Do Not Buy Avi-On Light Switches

I bought a GE Avi-On light switch for my daughter's room. This replaces the regular wall switch with one that can be remotely controlled from her phone. The idea was to allow her to turn off the overhead light from the bed. It worked for about 10 minutes until it started downloading a firmware update to the switch, at which point the update failed. The switch no longer works. Lots of people are reporting the same issue, which means there are thousands of these switches throughout the country with this problem.

The Avi-On switches have these problems:

1. The phone software always requires an internet connection and a login to the Avi-On site. Why? This is a Bluetooth app. There is no reason whatsoever that it needs a connection to a remote network. It only needs a connection between the phone and the switch.
2. It requires location services turned on and access to the file system on the phone. Why? This just smacks of them just wanting to harvest information from the phone, because there is no need for these permissions. The only thing that would require these accesses is for a firmware update to be downloaded from the network to be pushed to the switch. Which leads to...
3. The firmware update failed. You cannot push down a firmware update to remote switches if the firmware destroys the switch! And if your testing is abysmal and you somehow screw up and release a bad update, you must pull the firmware update off your site the moment you realize it. People have been reporting that the Avi-On current firmware update is causing problems for the last two months, but they are still pushing out the update.
4. These switches supposedly make a Bluetooth mesh with other switches in the area to allow spanning past the normal range of Bluetooth. Bluetooth isn't the right technology for home control. The range is too short, which means you either need a huge number of these devices, or you need repeaters about every 33 feet apart. That's an expensive solution to home control. The goal on home control is to have connectivity that ends at the walls of your house, but not before.

In summary, do not buy Avi-On GE Bluetooth light switches, or anything else made by Avi-On Labs. I will be returning this switch to where I bought it.

The Design of Everyday Things

When I worked at Microsoft, they gave anyone who wanted one copies of several books. One was The Design of Everyday Things (originally called The Psychology of Everyday Things), by Don Norman. The Design of Everyday Things is still one of my favorite books. It is not really about computer interfaces, but all the rules apply to computers. It covers things like: why is it that when you come to a door in a building you are always pushing when you should be pulling, pulling when you should be pushing, or pushing on the side where the hinge is? It's because the door design told you to do that (and don't you feel stupid when you do!). If designers were allowed to design emergency exits, lots of people would die in fires. We don't let designers create emergency exits. Think about that the next time you click on something that looks like a hyperlink and you don't go anywhere.

The Entire Web Should Use SSL All the Time

The entire web should be using SSL (secure socket layer) all the time. SSL causes resources on a web server to be encrypted on the server and decrypted on the web browser. This means that intermediary parties cannot view the information as it moves between the web server and the browser. They can get at the meta data, but not the content. Why is this important? For unencrypted traffic:

1. For dynamic content, it can be read.
2. All content can be manipulated.

If you have web based mail and it does not use SSL, then a party can essentially tap the connection between your computer and the server and read your email. I'm not pointing fingers, but one example would be the NSA.

All content can be manipulated. There have been cases where ISPs (Internet Service Providers) have grabbed the HTML (HyperText Markup Language), and injected ads into the content being delivered. Programs downloaded from the web site can be intercepted and malware injected. I don't want anyone messing with the content that I deliver from my server.

There are three reasons why people do not use SSL on their web servers:

1. It doesn't compress. A web server can automatically perform compression on text before sending it across the wire to the browser, where it can be uncompressed.
2. It requires a separate IP (Internet Protocol) address for each web site.
3. It costs money for the certificates for the site.

Compression of text is just not that big a deal. Unless you are moving a lot of text and your bandwidth is tight, you just aren't going to see huge gains using compression. As an example, let's suppose that you have 10000 (~10K) characters on a web page. That's a pretty big page; most are considerably smaller than that. Let's suppose that you can compress that at the maximum amount and get 85% compression. So you have to move only 1.5K characters across the wire. Big win, right? Saved 8.5K or 85% of the bandwidth of the page!

However most web pages like that might have three 20K graphics on them. Graphics don't compress, because they are already compressed. JPEG, GIF, and PNG, and all video and audio files are already compressed. Compressing things that are already compressed produces essentially no gain, and in some cases is even bigger than when you started. So if you have three 20K graphics on the page, compression has only reduced the size of your page from 70K to 61.5K, so only a 12% gain.

A little technical sidebar on reducing the size of your page. In most cases, if you want to reduce your bandwidth, don't worry about text...worry about graphics.

1. Reduce the number number of graphics on your site. Remove that extra graphic on the page.
2. Reduce the size of the graphics, particularly if you have a large graphic that you are shrinking through the HTML. If you have a picture that is 1024x768 and you use HTML to reduce it to be 200 pixels wide, you are moving a lot of bytes you don't need to move. Scale the image down to the size you are actually using.
3. Increase the compression of lossy graphics. JPEGs use lossy compression.You can re-save the image with higher compression. It will reduce the image quality, but the human eye is just not that sensitive to image quality. You have to compress quite a bit before the effect becomes really noticeable.

All of this applies to video and audio, as well.

The second issue is IP Addresses. When you use SSL, it essentially requires port 443 on the web server to be dedicated to just that one web site. Many web servers serve up multiple web sites on the same IP address. For example, I have one IP address serving 17 web sites on unencrypted port 80. The way it does that is that when a web browser talks to a web server, it puts a line called host into the HTTP (HyperText Transfer Protocol) header saying which domain it wants to talk to. When the web server gets that request, it then routes it to the appropriate web site. All well and good on unencrypted web sites.

But if the content is using SSL, then it can't serve up multiple web sites from the same IP address. When the server gets the HTTP packet, it is encrypted. The host line is in the encrypted packet. But the certificate necessary to unencrypt the packet is a part of the web site. The server doesn't know which web site to go to until the packet is unencrypted, but can't unencrypt the packet until it knows which certificate to use. It's a chicken and egg problem. Since there can be only one web site for SSL, the server just sends the content to that web site and everything works.

Web browsers normally ask for SSL on port 443. Moving things to other ports can work, but not in the general case. Configuration of firewalls frequently block ports other than port 80 and 443.

So the normal way of handling it is give each SSL web site a different IP address. Which would be great if there were an infinite amount of them. Unfortunately, at least under IPv4 (Internet Protocol version 4), there aren't. There are exactly 4,294,967,296, and some of those are for special purposes and can't be used. Virtually all of the 4 billion IP addresses are taken. There just aren't enough IP addresses for every web site to be on its own IP address.

The solution is IPv6. IPv6 changes the number of IP addresses to be 340,282,366,920,938,463,463,374,607,431,768,211,456. That should be enough to hold us for a while. Except IPv6 has been very slow to be adopted. There are a bunch of hardware and software changes that have to be made throughout the Internet for it to work. When IPv6 gets here, there really is no excuse not to have SSL on every web site. I expect it to take about another 10 years before there is a wide adoption, though.

The cost for site SSL certificates deserves its own rant...I'll do that one later.

Sites where you can get an IPv4 address should be on SSL wherever possible.

Expression Suite was a marketing disaster

If you view this page on the Microsoft web site, you'll see that they are discontinuing the Expression suite of designer tools. In my opinion Expression was a marketing disaster, not so much a technology one. The problem with using "Expression X" for a program name (for some value of X) is that I tend to concentrate on the "Expression" and not on the "X". There were several very different products that essentially had the same name.

What Microsoft should have done is called the products Microsoft Blend, Microsoft Design, etc., and then bundled them in the Microsoft Designer Suite. They don't call the Office products Office Word and Office Excel, do they? Expression Design, Expression Web, Expression Blend, and Expression Encoder were four very different products and to make them all have Expression as the most predominate part of the name was a mistake.

Blend (the really critical piece of the Expression suite), at least, will be making its way into Visual Studio, while the other products are becoming unsupported orphans. You can download Expression Design 4, Expression Web 4, and Expression Encoder 4 (but not Pro) for free from the Microsoft web site (get them while you can!). It's good that I will only need to buy Visual Studio to get the Blend features as well.

Microsoft orphaning products or technologies is never a good thing. People invest huge amounts of time and effort learning these products and technologies, sometimes basing their careers on them. When Microsoft abandons a product, the people and companies who have invested in it are left having to scramble to move to some other product or technology. The fact that Microsoft is giving the products away for free doesn't change the fact that they are at end of life and a dead end. I suspect if the Expression suite had been marketed right (with a different name) and allowed to flourish, they would have become respected members of the Microsoft product line.

Laptop Monitors Suck (compared to what used to be available)

I recently bought a new laptop. It wasn't the one that I wanted, but the one that I wanted doesn't exist.

I bought my last laptop in 2004. It was an IBM Thinkpad T42p. At the time it was the best laptop you could get. In some ways it still is. It is still going strong, but it is starting to be less useful for what I need. I need a multi-core, 64 bit, more RAM laptop for my current purposes. But I am holding out for one that is as good as my T42p. Let me explain.

The screen resolution on the T42p is 1600x1200. Two common screen resolutions for laptops now are 1366x768 and 1600x900. The 1600x1200 of the T42p screen has 1,920,000 pixels. The number of pixels for the more common resolutions are 1366x768=1,049,088 and 1600x900=1,440,000. So these resolutions are clearly inferior in that there is less information on the screen.

There are, however, a few laptops with 1920x1080 resolutions available (I've been staring hard at the Lenovo W520). That is 2,073,600 pixels. Okay! Finally a laptop with more pixels than my seven year old laptop. So I should get it, yeah? I'll come back to that...but let me rant about the 16:9 ratio for a bit. The new laptops use a 16:9 screen ratio rather than a 4:3 ratio of a few years ago. This is a marketing gimmick by the LCD manufacturers.

Explanation: Suppose that there was a screen with the same 1,920,000 pixels of my T42p, but had a 16:9 ratio instead of a 4:3 ratio. To have a 16:9 screen resolution with that number of pixels would be approximately 1847x1039 (1919033 pixels). However, screens are commonly measured in diagonal inches. 1600x1200 has a diagonal of 2000 pixels. But 1847x1039 has a diagonal resolution of 2119 pixels. So by using the 16:9 ratio, the manufacturers get an increase of 6% advertised diagonal size without having to add any additional pixels to the LCD! Thus a 16" monitor becomes a 17" monitor without adding any additional pixels, just changing the shape.

The 16:9 ratio is better for viewing movies, but I don't view movies on my laptop. My laptop is for getting work done. So now let me explain why 16:9 ratios suck for work screens. If I'm coding, I want to see as much code as I can. The more lines of code I can see, the happier I am. My current coding convention is that a line of code is no longer than 100 characters. So any screen that is wider than that is useless to me. But taller is very useful, because I see more lines of code.

So that screen that is 1920x1080 is actually less useful to me than the 1600x1200 screen of my T42p because of the change in vertical resolution. I see only 90% of the lines of code that I saw before, even though I have more pixels on the screen.

There are a few laptops that do 1920x1200, but they aren't really laptops. They are luggable integrated desktops. A laptop that weighs more than 9 pounds isn't really portable. I had a Dell Inspiron many years ago that weighed in at 9 pounds. Hauling it around the country was a real test. I didn't think that 3 pounds would make a difference, but it really does.

So what I want in a laptop is my T42p (with its 1600x1200 resolution), except with four cores and 16 gig of ram, weighing in under 6 pounds. It doesn't exist. If some manufacturer (Lenovo?) wants to make one, I'll bet I'm not the only person who would buy one.