I started using Twitter.

Twitter has been getting some mainstream press lately, mostly though celebrities using it — especially Stephen Fry and Jonathan Ross. As with any new communication medium people are asking: what exactly is it good for? On the Twitter website the synopsis is: "What are you doing?" Well, that doesn't quite describe how I use it. Here's what I use it for.

I use Twitter for semi-realtime conversations.

It may have started out as "What are you doing?" but really, that's just the starting point. Sometimes you really do say what you're doing and if your friends find it interesting, they can comment on it. And not only what you're doing — what you're reading and thinking too. I made only two "QOTD" blog posts last year because I was using Twitter to point these out instead.

Using TwitterFox, which makes my followings instantly available, it's more immediate than a blog and its comments which you have to dive into a feed reader to follow. It's also more uniform than blogs-with-comments, in the sense that the original message and its replies have the same status — they are both just tweets, whereas a blog post is somehow more important than the comments attached to it.

But at the same time it's less immediate than, say, Milliways, or IM. There was a gaping hole between realtime chat and blogging in terms of immediacy and Twitter fills that gap, which I think is why it's so popular. Nobody really wants to know what you are doing every minute of the day and of course letting them know can be dangerous. But it's for sparking discussion and carrying it on, in a way that's in the present yet not demanding that you pay constant attention.

Dear Alan Williams,

It has come to my attention that a Bill is being pushed through Parliament, namely the Coroners and Justice Bill, containing a clause, namely clause 152, amending the Data Protection Act (DPA). This clause would create a new type of order, Information Sharing Orders, which is explicitly a loophole in the data-sharing restrictions in the DPA that essentially render it meaningless.

Specifically, the extra clause 50B(1) enables department heads to relax or tighten any restriction on information sharing at its convenience. Given the Government's inexcusable losses of individuals' private records, for example its loss of CDs in the post containing the unencrypted details of millions of Child Benefit claimants, I no longer trust the government to keep my data private. I certainly cannot accept any law which would allow my data to be shared with anyone the Government chooses, which is what this amendment amounts to.

The added clause 50B(1)(d) also allows an Information Sharing Order that amounts to a gagging order, apparently without restriction. This makes moot the Prime Minister's decision the other day not to hold a vote on the Bill which would have enabled MPs to conceal their expenses, an issue on which I have already written to you in protest.

Of even more concern is clause 50B(2), which would allow the head of any Government department to create new summary offences by order. This makes a mockery of the rule of law and demonstrates the Government's contempt of it. If this bill passes intact, I shall have to emigrate as the UK will no longer be somewhere I can feel safe. In a liberal democracy the government should live in fear of its citizens, not the other way around.

The Coroners and Justice Bill simply cannot pass as it is now. It must be amended to remove clause 152, or it will no longer be possible to call the United Kingdom a liberal democracy which values the rule of law.

Yours sincerely,

Peter Berry

He forwarded the letter to Jack Straw, Lord Chancellor and Secretary of State for Justice, and got the following reply (written on 17 Feb), which he forwarded to me by post (on the 19th; it arrived today).

Dear Alan, [handwritten]

MR PETER BERRY, [address redacted]

Thank you for your letter of 23 January on behalf of your constituent, Mr Peter Berry, who is concerned about the Coroners and Justice Bill, and in particular the Government's proposals to introduce new data sharing powers.

The proposal to introduce a power to create a new data sharing gateway stems from the recommendations of the Data Sharing Review, conducted independently by the Information Commissioner, Richard Thomas and Dr Mark Walport of the Wellcome Trust. The Review was commissioned by the Prime Minister in October 2007 to consider, amongst other things, how data sharing policy should be developed to ensure proper transparency, scrutiny and accountability. The Government believes it is vitally important that public trust in the handling of personal data must be maintained and the privacy of citizens protected. At the same time, data sharing between Government departments is essential in providing (and improving) customer-focussed public service delivery and also ensures individuals get the services they require. It is a matter of balance: whilst there are occasions where data sharing may not be appropriate (in order to protect individuals' privacy, for example), there are occasions where not sharing data may cause considerable harm.

The Data Sharing Review report was published on 11 July 2008 and included several recommendations for changes to the legal framework surrounding data sharing. The Review noted that while legal uncertainty and confusion are significant barriers to sharing, there have also been instances when legitimate data sharing schemes have been prevented due to legal obstacles.

In its response to the Review, published in November 2008, the Government broadly welcomed the report and agreed with the Review's recommendation to introduce a new statutory fast-track procedure for instances where there is a genuine case for removing or modifying an existing legal barrier to data sharing. The Government proposes to amend the DPA so that a statutory instrument procedure is created that will permit the sharing of personal information between persons or bodies, so long as a robust case can be made for the sharing to take place.

The sharing of personal data between Government departments in a secure and appropriate manner is essential to protect the public and to deliver public services. In recent years, data sharing has helped the most vulnerable in society, for example by identifying elderly people needing support with fuel payments, children who qualify for free school meals, and those eligible for assistance in switching over to digital television. The proposed data sharing gateway would assist with the continued delivery of the protection and services expected of Government, with the ability to respond more effectively to quickly changing situations. These could involve the detection of fraud and other forms of organised crime, or respond to health epidemics and natural disasters.

I understand Mr Berry's concerns and I assure him that the Government takes the protection of personal information seriously. Data sharing must be justifiable, proportionate and only undertaken when proper safeguards are in place.

Mr Berry may be reassured to know that the proposed new data sharing powers are combined with important safeguards. The Government plans to make any order wishing to use this new data sharing gateway subject to debate in both Houses of Parliament (through the affirmative resolution procedure), so that Parliament will have to apprive [sic] every proposal. In addition, every proposal to share personal information using this new gateway will be subject to scrutiny by the Information Commissioner. The Commissioner may report on whether he is satisfied that the sharing of information enabled by the order is necessary to secure a relevant policy objective, that the effect of the provision made by the order strikes a fair balance between the public interest and the interests of any person affected by it. Proposals must further be accompanied by a Privacy Impact Assessment (PIA). A PIA will describe the initiative and analyse the proposal's implications for privacy and data protection, as well as benefits for individuals and the general public. The Government believes these measures will ensure individuals' rights are fully maintained and protected.

The power to permit data sharing would be an exercise of a minister's functions and, as with all other such matters, remain judicially reviewable. Consequently the power must be exercised within the terms of Articles 6 and 8 of the European Convention on Human Rights. While the power is capable of providing a legal basis for sharing where common law confidentiality and public law would otherwise prohibit it, the proposed power is to be structured in such a way that exemptions from common law and public law prohibitions will only be possible where it is necessary, proportionate and an effective balance between the public interest and the private interest of those affected has been achieved. I appreciate concerns that protections afforded by other laws may be set aside, however these safeguards ensure that this will not occur. Protection of the private personal information of individuals is paramount and the proposed power will only be capable of being put into effect where this principle is fully respected.

I trust that this information is helpful and I enclose a copy of this letter for you to forward to Mr Berry, should you wish to do so.

Yours, [signature]
JACK STRAW

> {-# LANGUAGE NoImplicitPrelude, MultiParamTypeClasses, FunctionalDependencies #-}
> {-# LANGUAGE FlexibleInstances, FlexibleContexts, UndecidableInstances #-}
> 
> import Prelude hiding (Monad (..))
> import qualified Prelude as P
> import Control.Monad.Trans

On the Haskell blog circuit recently the notion of "parameterised monad" has been floating about, provoked by a new paper "Parameterized Notions of Computation". I'll refrain from explaining it myself, instead linking to Dan Piponi's post on the topic. If you don't already know what parameterised monads are, go and read that.

It seems that a module has already been written to encode parameterised modules and uploaded to Hackage: Control.Monad.Parameterized (package monad-param). It dates from before the current excitement (2007 and it's at version 0.0.2) so the concept is apparently not new. It does however take a somewhat different approach, one that's seemingly more general but also more cumbersome. The change in approach is explained in a blog post by its author, Edward Kmett. Here's what the "parameterized monad" class would look like if translated from the paper:

> class PMonad m where
>     returnP :: a -> m p p a
>     (>>>=)  :: m p1 p2 a -> (a -> m p2 p3 b) -> m p1 p3 b

As Piponi explains, if the Prelude monad is some kind of generalised monoid where return is the unit and (>>=) is the operation, this class is a kind of generalised category where returnP is the identity and (>>>=) is arrow composition. Notice that you can only compose two arrows if their 'input' and 'output' types match. Now clearly we can set p1 = p2 and then ordinary monads fall out as a special case:

> -- newtype wrapper, with two phantom types to get the correct kind
> -- (m :: * -> *, UnparameterizedMonad m :: * -> * -> * -> *)
> newtype UnparameterizedMonad m p1 p2 a = UM { runUM :: m a }
>
> instance P.Monad m => PMonad (UnparameterizedMonad m) where
>     returnP       = UM . P.return
>     UM mx >>>= f  = UM $ mx P.>>= (runUM . f)

(P.Monad means the Prelude's concept of monad, whereas PMonad means parameterised monad.) What we have in Control.Monad.Parameterized is something like the following:

> class Return m where
>     returnM :: a -> m a
>
> class Fail m where
>     fail :: String -> m a
>
> class (Functor m, Functor m', Functor m'') => Bind m m' m'' | m m' -> m'' where
>     (>>=) :: m a -> (a -> m' b) -> m'' b
>     (>>)  :: m a -> m' b -> m'' b
>     x >> y = x >>= \_ -> y
>
> class (Fail m, Return m, Bind m m m) => Monad m
> instance (Fail m, Return m, Bind m m m) => Monad m

The last class basically says that Prelude monads are parameterised monads in which the parameter doesn't change:

instance P.Monad m => Return m where
    returnM = P.return

instance P.Monad m => Fail m where
    fail = P.fail

instance (Functor m, P.Monad m) => Bind m m m where
    (>>=) = (P.>>=)

(Unfortunately we can't guarantee a Functor instance for every Prelude monad - a known failing of the current Prelude. We also comment these instances out because they overlap with others.) Of course the thing to notice immediately is that this class doesn't make the parameters explicit; instead, the parameters can be provided any which way. The motivating example is a version of the State monad in which the type of the state can change.

> newtype State s1 s2 a = State { runState :: s1 -> (a, s2) }
>
> instance Functor (State s1 s2) where
>     fmap f (State trans) =
>         State $ \s -> case trans s of
>             (x, s') -> (f x, s')
>
> instance Return (State s s) where
>     returnM x = State $ \s -> (x, s)
>
> instance Fail (State s1 s2) where
>     fail = error
>
> instance Bind (State s1 s2) (State s2 s3) (State s1 s3) where
>     State trans >>= f =
>         State $ \s -> case trans s of
>             (x, s') -> case f x of
>                 State trans' -> trans' s'
>
> instance PMonad State where
>     (>>>=) =  (>>=)
>     returnP = returnM

What the more general setup provides is the ability to do things like this:

> instance Bind (State (s,t) (s',t')) (State s' s'') (State (s,t) (s'',t')) where
>     State trans >>= f = State $ \s -> case trans s of
>         (x, (s',t')) -> case runState (f x) s' of
>             (y, s'') -> (y, (s'', t'))

In this example, you can use a state transformer to change just one element of a paired state, without explicitly converting it. (Of course the usefulness of this is limited by only being able to do this on the left component - if you added one for the right as well, it would be ambiguous.) Another example:

> newtype StateT s1 s2 m a = StateT { runStateT :: s1 -> m (a,s2) }
> instance (Functor m, Return m, Bind m m m) => Functor (StateT s1 s2 m) where
>     fmap f (StateT trans) = StateT $ \s -> do
>         (x,s') <- trans s
>         returnM (f x, s')
>
> instance Return IO where
>     returnM = P.return
> instance Bind IO IO IO where
>     (>>=) = (P.>>=)
>
> instance Bind IO (State s1 s2) (StateT s1 s2 IO) where
>     mx >>= f =
>         StateT $ \s ->
>             mx P.>>= \x ->
>             case f x of
>                 State trans -> P.return (trans s)

So now you can have an expression like getContents >>= modify (map toUpper) and you automatically get a value in the transformer version of the second monad with the first monad as inner. Actually, even monad transformers become a special case in this framework:

> newtype Trivial a = Trivial { runTrivial :: a }
> instance Functor Trivial where fmap f (Trivial x) = Trivial (f x)
>
> instance (P.Monad m, Functor m, MonadTrans t, Functor (t m)) =>
>         Bind m Trivial (t m) where
>     mx >>= f = lift (fmap (runTrivial . f) mx)
>
> lift' :: (Functor m, Bind m Trivial m') => m a -> m' a
> lift' mx = mx >>= Trivial
>
> instance MonadTrans (StateT s s) where
>     lift mx = StateT $ \s -> mx P.>>= \x -> P.return (x,s)

lift' does the same as lift: notice that lift getContents and lift' getContents can both be instantiated to the type StateT s s IO String. (Semantically, they both perform the IO action and leave the state alone.) Monad transformers are just monads that can have some other monad bound to it on the left and are parameterised by that monad. Actually, lift' does more than lift: it generalises even generalised lifting functions like liftIO:

> instance (P.Monad m, Bind IO Trivial m) => MonadIO m where
>     liftIO = lift'

There is one big drawback to this implementation of parameterised monads, namely that the type of returnM can't be inferred reliably:

*Main> runState (returnM 1 >>= \x -> returnM x) ()

<interactive>:1:10:
    No instance for (Bind m m' (State () s2))
      arising from a use of `>>=' at <interactive>:1:10-38
    Possible fix:
      add an instance declaration for (Bind m m' (State () s2))
    In the first argument of `runState', namely
        `(returnM 1 >>= \ x -> returnM x)'
    In the expression: runState (returnM 1 >>= \ x -> returnM x) ()
    In the definition of `it':
        it = runState (returnM 1 >>= \ x -> returnM x) ()

Compare this to explicitly parameterised monads:

*Main> runState (returnP 1 >>>= \x -> returnP x) ()
(1,())

And normal monads:

Prelude Control.Monad.State> runState (return 1 >>= \x -> return x) ()
(1,())

The problem here is that State has two parameters and the type inferencer must fill them in, even though they're irrelevant, but it can't see what they must be because the second returnM could actually be in any monad.

This framework also has the following problem: the Bind class has two monads as arguments (plus the third that depends on the first two), so to get n monads to work together in all combinations that make sense, you'll need up to n² instances. This looks like the start of a maintenance nightmare.

This year, for a change, I'm living in what might be considered a household of more than one person, so we buy milk for 4 or 5 people at once. That needs to happen a couple of times a week, but it's a bit inconvenient to go shopping for 5 that frequently (we've only actually had two communal shopping trips since I moved in at the start of the month). Moreover, I really hate throwing away a 6 litre plastic bottle every week; glass bottles from the milkman, which get collected and reused, don't consume (much) oil in their manufacture and don't go into landfill, so are far more environmentally friendly. So I decided to set up milk deliveries. Observing our milk consumption before that point I decided we'd need about 3 pints on Monday and Wednesday and 5 on Friday (to cover the weekend). And the consensus was to get semi-skimmed. So on Friday morning a couple of weeks ago five pints of milk appeared on the doorstep.

Five pints of skimmed milk.

Well, sometimes that happens. The milkman might not have had 5 pints of semi-skimmed available when he got to my house. (Usually though you manage to get a pint or two of the right kind and the rest of something else.) So I put up with it, and we used the milk over the weekend.

On Monday, there appeared on the doorstep three pints of skimmed milk. And again on Wednesday, and another five pints on Friday. There was still a pint or two left over from Friday when we got Monday's milk, partly because skimmed isn't as nice as semi-skimmed so we didn't use as much, but also because it was starting to go off, despite being kept in the fridge and its best before date being Wednesday. (I've always thought skimmed milk tastes like it's started to go off even before you get it.) I checked the order on two occasions to make sure the order was actually for semi-skimmed (annoyingly you can't actually view your existing order on the Dairy Crest website) but still we kept getting skimmed, and it went off before it was supposed to.

This Monday I got the bill. Pricing on the Dairy Crest website for ordinary milk is "at current prices". Now I found out that it costs 58p per pint, about twice as much as getting it from Tesco. I expected it would be more expensive since they have to deliver it, but for stuff that doesn't taste nice and goes off prematurely so we end up throwing half of it away, that's just not acceptable. So today I cancelled the order.

So this little experiment lasted about two and a half weeks, and was thoroughly unsatisfactory. A crying shame. Surely the milkmen in Uplands can't be that much less competent than the ones in Cowplain?

Yesterday, in the Viacom v. Google litigation, the federal court for the Southern District of New York ordered Google to produce to Viacom (over Google’s objections):

all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website

The court’s order grants Viacom’s request and erroneously ignores the protections of the federal Video Privacy Protection Act (VPPA), and threatens to expose deeply private information about what videos are watched by YouTube users. The VPPA passed after a newspaper disclosed Supreme Court nominee Robert Bork’s video rental records. As Congress recognized, your selection of videos to watch is deeply personal and deserves the strongest protection.

I have always been of the mind that when you visit a foreign country you’re the one that should make the effort to communicate with the locals. Speaking your birth tongue slower and louder doesn’t make yourself any more understandable, it just makes you look like a jackass. The onus to learn the local language is even heavier if you’re an immigrant. After all, you’re the one asking for the privilege of becoming a part of someone else’s community. That means you can bloody well learn the language; you don’t even have to succeed, you just have to show that you’re willing to try.

Arthur C. Clarke died yesterday (OK, the day before yesterday) at the grand old age of 90.

One of the last of the Golden Age writers, one of the best and most foresighted, and probably the most optimistic. He will be missed.

Here's Joel's example. The idea is that you prefix the names of all string variables and functions returning strings with either "s" or "us" depending on whether they're safe or unsafe respectively. Then assignments that have "s" on one side and "us" on the other just look wrong.

us = UsRequest("name") // ok, both sides start with US
s = UsRequest("name") // bug
usName = us // ok
sName = us // certainly wrong.
sName = SEncode(us) // certainly correct.

Well I can think of one pitfall already. How do you mark whether a function expects safe or unsafe data in a way that makes wrong code look wrong?

us = UsRequest("name") // okay
RandomMangler(s) // okay
RandomMangler(us) // errm... wrong?

If you're using a language that supports it, there is a far better way. Think about it. What does Hungarian notation do? It marks the fact that a variable contains data that statically has some property (that is, we know it has that property at compile time). What else can you think of that tells you about static properties of data? What, for example, do we know about any random string? We know it is a string, and that's about it. But that gives us a clue. In most languages a string has some type that marks it as a string. If it's not a string, it can't have that type. What if we made sure that if a string isn't safe, it can't have some type?

class SafeString extends String {
    public static SafeString sanitize(String s) {
        ... // sanitise it
        return new SafeString(s);
    }
    private SafeString(String stock) { return new String(stock); }
    ...
}

Now we can have something that is still a string (SafeString is a subtype of String), but if we want something that only accepts safe strings we can give its argument the type SafeString. Then because the only way we can create a safe string is by sanitising it first, we can never pass an unsafe string to something needing a safe one. To put it another way, wrong code now looks wrong to the compiler. And the compiler is much, much better at spotting things that look wrong than you are:

us = Request("name") // ok
s = Request("name") // type error
usName = us // ok
sName = us // type error
sName = SafeString.sanitize(us) // ok

These type errors will produce a compile time error -- the code simply won't compile, so it can't cause security problems, because it never becomes an executable program. Of course, this only works if your language is strongly, statically typed -- if it isn't, you still get binaries that either break (because the typing is weak, so you can pass unsafe strings to things expecting safe ones and it still compiles) or blow up (because the typing is dynamic, so passing unsafe strings to functions expecting safe ones causes a runtime error). You might consider runtime errors to be bad or not, depending on your perspective, but letting type errors slide is to be avoided.