Responding to Uncertainty 3

Even in DC, Authentication is a Guess, writes Gunnar Peterson, and goes on to discuss the security problems faced by a minor politician who can't believe it really is the president-elect on the telephone. 

Gunnar uses the example to illustrate the importance of separating authorization from authentication. In the normal case, authentication involves "piecing together your guess at the reality of the situation and then binding to the principal". 

But risk is not the same as uncertainty, and there are alternative ways of taking risk out of the equation without removing the uncertainty. Sometimes instead of selecting (and binding to) the most likely reality, the best thing for security might be to detect the possibility of impersonation and produce a low-risk response that fits any of the possible realities. 

In other words, you might be authorizing a range of possibilities, and then it is not so critical whether you can reliably authenticate a particular individual within that range. 

So if you don't know whether the caller is a president or a radio prankster, the best thing to do is not to hang up, not to say something foolish, but to find things to say that fit both possible contexts. And if a caller asks for information about your products, and you suspect it might be a competitor, then you give him a bit of information (in case it is a real customer) but not too much. 

This is similar to my earlier points about responding to uncertainty in complex event processing.

Responding to Uncertainty 2

Following my previous discussion on Faithful Representation and Uncertainty, here's another example. Which of the following statements are facts, straightforwardly representing something in the "real world", and which ones are more problematic?

• John has a garden behind his house. Three quarters of the garden is plain green, presumably grass.
  
• There is an object in the garden visible from the satellite picture. It looks as if it might be a rusty lawnmower. It has been there all winter.
• It is nearly Spring. John might need a new lawnmower soon.

All of these statements might be represented by events, which are fed into an event processing system. As a result, the computer sends John an attractive brochure of garden equipment, including a range of lawnmowers.

Note that many of the observations are uncertain. The grass might be artificial, and the rusty object might be an exercise bike. The garden supply company might wish to purchase higher-definition images, or invest in better image recognition software to improve the interpretation of the raw images, but this investment would be wasted unless there was a good chance of increasing the number of lawnmowers sold.

In any case, there are lots of other things that might influence John's purchasing decision. John might have another lawnmower in the shed. He might be too busy to mow his garden, so he pays Harry (who brings his own mower). Meanwhile, John might want to buy a new lawnmower as a house-warming present for his daughter.

From both a business perspective and an engineering perspective, we can construct effective and profitable systems without bothering our heads whether the rusty lawnmower really exists, or whether it is just an unreliable interpretation of pixels on a satellite image. And what about John's desire for a new lawnmower? Does this really exist, or is this just a bit of hopeful speculation by the marketing department?

So I want to build models that include things like probability, intentionality and the future. Do these things "exist" in the real world, or are they some kind of construction? Rick Murphy explores the question of Representation and Realism in the context of the Semantic Web. In a later post on Signs of the Singularity, he argues that because the semantic web follows Tarski, model theory implies realism. "The relation between a model and the world may be only one of approximation, but without realism, technological utopianism quickly precedes to simulacra and simulation."

I don't think it's as simple as all that. And if it was, would it matter?

---

See follow-up post on Analyzing the Rusty Lawnmower.

Responding to Uncertainty

How does a system respond intelligently to uncertain events?

"A person may take his umbrella, or leave it at home, without any ideas whatsoever concerning the weather, acting instead on general principles such as maximin or maximax reasoning, i.e. acting as if the worst or the best is certain to happen. He may also take or leave the umbrella because of some specific belief concerning the weather. … Someone may be totally ignorant and non-believing as regards the weather, and yet take his umbrella (acting as if he believes that it will rain) and also lower the sunshade (acting as if he believes that the sun will shine during his absence). There is no inconsistency in taking precautions against two mutually exclusive events, even if one cannot consistently believe that they will both occur." [Jon Elster, Logic and Society (Chichester, John Wiley, 1978) p 84]

Austrian physicist Erwin Schrödinger proposed a thought experiment known as Schrödinger's cat to explore the consequences of uncertainty in quantum physics. If the cat is alive, then Schrödinger needs to buy catfood. If the cat is dead, he needs to buy a spade. According to Elster's logic, he might decide to buy both.

At Schrödinger's local store, he is known as an infrequent purchaser of catfood. The storekeeper naturally infers that Schrödinger is a cat-owner, and this inference forms part of the storekeeper's model of the world. What the storekeeper doesn't know is that the cat is in mortal peril. Or perhaps Schrödinger is not buying the catfood for a real cat at all, but to procure a prop for one of his lectures.

Businesses often construct imaginary pictures of their customers, inferring their personal circumstances and preferences from their buying habits. Sometimes these pictures are useful in predicting future behaviour, and for designing products and services that the customers might like. But I think there is a problem when businesses treat these pictures as if they were faithful representations of some reality.

This is an ethical problem as well as an epistemological one. You've probably heard the story of a supermarket, which inferred that some of its female customers were pregnant and sent them a mailshot that presumed they were interested in babies. But this mailshot was experienced as intrusive and a breach of privacy, especially as some of the husbands and boyfriends hadn't even been told yet. (A popular version of the story involves the angry father of a teenaged girl.)

Instead of trying to get the most accurate picture of which customers are pregnant and which customers aren't, wouldn't it be better to construct mailshots that would be equally acceptable to both pregnant and non-pregnant customers? Instead of trying to accurately sort the citizens of an occupied country into "Friendly" and "Terrorist", wouldn't it be better to act in a way that reinforces the "Friendly" category?

Situation models are replete with indeterminate labels like these ("pregnant", "terrorist"), but I think it is a mistake to regard these labels as representing some underlying reality. Putting a probability factor onto these labels just makes things more complicated, without solving the underlying problem. These labels are part of our way of making sense of the world, they need to be coherent, but they don't necessarily need to correspond to anything.


Minor update 10 Feb 2019

Clouds and Clocks 3

Some CEP vendors (Aleri, Coral8, RuleCore) are boasting that their CEP software is "deterministic" or "consistent".

In other words, "clockwork" rather than "cloudlike". Mark Tsimelzon, President & CTO of Coral8, insists that we shouldn't think of an event cloud at all - he prefers the concept of event stream.

But what do "determinism" and "consistency" actually mean here, and why are they important?

Both Aleri and Coral8 define “determinacy” to mean that a set of input data produces the same output data.

Aleri adds that the order in which the data arrives doesn’t matter. This only follows from the definition of determinism if we assume that "set" means a pure set, without sequence. Perhaps a better word for this property is "commutativity". There is also the related property of idempotence, in which it doesn't matter if the same event or message appears more than once. Aleri also defines “consistency” to mean that the output is predictable from the input - which sounds equivalent to their definition of "determinacy" - but they go on to say that consistency means that "the results are the ones we’d expect" - which sounds more like correctness to me.

Meanwhile, Mark of Coral8 introduces three degrees of determinism: non-deterministic, single-stream and multiple-stream determinism. He hopes his post has demystified the notion of determinism a little. Er, thanks Mark.

But why does determinism matter? Mark explains that this has to do with testing, especially regression testing. If we cannot compare results from two runs of the same stream of events, then our traditional approach to software testing breaks down. At least, that's the only reason he mentions in his blog.

This is rather like the value of the controlled experiment in science. A laboratory provides a controlled environment, in which most of the variables can be fixed, so that the cause-and-effect can be isolated. Software testing also requires a controlled environment, so that any unexpected variation in results can be reliably traced to a specific cause - such as a software bug.

But complex systems are not particularly amenable to laboratory experiments, because the requisite complexity cannot be properly contained and controlled. And complex internet systems raise a similar challenge.

Determinism may be useful from a software engineering perspective, but it seems to deny some of the technological potential of complex event processing, including machine learning. Surely the whole point of machine learning is that the system doesn't always produce the same results on the same input, but is capable of producing improved results on the same input.

So I'd like to see a wider debate about the limits of determinism. I've been talking about this for a while in an SOA context - see my earlier post on Determinism.

---

Consistency and Determinacy (Aleri March 2008)

Marco Seiriö, Context Management (RuleCore June 2009)

Mark Tsimelzon, Determinism in CEP (Coral8 October 2007)

Mark Tsimelzon, Unclouding and streamlining your thinking about CEP use cases (Coral8 October 2007)


Links via WayBack Machine. Updated 2 December 2014.

Clouds and Clocks 2

Pat Helland regrets ...

Pat Helland has resumed blogging, having recently returned to Microsoft from a sojourn at Amazon. In his latest post SOA and Newton's Universe, he renounces the quasi-Newtonian paradigm of distributed systems to which he adhered for most of his 30-year career, and outlines an alternative paradigm with some resemblance to the Special Theory of Relativity.

The Newtonian paradigm of distributed systems is that we are trying to make many systems appear as the One System. This paradigm may be linked with the idea of the Global Schema or Universal Ontology. Helland contrasts this with an alternative paradigm of distributed systems, in which the systems are entirely dependent on the point of view of the observer, and there is no Universal Ontology. (I'd have wanted to use the term relativistic semantics here, but it has already been bagsied for academic linguistics - see for example Catfood and Buses.)

Helland sees this in terms of a relaxation of consistency. I disagree. Distributed systems-of-systems (including SOA) must follow a consistent logic - but not necessarily a traditional two-valued logic. Flexibility comes from being underdetermined (clouds) rather than overdetermined (clocks).

See my earlier posts Beyond Binary Logic and On Clouds and Clocks. See also Philip Boxer on Modelling Structure-Determining Processes.

Clouds and Clocks

I've looked at clouds from both sides now ...

• Todd Biske: In the Clouds
• Dion Hinchcliffe: SOA will begin to open up more to the Internet cloud
• Joe McKendrick: SOA reaches out to the cloud - will business follow?
• Mark O'Neill: When Enterprise SOAs meet the cloud
• Phil Wainewright: The Internet cloud is one great global SOA

The classic distinction is between clouds and clocks. Clocks follow precise rules, they are under "iron control". Clouds are more complex, and are under "plastic control".

In SOA terms, the term "cloud" is generally used to describe what happens outside the enterprise boundaries, and outside the corporate firewall. SOA is commonly expected to start in areas that are under greater control, and then spread to more complex, less well-controlled areas. Numerous pundits are now predicting this trend for the current year.

But the contrast between clouds and clocks may be a misleading one. In physics, one of the central questions of the twentieth century was whether atoms behaved like clocks (predictable mechanisms) or like clouds (statistical mechanisms). In 1965, Karl Popper gave a lecture called "On Clouds and Clocks", in which he contrasted the assumption of classical atomism (even clouds are composed of tiny clock-like bits) with the modern alternative (even clock-like structures are composed of tiny cloud-like bits).

We can ask a similar question for SOA. Is there really such a strong distinction between (tightly controlled) behaviours inside the enterprise and (loosely controlled or uncontrolled) behaviours outside the enterprise? Or is the cloud (cloudiness) fractal?

Much of my consultancy time is spent with organizations that are just too large and complex to be able to draw simple boundaries. Especially in the public sector and defence sector. As soon as you get past tightly controlled pilot projects, everything typically becomes more cloud-like.

Obituary of Karl Popper, 1902–1994, by John Watkins
Printed in Proceedings of the British Academy, Volume 94, pp. 645–684. 1997

Technorati Tags: SOA service-oriented

Determinism

Should results always be predictable? This question applies both in the development of services (e.g. with model-based development), and in the execution of services. In this post, I'm going to look at a few contrasting examples.

Lucky Search

My colleague Lawrence Wilkes discovered that if you type the word "failure" into Google, and click "I Feel Lucky", you get sent to the official White House biography of George Bush. I wonder if this trick works for everyone. I wonder if it still works when you are reading this.

Not having played with the "I Feel Lucky" button before, I had always imagined it was some kind of non-deterministic selection, although I was prepared to believe that sponsorship might influence the selection. Perhaps someone with a political axe to grind has sponsored the link from "failure" to the White House, or perhaps it's been placed by a Google insider with an interesting sense of humour.

[Update: Here is Google's official explanation]

Of course this kind of thing is not new. Many years ago, I used to work with an enquiry tool called Datatrieve. (I actually used it to build a data dictionary, but that's another story.) If you enquired on "wombat" you got taken to some amusing pre-coded stuff. I guess the programmers thought it was unlikely that anyone would really want to store data on marsupials, so it was a safe term to use for an inside joke.

If the "I Feel Lucky" link has been fixed, then it is more deterministic than the search function, which may produce slightly different results every time (because new web pages containing the word "failure" are added to the Internet every minute).

Predictable Service

Should a service be predictable - should you get the same results every time? Clearly it is hard to test a system composed of non-deterministic services. But there are at least two reasons why the service supplier may be unable or unwilling to provide a guarantee of predictability.

Differentiated Service	The service provider may be entitled to vary the behaviour of the service according to some context information (such as customer status), without being obliged to publish the basis of this variation.
Differentiated Provision	The service provider may wish to avoid specifying certain aspects of the service (such as for example the exact response time) in order to preserve some flexibility in the delivery.

One aspect of predictability is fairness. Differentiated services can be used to give preferential treatment to your friends. (For example, an eBusiness website that offered different prices to different customers.) Such preferential treatment is more difficult to detect if there is some degree of deliberate randomness in the service behaviour.

So we have a loss of predictability for the service consumer, which yields flexibility and other business benefits for the service provider. Predictability and flexibility always benefit someone at the expense of someone else. (This is why SOA needs governance.)

Predictable Model Transformation

One view on Model-Based Development, strongly represented by Microsoft (see for example DevHawk) is that model transformation should be deterministic.

When you compile a given piece of C# code, you get the same IL output every time.

But there is an important caveat. If the platform changes, then of course you get a different output. That's always been one of the attractions of model-based development - that it is not restricted to a single platform.

And here's where it gets interesting. Because if the network is the computer (and why not?) then the platform is constantly changing. The greater the potential variety of the target environment, the greater the intelligence that might be required (perhaps embedded in the model transformation) to achieve the desired fit. And although such intelligence might be deterministic (under certain limiting conditions) it surely doesn't have to be.

So what is the value of this determinism, to whom? If we imagine the model transformation being carried out as a service, does its predictability make it more valuable, and why?

Determinism versus Flexibility

The key trade-off seems to be flexibility. If something is under-determined it leaves room for adaptation. But how is this adaptability governed, and in whose interest. And if we decide that determinism is a good thing in a particular situation, how is this to be guaranteed?