The Archives

Internet, Mobile, Security, Software, Technology
An Open Letter to Mobile Browser Developers
March 22nd, 2011 (10 months, 3 weeks ago) by Jeff | Permalink | 1 Core Dump

If you’ve been following my Twitter account at all, you’ve probably noticed by now that I’ve become an avid mobile device (i.e. smartphone) user, and a fan of Android in particular. This isn’t just a passing phase for me, nor is this a technology fad that’s just going to fade away. Mobile technology is really taking off, and I wouldn’t be surprised if a paradigm shift won’t occur—if it hasn’t already—where more people will be using smartphones and mobile devices to access the Internet and other online services than using a full desktop or laptop. There are other contenders vying to be our one-and-only window to the digital world, like set-top boxes, digital TVs, and such, but nothing is as personal and portable as the smartphone and its bigger brother, the tablet.

That said, I’m not in the camp that believes that the Web is dead and that mobile apps are the way of the future. I’ve expressed my feelings on that here before. Apps won’t and can’t be the end-all, be-all interface to data and the mobile Web will always have a place. Thus the mobile browser is one of the most important apps a smartphone can have. That said, most browsers on smartphones are anemic, underpowered, and severely lacking in important functionality. Smartphone manufacturers and OS authors want us to believe that we can leave the laptop behind and work entirely from that wondrous miracle in our pocket, but fail to deliver the tools we need to make that dream a reality.

My case in point: client-certificate authentication. As a very brief summary, the entire industry of e-commerce rests entirely on a set of encryption technologies such as HTTPS, SSL, TLS, etc., that allow secure, private communication between a client (such as an online shopper) and a server (an online store). The server authenticates itself to the client by using a digital certificate, signed by a trusted certificate authority which has investigated and authenticated the server as a legitimate entity. The client can rest assured that the server belongs to the authenticated entity because the certificate uses strong public-key cryptography to provide a chain of trust back to the authenticating authority. Without this technology in place, we wouldn’t be able to tell legitimate businesses such as online retailers and banks from the phishing scams so prevalent on the Web. (This doesn’t always solve problems between the keyboard and the chair, of course, but it is effective as long as the wetware interface is working properly.)

But digital certificates can be used to authenticate the client as well as the server. Many businesses and governments use client certificates to authenticate users to secure systems. For example, I use a government-issued Smart Card to authenticate with my client’s servers. On this card is chip that contains my digital certificate, signed by a private certificate authority. When I authenticate with the client’s services, the private key on the card creates a digital signature which the server can authenticate against my public key, the inverse of what happens between the online shopper and the store front. Thus, I can trust the validity of the government’s certificate and know I’m connecting to their servers and no one else, and they in turn can validate that I (or the person who has my card) am who I say I am and let me in. I use a similar technology with GPF, although I import my certificates directly into the browser rather than use an external card. I created my own private certificate authority and issue client certificates to each browser I wish to use to access my admin interfaces. That way, I know only certain machines can access those portions of the site, offering a lot more security than just a simple password can provide.

This isn’t a new technology. SSL has been around almost as long as the Web itself, and it wasn’t long before the model was flipped around to authenticate clients to servers as well as servers to clients. This is a tool used by businesses every day all over the world. Every desktop browser supports client certificates because they are a standard. Any browser that doesn’t support them is likely to be overlooked or ignored in favor of browsers that do.

Yet the support for client certificates on mobile devices is appallingly absent. I know the built-in Android browser doesn’t support it, and I created an issue in Google’s official Android issue tracker to complain about it. Android supports client certs for WiFi authentication, but not in the browser, e-mail, or any other key service vital to secure business communications. Supposedly support for this functionality is going to be added in future versions of Android, but that doesn’t help me or any of the millions of current Android users until it comes time to upgrade our devices. I’ve read in various places that the iPhone supports client certs, but I’ve never been able to get any of the solutions to work with my iPod Touch (essentially an iPhone minus the annoying contract and poor service of AT&T). The only success I’ve had in this area has been with Firefox Mobile, which is pretty much a Firefox 4 release candidate smooshed and crunched down to fit on a mobile device. It’s bloated and a lot slower than Android’s built in browser and there’s no handy UI for importing certs like there is on the desktop, but if you take a sledgehammer to it and do some manual file tweaking, you can import your client and CA certs into the certificate database and use it effectively.

Seriously, guys… you want your devices and mobile OSes to be taken seriously by businesses as tools to take our work out of the office and on the road. Yet, you don’t give us the essential tools required to take advantage of this amazing freedom. Sure, you tell us “there’s an app for that”, but frankly, there isn’t. I’ve looked, and they’re not there. Apple won’t let third-party browsers compete with Safari on iOS and none of the Android add-on browsers support client certs either. Only Firefox, a desktop browser masquerading as a mobile app, comes close, and it takes a bit of technical wizardry to do something that should be a quick five second import. Someone’s got to step up to the plate and make some progress here, or no business that really understands security is going to take the mobile space seriously.
Gadgets, GPF, Technology, Webcomics
Why there isn’t (and likely never will be) a GPF iPhone app
November 30th, 2009 (2 years, 2 months ago) by Jeff | Permalink | 3 Core Dumps

There’s an interesting trend in webcomics for a push onto mobile devices. I think it started with Clickwheel.com (which apparently no longer exists, hence no link), which tried to bring comics to the iPod by encoding them as short video files syndicated like a podcast. I thought this was an interesting idea, and I was even offered an opportunity to get into it on the ground flood, right when it started. However, I had a number of technical and rights management questions about the service and dragged my feet, eventually losing out on the deal and never following up on it. Given that the domain is now owned by a Norwegian ISP that apparently serves up malware, I’d say apathy may have been the right choice.

Nowadays the hot new distribution medium is to put an app on the (seemingly) ubiquitous iPhone (or its GSM-crippled sibling, the iPod Touch). Keenspot was the first place I remember seeing webcomic iPhone apps showing up, although I can’t say for certain that they started the trend. Since then, I’ve seen iPhone apps for various comics popping up here and there. The one I’ve been watching the closest has been Howard Tayler’s Schlock Mercenary (since Howard and I follow each other on Twitter and Facebook). It’s a curious trend to be certain, and it certainly has an element of “hipness” to it. After all, the iPhone is the “it” mobile device these days. And one thing every webcartoonist wants is more eyeballs reading their comics. Certainly it makes sense to go where those eyeballs are, to reach as many potential readers as possible.

Then a thought occurred to me: No one has really asked me why there’s no GPF iPhone app. Certainly it’s a valid question, and I’m even more surprised it hasn’t been brought up yet. I know a number of you out there use iPhones, as I’ve read your comments and seen your screen shots of the GPF site in the past. So I thought about this for a while and came up with a list of reasons why we don’t have an app, then decided to document those reasons here so I can point folks to one place so I won’t have to repeat myself. I thought about putting this in the GPF News, but since it’s more of an opinion piece than a news item, it probably belongs here instead. (There will probably be links from the FAQ eventually, if nothing else.)

The primary reason there is no dedicated GPF app for the iPhone will surely come as a shock to those out there who can’t get enough of their favorite beloved Apple device. I’ve never been one for great diplomacy or delicacy, so I’m afraid I can only be my blunt, bullish, blundering self. I really hate to say this, but it has to be said:

The iPhone isn’t the last word in mobile computing.

Now, before the fan boys start picking up your torches and pitchforks, let me elaborate. I have nothing against the iPhone. In fact, at one point, I seriously considered getting one. The GPF Year Nine story “iDilemma” is actually semi-autobiographical. (GPF Premium subscribers should check out the Author’s Notes for that story to see how it diverges from real life.) In the end, it all boiled down to economics, just as it did for Nick and Ki; it was less expensive for me to buy my current Treo 700p without subsidy than for me to break my contract with my current carrier, switch to AT&T, buy the iPhone plus another phone for my wife, and so on. While I passed on the device itself, several of my coworkers at my day job have iPhones, so I can pretty much get access to one to play with any time I wish. Thus I’m familiar enough with how it works and all the whiz-bang spiffiness it purports to have. I know a thing or two about what it does right, what it does wrong, and how it’s revolutionized the mobile computing or “smartphone” industry.

That said, the iPhone’s 30+ million units pales in comparison to the number of BlackBerry devices in circulation. The iPhone represents one device, one platform, on one network. BlackBerries are available in many form factors from almost every wireless carrier. On top of that, Android is a rapidly-growing platform; while it hasn’t yet matched the numbers of the iPhone, like the BlackBerry it comes in many flavors from many manufacturers and can be found on almost every network. It won’t be long before Android phones overtake iPhones in number by mere aggregation of disparate devices. And while some folks dismiss Palm as a has-been in the market, the Pre and the Pixi are selling modestly and may represent a comeback for the company. (Don’t forget the many of us who, ahem, still use good ol’ Palm OS, myself included, despite its age.) No matter how much we’d all wish it just went away, Windows Mobile still exists and people are still suckered into buying phones with it installed. And all of this ignores the biggest player of all in the field: Symbian, which runs about half of all mobile phones in the world.

Right there, I’ve listed off seven mobile platforms, including the iPhone. To pick one would severely limit the potential to reach new customers. To pick one with such a small market share (~14% as of Q2 2009) would be even more limiting. If my goal were to reach as many eyeballs as possible, why would I focus on one tiny segment of the market, simply because it’s the one everyone is talking about at the moment? After all, everyone might be talking about something else in a couple months.

Of course, this plethora of platforms opens up another can of worms. My goal with GPF has always been to be as accessible as possible to as many people as possible. Although the comic is (currently) confined to the English speaking world, it is available to just about anyone with a Web browser. I carefully designed the site to be as cross-browser compatible as possible, sometimes even sticking with older technologies longer than I should so the site will keep working in older browsers. If nothing else, it degrades gracefully and is still functional if you don’t have something top of the line. For that matter, thanks t0 our Oh No Robot transcriptions, you can even read 95+% of the archives with a text browser! That also means screen readers for the visually impaired can be used to enjoy the strip. It’s not ideal, of course, but it’s functional, and it’s helped us garner fans in ways you might not expect.

So if I’m not going limit myself by building a specialized app for one mobile platform, does that mean I’m going to end up making applications for all mobile platforms? No, that too is an exercise in futility. Every mobile platform has its own SDK with its own quirks. The iPhone and webOS use HTML/CSS/JavaScript, Android uses its own version of Java, and BlackBerry, Palm OS, Symbian, and everything else requires specialized cross-compilers and development environments. No, developing for individual platforms isn’t the answer. It just turns everything into a development and maintenance nightmare, one that is ridiculously expensive from a financial, time, and resource perspective. What I need is something that works everywhere, regardless of platform, using resources common to all devices out there.

And the answer, my friend, is the same as it is the desktop: the Web browser.

What piece of software do all the nifty little gadgets listed above have in common? A Web browser, of course. Some make it the core of everything the device does, like in webOS and to some extent the iPhone. To others, it’s just another app available among many. But even the most rudimentary phones have simple browsers these days, enough to grab small snippets of HTML and display it competently. Even my Treo, which most iPhone users would likely scoff at, allows me to do the odd bit of online banking, news reading, and forum checking. While no single mobile platform is ubiquitous, the Web browser itself comes alarmingly close.

So I’m happy to announce the creation of GPF Mobile, the official mobile-optimized version of the GPF site. There’s nothing special to learn or type in; just visit the main GPF site at the usual URL and it will detect your mobile device and bounce it to the mobile site seamlessly. With the exception of one or two multimedia-rich updates, you can read the entire comic archive, browse the News archive, read the forum, or search the wiki. If you are a Premium subscriber, you can do all of this ad free, as well as get mobile access to the Jeff’s Sketchbook and Rumor Mill archives. The entire mobile site is specially optimized to minimize clutter and trim bandwidth, so it loads fast and doesn’t break your data plan. But if you have a smartphone with a bit more horsepower and a fatter pipe, switching to the “full” site is as simple as a few extra clicks. Just use our site to set a cookie (and you choose its duration) and have access to the full size for as long as you choose. I’ve been using the mobile site myself for months now, especially to keep track of the forum while I’m on the road, and it’s been beta-tested by a number of hand-picked Faulties. It’s not necessarily pretty (in fact, it’s downright Spartan), but it does let you get your GPF fix on the go.

Best of all, it works with BlackBerries, Android, webOS, Palm OS, Symbian, Windows Mobile, and… yes, folks, wait for it… the iPhone. I guarantee that bookmark will take up less valuable storage space than some bloated, unnecessary “app”.