But that’s not enough.

The existential threat posed by SOPA to the very foundations of the Internet as we understand it can not be ignored and GoDaddy’s support of the bill — even now that that support has been withdrawn — was more than enough to send me and thousands of other technology professional packing.

The lesson of GoDaddy is this: there is no crime more abhorrent than to betray the very livelihoods of your customers. If the position of your company seeks to jepordize not just my ability to purchase your service but my ability to feed my family than no amount of discounts, stellar service, or witty ads will convince me to stay.

Of course, GoDaddy is a drop in the bucket; the list of SOPA supporters is long indeed and honestly very few of them will face a boycott because of that support. The internet is a mercurial and savage disciplinarian, however, and while few SOPA supporters will face the kind of reaction GoDaddy endured, many will no doubt fear it. The question is, will that fear translate into a change in policy?

The others are spam. All of them.

This despite trying a range of various CAPTCHA solutions, filters, etc, these I’ve been unable to stem the tide. Indeed, those 1,288 are just the ones that got through. Another ~900 were identified as SPAM by WordPress and blocked automagically.

Bluntly, this is absurd and, as I think about it, the possibilty of designing around such issues is equally absurd.

Even Gmail’s spam filters are not perfect, despite the unthinkably large data store from which they can pull and the absurd resources that Google is prepared to throw at the problem.

Practically – at least to my eye – this problem can not be completely solved by computer science. The solution lies, instead, in the field of economics.

Spammers do what they do because the cost is effectively zero and the preceived value is greater than zero. With zero cost, even if the marginal utility – the preceived gain from each individual action – declines with each message or post, it never drops below the cost.

It is thus always profitable to spam.

The solution lies not in attempting to block spam, which is difficult, annoying, and labor intensive, but in reducing the preceived value of a spam message.

The “no follow” link convention implemented by Google helps — links so tagged (and most in blog comments are) are not given weight by Google’s search algorithms, thus eliminating the value of spamming for page-rank. Of course, that is not the only reason people spam.

Some are looking to sell a product – and view spam as free advertising. Others are looking to ensnare victims in some sort scheme – either financial or technological.

In both cases, spammers are hoping that humans, not computers, will follow their links. Some social networks like MSNBC’s Newsvine have taken to banning linking entirely – at least on recently registered accounts. Spammers then break up URLs or instruct users to search for certain phrases.

Ineffective? Sure, but again, with a marginal cost of zero, who cares?

Perhaps it is not possible to reduce the value of spam postings to zero without destroying the possibility of meaningful comment as well. If so then the only remaining option is to find a way to raise the cost of posting.

CAPTCHA was an attempt to do this, though one that obviously has met with limited success. Back in the 1990s the notion of a pay-to-send email system was floated with micro-transactions supporting the system and making bulk-spam mailing actually cost something.

That was 20 years ago, however, and there’s been little meaningful progress.

Sadly, I have no profound conclusion to offer you, dear reader, save this one. Markets work both ways and the simple fact is that while I can not make it economically prohibitive for spammers to post, they have made it economically prohibitive for me to maintain a comments section on this blog.

Effective immediately, therefore, commenting on Nephandus is disabled. In reality it has been for some time as the volume of new-post notifications from WordPress lead me to simply ignore them and instruct Gmail to automatically delete them several months ago.

How do you user test this?

Most of the blogging I’ve done in the past has been political and thus I really haven’t had an opportunity to try to post much in the way of source code in a blog.  Once I got Nephandus up and running on WordPress, however, I thought I’d have a shot at it and thus posted a short article on my experiences with C#’s serialization quirks.

To illustrate a specific point I included a brief snippet of C# code which WordPress promptly turned into an illegible mess.  The web is a notoriously difficult place to display source code and thus I set off in search of a WordPress plug-in that would allow me to do so without too much thought.  Several days, a dozen plug-ins, and a string of curse words that would make a sailor blush with shame, I have a solution.

There is no shortage of syntax highlighting plug-ins available, but the support for their instantiation is practically non-existent.    Nephandus is running a number of plug-ins, none of which required much more than a few mouse-clicks to install and configure yet this particular task proved more difficult and involved than anything else I’ve done with WordPress.

The more I thought about this frustration the more I realized that this is an ongoing problem in the software development industry.

When developers buid a word processor or an email application they spend (or they should spend) a fair bit of time working out where users will intuitively look for certain basic functionality.  Tools, options, and commands should be where the user expects them to be; that saves time and cuts down on support costs.  We can test and evaluate that design by asking people who are totally unfamiliar with the product to find those sorts of functions and watching what they do.  It’s a system that works well because, familiar with the product or not, everyone has a basic grasp of certain tasks like writing or arithmetic.

But how do you do that kind of testing with an IDE?

The people who use IDEs are, pretty much by definition, super-users.  At the very least we can expect them to have a high level of familiarity, if not with the interface itself than with the thing the interface manipulates – code in a programming language they know.  These users have very specific ideas about where things ought to be which are based, not on intuition but where they were in some other IDE that they learned.  Because the population of knowledgeable coders is small and the number of IDEs they develop on is also small, it’s likely that they’ll bring some of their preconceived notions into user testing and that those notions will persist through the testing process.

Neophyte users aren’t terribly helpful because while they’re learning the interface they’re also learning the language and thus don’t know enough to evaluate the more powerful aspects of a product.

How then do you test the usability of a new interface when that interface’s intended users are a small, niche population often with preconceived, conflicting, and sometimes nearly religious notions of how the interface should look, feel, and act?

That isn’t a problem that WordPress plug-in authors really need to worry too much about – at least not if they’re giving their work away for free (beggars can’t be choosers) – but those of us who make specialty products for high-end niche professionals need to find a way to tackle the problem lest we find ourselves unable to change a 30 year old catastrophe of a design because it’s what everyone knows and expects.

People familiar with C# know that C# supports the inclusion of user defined controls called WebControls.  These are more or less very simple C# programs which can be man-handled by another bit of C# code.  They’re handy for making your code modular: you might design a web-control that takes and validates a credit card number, for example.

But WebControls are notoriously tricky beasts and over the course of the last few weeks I’ve come to understand that one of the reasons for this is that they don’t behave quite the way you might expect them to when they are serialized and deserialized.

Most C# serialization occurs behind the scenes in something called the ViewState.  For those of you who have no idea what that means, ViewState is C#’s rather clever way of persisting the things on a webpage so that it feels a little more like a desktop application.  The long and the short of its behavior is that things get serialized into the ViewState just before rendering and de-serialized back out of ViewState on the next request as part of the load step.

Most controls go into the ViewState… but WebControls don’t.  At least, they don’t go in there by default.  Presumably you can create custom ViewState serialization for them; I have not tried this.  Instead, I serialized my WebControls very simply into Session and coded that storage into a property.  My code looked something like this

private Widget InternalWidget
{
	get
	{
		Widget result;
		if (Session["Widget" + this.UniqueID] != null)
		{
			result = Session["Widget" + this.UniqueID] as Widget;
			if (result == null )
			{
				result = WidgetFactory.Create();
				result.Arguments = InternalActivePortlet.Arguments;
			}
		}
		return result;
	}
	set
	{
		Session["Widget" + this.UniqueID] = value;
	}
}

Now, as expected, none of my EventHandlers persisted when the WebControl came back out of its session serialization.  The object that comes back from serialization is an entirely new object; the old one has been destroyed.  As a result, the event handlers in the deserialized object point to null function pointers.  C# doesn’t throw an error when you call a null function pointer, however; it just goes on its merry way and does nothing.

But the function pointers – even though they now point to null objects – remain.  C# remembers a great deal more about the session-serialized object than one might think including – and this is the part that really threw me – the fact that it’s already been through the ASP parser.

I had expected, since my event handlers weren’t working when the WebControl came back from Session, that the events themselves were gone and that therefore the object returned from session was new — as if it was programatically created for the first time.  This is not the case.  When you programatically create a WebControl for the first time it’s ASP file is parsed and event handlers are set up based upon the code there.  When you deserialize a WebControl from session, however, C# remembers that it has already dealt with its ASP code and does not do it a second time.

Consequently, none of the event handlers defined in the ASP work either.

I expect that all of this seems rudimentary to more experienced C# developers, but to me it was quite a mystery and it took me some time to work out the above logic.  Hopefully this will aid some neophyte coder working through the same issues I had.

On a totally unrelated note: I need to find a decent code display plugin for WordPress…

Image Credit: Guillermo (via flickr)

It is time for Nephandus to change… again.

I registered Nephandus.com when I was in college.  Since then it has been a flat HTML page, a Macromedia (now Adobe) Flash application, a custom PHP driven web-application, a PHP/Fusebox web application, and a Zend PHP web application.  In that time I’ve gone from being a student of History at the University of Virginia to a  software developer at VirPack in Blacksburg, VA with stops along the way at Radford University (it turns out no one will pay you to have just one degree in History), Fingertip Marketing, BearingPoint, Sitevision, and Coral Networks.

Each new job or university has brought a change to the site as I’ve learned or sought to learn new technologies and techniques.

Much as I enjoy tinkering with my own custom application, however, the technology that surrounds blogging on the web has long since outstripped both my ability to keep pace and the spare time I have to undertake such efforts.   They say that “good programmers write good code; great programmers steal  great code” and so, I’ve turned to WordPress to handle Nephandus.

Maybe I’ll have more time to write about code now that I’m writing less of it.