a tabloid paper and someone whom I had good reason not to trust (see item 4) gave them a lot of information about me. When your intuition tells you not to trust someone, LISTEN TO IT. The best security in the world fails if someone props open a door, leaves a letter on the table, or mentally overrides the concern that someone who betrayed you before could do so again. People you don't trust should be ejected from your life firmly and without compromise. A "let them down easy" approach only prolongs any revenge they might carry out and probably makes it worse. The irony is that as a call girl I relied on intuition and having strong personal boundaries all the time... but failed to carry that ability over into my private life. If there is one thing in my life I regret, the failure to act on my intuition is it. As an aside if you have not read The Gift of Fear already, get it and read it.See also point 9: if and when you need people to help you keep the secret don't make it people already involved in your private life. Relationships can cloud good judgement in business decisions.There is a very droll saying "Two people can keep a secret if one of them is dead." It's not wrong. I know, I know. Paranoid. Hard not to be when journos a few years later are digging through the rubbish of folks who met you exactly once when you were sixteen. Them's the breaks.8. Consider the consequences of success.If you find yourself being offered book deals or similar, think it through. Simply by publishing anonymously you will become a target. Some people assume all anonymous writers "want" to be found, and the media in particular will jump through some very interesting hurdles to "prove" anything they write about you is in the public interest.In particular, if you are a sex worker, and especially if you are a sex worker who is visible/bookable through your site, please give careful consideration to moving out of that sphere. Even where sex for money is legal it is still a very stigmatised activity. There are a number of people who do not seem to have realised this, and the loss of a career when they left the "sex-pos" bubble was probably something of a shock. I'm not saying don't do it - but please think long and hard about the potential this has to change your life and whether you are fully prepared to be identified this way forever. For every Diablo Cody there are probably dozens of Melissa Petros. For every Melissa Petro there are probably hundreds more people with a sex industry past who get quietly fired and we don't ever hear from them.If I knew going in to the first book deal what would happen, I probably would have said no. I'm glad I didn't by the way - but realistically, my life was stressful enough at that point and I did not fully understand what publishing would add to that. Not many bloggers had mainstream books at that point (arguably none in the UK) so I didn't have anyone else's experience to rely on. I really had no idea about what was going to happen. The things people wrote about me then were mainly untrue and usually horrendous. Not a lot has changed even now. I'd be lying if I said that didn't have an emotional effect.Writing anonymously and being outed has happened often enough that people going into it should consider the consequences. I'm not saying don't do it if you risk something, but be honest with yourself about the worst possible outcome and whether you would be okay with that.9. Enlist professional help to get paid and sign contracts.Having decided to write a book, I needed an agent. The irony of being anonymous was that while I let as few people in on it as possible, at some point I was going to have to take a leap of faith and let in more. Mil Millington emailed me to recommend Patrick Walsh, saying he was one of the few people in London who can be trusted. Mil was right.Patrick put me on to my accountant (who had experience of clients with, shall we say, unusual sources of income). From there we cooked up a plan so that contracts could be signed without my name ever gracing a piece of paper. Asking someone to keep a secret when there's a paper trail sounds like it should be possible but rarely is. Don't kid yourself, there is no such thing as a unbreakable confidentiality agreement. Asking journalists and reviewers to sign one about your book is like waving a red rag to a bull. What we needed was a few buffers between me and the press.With Patrick and Michael acting as directors, a company was set up - Bizrealm. I was not on the paperwork as a director so my name never went on file with Companies House. Rather, with the others acting as directors, signing necessary paperwork, etc., Patrick held a share in trust for me off of which dividends were drawn and this is how I got paid. I may have got some of these details wrong, by the way - keep in mind, I don't deal with Bizrealm's day-to-day at all.There are drawbacks to doing things this way: you pay for someone's time, in this case the accountant, to create and administer the company. You can not avoid tax and lots of it. (Granted, drawing dividends is more tax-efficient, but still.) You have to trust a couple of people ABSOLUTELY. I'd underline this a thousand times if I could. Michael for instance is the one person who always knew, and continues to know, everything about my financial and personal affairs. Even Patrick doesn't know everything.There are benefits though, as well. Because the money stays mainly in the company and is not paid to me, it gets eked out over time, making tax bills manageable, investment more constant, and keeping me from the temptation to go mad and spend it.I can't stress enough that you might trust your friends and family to the ends of the earth, but they should not be the people who do this for you. Firstly, because they can be traced to you (they know you in a non-professional way). Secondly, because this is a very stressful setup and you need the people handling it to be on the ball. As great as friends and family are that is probably not the kind of stress you want to add to your relationship. I have heard far too many stories of sex workers and others being betrayed by ex-partners who knew the details of their business dealings to ever think that's a good idea.So how do you know you can trust these people? We've all heard stories of musicians and other artists getting ripped off by management, right? All I can say is instinct. It would not have been in Patrick's interest to grass me, since as my agent he took a portion of my earnings anyway, and therefore had financial as well as personal interest in protecting that. If he betrayed me he would also have suffered a loss of reputation that potentially outweighed any gain. Also, as most people who know him will agree, he's a really nice and sane human being. Same with Michael.If this setup sounds weirdly paranoid, let me assure you that journalists absolutely did go to Michael's office and ask to see the Bizrealm paperwork, and Patrick absolutely did have people going through his bins, trying to infiltrate his office as interns, and so on. Without the protection of being a silent partner in the company those attempts to uncover me might have worked.I communicate with some writers and would-be writers who do not seem to have agents. If you are serious about writing, and if you are serious about staying anonymous, get an agent. Shop around, follow your instinct, and make sure it's someone you can trust. Don't be afraid to dump an agent, lawyer, or anyone else if you don't trust them utterly. They're professionals and shouldn't take it personally.10. Don't break the (tax) law.Journalists being interested in your identity is one thing. What you really don't want is the police or worse, the tax man, after you. Pay your taxes and try not to break the law if it can be helped. If you're a sex worker blogging about it, get an accountant who has worked with sex workers before - this is applicable even if you live somewhere sex work is not strictly legal. Remember, Al Capone went down for tax evasion. Don't be like Al. If you are a non-sex-work blogger who is earning money from clickthroughs and affiliates on your site, declare this income.In summer 2010 the HMRC started a serious fraud investigation of me. It has been almost two years and is only just wrapping up, with the Revenue finally satisfied that not only did I declare (and possibly overdeclare) my income as a call girl, but that there were no other sources of income hidden from them. They have turned my life and financial history upside down to discover next to nothing new about me. This has been an expensive and tedious process. I can't even imagine what it would have been like had I not filed the relevant forms, paid the appropriate taxes, and most of all had an accountant to deal with them!Bottom line, you may be smart - I'm pretty good with numbers myself - but people whose job it is to know about tax law, negotiating contracts, and so on will be better at that than you are. Let them do it. They are worth every penny.11. Do interviews with care.Early interviews were all conducted one of two ways: over email (encrypted) or over an IRC chatroom from an anonymising server (I used xs4all). This was not ideal from their point of view, and I had to coach a lot of people in IRC which most of them had never heard of. But again, it's worth it, since no one in the press will be as interested in protecting your identity as you are. I hope it goes without saying, don't give out your phone number.12. Know when les jeux sont faits.In November 2009 - 6 years after I first started blogging anonymously - my identity was revealed. As has been documented elsewhere, I had a few heads-ups that something was coming, that it was not going to be nice, and that it was not going to go away. We did what we could to put off the inevitable but it became clear I only had one of two choices: let the Mail on Sunday have first crack at running their sordid little tales, or pre-empt them. While going to the Sunday Times - the same paper that had forcibly outed Zoe Margolis a few years earlier, tried to get my details through that old Hotmail address, and incorrectly fingered Sarah Champion as me - was perhaps not the most sensitive choice, it was for me the right move. Patrick recommended that we contact an interviewer who had not been a Belle-believer: if things were going to be hard, best get that out of the way up front.So that is that. It's a bit odd how quickly things have changed. When I started blogging I little imagined I would be writing books, much less something like this. Being a kind of elder statesman of blogging (or cantankerous old grump if you prefer) is not an entirely comfortable position and one that is still new to me. But it is also interesting to note how little has changed: things that worked in the early 2000s have value today. The field expanded rapidly but the technology has not yet changed all that much.As before, these ideas do not constitute a foolproof way to protect your identity. All writers - whether writing under their own names or not - should be aware of the risks they may incur by hitting 'publish'. I hope this post at least goes some way to making people think about how they might be identified, and starts them on a path of taking necessary (and in many cases straightforward) precautions, should they choose to be anonymous. Full Article anonymity blogging twitter
and Why Scotland should not make sex work illegal By belledejour-uk.blogspot.com Published On :: Mon, 18 Jun 2012 09:14:00 +0000 UPDATE: MSPs have voted that Grant's bill will have to go to consultation and will not be fast-tracked. Which is good news. But the fight is not over, and expect more to come when the consultation hits. At the same time that the Moratorium 2012 campaign kicks off in London, spearheading a common-sense approach to sex work, there appears a bid in Scotland to try to make prostitution illegal. Just to recap: soliciting, running a brothel, and kerb crawling are already illegal (as too are trafficking and sexual exploitation of children). Exchanging sex for money at this point is not. Not yet. Labour MSP Rhoda Grant claims "Scotland should become an unattractive market for prostitution and therefore other associated serious criminal activities, such as people trafficking for sexual exploitation, would be disrupted." Grant is, unfortunately, badly informed and wrong. I'm going to keep this one short and sweet because the points are pretty straightforward... Scotland does not have a sex trafficking epidemic Sex trafficking is the excuse frequently given these days to harass and criminalise sex workers. Problem is, it's not remotely the "epidemic" they would have you believe. If you're not already up to speed on the whys and wherefores, I highly recommend reading Laura Agustin's work on this. Or if I may be so cheeky to suggest you could also buy my book. Specifically, it is not happening in Scotland. “In Scotland, to the best of my knowledge, we don't have a conviction for human trafficking,” said police constable Gordon Meldrum. Meldrum had previously claimed research “proved” the existence of 10 human trafficking groups north of the border, and 367 organised crime groups with over 4000 members. “We had one case which was brought to court previously but was abandoned. My understanding is it was abandoned due to a lack of evidence, essentially.” Strange how the evidence seemed to disappear precisely when someone was asked to produce all these fantasy baddies, isn't it? It's not only Scotland where the trafficking hype falls flat though: investigation throughout the UK has comprehensively failed to find any supposed sex trafficking epidemic. Not convinced by the evidence? Then consider this: criminalising sex workers and their clients removes the most reliable information sources police have for investigating abuses. Police don't have a great track record on this: In interviews by the Sex Workers Project with 15 trafficking survivors who experienced police raids, only one had been asked by law enforcement if she was coerced, and only after she was arrested. SWOP-NYC make this case clearly. Criminalising sex work has been shown in Scotland to make criminal activity worse Criminalisation has all kinds of effects on the behaviour of sex workers, but unfortunately, none of those effects are good. Fear of police forces sex workers to get into clients’ cars quickly, and possibly be unable to avoid dangerous attackers posing as clients. When vigilantes and police roam the pavements, sex workers wait until the wee hours to come out, making them more isolated and vulnerable to harm. Such an approach can also result in a transfer of activity from streetwalking to other ways of getting money. High-profile crackdown results in repeated arrests of prostitutes, which translate to fines that sex workers, now burdened with criminal records, are unable to pay except by more prostitution or by fraud, shoplifting, and dealing drugs. Take Aberdeen, for instance. From 2001 onward, the city had an established tolerance zone for sex workers around the harbour. That ended with passage of the Prostitution (Public Places) (Scotland) Act in 2007. In the following months the city centre experienced an influx of streetwalkers and an increase in petty crimes. Quay Services, which operates a drop-in centre for streetwalkers, reported that sex workers became more afraid to seek assistance, and the number of women coming to the centre dropped to “just a handful”. There was also evidence that displacing sex workers led to more activity in the sex trade, not less – convictions for solicitation tripled. This kind of ‘crime shuffling’ takes prostitution out of one area and dumps it on another. It only resembles an improvement if you fail to look at the full picture. Prohibition never works There is a lot of talk in the political sphere about the need for “evidence based policy”. This means rejecting approaches that are moralistic and manipulative. Sex workers have suffered the tragic consequences of prejudicial social attitudes that lead to bad policy. The prohibition approach has not worked. It will never work. The people who endorse this view are putting people in danger and should not be guiding public opinion any longer. Disliking sex work is not a good enough argument to justify criminalising it. Is there any public interest served by preventing adults from engaging in a consensual transaction for sexual services? No, there is not. Bit like the war on drugs: making the business profitable only to criminals, awaiting the inevitably grim results, then claiming that it’s the drugs themselves, not the laws, wot caused it. Few reasonable people believe that line of argument when it comes to drugs. Why does anyone believe it when it comes to sex? Moral disapproval is a bad basis for policymaking. I don't find the idea of taking drugs at all appealing, but I don't assume my own preferences should be the basis for law. The condescension heaped on people who do sex work is embarrassingly transparent. All this mealy-mouthed, 'oh but we want to help them, really’. How’s that again? By saddling people with criminal records and taking away their children? Do me a favour. As well as the happy prostitutes there are unhappy sex workers in need of support. Society should protect the unwilling and underage from sexual exploitation and provide outreach for those who need and want it. We already have laws and services for that. Maybe the laws should be more intelligently enforced and the services better supported. But prosecuting the victimless crimes does neither of these. It helps no one. The potential existence of abuses does not mean such work should be automatically criminalised if for no other reason than doing so makes the lives of people in sex work worse, not better. Criminalisation is the very opposite of compassion. Rhoda Grant is hiding behind an "end demand" approach that will not achieve what she claims it will, but will punish sex workers and send those with already chaotic lives further into a downward spiral. If that isn't punishing them with no hope for change then I don't know what is. It's time we started acting like grownups and stopped pretending that making something illegal makes it cease to exist. Full Article crime prostitution Scotland trafficking
and Radfems, Racists, and the problem with "pimps" By belledejour-uk.blogspot.com Published On :: Sat, 02 Feb 2013 14:50:00 +0000 I was re-reading Iceberg Slim recently (as you do), and wondering what exactly it is the anti-sex brigade mean when they go around calling people "pimps". I've been called a pimp before. By Julie Bindel, to my face, and I laughed because it is so ridiculous: I have never profited off of anyone's erotic capital but my own… and arguably Billie Piper's, though that makes me no more and perhaps significantly less pimp-like than (say) her agent and the show's producers. I don't get particularly offended by such obviously over the top labels. But the word itself has started to crop up more and more in the arguments surrounding sex work and the proposed laws regarding prostitution. Take for example in Ireland, where the widespread assumption is that all sex workers are a) women and b) "pimped". Both of these are demonstrably and flagrantly not true, and yet are found in virtually any media coverage of the topic which is heavily influenced by an unholy coalition of extreme religious groups and extreme radfem ideologues. The side issue dogging the proposed changes, that is, the discourse about what exactly constitutes trafficking and who exactly is trafficked, is of course pretty openly racist - both the words and the imagery. This has been covered in some detail and extremely well by eg. Laura Agustin, whose work on the topic I highly recommend. Typical "trafficking" propaganda: shades of White Slavery all over the place. Anyway, back to the concept of "pimp". Now we all know, or think we know, what a pimp is, and much of this archetype comes from highly fictionalised misrepresentations of Mr Slim's own work. Go on, you know exactly what people mean by the word. What "pimp" implies. A man who runs women, lures them with money and romance, then turns them out to whoring, often beaten, always drug-addicted. And he is black. Starting to sound like casual use of "pimp" is dog-whistle racism, isn't it? For the life of me I have never met a person even remotely like the stereotypical pimp, and yet I "know" they exist, largely because I have been told so over and over again. I've met streetwalkers, both drug-addicted and not; escorts and call girls, same; not one ever had what popular imagination would classify as a "pimp," but then I keep getting told I'm not representative, so maybe the literally hundreds of men and women, cis and trans sex workers I've met are just "not representative" too? Occasionally you also hear talk of the "Eastern European gangmaster", but for some reason the class- and racially-evocative term "pimp" comes up far, far more often. Could that be because plain xenophobia just doesn't inspire the troops in quite the same way bald racism does? Independent sex workers who organise their own affairs and work solo. Roommates who share a flat and both happen to sell sex. Managers running escorts agencies with a dozen or so girls they mostly interact with by text. Massage parlour owners. Women whose house is used by other sex workers, so technically I guess are madams. People who set up message boards and internet forums where clients and sex workers talk among themselves and with each other. All of these are people who get called "pimps" by the anti-sex lobby. A guy in a crushed velvet suit on a street corner, keeping his girls high and working the neighbourhood? Not so many of those to the pound. But, let's say he really is out there, because we all keep getting told he is. This working-class black man in the loud clothes who is sexually and physically aggressive and probably has a criminal record. This "pimp". Do you think his choice of work isn't somehow constrained by society too? That he wouldn't rather be earning money some other way? Because anyone with any sense can surely suss out that a lot of activities, both legal and illegal, would be far more profit and far less hassle than running girls. Iceberg Slim: hustling because it's not as if you were going to save him and his mother from poverty, were you? This is the reality of waged work, all waged work, whether sex is involved or not. No one, but no one, has "free choice". If you think otherwise, remind yourself what you wanted to be when you grew up, and reflect on how exactly you ended up where you are now. Did you freely select from all career choices in the world, ever? Or did you choose as best you could from the options offered by your abilities and (more crucially) your circumstances? You know, like Iceberg Slim did? Some folks seem especially resistant to acknowledging the truth about work, so I'll underline it some more. Entire towns in the North weren't full of miners because everyone there just happened to have the aptitude and preference for that sole job, but because it was the only job going. NE Scotland isn't full of fishermen because they have a particular concentration of people whose life's dream was to catch fish, but because that's what the job market offers. Everyone's outcome is the product of limited choices, from streetwalkers to the Queen. And no one's suggesting she needs to be "rescued" from her lack of career options. If you want to improve someone's options, you address the things that constrain their choices in the first place. Poverty, addiction, education, to name a few. Not take away the only choices they have. The pimp as we perceive him is a low-end tough. He's not exactly a criminal mastermind. And unlike a lot of the people who talk about "pimps" and whatnot, I know criminals. I have seen that life up close and fucking personal. I have lived in their neighbourhoods and their houses, and even in their families. I know that anyone who runs a business in the way the supposed pimp supposedly does is making little money, if any. What's 50% of that £10 anal bareback the anti-sex lobby claim is available in red lights everywhere? A fiver? Yeah, that sounds logical. Now pull the other one. I know that his power - again, if he exists, because even when I was living in Cracktown, Pinellas County I saw shit that would stop your heart but I never once saw a "pimp" - is a power of an extremely limited kind. The power of someone with few and possibly no other options. The anti-sex lobby's fantasy use of the term "pimp" is bogus and it is racist. Anyone who claims otherwise is being purposely disingenuous for the sake of striking fear into white, English-speaking, middle-class people. Full Article myths pimps prostitution racism radfems terfs
and News roundup: 11-11-11! insertAdjacentHTML, classes in JavaScript?, twilight of Flash and Silverlight, Yahoo! Cocktails By www.jsmag.com Published On :: Listen to the podcast for November 11, 2011 insertAdjacentHTML Mozilla has a nice overview of insertAdjacentHTML, a DOM function that's intended to supplement innerHTML. It's a bit less destructive and plays nicely with content that's already in the DOM. For instance, whereas innerHTML completely blows away whatever is inside the ... Full Article
and News roundup: Chrome for Android, ASCII Fluid Dynamics, Node.js: doing life wrong? By www.jsmag.com Published On :: (no podcast this week - Boo! Check back next week) Chrome for Android Google has just released a beta of Chrome for Android, which is available for those running Android Ice Cream Sandwich (aka "the 1%"). This isn't JavaScript-specific news per se, but it is HUGE news for web devs ... Full Article
and Did the change of start time affect your ability to watch the Brazilian GP? | Debates and Polls By www.racefans.net Published On :: Sun, 10 Nov 2024 17:35:51 +0000 F1 did something it has never done before last weekend and moved a race start time earlier. But did that affect your ability to watch? Full Article Debates and Polls
and Every way Verstappen can clinch the championship at the Las Vegas Grand Prix | Formula 1 By www.racefans.net Published On :: Mon, 11 Nov 2024 07:45:43 +0000 Max Verstappen is poised to clinch the 2024 drivers' championship if he finishes ahead of Lando Norris one more time. Here's how he can seal a fourth title at the next race. Full Article Formula 1 2024 las vegas grand prix Max Verstappen
and Why Mercedes put ‘a reminder of joy and pain’ on display in their factory lobby | Formula 1 By www.racefans.net Published On :: Mon, 11 Nov 2024 12:32:38 +0000 Mercedes have put the car from Lewis Hamilton's controversial 2021 championship defeat on display in the lobby at their factory. Full Article 2021 F1 season Formula 1 2021 Abu Dhabi Grand Prix Mercedes toto wolff
and “Walthamstow FC exist and they’re playing on Saturday, and that’s a start …” By martinbelam.com Published On :: Wed, 23 Oct 2024 08:52:30 +0000 Do you remember when bloggers just sometimes did short posts about things they had enjoyed and just wanted to share them? I know, I am such a boomer*. Anyway, here is one of those, with a couple more to follow... Full Article Football
and The incredible secret of the London Overground rebranding By martinbelam.com Published On :: Tue, 29 Oct 2024 13:59:31 +0000 I am 100% on-board with the London Overground being split into six different lines with individual names. It is infuriating to see there are delays on the Overground and have no clear idea of whether they might be on a... Full Article Design
and The Tegan and Sara internet culture and fandom documentary is worth 100 minutes of your time By martinbelam.com Published On :: Fri, 01 Nov 2024 11:00:37 +0000 I didn’t watch this in the cinema, and I had a bit more to say about it than my usual one-line movie review format, so it didn’t fit into my monthly round-up, but I do want to wholeheartedly recommend you... Full Article Films
and I’ve been reading 2000AD again and Thistlebone and Brink are great! By martinbelam.com Published On :: Thu, 07 Nov 2024 11:00:53 +0000 Borag Thungg! When things like Woolworths go bust, people who haven’t been to Woolworths for years feel sad and say “Why can’t the old things I liked survive?”. So at the start of the pandemic I worried about things going... Full Article Media
and ‘We have to fight for the commanding heights of American culture’ By www.mackinac.org Published On :: Fri, 11 Oct 2024 05:58:00 -0400 American Culture Project’s John Tillman on winning through upstream engagement Full Article
and Michigan needs new ideas for high absenteeism and falling student scores By www.mackinac.org Published On :: Mon, 14 Oct 2024 06:00:00 -0400 Education choice is succeeding in other states Full Article
and Innovators and entrepreneurs: XPRIZE as catalyst By www.mackinac.org Published On :: Tue, 05 Nov 2024 05:59:00 -0500 Economic freedom is positively associated with job creation Full Article
and New Search experiences in EEA: Rich results, aggregator units, and refinement chips By developers.google.com Published On :: Thur, 15 February 2024 10:00:00 +0000 Following our latest update on our preparations for the DMA (Digital Markets Act), we're sharing more details about what publishers can expect to see in regards to new search results in European Economic Area (EEA) countries, and how they can express interest in these experiences. Full Article
and What web creators should know about our March 2024 core update and new spam policies By developers.google.com Published On :: Tue, 05 March 2024 10:00:00 +0000 Today we announced the March 2024 core update. This is designed to improve the quality of Search by showing less content that feels like it was made to attract clicks, and more content that people find useful. We also shared that we have new spam policies to better handle the practices that can negatively impact Google's search results. In this post, we'll go into more detail for creators about both the update and the spam policies. Full Article
and Search Central Live 2024 in Warsaw, Poland By developers.google.com Published On :: Mon, 25 March 2024 10:00:00 +0000 We're excited to announce a Search Central Live event in Warsaw, Poland on April 24, 2024. Search Central Live is our global Google Search event series specifically for site owners, publishers, and SEOs. Full Article
and Configure your shipping and returns directly in Search Console By developers.google.com Published On :: Thu, 11 Jul 2024 06:00:00 +0000 This post discusses a new and easier way to add shipping or return information directly in Search Console. Full Article
and Search Central Live 2024 is coming to Kuala Lumpur and Taipei By developers.google.com Published On :: Tues, 27 Aug 2024 08:00:00 +0000 As previously announced, we're coming to Kuala Lumpur and to Taipei in the last quarter of 2024. And yes, we're very excited! The KL event will be in English and the Taipei event will be conducted in Mandarin (Traditional Chinese). Full Article
and New Search experiences in South Africa: Badges and refinement chips By developers.google.com Published On :: Mon, 16 Sep 2024 08:00:00 +0000 We're sharing more information about our new search experiences in South Africa, and how South African platforms can express interest and participate. Full Article
and Search Central Live Jakarta and Bangkok 2024: it's a wrap By developers.google.com Published On :: Tue, 15 Oct 2024 06:00:00 +0000 Our first two Search Central Live events in Asia this year have been wrapped up and we finished looking back at what we've learned and what we can do better. Full Article
and Renovando el carné de Traductor-Intérprete Jurado (II) By www.elgasconjurado.com Published On :: Wed, 09 Aug 2017 14:05:32 +0000 En la segunda parte de «Renovando el carné de Traductor-Intérprete Jurado» vamos a ver los diferentes pasos que hay que seguir para la renovación del carné de jurado. La renovación es ahora más sencilla que nunca ya que es posible realizar casi toda la gestión online. Claro está, siempre que el sistema quiera y no […] Full Article Juradas Profesionales Recursos de TeI
and ¿Para qué sirve un burofax? Reclamando facturas By www.elgasconjurado.com Published On :: Sun, 12 Nov 2017 13:40:43 +0000 Uno de los primeros pasos que se suelen dar ante una factura impagada es preguntarle, amablemente, al cliente por el importe debido. Esto se suele hacer, habitualmente, por teléfono o por escrito usando el correo electrónico. Sin embargo, cuando a pesar de nuestra insistencia la factura sigue pendiente llega un momento en el que tenemos […] Full Article General
and AI and Community By multifarious.filkin.com Published On :: Mon, 01 Apr 2024 19:56:05 +0000 I’ve written quite a few articles in the last year or so on the use of AI in a localization setting, and in general as a tool to help you complete technical tasks you may not have been able to do without help until now. Certainly I’ve been making extensive use of this technology to … Continue reading AI and Community Full Article Business AI artificial intelligence community
and Its not just standalone BPM that is dead! By sanjiva.weerawarana.org Published On :: Sun, 30 May 2010 11:27:00 +0000 There was a thread recently on InfoQ asking whether standalone BPMS is dead. Yes it is dead.But, that's not the only standalone thing that is dead! Standalone Business Rules Systems is dead. Standalone Application Servers are dead. Standalone ETL products are dead. Standalone Messaging products are dead. Standalone ESBs are dead. Standalone Enterprise Content Management systems are dead. Standalone Security products are dead. Yes, they're all dead.They're all dead because customers are tired of being integration companies. What happens when a customer buys one of these standalone BPMS/BRS/ETL/etc. products is that the customer has to figure out how to integrate it to the other standalone products they've bought from other vendors. How does that help the customer's IT shop deliver business value to their organization?Enterprise problems don't come neatly packaged into BPM problems or Business Rules problems or Data Transformation problems or any one such well defined category. Instead, enterprise problems are complex problems that require an entire repertoire of tools which can be combined nicely to solve the problem at hand. Attempting to build solutions to these complex problems with a single sledgehammer approach is one of the reasons why many IT projects take so long to complete and end up being so expensive.The customer's IT shop is like the place which maintains the vehicle that the enterprise's IT is. What happens after a few years of taking standalone products and trying to live by their rules (not to mention their expensive consultants) and creating hodge-podge solutions is that the car ends up looking like this:That's why enterprise middleware needs to be 100% internally self-consistent and fully integrated. Without that, every turn may drive the IT shop into a wall. Behind every dark spot on the road could be a pot hole. Or, at best, the IT shop is not able to drive the car down the freeway with cruise control turned on .. instead its constantly hitting speedbumps.Don't like that? Well then you need middleware that can scale up and offer exactly the features that you need to solve the problem cleanly. Your IBM/Oracle/Tibco/JBoss middleware can't do that? Well then you have to try WSO2 Carbon based products .. and your car will end up looking like this :-).The best part of course is that all of our products are 100% open source under Apache license and free for you to use. If you want absolutely world class enterprise support, call us and we'll sell it to you at $8000/server. All very simple. Full Article innovation open source soa wso2
and Cloud players and open source collaboration By sanjiva.weerawarana.org Published On :: Tue, 17 May 2011 03:59:00 +0000 In today's keynote at OSBC RedHat's CEO Jim Whitehurst claimed that even companies like Google, Amazon and other cloud players are always collaborating .. not directly but in the form of collaboration via the various open source projects they build their offerings on. While that's true to some extent, the reality IMO is that many of these companies end up with forks of key projects such as MySQL or Xen or use extension points to write their own core bits that are not open source and never will be. If you talk to ex-MySQL people they will tell you that while there was a lot of testing and other "low end" contributions by the community, almost no major contributions for MySQL came from random outside users. That is the general sentiment I've heard from most open source organizations, communities and projects and certainly our experience in WSO2 as well. Even in Apache, its usually people who are fairly committed to the project (either by employment, which is most common, or by personal interest/choice) who contribute meaningfully; its very rarely that you get a sizable contribution from an outsider. In fact, the (ab)use of open source by online services companies like Google etc. is exactly why the AGPL license was created. For the uninitiated, AGPL is a viral license like GPL except that even online hosting is considered "distribution", thereby forcing service providers to ship the source code for any modifications they've done. Personally I'm not a fan of such aggressive tactics to get people to contribute (that's why ALL WSO2 software is Apache licensed) but there are many people who come from the free software mindset, in comparison to the open source mindset, of the FOSS community who are not happy with the Googles of the world not having to share any code at all even though they get a lot out of FOSS. So IMO Jim's wrong on this- Google and Amazon and other major closed cloud platform players will NOT share anything they absolutely don't have to. As a side-effect, they will not touch any AGPL code because it will force them to be a commodity and that results in loss of key competitive advantages for them. The FOSS movement is about giving power to the people. Cloud is a major risk for that as the cloud vendors are incentivized NOT to have a common denominator. That's why there's no freedom in the cloud without using a truly open source PaaS and building your own thing on top of it. Full Article cloud open source
and North Korea, The Interview and Movie Ethics By sanjiva.weerawarana.org Published On :: Sun, 28 Dec 2014 17:07:00 +0000 Its been quite a while since I blogged .. I'm going to try to write a bit more consistently from now (try being the key!). I thought I'll start with a light topic! So I watched the now infamous The Interview two nights ago. I'm no movie critic, but I thought it was a cheap, crass stupid movie with no depth whatsoever. More of a dumbass slapstick movie than anything else. Again, I'm no movie critic so I don't recommend you listen to me; watch it and make up your own mind :-). I have made up mine! HOWEVER, I do think the Internet literati's reaction to this movie is grossly wrong, unfair and arrogant. Has there ever been any other Hollywood movie where the SITTING president of a country is made to look like a jackass and assassinated in the most stupid way? I can't think of any movies like that. In fact, I don't think Bollywood or any other movie system has produced such a movie. When Hollywood movies have US presidents in them they're always made out to be the hero (e.g. White House Down) and they pretty much never die. If they do die, then they die a hero (e.g. 2012) in true patriotic form. I don't recall seeing a single movie where David Cameron or Angela Merkel or Narendra Modi or any other sitting president was made to look like a fool and gets killed as the main point of the movie (or in any other fashion). I believe the US Secret Service takes ANY threats against the US president very seriously. According to Wikipedia, a threat against the US president is a class D felony (presumably a bad thing). I've heard of students who send anonymous (joking) email threats get tracked down and get a nice visit. So, suppose Sony Pictures decided to make a movie which shows President Obama being a jackass and then being killed? How far would that go before the US Secret Service shuts it down? In my view the fact that this movie was conceived, funded and made just goes to show how little respect the US system has for people that are not lined up in the US way. Its fine for the US government, and even the US people, to have no respect for some country, its president or whatever, but I have to agree with North Korea when they say that this movie is a violation of the UN charter: With no rhetoric can the U.S. justify the screening and distribution of the movie. This is because "The Interview" is an illegal, dishonest and reactionary movie quite contrary to the UN Charter, which regards respect for sovereignty, non-interference in internal affairs and protection of human rights as a legal keynote, and international laws. – NORTH KOREA NATIONAL DEFENCE COMMISSION SPOKESMAN (From: http://www.itv.com/news/story/2014-12-27/north-korea-insults-obama-and-blames-us-for-internet-outages/.) Would all the Internet literati who hailed the release of the movie act the same way if Bollywood produced a movie mocking Obama and killing him off? If not, why the double standard?? Its disappointing that thinking people also get caught up in the rhetoric and ignore basic decency. Just to be clear- I'm not saying North Korea is a great place. I have no idea what things are really like there. What I do know is that I don't trust the managed news rhetoric that is delivered as fact by CNN, Fox, BBC, Al Jazeera or anyone any more about any topic. This is after observing how Sri Lanka was represented in various of these channels during the war and after being here to observe some side of it myself. After Iraq (where are those WMDs now?) you'd think that smart people wouldn't just believe any old crap that's put out .. I distinctly remember watching the news conference (broadcast on BBC) immediately after Colin Powell made his speech with pictures to the UN Security Council where the then Iraqi Foreign Minister (can't remember his name - fun looking dude) went thru each picture and gave an entirely different explanation. We now know who was telling the truth. I try hard not to get caught up in any of the rhetoric as a result now. There's an entirely different topic of whether the North Koreans attacked Sony Pictures' network and whether the US government hackers shut down their Internet. It seems that the general trend (as of today) is that it wasn't the North Koreans, despite what the FBI said: http://www.cnn.com/2014/12/27/tech/north-korea-expert-doubts-about-hack/index.html. So I'm with the North Koreans on this one: This movie should not have been conceived, funded and produced. I don't condone the hackers' approach for trying to stop it; instead Sony Pictures should've had more ethics and not done it at all. So, IMO: Shame on you Sony Pictures Entertainment! Full Article
and Understanding the (Sri Lankan) IT Industry By sanjiva.weerawarana.org Published On :: Wed, 27 Jan 2016 05:54:00 +0000 In the last 3+ weeks there's been war raging in the IT Crowd in Sri Lanka about the proposed CEPA/ETCA thing: Basically the part of a free trade agreement with India which might allow Indians in the IT and ship building industries to work freely in Sri Lanka. I know nothing about building ships so I don't have any opinion about whether the proposal addresses a real problem or not. I do know a thing or two about "IT" and am most certainly opinionated about it :-). I also know little real info about CEPA/ETCA because the government has chosen to keep the draft agreement secret. Never a good thing. There have been various statements made by various pundits, politicians, random Joes (Jagath's I guess in Sinhalese ;-)) and all sorts of people about how the Sri Lankan IT crowd is Scared to their wits that their jobs will be taken by Indians Looking for the state to give them protection from global competition Unable to compete with the world's IT industry without help from Indians Unpatriotic because a lot of them leave the country after getting quality free education Living in a bubble because some of them get paid Rs. 150k/month straight out of university Etc. etc.. I will address a lot of these in subsequent blogs (hopefully .. every time I plan to blog a lot that plan gets bogged on). The purpose of this blog is to try to educate the wider community about the mythical thing called the (Sri Lankan) "IT industry". For each area I will also briefly touch upon the possible Indian relationship. Of course this is all my opinion and others in the industry (especially in the specific areas that I touch upon) may vehemently disagree with my opinion. Caveat emptor. YMMV. So here goes an attempt at a simple taxonomy: Hardware Resellers/Vendors Hardware Manufacturers Software Resellers/Vendors Software Manufacturers System Integrators - Local Market Focused System Integrators - Outsourcers Enterprise Internal IT Teams IT Enabled Services (ITES) and Business Process Outsourcers (BPO) Universities IT Training Institutes This became way more of a treatise than I intended. I'm sure its full of things that people will disagree with. I'll try to update it based on feedback and note changes here. Hardware Resellers/Vendors IBM Sri Lanka has been in Sri Lanka for more than 40 years I think. I imagine they came when Central Bank or some big organization bought an IBM mainframe. I remember seeing Data General, WANG, and a host of other now-dead names growing up (70s and 80s). These guys basically import equipment from wherever, sell it to local customers and provide on-going support and maintenance. Some of these players don't sell entire computers or systems but rather parts - visit Unity Plaza to see a plethora of them. Not too many Indian hardware brands being sold in Sri Lanka AFAIK but probably MicroMax (the phone) is an exception. So having the Indian IT Crowd here really has no impact on this segment. Hardware Manufacturers These are people who make some kind of "IT thing" and sell it locally or export it. When it comes to technology no one makes all of anything any more - even an iPhone consists of parts from several countries and is finally assembled in China. Same with any computer you buy or any phone you buy. There are a few people here who "make" (aka put together / assemble) computers and sell under their own brand. There are also a few who export them (I believe). There are also some others who make specific hardware devices that target specific solutions - best is the company that makes various PoS type systems that get sold as Motorola. Fundamentally not many hardware manufacturers in Sri Lanka yet AFAIK. In any case, they're not likely to be affected by Indians being in Sri Lanka as this is a very specialized market and its unlikely the specialized skill will migrate to Sri Lanka given that skill base has excellent opportunities anywhere. If at all, electronics related graduates in Sri Lanka do not have enough good career opportunities yet as we don't have many companies buildings things yet. Software Resellers/Vendors Takes Microsoft Sri Lanka or the 100s of other agents of global software brands that sell their wares in Sri Lanka. These guys get a cut out of the sale in some fashion. Yes of course some of them sell (very good) Indian software. For example, a bunch of banks use InfoSys' Finnacle (sp?) core banking system. Software, used well, can increase any organization's productivity (after all, software is eating the world and all that). If there are Indian companies which have technology that can be used to improve LK orgs productivity - by all means do come and sell it here! That may even require Indian engineers to come and install / customize them - no problem at all. So, this segment will simply welcome more Indian presence in terms of companies. In terms of the Indian IT Crowd coming here for this segment - I guess experienced sales people are solutions engineers to help sell and deploy the Indian products are always welcome. To be successful the company will need to send good people (good luck selling software if the sales engineer sucks) - and good people are welcome anywhere. I should mention the global SaaS software products (e.g. Salesforce, Netsuite, Google Apps, Office 365 etc.). Most of those don't have regional sales teams etc. - you just go to the website and sign up and use it. However, they will often have local system integrators who know how to help deploy, tune, customize and integrate those systems to whatever enterprise systems are already in place. Software Manufacturers These guys make some kind of software product and sell it to whoever will buy it. More and more are selling them online as SaaS offerings only. Competing in the software product market means you just need to build a better product or at least have a good enough product that's cheap. To create great products you need great people who think and innovate faster and better than anyone else out in the world. More and more pretty much every product competes globally as even the smallest customer can simply use globally available SaaS offerings (some made in Sri Lanka even). Every idea someone has for a product in Sri Lanka is guaranteed also conceived by at least multiple Indians. And multiple Americans. And multiple Europeans. Etc. etc.. "Ideas are cheap. Execution is not." - Mano Sekaram at a talk he gave at the WSO2 Hackathon a few years ago. To make products and get them to market is not easy. Will having some Indian employees help? SURE - if they're awesome people. The 2m people who applied for a clerical job really wouldn't help. Will marketing experience help? Of course - but again high quality product marketing experience is hard to come by in Sri Lanka, in India and even in California (speaking from personal experience). Despite idiotic politician statements about how advanced the Indian IT industry is, they are much more a global outsourcer and BPO operator than a product development country. That's changing rapidly but the numbers in the product side of the equation are much lower than the other side. In fact, I'd venture to say that as a %ge there are more product companies in Sri Lanka's IT ecosystem than in India's. In any case, the word "advanced" is very hard to quantify in the software world. So sure, let anyone come - but good luck getting too many jobs in product companies that have no patience or interest with mediocre people. You need a few superb people to build a great product and fewer great people to market and sell it. If you're a super engineer or a marketer in India, there are tons of opportunities for you in India already, so the only way you'll come is if we offer a better total package: Check out WorkInSriLanka. I hope you come and stay and never leave! For WSO2, we're a BoI company. If we find a high quality person from ANYWHERE who wants to work in Sri Lanka we can bring them over. Piece of cake really - visa wise. We will NOT pay higher salaries for foreign people though - something that I know many do and something I soooooo detest. Sri Lanka seems to love reverse discrimination. System Integrators - Local Market Focused These companies take software and hardware from whoever and produce solutions for customers. These are systems that solve a particular business problem for some organization. For example, the vehicle registration system at the Department of Motor Vehicles. The work these guys do involve working with the customer to understand the problem domain, figure out a good solution architecture, figure out which technology to apply and then to build the full solution. All very important stuff! Who works in these places? Typically a combination of business analysts, architects, engineers of all kinds (software, QA, UI etc. etc.), project managers and so on. Sri Lankan enterprises are quite slow to adopt software technology. This (IMO) is primarily because labor costs are low, because customer expectations are still not hard meaning competition is not that intense as it is in say US. That will change and we will need a LOT more people to integrate and build solutions for local companies. Can we meet the demand with local skill - my guess is yes. If we need a few more, the integrator companies can easily import people too. There is one segment of this market that is special however. Small enterprises are also picking up low end solutions. These are often implemented by the owners daughter/son or niece/nephew type person. Basically some trusted computer geeky relative who "automates" the place in some form. That used to be with an Access database + VB type thing .. not sure what is in play today in that space. That market is critical to help develop the local IT Crowd as it gives business (aka employment) to many many relatively low skilled yet value-adding people. The people working in these places don't need 4 year CS degrees. They're simply people with a bit of knowledge (acquired from a tutory type place) and a good knack for computing. Its critical to support and protect this community because they deliver technology to the wider mom&pop / small kade business community. I think a bunch of lower cost people from India working in Sri Lanka in this market could be a negative thing as it could threaten employment for low end IT workers. However, many of these deals are struck based on trust and relationships so it'll be really hard for anyone to break in. System Integrators - Outsourcers These guys take work from a foreign country (typically a more wealthy country but could be one that simply has a dearth of technical capacity) and bring it here to do the work. Virtusa is of course the largest (~3000 or so people AFAIK) but there are TONS of smaller players employing a few 10s of people and a few dozen or so in the 100s range I think. The smaller ones always start with a single contract the owner managed to get from his/her work in the foreign country or thru a friend/relative outside. Do one task well at 1/5th to 1/3rd the price in the US and you can clearly keep get more business. Capitalism at work. The bigger of these companies are great places to work for the best of the best. They may give opportunities to learn a ton of stuff, travel, develop soft skills etc. etc.. Lots of passionate employees who will not move easily. The middle sized ones (> 25, < too many 100s) are usually great companies. They pay people well, they provide a quality work environment, they have passionate employees and often specialize in one or few areas (e.g. Alfresco or Mobile apps or whatever) and therefore command a higher charge out rate. The small companies (<= 25) tend to be more sweat-shop like from what I've seen - pay the people as little as possible and use crazy micro project management to deliver. No passionate employees typically. Its just a job that gives a paycheck for people who are relatively low skilled (and low initiative powered too). Virtusa has offices in India too with like 7000 people I think. If they want to hire Indians they can hire them there. If they want to bring people down here they can do it and undoubtedly do it already. (You need to go thru the Board of Investment but its trivially easy. FAR FAR FAR easier than hiring a foreigner in the US .. or I imagine India.) Does this part of the IT Crowd get affected by possible mass migration of the Indian IT Crowd to Sri Lanka? Not for the Virtusa's of the world IMO. However, for the smaller players, the small company CEOs who are milking money off the small outsourcing contracts, yes getting cheaper invisible people will be better for them. That could indeed mean a reduction in employment opportunities for the lower end of the technical community who work in these places as there indeed will be Indians willing to work for less (see Two million apply for 300 clerical jobs and 80% of Indian Engineering Graduates are Unemployable as recent examples). It would be great to have multiple Virtusa's in Sri Lanka. In 2009, Mphasis (apparently India's 7th largest service provider then) tarted operations in Sri Lanka with intent to hire 2000 but AFAIK have packed up and gone or are nowhere as big. I'm sure someone who knows will reply and I'll add a note. Would Infosys or TCS or whatever open up here if they have to bring people from India to Sri Lanka? I can't see why .. then why not just execute that in India itself. What am I missing in that equation? So I cannot see the larger players affected by this. The smaller players (and by that I mean the really small ones .. < 25 people) will probably benefit by getting cheaper workers. Will we see tons of iOS developers in LK with this? No, because they're a scarce commodity anywhere. Period. For the middle sized guys (> 25, < too many 100s) certainly getting more senior, experienced people from India will be a good thing. However, I see that as no different from attracting any national to come to Sri Lanka to work. I ABSOLUTELY want that - that's why I helped form WorkInSriLanka and am still part of it. High end people (of ANY origin) moving to Sri Lanka is critical for our future .. we need to become a net brain importer and not an exporter. However, they will come only if (a) you pay them properly and (b) if the quality of life is really good. These are things that WorkInSriLanka is addressing / informing about. Enterprise Internal IT Teams This literally the IT Crowd in the companies. (Haven't seen the awesomely funny British comedy? Check it out.) Well actually often they do much much more than that crowd. The IT Crowd guys are only IT operations - they keep computers running, keep networks running etc.. That's absolutely critical. But now more and more companies are using information as a key business strategy. What that means is that internal IT is becoming more and more important. Companies cannot afford to buy prepackaged solutions nor simply outsource to others - they need to innovate inside the company to create real business value for themselves in a way that differentiates them from their competitors. Not easy stuff. You need really good people. Not 100s, but a good number of really really good people and a bigger number of good people. You also need a visionary to be the CIO/CTO to drive that effort. Not at all easy. Sri Lanka is still in transition to that. Some big companies are doing it really well, but there's a massive dearth of really innovative CIOs in Sri Lanka yet. We're developing them as they move up the ranks but IT was kept away from the business and that needs to change for this to work. Is it a possibility to import talent for this from India? Of course! However, they are not cheap as those people have 1000x more work in India than here! What will happen to less skilled people who might come to this space? Good luck getting a job. For smaller companies, they don't have enterprise IT. Then they have the IT guy - the jack-of-all-trades who knows how to help with Powerpoint to debugging why he can't get to FB to cleaning up after he stupidly clicked on yet another get-rich-quick email. Those guys don't have (and don't need) CS degrees or IT/IS degrees. They need some training and lot of experience. They also get paid very little (think 25-50k/month). Those guys could get crunched if we allow hundreds of such people to come from India. That would be just stupid. IT Enabled Services (ITES) and Business Process Outsourcers (BPO) This is where the numbers are. Order a pizza in Texas? An Indian will answer. Call Delta airlines with an issue? An Philippino will answer. Call HSBC about an issue. A Sri Lankan will answer. These started off as call centers but more and more they take an entire process (e.g. claim processing for medical claims) and run the entire process in a lower cost location. All you need is a good network connection and a lot of (young) people who will work for a little amount and work odd hours and be happy with it. Sri Lanka also claims to be the largest producer of UK qualified accountants after UK .. and so does a lot of financial process outsourcing too. There's also high end parts of this market - research outsourcing, analytics outsourcing etc.. Great. Do more. Sri Lanka produces 300-400 THOUSAND 18 years each year. Only like 25,000 get to a university of some kind (who are the ones who have a chance at a higher value job). The rest need work. This low end kind of ITES/BPO work is great .. it gets them a salary and if the country keeps devaluing the LKR they even get salary raises every year! Keeping people employed prevents them from wanting to join revolutions. Some BPOs claim that they couldn't scale enough in LK because they can't find the large number of passionate, English capable young people. Probably true. MAYBE its possible to import them from India, but presumably only those that couldn't get jobs in the myriad of Indian BPOs. However, how that helps provide employment to the droves of young people who need work in Sri Lanka I do not know. Universities These guys of course produce the IT guys. We have state universities, private universities that grant their own degrees and a plethora of private ones that provide a learning environment to get a foreign university degree. As with anything the quality varies. The top govt engineering / science universities and the top private ones produce AWESOME graduates who are absolutely as good as the best in any country (India, US included). WSO2 is lucky that a bunch of these guys join us :-). But my focus here is on the teachers. We need more PhDs to teach in our universities - ask Jaffna Univ CS dept for example. Will Indian PhDs (good ones) come and teach there? Great if they want to! Salary is pretty poor but its what it is. Even private universities will happily hire teachers. We also need top research focused scientists to come here so we can improve our research capacity. I don't think opening employment to Indians will make a single IIT professor to come :(. Even right now, they can come (visa is easy) - so please, if you want to come and teach in Sri Lanka reach out thru WorkInSriLanka and we'll help you! And don't ever leave. India has absolutely fantastic universities. If they want to come and set up shop in LK and offer education to our people - great! India also has a LOT of crappy universities (see the article about unemployable graduates) - we certainly don't need them here. IT Training Institutes These are the literally hundreds (and maybe even thousands) of places that offer this course or that course on this or that. 90% of them in my opinion is crap. There's too little quality control. People are getting swindled daily by these jackassses who teach their children next to nothing and yet charge a ton of money. Even some local governments are in on it - I know in Dehiwala (my area) they run a program where literally 100s of people come for IT education. Each pays like Rs. 3000/month. Poor parents can't say no so they do it somehow. Do we need more of these? Yes, IF THEY ARE GOOD. We need to get our house in order, put regulations in to quality control these places and then of course its great if more teachers come and teach more. India has absolutely fantastic training institutes. Would be great to get them to open shop here. India also UNDOUBTEDLY has at least 10x crappy places than we do. Most certainly we don't need them here - we already have enough people robbing money from poor parents who desperately want to educate their children in "IT". (p.s.: Blogger.com has the world's WORST editor. I'm bailing to medium.com soon.) Full Article sri lanka
and Time for me to stop commenting about politics and other sensitive topics By sanjiva.weerawarana.org Published On :: Mon, 01 Feb 2016 13:52:00 +0000 I've been cautioned and advised by several good friends that I should take a chill pill on commenting about various political things. Some of the topics I've been quite vocal about are high profile things involving high power people .. and I might be beginning to get noticed by them, which of course is not a good thing! I get frustrated by political actions that I find to be stupid and I don't hesitate to tell it straight the way I think about it. Obviously every such statement bothers someone else. Its one thing when its irrelevant noise, but if it gets noisy then I'm a troublemaker. I'm not keen to get to that state. Its not because I have anything to hide or protect - not in the least. Further I'm not scared off by the PM telling private sector people like me to "go home" or "be exposed" but publicly naming private individuals in parliament is rather over the top IMO. Last thing I want is to get there. I have an immediate family and an extended family of 500+ in WSO2 that I'm responsible for. I'm taping up my big mouth for their sake. Instead I will try to blog constructively & informatively whenever time permits. Similarly I will try to keep my big mouth controlled about US politics too. Its really not my problem to worry about issues there! I should really kill off my FB account. However I do enjoy getting info about friends and family life events and FB is great for that. So instead I'll stop following everyone except for close friends and family. Its been fun and I like intense intellectual debate. However, maybe another day - just not now. (P.S.: No, no one threatened me or forced me to do this. I just don't want to come close to that possibility!) Full Article sri lanka
and WSO2 Stratos - Platform-as-a-Service for private and public cloud By pzf.fremantle.org Published On :: Thu, 03 Jun 2010 07:53:00 +0000 Yesterday we announced something I believe is a game-changer: WSO2 Stratos. What is Stratos? WSO2 Stratos is a complete SOA and developer platform offered as a self-service, multi-tenant, elastic runtime for private and public cloud infrastructures.What that means is that our complete SOA platform - now enhanced with Tomcat and Webapp support - is available as a "cloud native" runtime that you can either use on the Web (yes - you can try it out right now), on Amazon VPC, or on your own internal private cloud based on Ubuntu Enterprise Cloud, Eucalyptus and (coming soon) vmWare vSphere. It is a complete Platform-as-a-Service for private and public clouds. I'll be writing more about Stratos over the coming weeks and months, and I'll also provide links and tweets to other Stratos blogs, but in this blog I want to simply answer three questions: I'm already talking to {vmWare, Eucalyptus, Ubuntu, Savvis, Joyent} about private cloud - what does WSO2 add that they don't have? What is the difference between Stratos and the Cloud Images that WSO2 already ships? Why would I choose WSO2 over the other vendors offering Platform-as-a-Service? In order to answer the first question, lets look at the cloud computing space, which is most easily divided up into: Infrastructure-as-a-Service (IaaS): this is where Amazon, Eucalyptus, vmWare, Saavis and Joyent play Platform-as-a-Service (PaaS): Google App Engine, vmForce, Tibco Silver and now WSO2 Stratos play in this space. Software-as-a-Service (SaaS): Google Apps, Google Mail, Microsoft Office Live, Salesforce, SugarOnDemand - these and many more make up the SaaS category. To generalize wildly, most people talking about public cloud today are talking about SaaS. And most people talking about private cloud today are talking about IaaS. SaaS is fantastic for quick productivity and low cost. WSO2 uses Google Apps, Sugar on Demand and several other SaaS apps. But SaaS doesn't create competitive advantage. Mule also uses Google Apps. They may well use Salesforce. SaaS cannot produce competitive advantage because your competitors get access to exactly the same low-cost services you do. In order to create competitive advantage you need to build as well as buy. For example, we use our Mashup Server together with our Sugar Business Messaging Adapter to provide insight and management of our pipeline that goes beyond what Sugar offers. IaaS is of course a great basis to build apps. But it's just infrastructure. Yes - you get your VM hosted quicker. But someone has to create a useful VM. And that is where PaaS comes in. PaaS is how to speed up cloud development. What does Stratos give you on top of an IaaS? It gives you an Application Server, Registry, Identity Server, Portal, ESB, Business Activity Monitor and Mashup Server. And it gives you these as-a-Service: completely self-service, elasticly scalable, and granularly metered and monitored. Someone in your team needs an ESB - they can provision one for themselves instantly. And because it's multi-tenant, it costs nothing to run until it gets used. How do you know how it's used? The metering and monitoring tells you exactly how much each tenant uses. 2. What is the difference between Stratos and the existing WSO2 Cloud Images? The cloud images we started shipping in December are not Cloud Native. Stratos is Cloud Native. In practice, this means that when you log into Stratos (go on try it now) you can instantly provision your own domain, together with a set of Stratos services. This saves memory - instead of allocating a new VM and minimum half a gigabyte of memory to each new server you get a new ESB with zero extra memory cost. And it's much easier. The new ESB will automatically be governed and monitored. It's automatically elastically clustered. 3. Why would I choose WSO2 over other PaaS vendors? Firstly, if you look at PaaS as a whole there is a huge divide between Public PaaS and Private PaaS. The public PaaS vendors simply don't offer private options. You can't run force.com or Google App Engine applications internally, even if you want to. WSO2 bridges that gap with a PaaS you can use in the public Web, on a virtual private cloud, or on premises. The second big differentiator between WSO2 and the existing PaaS offerings is the architecture. Mostly PaaS is a way of building webapps. WSO2 offers a complete enterprise architecture - governance, business process, integration, portal, identity and mashups. And we support the common Enterprise Programming Model (not just Java, WebApp, JAX-WS, but also BPEL, XSLT, XPath, Google Gadgets, WSDL, etc). The only other PaaS that I know of that offers a full Enterprise architecture is Tibco Silver. The third and most important differentiator is about lock-in. Software vendors love lock-in - and Cloud vendors love it even more. So if you code to Google App Engine, you are tied into Google's identity model, Google's Bigtable, etc. If you code to force.com or vmForce - you are tied to force's infrastructure services. If you code to Tibco Silver, you are tied to Tibco. WSO2 fights this in three ways: No code lock-in: we use standards-based coding (WAR, JAX-WS, POJO) and Stratos is 100% Apache License Open Source. No model lock-in: we use standards-based services: Identity is based on OpenID, OAuth, XACML, WS-Trust Registry is based on AtomPub and REST Business Process is based on BPEL, etc No hosting lock-in: you can take you apps and data from our public PaaS and re-deploy internally or on your own virtual private cloud anytime you like. I hope you found this a useful introduction to Stratos. If you want more information, contact me paul@wso2.com, or check out the Stratos website or code. Full Article carbon cloud PaaS stratos wso2
and Wikileaks and Governance By pzf.fremantle.org Published On :: Thu, 02 Dec 2010 15:10:00 +0000 Whether or not you support the leaking of 250,000 embassy cables to the now infamous Wikileaks website, it certainly makes you think. Whatever business you are in there always emails or data that would be embarrassing or more likely harmful to our business if they were made widely available. So what is the lesson to be learnt from the Cablegate affair. The blame for the issue seems to be landing on a certain US private Bradley Manning. But I place the blame directly on a lack of Governance and poor IT systems. And the measures that have so far been announced - things like removing CD drives from classified systems - are simply the wrong approach. The real problem is why any one person - whatever level of clearance they had - should have access to all 250,000 cables. Without going into the details of XACML and policy-based entitlement models, suffice it to say that the right approach is to base access not only on the person, but the reason they have for accessing the data. Using policy-based entitlement, it is possible to have a well-defined Governance model where a person is given access to just the right data at just the right time for just the right purpose, and that this can be managed in a process-driven, auditable and controlled manner. If you live in a crime area and you leave your door open, you will be burgled. If you don't put in place good security and data governance, then it is you that will be blamed, not just the guy who steals your data. And if you want the technical low-down on XACML, start here, here and here. Full Article
and Understanding ESB Performance & Benchmarking By pzf.fremantle.org Published On :: Tue, 18 Sep 2012 20:51:00 +0000 ESB performance is a hot (and disputed topic). In this post I don't want to talk about different vendors or different benchmarks. I'm simply trying to help people understand some of the general aspects of benchmarking ESBs and what to look out for in the results. The general ESB model is that you have some service consumer, an ESB in the middle and a service provider (target service) that the ESB is calling. To benchmark this, you usually have a load driver client, an ESB, and a dummy service. +-------------+ +---------+ +---------------+ | Load Driver |------| ESB |------| Dummy Service | +-------------+ +---------+ +---------------+ Firstly, we want the Load Driver (LD), the ESB and the Dummy Service (DS) to be on different hardware. Why? Because we want to understand the ESB performance, not the performance of the DS or LD. The second thing to be aware of is that the performance results are completely dependent on the hardware, memory, network, etc used. So never compare different results from different hardware. Now there are three things we could look at: A) Same LD, same DS, different vendors ESBs doing the same thing (e.g. content-based routing) B) Same LD, same DS, different ESB configs for the same ESB, doing different things (e.g. static routing vs content-based routing) C) Going via ESB compared to going Direct (e.g. LD--->DS without ESB) Each of these provides useful data but each also needs to be understood. Metrics Before looking at the scenarios, lets look at how to measure the performance. The two metrics that are always a starting point in any benchmark of an ESB here are the throughput (requests/second) and the latency (how long each request takes). With latency we can consider overall latency - the time taken for a completed request observed at the LD, and the ESB latency, which is the time taken by the message in the ESB. The ESB latency can be hard to work out. A well designed ESB will already be sending bytes to the DS before its finished reading the bytes the LD has sent it. This is called pipelining. Some ESBs attempt to measure the ESB latency inside the ESB using clever calculations. Alternatively scenario C (comparing via ESB vs Direct) can give an idea of ESB Latency. But before we look at the metrics we need to understand the load driver. There are two different models to doing Load Driving: 1) Do a realistic load test based on your requirements. For example if you know you want to support up to 50 concurrent clients each making a call every 5 seconds on average, you can simulate this. 2) Saturation! Have a large number of clients, each making a call as soon as the last one finishes. The first one is aimed at testing what the ESB does before its fully CPU loaded. In other words, if you are looking to see the effect of adding an ESB, or the comparison of one ESB to another under realistic load, then #1 is the right approach. In this approach, looking at throughput may not be useful, because all the different approaches have similar results. If I'm only putting in 300 requests a sec on a modern system, I'm likely to see 300 request a sec. Nothing exciting. But the latency is revealing here. If one ESB responds in less time than another ESB thats a very good sign, because with the same DS the average time per request is very telling. On the other hand the saturation test is where the throughput is interesting. Before you look at the throughput though, check three things: 1) Is the LD CPU running close to 100%? 2) Is the DS CPU running close to 100%? 3) Is the network bandwidth running close to 100%? If any of these are true, you aren't doing a good test of the ESB throughput. Because if you are looking at throughput then you want the ESB to be the bottleneck. If something else is the bottleneck then the ESB is not providing its max throughput and you aren't giving it a fair chance. For this reason, most benchmarks use a very very lightweight LD or a clustered LD, and similarly use a DS that is superfast and not a realistic DS. Sometimes the DS is coded to do some real work or sleep the thread while its executing to provide a more realistic load test. In this case you probably want to look at latency more than throughput. Finally you are looking to see a particular behaviour for throughput testing as you increase load. Throughput vs Load The shape of this graph shows an ideal scenario. As the LD puts more work through the ESB it responds linearly. At some point the CPU of the ESB hits maximum, and then the throughput stabilizes. What we don't want to see is the line drooping at the far right. That would mean that the ESB is crumpling under the extra load, and its failing to manage the extra load effectively. This is like the office worker whose efficiency increases as you give them more work but eventually they start spending all their time re-organizing their todo lists and less work overall gets done. Under the saturation test you really want to see the CPU of the ESB close to 100% utilised. Why? This is a sign that its doing as much as possible. Why would it not be 100%? Two reasons: I/O, multi-processing and thread locks: either the network card or disk or other I/O is holding it up, the code is not efficiently using the available cores, or there are thread contention issues. Finally its worth noting that you expect the latency to increase a lot under the saturation test. A classic result is this: I do static routing for different size messages with 100 clients LD. For message sizes up to 100k maybe I see a constant 2ms overhead for using the ESB. Suddenly as the message size grows from 100k to 200k I see the overhead growing in proportion to the message size. Is this such a bad thing? No, in fact this is what you would expect. Before 100K message size, the ESB is underloaded. The straight line up to this point is a great sign that the ESB is pipelining properly. Once the CPU becomes loaded, each request is taking longer because its being made to wait its turn at the ESB while the ESB deals with the increased load. A big hint here: When you look at this graph, the most interesting latency numbers occur before the CPU is fully loaded. The latency after the CPU is fully loaded is not that interesting, because its simply a function of the number of queued requests. Now we understand the metrics, lets look at the actual scenarios. A. Different Vendors, Same Workload For the first comparison (different vendors) the first thing to be careful of is that the scenario is implemented in the best way possible in each ESB. There are usually a number of ways of implementing the same scenario. For example the same ESB may offer two different HTTP transports (or more!). For example blocking vs non-blocking, servlet vs library, etc. There may be an optimum approach and its worth reading the docs and talking to the vendor to understand the performance tradeoffs of each approach. Another thing to be careful of in this scenario is the tuning parameters. Each ESB has various tuning aspects that may affect the performance depending on the available hardware. For example, setting the number of threads and memory based on the number of cores and physical memory may make a big difference. Once you have your results, assuming everything we've already looked at is tickety-boo, then both latency and throughput are interesting and valid comparisons here. B. Different Workloads, Same Vendor What this is measuring is what it costs you to do different activities with the same ESB. For example, doing a static routing is likely to be faster than a content-based routing, which in turn is faster than a transformation. The data from this tells you the cost of doing different functions with the ESB. For example you might want to do a security authentication/authorization check. You should see a constant bump in latency for the security check, irrespective of message size. But if you were doing complex transformation, you would expect to see higher latency for larger messages, because they take more time to transform. C. Direct vs ESB This is an interesting one. Usually this is done for a simple static routing/passthrough scenario. In other words, we are testing the ESB doing its minimum possible. Why bother? Well there are two different reasons. Firstly ESB vendors usually do this for their own benefit as a baseline test. In other words, once you understand the passthrough performance you can then see the cost of doing more work (e.g. logging a header, validating security, transforming the message). Remember the two testing methodologies (realistic load vs saturation)? You will see very very different results in each for this, and the data may seem surprising. For the realistic test, remember we want to look at latency. This is a good comparison for the ESB. How much extra time is spent going through the ESB per request under normal conditions. For example, if the average request to the backend takes 18ms and the average request via the ESB takes 19ms, we have an average ESB latency of 1ms. This is a good result - the client is not going to notice much difference - less than 5% extra. The saturation test here is a good test to compare different ESBs. For example, suppose I can get 5000 reqs/sec direct. Via ESB_A the number is 3000 reqs/sec and via ESB_B the number is 2000 reqs/sec, I can say that ESB_A is providing better throughput than ESB_B. What is not a good metric here is comparing throughput in saturation mode for direct vs ESB. Why not? The reason here is a little complex to explain. Remember how we coded DS to be as fast as possible so as not to be a bottleneck? So what is DS doing? Its really just reading bytes and sending bytes as fast as it can. Assuming the DS code is written efficiently using something really fast (e.g. just a servlet), what this is testing is how fast the hardware (CPU plus Network Card) can read and write through user space in the operating system. On a modern server hardware box you might get a very high number of transactions/sec. Maybe 5000req/s with each message in and out being 1k in size. So we have 1k in and 1k out = 2k IO. 2k IO x 5000 reqs/sec x 8bits gives us the total network bandwidth of 80Mbits/sec (excluding ethernet headers and overhead). Now lets look at the ESB. Imagine it can handle 100% of the direct load. There is no slowdown in throughput for the ESB. For each request it has to read the message in from LD and send it out to DS. Even if its doing this in pipelining mode, there is still a CPU cost and an IO cost for this. So the ESB latency of the ESB maybe 1ms, but the CPU and IO cost is much higher. Now, for each response it also has to read it in from DS and write it out to LD. So if the DS is doing 80Mbits/second, the ESB must be doing 160Mbits/second. Here is a picture. Now if the LD is good enough, it will have loaded the DS to the max. CPU or IO capacity or both will be maxed out. Suppose the ESB is running on the same hardware platform as the DS. If the DS machine can do 80Mbit/s flat out, there is no way that the same hardware running as an ESB can do 160Mbit/s! In fact, if the ESB and DS code are both as efficient as possible, then the throughput via ESB will always be 50% of the throughput direct to the DS. Now there is a possible way for the ESB to do better: it can be better coded than the DS. For example, if the ESB did transfers in kernel space instead of user space then it might make a difference. The real answer here is to look at the latency. What is the overhead of adding the ESB to each request. If the ESB latency is small, then we can solve this problem by clustering the ESB. In this case we would put two ESBs in and then get back to full throughput. The real point of this discussion is that this is not a useful comparison. In reality backend target services are usually pretty slow. If the same dual core server is actually doing some real work - e.g. database lookups, calculations, business logic - then its much more likely to be doing 500 requests a second or even less. The following chart shows real data to demonstrate this. The X-Axis shows increasing complexity of work at the backend (DS). As the effort taken by the backend becomes more realistic, the loss in throughput of having an ESB in the way reduces. So with a blindingly fast backend, we see the ESB struggling to provide just 55% of the throughput of the direct case. But as the backend becomes more realistic, we see much better numbers. So at 2000 requests a second there is barely a difference (around 10% reduction in throughput). In real life, what we actually see is that often you have many fewer ESBs than backend servers. For example, if we took the scenario of a backend server that can handle 500 reqs/sec, then we might end up with a cluster of two ESBs handling a cluster of 8 backends. Conclusion I hope this blog has given a good overview of ESB performance and benchmarking. In particular, when is a good idea to look at latency and when to use throughput. Full Article
and Synapse and WSO2 ESB myths By pzf.fremantle.org Published On :: Mon, 24 Sep 2012 14:44:00 +0000 There are a few myths about Synapse and the WSO2 ESB I'd like to address. Its amazing they still come up. Not an ESB? The first and oldest myth is that Synapse is not an ESB. This dates back to the initial creation of the project - before there was even any code! Dave Chappell was at Sonic at the time and he said "This project is related to ESB , but it is not in itself an ESB". Well, firstly, since at that time Sonic was the ESB leader, he would say that! Secondly, this was purely theoretical - no code had been written at that point. While I love the internet's ability to archive everything for years, to quote this several years later (like the ServiceMix guys do here: http://servicemix.apache.org/how-does-servicemix-compare-to-synapse.html) is disingenuous to say the least. The fact is that Synapse - both as a pure Apache project and when packaged as the runtime engine of the WSO2 ESB is an ESB. Rather than argue about the definition of an ESB, it would be simpler to describe a few of the many usecases it is in production for: * Getting the latest trades from a legacy financial system and reporting them to third-parties to meet regulatory requirements. * Linking an SAP/R3 system with a .NET-based Point-of-Sale (POS) system in 40+ retails stores to distribute the latest price updates. * Integrating between BMC Remedy, Salesforce and Peoplesoft. * Providing a full SOA bus for a telecom operator linking to provide a common fabric for payment services, SMS top up and other integrations. * Lightweight Service Orchestration (what we call Service Chaining) - providing simple non-persistent flows across multiple services. * Integrating FIX messaging to existing systems. * etc etc In addition, the beauty of the Synapse ESB (and WSO2 ESB) is that it can also provide very high performance lightweight routing, load-balancing, failover and security management, so it is often used for high throughput scenarios as well - for example at eBay where it handles well over 1bn request/response interactions/day. Synapse (and WSO2 ESB) only support SOAP or translate every message into SOAP This is also a complete myth. The WSO2 ESB has a very effective model for dealing with content that only parses the content as needed. This model is based on the concept of a message formatter and builder. These objects handle the internal representation of content and are very flexible. For example, the normal approach to handling non-XML data is to keep it as a binary stream. In addition, a new transport in the WSO2 ESB (the Passthru transport) supports even higher performance routing of messages where the message body is simply passed from one HTTP endpoint to the next, while still supporting useful functions like header-based routing, authentication and authorization, logging, throttling and cacheing. For XML data, we have an internal model that unifies SOAP and non-SOAP. What this means is that for non-SOAP payloads, there are two extra objects in memory that represent the envelope and body. This makes it very easy (and performant) to handle scenarios like taking the SOAP body and publishing it (without the SOAP wrapper) onto a JMS queue. Because the XML object model we use (Apache Axiom) supports streaming (via StAX), the message is only built into a tree if a mediator such as the XSLT transform requests it. I think this is where the mistaken belief lies. This is a bit like Heisenberg's Uncertainty Principle! The act of observing a quantum level action affects the action. Similarly, if you examine the message, then if you ask for it as SOAP, we will build it into a SOAP message and give it to you. Of course that doesn't mean it was a SOAP message until you asked for it as SOAP. If you were to ask for the message as pure XML then you would get it as a pure XML element. In both cases it remains as a binary stream until the point you ask for the message. If you simply route the message out to another system, it will not have been converted to or from anything: Synapse will simply stream the message through and out to the target. I hope that this clears up these two myths! Full Article
and Understanding Logging in the Cloud By pzf.fremantle.org Published On :: Fri, 28 Sep 2012 10:39:00 +0000 I recently read an interesting pair of articles about Application Logging in OpenShift. While these are great articles on how to use log4j and Apache Commons Logging, they don't address the cloud logging issue at all. What is the cloud logging issue? Suppose I have an application I want to deploy in the cloud. I also want to automatically elastically scale this app. In fact I'm hoping that this app will succeed - and then I'm going to want to deploy it in different geos. I'm using EC2 for starters, but I might need to move it later. Ok, so that sounds a bit YAGNI. Let's cut back the requirements. I'm running my app in the cloud, on a single server in a single geo. I do not want to log to the local filesystem. Why not? Well firstly if this is say EC2, then the server might get terminated and I'm going to lose my logs. If it doesn't get restarted then they are going to grow and kill my local filesystem. Either way, I'm in a mess. I need to log my logs somewhere that is: 1) designed to support getting logs from multiple places - e.g. whichever EC2 or other instance my server happens to be hosted today 2) separate from my worker instance so when that gets stopped and started it lives 3) supports proper log rotation, etc If I have this then it supports my initial problem, but it actually also supports my bigger requirements around autoscaling and geos. Stratos is an open source Platform-as-a-Service foundation that we've created at WSO2. In Stratos we had to deal with this early on because we support elastic auto-scaling by default. In Stratos 1.x we built a model based on syslog-ng. Basically we used log4j for applications to log. So just as any normal log4j logging you would do something like: Logger logger = Logger.getLogger("org.fremantle.myApp"); logger.warn("This is a warning"); We automatically setup the log appenders in the Stratos services to use the log4j syslog appender. When we start an instance we automatically set it up under the covers to pipe the syslog output to syslog-ng. Then we automatically collate these logs and make them available. In Stratos 2.x we have improved this. The syslog-ng model is not as efficient as we needed, and also we needed a better way of slicing and dicing the resulting log files. In the Stratos PaaS we also have another key requirement - multi-tenancy. We have lots of instances of servers, some of which are one instance per tenant/domain, and some which are shared between tenants. In both cases we need to split out the logs so that each tenant only sees their own logs. So in Stratos 2.x (due in the next couple of months) we have a simple Apache Thrift interface (and a JSON/REST one too). We already have a log4j target that pushes to this. So exactly the same code as above works in Stratos 2.x with no changes. We are also going to add models for non-Java (e.g. syslog, log4php, etc). Now what happens next? The local agent on the cloud instance is setup automatically to publish to the local central log server. This takes the logs and publishes them to an Apache Cassandra database. We then run Apache Hive scripts that slice the logs per tenant and per application. These are then available to the user via our web interface and also via simple network calls. Why this model? This is really scalable. I mean really, really scalable. Cassandra can scale to hundreds of nodes, if necessary. Also its really fast. Our benchmarks show that we can write >10k entries/second on a normal server. Summary Logging in the cloud isn't just about logging to your local disk. That is not a robust or scalable answer. Logging to the cloud needs a proper cloud logging model. In Stratos we have built one. You can use it from Java today and from Stratos 2.0 we are adding support to publish log entries just with a simple REST interface, or a super-fast highly scalable approach with Apache Thrift. Full Article
and OAuth2 Introspection with WSO2 ESB and WSO2 Identity Server By pzf.fremantle.org Published On :: Sat, 09 Nov 2013 17:26:00 +0000 The OAuth2 specification defines several parties: the Client, the Resource Owner, the Authorization Server and the Resource Server. Here is the (textual) diagram from the spec: +--------+ +---------------+ | |--(A)- Authorization Request ->| Resource | | | | Owner | | |<-(B)-- Authorization Grant ---| | | | +---------------+ | | | | +---------------+ | |--(C)-- Authorization Grant -->| Authorization | | Client | | Server | | |<-(D)----- Access Token -------| | | | +---------------+ | | | | +---------------+ | |--(E)----- Access Token ------>| Resource | | | | Server | | |<-(F)--- Protected Resource ---| | +--------+ +---------------+ Figure 1: Abstract Protocol Flow One flow that is not defined by the OAuth specification is any flow from the Resource Server to the Authorization server to validate an existing Bearer Token (or other token). The spec says: The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server as the resource server or a separate entity. A single authorization server may issue access tokens accepted by multiple resource servers. In many cases the Authorization server offers an API to access this. For example, Google allows you to call a TokenInfo APIto validate tokens. Similarly Facebook offers an API to "debug" a token. The WSO2 Identity Server also offers an API, but (shock and horror) we don't document it yet. The ESB and API manager both utilize this API to validate OAuth2 bearer tokens. The ESB code is of course available, and with a quick look at the code and also the use of TCPMON it didn't take me long to reverse engineer the API. This Gist has a sample HTTP SOAP request against the WSO2 IS to validate a token: It turns out that the OAuth Working Group at the IETF is working on this and has a draft specification available, using a RESTful service. They call this OAuth Token Introspection. I figured this would be easier (and more pleasant) to call from my Python code, so I knocked up a quick WSO2 ESB API mediation flow to convert from the RESTful API to the existing WSO2 SOAP-based API. I know that Prabath and the security and identity team at WSO2 will soon add this useful REST API, but in the meantime, here is a quick hack to help you out. Please note you need to hardcode the URL of the IS and the userid/password into the ESB flow. Also I assume if you don't provide a token_type_hint then this is a bearer token. And here is the Gist showing a sample interaction: ->->-> Full Article