The cr.yp.to blog


Newer (Access-K): 2015年03月14日: The death of optimizing compilers: Abstract of my tutorial at ETAPS 2015. #etaps #compilers #cpuevolution #hotspots #optimization #domainspecific #returnofthejedi
Older (Access-J): 2014年06月02日: The Saber cluster: How we built a cluster capable of computing 3000000000000000000000 multiplications per year for just 50000 EUR. #nvidia #linux #howto
Table of contents (Access-I for index page)
2025年10月05日: MODPOD: The collapse of IETF's protections for dissent. #ietf #objections #censorship #hybrids
2025年10月04日: NSA and IETF: Can an attacker simply purchase standardization of weakened cryptography? #pqcrypto #hybrids #nsa #ietf #antitrust
2025年09月30日: Surreptitious surveillance: On the importance of not being seen. #marketing #stealth #nsa
2025年04月23日: McEliece standardization: Looking at what's happening, and analyzing rationales. #nist #iso #deployment #performance #security
2025年01月18日: As expensive as a plane flight: Looking at some claims that quantum computers won't work. #quantum #energy #variables #errors #rsa #secrecy
2024年10月28日: The sins of the 90s: Questioning a puzzling claim about mass surveillance. #attackers #governments #corporations #surveillance #cryptowars
2024年08月03日: Clang vs. Clang: You're making Clang angry. You wouldn't like Clang when it's angry. #compilers #optimization #bugs #timing #security #codescans
2024年06月12日: Bibliography keys: It's as easy as [1], [2], [3]. #bibliographies #citations #bibtex #votemanipulation #paperwriting
2024年01月02日: Double encryption: Analyzing the NSA/GCHQ arguments against hybrids. #nsa #quantification #risks #complexity #costs
2023年11月25日: Another way to botch the security analysis of Kyber-512: Responding to a recent blog post. #nist #uncertainty #errorbars #quantification
2023年10月23日: Reducing "gate" counts for Kyber-512: Two algorithm analyses, from first principles, contradicting NIST's calculation. #xor #popcount #gates #memory #clumping
2023年10月03日: The inability to count correctly: Debunking NIST's calculation of the Kyber-512 security level. #nist #addition #multiplication #ntru #kyber #fiasco
2023年06月09日: Turbo Boost: How to perpetuate security problems. #overclocking #performancehype #power #timing #hertzbleed #riskmanagement #environment
2022年08月05日: NSA, NIST, and post-quantum cryptography: Announcing my second lawsuit against the U.S. government. #nsa #nist #des #dsa #dualec #sigintenablingproject #nistpqc #foia
2022年01月29日: Plagiarism as a patent amplifier: Understanding the delayed rollout of post-quantum cryptography. #pqcrypto #patents #ntru #lpr #ding #peikert #newhope
2020年12月06日: Optimizing for the wrong metric, part 1: Microsoft Word: Review of "An Efficiency Comparison of Document Preparation Systems Used in Academic Research and Development" by Knauff and Nejasmic. #latex #word #efficiency #metrics
2019年10月24日: Why EdDSA held up better than ECDSA against Minerva: Cryptosystem designers successfully predicting, and protecting against, implementation failures. #ecdsa #eddsa #hnp #lwe #bleichenbacher #bkw
2019年04月30日: An introduction to vectorization: Understanding one of the most important changes in the high-speed-software ecosystem. #vectorization #sse #avx #avx512 #antivectors
2017年11月05日: Reconstructing ROCA: A case study of how quickly an attack can be developed from a limited disclosure. #infineon #roca #rsa
2017年10月17日: Quantum algorithms to find collisions: Analysis of several algorithms for the collision problem, and for the related multi-target preimage problem. #collision #preimage #pqcrypto
2017年07月23日: Fast-key-erasure random-number generators: An effort to clean up several messes simultaneously. #rng #forwardsecrecy #urandom #cascade #hmac #rekeying #proofs
2017年07月19日: Benchmarking post-quantum cryptography: News regarding the SUPERCOP benchmarking system, and more recommendations to NIST. #benchmarking #supercop #nist #pqcrypto
2016年10月30日: Some challenges in post-quantum standardization: My comments to NIST on the first draft of their call for submissions. #standardization #nist #pqcrypto
2016年06月07日: The death of due process: A few notes on technology-fueled normalization of lynch mobs targeting both the accuser and the accused. #ethics #crime #punishment
2016年05月16日: Security fraud in Europe's "Quantum Manifesto": How quantum cryptographers are stealing a quarter of a billion Euros from the European Commission. #qkd #quantumcrypto #quantummanifesto
2016年03月15日: Thomas Jefferson and Apple versus the FBI: Can the government censor how-to books? What if some of the readers are criminals? What if the books can be understood by a computer? An introduction to freedom of speech for software publishers. #censorship #firstamendment #instructions #software #encryption
2015年11月20日: Break a dozen secret keys, get a million more for free: Batch attacks are often much more cost-effective than single-target attacks. #batching #economics #keysizes #aes #ecc #rsa #dh #logjam
2015年03月14日: The death of optimizing compilers: Abstract of my tutorial at ETAPS 2015. #etaps #compilers #cpuevolution #hotspots #optimization #domainspecific #returnofthejedi
2015年02月18日: Follow-You Printing: How Equitrac's marketing department misrepresents and interferes with your work. #equitrac #followyouprinting #dilbert #officespaceprinter
2014年06月02日: The Saber cluster: How we built a cluster capable of computing 3000000000000000000000 multiplications per year for just 50000 EUR. #nvidia #linux #howto
2014年05月17日: Some small suggestions for the Intel instruction set: Low-cost changes to CPU architecture would make cryptography much safer and much faster. #constanttimecommitment #vmul53 #vcarry #pipelinedocumentation
2014年04月11日: NIST's cryptographic standardization process: The first step towards improvement is to admit previous failures. #standardization #nist #des #dsa #dualec #nsa
2014年03月23日: How to design an elliptic-curve signature system: There are many choices of elliptic-curve signature systems. The standard choice, ECDSA, is reasonable if you don't care about simplicity, speed, and security. #signatures #ecc #elgamal #schnorr #ecdsa #eddsa #ed25519
2014年02月13日: A subfield-logarithm attack against ideal lattices: Computational algebraic number theory tackles lattice-based cryptography.
2014年02月05日: Entropy Attacks! The conventional wisdom says that hash outputs can't be controlled; the conventional wisdom is simply wrong.

2015年02月18日: Follow-You Printing: How Equitrac's marketing department misrepresents and interferes with your work. #equitrac #followyouprinting #dilbert #officespaceprinter

Technische Universiteit Eindhoven removed all of its old printers earlier this year, and installed new printers featuring "Follow-You Printing". Here's the user experience printing a document with Follow-You Printing (after various one-time steps such as telling your computer how to talk to the printing system):

  1. On your computer, click "Print".
  2. Wait long enough for the document to upload.
  3. Go to the printer room.
  4. Pick up your printout? No: the printout isn't there, and won't be there unless you take action. Swipe your ID card.
  5. The printer is now contacting a login server. Wait for the screen to change. No, you can't type ahead.
  6. Push "Follow-You Printing".
  7. The printer is now contacting a server that has your document. Wait for the screen to change.
  8. Push "Select All".
  9. Wait for the start button to change from red to blue.
  10. Push the start button. The printer is now starting to process your document.
  11. Push the Access button to log out.
  12. Make sure that the screen changes to ask for a user name and password.
  13. Unless you enjoy further exposure to printer fumes, go back to your office.
  14. Wait long enough for the printing to finish.
  15. Go back to the printer room.
  16. Pick up the document.
  17. Go back to your office.

For comparison, here's the user experience printing a document with a sane printing system:

  1. On your computer, click "Print".
  2. Wait long enough for the document to upload and for the printing to finish.
  3. Go to the printer room.
  4. Pick up the document.
  5. Go back to your office.

The university's announcement of Follow-You Printing included two advertisements:

No matter what the merits of these corner cases might be, they obviously don't justify slowing down the normal case, and people don't enjoy having their time wasted. So there were complaints, and meetings, and more complaints, and the start of an online petition for the managers to turn on the "Direct Printing" option. But the university didn't budge. A faculty member, obviously puzzled, reported that he "got essentially nowhere" in a meeting with the relevant authority: "The university is not planning on changing this. Even though it is a simple question of enabling the choice in the software—it’s not more complicated than that."

I would like to think it's this simple: as Napoléon allegedly said, "N’attribuez jamais à la malveillance ce qui s’explique très bien par l’incompétence". Unfortunately, there's ample evidence of what's actually going on here, and it's not adequately explained by incompetence.

The marketing. Equitrac, now owned by Nuance, advertises itself as providing "the world's most popular print management software", and in particular providing Follow-You Printing. Equitrac says that its software is "the leading pay-for-print solution for colleges, universities and school districts" and is deployed in "more than 10% of the Global 500 companies".

Equitrac's online case studies include quotes from managers with serious-sounding titles: Chief Information Officer, Technology Director, Senior Systems Engineer, Program Administrator for Media Services, Finance Director, etc. Equitrac's advertising is clearly aimed at such people, telling them about "cost control" and "maximum savings" and "complete accountability" and "a reduced burden on IT" and "a smaller hit on corporate budgets".

Equitrac says, for example, that the University of St. Thomas dropped from "2.5 million pages to 1.3 million printed pages in the first semester" after deploying "Equitrac Express". Maybe some of the reduction can be explained by general societal trends, but presumably most of the reduction comes from replacing a students-print-for-free policy ("non-tracked free use of computer lab printers") with a students-pay-for-printouts policy ("a print quota of 400 pages per semester, with output over that charged to the student at 10¢ per page").

Okay. What does this have to do with Follow-You Printing?

Equitrac claims that Follow-You Printing "can reduce printed output by 10-20% on average". Even better, Equitrac claims that this reduction happens "with no impact to users"; that it happens without the users "ever knowing it or consciously changing their behavior".

Obviously we, the users, are quite aware of the annoyance of Follow-You Printing, but this doesn't imply that we're aware of the reduction in our print volume, so it doesn't directly contradict what Equitrac is saying. Let's look more closely at what Equitrac would like the CIO to believe about our printing habits and about the impact of Follow-You Printing.

Myth: The volume of paper in the recycling bin demonstrated that our printing was wasteful. Equitrac thinks that "looking at the piles of paper in the recycling bin" proves that our printing was "unnecessary". Specifically, Equitrac claims that recycling bins are "full of wasted paper, unused prints and multiple copies of the same document". Equitrac also claims that these bins send a "message" of "we know that you are going to print stuff you don’t need, so here’s a place to put it". In its Peirce College case study, Equitrac claims that there was "an estimated waste factor of 30–50%" based on "the amount of paper left in recycling bins and on paper trays".

Reality: As a scientist, I spend a considerable fraction of my time skimming scientific papers, and of course the screen is much faster for this than a printout. However, sometimes I go through a paper in depth, and in these cases I find it noticeably faster and noticeably more reliable to read (and take notes on) a printout. Some of these printouts have long-lasting value, but for most printouts there comes a point when I'm reasonably sure that I won't look at the printout again. I'll often reuse blank spots as scrap paper, but if it becomes clear that a printout is no longer worth keeping then I'll recycle it.

Does the presence of this printout in a recycling bin mean that the printout was "unused", and that the printing was "wasted" and "unnecessary"? Of course not. The printout was important for me: I needed the printout to do my job efficiently. The entire impact that I can see from Follow-You Printing, and from Equitrac in general, is to make my job more difficult. I hope that writing this blog post will save others from the same fate.

These self-printed documents aren't my entire contribution to the recycling bin: I also recycle documents that I receive through the mail and that I wasn't responsible for printing in the first place. Often these documents aren't useful, and occasionally I go to the effort of actively telling the senders that they really shouldn't be sending me physical mail. But almost all of these documents (at least by volume) are professional or semi-professional mass mailings, obviously not the sort of thing that would be stopped by a CIO burying work printers in the tar pit of Follow-You Printing.

Maybe the CIO stores everything he ever successfully printed (including all his incoming email?) in his filing cabinet. Maybe he doesn't recycle anything other than mistaken printouts. Maybe he assumes that everyone else shares his printing habits. When Equitrac claims that recycling bins are "full of wasted paper, unused prints and multiple copies of the same document", maybe he believes them. Why else would Equitrac put this sort of garbage into their advertising?

Myth: The destruction of documents by Follow-You Printing demonstrates that our printing was wasteful. Equitrac paints a picture of several reasons for our flood of "unused prints": "a newer version was printed, the user got distracted and forgot about the document, the user realized they didn't need to print it, etc." Equitrac claims that Follow-You Printing provides "reduction" of such "waste" via "expiration on jobs sent to the Equitrac print queue". As a concrete example, Liverpool John Moores University found that "up to 25% of jobs" on "many devices" using Follow-You Printing were never actually retrieved (i.e., actually printed) by the user; Equitrac says that it has "heard many more stories in the 10–20% range". Equitrac quotes the LJMU Senior Systems Engineer as saying that LJMU saved "80,000ドル per year" from "4.5 million unprinted pages" eliminated by "Equitrac’s automatic erasing of unreleased print jobs".

Reality: Eindhoven switched only very recently to Follow-You Printing, and my job there is only 20% time, but I already have enough experience with Follow-You Printing to clearly see its impact.

Last week I printed several important documents before a short trip to a meeting in Germany. As a direct result of the time consumed by Follow-You Printing, I almost ran out of time to finish printing the documents before catching the train. If I hadn't started the printing far enough in advance then it's entirely possible that, after clicking Print, I would have realized the futility of trying to extract my documents out of Follow-You Printing in the time available, and I wouldn't have bothered going to the printer. I would have wasted time on the trip compensating for the lack of the printouts that I needed.

Equitrac would have marked this as a successful reduction in printing costs ("without your users ever knowing it"). Equitrac would have described my un-retrieved printouts as "waste" avoided by the Follow-You Printing system. No, damn it, it's not waste. The core of the Equitrac message, "didn't need to print it", is simply wrong. We agree on the result from the printer's perspective, namely a printout not happening, but Equitrac incorrectly describes this as a good thing, when in fact it's a perfect illustration of what's wrong with the Follow-You Printing system.

Equitrac doesn't say "We turn printing into such an annoying, time-consuming experience that we sometimes succeed in saving you money by stopping your users from collecting the printouts they need." Equitrac says that printouts are skipped because "a newer version was printed, the user got distracted and forgot about the document, the user realized they didn't need to print it, etc." Nowhere, as far as I can tell, does Equitrac even acknowledge the possibility that the documents destroyed by Follow-You Printing are documents that we actually needed to print.

Furthermore, now that I know that Follow-You Printing is in place, I find myself somewhat more casual about clicking Print: after all, I can decide later to skip printing the document! If in fact I don't pick up this document, then Equitrac assumes that the document would have been a "wasted" printout without Follow-You Printing; Equitrac reports the deletion to managers as "waste reduction", and advertises how much it's reducing carbon emissions. But this is all wrong. Without Follow-You Printing, I would have skipped clicking Print in the first place.

The fantasy world of the CIO. The reason that Equitrac's bogus advertising is important is that CIOs make decisions on the basis of bogus advertising. Here's what the CIO thinks of you after listening to Equitrac:

It should be obvious what the same CIO will be thinking if you complain that Follow-You Printing consumes your time:

What makes your complaints ineffective is that you aren't even recognizing, let alone responding to, the core Equitrac messages—"didn't need to print it" and "cost control".

What the CIO needs to hear is that the Equitrac advertising is wrong. The reality is that we do need to print it, and Follow-You Printing is interfering with this. Follow-You Printing's real strategy to save money is to take the worst moments for a printing delay, the moments when we really need to print something in a rush, and to destroy those printouts.

As for "cost control": Follow-You Printing costs the organization money for every printout, because it takes away time that we should be putting into our jobs. On occasion Follow-You Printing forces us to abandon a printout that we need, saving a little bit of money but costing us even more time. My current estimate is that the costs every year add up to several hours for the average person: certainly more than an hour. For comparison, a savings of "80,000ドル per year" (under highly questionable assumptions; see above) might sound impressive, but that's at a university with 27000 people and a yearly budget above 100,000,000ドル. Would you sacrifice hours of your time to save under 3ドル?

Sometimes managers think that they can get away with reducing costs by imposing burdens on existing employees. However, small stories of an unsupportive work environment end up having a large effect on the organization's efforts to attract and retain top personnel, and ultimately this ends up costing the organization much more than its printing budget. The bottom line is that replacing direct printing with Equitrac Follow-You Printing is a mistake.

[2022年01月09日 update: Updated links above.]


Version: This is version 2022年01月09日 of the 20150218-printing.html web page.

AltStyle によって変換されたページ (->オリジナル) /