Disruptive Telephony

Interestingly, there was no event inside of Facebook for the ACUTA annual conference that I referenced in my last post.  Continuing my ongoing exploration of Facebook, I thought that perhaps because ACUTA is the "Association for Communications Technology Professionals in Higher Education" there might be an "event" already created in Facebook.  There wasn't one, so naturally I created an event notice.  If you are going to the ACUTA conference this month and are also a Facebook user please feel free to join that event.

ACUTA?

Creating this event caused two discussion threads in my brain.  The first was about ACUTA as an organization and the question of perhaps why there is no mention of ACUTA within a search inside Facebook.  While my co-workers involved with education sales have been involved with the organization for some time, I personally had not heard of it prior to being asked about speaking at this conference.  From the corporate FAQ (and university FAQ), it seems very obvious that ACUTA comes from the telecom side of the house and is looking now at the larger "communications technology" space.  I would think for the folks involved, all of these social networking services will play an increasingly larger role in the future.  One of the talks I'm interested to hear at the conference is "Millenials Go to College", which looks to be about how communication is changing with the younger generation.  Will ACUTA members be inspired to delve more into Facebook after that?  (Will the talk cover Facebook? One would expect so...) We'll see.

Facebook events and corporate choices?

The second discussion thread in my head was about how Facebook still needs to adjust to being more than a college/university place.  For instance, let's look at the choices I have when creating an event:

First choice... a party!  Woohoo!  But wait... there are even many individual types of parties!  (Do Facebook users actually schedule a "Night of Mayhem"?)

Next up is "Causes"... with a sub-type of "Fundraiser, Protest or Rally".  So where do you put a "conference"?  I thought perhaps "Education" might be a choice, but that gives me these choices very clearly targeted at higher education:

The answer would seem to be under the fourth choice of "Meetings":

where, sandwiched between "Club/Group Meeting" and "Dorm/House Meeting" there is... ta da... "Convention".

Now, I realize that Facebook came out of college/university roots and that certainly parties are a major focus with that age range, but as Facebook tries to capture more "business" users... or at least more "professionals", one wonders if over time they will re-write this a bit to adjust more to the type of events that people within the business world usually attend.  Or perhaps at least re-order the priorities a bit (or let you do so).

They may not be able to easily do so, though.  They really have different audiences to which they need to cater.  One group is looking for social events and the other for more business focused events.  It's also not entirely clear to me that "business users" would actually want to use Facebook as the calendar for their events.  But if you buy into the vision of Facebook as your end-all and be-all portal (I'm not there yet, personally, but I can see that as the vision of FB.), it makes sense to think some of those meetings might migrate here as well.

We'll see... the evolution of Facebook continues!

FYI, on the week of July 29th - August 2nd, I'll be down in Hollywood, Florida, at the annual conference of the Association for Communications Technology Professionals in Higher Education (ACUTA).  I will be speaking on... surprise!... VoIP security!  There look to be a great number of interesting talks on the schedule, and so I'm looking forward to wearing my CTO Office hat (versus my pure "VoIP security" hat) and listening to and learning from what many of the folks involved with deploying leading-edge IP communications technologies in the education space are doing.   There will, of course, also be some security talks of interest.

If any of you reading this weblog will be down there at the ACUTA conference, please do feel free to drop me a note, as I definitely do enjoy meeting with others who connect through the social media space.

P.S. And yes, Florida in late July/early August is definitely not my idea of a fun place to be... good news is that we'll be indoors!

As readers and listeners know, I've been very much looking forward to heading over to Stockhom, Sweden, for VON Europe 2007 and the co-located Podcamp Europe. Unfortunately, when my flight leaves this afternoon, I will not be on it.  I'm now not going.

Since about the middle of this past week, I've been experiencing some pains that made it extremely uncomfortable to sit or stand for long periods of time.  Oddly, walking is fine, but sitting or standing still starts to really hurt.  After spending literally the entire day Saturday in a medical center and then hospital, they think it might just come down to something like a severely pulled muscle... but they don't know and suggest watching it for the next couple of days.  It's strange because I can't recall doing anything that would cause a muscle tear.

The net of it, though, is that: a) spending 10-ish hours in airplanes getting over there is going to be very painful; and b) if anything gets worse, I don't really want to be going into a hospital in Sweden... (and then fighting with US health insurance about coverage!)

So very unfortunately, it looks like I'm going to have to miss out on this one... which is a severe disappointment!  I know that folks there will have fun... and I'm looking forward to hearing/reading about all the went on (including the Blue Box dinner tomorrow night).

As Jeff Pulver notes today, he'll be once again hosting a big party at his VON Europe Spring 2007 in June in Stockholm.  Jeff's events are definitely always interesting... and I'm looking forward to being at this one.  If you're going to Stockholm, I'll see you there!

In a few short hours, I will be catching a plane heading out to Fort Huachuca, Arizona, to swim in an alphabet soup of very different acronyms and jargon than my normal work - the "OSD-Sponsored, JITC-Hosted DOD Telecommunications Services Information Conference".  As noted on the page:

The purpose of the conference is to provide an open forum where DOD and vendor representatives can discuss issues related to interoperability of systems providing DOD Telecommunications Switched Services.

The conference will present the current program and discuss ongoing developments to the interoperability certification and information assurance procedures and test documentation. Other topics for discussion include emerging technologies, standards and their integration into the systems providing DOD Telecommunications Services.

I attended last year as well and it's definitely an interesting experience.  The US DoD is really doing some intriguing things with how they make use of VoIP / IP Telephony.  Obviously security is rather important.  They are also driving IPv6 adoption into their infrastructure and so, with the June 2008 mandate only a year away, it will be quite interesting to hear where they are with regard to IPv6 adoption.  Obviously, their huge size and buying power is of strong interest, so the number of vendors will no doubt be high.  Also, and I would think "obviously", I won't exactly be writing about things that I hear or learn there.

If any of you reading this happen to be out there at the conference, do drop me a note as I'm always interested in meeting readers or listeners.

Two of the cool "events" at the Emerging Telephony conference last week were the "Mashup Contest" and the "LaunchPad" (sponsored by GigaOm). In both cases new companies or developers were able to show off their products. I was going to write up my thoughts and summary, but it turns out that Alec Saunders posted about all the companies and included video of their presentations.  Definitely worth a look to see what companies are doing around emerging telephony apps and services.  Thanks to Alec for recording them all.

I mentioned it previously, but James Duncan Davidson has now put the set of photos he took for O'Reilly up on Flickr.  So if you would like to vicariously experience the conference, check out the set.  I particularly liked this one to the right (click for the larger image).  Just a great use of focus and depth of field.  The person in focus is actually Jay Phillips, developer of Adhearsion, a Ruby framework for building applications on top of Asterisk.

I was rather dumbfounded a few minutes ago when I went down to the kiosk in the hotel lobby to print my border passes.  After logging in to United's webs site, I was immediately confronted by a big warning message:

Due to cancellations you have been rebooked onto the following flights:

<new flight info>

[No thank you]                                         [Accept this flight]

"No thank you?"  Huh?  You have just been told that due to cancellations you are being rebooked - so why would you NOT choose "Accept this flight?"  What happens if you press "No thank you"?  Could you try another route?  In this case would I have actually been booked on the same flight?  Huh?  (Needless to say, I didn't try it.)

I guess the good news is that I'll be avoiding Chicago tomorrow and flying down to DC (to Dulles) and then from there to Burlington. The other good news is that I'm not going to have to be at the airport at 4:45 in the morning... the bad news is that the flight gets in 2 hours later... but hey, I just want to get home!

When I go to conferences, I usually wind up taking many shots of other people and events, but I naturally almost never wind up with any actual pictures of me. So it was a bit fun to find out that the photographer taking pictures for O'Reilly is posting all the pictures to a Flickr photo set, and that there were a couple of pictures of me included (click on the pictures to go to the Flickr pages and larger photos).  I was a bit amused to see that my mouth was wide open in both of them, but then again, I was in the middle of presenting so of course that would be the case.

I just have to say kudos to O'Reilly for doing the "Web 2.0" or "social media" thing of posting all these photos to Flickr... and tagging them all appropriately.  Given that they are a company that produces conferences like "Web 2.0", it rather makes sense that they would walk the talk, but it's just good to see.

Which of these two photos do you like the best?  I think I like the one on the left a bit better.  Many other good photos of the rest of the conference are part of the Flicker set.

So "the talk" finished around 11:15am this morning... I've just been straight out and unable to blog until now.  The "Black Bag Security Review" was fun to do and I've been receiving a great amount of positive feedback and kind words from folks here.  As you'll see below, I'm going to include the slides here in Flash (I finally get a reason to experiment with SlideShare!).  I'll put a PDF up here as well once I get back to Vermont.  It seems that after my laptop was reformatted, I never re-installed Acrobat to do PDF exports.

However, the slides aren't really that much use without the audio, but I'll be putting the audio up on Blue Box sometime in the next week or so and will post an update here with a link. 

Had a couple of interesting questions and points of feedback about the talk (and things I noticed):

• Yes, there were actually 243 slides and yet it came in a hair under 15 minutes.  This is a very different way of presenting than a "traditional" deadly PowerPoint presentation.  More slides... minimal text... fast transitions.  The point is to accent your story and leave the focus on you and what you are saying.  Keep people focused on you and the story you are telling... not getting them lost in reading a slide full of text.  One or two words maximum on a slide.
  
• Someone commented that the preso was like something from Lawrence Lessig. Indeed, he was definitely someone whose style I have always deeply appreciated and yes, my style was similar to some of his presos.  I've been integrating "story" elements into presentations for a good number of years whenever I can and every once in a while I get to do a preso like this one today that is entirely in a minimalist style focused on a story.  Similarly I've always appreciated Cliff Atkinson's work with "Beyond Bullets" encouraging people to focus on a story versus bullets.  Lawrence Lessig is definitely a master of the style and I admire what he does.  When I first saw him at one of the Open Source conferences, it really showed to me the power of the delivery form - and I knew I was in the presence of a masterful presenter. If you want to see him in action, check out his "<free culture>" presentation available from EFF.  (It is also well worth a listen for the subject matter as well.)  So yes, there was a definite similarity... I like learning from the masters, and he's definitely one in this style of presentation.  Personally, I wish more people would present this way.
  
• On technical issues, someone pointed out to me that SysAdmin Steve's VoIP system would have been secure "out of the box" with any of today's enterprise IP-PBXs.  He stated that any of the recent enterprise systems from my own employer, Mitel, or from Cisco, Avaya, Nortel or others would provide most all of the security Steve needed.
  
  He's right to a degree... with any of those enterprise IP-PBXs the system could have been secured right away.  But the question is whether or not they are secured by default.  In my story, the IT staff who implemented the VoIP system (and subsequently quit) installed it without any security.  Perhaps they installed it and didn't enable required security options.  Perhaps they turned the security features off.  Perhaps the IP-PBX didn't have it in the first place.  I didn't get into naming vendors... I was really painting a worst case. Now I know that in Mitel's case, encryption of both voice and call control is enabled by default and you actually have to work at it to turn it off - and while encryption doesn't solve all the problems, it solves many and makes others harder.  I don't actually know about the default posture of recent Cisco, Avaya and Nortel switches, but if things like encryption are not on by default, there are definitely options to turn them on.  All of the major venders in the enterprise IP-PBX space have the capability - TODAY - to provide secure VoIP.  We have to, because enterprises demand it.
  
  That was really part of the point that I was trying to make - you can implement secure VoIP in the enterprise today (at least up to the SIP trunk space).  You'll note that SysAdmin Steve did enable all those features in whatever IP-PBX he had.  So in the end, he did  have secure VoIP.
  
  It was good feedback, though, and should I do another talk like this, I might consider adding a slide that explicitly mentions that enterprise IP-PBXs today can address these issues.
  
• Another person asked about why I focused only on SIP.  Well, the answer is pretty much...  15 minutes.  That's the amount of time I had to do this talk.  In the 90 minute session that Jonathan, Shawn and I did back on Tuesday, we discussed how while these tools focus on SIP, there are others for the other protocols, and some like the RTP attacks are rather independent of the signalling protocol.
  
• One thing I noticed... in an effort to get done in my allotted time, I did not have an introductory slide about me.  I thought about it, and actually had one in one rev of the deck, but then killed it to just jump right into the story.  While this worked great for the flow of the story and also for keeping on time, it had the unintended effect of causing at least one writer to assign me an affiliation.  VoIP News was doing live blogging of the show and wrote this: "Dan York of CIISP is talking about the security challenges in VoIP..."  Welllll... not quite.  CISSP is really the premier security certification... but hey, I give VoIP News a lot of credit for doing "live blogging"... tough to do. And my mistake... another time I'll put in an affiliation slide at the beginning.
  
• Speaking of affiliations, I was a bit disappointed that at the very end, the AV guys killed off my almost-final slide and put the ETel transition slides up there before people could really see my slide title and the URLs (shown on right).  I thought it was just a great little nod to the Canadian heritage of my employer!  (And I was hoping people could see the URLs for more than 2 seconds...) Ah, well!
  
• And yes, this is "Part 1" of "The Story of SysAdmin Steve"... "Part 2" will have to wait for another conference!  ;-)

With that, I'll end the commentary and just try out the embedding of the SlideShare object.  Like I said, it doesn't really do a whole lot without the audio... but I'll put it up here for folks who want to check it out:

Comments, feedback and opinions are definitely all welcome.