The Black Liszt

Author: David B. Black

  • Big Data’s Big Face-plant

    Big Data is huge. Everybody wants it. If you're not doing it, you're hopelessly antiquated. But it has serious flaws. The high-profile role played by Big Data in the recent election provides an excellent example. Calling those efforts a "face-plant" is kind. In addition to illustrating many of the glaring flaws I have previously enumerated, this face-plant clearly and explicitly demonstrates the corrosive effects of bias: the experts weren't seeking the truth — they were rooting for an outcome. Given the undeniable predictive failure, you'd think a little self-reflection might be in order. This post uses the recent election Big Data failure as an example. The flaws it illustrates, and others, are common in Big Data efforts, and are the reason why so many of the much heralded efforts result in no substantial benefit.

    The Big Data Experts

    In recent years, Big Data election experts have attained great visibility. Their pronouncements are more closely followed than those of the candidates themselves. Nate Silver has been the reigning god, but a new one exploded onto the scene this election season. Here's the story as it appeared in Wired Magazine, just days before the election:

     Wired 1

    The story got serious attention, as you can see from more than 24,000 Facebook shares. How big is this guy and organization? Real big:

    Wired 2

    Who is this guy? Read on:

    Wired 3

    Clearly a massive math and science wonk. No one else gets into CalTech, much less gets a Stanford PhD in science.

    What did he say about the election? Of course the picture changed as election day drew close, but all the math pointed strongly to a Clinton victory.

    The debate as the election drew close was interesting. It wasn't whether Clinton would win — everyone thought she would — but since they're math guys and they know this isn't physics, they argued about the probability she would win, and about the margin predicted.

    Dr. Wang ratcheted up the probability of a Clinton win all the way up to 99%. That's pretty darn certain! Here's his argument for why such certainty was reasonable:

    2 PEC

    Yup, it was sure a giant surprise, all right!

    Here is his description of his calculations and why they're reasonable, if you can stand it. If not, that's OK, just skip ahead:

    3 PEC

    There's lots more stuff on the site. By all means check it out for a great example of self-delusion by a celebrated Professor Doctor. Here is a sample:

    4 PEC

    For any readers who actually know math and science, you'll know right away that this is a specious argument: it's a lot of words that are math-y, but they bear no real relationship to the actual probability of Clinton winning.

    Late afternoon of election day, he posted his last prediction:

    1 PEC

    This was not a search for truth

    How could Professor Doctor Neuroscientist Sam "Election Hero" Wang have gotten it so wrong? In addition to committing many of the standard errors and unusually bad interpretations of probability I've mentioned, there's another reason: Wang was not seeking truth. Dr. Wang was an advocate. He badly wanted an outcome. He wasn't predicting for prediction's sake — he was predicting to find out which races were close, so that scarce funds could be allocated to sway the outcome of those close races. How do we know? Here are Wang's own words in that same final post, which he repeats with emphasis in the comments:

    Activism

    This also explains how he got famous — he was drizzling science-y pixie-dust on the outcome that he and many other people wanted. He told them what they wanted to hear.

    Could it be that Dr. Wang has an unblemished track record of prior predictions, and let his emotions get the best of him in the 2016 election? Sadly, no.  Look at this powerful — 98% probability! — prediction, his final one before the 2004 election:

    Final prediction

    What we've got here is an advocate posing as a scientist, spouting out what his fans want to hear with lots of math-geek talk to make it sound solid, but who gets it badly wrong. Repeatedly. Surely, all right-thinking people would turn their backs on him, right? Science is about making predictions that come true, and if your predictions are wrong, you're just a promoter with no credibility, right?

    Sadly, no.

    A prospect

    There is clearly an audience for people who tell readers what they want to hear with math-y icing on top.

    Conclusion

    The Big Data juggernaut rolls along, its momentum unabated. The face-plant of Big Data analytics in the 2016 should have been a wake-up call, regardless of your political views, of the inherent dangers and deep biases that send all too many Big Data efforts into the gutter of failure. Everyone appears to have moved on unchanged, which makes sense, because it was never really about science and truth to begin with. It's sad to see exotic BIG data efforts getting lots of money and attention, when humble LITTLE data efforts are causing daily pain but starved for funding. See this. However, if you want to get value out of Big Data and associated technologies, be assured that it can be done. Just take this story as another note of caution.

  • On the Internet, you’re Naked and For Sale

    Wild claims are being made by powerful people about how certain regulatory changes being discussed in the US Congress will remove your privacy on the internet, enable evil corporations to sell your personal information to the highest bidder, and control where on the internet you can go. See here and here.These claims grossly misrepresent the facts.

    The situation on the internet is like this: Imagine that when you walk around New York City, all the business owners know everything about you. Imagine that when a business owner learns something new about you, he immediately puts the information up for sale. You are naked! No privacy! Now you get on a train to Boston, and when you get off, you find exactly the same happens there — AND, everyone in both cities knows what you did in all the other cities you've visited.Yes, there are things you can do about that. But most people don't do those things. They've decided that it's OK.

    Until October 27, 2016, you were just as naked and for sale when on the train as you were while walking the streets. That's when the FCC issued new rules, which haven't gone into effect. Because the new rules have not gone into effect, rescinding them means that nothing has changed: you were naked and for sale from the start of the internet, whether in a city or on a train, and that won't change.

    What's under discussion in Congress and at the FCC is this:

    • You should continue to be as naked and for sale while you're on the train as when you're in a city — no more and no less. That's the "privacy" they're talking about, which is unchanged from the start of the internet.
    • Business should be free to offer different ways at different prices for consumers to travel from NYC to Boston, for example, cheap but slow bus, faster but more expensive train and fastest but most expensive airplane. So-called "net neutrality" rules amount to making everyone take the bus and ending consumer choice.

    Ignorance and lies surround us. Business as usual.

    You have no Privacy on the Internet

    On the internet, you are naked. You always were. What has evolved are the methods for buying and selling pictures of your naked self, and histories of where you've been and what you've done.

    I've visited a wonderful but obscure website for a credit card anti-fraud company I'm involved with, Feedzai. Today, I clicked on an item in my Facebook newsfeed about introverts and extroverts. When I got to the page, here's what I saw:

    Feedzai ad

    It's a great ad, and I never mind seeing it. How the heck did Feedzai manage to place an ad on this from-another-universe site? Simple: when I got to the site, it put my information up for auction, Feedzai looked at the information about me and placed a high enough bid to win the auction and place the ad. It's called real-time bidding. It takes place when you visit most websites, and happens in a fraction of a second.

    I purposely picked an itty-bitty advertiser placing an ad on an obscure site to show how ubiquitous the information marketplace is. But the big boys do it too, and it's even creepier. I have a cat. I recently bought food for the cat. Here's what I just saw on the blog of Scott Adams:

    Cat food ad

    Yes, that's exactly the product I bought on Amazon

    There are private rooms on the internet, sites where the communication is encrypted. Google is one of them. The information about you learned by the encrypted site is entrusted to the site — which may or may not be able to keep it secure. Google, for example, immediately puts the information up for sale, which is why you see ads related to the search you just did. The retail company from which you just bought something may not manage to keep your information secure, even if they try.

    You are naked on the internet, followed everywhere, and you're always for sale. Period.

    What would change if the privacy rules went into effect?

    If you listen to the people screaming about it, lots would change. Sorry, it wouldn't.

    • The ISP's don't have much data to sell — they're free to sell it now and have been free for years, but mostly they don't. ISP's are a tiny fraction of the internet ad market.
    • The ISP's get less of your data as time goes on. Far from having your complete browsing history and knowing your SSN and the size and color of the most recent clothing you just bought, as famous people have declared, they have little access to it, and the fraction gets smaller over time.
      • They never had access to your SSN. The proposed rule would have had no practical impact.
      • Most commercially important data passes through the ISP encrypted. It's literally not visible to them. Look up at the URL of this blog. It's not encrypted. On the other hand, the fact that you're viewing it is commercially useless.
      • Go to Google and look at the URL. You'll see https:// at the start, which means it's encrypted. The ISP literally can't see what you're searching for! And when you go to Amazon or another commercial site, it's the same. The ISP doesn't know what you've bought. But Amazon does, and stalks you with ads about it, as illustrated above.

    This whole thing is a tempest in a teapot.

    What about Net Neutrality, which the FCC proposes ending?

    This is a complex subject, with heated rhetoric all around. I go into the issues in depth here. Briefly, ending net neutrality is a good thing for consumers.

    Net neutrality says, for example, that all the seats at Yankee Stadium have to be sold at the same price and offer the same views. We all know that the views from the grandstand and the upper deck are quite a bit different from the boxes behind the dugouts. Most people understand and accept that the prices vary accordingly. Under net neutrality, everything would have to be the same and charged the same price. Switching metaphors, why would any company offer air service if they could only charge the same rates as the bus? Why would any company offer better service without any incentive to do so?

    Naturally, there are arguments against the summary I've presented here. To go into depth, read this.

    Conclusion

    You're naked and for sale on the internet. It's the way it is. It stops almost no one from using the internet, and many people find it convenient, seeing things that are more relevant to them than not. The frantic noise about the awfulness of rescinding a change that never took effect is nothing but posturing to the ignorant.

     

     

     

  • Devil’s Dictionary for 21st Century Finance

    Another in the series introduced here.

    Ambrose Bierce

    A couple definitions from his book:

    Finance

    Wall street

     

    Definitions for 21st Century Finance

    A couple from the student:

    Alternative Data

     

    The shocking practice among certain rogue financial investors of evaluating investments using non-financial data, from sources such as social media. Leading progressive investors are talking with the appropriate authorities in hopes that strong regulations will be issued to put a halt to this kind of prejudicial and unfair practice.

    Quantitative Fund

    A fund that uses methods that involve lots of numbers, in sharp contrast to earlier methods that emphasized more qualitative measures such as “lots and lots,” and “not too much.”

    Quantamental

    An approach to investing that purports to combine two incompatible investment methods, quantitative and fundamental, to their mutual advantage. It is based on the success of other combinations of opposites, like combining overpaying and underpaying in order to pay just the right amount for something.

    Conclusion

    Some bad things never seem to end…

  • Software Giants: Image and Reality at Facebook

    I am perpetually amazed at the flood of reverent articles about the wonderful big software companies that are inflicted on us. How great are their leaders! How wonderful it is to work there! Everyone should emulate their business practices! Their products are awesome!

    The reason why the sycophantic flood continues is based in simple economics, but why most people appear to buy the b.s. is beyond me. You don't have to be a hardened cynic to see past the image.

    This subject is worth a book or two. I've contributed just a couple blog posts. This post is another one on the wonderful Facebook, which (supposedly) does so much to demonstrate software excellence and contribute to our betterment.

    Why Facebook is Wonderful

    An article has just appeared about the wonderfulness of Facebook. The article is an interview by John Battelle with Lori Goler, who is "VP of People" at Facebook, leading the company's growth from 500 employees to 15,000. Here she is:

    Lori Goler

    She sounds like a really nice person. I've worked with the interviewer, John Battelle, at one of his prior ventures, and he's a great guy.

    The whole article is worth scanning. But the subhead gives you the idea: Facebook is "the world's most admired employer." Here are a couple quotes from Ms. Goler:

    We are really looking for builders…What goes along with that is a learning mindset.

    Being a strengths-based organization is a place where you are really looking to put people in roles where they are doing work they enjoy that plays to their strengths. … It’s where you get the best teamwork. It’s where the people are able to do the best work of their lives.

    For us, the mission is, “To make the world more open and connected,” so it makes sense that our culture is open and connected. Then internally, we reflect that culture.

    What we find is that what it really means is that people have all the context they need to be able to work with great autonomy in the organization, which of course leads to greater innovation and greater impact. It’s been a virtuous cycle for us.

    According to the article, Facebook is a great place with a socially uplifting mission, populated by great people who are always learning and in roles where their strengths are tapped and their work has impact is fulfilling, in a completely open and supportive environment. Wow. Who wouldn't want to work there?

    Another view of Facebook

    For a contrasting view of Facebook, I recommend reading this book:

    Chaos monkeys

    Warning: I had to force myself to get through the book; the author's self-described behavior was distasteful, to put it mildly. But it made the rest of his descriptions the more credible, and he said nothing that contradicted my inside knowledge.

    The book has gotten lots of attention. It's been reviewed by major media, for example the New York Times:

    NY Times

    And by tech journals, for example Tech Crunch, which declared it was the "year's best non-business book about business"

    Tech crunch

    The book is #1 in several categories at Amazon. The top-rated review is telling:

    Chaos review 1

    ….

    Chaos review 2

    Perhaps you can see that there is a contrast, shall we say, between the wonderfulness of Facebook as presented by its leaders and the reality. But this makes sense. What was the job of the VP People before getting that job? Marketing! In other words, telling stories to get you to buy stuff. She is continuing to do her job well, i.e., selling Facebook as a great place to work.

    Facebook's Product

    Well, maybe it isn't such a great place to work in spite of all the propaganda, but at least those 15,000 people turn out a great, high-quality product, right?

    Here's a post about software quality issues with a section on Facebook, and here are details about the inability of those 15,000 engineers to turn out a product that has reasonable quality, even after many attempts — as judged by their own users.

    It's not just Facebook. It's Google and the rest. Think about this: with such wonderful employees and huge cash reserves, why can't they make their own products work, much less innovate? If they're so innovative, why does so much of what they "innovate" come from acquisitions? See this for details.

    You might ask, if their software quality is so awful, how did they become so big and valuable? Good question. Zuckerberg made some world-class smart business strategy moves to get it going. See here for details.

    Why this matters

    These observations about image and reality at the big famous software companies have huge practical implications for small companies, managers and programmers.

    I have often observed that when board members want to hire a top executive, or when managers want to fill an important software position, they often value highly a candidate's having done a stint at one of these famous giants. They'll think something like "Facebook has a product that nearly everyone uses; I want to build a product that nearly everyone uses; therefore, I'll hire people from Facebook, and I'll get a product that everyone uses."

    Of course rarely will someone come out and say something like that, but the Facebook (or Google or whatever) aura is so strong, people often act as though they believe it. On the other hand, if you really get the perspective about the inept software giants described here and confirmed widely, you will tend to avoid hiring people from Facebook (or wherever) because you know you're likely to drag down your company to its abysmal level!

    Lots more detail on this and related subjects is in my book on Software People. Or for an illustration from a whole different direction, consider the incompetent doctor and nurse in the PBS civil war hospital drama Mercy Street.

    Hastings
    Nurse Hastings frequently brings up the fact that she served with Florence Nightingale as proof that her opinions are the best.

    Conclusion

    Nothing is going to change. Major corporations of all kinds, even more so the big tech ones, will beat the drums of self-promotion, selling themselves to customers and potential employees. It's in the interest of groups that hunger for money and attention from the big companies to make nice, and trumpet the self-congratulations. The big companies will continue to be unable to innovate, and will instead buy innovative companies. Sometimes the contrast between the image that is widely promoted and the reality gets to me. At minimum, my hope is that you're working at a place that's far better than Facebook, and that you avoid error of attribution I have described here.

  • Let’s Fix CIA Cybersecurity using Machine Learning

    We all know by now that the CIA has suffered from the worst hack in history, worse than the Edward Snowden, Daniel Ellsberg, the OPM and any commercial hack you can think of. The likely response will be lots of time and money spent doing more of the useless stuff that failed last time.

    There is a solution. It's proven, at scale and in practice. It's based on the best technology, Machine Learning. It is the reason why banks lose only little dribbles of money to evil criminals and hackers, but have never suffered substantial card losses, after decades of thousands of attempts per year! You think maybe the CIA should try it?

    Security at the CIA

    I have no idea how the CIA does security today. I suspect the bosses all say it's incredibly important, they spend lots of money on it and use "the best" methods.

    The CIA may spend more money and use stronger words, but they're pretty much like most large organizations. They just don't know how to get security done and don't seem to care. What about government-issued security regulations? Ineffective. 

    11

    There are solutions, but no one is interested. Retails stores have implemented them. Even local libraries have implemented them.

    Credit Cards

    Let's drill into credit card technology, which has implemented a method of security that is proven at large scale and now uses ever-improving machine learning methods. If the CIA had used credit card security technology to protect its assets, the recent breach would not have happened.

    There are hundreds of millions of active credit cards in the US, which cause the movement of trillions of dollars. There are over 30 billion transactions a year. Think of all those cards being used by tens of millions of people at millions of merchants. The fraud problem must be huge, right?

    All I can say is, it's a darn good thing the CIA isn't offering credit cards. While the card system isn't perfect, losses due to fraud are well under 10 cents per $100.

    First step Card security technology

    The card issuers were always concerned about fraud, and as time went on and the numbers grew, the technology deployed to avoid loss evolved.

    Among the earliest automated steps to avoid loss in credit cards were two simple measures: credit limits and velocity checks.

    Credit limits are what they sound like: how much money you can spend (take) before the card is blocked, i.e., prevents further spending. The limit may be $500 or it may be $50,000, but there's always a limit.

    Velocity checks count the frequency that a card is used. If a card is used once a day, that's pretty low frequency. If it's used twice in ten minutes, that's high frequency, and will probably block the card.

    These simple measures did an amazing amount to limit fraud losses. They kept losses under 20 cents per $100 spent.

    Applying first step card technology to the CIA

    In computer terms, all of the assets lost by the CIA are files. Files are managed in a file system, which is a key part of an operating system. All operating systems have security of some kind, which I would hope the CIA already uses. This simply means that any user has to log in and provide security credentials before they're given access to anything.

    Every operating system and file system has the ability to restrict access to files by directory. Did the CIA use this simple security measure? I don't know. Did they place files in a hierarchy of directories and carefully control who had access to which tiny subset of all the files they were working on? I don't know, but if they failed to use this existing security method, someone should go to jail.

    Regardless of how existing security methods were deployed, the methods of credit limit and velocity check could be added to the file system to keep any one person from "spending too much," i.e., from accessing too many files in a way that could lead to a security breach. Obviously this simple method is not currently deployed at the CIA.

    Inside the file system, after a request for a file has been made and before it is honored, there is already a security check: does this person have access to files in this directory? What's needed is straightforward. There needs to be a per-person log of all file accesses, including name and date/time of access. For each person, there should be a limit to the number of files accessed per period of time (for example per day), which is like a credit limit. In addition, there should be a velocity check, so that if a person uses half their daily quota in ten minutes, there could be a problem. When either of these checks are tripped, the user is locked out, and security people need to check and make sure the person is actually doing authorized work. If the limits are set correctly for each person's role, this will stop many problems.

    Obviously, bad guys figure this out, so you add things. If you see that someone keeps accessing new files close to the daily maximum, something is wrong. You apply a different kind of velocity check, and shut them down. There are other simple extensions which cover a wide variety of bad things, and shut people down before they get many files.

    This method, if applied to the CIA, would put them decades behind credit card technology, but way ahead of where they are. This method would have prevented the recent CIA breach.

    Neural Network card technology

    Credit limits, velocity checks and their extensions were and are effective for reducing loss. But the bad guys got smarter, and managed to game the system in spite of them.

    Before long, some smart and motivated people got together and applied an older machine learning technique, neural networks, to the problem. HNC, now part of FICO, became the industry standard for fraud prevention.

    The approach is basically to investigate in depth fraudsters who had been caught and train neural nets to recognize them. The neural nets worked best with a large collection of cases to work on, so an industry coalition was organized, and most of the card issuers contributed their data to HNC, which distributed well-trained models to all the participants. This resulted is tremendous improvement — it cut the already-low fraud rate in half.

    However, this particular method of machine learning, while it works well with credit cards, does not apply to cases like the CIA. Neural nets require a large number of cases to train against, which exist in the credit card world. But fortunately, the number of breaches at places like the CIA, while catastrophic, are small in number and infrequent. Therefore, the neural network method would not help the CIA.

    The lastest Machine Learning card technology

    Recently, some smart innovators applied more modern machine learning techniques to credit card fraud, techniques that went deeper into the card issuer's computer systems. This company, Feedzai, is posting tremendous gains in fighting fraud, without requiring data sets of existing fraud cases to train against. This new, powerful method trains against normal, lawful users' ordinary usage patterns, and detect departures from them. Because of this, it can catch first-time fraud.

    Disclosure: I'm part of a VC firm that invests in Feedzai.

    Applying credit card machine learning to the CIA

    Feedzai-type machine learning methods are exactly what's needed at the CIA. I'm not saying they can be plugged as-is into the CIA to solve the problem. I am saying that the machine learning methods used by Feedzai to fight credit card fraud are exactly applicable to extend the "credit limit" and "velocity checks" to new levels of accuracy in protecting files in a file system.

    Part of what Feedzai does is model the patterns of card usage that are typical for a kind of consumer. Apply this to the kinds of users who access files at the CIA. Some of them are designers, some are programmers, others are quality people and testers. Each of them will have a typical pattern, accessing a per-person unique set of files. Usually, they'll access the same set of files over and over, as they're working on them. Accessing a file for the first time will be rare, and usually only happen when they're working on a new project.

    What if a tester, for example, suddenly starts reading files from a project they're not currently working on? What if they're reading source code files, while their normal work only involves working with executables? Alarm!! Ahh-OOOgahhh!! Shut down access of the VERY FIRST file they try to access! And that person has some 'splaining to do.

    It's legitimate for a team to be assigned to a new project. Why shouldn't their actions be hand-monitored during the initial days, with every single file access logged and double-checked as being appropriate during a start-up period? Then, once a pattern has been established, the automated method can again take over.

    Even a simple implementation of this kind of machine learning would have prevented the massive CIA breach. The 8,761 documents currently available on Wikileaks are just a portion of the whole. Even if the directory-level file system security were as pathetic as I suspect it was, the machine learning method would have caught anyone accessing files outside their normal work pattern, subjecting them to scrutiny and probable removal from the premises.

    Conclusion

    Security breaches of the most damaging kinds keep rolling in, from the most deeply secret parts of government (NSA, CIA, Army) to important commercial organizations. It's way past time that proven methods of the kind I describe here and in posts linked-to here are deployed to solve the problem.

     

  • Libraries are More Secure than Computers

    Some people look down on libraries. They think they’re obsolete institutions from a previous age – from that inconceivably ancient age before there were computers. But the fact is, libraries do a far better job of protecting their assets – books – than the vast majority of computer systems do protecting their assets – their data and files. Perhaps the oh-so-mighty gods in charge of their Olympian computer systems could pay a visit to the land of mortals, where people use libraries, and learn a thing or two about keeping your assets secure. Given the abysmal track record large corporations and governments have protecting these assets, with no end in sight, it may be worth a brief visit to the primitive places that out-perform them by miles in terms of security.

    Computer Security Problems

    Does anyone doubt that computer security problems are wide-spread, deep and continuing? Does anyone (except the management in charge, of course) have any reason to believe that the problems are recognized and fixed?

    Libraries

    Libraries are great places. I’ve spent many happy hours in them. But they’re annoying. They won’t let you pick out the books you want and walk out with them!! They insist, absolutely insist, that you check them out. Not just in general, either – they want you to check out each and every doggone book! First, you need to surrender your personal, private information and get a library card. You have to turn the card over to the librarian with your books. Then, submit to the indignity of having the card scanned and each book scanned. Finally, with all your private information recorded, they physically stamp each book with the date it must be returned by, insultingly making the assumption that you may not return it without such a reminder. Then, and only then, can you leave with your books.

    Have you ever tried walking out of a library with a stack of books, without first having checked them out? If you’ve never tried it, you may still harbor the illusion that librarians are mostly quiet, pleasant, mild-mannered people, mostly ladies, who need to be protected from the tough things in life. Anyone who’s tried to STEAL BOOKS from a library harbors no such illusion. The swift, fierce movements, commanding voice and iron resolve of the person who magically appears in front of you, blocking your way, demanding to know exactly what you think you’re doing, will quickly cure you.

     

    Overdue

    Let's hope you've never had overdue books. The librarians know what books you have, when you left with them, when you should have returned them, and exactly how much you owe:

    Pay fines

    By contrast, the computer "librarian" has no idea what files you've even looked at, which ones you left with, and has no sense of returning or overdue. I guess we care more about those obsolete paper books than we do about files that contain confidential customer information.

    Century-old Book Seller security methods

    Librarians and booksellers have been concerned about security for a long time. Here's a publication that appeared for many years, this particular issue in 1905:

    The Publishers' Circular and Booksellers' Record of British and …, Volume 82

    There is lots of wonderful content in this issue, but here's an article that raises the pressing issue of book theft:

     

    Steal 1

    Stealing books is serious business. The thieves go to jail, as well they should! Here is a method that booksellers use to protect their goods:

     

    Watch people

    No one "takes" a file from a computer without help. You ask a program to do it for you. File systems have been part of computers for decades; a file system is the software that keeps track of what file is where, and handles the actual reading and writing of the file (like a book). Moreover, "logging" file systems have been around for a long time — a logging file system is one that records each and every access to a file — every read, every write, every update.

    It's not hard how to imagine turning a file system into an automated version of the librarian's "spy hole" described more than 100 years ago. A security program reads each request for file access and compares each request against a log of who's done how much of what, and when. If someone whose work normally involves reading a customer record every few minutes suddenly requests dozens of files at a time, this is suspicious! Doesn't it make sense to immediately block their actions until someone makes sure nothing bad is going on? After all, it would be the equivalent of someone trying to walk out a library door with a wheelbarrow piled high with books that had not been checked out — and if you tried to check them out, you can imagine the grilling you'd get from the librarian before you would be allowed to walk out the door.

    Believe it or not, systems like this have been implemented. They're not hard to build. No new programming magic is required. In fact, all that's required is a sincere desire to solve the problem! A desire which appears to be lacking. Sad.

    Conclusion

    Think of the image of the librarian (old, dowdy, obsolete) and the computer expert (young, cool, with-it). It turns out that the contrasting images are exactly backwards when it comes to security. In spite of all the acronyms and nerdy stuff, computer security experts are simply incapable of protecting their "stuff," while librarians are way ahead of the game — more than a hundred years ahead, for what it's worth!

     

  • Devil’s Dictionary for 21st Century Computing 3

    More cynical definitions in the series introduced here, for Deep Learning and Blockchain.

    Ambrose Bierce

    A couple definitions from his book:

    Cynic

    Conversation

    Consult

    Stan Kelly-Bootle

    Mr. Kelly-Bootle sometimes provided extended explanations of the words he defined:

    Alpha

    Sometimes he even needed illustrations. See the two definitions below, followed by illustrations:

    ASCII

    ASL

    Definitions for 21st Century Computing

    A couple more from the student:

    Deep Learning

    Deep learning is an evolution of shallow neural networks, in which the neural networks are stacked in many layers, making them “deep.”

    Decades after the 1959 biological model introduced by Nobel Prize-winning scientists Hubel and Wiesel inspired artificial intelligence pioneers at MIT and elsewhere to invent neural network technology, someone noticed that biological neurons are connected in many layers, unlike the single-layer neural networks that AI researchers had been touting for years as the basis for recreating human intelligence inside a machine. Since everyone knows that prestigious artificial intelligence researchers don’t commit errors, or at least simple ones, “deep learning” was introduced as a brand-new idea that would finally crack the code of making machines as smart as the average fifth grader. Someday. Maybe.

    Blockchain

    A hot new technology that is sweeping through the world of finance,  healthcare and elsewhere, whose greatest practical success to date has been the secret transfer of funds between cooperating parties in a criminal enterprise.

    A newly discovered database that has recently been freed from the nearly unbreakable bonds of its cryptocurrency prison; however, as a new kind of database, it stubbornly refuses to be classified as a “database,” preferring to be known as a “distributed ledger,” of which it is apparently the only known exemplar. A cynic might point out that that the stubborn refusal to agree to be part of genus database-imus may be due to the wholly inadequate functionality and performance of blockchain on generally accepted measures of database value, but this is almost certainly unfair to such a widely hailed future solution to problems that undoubtedly are pressing, and have resisted solution for many years.

    Conclusion

    I apologize in advance: there could be more to come.

  • How to Get A Software Job

    There is lots of advice from authoritative places about how to get a job. Any job! Let's apply those principles to software jobs. If you're a great programmer and the techniques work — you don't want to work there! If you're a software manager and the techniques work on you — I hope you work for the government or a big corporation, you'll do well.

    How to Interview Well

    There are lots of places where you can find essentially the same advice, but a recent article in the Wall Street Journal did it well. Here's the key — and note, it's hot off the press!

    Rapport

    Rapport, huh? Sounds suspiciously like what a car salesperson does, your instant new best friend. Who are experts in this rapport thing? Somehow, I suspect it's not top programmers:

    Researchers

    Wow. And "researchers" have found this. So it must be true!

    Here's a lady in a professional job. Where'd she learn her key skills? Tending bar. So much for the value of computer science!

    Bar

    One thing that's recommended is using humor in the interview. Here are a couple models to follow:

    Humor

    The scary part is the study referenced in the WSJ article, in which ratings for competence were strongly influenced by the extent to which rapport was built in the first couple minutes of the interview — all other things being equal, you got higher marks for competence by the interviewer if you were an effective schmoozer. Sad.

    There are Alternatives. Winning Groups use them!

    I strongly suspect that the author's advice is excellent. Aside from my snark about being proven, it's true that most software interviewing is mostly about interpersonal relationships. Groups that famously try to do it differently need to try again. Here's my analysis.

    It doesn't have to be this way. Do it the Joe Torre way! It's all about the substance, people! Just get your head out of software and look at other substance-centric fields. All will be clear.

  • Learning, Machine and Human

    Machine Learning is all the rage today. It's getting so I'm hearing about it as often as about Big Data! And that's a lot!

    A Machine Learning Expert is supposed to be able to wield his magic weapon and solve problems that have eluded apparently smart, motivated and educated humans for decades. It's said to be that good! It's knocking off previously unsolvable problems in fintech and healthcare left and right, with no end in sight.

    I'm a big fan of machine learning and related analytical techniques. I'm delighted that it is finally being applied to some problems for which it is well-suited; this happy event is long overdue. But as with most magic wands, some words of qualification and caution are in order.

    Do you have a ML problem?

    While the definition of machine learning has been stretched and pulled in recent years (maybe forever!), there are important numerical methods that most people don't consider to be ML algorithms. One important category of these is optimization techniques of the kind that are studied in Operations Research. For example, if you want to optimize running an oil refinery, you probably want goal-based optimization rather than machine learning.

    What kind of machine learning?

    Given that you have a problem that may lend itself to a machine learning approach, it's important that you pick the right one to use — that's right, I said "right one." Machine learning is a body of algorithms, in fact a large and growing body. Here's a snapshot of part of a list of them — this is less than a quarter of the list:

    1 ML
    Do you have all the data?

    Supposing you do in fact have a problem that lends itself to machine learning and have a sense of the appropriate technique to use, even a machine can only learn if it's got the right stuff to learn from.

    This is one of the many reasons why machine learning efforts that end up yielding practical, real-world results nearly always start out with humans examining the data in great detail. Often they find that data you know is going to be important just isn't present in the data set.

    And then when all the relevant data is there, what to do with it is often blindingly obvious — human learning works just great, thank you very much!

    Is the data any good?

    There's this phrase you may have heard; it goes something like "garbage in, garbage something-or-other." You can probably figure it out. Sounds simple. It isn't. Even finding out whether your data is any good can be a major challenge.

    And then, once you're pretty sure it's good, does it stay good? This isn't a pie-in-the-sky problem. One company I know that processes massive amounts of credit card data from credit card companies has a few people assigned full time to detect when the card company has changed something important about the data. When told about it, the card company would typically respond with skepticism. Then they would check. Then they'd say "oops." The "sorry" was usually implied, not stated.

    Are the data types identified and in good order?

    Take something simple, like date. If a date is coded, it may be a julian day number; many DBMS's do it this way. A date may be just a string, like 20161112. You have to know whether that's year-month-day (Nov 12 2016) or year-day-month (Dec 11 2016) or day-year-month (Dec 20 1611). The whole Y2K problem came from this, in which Sep 9 1999 would be represented in a string like this: 090999. Life is complicated. Data is even more complicated, in new and different ways. You have to embrace the complication.

    And BTW, dates are just the tip of the messy-data iceberg.

    Is the data normalized?

    This may sound esoteric, but getting good results can hang on it. It basically means, is all the data that refers to the same thing coded the same way? For example, here are a couple street address variations: "Cedar Lake East," "Cedar Lake E," "Cedar Lk E." The guy driving the post office truck knows they're the same. Does the computer?

    I ran into a more complex problem of this kind trying to get data about doctors, doctors who happened to work at varying office locations. How can you be sure it's the same doctor, particularly when there are doctors with similar names and different spellings of the same name.

    Is the data coded where appropriate?

    That's why you'd really like to have all your data be coded. You really don't want doctor names — you want unique doctor ID's, like social security numbers. But all too often, you just don't have it.

    How much natural language is used?

    Any of the problems above can sink a machine learning project into the morass of struggling with tools and bad results. But when natural language is involved, you reach a whole new level of horror.

    The world has a lot of experience with this, smart people working with the best tools on massive data sets over many years. Even things that sound simple are far from solved, and it's doubtful they ever will be solved with high precision.

    One simple example: spam filters. Do you get any spam in your email? Are any valid emails marked as spam? If your answer is "no," then it's obvious that you basically don't use email.

    Another example: comment filtering. As commenting on the web has exploded, so has the number and vigor of people who write nasty, obscene comments. Lots of people, yes including all the tech giants, have put loads of resources into automatically identifying comments that are inappropriate. You wouldn't think it would be that hard. It's not hard — for humans. For machines, well, yeah it's hard.

    The problem of natural language processing (NLP) remains unsolved. Even something seemingly simple like "feature extraction" from natural language can be a nightmare. Suppose you want to automatically extract from clinical notes whether a patient is homeless. Consider these sentences:

    The possibility that the patient is homeless was raised several times. I examined it carefully. Not true.

    This is easily understood by a human reader, but is surprisingly difficult for NLP because of making the link between the sentences. The problem is linking “it” with the attribute “homeless” and further interpreting “not true” to mean that the attribute “homeless” is false. And that again is a relatively simple case.

    Conclusion

    I'm all for machine learning. But fashionable trends like this all too often result in spending lots of money with promising results perpetually just over the horizon, and then … the subject gets changed.

    There's good news. Machine learning used by the right people in the right way against properly constructed and understood data sets with the right amounts of human learning added in can achieve astounding results. And have! A good example is The Oak HC/FT portfolio company Feedzai, which is blocking and tackling credit card fraudsters as we speak.

  • Evidence-based Software

    Have you heard of "evidence-based medicine?" It's a relatively new trend in medicine based on the idea that what doctors do should be based on the evidence of what works and what doesn't. What's scary as a patient is the thought that this is a new idea. What is it replacing? Voo-doo-based medicine?

    At least the field of medicine has accepted that evidence matters. So much better than not!

    Let's turn to software. Have you ever heard of evidence-based software? Of course not! There is no such thing! How software is built is based on loads of things, but sadly, evidence is not among them. Among other things, this explains why software projects fail, and/or result in expensive, rigid bloat-ware that is riddled with errors and security holes.

    The Golden Globes 2016

    One of the reasons to watch the Golden Globes awards ceremony is for the fashion. Everyone knows it — which is why there's a multi-hour Red Carpet pre-show, and even a pre-show to the red carpet show.

    You watch the show if you want to see what the new fashions are. You wouldn't want to look silly, would you? If you watched this year's show, you could see Amanda Peet looking really nice:

    11 Peet

    And you could see Sarah Jessica Parker looking like something else altogether:

    11 Parker

    I heard the expert on one of the shows talking about the new colors and lines in the dresses, something we'd see more of in the upcoming year.

    What's the "best" fashion? The one leading people seem to like. What will be the best fashion next year? About all you can be certain about is that it will be something different from what was most-liked this year.

    Software development fashions

    The methods used in software development are selected with just about the same criteria as the leading fashions in dresses. Who's wearing what? What do leading people think? What did I use (wear) last time that got admiring looks?

    Fashions come into software development. They get promoted. They get used and mis-used, adapted and morphed. Programmers take them with varying degrees of seriousness. Wherever you're programming, you have to more or less go along with the prevailing fashion. If everyone else crosses themselves, you'd better too. If there's a daily stand-up, you'd better stand up when everyone else does, and not look too abstracted or bored.

    Effectiveness, Productivity and Quality

    In fashion, you want the admiration of other people who look at what you're wearing. In software, since you spend most of your time building software, it's nice to have the admiration of people who look at you building software.

    But unfortunately, other points of view sometime intrude. Managers want to know about budgets and productivity and deadlines. After the software is put into use, there are ignorant and annoying users to contend with. What you've worked so hard to build is never enough. They complain about it! Crashes, performance, quality issues? Sometimes people get upset. And security? Rule number one is keep it quiet! The last thing we need is this getting into the papers!

    Then you find out that most outsiders could care less what goes on in the sausage factory. Whether it's organized or chaotic, ugly or pretty, in the end all they seem to care about is how the sausage tastes. These simple-minded people can only keep one thing in their heads at a time, and that one thing is most often: the results!

    Wouldn't it be nice if we had a way of picking through the dozens of software methods that are in widespread use, and based on the evidence, settle on just a couple that were the best that actually … produced the best results!!?? Or maybe that's just too radical a thought.

    That's why we need something like evidence-based software — or at least acknowledgement that it could help things out.

    Coda: EBSE: Evidence-Based Software Engineering

    I started writing this blog post based on the comparison to evidence-based medicine as a way to frame the fashion-based chaos that surprisingly rules the day in this highly exacting field of work. I certainly had never heard the phrase "evidence-based software." But as a check before clicking "publish," I thought I'd better do a quick search. Imagine my surprise when I found that there is, indeed, something called EBSE, evidence-based software engineering, explicitly inspired by the analogy in medicine!

    I've interacted with a large number of software engineering groups over the last twenty-plus years, and been inside a few for many years prior to that. The groups have been highly varied and diverse, to put it mildly. I've seen loads of trends, languages, methodologies and tools. And never — not once! — have I heard of the existence of EBSE. It should be just what we need, right?

    So I dove in. It's sad. Or pathetic. Both, actually.

    There's a moribund website on the subject:

    11 EBSE

    • It doesn't have a domain name, it's just hosted at some obscure university in the UK midlands.
    • The last "news" is from 2011. Not much happenin'…
    • All the "evidence" appears to come from published academic papers — you know, those things that practicing software people absolutely depend on.
    • "The core tool of the evidence-based paradigm is the Systematic Literature Review (SLR)…" The SLR is basically a meta-analysis of lots of published academic papers. Whoopee!
    • The whole thing is organized "using the knowledge areas defined by the SWEBOK."
    • I couldn't find a single useful thing in the whole pile of words.

    The "SWEBOK"??? Another thing I've never heard of. It turns out it's an official IEEE guide to the Software Engineering Body of Knowledge. This essential guide tells us everything that leading academics are convinced are must-knows, "generally accepted knowledge about software engineering." If only I had known! Think how much trouble I could have saved myself and others over the years! Best of all, it's practically up-to-date — just over 12 years old!

    EBSE and SWEBOK are great demonstrations of just how bad things are in the software field: even when you start with a great metaphor, you still make no progress if you continue to accept as gospel the broken assumptions that the field's academics take to be eternal TRUTH. The sad fact is, math and computer science are at fundamental odds with effective software development. As I've shown. Sad, but true.

    Having something like evidence-based medicine for software instead of the ugly, ineffective chaos we have today would be nice. EBSE is a nice name, but as a reality, a non-starter.

  • Software Management and Relationships

    The worldly and wise among us repeat without end: relationships and getting along are everything in the world of work. I grudgingly admit that they are sort of right. But I also insist that groups of highly technical people with highly technical jobs, like programmers, outshine the competition by 10X or more by following a different set of rules.

    Yes, relationships are important. But high-performing software people build real relationships based on the common substance on which they work — software — rather than interpersonal junk.

    Sick Sheep in England

    This isn't just about software. It's about knowledge and substance vs. interpersonal relationships. There's a section of Thomas Hardy's novel Far From the Madding Crowd which illustrates the point nicely.

    Bathsheba has inherited a farm, and she knows little about farming. She is totally focused on her changed circumstances and her status relationships with the people around her. Because of his own troubles, a neighbor named Gabriel Oak has been working for her. Gabriel has deep knowledge of sheep. Bathsheba disapproves of the way he relates to her, and dismisses him. Then her sheep break through a fence and start eating young clover, which makes them very sick. They start to die.

    Hardy sick sheep

    Her men tell her that only Gabriel knows how to pierce their stomachs and cure them, but she refuses to ask for his help. Then another sheep dies, and she asks him to come. He refuses until asked "properly," with respect. She asks, he comes, he operates on all the sheep. The day is saved.

    Hardy people

    Bathsheba has learned the important lesson that — substance and knowledge matter! — and so asks him back and he accepts, now that his technical skill is respected, and front-and-center.

    Sick Sheep in Software

    I have seen far too many situations in software groups run by Bathshebas who have yet to go through a dying-sheep episode. I have also seen far, far too many situations in software groups in which software sheep are dying by the day … and the Bathsheba in charge simply refuses to change her or his attitudes and reconcile with the equivalent of Gabriel Oak.

    Conclusion

    Do you want to win an award for most congenial software group? Or do you want to have a software group that bonds over the work it's doing, and hits it out of the park? This isn't a binary choice, but you definitely do have to decide your priorities. If someone is marginally productive and starts getting nasty, it's time for them to go. If someone is a great producer, you find ways to make the nerd happy and fulfilled as well. By doing great work. This is a tough subject and an important one. For more, see this. For lots more on software people, see this.

  • Devil’s Dictionary for 21st Century Computing 2

    Another in the series introduced here.

    Ambrose Bierce

    A couple definitions from his book:

    Telephone

    Telescope

    Stan Kelly-Bootle

    Mr. Kelly-Bootle sometimes provided extended explanations of the words he defined:

      Algo

    Algo 2

    Definitions for 21st Century Computing

    A couple more from the student:

    Cognitive Computing

    A totally, absolutely brand-new approach to making computers that are really smart. Cognitive computing is already a success primarily because it has NOTHING whatsoever to do with certain lame technologies that have a decades-long, proven track record of achieving perpetually imminent success. Cognitive computing is primarily backed by a giant company whose roots go back to the technology that popularized the term “hanging chads,” whose TLA name is alphabetically adjacent to HAL, the star of movie set in 2001.

    Machine Learning

    The term for a growing collection of dozens of techniques that have been developed in the continuing quest to teach machines enough so that they can score better than they do on the college entrance exams. Until the quest for effective machine learning yields better results, machines will continue to be relegated to second-class status among the company of educated things.

    The advocates of machine learning are known to be a fiercely contentious lot, each asserting that its own approach is superior to all others, and that any evidence adduced to the contrary is propaganda, fake news of the worst sort, stemming from jealous advocates of inferior approaches. The closest approximation to the internecine warfare of the machine learning field is the human learning field, in which advocates of public, government-run and union-staffed schools exchange harsh words with advocates of charter schools, with a level of invective and passion that indicates that someone is strongly in favor of hopelessly uneducated machines and/or humans.

    Conclusion

    I apologize in advance: there could be more to come.

  • Devil’s Dictionary for 21st Century Computing

    Ambrose Bierce wrote the Devil’s Dictionary in 1910, delighting and edifying cynics everywhere. Stan Kelly-Bootle wrote a new version for the world of computing called the Devil’s DP Dictionary in 1981, and a later edition in 1995 called the Computer ContraDictionary. These are timeless works, providing valuable insight and inspiration for cynics to this day. But there are modern computing terms that came into use after these geniuses had passed onto their reward. It’s time for at least a first draft of a Computer Cynic’s Dictionary for the 21st Century.

    Ambrose Bierce

    Mr. Bierce started publishing definitions many years before the first book appeared. Here is the start of a column from 1881:

    Devil

    You can see that from the very start, Mr. Bierce had the ability to get at the heart of things using few words.

    Stan Kelly-Bootle

    Ambrose Bierce was clearly a tough act to follow, but the new computer technology was such rich soil that Mr. Kelly-Bootle felt that an attempt had to be made. And a heroic attempt it was, providing insight and edification all these years later. The following couple of simple definitions get right to the point:

    Stan

    In other definitions, he gets a bit more cutting:

    CS

    Cynicism in the 21st Century

    Many new terms have entered the world of computing since Mr. Kelly-Bootle last graced us with his wisdom. Reasonable people may ask, "is cynicism dead?" "Will such juicy targets remain unskewered?"

    I have searched high and (especially) low, and found nothing but piles of dry computer-babble, peppered with ignorance and misinformation. I have yet to find a good source of penetrating definitions for any the terms being thrown wildly about in today's discourse. I feel I have no choice but to offer some of my own definitions, sad exemplars of the type though they be, in hope of challenging those with the true, deep knowledge of a Bierce or Bootle to counter with their own superior definitions.

    Here is the first installment. Should I somehow avoid assassination, more will follow in future posts.

    Big Data

    A subject of which no self-respecting executive may claim ignorance; an expensive, ever-growing collection of hardware and software managed by people who spout a dizzying array of acronyms with confidence and certainty, with mounting expenses and benefits that are just about to be realized.

    A collection of data, presumed to be large but normally fitting in a backpack with room to spare, which is said to contain untold riches if only they can be found and unlocked with mysterious keys like Hadoop.

    An approach to analyzing incredibly huuuuge collections of data that has been recently invented, bearing no resemblance whatsoever to outdated technologies such as data warehousing and business intelligence, and sharing none of their drawbacks.

    Artificial Intelligence

    A kind of intelligence, sometimes implemented by computers, which would be decisively rejected by all right-thinking people if it were food. It is the opposite of organic, free-range, unprocessed intelligence – it is chock-full of GMO’s, fructose and artificial ingredients of many kinds.

    The growing crisis of insufficient intelligence is being addressed by some leading scientists, who are leading the way in the creation of artificial intelligence to fill in the gaps left by inadequate supplies of naturally-occurring intelligence. Like the green revolution in agriculture, many hope that this emerging “grey revolution” will put a stop to the persistent intelligence shortages that make so many miserable. While some elites sneer that artificial, non-organic intelligence is deeply harmful, most of the deprived are glad to be served intelligence of any kind, however artificial it may be, rather than their current meager diets containing precious little intelligence of any kind.

    A purposely vague term, referring to an ever-growing set of tools and techniques, that are said to do stuff that people usually do, only better. AI programs have advanced from early victories in playing checkers to wins against chess masters. They have finally achieved the pinnacle of human intelligence, winning the game show Jeopardy. After decades of marching from success to success, today's leaders of Artificial Intelligence anticipate that practical applications of the technology are certain to emerge. If not, they threaten to further inflate the definition of Artificial Intelligence to encompass normal computer programs written by ordinary human beings, at which point success will be theirs — since a computer program is, without doubt, artificial.

    Conclusion

    I expect to release more definitions in the course of this year.

  • Use Advanced Software Methods to Speed Drug Discovery

    Drug discovery is like the worst imaginable, old-style software development process, guaranteed to take forever, cost endless amounts of money, and far under-achieve its potential. There are methods that the most advanced software people use to build effective software that works in the real world, quickly and inexpensively. These small groups invent all the new things in software, and then get bought by the big companies.

    Can these fast, agile, effective methods be applied to invent and test new, life-saving drugs and get them to the patients who are dying without them? Yes. The obstacles are the usual ones: the giant regulatory bureaucracies and the incumbents who would be disrupted. Yes, the very people who claim to keep you healthy and cure your ills are the very ones standing between us and speedy drug discovery.

    Drug Discovery and Software

    While I'm not an expert in drug discovery, I've learned more than I wish to know about the regulations through the software providers to the industry. And like many other people, I've learned from being a patient with a disease that could be addressed by drugs that I am not allowed to take, because they are deep in the labyrinth of the years-long approval process.

    I've explained elsewhere how a revolution in medical device innovation could be enabled by transforming the applicable regulations from complex, old-style software prescriptions to simple, goal-oriented ones.

    A similar concept can be applied to the process of drug discovery itself.

    Old-style Software is Like the FDA's New Drug Regulations

    The classic software development process is a long, expensive agony. It's an agony that sometimes ends in failure, and sometimes ends in disaster. It most resembles carefully constructing Frankenstein's monster. It starts with requirements and goes on to various levels of design, planning and estimation. Finally the build takes place. But wait — we can't "release" the software until we know that its quality is top-notch. And that it meets all the requirements. It's gotta work! So let's make absolutely sure that it's up to snuff before inflicting it on the innocent users. Here are details.

    Yes, those innocent users — who are, by the way, chomping at the bit to get at the long-awaited new software whose requirements they signed off on years ago, and that they actually need to get their jobs done.

    So is software development like drug discovery? Let's see.

    • Development that's a long, expensive agony. Check.
    • Don't release it until its adequacy is PROVEN. Check.
    • People who are just dying to use it. Check.

    But here's the difference: for software, usually one company both builds it and decides whether and when to release it. That means the business leaders of the company can balance the tension between adequacy and getting it out there. In the case of drugs, it is adversarial: the FDA declares how each step of drug discovery and testing has to be done, and has armies of people to impose its will on the companies that do the work.

    The FDA Nightmare

    The FDA nightmare has two main parts.

    The first nightmare assures that development and testing is performed in what is claimed to be the "safest" way possible — it's all about protecting patient health! In fact, this means incredibly slow and incredibly expensive. The overhead is far more burdensome than the work itself, which really tells you something. There is a multi-billion company, Documentum, that got started with and still is the leading provider of software to the pharmaceutical industry for handling the documents required by the FDA. Right away, this expense and overhead burden assures that no group of brilliant people will create a start-up and create a new cure for a disease.

    The second nightmare is that the process is incredibly high risk. The FDA can kill your new drug at any time, including near the end, after all the time and money is gone. This again reduces the number of groups performing new drug development to a tiny number of rich, giant, risk-averse corporations.

    This is like big-corporate software development — only far worse.

    Wartime Methods for Drug Discovery

    I've written a lot about wartime software development. A good way to understand it is to look at bridges in peace and war. In wartime, we build effective bridges while under fire in a tiny fraction of the time needed in peace. And the bridges work.

    The methods translate well to software. They are practical. They work. They are in regular use by groups that are driven to innovate and get stuff done. There are details in my book on the subject, with lots of examples and supporting material in my other books.

    It's very clear that the methods also apply to the FDA's regulation of software. Here is an example. There is no reason other than the usual obstacles to innovation that the principles couldn't be applied to drug discovery in general.

    Wartime Drug Development

    What we should try is Wartime Software Development morphed into Wartime Drug Development. Here are the principles:

    • Grow the baby.

    Instead of going through a whole long process and supposedly coming out with perfection at the end, you start with something that sort of works, try it (on volunteers), see how it goes, make changes and iterate.

    • Principles of e-commerce and social media

    When you think of buying a product, do you just walk into a store and trust the salesperson? If so, you're probably in your 100's and hope to get a computer someday. Everyone else goes on-line, checks reviews, and above all checks comments from real users. The sheer number of comments tells you how popular something is. Of course, you don't blindly believe everyone, and of course you translate what people say to your own situation. There could be awful risks and side effects, but if it sometimes works and your alternative is misery shortly followed by death, you might decide it's worth the risk.

    It's a decision that should be in your hands, informed by full sharing and disclosure, not decided on your behalf by a bunch of bureaucrats sitting in offices.

    • Open source and full disclosure.

    Of the top million servers on the internet, over 95% run linux, an open source operating system. Linux was created by an interesting nerd, and developed by an evolving band of distributed volunteers. It is superior to any commercial operating system. And operating systems are complex; linux contains more than 12 million lines of code! Why shouldn't we make drug discovery open to a similar process? With open source, everything about a drug and its results so far would be open and available for anyone, including patients, to see. Patients and researchers would all be active participants in the open discussions.

    • Continuous release

    The most advanced sites first bring up their software in extremely limited, volunteer-only releases. Everything is tracked. If things go well, more people can be invited in. Incredible tracking, lots of feedback, explicit and implicit. As software goes into wider release, a new version of it may be made available to a combination of new and existing users. Its use may be expanded, or it may be withdrawn. The process is continuous and iterative. It's called continuous improvement. We use it in lots of domains, ever since its use was formalized by W Edwards Deming in car manufacturing. It's not exactly weird or marginal. We simply refuse to apply its proven principles to drug discovery.

    Conclusion

    The FDA says its mission is to keep us safe. The gigantic bureaucratic monolith in practice assures that new drug development is performed by a tiny number of elite corporations at great expense, and rarely. Let's at least try a better way of doing things!

  • The Science of Innovation Success

    Most of what you read about how to innovate and how to achieve success as an entrepreneur is irrelevant at best, and a cargo cult at worst. The real success patterns are not well known. They work. If you want to be seen by the world as doing the right thing, keep doing what "everyone" says you should do. But if you want to … win … you may want to consider learning from the patterns that actually work.

    Patterns that work in health and fitness

    Let's look at a clear winning pattern in health and see if it can be applied to learning how to innovate. (Hint: it can't.)

    Sometimes you're struck down by an illness that no action of yours could have prevented. HOWEVER, there are proven patterns of behavior that greatly improve your health and resistance to disease, and related patterns that clearly result in your being able to run faster, jump higher and lift more weight. While the specific advice to achieve these things varies, the principles as understood by mainstream experts are largely valid.

    It's pretty simple: eat a variety of mostly un-pre-packaged foods with a minimum of additives and things like fructose, and balance exercise and eating so that you maintain a moderate weight for your body type. For fitness, it's exercise and practice.

    In addition to these common-sense patterns, there other things people do that make sense. If you see someone who has achieved what you want to achieve in terms of health and fitness, it makes sense to find out how they did it and emulate their actions. In addition, it's broadly known that motivation is a key factor, along with attitude and consistent behavior.

    In other words, study what the fit, healthy people do, and do it yourself. Pretty simple, at least in concept.

    Applying the Observe-and-Emulate Pattern to Innovation

    Most things you learn or achieve, you are doing again or for yourself something that has already been done, typically by millions of people. That's what education is all about, for example. When you get educated, you are walking down a well-trod road. What about science education? Same thing. You have to learn the facts, the concepts, the math.

    What about innovation? Is it just another thing you can get educated in and learn from the teachers, who learn from the experts? No! Innovation is different. Innovation is some combination of creation, discovery and adapting. It's being the first. It's creating something that wasn't there before. It's taking something that worked in a particular time and place, and making the substantial changes required to work in entirely new circumstances.

    Imagine taking a course in exploring new lands in Europe in 1480. Who were the experts? What did they teach? Who could you study and emulate? Of course, there were lots of self-styled, widely revered "experts" who knew all about it. Sure. Columbus had to do it without any help that was actually, you know, helpful!

    Innovation is not like health, fitness and most everything else. It's different.

    Winning Innovation Patterns

    I truly hope someone will figure out if there are winning patterns for innovation and make a science out of it. Until then, from years of observation of people trying hard to innovate, I've noticed a couple of things.

    • Pattern: Expert-phobia

    Successful innovators ignore the experts. They ignore (1) the experts in their field of innovation, and they ignore (2) experts on innovation itself.

    Sometimes experts in a given field, even widely-acknowledges ones, are actually good. While the vast majority simply assert and defend the common view, sometimes an unusual expert will innovate or be helpful to an innovator. But this is the exception. The invention of powered flight is a great example of what usually happens; how the "expert" approach never got off the ground, and the hard-working unknowns made the key innovations. Here's my description.

    Successful innovators just don't have time to waste on people who claim to be experts in "innovation" itself. They know that real knowledge is all that matters.

    With all the noise about "innovation" in the air, it may seem to make sense to dive in to the "innovation" pond. I've noticed that the people who actually end up innovating with success don't go there. They've got better things to do. If they largely ignore experts in their field, why would they pay attention to experts in generic innovation?

    • Pattern: Dive Deep, be the Best

    The people who create innovations that work started by diving real deep into some particular area of experience or knowledge. They became real-life, on-the-ground, go-to experts in something. Not famous. Not writing books and giving talks. Just knowing more and accomplishing more in some narrow area of activity.

    Knowing as much as they do, they stick their heads about water, and get dissatisfied. They see waste; or stupidity; or something that could be better or be done better. They set out to do it, from the basis of being the best at the status quo. They know how things should be done. They start by wondering how things could be done.

    • Pattern: Ignore the Big Picture, Focus on the Little Picture

    Most people who get known as experts spend most of their energy sharing their wisdom and broadening their knowledge. They don't innovate.

    The successful innovators can be remarkably clueless about the "big picture." Not their problem. They are absorbed with the day-to-day, with what confronts them in the here-and-now. They tend to be do-ers who can think, not thinkers who pretend they could do if they really wanted to.

    Often, the problems that inspire innovators are "trivial," from the big-picture point of view. It is just those problems that inspire practical, real-life innovation. Here's a description of "little picture" innovation, and here's an example of "little data" innovation.

    • Pattern: Innovate as Little as Possible

    Innovators like to innovate. They think of themselves as creative people. They love to solve knotty problems. This is the main problem of many creative people who fail to innovate with success. They can't stop!

    People who innovate successfully innovate something that matters. Then they stop innovating, and do what they need to do to make their innovation work in the real world. They reduce their risk. They stick with proven things. Because they want their innovation to work!

    • Pattern: Solve Real Problems of Real People

    Everyone knows that medical records have to go digital. They've know it for a long time. There were and are loads of experts and industry committees piously pontificating about the best way to do it.

    Then a programmer — yes, a real, live software engineer — went into the records room of a medical practice and learned how to do the job from the people who were already doing it. He did the work, not just for a couple hours, but for days on end. Long enough to see all the issues. Long enough to get bored, get annoyed, get ideas and get motivated to automate stuff.

    He didn't make a plan. He didn't create a strategy. He didn't run some ideas past some people. He wrote some code. Code that would make his life in the filing room better. He tried it out. He wrote more code. The people who really worked there asked if they could use it when he wasn't there — because it would make their jobs easier. What a concept! The code became Athena Health's highly successful clinical records management product — a rare example of innovation taking place inside an already-successful company.

    • Pattern: Apply Step Theory

    Successful innovators don't tend to have carefully-thought-out strategic plans. They don't lay careful foundations. They don't create detailed plans that account for a wide range of contingencies. They know that if they don't get through today, there will be no tomorrow. They know that there may end up being 1,000 steps in their journey, but they also know that if they fail on step 1, they have failed. So step 1 is the ONLY step that matters.

    This is "step theory." For more details and examples, see my book.

    • Pattern: Ignore Fashion, Except for Scale-up Marketing

    It's rare that people who jump on one of the fancy new bandwagons accomplish much of real value. In fact, most of the fancy new bandwagons are little but fancy new names for things that have been around, while others are fads that will fade out. Big Data? Old news. Machine learning? Been around. Blockchain? Great for Bitcoin, not much else.

    Nonetheless, to the extent that the fashionable thing happens to be applicable to a narrow, real-world problem and smart, go-deep people focus on real problems and solve them with urgency, innovation can result. Then, as the innovation starts to get traction, it makes perfect sense to embrace the fashion. Why not? If that's what it takes to get people to pay attention to you, you do it.

    Conclusion

    Here are a few examples of real-life innovation that I'm associated with. Here is a whole book of innovation stories, taken from real life and personal experience. I hope that these patterns of successful innovation will be further explored and help inspire future innovators.

  • Russia Hacks DNC, Podesta Email: Fake News

    The US government has declared that the Russian government has hacked important US entities. It has retaliated against the Russian government in response. It has now issued its official report providing the evidence of hacking. 

    The "evidence" is a joke. It proves nothing but the incompetence and/or duplicity of the agencies that issued it. The near-certain declaration that the Russian government was behind this and related hacks is fake news. The majority of the US press echos the fake news, supporting it with whatever is left of their credibility.

    Cybersecurity background

    Most large organizations have a big computer security problem. They just don't know how to get it done and don't seem to care, as repeated massive breaches have demonstrated. Government agencies are just as helpless. They issue regulations that tell corporations how to achieve security, but the regulations make things worse, and are ineffective for the government itself. There are solutions, but no one is interested.

    The Hacks

    The overall results of the hacks are well-known. In July, Wikileaks released 44,053 emails from officials of the DNC. In October, it released a large batch of Hillary Clinton campaign director John Podesta's email. Many important people immediately accused the Russians of performing the hack and providing the documents to Wikileaks.

    The Official Evidence

    The government's long-awaited official report of evidence that the Russians performed the hack was released last week by this government agency:

    US-CERT

    Here is how the report is described:

    US-CERT 1

    The report is 13 pages long, with a couple of linked files. The first thing that struck me was that, starting on page 5 and going to the end, the content had literally nothing to do with hacks or Russians — it was just a list of generic nostrums about how to be cyber-secure. One has to wonder where all this supposed powerful wisdom was while the US government Office of Personnel Management (OPM) hack took place; this hack resulted in the loss of highly sensitive data on over 22 million people. People who live in glass houses…

    What about the "evidence" contained on the first few pages?

    I have personally dealt with computers for a long time. I've had to fix serious problems, evaluate reports of problems and recommend solutions. There is a clear pattern of good work:

    • The person and group that did the work is clearly identified.
    • There is some kind of narrative that describes the problem and the path of discovery that leads to the conclusion.
    • Full details about the computers and software affected are provided. Is it a personal computer or a server? What version of what operating system is installed? If an application is relevant, what is the name and version of the application?
    • Full details about event data are provided, for example log files.
    • If there are anomalies, full details about them, included where and how they were found.
    • Enough data is provided so you can double-check any conclusions that may be drawn.
    • If more than one event is involved, this information is provided for each event, with all the information for example servers and operating systems clearly associated with the corresponding event.

    None of this standard information was provided in the report!  Any conclusions that are drawn, given the total lack of real, professional evidence, are therefore baseless.

    Details of the non-evidence

    The report provides no separate information about the DNC or Podesta hacks. It says nothing about whether an email server was hacked or a client. Nothing! What the report does have is a little information with generic diagrams, a very techie listing of part of a script, and a list of IP addresses. The contents of what they provided has been competently analyzed by a security firm. Here is their summary:

    Wordfence

    Let's look at the Podesta hack for a bit.

    I looked at a broad sample of the emails on Wikileaks. Podesta had a gmail account, john.podesta@gmail.com. While some of the emails were sent to another address, podesta@law.georgetown.edu, a quick look at the source of the emails (kindly provided by Wikileaks) shows that this was set up as a forwarding address, i.e., automatically forwarded to the gmail account. The source code I examined was all typical, i.e., not faked.

    No one claims Google was hacked. So it was Podesta's email account and/or the computer he used to access it. The report, of course, doesn't say. The hack could have been accomplished by any number of techniques, and certainly doesn't require sophistication.

    The list of IP addresses given is completely irrelevant for this kind of hack. If the hackers got his user name and password, all they needed to do was log in — no "attack vectors" required.

    Turning to the DNC, the report implies (but doesn't state) that the DNC server was attacked. It talks about how the hacker:

    Escalationwhich is quite impressive. How exactly did the malware "escalate privileges?" That's like saying that a lieutenant in the army suddenly became a general! By making it happen himself! It's only possible if there's a bug in the system that was hacked. Was it Microsoft Exchange? What's the bug? We'd like to know!

    Going into this made me more suspicious, because the Wikileaks site lists exactly 7 senior officials whose emails were hacked. Here's what they say:

    DNC

    All that's needed to accomplish this is a bent insider, like a junior Edward Snowden, or some good social engineering. In other words, more of the same that worked on Podesta. Otherwise, why would the hack be limited to exactly those 7 and no more?

    In other words, an examination of what was hacked leads to the strong suspicion that the "evidence" provided by the government has nothing to do with how the hacking was actually accomplished, or by whom.

    Conclusion

    Cyber-security is incredibly important. I don't care one way or the other that the DNC and Podesta were hacked. Shame on them for not caring about security when the world is full of bad guys. But I do care that many of our most important institutions such as our government and healthcare institutions fail to take it seriously, and when they do, are incapable of getting the job done. It hurts many of us, and someday could hurt us really badly.

  • My Cat Taught me about the state of Healthcare Provider Data

    My daughter's cat taught me a major lesson about healthcare as I described here. Pretty amazing. But Jack the cat also thought I should learn about the advanced databases that providers and insurers maintain about each other. While not as brilliant as the inter-provider EMR interchange breakthrough I've described, the databases have a similar effect to the brilliant gamification strategies for wellness implemented by leading hospitals, but take a whole different approach. The depth and extent of innovation in this industry never fails to amaze me.

    Jack's learning environment

    As I described before, the terrified cat was outdoors and I had to pick him up to bring him inside. He was scared, so he scratched and bit me. I saw my doctor and got a mis-prescription for antibiotics. Then I needed an X-ray to see what was going on inside the hand that was painful after weeks. That's the situation.

    Jack the cat decided this was an opportunity for me to learn about databases and get some extra exercise, no doubt as penance for failing to pet him well or often enough.

    The search for the X-ray provider

    First, I got a referral to a provider that was way far away from where I live. How did this happen? The doctor claims she called me to find where I live twice and got no answer. Hmmm. I guess the information was mysteriously missing from my records and no one thought it was important to get it, and I guess the fact that I only got one message, and it had no request for where I live was just … whatever. So I decided I better get active, rather than waiting another couple of days for a referral.

    I went onto the Anthem site — the provider of my health insurance in spite of their horrible computer security track record. I discovered a provider that is covered by them just a couple blocks from where I live:

    X-ray

    That should be an easy walk. After more fumbling with the doctor's office, I finally got them to give me a referral.

    Here's the place to which I was referred:

    XX

    Same place. Good. I called them up, and they said no appointments were required, just show up with the referral. I walked right over, but they weren't in the building directory. Hmmm. I asked the person at the desk, who had clearly seen confused and lost people like me before. She told me they've moved, and gave me the new location. Great!

    I went back home, and discovered that someone else at my doctor's office had also given me a referral, only to a place that actually has an X-ray machine. So out I walked again, and got my medicinal dose of radiation.

    Anthem didn't know that they'd moved. The people on the phone at the X-ray place had no idea. One person at my doctor's office did know — but another one didn't. In normal life, companies that acted like these did — my doctor, the X-ray place and the insurer — would be out of business. But as we all know, healthcare isn't normal life.

    Big Data and Blockchain

    What happened with me was no big deal. Business as usual in healthcare, and in this case had no consequences beyond getting me to walk more, which is a good thing whether I decide to do it or I'm tricked into doing it.

    But let's consider the consequences of this trivial episode.

    Where are the Big Minds, the elite in healthcare, spending their oh-so-valuable time and effort? Lots of things, of course, but two of the big obsessions are Big Data and Blockchain. Each of these, for different reasons, is a holy grail of technology for healthcare, if you pay attention to the talks, conferences, articles and real dollars invested.

    Big Data is a focus because the leading thinkers and influential, powerful people are convinced that if all this healthcare data is poured into a giant Hadoop data lake and poured over by ultra-modern machine learning tools, we'll discover important things that will make us all healthier.

    We already knew that EMR's are riddled with data problems; now Jack has shed light on problems elsewhere:

    • If the data is missing or wrong, no amount of bathing in Data Lakes will cause accurate results to pop out. Bad data in, bad results out.
    • If there are protocols that have been proven to be the best for treating patients and doctors simply refuse to follow them, nothing improves.

    Blockchain has attracted the attention of leading figures among the healthcare elites because of its awesome promise to solve the problem of data interchange and effortlessly created universal health data — on which Big Data can proceed to work its magic.

    BUT … if no ones cares or is allowed the time to get the data accurate and complete and the data is no good, spreading it around hardly helps anything.

    As usual, all the attention goes to the highly visible frosting on the cake, while the underlying layers of the cake rot from inattention.

    The consequences of extraordinary cat knowledge

    This valuable knowledge about provider databases and the reliability of doctor decision making came from just a couple days of cat-sitting our daughter's cat. The experience was so rich that we decided to get a cat of our own, Priss:

    2016-11-27 14.37.03 - Copy

    We eagerly await the medical knowledge that Priss will bring our way!

  • What can Cats Teach us about Healthcare?

    If you had asked me what cats can teach me about healthcare a year ago, I would have answered, probably nothing. Well, live and learn. My daughter's cat has just taught me a couple major lessons about healthcare. Who would have thought cat-sitting could lead to valuable knowledge about how doctors prescribe drugs?

    Here's Jack:

    2012 04 26 Jack

    Jack is a good cat. He knows how to relax, and is definitely not anxious about things:

    2012 07 13 Jack 003

    Jack is a rescue cat. Something bad involving men wearing boots must have happened to him in his early days, because he gets really scared and is desperate to get away from any man wearing boots.

    Jack sets up the learning environment

    A few weeks ago we were cat-sitting him. He had been outside for too long; workers came onto our property to work on an extended project. It was getting dark. Jack wasn't responding to the usual "come home" inducements. I spotted him hunched down in a hiding spot intensely watching the workers. I went to him. He was too scared to follow me home, since that would bring him out of his hiding place and closer to the scary men. So I picked him up. He got really scared. He scratched and bit my hand pretty well. I managed to hold onto him and get him into the house. Now that he was safe, he was OK, and I just had to treat my badly hurt and bleeding hand, which I did with a thorough wash and bandaging.

    First Lesson: Doctors, prescribing and protocols

    By the next day my hand had swollen up pretty badly. I got an appointment with my primary care doctor. I provided all the details. She put in an order for antibiotics in case the swelling and redness continued. It did, and I filled the order. I took it as directed, and after 5 days there was still lots of pain and swelling. So she gave me a different kind of antibiotic, which was supposed to cover the kinds of things the first one doesn't.

    After a couple days, things weren't improving by much. Here's my hand at that point — notice the lack of knuckles showing how swollen it still was:

    Hand

    My daughter, who's an MD, had been following the events and asked to see my medications. She then sent me information that made it clear that my doctor had given me the wrong antibiotic! Just as bad, the doctor had advised a wait and see approach, while the literature clearly shows that the right approach is to give the drug right away. I gave this information to my doctor; the only appropriate reaction would have been embarrassment and apology, and that is not what happened.

    Finally, I wondered what if you didn't have an amazing daughter who happened to be an MD with access to the literature? This makes it even worse for my doctor: Dr. Google came up with the right answer — the answer to the question MY doctor got wrong. And wouldn't admit it.

    I've had an incurable form of cancer. As my cancer doctor said, I've won the lottery, and I'm OK for now. That was hard. The cat bite was easy. There's no excuse for failing to learn the right approach if you don't already know it and following the approved protocol. My trust in doctors other than my daughter for doing simple things is now below zero.

    Details of the first lesson

    The points been made. If you are skeptical or want details, here we go:

    First prescription:

    22 Bac

    Second prescription:

    22 kef

    The article on UptoDate (a resource used by doctors to make sure they're up to date) recommending Augmentum (commercial name of a combination of amoxicillin and calvulanate):

    33 up to date

    The part of the article on prophylaxis:

    22 proph

    I gave the information to my doctor. Here is the key part of her response:

    111 doc

    In other words, she decided to violate the authoritative protocol because of "anecdotes." Not because there's an emerging body of evidence-based thought. Anecdotes.

    Here's what I should have done before accepting her treatment. I should have asked Dr. Google. Here's the question:

    11 aa

    The first result is Google's attempt at giving the answer:

    11 bb

    Prophylactic Augmentin. How about that? But the article's 10 years old. Let's check the first "regular" result:

    11 cc

    Same thing. Respectable source. But undated. Check the next result:

    11 dd
    Just two years old, in a real medical journal, same advice. We're done here.

    Conclusion

    Too many doctors just do the wrong thing. Even when they know it's the wrong thing, they do it anyway! Doctors increasingly complain about having everyone second-guess them and look over their shoulders. Well, guess what: when you screw up, you deserve that and more.

    I've long since preferred to get my cash from an ATM rather than a teller. I'm now at the point where, for anything that's at all routine, I will strongly prefer an automated medical knowledge agent to a doctor who can't be bothered to do the right thing. Until that's available, I will just have to endure doctors not liking me because I check each and every thing they do to make sure it's the right thing.

    The best thing is — Jack the cat wasn't done! I'll tell the next important thing he taught me in a post soon to come.

  • Regulations that Enable Innovation

    Regulations that enable innovation? How can that be?? Don't regulations inhibit or even prevent innovation?

    Yes they do. Wouldn't it be nice if there were a way to write regulations that enabled innovation? Well, there is a way to do it! It's actually easier to write regulations that enable innovation than the usual way. There are fewer of them. They're easier to understand, and easier to keep up to date. They're more effective at regulating what you could reasonably want to regulate, while at the same time keeping the door open for inventive people to find better ways to get things done, while still conforming to the regulations.

    So why isn't this the standard way of writing regulations? Inertia. Lack of understanding. Fear. Bureaucratic intransigence. The usual reasons.

    Regulations that Enable Innovation

    Practically all regulations tell you, in varying levels of detail, tending to the excruciating, How you're supposed to do the regulated thing. The more detail, the less innovation.

    By sharp contrast, regulations that enable innovation tell you What you're supposed to do or avoid doing. The less said about how to reach the goal, the wider the door for innovation.

    Suppose the point of a regulation was to make sure you got to work on time.  Typical how-type regulations would tell you exactly when to leave your apartment and exactly what streets and avenues to walk until you got to the office. It would allow for red lights. The regulations would have to change to allow for construction and other changes. If you deviated from the prescribed route or used a different method of transportation, you'd be in violation.

    What-type regulations for the same thing are simple: dude, get to the office on time! How? You figure it out, it's your problem! But it's also your opportunity for learning and evolution. You could try walking, and try different routes. You could try the bus and subway. Taxi and Uber. Different ones under different circumstances. So long as you got to work on time, you'd meet the regulation!

    For more detail on What vs. How, see this.

    If this sounds crazy to you, you should realize that there is a whole, vast area of our legal system that works in just this way: the criminal law. See this for more.

    I wouldn't be advocating for change if how-type regulations worked. They usually don't get the job done. They prevent innovation. Worse, when you satisfy all the regulations, you're under the illusion that things are fine. Except that they're usually not. The ongoing cyber-security disasters we have experienced are prime examples of this.

    Cutting down the number of regulations

    Lots of people complain about regulations. Some people want to reduce their number. For good reason! Have a look at this to see the scale of regulations.

    I hope it's now clear that reducing the number of How-type regulations won't make a big difference. It may even make things worse. It's better to replace a whole pile of How-type regulations with a couple of simple, goal-oriented What-type regulations.

    An example of regulatory innovation prevention

    The rhetoric of regulations and licensing is that they protect us poor, innocent consumers from the awful products and services that would be inflicted on us in their absence. The reality is that they are a massive effort that increases the costs of everyone already providing a product or service, while putting up huge barriers to competition from fast, light-footed innovators who have figured out a better way to do things. Regulation, certification and licensing do almost nothing to protect consumers, but are remarkably effective incumbent protection programs.

    While this dynamic plays out in many industries, nowhere is it more harmful to our health and well-being as it is in healthcare.

    The FDA is supposed to protect our health. It's even what they say they do:

    FDA promoting health

    One of the many ways they do this is by heavily regulating the software that goes into all medically-related devices.

    The right way, the What-type way of regulating that software, would be like a criminal law:

    Your software has to perform all its intended functions in a timely and effective way, without error. When updates are made, no errors or other problems should be introduced.

    Now that's just a first draft. But I bet the final goal-oriented "regulation" wouldn't be too far from this.

    This simple regulation states what everyone really wants: the software should do what it's supposed to do. Period.

    The FDA does the opposite of simple and effective. It tells you exactly how you're supposed to develop software, and in gruesome detail. Here's the overview of the regulation:

    1a

    The sections are listed on the left. Each explodes into many sub-sections, some of which are further divided. Each one is long, detailed and brooks no variation (or innovation). On the right in the image above, you see just some of the bibliography, the many underlying documents you'd better get and understand if you're going to be in regulatory compliance.

    Here's a diagram that gives an overview of what is required:

    62304 fig 1

    Here are the section headings from the software planning part of the document:

    IEC 62304 requirements

    As this makes clear, you'd better not write a line of software until you've spent boatloads of time and effort in planning — exactly what people do when they build buildings using steel and poured concrete, but exactly the opposite of the iterative approach that is the standard among fast-paced, innovative organizations. I mean little upstarts with a high failure rate, like Google, for example.

    If the FDA were serious about their stated mission, "protecting and promoting your health," they would immediately blow up IEC 62304 and the who-knows-how-many-other mountains of how-type regulations they oh-so-lovingly promulgate and enforce, and replace them with simple goal-type, what-type "regulations." It would unleash a torrent of health-promoting innovation and open the lobbyist-loving incumbents to much-needed competition. To the benefit of nearly everyone, except a bunch of progress-preventing bureaucrats employed both by the government and by their corporate "homies."

    Conclusion

    We need regulations. The last thing any of us wants is for corporations to build crappy equipment that doesn't work or deliver services that deceive or hurt us. There are bad and incompetent people in the world, and without appropriate regulations that are vigorously enforced, we'd be worse off. And in extreme cases, dead when we could be thriving.

    Which is why it is so upsetting that major organizations like the FDA keeping waddling along, crowing about what a great job they're doing, when it's just not true.

    I wish it were just the FDA. Most major sectors of society that are supposed to be protected by regulations are instead hobbled by incumbent-protecting, innovation-killing, ineffective how-type regulations.

    The path to regulation that is both effective and enables innovation is clear. Let's do it!!!

  • Managing What you Can’t See

    How can you manage something you can't see? Simple: you can't.

    Can you see software? It depends. If you're a programmer, you can definitely see it — assuming you know the language. Can you see written human language? Only if you know the language. Yes, you can literally "see" it, but what difference does it make if the page with the language is completely meaningless to you? What if you couldn't read it, but couldn't even speak it — not just be unable to speak that language, but any language? You'd be in deep trouble, wouldn't you? Suppose you were a manager; would you be able to "manage" a bunch of writers, using the best management techniques taught at Harvard Business School? What a ridiculous thought!

    But that is exactly the situation that people who are unable to write or read computer programs in any language find themselves when called upon to "manage" programmers. Here's what's truly amazing: it doesn't seem to phase these genius MBA types at all! Of course I can manage programmers, they say — I can manage anything!

    There's something about software that brings out the inner stupid in managers who can't program. Here are some details and examples.

    There are innumerable consequences of attempting to manage something that is invisible to you. Here's a good illustration: 2 Dilbert finish times

    It's the classic problem of setting expectations. It's the reason why I assert that, in software, dates are evil.

    At the same time, I fully acknowledge that programmers, at least good ones are a different breed. It's such a big deal that I've written a whole book about it.

    Just to take a trivial illustration: take a look at the Dilbert cartoon again. Notice anything? Anything jump out at you? Well, something in that cartoon jumps out to programmers. Every Dilbert cartoon is on-line and accepts comments. Here is one of the comments written by a programmer, who clearly goes right to the heart of the matter: 2 2 Dilbert comment

    You think it's trivial? If so, I advise you to continue avoiding learning anything about programming. You won't make it if you try. And get some humility on the subject. Maybe you should try out some concepts that are actually appropriate for software, as opposed to jammed onto software because they're general management techniques that "work for everything." See this for more.

Links

Recent Posts

Categories