I've been running as a non-privileged user (e.g. not an administrator account) for a while now, reducing the security risks of day to day computing. This was spurred on by the rising prevalence of root-kits, which are even being unleashed on an unknowing public by respected corporations. 

While this is simply a well-known good practice, it is remarkable how many ridiculous little irritants one runs into trying to do this: Even widely used applications like winamp fail to run as a non-admin without security tweaks, and of course you can't even open the system tray calendar without customizing your user rights. Thus far I've been very impressed by the behaviour of Visual Studio 2005 and friends, which seem to do a great job of living within the constrained permissions. I have to su every now and then to do some administrative tasks, but the threat window is vastly reduced.

Of course we all know that this is simply a good practice (and I would have done it far earlier if not for some demanding development tools), just as a number of other standard but sadly ignored security precautions should be the norm. On this theme, earlier today I was wondering if there was a "Computer Security Day" - A day when people could be gently reminded to take computer security initiatives (such as not running as administrator) to make the computing world better for everyone: While it might seem like it's only for individual gain, we all gain when there aren't millions of zombie computers at the bidding of hackers and spammers.

Turns out that there already is such a day. It's actually coming up in just a couple of weeks, as it occurs every November 30th. Which brings me to my real comment - scheduling such a largely business-related event to occur on a specific calendar day is ridiculous, and of course almost 30% of the time that's going to fall on a weekend. It seems only logical that it should have been the 3rd Tuesday of November, or whatever.

I needed to post a support question to Electronic Arts support today (long story), and like many sites they force you to create an account.

Fine. So first things first I have to create a user account, and it's asking for a username.

dforbes...sorry that account name is already taken
dwforbes...sorry that account name is already taken
dennisforbes...sorry that account name is already taken
denniswforbes...sorry that account name is already taken
dennis.forbes...ILLEGAL CHARACTERS!
dennis_forbes...ILLEGAL CHARACTERS!
forbesdennis...sorry that account name is already taken
RRR...sorry that account name is already taken
blah...sorry that account name is already taken
blah999...sorry that account name is already taken
RRRRRRR999...taken

I'm not kidding. It was actually proposing ridiculous available alternatives for each, so I didn't have to keep trying, but at this point I was just punching in random strings to see how huge and polluted their database really is. It's big, and it's polluted.

These sorts of user accounts irritate me because I already have a globally unique account - my email address. No one else, in the whole wide world, has the same email address as I do. Furthermore I don't have to remember whatever oddball account you've forced me to take through arbitrary and site-unique username restrictions: Just use an email address and you can allow whatever is allowed in the RFC (it's all documented there for you), and when I get there I'll know what my username is. Why it's my email address! You're forcing me to enter it elsewhere to validate the account anyways, so you might as well go all the way with it.

I wrote about Riya previously, expressing a bit of skepticism about the technology. I should temper that by saying that I've never used it, and the most I've heard about it are some cursory micro-reviews, but my skepticism is based on the history of facial- and scene- recognition technology, and the barriers this product has supposedly overcome: Facial recognition, like character and voice recognition, has to be accurate enough that it is more beneficial than detrimental (e.g. nuisance false positives, and detrimental false negatives), and historically the latter is far more prevalent. Sure we'll get there, but it's just surprizing that a company could go from the primitive stage that we're at today to such an advanced stage, all in just one step.

Anyways, today I happened to look at my keywords to see that there has been an explosion of Riya postings - Google, or so the story goes, has put a $40 or $60 million dollar offer to buy Riya. If you follow the blogs around you'll discover the big circular authority that is prevalent in these sorts of "blog scoops", with A attributing his source to B, but B hilariously points to A as the authority. Remarkable stuff. Like the technology itself, it could very well be true...but I certainly would take it with a mountain-sized grain of salt.

Indeed, if Riya is as capable as we've been told, I'd say that $60 million would be grossly undervaluing the IP - This would make a photo service stand head, shoulders, and torso above its competition, and I'd be looking for a number more like $400-$500 million. Seriously.