Digital Root,2003:weblog-1775616 2015-02-20T12:48:49-08:00 Technologist & Digital Anthropologist TypePad Bayes Theorem Illustrated with Legos,2003:post-6a01053619627c970c01b8d0da707f970c 2015-02-20T12:48:49-08:00 2015-02-20T12:48:49-08:00 Bayesian Logic with Legos Brian

The complex and often conflated Bayes Theorem was recently simplified using lego pieces on the blog  This isn't the first attempt at making the reasoning theory easier to understand, but certainly is more accessible that anything I've seen before.


Bayes' Theorem states:  P(A|B)=P(B|A)P(A)P(B)  Which is a logical expression of probability (P) given varying combinations of conditions (A&B).  Bayesian logic is an elegant way of quantifying puzzles like "I have two children. One is a boy born on a Tuesday. What is the probability I have two boys?

This theorem may seem trivial or narrowly applicable, but its been used to great effect in the real world. Spam detection in email,  finding plane wreckage in the ocean, and treasure hunting all rely on the notion of continually evaluating conditional association (how much does this email look like other emails marked spam?).

Download (1)

If you've not used Bayesian logic in your problem solving, I encourage you to take a little time to understand the process and benefit from its usefulness.


Brand Heartbleed,2003:post-6a01053619627c970c01a73da7bcb5970d 2014-04-11T14:42:43-07:00 2014-04-11T14:42:43-07:00 Online brands are learning what it means to manage PR in the always-connected world Brian
Heartbleed Iconology

On Monday April 7th, OpenSSL published an advisory that by April 9th became a catastrophic level security hole that affects practically everybody who uses the internet. You may have heard it called Heartbleed. It even has a nifty logo.  The threat may be summed up as this: “The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software.

OpenSSL is a commonly used software mechanism that encrypts data between two or more systems. It’s what enabled people to start shopping online, store privacy information online and identify themselves with usernames and passwords.  There are a number of implementations of SSL, but OpenSSL has been favored by open-source developers for years. 

The bug itself is a relatively common one and easily fixed. It’s how the bug exists that pushes this into the catastrophic category. With little effort and without tripping any alarms, a malicious program can get peeks of unencrypted data (that is otherwise on its way to being encrypted) 64kb at a time.  The bug has been in existence in > 25% of the top 1000 websites for the last two years, with virtually way of tracking it or proving someone used it.  Consequently the reach implicitly extends to anyone who uses a username/password online, at least potentially.

Exploiting this defect is a bit of finding a needle in a haystack – you’d need to randomly pull 64kb of data (65535 characters) and compile it over and over again, over a long period of time and run pattern matching search algorithms against the data to see if your 64kb “peeks” contained anything good.  Eventually, with enough samples, you might find administrator passwords, or security certificate challenge phrases that would in turn allow you to get into a system to do something more. 

example of heartbleeds bug
Heartbleed example

A group of online brands fixed the problem and then alerted their users as to the vulnerability, and instructed them to change their passwords. Flickr, Youtube, OkCupid and many others were directly using the flawed OpenSSL implementation and fixed it immediately.  They also for the most part, contact users and kept them in the loop as to what to do next and the seriousness of the problem.

Other brands remained a little more obtuse and posted blog entries or made a general statement. For instance Amazon made an announcement that they weren’t affected by the bug, only to later state, that most of Amazon wasn’t affected, but their EC2 cloud-based load-balancing servers did use OpenSSL, so they were vulnerable: whoops, lol, r bad.

Statistically speaking the chances you’ve been exposed to the bug are about 74%*.  That doesn’t mean your information was taken (the odds of critical data being comprised are incredibly small) it just means the potential for the bug to have occurred is probable.  This is because most Software as a Service companies use tools that themselves utilized OpenSSL.  By extension, the risk of exposure goes up with as many services the original service has visible to the outside world.

Brands that operate in any meaningful way online should have already have fixed the bug and alerted users to change passwords/encryption keys. Even though the probability of your data being exploited is remote, the volume of opportunities that existed to attempt to exploit the bug is exponential to the number of minutes that have passed since the bug was first deployed.

In an online and increasingly connected world, businesses have to adjust to a PR model goes beyond damage control and is proactively transparent with its users.  Instances where companies have attempted to downplay or cover-up data thefts have backfired – typically because of the perception of what might happen, rather than what did to those affected by the theft. The causes of the problems are understandable. Not communicating it immediately and clearly on the other hand, is not.


* Bayesian theorem with Probability (P|H) of using a site at least once that requires a U/P =.5, Probability (P(D|H)) those sites are vulnerable * number of OSS tools that use OpenSSL and are exposed to the internet =.7 and Probability (P(D|H)) that a site is using OpenSSL but never had it exposed to the internet .25

 P(H|D) = [P(D|H)P(H)]/[P(D|H)P(H)+P(D|H')(1-P(H))] = .074 / 74%



TOR, Bitcoin, Grey Markets and Anonymity,2003:post-6a01053619627c970c01901e9e586f970b 2013-08-04T16:54:13-07:00 2014-04-11T14:52:54-07:00 TOR, Bitcoin, Grey Markets and Anonymity - what do these things have in common, and why are they a threat? Brian
silk road 2
Silk road 2.0

Over the last few days the largest TOR network was hacked (ostensibly by the NSA and FBI).  Its imaginable that other large TOR networks will see the same thing happen over the coming weeks.  In particular, there's speculation that a network known as SR (Silk Road) which operates as a simplistic clearinghouse for drug-trade will be next, if it hasn't already been compromised.

Interestingly, its created some concern about the economy of bitcoin and the long term impact on virtual currency exchanges. 

But, You ask: "What does anonymity have to do with virtual currency, and why is drug trade and TOR being mentioned in the same sentence?" 

TOR is a simplistic mechanism by which your web traffic can be masked (ala Pirate Bay or Torrents) through networked proxies. People use it with encryption to effectively hide the online footprint (or at least obscure it) for a variety of reasons.  Unfortunately, so do criminals and individuals who have strong motive to hide their actions online.

This gave rise to a need for a non-audit-able means to exchange services or goods without the use of regular banking systems. Enter bitcoin. Simultaneously loved by programmers, network engineers, hackers, pornographers and drug traffickers alike. The simplicity of exchanging fiat currency (e.g., dollars, euros) for a virtual "Credit/coin" coupled with an online exchange enables people to buy and sell illegal things with ease.  So powerful is the desire for an open-source currency that the infamous Winklevoss twins took a bunch of their Facebook money, and funneled it into a legit bitcoint venture.

Under the claim of protecting people from illicit materials and stopping terror, the NSA hacked a large TOR operator and injecting tracking mechanisms on anyone using it. Effectively removing the anonymous cover it provided for any of its users. 

I predict bitcoins exchanges will be forced to play within currency-managed regulations or face a similar shut-down in the future. Now that the US and UK (at probably most UN/EU participating Countries) are actively tracking and monitoring everything its citizens say and do, it's unlikely they'll allow a system by which they can end-around the Fed Bank.  It'll be presented just as the ISP filtering act is shaping up in the UK.  Its about forcibly protecting your children, from dating, or "questionable news sources", or images or thoughts inconsistent with political favor.

In the end, anonymity, unsanctioned markets and voluntary cooperation are becoming extinct. The millennial curse of nanny-state-ism is in its infancy. In 15-20 years, 1984, Brave New World and other distopian works will have proved more accurate than any religious prophecy ever recorded.


You Are Beautiful,2003:post-6a01053619627c970c017d43241476970c 2013-04-26T10:40:21-07:00 2014-04-11T14:47:48-07:00 Doves Beauty-Sketches campaign subtly and possibly unintentionally perpetuates gender bias. Brian

Insightful and poignant post on Futurelab by Denise Lee Yohn Today.  The crux of the topic relates to Dove's campaign and how its been critically perceived. 

On its surface the campaign message is an extension of their efforts to associate Dove with the politically correct theme of self-esteem and real beauty.  Ostensibly aligning Dove as a product of choice in this psychological arbitration. But there's an unintentional tone-deafness to the message in that it continues to define women's value via beauty standards, though in this case a reduced one.

beauty sketches from Dove
beauty sketches from Dove

When brands or products attempt to position themselves along side a popular belief it runs the risk of revealing a hidden bias.  In this case its a back-handed compliment of "See you're prettier than you think... thus more desirable than you think...  your friends at Dove knew this all along... buy some soap".

For brands that want to cater to women (or those segmenting them, as if gender alone is a sole determination of psychology) it helps to not see them as a component in your Value Chain. These are people with aspirations and social strategies designed by millions of years of adaptation. To ignore them in favor of a popularized belief system undermines and alienates the very people they're trying to influence.



Consumers Really Care,2003:post-6a01053619627c970c017c38201280970b 2013-03-26T12:48:48-07:00 2014-04-11T14:47:25-07:00 Consumers don't care about your brand, and social media isn't going to change that. Brian



To be fair, we are all consumers, and we do care - a lot. But not about marketing or branding or engagement or "joining the conversation".  We care about things that matter - love, health, sex, friendships, the future, our families and friends.

Marketers and advertisers have been patting themselves on the back for a while about how they've tapped into this 1-to-1 audience via social media. So much better than TV ads, they'll say.  But at the end of the day they're still pushing more banners, ad insertions (ahem... Facebook?) to induce ADD-style interuption.

A recent article from W+K Amsterdam that a colleague sent me, elegantly and simply illustrates how marketers are getting it wrong.  Here's an excerpt. Read the the deck to get the perspective on what does matter and where Brands fit into Social media.









Yeah, But You Didn't,2003:post-6a01053619627c970c017ee5b03b30970d 2012-11-27T18:03:53-08:00 2012-11-27T18:05:04-08:00 Read an interesting blog post today. I see this daily where online critics judge the work of others in a light that suggests they've never attempted to create a thing on their own. What puzzles me the most about a... Brian


What puzzles me the most about a lot of people, is the lack of appreciation for work others do. And complaining about everyone and everything nonstop on social networks. This article is a complaint by itself, so this is some kind of a recursive problem, but that’s not the point. I think seeing greatness in others is what makes one able to achieve greatness himself and if you can only see bad, you are meant to become a snob one day. Pretty sure that’s not a carrier [sic] path you want to take.




Minimal Semaphore Architecture for Key Value Transaction Processing,2003:post-6a01053619627c970c016769460734970b 2012-08-14T11:07:19-07:00 2012-08-14T11:08:26-07:00 Minimal Semaphore Architecture for Key Value Transaction Processing Brian

An interesting interview from the High Scalability blog points to a novel architecture that minimizes traditional locking and concurrency controls, without going full-on NoSQL.  For those applications that require high volume, rapid transaction processing (micropayments, single signon, gaming concurrency, etc) this could point to a new hybrid of SQL/NoSQL in a cloud environment.


In a single machine environment MemSQL makes an excellent case for their architecture. In a distributed environment they are limited in the same way every distributed databases is limited. MVCC doesn’t offer any magic as it doesn’t translate easily across shards. The choices  MemSQL has made reflect their primary use case of fast transactions plus fast real-time SQL based analytics. MemSQL uses a sharded shared nothing approach where queries are run independently on each shard and merged together on aggregation nodes. Transactions across shards won’t be supported until two phase commit is implemented, but then they will perform like any other database.  What they really want to do well is run fast real-time aggregations across a cluster so that’s what their design reflects.

Read more about it here:


Innovation is Hard,2003:post-6a01053619627c970c0167654f56b9970b 2012-04-18T10:11:29-07:00 2012-04-18T10:12:42-07:00 Corporate bureaucracy and Human Resources one-size-fits-all approaches to innovation management stifles and strangles creativity and innovation. Avoid these traps that kill your efforts before they start. Brian

In light of the pervasive corporate opinion that "best" things come from flat organizations with democratic process that is devoid of personal risk or gain, innovation efforts inside organizations tend to fail before they start.

This series from HBR discusses the challenges with innovation. Simon Rucker writes - "Why? I think the pervasiveness of the nicely-nicely work culture has a lot to do with it. It slows down and obfuscates the transformational innovation process because it creates the expectation that work should be fun and devoid of the difficult situations, demands, and emotions the process creates."

Its not to say that an organization must be totalitarian, but there is a reason why startups tend to have challenging personalities running them. They push, reach and demand as much of themselves as those around them. Organizations that focus on bureaucracy and treating every person and process identically (as if the ideal format is perfectly depicted at the DMV) destroy critical thinking.  Its centralized in nature and punishes anything that disrupts central planning.

What if the company you're in isn't as slow and centralized? Then you need to insure that your efforts are subject to critical thinking. Identify boundaries, look-alikes, opposites, break it a hundred times, redefine and measure it.  Its that kind of objective reasoning that makes solid ideas manifest into great products.  The over-optimistic or envious entreprenuer wants to copy everything that's already working - ignoring the fact they're too late to the game.

Specificity of objective is often the first step towards innovating. Even the improbable, if specific and rationally considered may work, whereas vague, childishly optimistic and emotionally rooted "directions" will flounder.

The Mind-Language-Physiology Link,2003:post-6a01053619627c970c015393610fca970b 2011-11-21T17:58:17-08:00 2011-11-21T17:59:19-08:00 Knowing 10 words for the color blue helps you see more shades Brian

When I was a boy, I believed that people with blue eyes could perceive the color blue more acutely than people with brown eyes.

This research doesn't exactly prove that, but it does suggest there's a mind-language-perception link going on.

It was clearly the language system interfering with a task that was presumably purely visual: distinguishing between different colors. Categories in our thinking may go much deeper than we think.



While not conclusive, this research indicates that having a greater definition of a given color enables perception to a more granular degree.  Its conceivable that this language-physiology link permeates our ability to think and perceive well beyond colors.

QR Codes and That Guy Who Uses Them,2003:post-6a01053619627c970c0153930fc29c970b 2011-11-14T16:35:15-08:00 2011-11-14T16:35:15-08:00 Forrester released a study on QR/Barcode mobile usage. QR/2D barcode scanning is up to 5% (from 1% a year ago) for smart-phone users in the US. Earlier reports stated a total of 14MM "scanned a QR code ever", but its... Brian


Forrester released a study on QR/Barcode mobile usage.  QR/2D barcode scanning is up to 5% (from 1% a year ago) for smart-phone users in the US. Earlier reports stated a total of 14MM "scanned a QR code ever", but its unknown if this was a superset of smartphone or general mobile users.

Either way, it’s still a small market – 6MM people in the US, primarily in the 25-34 "affluent" demo.  Something to consider when adding QR codes (especially if its intent is solely to redirect to a URL) to print/web materials.  In fact, if you're setting up QR codes to redirect to a simply root URL, you're wasting your time.


Because these reports rarely quantify their numbers, I pulled the latest survey data from Q3'11 US Census, CITA, ITU and Nielsen data.


Mobile QR Code Usage in the US

Approx Mobile accounts:                 285.0MM

Approx Smart Phones:                     114.5MM

Approx QR/Barcode Users:                5.7MM


Over the next 24 months I'm expecting to see a shift from QR code usage to object/image recognition as redirect markers.  Most smartphones can train and recognize an image or object in the real world as a redirect or augmentive marker, rendering the insano checkerboard that is a QR code less novel.