Best is the Enemy of Good Enough...

I've written about this before, but the message is worth repeating now and then so I don't forget...

Sometimes I'll spend hours on something I'm trying to get perfect. "This block of code could be cleaner." or "Progressing through this form doesn't feel very natural now does it?" It's a trap I fall into all the time. (Thankfully I'm getting a little better at catching myself on the edge.)

That's not to say I shouldn't always be trying to do my best! I do however have to accept my best for what it is today, continue to learn from my experiences and improve.

Why do you use 3rd party libraries?

I asked a co-worker why he decided to roll his own javascript remoting framework rather than use something like prototype that would do it all for him. He told me he'd looked into a few, but couldn't find one that just did remoting - they all came more than generously padded with extra cruft he didn't need. I can sympathize with his point of view, but he did get me thinking about the times I've been willing to take on the additional cognitive burden frameworks like Spring, Hibernate, Struts2, etc. add to my projects. Here's what I came up:

• 3rd party libraries are maintained by other people. To put another way, 3rd party libraries are not maintained by me. Which means bugs I get bug fixes for free.
• They're usually the bits of my application that I consider plumbing ie. unrelated to the business problem I'm trying to solve. (eg. Spring, Hibernate) Why am I spending time on problems that don't add value to my project?
  
• Each major revision of a library is more polished/refined than the last. Better abstractions, shifts towards external configuration by xml, shifts back to configuration in code by annotations/intelligent defaults are some of the ways libraries have evolved in recent past to make using them easier.
  
• The very best are used by thousands of developers which makes them battle hardened aka. production ready. Odds are somebody somewhere has run up against bugs I would have otherwise hit in my project. Thanks Somebody!

That's all I've got for now. If I think of any more, I'll add them.

My new Eee pc!

I have no trouble whatsoever seeing this little device becoming indispensable to me. Out of the box, it comes with more than enough software to satisfy the needs of the 80%-ile. (Internet, productivity, media management/playback and games are all well represented.) I thought the "friendly" UI Asus developed would be the first thing I turned off but there are a few things it does right that eventually sold me on it:

- The applications I use the most are maximized by default and can't be made smaller - Firefox, OpenOffice, etc. Asus specifically tailored the experiences of these applications for it's new platform and done it well.
- The little home key automatically minimizes everything instantly so you can see the dashboard. (It brings up the last application you were working in if you hit it again. Again this is instantaneous.) I use this all the time to start new applications.
- My favourite apps couldn't be easier to find. (Web browser, word processor, presentations.)

(Compare that to the advanced view: 1. Apps wouldn't maximize on their own - I found I was doing this myself all the time. 2. The home key brings up KDE's start menu. 3. Applications were harder to find buried as they are in the start menu under multiple levels of submenus I'm not familiar with coming from Windows.)



Thanks Asus!

Scott's Grails/GORM talk...

Scott Davis: davisworld.org

used in grails stack
gorm: grails object/relational mapper

thin wrapper over hibernate

google: grails rails performance

[what is quartz?]

hibernate knowledge transferrable here
can override default gorm behaviour
.hbm files

can map domain classes to tables with different names
normally it's pogo name == table name

nice dsl for gorm coming in grails 1.0-rc1

grails shell lets you connect to running application and query data
using app domain objects

select * from artist
* == splat

See dynamic sorted list! awesome!
Simple dynamic queries

Relationships are pretty damn cool too
see 1-1 slide

send thx!
email: scottdavis99@yahoo.com

Scott's Advanced Grails talk...

quote: make easy things easy, hard things possible

many-many relationships not easy
but possible

grails brings together lots of popular java libs/frameworks
grails uses spring mvc for views
user auth uses spring acegi

google: many to many relationship grails
managed by hand in domain class
see BookAuthor class/slide
not a bad solution

get on grails mailing list->codehaus project

grails ships with prototype, scriptaculous, yui out of the box
in view:

emits >script src=... tag into response

take a look at:
google: cos.jar
manages file upload nicely
+ others
project: "com.oreilly.servlet"

file upload is nice
uses spring under the covers

security through acegi
need to install plugin
gem-like:
grails list-plugins
grails install the_plugin
grails.org: jsecurity plugin

No Fluff wrapped up...

I never did get a chance to write about my experience at No Fluff last weekend in real-time, but I've decided to put up some notes from a few of my fave sessions for posterity's sake. Scott Davis's Groovy/Grails track was by far my favourite. JSF/Seam/GWT et al were interesting to be sure, but more evolutionary IMHO. Grails on the other hand (which has, admittedly, borrowed rather generously from certain other frameworks du jour) was just neat-o!

No Fluff Just Stuff - Toronto has just rolled into town...

... and I'm attending! This being my first time, I expect all the presentations will be fresh and *hopefully* exciting. I'll be sticking to the JSF, Grails and Spring 2.0 streams primarily as they seem most relevant/interesting to me, but the truth of the matter is it was really hard to choose sessions - they all look good. I'll be updating my blog throughout the day if I can - hopefully they have wifi at the hotel's conference center - otherwise expect updates in the evening.

See ya there!

Parallel Thinking

Has anyone else noticed the attention a little known language - Erlang - has been getting in recent past? It just hit me... it's an attempted shift away from more megahertz will save me, towards multiple cores will save me. Programmers everywhere are trying to find a better way to model concurrent systems. Getting shared memory systems right is just plain hard. Looks like Erlang may be my language to learn this year. :-)

If Data is King...

... Visualization is Queen.

Companies are collecting more data than ever before. Figuring out how to store it for efficient retrieval later is indeed a difficult problem to be sure. But presenting said data in meaningful - actionable? - ways is just as tricky. (And from the perspective of business leaders, dare I say more important.)

Application security the process...

A secure development process like the one in use at Microsoft takes careful planning and lots of time to achieve. My company's been moving towards something like it since I started almost 2 years ago... here's how:

Testing

We figured testing would be the least disruptive starting point for this little paradigm shift. Somebody who understands the issues du jour should be able to get you going pretty quickly. (Consider tools like Fortify's SCA and Watchfire's AppScan here.) Don't overwhelm developers with a report that's hundreds of pages long with dozens of defects - they won't read it. Focus on the most severe vulnerabilities and get them looked at first.

Secure coding guidelines

While that's going on, you can start work on a secure coding chapter to add to your organization's coding guidelines document. The 2 main ideas to get across: input validation and output encoding, will prevent 80+% of the vulnerabilities hackers are exploiting these days. (The shorter this is the better.)

Developer training

When your guide's ready go through it with development. An hour long presentation or so should suffice.

Security audits of new code

Are developers actually following the recommendations you laid out in the last 2 phases? Use regular code audits to highlight the parts of your guide that have been internalized and which bits may need further evangelizing.

Security considered by designers

Security at design time is the ultimate goal. Security paid for up front is much cheaper and many times more effective than security that's bolted on at the end.

But don't expect things will change overnight. It may even be worth your while to get some help while you're ramping up (consultants?), ultimately though, you want your developers writing better code.

Communication: Be concise...

I've found this principle applies across the board from face-to-face meetings and presentations to e-mail. People are just better at digesting information one idea at a time - the shorter the better.

Some examples:

Presentations shouldn't contain more than 2 or 3 main takeaways and will ideally come in at a little under an hour - give or take. Beyond that your audience will start to miss parts of your message. It really isn't worth it. If that's not possible, save some material for another presentation.

Slides filled with bullet points don't help you. One idea per slide for the speaker to talk to works much better. The first time I tried this I ended up with 90 slides instead of 20 but I people definitely enjoyed the pace and format more.

E-mails should focus on 1 main idea and preferably fit on my screen without scrolling. Anything else is intimidating. (I'm only using e-mail these days to give background/context for face-to-faces.)

On handling errors...

The 3 error types I'm dealing with all the time: bad data, resources that aren't available or invalid and surprises.

Validate data coming into the application whether it be from people, web services or file system imports. Reject everything that doesn't match what you're expecting. But don't forget to tell the user what went wrong! (Where you do the validation is another story - the short answer: on the server.)

Catch errors you can reasonably recover from. File not founds, access denieds, timeouts, etc. Bring the application back to a valid state, help the user correct the error and continue.

Anything else has to go through a generic error handler. "An application error has occurred. Please contact technical support and refer to error number: nnnn."

My shiny new VStrom...

Finally!

How to make a system hard to secure...

Add...

1 part complexity. Thousands of classes, millions of lines of code, xml configuration files decipherable only by parsers, and all the latest technologies and buzzwords contribute here. (Don't forget to mix in a pinch of WS-* for good measure.)

1 part extensibility. How many of us use the software we do because of vibrant plugin communities? (Eclipse?) Lots of plugins tells me an application is probably alive and well, and has dozens of passionate users to turn to for help when I need it. (IntelliJ/MS MVPs?)

Plugins: are those little bits of custom code you download by clicking Tools->Addons -usually written by one "Who, I Have No Idea"- that run in-process and have privileged access to the local file system, main memory and all the data contained therein.

and...

1 part connectivity. Technology is more pervasive today than ever before and people are using it to keep in touch with old friends and make new ones - I'm thinking Web 2.0's poster children here: MySpace, Facebook, flickr, etc., but this criterion could be applied much more broadly (SMS?). One of my fave quotes comes from Sun Microsystems's Whitfield Diffie: (Not originally his.)

"As the number of interactions between people goes up, their relative security goes down."

Dr. Whitfield Diffie, Chief Sun Security Guy, Crypto Wiz.

Phishing, stalking and child abduction have all flourished, sadly :-(, in these new online communities by adapting to the new medium faster than did law enforcement.

Blogspot, del.icio.us, and Feedburner

I noticed a few of my fave bloggers were making daily posts of del.icio.us links and notes. "Well that's very neat!" I say to myself. "How'd they do that?"

After a little bit of poking around, here's what I've come up with...

Del.icio.us has a couple of things that'll do it if you don't mind new posts showing up in your blog full of links: link rolling and daily blog posting. Great! I guess my only problem then is I don't actually want posts full of links showing up in my blog every day. Ugh. Enter Feedburner...

Feedburner takes my regular Blogspot feed and wraps it up in one of their own letting them do things like track how many subscribers I've got, and count the number of click-throughs to my posts-presumably to see which ones people are reading most? But here's something else they do that's been very helpful to my little quest... feed aggregation. Did you know del.icio.us serves up a feed of links you add to your account every day? I didn't. Anywho, it looks like Feedburner will automatically grab it and drop it into my feed without touching Blogspot.

Nice. :-)

The Defender's Dilemma...

Bruce Schneier writes about active deterrence and retaliation in Cyber-Attack-a post that takes me right back to one of the first ideas I ran into getting started in security-The Defender's Dilemma. It talks about the 2 opposing forces at play in this space: attackers and defenders and says "it's a lot easier to be an attacker than a defender".

Here's what it means for me...

As a defender, I need to make sure my firewall lets traffic through on some ports (21, 25, 80, etc.) but not others. My app server must be locked down-this means getting rid of default apps, changing default passwords, tightening up my server.xml or http.conf, and staying on top of those daily security updates-. And wouldn't it be great if my application was built by people who've heard of things like cross-site scripting and SQL injection-sadly these are still too few and far between.

As an attacker, all I need do is find one buggy service still running, an over-looked configuration setting or a single unprotected form field in a web application that might have 1000s (alright... an unprotected field that's used in an interesting way-oh in say... a SQL query).

The general in Schneier's article suggests always being the attacker. Setting aside the moral high-ground for a moment this is the best way to tip the scales in our favour. What he's doing is moving the battlefield away from our systems and networks into somebody else's-which should make for much less collateral damage. Unfortunately that's not something we're going to be able to do is it-enter that pesky high-ground. :-(

So what's left to us? Disaster recovery and response plans, rock solid backup strategies and constant vigilance. *sigh*

And the topic for another entry... :-)

Architects...

I'm not sure architecture is where I'll end up in the next 5 years or so but here's where I think I need to be myself before I even start thinking about filling that kind of role...

An architect is somebody who:

Is experienced. (And work in the field is pretty much the only place to get it!) S/he usually gets to decide how an application will work from the get-go at the highest level - a system-wide view. Where does it come from? A background involving several sufficiently different projects certainly helps, but nothing beats mistakes when it comes to learning the right way to do things.

Is confident. Confidence is something I struggle with all the time - especially when I'm wading into new territory (architectures, libraries). The good news is it's something that largely corrects itself the more decisions you have to make. I know I'm much better than when I started 5-ish years ago - a lot of that came from just slogging through, and working with really smart people.

Is a mentor. I wouldn't want to work in a company that separates the best and brightest from the rest of us mere mortals. Books and articles are great for improving your craft, but so is a good slap on the wrist when you need it from somebody who's been there. I think an architect should do more than keep apps maintainable, testable, performant, etc. Most developers (myself very much so included) absolutely need the occasional firm but gentle nudge in the right direction!

[Heavily borrowed from some of my fav bloggers out there. :-p]

On improvement...

From Extreme Programming Explained: Embrace Change…

“Best is the enemy of good enough” suggests that mediocrity is preferable to waiting. This phrase misses the point of XP, which is excellence in software development through improvement. The cycle is to do the best you can today, striving for the awareness and understanding necessary to do better tomorrow. It doesn’t mean waiting for perfection in order to begin.”

I fall into this trap all the time. It’s paralyzing!

First post...

Hi there!

I've decided my first post is going to be about me.

My name is Christian. I was born in Toronto, Ontario, Canada and have lived here my entire life. I have a sister and mom who love me. I've been really lucky me thinks. What kind of person would I have turned out to be if I had been born in say, Africa? Asia? I'll never know. Life has been good to me and hopefully through my writing, I'll figure out how I feel about that and why.

Writing helps me think. Whether it's about work, life, or anything else under the sun, some of my most important aha! moments have come when I made myself slow down and reflect. I guess this is what writing does for me and why I decided to make it a bigger part of my life.

I haven't decided what my blog is going to be about yet. For now I think I'll write about whatever pops into my head. I know I know, blogs are supposed to be focused, coherent things about a single topic. I couldn't agree less. I'm writing about myself for friends and family. This is about my own personal journey to enlightenment. So there! :)

That's good enough for a first post about nothing in particular.

See you soon.