Technology News
Sunday
Mar282010

How to Make a Software Project Succeed

Software is taken for granted.  Of all the things that humans can build, what else compares to software? An architect designs a house with known parameters, such as gravity, terrain, climate, plumbing specifications etc… The environment that a home is in may fluctuate, even to extremes, but a home will stand.  Houses are fairly standardized—they usually have a front and back door, x number of windows and all of the other usual features we expect from a typical home.

Enter a software application—the foundation on which it stands can change weekly via software operating system updates. There may be many entry points and exit points within an application—some of them are hidden to the software user.  There are usually hundreds, if not thousands, of dependent actions in a typical application.  Conversly, a home has a trivial set of dependencies:  you open or close a door, when it rains the water must flow into gutters, the trusses must be strong enough to support a maximum specified load etc…

There are many complexities that must be considered when architecting and managing a software application.  These complexities are often not fully realized.  Project managers, senior management, and potential customers underestimate the complexity of dependency—the intricate web of dependent actions and reactions that are required to enable a software application to deliver its advertised features.  To further exasperate the situation, developers often underestimate the complexity and magnitude of dependencies that they must account for to deliver a feature.  Let’s face it, the good developers are Creators of Software—in an almost Biblical sense. As such, the good developers are frequently overtaken by the power of creation at their fingertips and can easily underestimate the level-of-effort type metrics that managers need to estimate a project timeline.

To put it simply software projects succeed when all responsible parties understand complexity and human nature.  When developers are cognizant that they may not know what they don’t know, estimates become more accurate.  Managers understanding  a developers code-creationist mentality, can interpret their often optimistic  project estimations. 

Having software project managers that are intimate with code can be a great help as well.  Software cannot be created on an assembly line.  Trying to pump out code faster is not as simple as turning up the “speed” knob on the assembly belt.  Managers shouting down the line don’t increase productivity either with mind workers—typically this has the opposite effect. Performance anxiety is a code killer as with many other ares in life.  If a developer has a manager breathing down his or her neck—guess what their not going to be thinking about—code. A management team that understands these principles will pay big dividends.

 Remember the complexity/dependency discussion? This takes concerted concentration by developers in order to not “miss” anything when developing code.  Anything that interferes with a developer’s thought process lowers their productivity in the same way a factory worker’s productivity would decline if you added an extra assembly line belt for them to work on simultaneously.  Let the developer devote their mind exclusively to one task—writing code!  To supercharge this concept, provide developers with an atmosphere that mitigates thought process interruptions.  Most thought process interruptions are from co-workers or management inquiring about projects and/or adding new requirements.  The other, often not considered interruptions, are loud office spaces (i.e. conference calls on speaker-phone, high foot traffic developer work spaces, and even non-coders being located with developers which can increase office cross-talk).

Lastly, complexity must be managed and reduced where at all possible. The most elegant code, is very often not the most maintainable and understandable by anyone but the person who created it ( and often this isn’t true over time).   Disk space and processing power are relatively cheap—always write a few lines of extra code that lends to clarity over efficiency—if you like successful software projects. To mitigate complexity, write code that mimics life.  Code can mimic life by having flow control sequences that match the order of events that must happen in real life.  Objects can be created that match the real-world object (i.e. a file cabinet contains folders—folders contain documents, documents have paragraphs, paragraphs have sentences etc…).  In nature many seemingly complex processes occur, but when scientists study these processes, they find pristine simplicity.  To quote Albert Einstein, “Everything should be made as simple as possible, but not simpler.” 

The topics mentioned in this article are general areas that lead toward the success of software projects—but areas that are commonly overlooked. 

Friday
Apr242009

As Green as I Wanna Be

I admit, mother earth probably doesn’t have the warmest feelings for me (pardon the pun), but I do beleive that green technologies hold the promise of ushering in an era of ecological and economical salvation for humankind.  Why am I only”as green as I wanna be” you ask?  In most cases, being green just isn’t practical for gadget lovers and technologists.  I am not saying that being green isn’t important, but until being green becomes highly practical, not a headache to technology users, and performs as well or better than non-green stuff, the practice is not going to be adopted widely enough to make a noticeable difference. If a gadget can bio-degrade in a friendly way and be within the targeted price point, then I’m all for it, but where are these products?

Let me give you an example.  How many corporate workstation users deliberately leave their workstations on so that when system updates are pushed out overnight, they are already installed when they get to work the next day?  So, leaving my laptop on at work on while I am sleeping in bed (with it being set to hibernate) uses less electricity than the lamppost outside my door (with a 60 watt light bulb)—you know the one my homeowner’s association says I must have.  The laptop is putting my employer back less than 10 cents per day that I leave my laptop on outside of business hours. To the typical stressed out office worker, the 5 to 10 minutes it may take to boot up their workstation is worth much more than 10 cents, with carbon emissions a nascent thought. 

On a positive note, PC makers are using greener materials and I am all for that as long as it doesn’t affect my user experience in a negative way.  I mean, after all, we have been working hard to keep Moore’s Law going strong and Moore definitely isn’t helping on the power consumption front.  More transistors equate to higher performance and, with today’s semiconductor technology, more energy consumption.  Areas where performance has been increased without increasing energy consumption are in the use of mult-core processors. The same rules apply to the transistor counts in a core, but adding more cores improves the megaflops per watt consumed by a typical CPU.  While a little questionable in its reasoning, Wikipedia lists the MHz-to-watts  ([loosely]speed- to-power) ratios of all the main line consumer CPUs.  The wikipedia article demonstrates a point—if you note the Celeron line, typically used in mobiles, versus the Core 2 Duo processors, typically used in desktops, the speed to power ratio is much lower with the mobile CPUs.  Good for the green minded, bad for the performance minded.  

Some may be tempted to make the analogy between sports cars and the need for the extra power that typically doesn’t ever get used in commuter driving (so why would anyone want a sports car then?). Sports cars waist energy just idling at the stop light.  This analogy CANNOT be used with computer processors. Higher performing processors DO mean better application performance (assuming RAM and video are up to par).  An application user gets the opportunity to utilize the full power of the CPU much more so than a commuter with a tricked-out ‘vette.

Sunday
Mar082009

Self, what is it that I do?

Throughout the, often stormy, journey of deciding what I think I can contribute to  prospective employers, I have frequently pondered my job title.  Heck, I have even conferred with industry greats to glean what they would consider my most appropriate job title would be considering my interests, abilities, and aspirations.  I have often been ashamed of my very broad areas of experience.  The shame stemming from a self-contrived notion that not being a profound expert in one succinct area of IT made me a loser among geekdom. 

Over time, I have learned from managers, coworkers, and through self-observation that I am really good at making end-to-end solutions work—especially in areas where “no man has gone before.”  Fringe system integration solutions seem to materialize in my mind with relative ease.  Being very knowledgeable of many different IT technologies and approaches to integrating technology, as it turns out, does fit a job title pretty nicely.  I find that I am well suited to being an Architect.  While being an expert in every facet of an IT project is not typically a requirement—being really knowledgeable in most of the areas is very useful.  As an example—you might not need to know the most efficient method for executing a CRC checksum on a binary blob, but you must know that a coder on the project needs to develop an efficient method.   A broad swathe of technological know-how, the ability to communicate well, and an innate ability to lead make the best IT  Architects., in my opinion at least.

IBM has a very nice description of what an IT Architect is:

In terms of position in the organization, the architect is the technical lead on the project and should have the authority to make technical decisions. The project manager, on the other hand, is more concerned with managing the project plan in terms of resources, schedule, and cost. Using the film industry as an analogy, the project manager is the producer (making sure things get done), whereas the architect is the director (making sure things get done correctly). As a result of their positions, the architect and project manager represent the public persona of the project and, as a team, are the main contact points as far as people outside the project are concerned. The architect, in particular, should be an advocate of the investment made in creating an architecture and the value it brings to the organization.

The architect is also involved in organizing the team around the architecture and should actively contribute to planning activities as a result, since dependencies in the architecture translate to the sequencing of tasks and therefore the skills required at particular points in time. On a related note, since the success of the architect is closely linked to the quality of the team, participation in interviewing new team members is also highly appropriate.

So, I am happy to announce this shift in my professional repertoire.  For the near-term, a life of Architecture is where I will be focussing my attention.  I hope to meet many more Architects that might be out there along the way.  SHOUT OUT!

 

Tuesday
Jan132009

Calling all Project Managers: When Do We Start Planning For The Survival Of The Species?

Really, I am not paranoid, but as I read the news and see all the ballyhoo made over relatively benign issues that face the earth, I have to ask—what about the human species?  We (earthlings) plan for, seemingly, everything else, but what about “us” in a few eons and beyond?

Let’s, look a this.  How many species killing scenarios are there to choose from?  It’s not hard to find enough of them to fill a volume of encyclopedias.  We’ve got plagues, volcanoes, sunamis, asteroids, cosmic rays, etc., you name it.—we’ve got it.  For instance, there is the Andromeda and Milky Way galaxy collision—estimated contact: 2-5  billion years, plus or minus. There is a good chance that our sun won’t collide with any of Andromeda suns, but do you bet the species on that?  Maybe we don’t need to worry about galaxies colliding as the sun is going to burn out in 5 billion years anyways.  I am not so much talking about the calamities that might happen; for god sakes, I am talking about the ones we know are going to happen.

Let’s get closer to home now.  On February 1, 2019, a two kilometer wide asteroid (2002 NT7) might hit the earth. Is this the same as, it might rain today?  If there is a 1% chance of rain, my hair might get wet.  If the asteroid hits it might destroy a continent and drive the into earth to a deep ice age. Even with Yellowstone’s recent heightened activity—it seems that the people of the planet are blowing it off (no pun intended). Scientists know that the Yellowstone caldera blows up every 600,000 years or so, and we are estimated to be about 640,000 years into the next cycle.  There are various assumptions about the resulting aftermath of this eruption,  everything from 2/3 of North America becoming an ash strewn wasteland to the planet going into extreme cooling with little sunlight for growing food (i.e. global starvation).  Project managers—what are you doing to deal with this?

I think we know that the “important” people of the earth will be taken care of ,at least for a while, but what about the masses?  It seems to me that the governments of the earth are being a little irresponsible here!  We know that bad things are coming—not might be coming!  Nevertheless,  we get all discombobulated over oil prices and whether or not we have global warming.  Global warming over global destruction….hmmmmm.

So what are we doing to prepare?  I don’t know.  Maybe we should be looking into things like: 

  • Living under the sea. We came from the sea anyways—we might need to return there.  The sea takes a long time to cool, even if the surface of the earth becomes a frozen wasteland—plus there are tons of geothermal vents in the ocean and food to be harvested.
  • Living underground. Scientists belive that many mammal species survived living underground in past Asteroid hits that darkened the earth—maybe we could too.
  • Build an orbiting, Battlestar Galactica type, armada above the earth.  Why not—we have made a lot of advances in harvesting food in hydroponics fams.  Orbits are fairly easy to sustain for decades if need be.  
  • Become the aliens to other, life sustaining, planets that some think we are currently being visited by.  Who’s to say that by the time we crash into Andromeda that earthlings won’t look like the Greys already?

 

The bottom line is that the world needs to start paying it forward.  There will won’t be an available After Action Review on this one. Well, that’s it for my ranting. Seriously though—-irresponsible people!

 

 

 

Friday
Jan092009

SQL Injection, Still Racking Up Kills!

In this day and age it is hard to imagine that SQL injections are still successful.  An SQL injection attack occurs when a Web user enters SQL structure into an input field on a Web page, subsequently causing data loss,  modification, or theft of private information.  According to Robert McMillan’s article, a U.S. Army Web Site was modified by an SQL injection attack.  Of all the places, a Federal Government Web site was successfully attacked this way? This is a perfect example where mountains of security bureaucracy cannot save you—organizations still need talented, knowledgeable people designing their “world-facing” infrastructure.  

The easiest ways to prevent an SQL injection attack are to use parameters or stored procedures.  With this approach a Web site’s form fields cannot be used to build an SQL command.  A stored procedure can run under a security context that is only allowed limited permissions.  In this way, if a stored procedure was compromised—it couldn’t do anything harmful.  

You will see the term “build an SQL statement” around when researching injection attacks.  Typically novice developers will do something like this when creating a data input form:

insert into logged_in_customer (first,  last, userid)

select  acct_first, acct_last, acct_userid

from customer_accounts

where username=”’ +  username.Text + ”’

The “building” part is in bold and occurs when developers use external data to create or complete an SQL query.  In this example, the where clause is built with a user entered value from a textbox as the criteria.  We would hope that this textbox is being validated for injection on both the client and server side, but lets assume it’s not. What if the user entered the following into the text box:

’ or 1=1 —

This seems pretty innocuous right? Well this simple example would cause every user to be entered into the “logged_in_customer” table.  Let’s break it down:

In username=”’ ,using two single quotes in the where clause creates an escape sequence for the char/varchar data type .  The last single quote terminates the SQL  text string so that we can add (inject) the username.Text.   The trailing set of single quotes follow the same rules.  Can you see what happens here when a bad user enters the first single quote into the textbox?  Yep, the first in ’ or 1=1 —    causes the sql string to be terminated giving complete control over the where clause. So, just with the first single quote, we effectively have username=” , or the username equals an empty value.  In itself, this wouldn’t cause any harm—most likely no user account would be returned.  The or gives us an alternative input value to accept in order for the query to be successful. The 1=1 is always a true statement, therefore the where is always successful and every user would be entered in the logged_in_customer table. In username.Text + ”’ , what do we do with the last two single quotes that are in our original query that are suppose to be escape characters for our desired single quote?  That is where the  comes into play.  In MS SQL Server, two single dashes designate a comment, in which case the database compiler ignores everything following the two dashes until a newline is encountered. Using the comment at the end of our SQL injection prevents the SQL error that would have been returned by the final single quote.   

My example is overly simplistic, but lets you would be amazed at the code that prestigious organizations unknowingly have deployed on their Web sited. Let’s look at possible horror story that could happen from this simple example.  What if a Web site used the logged_in_customer table to prevent more than one user session from being logged in at one time?  This would effectively cause a denial of service to any customer that attempted to log in.