Re-activating this blog and new house design

This blog has been completely dormant for quite a while, but I now have something interesting to post about, and I expect there to be a lot of posts coming. I'm building a new house, which is somewhat interesting, but I'm also planning to incorporate a lot of custom-built automation into it and I think that's very interesting, and may be interesting to others. Particularly since I'm new to electronics engineering, so I'm going to be posting what I learn as I go.

Today, though, I just want to talk about the house as a whole. My uncle Kelly is doing the architectural design and he has finished the basic plans and is sending it out for structural engineering review, so it's pretty close to final. For those who've followed my Google+ posts, this will be old news. I'll get into other, more interesting stuff soon, but I want this blog to have a fairly complete record.

First, this is the front view and the view from the right end (as you face the house):

The left side of the house is the garage. The tower contains the stairs going up and down. The small sections on the ends with the archways are facades.

Next, this is the rear view and the view from the left end:

That's a two-car garage, but an extra deep one. We decided that two cars is enough, because we'll also have a large (approximately 30' x 40') shed on the property where we can keep equipment. The extra depth of the garage will leave plenty of space for tools and even a small workshop area in front of the cars. I may have a bigger workshop in the shed.

The big windows near the center of the house open into the great room, which is two stories high. To the left of it (in this image) there's a sun room that projects back from the master bedroom. To the right is the kitchen/dining area, which has a bay window.

Here's the main floor:

At the bottom of the plan is the entrance. You can see the covered area leading to the double doors. Just inside the doors to the right is a half bath. Straight ahead from the doors is the great room, with its 18 foot-high windows and a door opening onto the back patio. To the left of the entrance is the stairs going down to the basement and up to the second floor. Also to the left is the kitchen and dining area. I'll detail the kitchen design in another post. Beyond the kitchen are a mud room, laundry room and pantry. The mud room connects to the garage which will, of course, be the primary way that we enter and exit.

To the far right is the master bedroom and bath. The bedroom opens into a sun room in the rear, perhaps with a half wall dividing them. The master bath is large and comfortable and opens into a big walk-in closet. Note that the closet connects to the bath, not the bedroom. That's so if one of us is up earlier than the other (or later), that person can bathe and dress without bothering the other.

Here's the upstairs:

To the left are two bedrooms, each with its own features. The one on the end is larger, with a walk-in closet and a door (not shown) into the "bonus room", which is space carved out of the garage attic, for storage. The one next to it isn't as big, but has a nice bay window, with a window seat. There's a full bathroom next to the two rooms. One other feature of this area is that the hallway into the smaller room will have a laundry chute, which opens into the laundry room below.

In the center is the great room, which is open to the floor below, but with a walkway stretching across to the right. On the right end there is a guest bedroom, with connected full bath, and my home office which also connects to the guest bath.

Next, the basement:

The basement will be unfinished, mostly. In the front, underneath the front porch, will be a cold storage room, for food storage that needs cooler temperatures. To the right and further back is the utility room. I have great plans for that utility room, more in future posts. There's a location for a bedroom to the right, with a large window. The left and rear is a basement walkout, with lots of space for bringing in large furniture. Eventually we'll build a family room / home theater down here, but not right away.

Finally, the location:

The blue quadrilateral is the property boundaries. The lot is five acres. The black curving line is the driveway. The reason for running it back so far and then curving around is because there's a hill, and that route provides a gentle grade to the top. The red polygon is, roughly, the edges of the hilltop.

The larger black rectangle is the approximate size and location of the house, sitting on top of the hill. The house will fact to the southeast (north is up). This means all of our big windows will be pointing to the northwest, which is a little unfortunate. The smaller black rectangle is our planned storage shed (which will be built well before the house). The placemarker balloon is the approximate location of the planned well, which needs to be at least 100 feet from any building and from the property line.

Technically, the well doesn't have to be 100 feet from the property line, it just has to be 100 feet from another well. But if you put it close to the property line you have to get an easement from the owner of the neighboring land, which is basically a commitment from them that they'll never put a well on their property within 100 feet of your well. The easy way to avoid all of that is just to put it at least 100 feet from the property line.

Not shown on this image is that the septic tank and drainage field will be between the house and the road, in the low ground (which looks very green in this image).

Web site password manager

If you're like most people, you use a bunch of different web sites, including some that handle some pretty important stuff -- like money -- but you use the same password for all of them. And it's probably not a very strong password, either.

That's a really bad idea. If one of those sites gets hacked, the attacker could get your password and then start trying other places it might work. Essentially, the security of all of your web accounts is only as strong as the weakest one.

But the reason we do that is because it's just danged hard to remember a whole bunch of different passwords. I'm hopeful that eventually OpenID will solve this problem but in the meantime I found another nice solution: Passpack.com.

It allows you to store all of your passwords in one place, and it even provides a little button you drag onto your bookmarks that automagically types the right password for each web site you visit. So, I've now gotten rid of my one password for everything and replaced it with a bunch of passwords, one for each web site I use -- and I never have to actually type any of them. I just go to, for example, "discovercard.com", then click the "Passpack it" bookmark and I'm automatically logged in. And the password is something like 3yPtdkogzh8H, which I could never remember, but don't have to. Or even something like "ò-èuÓ¿¸>8ÝAÖ" for sites that can accept the strange characters -- I don't have to type it so there's no reason to limit it to something I can type.

This *also* works from any computer that has a web browser. I do have to remember my "passpack key", which is what secures all the rest of my passwords, but as long as I know that, I can log into passpack from anywhere and then use it to log into other web sites. Do be cautious about using passpack from public computers, though... there are ways that a deeply hacked computer could extract your passwords if you unlocked them while using it.

Finally, I also had Kristanne set up a passpack.com account, and then I "shared" my passwords with her. So she can use them to log into web sites, too, so that we both have access to our bank account, credit card accounts, etc. If I ever change the password for one of them, I just update it in passpack and then when she uses it to log in she'll get the right one -- and won't even know that it changed because she never sees or types the passwords.

How all of this works is pretty complex, and very technical. Suffice it to say that it appears to be done right from a security perspective. Your passwords and your passpack key are never sent to passpack.com in "plaintext". Software running in your browser applies a salted secure cryptographic hash function to your passpack key to produce a 128-bit AES key which is then used to encrypt your passwords. The encrypted passwords are sent to passpack.com and stored there (which is how it can work from a browser on any computer -- they encrypted copies are downloaded). Password sharing is done by generating a 1024-bit RSA key pair which is used to exchange AES session keys to make it possible for people you share your passwords with to use them. Actually, you can also use the sharing service as a form of highly-secure e-mail.

If the preceding paragraph is gobbledygook, just trust me. Or if you'd like to understand it, just ask sometime and I'll explain it in as much detail as you could possibly want :-)

If that paragraph isn't gobbledygook to you, and you see a bunch of possible holes, that's because I left out all of the details.

Won't people freak out and call the police if I openly carry a gun?

Short answer: It's possible, but not common.

Utah is a very gun-friendly state, and many residents of Utah have some familiarity with guns. In addition to that, people tend to assume that the calm, confident actions of a normal-looking person must be legal and most people are, frankly, oblivious to most of what goes on around them.

These factors combine to mean that open carriers find that the vast majority of people simply don't notice the gun, especially if it's not large or ostentatious, the majority of people who do notice the gun don't react to it and most of those who react ask questions or make comments rather than calling the police. People who open carry regularly report that the most common interactions are very positive ones, where the carrier has an opportunity to explain the issues to the curious or just engage in “gun talk”, chatting about shooting, firearms and lawful self-defense.

That said, negative interactions do ocasionally occur. Most often these take the form of store or restaurant employees asking the open carrier to leave. Sometimes these requests are provoked by questions from other customers but most often they are initiated by employees. The appropriate response of the open carrier to such a request is not to argue or debate the point, but simply to comply, ideally without completing a purchase and with a followup letter or e-mail to explain the carrier's point of view and to request clarification of the store policy.

In rare cases the police are called and become involved. In some areas, 911 operators are being trained to question “person with a gun” reports, asking what the person is doing, if he or she is threatening anyone, etc. In those areas, police are unlikely to be dispatched. If police do arrive, interactions are generally peaceful, though not all police officers are fully informed on the law so some may make false statements regarding the legality of open carry. If you are the recipient of police attention due to open carry, please stay calm, stay polite and if the officer is making incorrect statements, just say “I'm sorry officer, but I don't think that's correct. Can you please ask your supervisor to verify it?”.

If you are a person who has an unusual style of dress, hairstyle or appearance, especially if your appearance is one that might be associated with gang or criminal activity by many people, or if you appear or act intimidating or frightening even without a firearm, you are much more likely to have negative interactions and police interactions as a result of open carrying. This may not be fair or right, but it is reality. Also, young people and those who engage in body modification (piercings, tattoos) are more likely to have negative experiences with open carry. In contrast, well-dressed, well-groomed, responsible-appearing people tend to have no issues.

I don't have a concealed carry permit, can I carry a gun?

It is legal to carry a firearm in Utah without a permit, but there are some things to watch out for if you leave your own property or vehicle. Specifically, if you're carrying in public your firearm must be unloaded and unconcealed, and you must avoid school zones and buses or trains.

It might seem that carrying an unloaded gun is useless, but Utah's law has a peculiar definition of the word “loaded”. Specifically, the law says that gun is loaded if either:

1. There is a round in firing position; or
2. A single mechanical action will cause the gun to fire.

This means that you can carry a semi-automatic with a full magazine as long as the chamber is empty, because an empty chamber means there is no round in firing position, and it takes two mechanical actions to fire the gun: rack the slide and pull the trigger. For a revolver, the chamber lined up with the barrel must be empty, and if the revolver is double-action, meaning a pull of the trigger will rotate the next chamber into position, cock the hammer and fire the gun, then the next chamber must be empty as well.

In contrast to this odd definition of “loaded”, Utah's definition of “concealed” is very straightforward. A gun, or any other dangerous weapon, is concealed if it is hidden so that people aren't aware of it but it is readily accessible. In practice, the best way to open carry is to use a normal outside-the-waistband belt holster. I recommend using a holster that has some “retention” features, which are devices that lock the gun into place so it can't easily be removed by someone who isn't familiar with the holster, and I recommend practicing techniques to stop a gun grab attempt.  Such attempts are extremely rare, but your gun is your responsibility so it makes sense to be prepared.

The final issue to watch out for is locations where it's illegal for you to carry. The most frequently-encountered issue is school zones, but carry is also banned on UTA buses and trains and in bus and train stations. There are other areas that are off-limits even for permit holders, including courthouses, jails, secure areas of airports, etc.

Without a permit, it is illegal for you to carry within 1000 feet of any school property, where “school” means any pre-school, day-care, elementary, secondary, or post-secondary institution. Since day care facilities are often ordinary homes with no distinguishing marks, and post-secondary schools like cosmetology schools and massage therapy schools are found in many strip malls and may not look like schools at all, this means there are a lot of places that carry without a permit is illegal. The area within 1000 feet of a school-sponsored activity is also considered a school zone.

If it weren't for some exceptions in the law, school zones would make lawful unlicensed carry almost impossible, and would pose serious problems for owners of homes and businesses near schools. First, it is legal to possess a firearm on private property located within a school zone, with the owner's permission. Second, it is legal to possess a firearm in a vehicle located within a school zone, with the driver's permission -- as long as federal law enforcement isn't involved. The federal school zone law allows firearms in vehicles, but only if the gun is completely unloaded and in a locked container. This law has never been enforced since it was passed in 1995, but it is on the books.

Relevant laws:

• UCA 76-10-505 bans carrying a loaded weapon on a public street. Note that the law does not define “public street”, so to be safe I recommend interpreting it as “anywhere but private property with the permission of the owner”.
• UCA 76-10-502 defines when a weapon is deemed loaded.
• UCA 76-10-504 bans carrying a concealed dangerous weapon.
• UCA 76-10-501 defines “dangerous weapon” in paragraph (6), “concealed” in paragraph (3) and “readily accessible for immediate use” in paragraph (15).
• UCA 76-10-505.5 is the state law that bans carrying a dangerous weapon (including firearms, per 76-10-501(6)) in a school zone.
• 18 USC 922(q) is the federal law that bans carrying a firearm in a school zone.
• UCA 76-10-1504 and UCA 76-10-1507 ban carrying a firearm on a bus or in a bus terminal.
• UCA 76-10-1503 defines “bus” to include any transit vehicle, including trains like TRAX and FrontRunner.

There's going to be an increase of activity here

I need to get my utahlegalcarry.com site up and running soon, but in the meantime I've decided to start posting here some of the content that I ultimately want to put there.  Eventually I want to build a fairly comprehensive FAQ list for people who want to understand legal carry of firearms and other dangerous weapons in Utah.  To begin with, I'm going to start posting essays on various topics here, with the intent that they'll eventually get incorporated into my FAQ list, and so that in the meantime I can easily refer people to them.

I'm going to shoot for adding one or two articles per day here, so expect to see some activity.

Here's a partial list of issues/questions I'm going to address:

• Politics/opinion (note:  I'll give my opinions, but try to present all sides)
• Shouldn't only police officers have guns?
• Isn't it a bad idea to allow anyone who wants to carry a deadly weapon?
• Doesn't allowing people to carry guns at our schools endanger the children?
• Doesn't owning, possessing or carrying a gun make you more likely to get shot?
• Why would anyone want to carry a gun?
• Why would anyone want to carry a gun openly, if they can conceal it?
• Legalities of carrying a firearm or dangerous weapon
• I don't have a concealed carry permit, can I carry a gun?
• I have a concealed carry permit, where can I carry?
• How come Utah courtrooms don't provide firearm storage lockers, like the law says they should?
• I have a concealed carry permit, does my gun have to be hidden?
• Can my city or county ban dangerous weapons?
• I'm a student or staff member at a Utah university, can I carry there?
• My employer has a policy against carrying weapons at work.  Do I have to obey that policy?  What might happen if I don't?
• What kinds of weapons does a Utah Concealed Firearm Permit allow me to carry?  How many can I carry?
• What should I do if I see a "No Firearms" sign somewhere?
• Can I carry in other states?  If so, which ones and what are the rules?
• Can I take my gun on a plane?  A train? A bus?
• Practical issues around daily carry
• What kind of gun should I get?
• What caliber is best?
• Are revolvers better than semi-automatics?
• What brand of gun is the best?
• Are big guns better than small guns?
• Is it important to use a holster?
• What kind of holster should I use?
• Should I use a lot of different holsters?
• What should I do with my gun when I go to the bathroom?
• If I'm pulled over by the police and I have a gun, do I have to tell the officer, and if so how should I do it?
• Firearm safety
• What's the difference between an accidental discharge and a negligent discharge?
• How can I make sure that my guns don't hurt anyone?
• How can I make sure that my guns aren't a danger to my children?
• Are there any special safety precautions I should take while carrying?
• Is it safe to carry a gun with a round in the chamber?
• Securing firearms
• Am I responsible for keeping my guns secure?
• How can I secure them in my home?
• How can I secure them in my car?
• How can I secure them when I travel on airplanes or trains?
• Training
• How much training do I really need?  Isn't the Concealed Firearm Permit course enough?
• What kinds of training are available for free?
• What kinds of training are available for fee?
• Legality of self-defense
• Who am I allowed to defend?
• When is it legal to shoot someone?
• On the street
• At home
• In my car
• On my property
• Do I have to try to escape before I can defend myself?
• When should I shoot someone?
• When should I NOT shoot someone?
• Should I threaten someone with my gun?  Should I draw if I'm not planning to shoot?
• Is it necessary to carry a non-lethal defensive tool, like pepper spray?
• If I get in some sort of altercation that doesn't involve my gun, should I call the police?
• If I get in some sort of altercation that does involve my gun, but I don't shoot anyone, should I call the police?
• If I shoot someone, what should I do next?
• What should I do before I call 911?
• What should I say to the 911 operator?
• What should I do while waiting for the police to arrive? 
• What should I do when the police arrive?
• What should I say to the police?
• Will I be arrested?  If I am, what should I do?
• Can I be sued even if the police decide I didn't commit a crime?
• Utah's Concealed Firearm Permit
• Who is eligible to get a permit?
• What records does the state examine to determine eligibility?
• What's the process for getting a permit?
• How much does it cost?
• How long does it take?
• What are the steps?
• Can I get a temporary permit quickly if I'm in danger?
• How long is the permit good for?
• What is the process for renewing a permit?
• What kinds of things might cause my permit to be suspended or revoked?

I'm sure plenty more stuff will come up as I flesh this out.  I'm going to attempt to use the newspaper article structure for each answer, meaning that the article provides the basics first then incrementally expands the details, so the reader can stop at any point.

Awesome new voting system used in Maryland

I'm something of an election geek. I deeply believe that although democracy sucks (including the slightly-less-sucky Republican variant we use), it sucks less than any other system of government. But to make any Democratic system work there must be a good way to determine the will of the people, and that turns out to be very hard to do.

There are two main parts to the hardness. First supposing you can collect everyone's opinions, how do you put them together to make decisions? We generally use the "plurality rules" system; whichever option gets the largest number of votes wins. That system is full of problems, but that's not the subject of this post.

The other problem is collecting everyone's opinions and doing it accurately. Someone who can manipulate the elections has tremendous power, and there are a LOT of ways of manipulating elections. Stalin famously (and apocryphally) said "Those who cast the votes decide nothing; those who count the votes decide everything," and historically that is the BEST way to manipulate an election. Let the people vote as they will and then either just report whatever result you want or, if you're more subtle, just tweak the counts enough to give the desired outcome.

In the US we've recently gone through a somewhat mind-boggling electoral change by deploying electronic voting machines. I say mind-boggling, because these machines are the PERFECT tool to facilitate large scale, undetectable election fraud, and supposedly we're a country that takes its elections very seriously.

If the idea that electronic voting machines are a bad idea strikes you as surprising, or the view of a Luddite, let me point out that I'm a professional software engineer with a career focus on building extremely high security systems. If you wanted to build a very secure electronic voting system, I'm the kind of person you'd hire to do it -- and I would tell you that it is a TERRIBLE idea. And not just me. A few years ago, as the debate was just starting to heat up, several hundred of the world's top computer security experts collaborated on and signed a paper which basically said the same thing. They explained in detail why computer security technology at present and for the foreseeable future was simply not up to the task. The very best in the world said, in effect, "Not only don't we know how to make such a system secure, we really doubt that it's even possible."

By the way, the system that Utah uses is the worst of the worst.

This debate, however, did provoke a bunch of top-flight cryptographers, mathematicians and computer scientists to start thinking hard about how to design an election system that is secure against fraud. They wanted to build something that cannot be manipulated by the people in power without the populace being able to detect it, and which also preserved the anonymity of voters. It's very easy to build a secure voting scheme if you don't mind revealing who everyone voted for, but that enables vote-buying and coercion.

Some very cool ideas were developed, notably originating from Ron Rivest (who is the "R" in "RSA", for those who know what RSA is) and David Chaum (the creator of some very cool untraceable digital cash schemes). It's probably unfair to mention only their names, because there were many contributors, but they were the main "well-known" researchers involved. The first versions of these ideas were theoretically very cool, but completely impractical. Lots and lots of academic security ideas start out exactly that way.

A few years ago, some of the disparate ideas started to come together, along with some refinements that made them more practical. The result was a system called "Punchscan", which was used to carry out some real-world elections for university student body leadership. It was a good test environment because the stakes were relatively low, but the scale was big enough to make the test realistic. A system that works for a few hundred people is a lot different from one that works for tens of thousands, and once you get to that level it's really not that different to scale it up to millions.

The third-generation successor of Punchscan, called Scantegrity II, was used on Tuesday to carry out the municipal elections in Takoma Park, Maryland. This marks the first time these new ideas in election integrity and verification have been applied to a real government election. And it worked well. The security experts said that electronic voting machines were a bad idea, and now their recommended alternative was used for the first time.

The basic goal of the system is to ensure that it is impossible for ballots to be lost or modified undetectably, and to do it in the context of a practical election that is cost-effective, easy to run and easy for voters to use.

It uses optical-scan ballots, with a small twist. The "bubbles" on the ballot are pre-filled with invisible ink. The voter has a marker that contains the chemical that activates the ink, so swiping the marker across the bubble causes it to be visibly filled -- mostly. When the ink is activated, not only is the bubble-filling ink revealed, but a three-letter code is also revealed. The code is "printed" by the absence of the ink.

A voter who wishes to make sure that his ballot is counted correctly takes a moment while in the voting booth and copies down that three-letter code, as well as the ballot serial number. After election results have been posted, he then goes to the election web site, types in his ballot serial number (which isn't associated anywhere with his identity), and make sure that the codes he copied down are among a small list of codes presented to him. If they are, then he knows his ballot was submitted and tallied as part of the final count.

Now, HOW that code's presence on the web site verifies that the ballot was counted correctly is a little bit complicated, and I'm not even going to try to explain it here. If you want to know, a good starting point is this paper. Also, that code-verification is far from the only thing that has to be done to verify the integrity of the election. Ballots have to be audited before and during the election (audited ballots are not used to cast actual votes), there's a pre-election "code commitment" process that the election officials use, and a post-election "randomized partial checking" system that verifies that the ballots submitted and tallied were actually tallied correctly.

The system allows all of these various integrity verification processes to be carried out by ANY interested parties. It's presumed that the candidates and political parties will take part in them, and that democracy watchdog groups will as well, but any interested person can do it. In fact, the system is designed so that anyone who wants to can easily conduct a personal recount of the entire election, just by downloading the data over the Internet and then running some software on it. The software has to do some complex things, including a lot of fancy math, but the detailed specification for what the software must do is available, along with mathematical proofs demonstrating how it assures integrity, so that anyone with the relevant skills can write their own software to do the verification. Those who don't have the skills to write the software just need to get a program from an organization they trust, and use that.

All of this makes it possible to prove to an arbitrary mathematical probability that the election results were accurate. By "arbitrary mathematical probability" I mean that there is always a possibility that the election was fraudulent and that the fraud was undetected, but for any given margin of error you can decide how much auditing needs to be done to make the probability of fraud as small as you want it to be. The smaller you want to make it, the more auditing is required, but you can achieve any desired level of certainty.

In addition, the Scantegrity system allows for manual recounts of the paper ballots. Manual recounts are actually less reliable than the statistical verification the system uses, but they're an option, unlike with electronic voting systems (including Utah's; no one has ever managed to successfuly recount an election from those paper rolls the machines produce).

This is very cool stuff. Of course it doesn't address issues with registration fairness, fraud, etc., or issues with whether or not plurality voting makes sense, and certainly does nothing to address voter apathy, lying politicians, media influence or any of the many other problems with the political process, but it DOES allow us to have confidence that our votes are counted as cast, which is something that has never been very certain, and which the current generation of voting machines has made very, very questionable.

Software Copyrights

I've written about this various places before, but I thought I'd put it here, mostly so I can link to it from other places rather than retyping the arguments.

I'm a big fan of copyright law. In the abstract, at least -- there are a lot of problems with our current law. And computer software is a huge part of my life. It's not only my job, it's one of my major passions and lately my biggest hobby. So it's natural that I should be interested in how copyright applies to software, and I think that the way we use copyright for software is very, very broken.

To explain why, first I have to give a little background on copyright.

The idea of modern copyright is a pretty simple one: Society grants creators of all sorts of useful and artistic intellectual works control for a limited period of time over who is allowed to produce copies of their work. There's a little more to it, and lots of corner cases and caveats, but that's the basic idea. Other than the "limited period" part of it, pretty much everybody understands that if an author writes a book, you can't make copies of it and sell them on the street without permission.

But, why not? Why do we do this? Thomas Jefferson argued that copyright made no sense. He said that ideas are naturally infinite, that as they're passed from person to person, everyone is enriched. He compared it to candle flame and pointed out that a man who lights his candle from mine has obtained light, and I have lost nothing.

So why should society invest large amounts of money and time in enforcing copyright laws, which restrict the natural freedom and urge to share?

There's a really good reason, and it's the one described in Article I Section 8 of the US Constitution: "To promote the progress of science and useful arts, by securing for limited times to authors and inventors the exclusive right to their respective writings and discoveries". Copyright law was created as a means to convince creators of intellectual works to publish them, to make them available to the world. The way it works is that society removes the freedom of everyone but the creator to make copies, for a time, so that the creator can benefit from his or her work. But any benefit to the creator of the work is just a pleasant side effect, because the real goal is to get that work published, into the hands of as many people as possible where it can spark new ideas and inspire new creativity. In other words, where it can Promote Progress.

Oh, it also promotes progress by motivating people to write, sing, etc. But the real goal of copyright was to promote publication and dissemination, because that's where the real progress is made, when ideas build on other ideas.

So, how does this relate to software?

Well, copyright law is the primary legal tool used to control the distribution of software, both by individuals and corporations who are trying to make money, and even by the Free Software movement, who have other goals. But Congress never really sat down and thought hard about how copyright should apply to software. Congress did change the law in order to balance out the short-term and long-term advantages to society when other technological changes came about, but they didn't do it fast enough for software, so the courts ended up deciding for them.

The courts basically decided that software is sufficiently expressive and creative to qualify for copyright protection. I completely agree. I have seen some truly beautiful code in my life, and even written a little. I hope someday to take a photo that's as beautiful as the best of the code I've written.

But what the courts failed to do, in a crucial oversight, is that they failed to distinguish between "source code" and "compiled binaries".

Source code is what programmers write. Reading or writing it requires some training, but it's designed to be human-readable, and computers can't make any direct use of it. Instead, the source code must first be processed by another program called a "compiler" (which itself was written in source code and processed by a compiler). The compiler turns the source code into "machine code", the actual pile of computer instructions that the computer reads and follows, like a very sophisticated cake recipe.

Source code is also what programmers read. Just as authors of poetry and novels hone their craft by reading the writing of other authors, the best way for a programmer to learn new ideas and new techniques is to read the code written by other programmers. The progress of software is promoted by making sure that programmers can read what other programmers have written, not so they can copy their programs directly, just as authors don't make word-for-word copies of the works of other authors, but so they can pick up ideas. Structure, phrasing, word choice, dialogue, character development plot arcs... all of these are things that authors learn from other authors, and there are analogous concepts to all of them in software.

The difference between a book and a software program, though, thanks to those first court rulings that decided that copyright applies to software, is that it's impossible for an author to publish a book to the world and simultaneously keep secret from the world the words that he used to write it. In order for an author to reap the benefits of publication, he also has to allow other authors to read his words and learn from them. How could it be otherwise.

With software, it is otherwise. Programmers can read and learn from source code, but once that source code has been fed through the grinding maw of the compiler, turning it into an opaque mass of machine instructions, it is extremely difficult to examine the result and determine how it does what it does. Not impossible, but very difficult. It's perhaps akin to taking a book and running it through a paper shredder, then piecing it laboriously back together in order to read it.

But copyright law, as currently applied, protects that ground-up version just as much as the readable version. And with software, the ground-up version is the one that has value to non-programmers. So, individuals and companies can produce software, publish the opaque binaries on CDs, in boxes on the shelf in the local computer store, and never have to reveal the ideas they used to create it. And yet they get the full weight of the legal system standing behind their copyrights, even though they have sidestepped the whole purpose of copyright law, to promote progress by disseminating ideas.

Moreover, although copyright is supposed to last for a limited time, after which copyrighted material falls into the public domain and becomes available for anyone to use for any purpose they wish, the source code of software published in binary-only form will never see the light of day. The binaries will fall into the public domain, but the source code was never published and will be lost.

It's not a total loss, of course. Other programmers can often infer interesting things about the structure of software from the behavior of binary copies. And some 'reverse engineering' (figuring out how it works by poking through the binary) does take place. But progress is hugely slowed by the predominance of 'closed' software, software for which no source code is available.

The Free Software movement is really a reaction to that limitation on progress. And it's a significant testament to the progress that is enabled by openness that Free Software constructed by ad-hoc groups of volunteers around the world often not only compares with, but bests, similar "closed" software constructed by large, well-paid and focused corporate teams.

I think the solution to this problem is very simple, though politically challenging: Software makers should be required to publish source code in order to receive copyright protection. It would still be illegal for programmers to copy this copyrighted source code, and illegal to copy the ground-up binaries as well, but other programmers could read the code and learn from the ideas, satisfying the progress-promoting goal of copyright law.

There would be practical benefits as well. As a purchaser of a software package, you would have some assurances that you do not now have. For example, should the company that sold you the package collapse, you could still hire a programmer to fix any defects you find in the software (the legalities of that would have to be worked out, but at least the ability is present). Even before you buy it, you would probably have the ability to ask others who've purchased it what they thought of the program -- and not only it's outward behavior, but also its inward structure. A good programmer can tell a lot about the quality and reliability of a software package by examining its source code. This is similar to a mechanic taking a look under the hood to see if an automobile is sound. But with closed-source software, the hood is welded shut.

A non-obvious benefit that I'm convinced we would see is a reduction in the amount of code copied illegally between programs. How can that be? Doesn't only publishing code in binary form completely prevent illegal copying? Not really. There are still people who see the source code, and they can still copy it. Lots of programmers (illegally) take a copy of their work with them when they change employers. I personally have witnessed a couple of cases of stolen code incorporated into closed-source software (not while at IBM; IBM is exceptionally cautious about this).

So illegally copying of source code happens now, but how would making source code more widely available reduce it? Simple, because it would be easier to find. Right now, companies that illegally copy source code usually get away with it, because they distribute only opaque binaries and it's difficult for anyone to recognize their act. But if everyone published source code, finding illegally-copied code would in most cases be a simple matter of scanning. There are tools right now that can scan a body of source code to see if it contains any code taken from the thousands and thousands of open source programs in the world. Companies use these tools to verify that their programmers haven't lifted some open source and dropped it into the company's software as a time-saver. It's easy to see that if most commercial source code were available, that this approach would be easily extended to cover that as well.

There might still be some companies who have such important and novel ideas in their source code that they dare not publish it. They would also have an option to protect their assets, through another facet of intellectual property law: Trade Secrets. They could classify their source as a trade secret, and sell their software only to customers who are willing to sign a contract committing them not to make copies. The contract would protect the binaries from being freely redistributed, and the source code would stay a secret. Any employee or other person who knowingly divulged the secret source code would be guilty of a crime.

I'm convinced that if obtaining copyright protection for software required publishing the source code, we would see an explosion in software progress. The quality and capability of the software packages we all use every day would grow by leaps and bounds. Software technology researchers would have access to a huge body of code to analyze and learn from, to help cull the best techniques and processes to help all programmers be able to do a better job. Tools would improve. Quality and reliability would improve. Security would improve. There would still be lots of problems, of course, because software is inherently, fundamentally hard. But applying copyright law in accordance with its underlying principles would better serve society's interests as a whole.