I was thinking the other day that it’d be great if you could click on a link to a tel: or sip: and have your phone dial the number. In my office, I have a snom VOIP telephone, which has an integrated web server that you can use to, amongst other things, dial numbers… which started me thinking.

URL handlers have received a lot of (adverse) publicity recently on Mac OS X, because they have been the subject of a number of security flaws, but they are absolutely perfect for this sort of application. It turns-out that it’s quite easy to write one, too.

Anyway, I thought the results might be useful to more than just me, so please feel free to download my snomURLHandler application, which is a Status Item (that is, one of those icons at the top right of your screen). It’s very basic, but quite useful I think, and also allows you to dial a number from AppleScript by writing something like

tell application snomURLHandler
  dial "<some phone number>"
end tell

I’ve just finished a marathon site update on my company web site. It’s probably quite hard to see what has changed, but here’s a short list:

• Automatic(!) localised pricing (U.S., Europe and U.K.)
• VAT support (although the company isn’t VAT registered yet…), including support for both physical and downloadable products, with correct allocation of VAT, including E.U. distance selling thresholds. That doesn’t mean it’s fully automated, of course, because it isn’t possible to do that at present.
• Invoicing, including both text-based invoices sent by e-mail and, in parallel, the same information presented on the web.
• Integration with a proper credit-card handler (i.e., not PayPal). PayPal’s great, especially in Europe where it’s properly regulated, but a lot of people don’t like it—plus you have to sign-up for an account in order to use it. Well, OK, if you’re a U.S. merchant, then you can make sign-up optional, but those of us in the rest of the world don’t have that option.
• Finally, the beginnings of a usable back-end… still not really finished, but it’ll save me from at least some command line SQL. It’s even got some SVG-based graphs, which I’m quite pleased with (although as a customer, you wouldn’t be able to see them).
• Re-vamped customer area, including the ability for customers to view and edit their own details, download software, generate licence keys, and view past purchases.
• Support for account customers.
• “Shopping Cart” support, which makes it easier for people to purchase more than once licence at a time.
• (Hopefully) even better support for accented and other non-ASCII characters. The entire site is now UTF-8 based (previously only the My Keys area used UTF-8).
• Built-in support for e-mail announcements, which means that customers only have to keep a single address updated, and also means that it isn’t necessary to copy their addresses across periodically to keep a separate bit of list software up to date.

There are still plenty of things to come, including a new product, which should be available for beta test late this month.

Over the past few days, I’ve become more and more annoyed by the number of American companies on the ’Net complaining about the “complexity” of accounting for VAT and the fact that they have to identify their customers’ country of residence, although those of us inside the EU (according to them) don’t.

To set the record straight, the moment you start thinking about physical goods, VAT is even more complicated to account for if you are inside the EU! In particular, non-EU businesses can register under a simplified scheme that means they only have to register in a single member state and must pay all VAT due (at rates appropriate to the customer) to that member state. Whilst intra-EU trade is simpler in the case where the company is providing a service over the Internet (because they are only required to charge VAT in their member state in that situation), if any physical goods change hands, then it balloons into a monster! To trade physical goods within the EU, you must:

1. Identify the country of residence of your customer.
2. If the total sold into that country is over the distance selling threshold for that country (which isn’t necessarily in the same currency as the sale, and may not even be in the same currency as the VAT you must charge!), then:
   1. If you aren’t registered for VAT in the customer’s member state, you must do so.
   2. If that member state happens to be Finland, then you can’t sell your goods, because Finland requires registration prior to trading.
   3. You have to charge VAT at the prevailing rate for the customer’s member state—but be careful, because some products attract different rates of VAT than others.
   4. This VAT may not be in the same currency as the sale. It may also have to be calculated according to complex and often arbitrary rounding rules, all different depending on which country you are talking about.
   5. You may have to pay the VAT up-front, or in arrears, depending on the member state’s regulations.
   6. You may have to pay the VAT after invoicing the customer, rather than when the customer pays you.
   7. Depending on the regulations in force in the customer’s country, you may have to appoint a VAT representative.
   8. You may have to comply with other onerous regulations (for instance, in Greece, some documentation must be handed over in person)!
3. If the total sold into the customer’s country is below the distance selling threshold, then you can charge VAT in your member state instead. This usually means that you have to quote VAT in your currency on their invoice, even if you have decided to bill the customer in their own currency. Plus, the customer will probably be expecting to pay VAT at their local rate. All of which adds up to a certain amount of confusion.
4. Additionally, you need to remember that if you have (for instance) downloadable software and a CD-ROM on the same invoice, you may need to comply with two different VAT regimes (which may have contradictory rules) on the same invoice, and you’ll have to quote two separate amounts of VAT.
</ol>

You can’t even (necessarily) get around the VAT complexity by outsourcing, because of the rules over “triangular transactions”, which are explicitly designed to prevent such things.

What this means in practice is that it’s impossible for an EU company to trade properly over the Internet, because you won’t be able to tell when the distance selling threshold has been exceeded when quoting a price to your customer. Of course, you are allowed to register for VAT individually in every member state of the EU, but that’s 25 sets of complicated, contradictory and often obtuse sets of rules that you must comply with (potentially more than one set at once, even on a single invoice), and what’s more, it means filling-out up to 25 separate VAT returns every month, many in a foreign language—and I don’t know about you, but I certainly can’t speak a word of Dutch, Italian, Greek, German or Spanish, let alone any of the less well known languages. Oh, and just to top it off, a lot of it has to be done on paper because of countries that don’t allow electronic VAT returns, or (like Germany) still require a paper return even if an electronic one has been provided. And as I mentioned above, you actually have to go to Greece! Aaaargh!

Obviously, all of this is fine for large companies, because they can just register everywhere and employ enough people to handle it. But for smaller companies, it’s a real nightmare.

Basically, what I’m trying to say is that the majority of American organisations that have complained about how complicated it is for them don’t even know that they’re born! The rules within the EU are frankly diabolical, and still provide a considerable advantage for companies selling into the EU from outside, especially for smaller organisations.

Disclaimer: I should just add that I’m not a qualified accountant and that the above shouldn’t be used as tax advice. If you have a question about VAT, then EU member states often have VAT helplines that businesses can use to get definitive answers, or, failing that, you should either consult a professional adviser or obtain copies of the relevant laws from the appropriate authorities.

Movable Type really is an excellent piece of software; the upgrade to version 3 went (almost) totally without a hitch, the only problem being that commenting broke temporarily whilst I sorted-out how to enable TypeKey authentication.

Anyway, hopefully that will put an end to the flood of comment spam that I’ve been experiencing over the last day or so (oddly enough, I don’t want links on my site to pornography, places to purchase drugs or financial scams). If only the U.S. Government would take the poor behaviour of some of its citizens on the ’Net as seriously as it takes things like obvious jokes about bombs at airports… ;-)

I realise, by the way, that it isn’t just Americans that are responsible for spam, but it is certainly mostly Americans, both from personal experience and according to people like Spamhaus. Indeed, MessageLabs claim that:

“…more than 80 per cent of global spam originates from fewer than 200 known spammers in the U.S.A.. Many are based in the small town of Boca Raton in Florida…”

It’s a shame that those 200 people—or others like them—are still being allowed to give the United States a bad name, although at least the FTC is finally cracking-down on some of the spammers who were flouting the rather weak CAN-SPAM Act.

There may be a few problems with my weblog for the next few hours, because I’m upgrading to a newer release of MovableType (for one thing because I’m thoroughly fed-up with comment spam…).

…is that email (even in plaintext) is in any way less secure than a telephone, a letter or a fax.

People who take this viewpoint usually haven’t actually considered the security of the other media in any way. First, let us consider telephone calls and faxes; in the U.K., there are still an awful lot of exposed telephone cables… and even if they are only exposed at the edge of your property, it only takes a few minutes to splice some wires onto your cable, at which point all of your supposedly more secure telephone calls and faxes are easily intercepted. Unless you routinely encrypt them, that is. Mobile phones are a bit safer, because they encrypt your call over the air interface. Unfortunately, the encryption isn’t really strong enough, and in any event, chances are that you’re calling a vulnerable landline—and remember, you only need to tap one end of the call to hear the entire thing.

And as for letters… well, I recently had a debit card go missing in the post, so don’t talk to me about letters! Plus there was a very good television programme recently demonstrating just how easy it currently is to get a job in the Royal Mail sorting departments and how easily that position can be abused.

The difference is that in order to intercept an e-mail, you have to be clever (or you have to have clever people helping you). At the very least, you have to persuade the Internet e-mail system to route it to you rather than to its intended recipient; now, there are a number of techniques you could use to do this (which I’m not going to go into here), but none of them are especially easy for a layman (unless you can find a program written by some irresponsible but clever individual that already does what you need). Unlike tapping a telephone line, which can be done by anybody with an easily purchased engineer’s telephone, a sharp knife and some wire and croc-clips.

On top of that, with S/MIME support in several major e-mail packages—including the very nice implementation in Mac OS X’s Mail.app—it is almost trivially easy to encrypt an e-mail message. Contrast that with telephony, where you need special equipment at both ends, or letters, which would have to be tediously encrypted and decrypted at either end.

Of course, you could point-out that e-mail could be intercepted by tapping the telephone line as well, and you’d be right. It can. But it isn’t really any less secure than a telephone conversation over the same piece of wire, and it’s often more difficult to find the bit of wire associated with an Internet link than it is to locate the cable associated with a given phone number; in the latter case, .

Wired News have posted an article about the closed vs. open source debate, in which they say that James Gosling, widely acknowledged as the creator of Java, slammed Apple at Sun’s JavaOne Conference this Thursday.

As an example of problems he said he believes are caused by closed-source development, Gosling slammed Apple, saying that the company doesn’t provide enough information about its programming bugs and security flaws.

“You don’t know what's going on in that code,” said Gosling about Apple.

Now this is pretty cheeky. Apple have actually released most of the components of their operating system under some type of open source license, omitting mainly the GUI parts—which are less likely to contain security flaws. When you consider this, it becomes clear that James Gosling was actually engaging in a point-scoring exercise with his audience, by capitalising on recent criticisms of Apple in some sections of the computer press. Generally speaking, I have to say that I think that criticism has been unfair and is really a result of the existence of a large body of vociferous Windows devotees who for some reason feel the need to devote a large amount of time to finding ways to claim that Windows is in some way better than a Mac (thereby missing completely the point that Windows is a piece of software, whereas the Mac is a computer, and a very nicely designed one at that).

Some of the points that have been made are clearly valid, but I don't agree that immediately informing the world of every security hole is always the best way to approach a problem. In the PC world, every time a new hole is reported by CERT or BugTraq, a spate of new viruses are created that exploit the flaw. Even if you wait until a patch is available before detailing the vulnerability, the chances are that many users won't have applied it.

I don't agree with total secrecy either, of course. But I bet that Apple keeping things close to their chest is one of the factors behind the current lack of Mac malware.

My company’s website is now active and (I hope) ready to accept payments. I can also reveal what I was working on (and being so secretive about); the company’s first product is a piece of software called iPartition, which is an advanced partition management tool for Mac OS X. Not only is iPartition capable of resizing HFS+ (Mac OS Extended) partitions without reformatting them, but it also takes care of any rearrangement of other partitions on the disk that may be necessary as a result. It also lets you queue-up several operations so that you can go away and let iPartition get on with it while you have a cup of tea (or coffee). It’s a fully native Cocoa application, enhanced for Panther (it looks prettier), and very easy to use.

If, by chance, you need a disk partitioning tool (for example, you’re dying to have a go with your new Tiger Developer Preview), you might want to consider it.

Here’s a screenshot:

BTW, it’s only available for electronic download at the moment; hopefully at some point we’ll be able to ship CDs as well, but for now, if you want to use it to repartition your boot disk, you’ll need another Mac (so you can use yours in FireWire target mode), or another disk you can boot off. An easy way to make a bootable Mac OS X CD, if you don’t already have something suitable, is Charles Srstka’s excellent BootCD.

(Oh, by the way, I know that IE on Windows doesn’t render the company’s site properly; it’s IE’s box model bug and its lack of support for transparent PNGs that are the problem, well, that and some slightly incompatible Javascript. I’ll get round to fixing it soon, although the site is still usable.)

Well now I feel violated. For various reasons, I had an old Lloyds TSB bank account that I hadn’t closed; well, mostly because I was told that I had to go to my branch to do it (and the branch in question is a long way out of my way) and because it still had a couple of direct debits associated with it, one of which was directed to a recipient who refused to acknowledge the validity of the sort code for my new bank account. Anyway, it’s been floating around for four years now, and because it only held £50, I decided that I couldn’t really be bothered to close it.

Now, I wish I had. Apparently, in May, Lloyds TSB sent me a new debit card/cashpoint card. Only it didn’t actually get to me. No, some light-fingered #!*$ in the Post Office must have pinched it, because today I got a letter from Lloyds TSB asking me to confirm a load of transactions, made with a card I don’t even have. Why did I get a letter, you ask, rather than a telephone call? Well, I moved house recently, and guess who I forgot to tell? That’s right, Lloyds TSB, who hold a bank account that I don’t really care about. Fortunately, my mail is redirected, so I get letters from them.

What really irritates me about this is that card issuers have known for ages that cards go missing in the postal system, and some of them—American Express for example—have solved the problem by sending the cards inactive and requiring their customers to phone up and activate them. Not so, Lloyds TSB. No, they send active cards through the post. Last time I received one from them, I don’t even think they used recorded or special delivery, although that, of course, was a couple of years ago now.

The banks, of course, will probably tell you that “Chip & PIN” will stamp this problem out once and for all, but, looking at the short list of transactions that Lloyds sent me, I would guess that they were made by criminals overseas, because of the bizarre retailer names. And I doubt very much that every country on the planet is going to simultaneously transition to “Chip & PIN” overnight.

Lloyds TSB, for their part, have said that they will refund the money. Well, once I’ve signed a declaration to say that it wasn’t me that spent it, anyway.

Lawrence Lessig, Professor of Law at Stanford Law School and writer for Wired Magazine wrote yesterday about the potential impact of the EU ruling against Microsoft, saying that Microsoft needed to “solve its antitrust problems” and implying that the EU’s action had in some way hampered competition.

Even more surprisingly, Prof. Lessig seems to be under the impression that there is a reason for the popularity of Windows Media other than Microsoft’s dominance of the operating system market, citing the availability of Media Player on other platforms including Mac OS X and Solaris. This, it seems to me, is a rather naïve perspective on the situation; as far as I can see, Windows Media is a popular format for content producers because 90% of content consumers already have Media Player installed on their systems—and why is that the case? Well, because they’re running Windows. Yes, Media Player may be available on Mac OS X, Solaris and other platforms, but, oddly enough, sites targetting primarily Mac users tend to pick QuickTime rather than Media Player, and sites targetting UNIX users generally plump for MPEG or Real Media.

The EU ruling is, of course, far too late, and the fine is far too small. In any event, Microsoft will appeal it and attempt to defer paying any fine until the last possible moment—it doesn’t matter to them that this is a dishonorable course of action, because Microsoft, like many large corporations, are more interested in the bottom line than in doing the right thing. They know that they are guilty, that they are attempting to dominate a variety of markets by integrating the required software into Windows or by bundling it with Windows, leveraging the popularity of Windows and the naïvité of their users to ensure that competing products’ markets are destroyed. But they don’t care.

If there were one question that I could ask Bill Gates, it would be “How much money is enough?” I wonder whether Bill and his company have ever stopped to consider the answer to that one.