Today, I became a dad. Welcome to the world, little Penelope.

It should not have escaped the attention of any U.K.-based website operator or web developer that ICO has been banging its drum about the changes to The Privacy and Electronic Communications (EC Directive) Regulations 2003 and in particular section 6, which has been amended to say

Confidentiality of communications

6.—(1) Subject to paragraph (4), a person shall not use an electronic communications network to store information, or to gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of that terminal equipment—

(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and

(b) is given the opportunity to refuse the storage of or access to that information.

(3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user on more than one occasion, it is sufficient for the purposes of this regulation that the requirements of paragraph (2) are met in respect of the initial use.

(4) Paragraph (1) shall not apply to the technical storage of, or access to, information—

(a) for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network; or

(b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.

ICO is emphasising the impact of these rules on cookies, but as you can see from the text of the actual regulations, above, they also cover any “information stored”. This would seem to include

• The User-Agent string

• The Accept-Language header

• The URL itself (which may be covered by the exception in (4)(b), but not if it happens to contain session data)

• Various information that is accessible to Javascript on the client side, but which may be of interest to the server merely to improve the end-user experience — for instance, the end user’s display size or colour depth, whether or not Adobe Flash or Java is installed and enabled, whether or not the end user is using a screen reader, and so on.

It is difficult to argue that the exceptions in (4) apply to all of this information, yet in most cases it would be unreasonable to demand explicit consent from the end user for any of it.

Further questions surround use of services like Google Adwords’ conversion tracking functionality; websites using this feature of Adwords are relying on the Adwords system setting a cookie on the end user’s machine when they click on an advert. This cookie isn’t actually under the control of the site operator—instead, it’s set by Google (via the googleadservices.com server). How is “informed consent” supposed to operate in that case? It isn’t as if Adwords conversion tracking is the kind of thing that anyone should be worried about—all it does is tells the person paying for the advertising how much each advert-driven sale is costing them.

ICO also rightly points out that the legislation applies to session cookies. Yes, you did read that right. And looking at ICO’s updated guidance it’s hard to get the impression that they plan on ignoring that fact.

Ironically, the regulations are actually worse for free services than they are for paid-for services, because the definition given for an “information society service” in The Electronic Commerce (EC Directive) Regulations 2002 is

“any service normally provided for remuneration, at a distance, by means of electronic equipment for the processing…”

and so exception (4)(b) doesn’t apply where remuneration would not normally be expected!

There’s some very wooly language in the ICO guidelines about what ICO considers would and would not fall within the exception, but even if ICO doesn’t think something is worth pursuing, there’s nothing stopping some crazy privacy campaigner from pursuing a private prosecution.

ICO does quite clearly say that you can’t rely on the availability of the “Do Not Track” header and associated browser preferences, contrary to the previous mutterings coming out of government on the issue.

I tried writing a letter to government to suggest some changes to the legislation that would provide some sanity, for instance by explicitly permitting the use of information sent by default by the user’s browser (like the User-Agent string), along with exemptions for session cookies and non-identifying properties of the user’s terminal equipment. In response, I was told that it wasn’t possible to change the law because that would require renegotiating at EU level—not an option at present, apparently. (I note, by the way, that the Danes apparently do not agree that additional work at EU level is necessary, since they have explicitly exempted session cookies, which cures at least one of the problems.)

At present, then, the European Union has broken the web. It turns out that most EU countries have been so slow at implementing the law that this hasn’t been a problem so far, but that situation won’t persist forever.

All of this could have been avoided had the EU actually consulted someone with sufficient technical expertise before changing the law. I made that point in my letter, and was told that various industry players had been consulted (the response listed Google, Apple and others), but it seems to me highly improbable that any competent technical expert would not have objected to the wording from the EU Directive, so my guess is that this consultation was after the fact.

Right now, the simplest thing seems to be to incorporate outside the European Union, and have the new entity run your company website. That would place both the site and the entity operating it outside of this idiotic piece of legislation and the regulators whose job it is to enforce it.

Oh, where to begin…

I’ve been very quiet about all of this; partly for reasons I’ll explain below, partly because I’ve been busy, and partly because, well, it’s just too amazing for words.

Software development is, as has been decried many times, horribly male-dominated. Even more so than engineering in general, and that is pretty male-dominated itself. All of us would love for this not to be the case, but it is, and for the moment at least, however much effort all of us put in to changing the demographics, we have to live with it.

One result of this is that we’re very unlikely to meet anyone at work, and worse, those women we do meet are very probably quite fed up of the unwanted attention they reportedly get from some of our number, are therefore on the defensive from the outset, and in any event are quite probably already spoken for.

Anyway, the upshot is that a fair number of us end up on online dating sites. In my case, the first one I tried was match.com, but came to the conclusion that it’s basically a rip-off; yes, I had a few actual dates, and even an actual relationship, but even using the site makes my skin crawl… sharp practice doesn’t even begin to describe the way match.com and others treat their customers. In many cases you won’t get replies to your messages for the simple fact that the person you sent it to hasn’t paid to be able to send e-mail. That’s right, both parties have to pony up in order to get a response. Either that, or you can buy the right to get replies from people who haven’t paid up, but that, as you might imagine, tends to be an expensive extra. To my mind, the sector needs regulations to protect customers from this kind of thing; if you pay to send messages, it should include the right to receive replies, end of story. Anything else is bilking the customer.

On Twitter, I’d heard about another dating site, OkCupid, which doesn’t force you to part with large sums of money before you can contact one another and which treats its members more reasonably. Obviously, since it’s free, it’s ad-funded (i.e. you are the product), though you have the option to pay to disable the ads if you find them objectionable. I should say, since I’m singing their praises somewhat, that OkCupid has since been bought by match.com, which may or may not have had an impact. It did result in the post about paid online dating that I linked above being removed although OkCupid insisted that that was because it wasn’t accurate, rather than being instigated by match.com.

So, around the end of last year, I had an e-mail on OkCupid from Jo, to which I replied asking if she’d like to go out for a meal with me at the excellent La Regatta in Southampton. Very convenient as she was living on the Isle of Wight at the time, and it’s right opposite the ferry terminal. Owing to the bad weather, we postponed our date until the New Year, but it’s something of an understatement to say we got along like a house on fire; we basically forgot to eat, we were so busy chattering. Our second date wasn’t really much different, though we did actually manage to eat something! I really don’t have the words to describe how much I love Jo; she’s the best friend I’ve ever had, the most wonderful company, and I don’t know now what I’d do without her.

Anyway, a couple of months later, I proposed, and she accepted.

So the first piece of news (to readers of my blog) is that I’m getting married, next July.

The second piece of news — in some ways even more amazing — is that Jo and I should be having our first child some time over the next couple of weeks. We’re both over the moon about this (Jo especially, as she wasn’t sure it was possible), and hopefully there will be another blog post soon enough to welcome a new life into the world.

(In an ideal world, I would have preferred to do this the other way around, but when I met Jo at the start of this year, she was separated but not yet divorced. This is also why I haven’t mentioned anything up to now — neither of us wanted to do anything that might upset the divorce proceedings.)

Jo, if you’re reading this, I love you so much.

If you’ve done any shopping on the Internet in recent years, chances are that you’ve happened across the joy that is 3‑D Secure (aka Verified by Visa or MasterCard SecureCode). This is a system that can be adopted by your bank, supposedly to provide you with additional reassurance that your card details cannot be used fraudulently by a third party to make purchases on Internet sites.

You’ll know if your bank has “enrolled” your card for this scheme because when you make your purchase you’ll very likely be presented with a screen like the one on the right.

Unfortunately, 3‑D Secure is still, in 2011, ten years after it was first launched, a total disaster. Why? Well:

• Some banks don’t tell their customers about it, but have still signed all their cardholders up to the scheme.

• Some banks’ implementations ask cardholders for things they frankly shouldn’t (for instance, in the United States, the customer’s Social Security Number). This frightens cardholders, because they have been told never to enter these details into a website because of the risk of identity theft.

• Typically there is no way to proceed with the purchase without using the 3‑D Secure form; all you can do is use it or cancel. This is often the case even when the user is being prompted to sign up for 3‑D Secure, and as a result some customers abandon their purchase.

• Banks generally outsource their side of 3‑D Secure, which means that the end user is seeing a page from a third-party. Of course, current recommendations from Visa and MasterCard say to use an HTML iframe anyway, so maybe they don’t see that, but if they do have the inclination to check it out, they may very well panic anyway.

• Customers simply don’t expect to suddenly see a page displaying their bank’s logo while trying to pay for something. This is, of course, made substantially worse by their bank not mentioning to them that this will happen.

• Some banks’ 3‑D Secure forms are not as concise as the example above and even in some cases require that the cardholder re-enter(!) all of the information they have already given to the site trying to sell them something. Yes, I did say re-enter.

But, more pertinently, passwords are a terrible way to verify customers’ identities. Even assuming the cardholder doesn’t choose the same password they use everywhere else, they’re likely to forget their password (which is very frustrating), and in any event it is susceptible to phishing or keylogger-based attempts to capture the necessary information.

The sad part is that 3‑D Secure itself is actually able to provide any authentication technique your bank cares to use. There is nothing stopping your bank from choosing something a little more human-friendly - for example, showing you pictures of faces and asking you to choose the correct one - or even providing a card reader and allowing your bank card to directly communicate its physical presence to the bank.

Apparently CPI inflation is now 5.2%, with RPI at some 5.6%. The Bank of England is supposed to set interest rates according to its inflation target of 2%. It even says this, quite clearly, on its own webpage:

Each member of the MPC has expertise in the field of economics and monetary policy. Members do not represent individual groups or areas. They are independent. Each member of the Committee has a vote to set interest rates at the level they believe is consistent with meeting the inflation target. The MPC’s decision is made on the basis of one-person, one vote. It is not based on a consensus of opinion. It reflects the votes of each individual member of the Committee.

Yet, month after month, the MPC has voted consistently against raising interest rates.

Note that the MPC committee is not supposed to vote to set rates according to anything other than inflation. It isn’t supposed to care one jot about anything else, and while it does explain that there is supposedly a lag of “about two years”, the data consistently shows an upwards trend over a much longer period. Put another way, going by the data, interest rates should have been higher in the past, and should be higher now.

I’m still in the process of re-organising things, so a lot of the site is going to have broken links for a while (sorry; it’s just a fact of life, until I can extract all my old posts from Movable Type).

However, there are a few pieces of software that are hosted here, and so I’ve made a page dedicated to those and set up links so they’ll still be available.

It’s been quite a while since I last wrote a blog post on my own site. Partly this is because I’ve been busy with work. Partly it’s because I’ve been busy with life. Mostly it’s been because I haven’t had the time to configure a server to host it since we moved the company site to its current location.

One might retort that I could just have set something up on TypePad, or Blogger or some such, and that’s true, but it doesn’t really provide the kind of service I’m after. So I waited, thinking that eventually I’d get around to organising myself another server with MovableType on it. Of course, this never happened (too busy), so the situation persisted, and in the meantime I’ve built up quite a few things I wanted to say, but didn’t really have anywhere to say them.

Then, just the other day, we received the sad news that Steve Jobs, the visionary behind Apple, NeXT, Pixar and all of the great work that flowed forth from those companies, died. Sure, I posted something brief on my company’s blog, but more than that doesn’t seem appropriate for that location.

Anyway, in the meantime, Matt Gemmell had been talking about changing blogging platform as a result of persistent performance problems with WordPress, and indeed had actually switched to Octopress. MovableType, my previous blogging platform of choice, doesn’t suffer from the performance issues that plague dynamic blogging software such as WordPress, but Octopress does offer other advantages, especially the fact that posts are stored in plain text files, under version control.

So, I’m switching. This does mean that it might be a little while before my website settles back down again, and I’m intending to move one or two things about a bit. Plus I’m vain enough to want my blog to look unique, so now I have a new blog theme to design. But hey… it’s all fun.

So I said ages ago (here too) that I’d release the source code for a Finder-style icon view that I had sitting around on my disk.

Yesterday, while listening to the speakers at the first day of NSConference, I managed to find the time to tidy up what I had and to make it build and run properly on Snow Leopard.

The code isn’t perfect — I can think of lots of things that need doing to get it to the stage where I’d want to use it myself in an app — and because it was started way back in 2005 and slowly tinkered with over time, I’m sure there’s plenty that could be tidied up too… but it does provide a lot of examples of using all kinds of Cocoa functionality, some of which is not so obvious until you’ve tried it once or twice.

Anyway, it’s available under an MIT-style license from Google Code.

Earlier today I went to see Avatar 3D over at the Vue Cinema in Eastleigh. James Cameron has a pretty good track record, but I won’t deny being a little worried that the film might concentrate too much on special effects at the expense of the story, but I was very pleasantly surprised.

It would be very easy for the 3-D effect to become the centrepiece of a 3-D movie, but it seemed as if it was carefully thought out. Nice touches included the fact that some of the humans’ display devices were themselves displaying images with depth and the various things floating in the atmosphere (including the Atokirina’ and the dust after the destruction of the Na’vi Hometree).

The only thing really wrong with this type of 3-D right now is that you can’t focus anywhere other than where the camera is focused. Of course, fixing that is incredibly difficult, since you’d need to be able to adjust the focal length for specific areas of the image in the projector, not to mention adding the requirement of being able to film everything in every shot in perfect sharp focus in the first place.

Pandora itself is amazingly beautiful, particularly at night with all of the bioluminescence, and it really is difficult not to marvel at the amount of work that went into designing the lush and importantly believable landscape of the Pandoran forest and its native wildlife.

Anyway, it’s a wonderful film; let’s hope James Cameron gets to make a sequel. Let’s also hope that unlike the Alien series (which has been fatally marred by the awful Alien Resurrection, not to mention a certain amount of stupidity in the AvP films), the studio knows when to call it quits.

So far over the past week, we’ve had two people tell us that they think some sort of scam is going on via our website after their bank decided to ask them for something stupid as part of its 3-D Secure (Verified by Visa/MasterCard SecureCode) implementation.

The first one was a U.S. bank that decided it’d be a great idea to ask its customers to enter their Social Security Number into a web form on the Internet. U.S. citizens are understandably very wary about giving out their Social Security Numbers on-line, particularly on websites they don’t recognise, and it also seems that the bank in question apparently hadn’t mentioned to the cardholder that it might go and ask them for this information during a card payment transaction, resulting in a worried e-mail to us asking if it was some sort of scam.

The second incident involved a credit union that had told its members that it would never ask them to enter their credit union member number online. And then it did, in its 3-D Secure authentication form. Again, we get an e-mail asking us if it’s some sort of scam.

Most of these problems seem to be due to inept security policies at U.S.-based card issuers. At the very least if you are going to enroll your customers’ cards for 3-D Secure, you need to make sure they know what to expect when they see the Verified by Visa or MasterCard SecureCode boxes appear. Otherwise it’s actually a major security risk, because someone could set-up a site that pretends to use VbyV or MCSC and asks for information like Social Security Numbers that can then be used for credit fraud.