Actually, this isn’t about Facebook. It’s really about you and your entire identity online. For most of us, that means Facebook, LinkedIn, Twitter, and other “social media” web sites. I think most of us underestimate, if not completely fail to imagine, the real risk of our online blabbering (speaking of… add “Blogs” to that list of social media web sites). The event that ruins your day isn’t going to happen when you update your status message to say, “Just got to Cancun, suckaaaaas!! Looking forward to three weeks on the beach!” Actually, nevermind, maybe you will get robbed as a result of that status update. Face it, your 300 facebook friends aren’t really your friends. In fact, at least a handful have probably become straight-up criminals in this economy. But no, that isn’t what I had in mind. This vulnerability has been around since the beginning of social media. It’s a vulnerability in Facebook, it’s a vulnerability in MySpace, it was a vulnerability in Friendster, and it’ll be a vulnerability in the systems that are being launched tomorrow. Come to think of it, that isn’t quite accurate either. The vulnerability isn’t in any of those systems, it’s in you. The vulnerability that I’m talking about is plain old gullibility, and the exploit is made possible with social engineering, using all of the information you offer up with Facebook and the rest of your social media identity.

Social Engineering

I’m talking about your online identity being used by criminals as a tool for social engineering. If you aren’t familiar with social engineering, here’s the definition fromWikipedia : “Social engineering is the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical hacking techniques…” Can you imagine how the information in your Facebook profile (and your friend’s profiles, wall posts, photo comments, your blog, your web site, your gmail, and the rest of your online identity) might be used by a persistent group of individuals to trick you into divulging sensitive information? Let me paint a picture for you. A well-funded group of criminals in Russia (yep, still picking on the Russians) is looking to steal your money or your identity. They have a large group of people who are scouring the social web for potential targets. Once a target is identified (you), they create a fictitious Facebook profile for a smokin’ hot young Russian girl who is “Looking for: Love in America, Religion: none.” You arrive at work in the morning, not wanting to focus on work yet, and receive a friend request from her. You figure, what harm could it do? You accept the friend request and you are handed off to the gang’s research team. The research team gathers as much information about you as they possibly can. They look at all of the pictures of you on Facebook, sorted by captions so they can get straight to the good stuff. They look at the events you’ve attended recently. They look at the schools you went to. They look at your looong history of wall posts and conversations that go on in the comments. They have all they need. But wait, before you start unfriending all of the hot Russians, a friend request isn’t the only way they can gain access to your profile information. There are actually many ways, and the list is ever-expanding, for people to gain access to your information on Facebook. For example, all they have to do is get one of your friends to start playing their obnoxious Facebook game, or get you to play it, and when you click that “Allow” button, you are giving up all of your information, and your friends information, to the developers of that game. So anyway, now that the research team has all of the information they need, it is handed off to their team in the US. Your phone rings, and you answer it. “Good afternoon, can I speak with Joe please? Joe, I’m terribly sorry to bother you this afternoon, but I just got off the phone with your friends Rick Fields and Chris Anderson (Joe’s long-time friends from High School marching band) and both of them said you would be a good person for me to talk to. I’m working with Jeff Fossilheimer (the band director) to raise money to send the marching band to San Diego this year for an international competition. Have you heard the band this year? You should, they’re incredible. Anyway, the boosters spent a lot of money on new football uniforms and exercise equipment this year, I mean a lot of money, and an unfortunate accounting error means there isn’t enough money left in the budget to send the band to the competition now. The really sad part is that, up until very recently, the kids thought they were going to the competition. Their dreams have been crushed by a bunch of expensive ellyptical machines. So, Rick and Chris both contributed $20 and said that you could afford a contribution too. So, how about it, can you spare $20 to help these kids win their dreams back from the football team and represent your high school to the world in San Diego?” From Joe’s profile, they could tell that he was a member of the marching band in high school. They could tell that he loved it. They could tell that he and other fellow band-mates still keep in touch and speak fondly of the times they shared there. They could tell that he hated the football team. Once Joe hands over the credit card info, or worse, the debit card info, he’s getting flowers from the Russian mafia. What would you have done? In this very rudimentary, and probably not realistic, case. The goal here was simply getting money, but a more likely goal of an attack would be identity theft. Depending on how valuable a target is, the social engineering may persist, and once they have a credit card number, they can call pretending to be the fraud-prevention department from your credit card company. To verify YOUR identity so that they can help you, you’ll have to give them the last 4 digits of your social and possibly confirm other information. Have you ever gotten one of those calls? Did you give up sensitive information? You would be wise to challenge anyone who calls you and challenges you with a request for sensitive information. Make them prove to you who THEY are before you prove to them who YOU are. If you get a call from “fraud prevention,” hang up and call the number on the back of your credit card. They will route you to the real fraud prevention department to take care of any issues. If you find out that they didn’t try to contact you in the first place, it’s time to start changing passwords, closing credit cards, and seriously consider closing bank accounts. So, the identity thieves will continue hitting you from different directions, across all of your online services, one piece at a time until they have all of the information they need to open a credit card in your name.

Strong Passwords

Finally, one of the most important things you can do to protect yourself from a potentially devastating attack on your identity is to make sure you are using strong passwords. You’ve heard this a thousand times, but why are you still using your dog’s name for your password?Dictionary attacks are a brute force technique that hackers use to get into your accounts to ruin your day, and simple passwords make a dictionary attach very, very easy to execute. In a nutshell, a dictionary attack is one where a hacker simply writes a script that will try to log into your accounts using every word in a long list of potential passwords. When it succeeds, you’re screwed. With cloud computing infrastructures like Amazon’s EC2, hackers have access to an incredible suite of tools for very little money, and the only way to protect yourself is to take the time to come up with a secure password. Here are some tips:

Use passwords that include more than one word
Each word you add to your password exponentially increases the number of possibilities a hacker will have to dream up to guess your password. If there were only 10 words in our lexicon, a two-word password would mean that a hacker would have to check 100 possibilities instead of just 10. Three words would mean 1,000 possibilities.

Use symbols
Most sites allow certain symbols in your password. If a site doesn’t, consider not using it. Symbols, or better yet a sequence of symbols, will greatly increase the randomness of your password while still remaining somewhat easy to remember. Insert a sequence like “#&#$%” into your password to increase it’s strength.

Use upper and lowercase letters
Upper and lowercase letters are another simple and easy-to-remember way to increase the strength of your password. Avoid using a patter, like ThIsOnE, and instead stick to a moReRandOm sequence of capitalization.

Use a phrase that is completely unrelated to your life
If you’re a stock broker, don’t use StockbROker as your password. Don’t use any nouns unless they are part of a phrase like StockbROkerPickleFencEbreaKER. Better yet, make it St0ckbROker!!!$&$PickleFenc3breaKERyoyoyo. That’s a strong password, and if you try, you can actually remember it. Just don’t use that password if you’re a stock broker who blogs about how rich you are and how much you love to break pickle fences.

Read more at Wikipedia

So, how important is it to have a strong password? Let me paint another picture… this time it isn’t hypothetical. It happened last weekend. My parents got an email from a close family friend (pun intended) simply stating that he and his wife were traveling in London and were robbed. They asked if anyone could help them with some emergency cash. My Dad replied to ask what had happened, and for details on how he could help. He waited for a reply, but before it came he got a phone call from the friend who had been robbed. The conversation went something like this:

Friend: “Did you send any money yet?”

Dad: “No.”

Friend: “OK, good. Don’t. We aren’t in London and we didn’t get robbed. Our AOL email account was hacked.”

Dad: “Yikes!”

Friend: “Yikes indeed. I’m calling everyone I can think of who might have been in the address book in our AOL account to tell them not to send money. Thank God someone called me, or I never would have known that this was going on. I’ve already stopped two people who were in the process of wiring money and I have no idea who else might be trying to send money now.”

Dad: “Can’t you send everyone an email?”

Friend: “No, the hackers changed my password on me.”

Dad: “Damn. Did you call AOL?”

Friend: “Yes, but this all happened on a Friday afternoon, and AOL’s fraud department is closed on the weekends.”

Dad: “Ouch. You shouldn’t have used your kid’s name as your password. Didn’t you ever see War Games?”

So, which passwords are you going to change first?

Privacy

Forget it.  Nothing you do on Facebook is private.  Treat everything on Facebook as if you are doing it in public.  Even when you “message” a person, Facebook is filtering that message.  They say that they only do it to save kittens and promote world peace, but there is nothing stopping them from updating their TOS to expand the scope of the program.  Then they might start handing that data off to the government for some kind of McCarthy-esque round up, sending all of the Farmville addicts to concentration camps.  Or, heaven forbid, they could start data mining those messages for the delivery of targeted advertising.  Who are we kidding those things, except the Farmville camps, are probably already happening.  The bottom line is that Facebook’s recent actions have proven that information being treated as private today doesn’t mean it will continue to be private tomottow, or that you will even receive real notice when your information jumps that fence.

Instant Personalization and Privacy

I’m not sure if you realize it, but the “Instant Personalization” feature reversed existing Facebook privacy policies.  What you may have thought was private, or only shared with your friends, became public.  It’s a clever name, really.  By “personalization” they apparently mean shipping your “personalized” information off to third parties of their choice and, by “instant,” they mean that they did it “instantly”; the information was shipped off before anyone had a chance to opt out.  The less cynical perspective on it is, why not let the information I put into my facebook profile be used by other hand-picked sites to try to serve me in a more effective way?  Pandora can look at my favorite music on Facebook and start playing what I really want to hear right now.  Yelp can give me restaurant suggestions in my area that are highly rated by my peers and serve the food I like.  That’s pretty awesome.  Microsoft knowing my likes and dislikes, however, is kinda like finding out that your Grandma just did the laundry and had to fold your underwear.  It’s just not right.  The only thing I see wrong with that is the likelihood that the sites who get my info may not be so “hand-picked” in the very near future.  The information that Facebook is selling (I assume there’s hefty a price tag on it) for Instant Personalization is the information that appears in the “info” tab on your Facebook profile.  I’m sure it will extend to other information, and potentially everything you do on Facebook as they test the boundaries of what is public and what is private, but for now that’s all they’ve sent to Microsoft, Pandora, and Yelp.  If you want to opt out, Facebook makes it easy-ish:

When logged in to Facebook:

1. Click “Account” in the upper right corner

2. Choose “Privacy Settings”

3. Click “Applications and Websites”

4. Click “Edit Setting” next to Instant Personalization

5. Uncheck the “Allow select partners to instantly personalize their features with my public information when I first arrive on their websites.”

While you’re in there, explore every single setting or just stop using Facebook.  Seriously.  Then check it every few months to see what has changed.

The “Like” Button and Privacy

Another feature that is drawing some criticism is the new suite of “social plugins.”  Facebook has made them available to the millions of sites across the internet, like LightMedium.com, that want an easy way to tie into the conversation on Facebook.  The plugin that seems to have drawn the most attention is the “Like” button.  On my site, and please feel free to use it, the button is called “Recommend.”  If you click the button, you will see your picture appear on this article below the button.  GASP!!! PRIVACY ALERT!  PRIVACY ALERT!  I don’t want my picture on this web site!!  The truth is that a web site like this one doesn’t have access to the information in your Facebook profile, and your use of the “Like” button doesn’t allow your data to be used by this site in any other way.  Sites that ask you to log in to facebook are a different story, but the “Like” button is merely a window into Facebook, and only your friends who are currently logged into Facebook will know that you liked it.  So, if you don’t want your Facebook friends to see that you like the article, then don’t click the “Like” button!

Security

These new features have raised the mumbling din of internet security Chicken Littles as well.  Are there security risks?  Yes, but they are the same general risks of doing anything on the internet, and aren’t necessarily new or exacerbated by these new features.

Instant Personalization and Security

The security risk with Instant Personalization would most likely result from the partner site exploiting a security vulnerability to gain greater access to your information than is needed.  Unless the Facebook engineers are completely idiots, there is probably a 0% chance of that vulnerability existing in the first place, let alone being exploited.  There is no reason, for example, that your username and login should be part of the exchange between Facebook and the third party sites.  The other security risk would involve misuse of the information gained by the partner site.  It may seem like your favorite books, music, and recent events you’ve attended is pretty innocuous information, but from a social engineering perspective, that is far from the case.  Still, the information isn’t nearly as potentially damaging as the sharing of your credit card and social security number can be.  There are sites right now (fandango.com, buy.com, 1800flowers.com, travelocity.com, and many others last I checked) who have partnered with a company called Reservation Rewards to, in a very shady way, transfer your credit card info to them so they can start charging you $5.99 a month to be a member of their discount club.  They started charging me two years and I had to go to war to get our money back.  Google it, it’s crazy.  The potential for abuse of an information sharing arrangement like Reservation Rewards is far more scary than Facebook’s Instant Personalization feature, and it’s been going on for years without much outcry from the general population.

The “Like” Button and Security

A lot of people have seen the “Like” button and thought, “How does CNN.com know about my friends on Facebook?  Wait, how does CNN.com even know who I am?  I didn’t give them permission to access my Facebook account!”  The truth is, when you see those little Facebook social plugins on third party sites, you are really looking at a tiny window into Facebook.com called an “iframe.”  The browsers create what is called a “security sandbox” around the content in that iframe.  That sandbox prevents information sharing between the page (CNN.com in this example) and the iframe (Facebook.com in this example).  So, if you see your friends smiling back at you on CNN.com, it is only because you are currently logged into Facebook, and they clicked the “Like” button.  Log out of Facebook and go back to CNN.com to prove it to yourself.  This arrangement is no less secure than Facebook.com itself, and you already trust Facebook, right?

The New Digital Social Contract

A lot of people argue that America is not a Democracy, but is in fact a Plutocracy where, in essence, the nation is ruled by “the people with the money” instead of just “the people.”  If the mafia-infested concrete jungles, cartoon-chicken-littered farmlands, and libraries of mundane chatter in the land of Facebook actually made up a real country, it would definitely be a Plutocracy. That’s not some kind of profound revelation, it’s just recognition of the fact that Facebook is a corporation with a bottom line and a lot of overhead.  There isn’t much regulatory oversight in social media (yet).  It’s the wild west and cash is king.  The lines between which bits of information are private and which bits are public, which bits belong to you and which bits belong to the sites, are being drawn as you read this (did I mention the Facebook “recommend” button below?).  They aren’t being drawn by geeky, spiky-haired attendees at some kind of Silicon Valley constitutional convention.  They’re being drawn line by line, feature by feature, by companies like Facebook who own the sites we happily socialize on *for free*.  From an engineering perspective, the more information you can gather and use, the more robust your set of offerings will be to the third parties who want to target your user base.  From a business perspective, the more robust your set of offerings to third parties is, the more money you can make to pay the bills, keep the lights on, keep the service free to the 500 million people who use it, and buy islands in the Caribbean.  The goal of the company isn’t to protect your privacy, the goal is to buy islands in the Caribbean.  So, when it comes to the privacy lines being drawn, the company is going to continually push the limits until the screaming of the peasants gets too loud.  If you don’t like the direction a particular service is going, you better start screaming because they’ll keep on pushing.  Keep in mind, though, that if we want to be able to use services like Google and Facebook, Facebook and Google have to be able to use us.  If that makes you feel dirty, then the only thing you can do is log out, cancel your accounts and go take a shower.

The part that has fascinated me lately is that, as Facebook expands its reach with their new social plugins and the Open Graph Protocol, they inch closer and closer to reaching a point of “customer lock-in.”  Each partner in Facebook’s social graph is another anchor that the SMS Facebook drops in your harbor.  There are two aspects to customer lock-in in our relationship with Facebook.  First, we are becoming locked in by becoming data-bound to the system.  That means that all of our mobile picture uploads that don’t exist anywhere else but on Facebook, all of the pictures our friends have uploaded that we can only access though Facebook, all of those priceless conversations about nights of debauchery, all of those witty status updates that you hoped to get a book deal with someday… they’re all in Facebook.  Sure, you can get them out, but it would be such an enormous pain in the butt that you’d rather just stick around and deal with whatever gripes you have against the service than spend the days it would take to round up all of your data and store it somewhere else.  People are, however, writing software tools that promise to scrape that data out of Facebook for you, but you can bet that Facebook will be working overtime to shut them down one-by-one.  Second, we are inching closer to lock-in by becoming culture-bound to the system.  If I leave Facebook, what will I miss?  Where will I go?  Everyone is there!  Who will come with me?  Will the new service have Farmville?  Several of my friends, who I admire and respect very much, disagree with me on the strength of cultural bonds to software.  They name several also-rans, like Friendster, that were simply abandoned and then atrophied.  If a project likeDiaspora succeeds in creating a massive “geek exodus” from Facebook like the one that foretold the decline of AOL, then maybe Facebook will atrophy and die, but otherwise I think we’re about 18-24 months from a very powerful lock-in.

I don’t think this caught anyone by surprise, did it? Watch the gulf widen as Android-powered phones drop below $50 and data plans cost less than $20 per month (*sigh* one fine day, eh?). Read more onCNN.com

Sorry for the bad Dave Matthews parody. I had a surprise in my inbox this morning -Cartfly is going to start charging for the use of their service in the middle of May, and that song immediately popped into my head. You heard that right. They’re pulling aNING and forcing all of their existing customers to either pay up or go somewhere else. (Full disclosure -I have a personal interest in all of this, as I was a contractor, and eventually the Lead UI Developer, onCartfly andSellit from inception to bankruptcy back in October of ’09.) Their move away from “freemium” to just plain “premium” makes sense, since the bankruptcy of the company and subsequent dismissal of nearly all of the development team left them needing some kind of income to survive in this brave new world of limited venture capital. I just hope they can survive this in a market where products likeECWID (short for e-commerce widget) are still free, backed by the superior catalog management of X-Cart, and work on mobile.

I use Cartfly, should I abandon ship and use ECWID?

Probably not, but you should definitely explore your options, if for no other reason than to find a more stable basket to put your e-commerce eggs in. Cartfly won’t have a free option anymore, but the paid version is only $5.99 a month. In true NPR Fund Drive style, they remind us that it’s only the price of “two cups of coffee.” A tired analogy, but more than true. That’s less than the cost of one of my quad venti mochas from Starbucks. Cartfly is probably still the cart of choice for complete novices, especially considering the added services offered by Sellit (if you can afford the cost of just 9 cups of coffee a month). It’ll be interesting to see if this works for them!

Apparently section 3.3.1 of the iPhone 4.0 SDK (commentary ) has triggered an anti-trust investigation. Rather, it’s triggered, in true fed style, an investigation into who would conduct an investigation should an investigation need to be conducted. I don’t think this one is going to go away unless Apple backs down. The sad part is, this is probably the only anti-Flash action Apple has taken that might have a positive effect on the universe. Here’s somenews about it. What do you think?

This post is intended to satisfy my mother’s fears, but if you’re afraid too, read on.

Let me be clear, I am a Flash developer and I think Flash is an incredibly valuable tool. It always will be, especially for rich internet application development. For banners and fluff, it’s completely replaceable byJQuery. I can look back on my career and see projects that *might* have been better served by a different technology, had a better technology been available at the time, but for the vast majority of them, especially applications like the AmberAlert.com Law Enforcement Alerting Portal, Flex would be the tool of choice again today. The public concern over all of this stems from the fact that everyone who is producing content for the web right now feels a burning desire (fear?) to make their content “work on mobile.” It didn’t help that the hysteria resulting from the realization that Flash content doesn’t work on the iPad was amplified by the sudden news of Steve Jobs’ assertions that Flash is a dying technology. What quickly followed were cries that “Steve says it’s never gonna work on iPad, iPhone or iPod, and that’s like a gazillion users! A gazillion is like 40% of the web! I can’t miss 40% of my audience!” Now stakeholders are becoming increasingly leery of Flash.

This whole notion that the absence of Flash on iPhone or iPod is some sort of crisis is built entirely on the assumption that the same content should serve desktop and mobile visitors. In most cases, especially web apps, that is just not reasonable. If you find that you can get away with using the same content no matter how your users are viewing your web app, then one segment of or the other (computer or mobile) just wasn’t the priority to begin with. The iPhone’s screen size is big for a phone, but it’s still painfully small compared to the average computer monitor. If you’ve ever done any serious web browsing on your iPhone, you’ve probably realized that most web sites don’t “work on mobile.” It’s possible to get through most sites, but it’s kinda like trying to read a web page through a straw. At the end of the day, “work on mobile” can only mean one thing; a mobile version of your content. For most projects, unless you’re misusing Flash to begin with, it really doesn’t matter that Flash isn’t on the iPhone. If your site is built entirely in Flash, or the most critical message you need to deliver exists entirely in Flash, start working on alternate content in HTML+CSS (+Javascript if you’re feeling saucy), then embed your flash content withSwfObject,which replaces alternate content with your flash content at runtime if Flash is available. The search engine spiders, and your mobile users, will love you for it. View the source forBlue Ion’s web page to see how the spiders see their home page. Nevermind, they redesigned their site, using Flash again, and as of this writing, there is no mobile or alternate content.

The iPad is different from iPhone and iPod in one critical way, which makes it the only device that really matters in this debate. It’s different simply because of it’s size. The larger screen on the iPad means that the user interface, and thus the experience, can be similar to the experience that you create for visitors who surf in on a computer. Repurposing content isn’t only possible on the iPad, it’s the smart thing to do, which brings us back to the beginning of the uproar. Flash content can’t be repurposed for iPad. OK. So what? Unless you’re building a “Tips and Tricks for iPad” web site, it shouldn’t matter all that much. I would bet that most iPad users also do a significant amount of their web surfing on a computer, further marginalizing their impact on your over all user base. I’m already building separate content for mobile when necessary (I target Blackberry’s 240 x 320 screen size), and when Flash-incapable devices appear destined to be more than a tiny blip on my user-agent reports, I’ll probably abandon Flash. In the mean time, we choose our technologies wisely based on the application and its audience.

I write flash content all day long and the only Adobe product I work with is Photoshop. I use open source software for my entire work flow. I write my code in Eclipse, compile with Sprouts, manage my source with Subversion, deploy with Capistrano, and serve it all up with Apache running on Linux. The Flash Player is the only part of the whole ecosystem that’s proprietary to Adobe, but even that’sdebatable. Either way, it’s free (always will be) and more widely available than any other third-party plugin on the web. Read The “Full Web” below to see how “open” H.264 video is.

It’s never gonna catch on. Just kidding. Personally, I can’t wait until it catches up to Flash in terms of joy-of-use. A recentproject by Tom Preston-Werner at Github shows that, though it’s hard to work with right now, the HTML5+Canvas+CSS stack made GitHub’s network graph less than 25% of the size of the Flash content. That article alone inspired me to start experimenting with HTML5+Canvas+CSS, but let’s not forget that there is a segment of the web that is slightly larger than your iPad demographic, Internet Explorer users, who won’t be on board the HTML5+Canvas+CSS bandwagonanytime soon. *hint* Search the post for “canvas” to see what’s missing.

I love it and I wish that every browser on the planet used it and helped to advance it.

No one is telling the whole truth here. Steve neglects to mention that the “open” HTML5+Canvas+CSS ecosystem he lauds must include the proprietary H.264 video decoding technology to entirely replace Flash, which may get really expensive to use someday depending on the whims of the MPEGLicensing Authority.

“Symantec recently highlighted Flash for having one of the worst security records in 2009.” -Steve Jobs

You can read the 2010 Semantec Threat Reporthere, as written by the security experts at Semantec and presented to you USING FLASH. It’s actually an example of when not to use Flash, and probably made Steve’s blood boil as he read it, but that isn’t the point. Flash is like any other scripting technology, including javascript, in that the security of an application relates directly to the skill level of the developer. Flash may exhibit more security breaches than other technologies simply because it is easy for non-experts to write code for it. I’m sure that Flash’s ubiquity also contributes to it’s rank as a threat.

Just as bad code opens security vulnerabilities, bad code crashes computers. I’ve crashed my Mac dozens of times with bad code in Apple’s own iPhone SDK. That isn’t the SDK’s fault, I’m the one who create the condition for the infinite recursion to bring my Mac to its knees. Anecdotally, I work in Flash all day long and the number one reason my Mac crashes is OpenOffice (which isn’t very often).

True. That’s all you have to say. This whole debate started with the fact that Apple’s iP* devices don’t support Flash. They shouldn’t because it simply doesn’t work well… nuff said. Unless it works on other mobile platforms. Then it would be Apple’s problem.

Steve mentions the 2x increase in battery life using hardware decoding (like H.264 can on the iPhone, et al) when compared to software decoding (as employed by Flash video even with H.264 encoding). Giventhis news today, I wonder if hardware video decoding is even open to third parties on Apple’s mobile devices. They only made hardware decoding accessible to third parties like Adobe six days ago on MacBooks, MacBook Pros, and Mac Minis (shipped after Jan 21, 2009). It only took Adobe 6 days to respond with a beta release of Flash Player that takes advantage of it. That’s fast. If it works, and signals a renewed effort by Adobe to respond quickly and create performance-focused software, then maybe Apple’s Flashmageddon will be averted. Probably not.

“Most Flash websites will need to be rewritten to support touch-based devices.”

I don’t know about you, but I see dozens of web sites every day that rely on rollovers to expose functionality, especially menu navigation. Most of them are built using Javascript and CSS. It’s bad design, not a Flash problem. Besides, and this is where I gotta say, “C’mon Steve. Really?” why not simply replace that rollover event handler with a click. In most languages, that’s a trivial change compared to adopting an immature technology stack and rewriting your app in a new language.

If I was Apple, I’d be trying to squash this too. This is where the training wheel analogy comes in. If you wanna ride the bike, and really feel like your flying, you’ll have to do it without the training wheels. Your users will thank you for it and the world will be a better place. Apple knew that, with the impending release of Flash CS5, they were about to be flooded with apps originally written in ActionScript. Let’s face it, the App Store is already full of too much crap (100,000 apps? Seriously?) and giving every Flash hacker a chance to submit an app probably would have halved the signal to noise ratio in the app review dungeon in Cupertino. Expenses, crippling depression, and suicides would skyrocket amongst Apple’s poor app reviewers. Nobody wants that.

I don’t know why Steve is so dead set on killing Flash entirely. He makes a good case for Flash to be left out of the iP* devices, it’s just to much of a resource hog. If you want to target mobile, don’t use Flash. Simple. However, his arguments against it on the desktop are silly. It seems like he’s really grasping for anything he can get his hands on to slander the technology and instill FUD in the minds of stakeholders. Apple needs to keep innovatingARM processors and Adobe needs to tidy up the Flash Player if they don’t want to be left behind. Meanwhile, Action Script developers need to get versed in Javascript and keep an ear to the rail for other portable threats to the Flash Platform.

Thanks to a little piece of swag from our auto insurance agent, my daughter and I started flying balsa wood gliders at our house in Tempe last year.  We had a blast for weeks with that thing!  I urge all banks, groceries, realtors, dentists offices, insurance agents, and whoever else might be thinking of giving a balloon away to a child:give away a glider instead!  You will be giving away a rich and rewarding experience.

Naturally, I couldn’t just stick with the little tiny gliders, I needed to build something that would fly further!  Of course, wood and time are in short supply, so I needed a design tool that would help me avoid wasting either of them. I searched the web for an easy, simple, and free tool for calculating the center of gravity and other measures for different wing shapes. I came acrossAdam One’s awesome site for model airplane hobbyists, which got me started, but I needed something more “clicky-and-draggy.” I ported Adam One’s javascript (based on formulas here) over to Action Script and started building my own tool in Flex Builder. I hope to make many improvements to this as time allows, and maybe even port some of Adam’sother tools to Flex. This is a work in progress, with several design flaws, so don’t use this tool to build yourself a man-sized glider. If you do, test it with a trained monkey before you fling yourself off a cliff in it.