Having just walked out of my first exam this semester, I decided to write my semi-annual exam bash/rant. The exam I just had is on microeconomics, which involves quite a bit of maths. For me, who also take courses in engineering, the maths are quite easy. In fact it is so easy I question the need to waste time on them in an exam.
Take a simple example, solving a pair of simultaneous equations. We all know how to do it since year 9 or 10 and it is (usually) simple. However that doesn't mean it can be done very quickly, especially in a time critical situation such as an exam. This particular exam should be testing my knowledge on economic theory and how to apply mathematical tools (e.g., solving simultaneous equations) to get the information we sought. If I apply the correct theories I should get to a point where I can say, "OK, we have two unknowns and two equations, so we can solve for them." The test should end here because it had verified I understand the economic theories and know how to get at the answers.
But the test doesn't end there because I need to write down the actual numbers for full mark. Can anyone tell me why I need to justify to the examiner I can solve a pair of simultaneous equations in this context? To me this is just a pointless exercise that has nothing to do with economics.
I would, however, like to point out that things would be different if the question does not ask for a number, but rather an expression of the quantity we are after. Then it would be useful and interesting to fully solve for the expression because from that expression we can tell how the value will change in relation to the known parameters.
It is unfortunate that all too often exams contain numerical rather than analytical questions. Coupled with odd parameters (a=0.423 instead of a=2), you wouldn't know you made a mistake since your answer, whether right or not, is just a number. On the other hand, a mistake can be spotted more easily in an expression if you know how the variables should interact with each other.
If I want to solve mathematical problems numerically, I won't be studying economics.
Friday, 15 June 2007
Saturday, 9 June 2007
Intolerant Culture
The inspiration for this post started when I was considering why video games are not responsible for violent acts in real life. Clearly it is impossible to prove that video games will not make anyone more violent. Even I don't believe in that assertion. However it is my belief that video games are not the major influence of someone committing acts of violence, rather it is something more subtle that we have so far ignored.
The first thing that came to mind is the current so-called war on terror. War, whether the legitimacy of its cause, is an act of violence. Worse, it is an act of violence in real life, as opposed to what one would see in a movie or a video game. If games really induces people to become more violent, then the same should happen with seeing footages of the Iraqi conflict. If anything the latter also legitimises and actively promotes the use of force, since the war is endorsed by the U.S. Government. It is odd that people will believe simulated violence can cause violent behaviour but real violence has no effect.
As I thought harder, it occurred to me that violence is often driven by the need to retaliate. To get even. To get justice. The sue-happy culture of the United States (and probably spreading to other Western countries) is sending one message to the people: if anyone, including your closest ones, does anything that makes you worse off, sue them! Thus everyday we see on Judge Judy mothers suing their sons or ex-best friends suing each other, for mere hundreds of dollars or less. It seems to me people are getting less and less tolerant of others which explains why the smallest conflicts result in full-blown retaliatory law suits. The problem is, some people (most, hopefully) get their revenge via law suits but others prefers to use force. I believe that if people can learn to be more tolerant of others they will not desire to seek revenge, thus eliminating the source of violent acts altogether. Alas, such a scenario probably belongs to Utopia more than the real world, as it is hard to convince most people that life really isn't fair and they should just live with it.
In conclusion, video games and movie probably contributes to violence, but they are not the root of the problem. We need to look deeper into this matter and find out what provokes one to want to cause harm to another person. Only then are we able to cure the problem once and for all.
The first thing that came to mind is the current so-called war on terror. War, whether the legitimacy of its cause, is an act of violence. Worse, it is an act of violence in real life, as opposed to what one would see in a movie or a video game. If games really induces people to become more violent, then the same should happen with seeing footages of the Iraqi conflict. If anything the latter also legitimises and actively promotes the use of force, since the war is endorsed by the U.S. Government. It is odd that people will believe simulated violence can cause violent behaviour but real violence has no effect.
As I thought harder, it occurred to me that violence is often driven by the need to retaliate. To get even. To get justice. The sue-happy culture of the United States (and probably spreading to other Western countries) is sending one message to the people: if anyone, including your closest ones, does anything that makes you worse off, sue them! Thus everyday we see on Judge Judy mothers suing their sons or ex-best friends suing each other, for mere hundreds of dollars or less. It seems to me people are getting less and less tolerant of others which explains why the smallest conflicts result in full-blown retaliatory law suits. The problem is, some people (most, hopefully) get their revenge via law suits but others prefers to use force. I believe that if people can learn to be more tolerant of others they will not desire to seek revenge, thus eliminating the source of violent acts altogether. Alas, such a scenario probably belongs to Utopia more than the real world, as it is hard to convince most people that life really isn't fair and they should just live with it.
In conclusion, video games and movie probably contributes to violence, but they are not the root of the problem. We need to look deeper into this matter and find out what provokes one to want to cause harm to another person. Only then are we able to cure the problem once and for all.
Wednesday, 6 June 2007
Security is a Tradeoff
Everyone is talking about security these days. Politicians want to protect their countries from terrorist attacks, while companies are worried about frauds of all kinds. These concerns led them to introduce various security measures such as more stringent checks in airports, identifying a person by their biometrics, and looking at the buying patterns of a credit card. Although there is no doubt each additional measure increases security, they also put extra burden on the process and that can add up to a large cost.
For example, it is very convenient to shop with a credit card. Just swipe the card and sign the bill and you're done. However, if your credit card details is leaked to a malicious third party, he or she can easily purchase goods from online stores under your credit. Hence this is not a very secure payment system.
Now let's consider the opposite end of the scale. Suppose every time you want to pay with your credit card the store needs to verify your identity by checking two official documents that identifies you (say your HKID card or drivers licence), as well as performing three separate biometric scans. Clearly it is now a lot harder for someone pretending to be you using your credit card, but at this point I suspect you wouldn't want to use your credit card either due to all the hassles.
The above is of course an exaggeration of what might actually happen in practice, but it illustrates an important principle, that although security measures reduces the risk of losses, it imposes its own costs. Thus it is not wise to blindly put in place any and all security measures you can think of into a system, because the cost of performing these extra steps becomes higher than what you lose by being less secure. The art of security, therefore, is to find the point where cost is minimised rather than engineering the most secure (and likely most tedious) system.
This is not to say one cannot improve security without causing extra trouble to the customers. For example, one of the biggest reason people don't (in the companies' view) adequately secure their PINs and passwords is because they want to share them with several others whom they can trust. We all do that at some point in time, and sometimes it makes sense to do that. Usually a more secure system means it's harder for people other than the account owner to gain access. But this contradicts with our needs to sometimes let people we trust to access our accounts!
In theory, if the system knows the owner gives (or would have given) another person consent to access than it should be safe to allow access for that person, but this is almost impossible to implement without increasing risk. If I want to access my mum's back account, should the bank let me? Let's say my mum give me permission today and I got in, but I try to get in again the next day. Does the bank let me in now? Can it safely assume the situation will not change in just one day? No! It needs permission from my mum again. But if my mum is always around to give permission she can just access the bank account herself!
If the bank has perfect information it will just let me in, but it doesn't. The best it can do is look at my track record and assume that I'm benign because I always have a good relationship with my mum. Again this is a tradeoff -- set the criteria too loose and anyone can access the account, too strict and we're back to where we started -- and the trick is to find the point that minimises hassles and risk of fraud. Realistically I can't imagine anyone building this kind of system just because it's so complicated and so hard to find that "middle point". That's unfortunate, because it means legitimate people like me have to "hack" into my mum's accounts just to change a credit card number.
For example, it is very convenient to shop with a credit card. Just swipe the card and sign the bill and you're done. However, if your credit card details is leaked to a malicious third party, he or she can easily purchase goods from online stores under your credit. Hence this is not a very secure payment system.
Now let's consider the opposite end of the scale. Suppose every time you want to pay with your credit card the store needs to verify your identity by checking two official documents that identifies you (say your HKID card or drivers licence), as well as performing three separate biometric scans. Clearly it is now a lot harder for someone pretending to be you using your credit card, but at this point I suspect you wouldn't want to use your credit card either due to all the hassles.
The above is of course an exaggeration of what might actually happen in practice, but it illustrates an important principle, that although security measures reduces the risk of losses, it imposes its own costs. Thus it is not wise to blindly put in place any and all security measures you can think of into a system, because the cost of performing these extra steps becomes higher than what you lose by being less secure. The art of security, therefore, is to find the point where cost is minimised rather than engineering the most secure (and likely most tedious) system.
This is not to say one cannot improve security without causing extra trouble to the customers. For example, one of the biggest reason people don't (in the companies' view) adequately secure their PINs and passwords is because they want to share them with several others whom they can trust. We all do that at some point in time, and sometimes it makes sense to do that. Usually a more secure system means it's harder for people other than the account owner to gain access. But this contradicts with our needs to sometimes let people we trust to access our accounts!
In theory, if the system knows the owner gives (or would have given) another person consent to access than it should be safe to allow access for that person, but this is almost impossible to implement without increasing risk. If I want to access my mum's back account, should the bank let me? Let's say my mum give me permission today and I got in, but I try to get in again the next day. Does the bank let me in now? Can it safely assume the situation will not change in just one day? No! It needs permission from my mum again. But if my mum is always around to give permission she can just access the bank account herself!
If the bank has perfect information it will just let me in, but it doesn't. The best it can do is look at my track record and assume that I'm benign because I always have a good relationship with my mum. Again this is a tradeoff -- set the criteria too loose and anyone can access the account, too strict and we're back to where we started -- and the trick is to find the point that minimises hassles and risk of fraud. Realistically I can't imagine anyone building this kind of system just because it's so complicated and so hard to find that "middle point". That's unfortunate, because it means legitimate people like me have to "hack" into my mum's accounts just to change a credit card number.
Thursday, 31 May 2007
Too many passwords
Depending on how active you are online you may have anywhere between 1 to 50 logins (username and password pairs). It's just that every web site you go to requires a separate login. Sometimes you can reuse the details but not always. Your favourite username might be taken, or the password rules are incompatible with each other. Thus it's practically impossible to use the exact same login for every site you run into. This is usually not a problem for sites you use on a daily basis such as emails, but for sites we seldom use the it's always a challenge to recall the username and password. "Which email address did I use for the username?" "When I changed my password last year did I remember to update for this site?...no, and apparently I didn't update for the password change two years ago either." The problem becomes more complicated as some sites change ownership or two sites merge. I once lost my netscape.com email because when AOL bought Netscape it got changed to netscape.net, and with that I was unable to recover the password for the old SETI@home project. In short, things can become quite messy, and this is the reason I do not create accounts on web sites unless I absolutely have to.
As if things are not bad enough, we also have some "hidden" accounts created for us automatically when we subscribe to real services such as phone and utilities. Most of the time we are not even aware of the existence of these accounts until we need to say change our credit card details or enter a competition. But if we didn't create the accounts ourselves, how the hell do we know our username and password? If you are lucky, you may be able to dig up the letter they sent you when you first subscribed and the login details would in that letter. More likely there was no letter or it was lost or they never told you the login details. Thus you can't login and have to call support to get the details. If you can confirm your identity to the support guy he might tell you how to login. If you are calling on behalf of someone else, good luck.
Here's a real life story and basically what motivated me to write this post. My mum's credit card was discontinued because they thought the spending pattern seemed suspicious (in fact nothing of the sort was going on). Rather than reinstating the card, they had to issue a new one to my mum. This means we have to update the credit card details for our phone services. Now, trying to log onto the phone website, I found the password on the phone bill would not work. A few trials later I was redirected to a password recovery page, where it would email me the password. Great, except at the bottom I have to enter the "4-digit service code". What?! What the hell is that? You can imagine how silly this is. If I don't know the password why would I know a 4-digit service code? So in order to retrieve one shared secret (the password), I have to have another shared secret (the service code)? Come to think of it, isn't the service code just another password?
It's not hard to see the problem here. We have too many passwords, so only the frequently used ones are remembered. I don't know how long it'll take phone or utility companies to realise their customers don't need to access their accounts every day. Or every week. Or every month. Or ever (just call support...). If they want the customers to actually be able to login, maybe they should make the logins easier. Maybe the username is the customer number and the password the driver license number or something they actually know. You might think this choice of password is insecure, but if I know your driver license number I can just call up support and ask them to tell me the password. And no, these companies will never understand passwords should not be revealed to anyone including the support staff.
As if things are not bad enough, we also have some "hidden" accounts created for us automatically when we subscribe to real services such as phone and utilities. Most of the time we are not even aware of the existence of these accounts until we need to say change our credit card details or enter a competition. But if we didn't create the accounts ourselves, how the hell do we know our username and password? If you are lucky, you may be able to dig up the letter they sent you when you first subscribed and the login details would in that letter. More likely there was no letter or it was lost or they never told you the login details. Thus you can't login and have to call support to get the details. If you can confirm your identity to the support guy he might tell you how to login. If you are calling on behalf of someone else, good luck.
Here's a real life story and basically what motivated me to write this post. My mum's credit card was discontinued because they thought the spending pattern seemed suspicious (in fact nothing of the sort was going on). Rather than reinstating the card, they had to issue a new one to my mum. This means we have to update the credit card details for our phone services. Now, trying to log onto the phone website, I found the password on the phone bill would not work. A few trials later I was redirected to a password recovery page, where it would email me the password. Great, except at the bottom I have to enter the "4-digit service code". What?! What the hell is that? You can imagine how silly this is. If I don't know the password why would I know a 4-digit service code? So in order to retrieve one shared secret (the password), I have to have another shared secret (the service code)? Come to think of it, isn't the service code just another password?
It's not hard to see the problem here. We have too many passwords, so only the frequently used ones are remembered. I don't know how long it'll take phone or utility companies to realise their customers don't need to access their accounts every day. Or every week. Or every month. Or ever (just call support...). If they want the customers to actually be able to login, maybe they should make the logins easier. Maybe the username is the customer number and the password the driver license number or something they actually know. You might think this choice of password is insecure, but if I know your driver license number I can just call up support and ask them to tell me the password. And no, these companies will never understand passwords should not be revealed to anyone including the support staff.
Tuesday, 15 May 2007
Thunderbird
I have at least 7 email accounts and it's difficult and annoying to keep track of them all. The most obvious thing is I have to login 7 times to check everything, since I do not turn on "remember passwords". Anyway a while back I discovered Thunderbird (TB) can be made to handle many popular webmail accounts such Hotmail and Yahoo Mail, with the help of the Webmail extension. I have been using it for a few weeks and have to say it saved me a lot of time and trouble. I can now check 5 of the email accounts without logging in at all, and TB will regularly check for new mail so I won't miss anything. Granted this method is not perfect -- from time to time I still need to log on to manually delete the read messages as the Webmail extension will only grab them from the server but not remove them. However logging in once every week isn't so bad.
If you have been using any of these popular webmail services you will know they are all becoming more application-like, that is instead of having to refresh the whole page every time only a portion of the screen is updated, and you can use keyboard shortcuts and drag-and-drop to manage messages. They are essentially programs running inside your browser. While I quite enjoy using these new interfaces none of them can compare to an actual program running natively on my computer, in terms of response and functionality. Perhaps one day the internet will become so fast, and our computers so powerful that applications inside a browser is just as snappy as native programs, and none of these would matter. For now, I am sticking with TB.
If you have been using any of these popular webmail services you will know they are all becoming more application-like, that is instead of having to refresh the whole page every time only a portion of the screen is updated, and you can use keyboard shortcuts and drag-and-drop to manage messages. They are essentially programs running inside your browser. While I quite enjoy using these new interfaces none of them can compare to an actual program running natively on my computer, in terms of response and functionality. Perhaps one day the internet will become so fast, and our computers so powerful that applications inside a browser is just as snappy as native programs, and none of these would matter. For now, I am sticking with TB.
Subscribe to:
Posts (Atom)