Dave Naffziger's Blog

It was kind of cool to see Quova float across my VentureBeat feed late last week. Enterprise companies rarely cross the startup feeds, particularly those that are infrastructure companies. It is also amusing to see how the media reports news from companies you are actually quite familiar with.

The VentureBeat article is here and Quova’s press release is here. Other than making up a competitor that doesn’t exist (DoubleClick), there wasn’t any real analysis in the VB article or facts that couldn’t have been found in the press release.

The on-demand geolocation from Quova is significant because it drastically reduces the entry cost for world-class IP geolocation. We had experimented with a similar service nearly 6 years ago, but never really had the business structure to really sell or develop the service. The company that will most likely be affected is MaxMind, a tiny company that produces ok geolocation data. They’ve sold primarily to companies that were too small to afford Quova’s technology and have been successful amongst the solo-developer crowd.

I’ve been on the east coast for just under a week and of course have been using gmail and google calendar regularly. I’m pretty attentive to geolocation cues and I was pleasantly surprised when I saw this question appear in my calendar:

This is the type of thing that we envisioned people would do with IP geolocation data years ago when we launched Quova. Of course data accuracy and business imperatives got in the way for a while. It does make for a great product refinement though.

A random assemblage of notable stuff I’ve run across online:

Interesting:

• Yahoo & geographic search queries: Yahoo has released some research that associates search terms with the geographic location of searchers. We used (and I presume still use) similar techniques at Quova. I find the secondary information that can be derived from some data sets fascinating.
• Gen Lord on Slashdot about Air Force Cyber Command. Air Force Cyber Command is still finding its way, but it is rare that senior officers engage with the online community.
• Cat ownership improves heart health (via Slashdot). A 30% reduction in heart attack risk. No effect was found for dogs, but the authors attribute that to data scarcity in their study. I wonder what effect kids have.

Cool:

• Giant mechanical flying jellyfish. Gorgeous.
• Robotic military insects. Prototypes of miniature robotic sensors similar to insects may be in use by the end of the year.
• MacGyver Movie. Now, we just need a remake of the A-Team.

Useful:

• Free AT&T Wifi (thanks Rahul): AT&T gives iPhone users free wifi at its hotspots. However, their authentication isn’t all that great. Modify your user agent and AT&T thinks you are an iPhone.
• SPF wizard. Sender Policy Framework wizard to create SPF records for your email (so it doesn’t end up in spam boxes). If you do any automated mailing, the SPF records are a must.

I guest-lectured at Johns Hopkins last Saturday in the Analysis, Data Mining & Discovery Informatics Class in the Intelligence Analysis Master’s Degree program. The students were largely early-career intelligence analysts that are accustomed to conducting one-off analysis, but rarely think about building analytic systems.

I gave an overview of IP geolocation, had the students test their skills at mapping IP addresses (thanks for the IPs Bob!), and then we discussed how we might build an analytic system to map IP addresses.

My takeaway from the class was that the government doesn’t train its people how to build systems. The analysts that I worked with had all been in their roles for a number of years, but this course seemed to be the first time that most of them had ever thought about improving the analytic system, not just improving their personal analytic capabilities

I’ve found the culture of the intelligence departments to be very analyst driven. The analyst is at the top of the food chain. Tools are built and data is collected to improve the analyst’s job.

However, analysts frequently do things that can be automated. Even worse, the agencies reinforce this by building tools that make their automatable work easier to do manually.

The key is to realize that the analysts are components of a larger system, and not the purpose of the system. We found a great balance at Quova where our analysts and algorithms worked closely together, creating a system much stronger than any one component.

For some reason inexplicable reason Utah consistently passes laws that attempt to regulate niches of the Internet in Utah only. While these laws are typically a boon for Quova and other IP geolocation companies, they are ridiculous attempts by Utah to rewrite existing laws.

In 2004, Utah passed the Spyware Control Act (Ben Edelman’s review), which intended to protect trademark owners from otherwise legal (and annoying) popups from spyware. While no one likes popups, the fact remains that the legal foundation for the law was shaky at best. Utah amended it in 2005 and then saw the legal principle behind the Act struck down in a Second Circuit Court ruling (boy is it rare when you see the EFF siding with spyware purveyors). I believe the law still stands, but it is likely toothless at this point.

The latest brilliant incarnation of Utah law is to ban keyword advertising on trademarked terms. Although misrepresented as a generic ban on keyword advertising, this is still another example of Utah overstepping the bounds of its authority online. Google has already fought in court and won the right to display competitive advertisements on branded keywords. I have no idea why Utah lawmakers feel that they can usurp existing trademark law, and it can only be a matter of time before Google masses its legal forces against the gates of Utah.

The only solace I take in any of this is that the question of whether companies can comply with state or national laws online is no longer at issue. Years ago, the IP geolocation industry was set back by Yahoo’s insistence, that Yahoo couldn’t technically comply with a French ruling to remove Nazi memorabilia from their site (ironically, Yahoo’s refusal to utilize IP geolocation technologies set them back several years on Google).

I dislike that IP geolocation can be used to justify absurd laws, but it is naive to think that local and national laws have no impact online. Now, hopefully the courts will stop studying the technical feasibility and instead begin dealing with the legal and policy implications of an Internet that is local as much as it is global.

It’s not everyday that one of my friends sends a request like this:

I’m also trying to connect with people to buy used/refurbished plasma/oxy cutting machines for steel plates for a steel service center I am setting up. Any ideas?

He’s outside the US and will be visiting in a few months. After I stopped laughing, I tried to figure out what advice I could send him.

My first instinct was to tell him to use Google and sure enough there a ton of results (the adwords results actually look particularly promising). However, I realized that:

• He probably already tried this
• He’s outside the US and probably won’t see results that are as relevant as I see (US geotargeted Adwords campaigns being the default option). Even his natural search could be way different.

So, I emailed him a screenshot of my search results. Surely there has got to be a better solution.

Hats off to the aimClear team for helping identify and clarify Yahoo’s geotargeting issues (via Online Marketing Blog).

Yahoo messed up so badly, it seems that they’ve disabled the geotargeting features for now. BTW, I can’t tell you how happy I am that these issues aren’t related to the core technology. At Quova, we constantly heard things like ‘why are you showing my IP to be in Minneapolis - I’m in St. Paul’.

Geotargeting is often mistaken for something that is easy to do and easy to implement. Neither are true. However, both are easy to do a poor job at. Effective use of geotargeting technology requires someone to sit down and carefully map out the full user experience. This involves these frequently overlooked scenarios:

• No geotargeting information (or information that is known to be unreliable)
• The user is trying to hide himself (yes, these can be detected)
• Incorrect geotargeting information - you obviously want to give the user a way of telling you that you’re wrong.
• Geotargeting information available at a different resolution. The user is reliably determined to be in the Bay Area, but the technology cannot reliably determine whether they are in Oakland or San Jose.

Interesting post by Markus wondering whether AOL had been hacked.

They haven’t been hacked – they’ve just become the new spammer’s haven. I’ve wondered how long it would take the spammers and scammers to figure this out after AOL made their service available for free.

Here’s how it works:

1. Scammer downloads a copy of AOL’s software
2. Scammer uses AOL software in “AOL over broadband” mode (they use their own Internet connection)
3. Scammer conducts bad business using the AOL client (they can’t use any non-AOL browser).

The spammer is now indistinguishable from every other AOL user – bad grammar and all.

Now, let’s suppose that someone detects the fraudulent behavior and they want to block the user. Because of AOL’s proxy systems, websites can’t block the IP address since they would be blocking hundreds of thousands of AOL users. Doh.

AOL has now become the world’s largest public, anonymizing proxy.

Many sites use IP geolocation technologies to identify traffic from proxies. The fraud from these proxies is several orders of magnitude higher than from regular IP addresses, so many ecommerce companies naturally send these transactions for extra screening. Try sending a big paypal transaction next time you’re in Africa – you’ll get to know the folks in the Paypal fraud department pretty well.

So, what happens as AOL becomes a spam gateway? One of two things:

• they begin policing their free users. An expensive and challenging option.
• regular users of AOL have a harder time doing things online. They get asked for extra information when they make purchases (or have them outright rejected), get rejected when they apply for credit cards, etc. The users leave and spamming gets worse. AOL eventually shuts down their proxy servers.

Anonymity is nice, but the world requires trust to operate.

BTW, never trust a message from a gmail account either. Gmail doesn’t display the source IP address of the sender in the message headers. So, the scammer can hide himself from prying eyes. Yahoo and Hotmail may have a long history of scammer usage, but the real pros are using gmail now.