Archive for Rants

Security Is Security

Aug 24

Something the past few days that has been irking me and seems to be a growing trend in the security space are comments like this:

“This attack is irrelevant because doing Y is cheaper/easier”

You are right. If I were an attacker I would try the simplest method first. If that fails do I go home and watch My Little Pony reruns because I could not telnet to your server with a blank password? No, I try increasingly more complex attacks until I get in.

Security is Security. Just because someone can set the data center on fire does not mean you should not secure the machines within it.

/rant

 

Filed Under: Rants, Security

Dropping my MVP

Feb 2

I have decided to drop out of Microsoft’s Most Valuable Professional Program. I have decided this for many reasons. Mainly I feel the program has no value to me and that MVPs are of no value to MS.

Experts

MS states how they have these “experts” in the community and that are involved in the products. While I have met some really smart MVPs I have also met some that are so out to lunch on things yet MS still considers them experts. To me this completely devalues the MVP program. I am definitely no exception to this. I am a MVP in developer security yet I don’t consider myself to be an expert. Interested yes. Expert no.

The way you get in is by contributing to the community. I had done lots of this and it was really nice to get recognized for it. Once you are in you are supposed to be this expert that provides feedback to the products that MS is building. Now this is where the program breaks down.

Products

Firstly most products you never hear about until it is too late. I hear about more MS technology from the mainstream media than I do from the MVP program. As a MVP who is supposed to be like an insider I thought that they would be looking to us for feedback on these technologies. But they don’t. They will take it after the product is released though but by then there are usually too many issues with the technology to be overcome.

While some products are great there are a big few that still irritate me:

 TFS is garbage if you have used anything else. I should never have to struggle to get things under source control as much as I have with this product. I should never have to struggle for days/weeks to install it. I should never have so much trouble configuring it or applying checkin policies. If any MVP worth their salt was asked about this then MS should know this.

MSBuild is another failed technology to me. It does not come close to the power of Nant so if I am going to pay the XML tax I will pay it with Nant. I will say that it is nice that proj files are msbuild files yet whenever I have had to customize my builds with MSBuild I want to hurt myself. At first I thought it was the learning curve but to me the product just does not meet my needs. Again if an MVP that uses a build technology was asked then MS would have known about this.

MSTest also missed the mark to me when they said it was not geared towards people who do TDD. Really? No one else does TDD? I am the only MVP that does? I think not.

The big one that continues to bug me is Entity Framework. At the ‘08 MVP summit a lot of the MVPs that saw it before it was announced pointed out the serious issues it has. At the ‘09 summit we were excited to see the improvements they had made but instead we were shown the same crap that was the ‘08 entity framework. This spawned off the Entity Framework Vote Of Non Confidence and finally in ’11 we have some of the changes that we said were so needed in ’08. Good job valuing the input of the people that actually have to use the crap you put out.

MS “Listens”/”Cares”

To me it seems that MS having MVPs is a way for MS to feel that they are in touch with the community at large. This is great for a company to do but it seems like the feedback that is given falls on deaf ears for many products. I am not saying that this is for all products though as some do really care about feedback. For the most part though it feels like any feedback given just falls into a void. When I asked for some contacts for TFS/MSBuild/MSTest I was told to send my feedback to my MVP lead and they would forward it on…. Because that is open. You want MVPs to be involved yet filtered (I felt anyways). I have had more interaction with MS staff by tweeting things that I have through the MVP program.

The other big issue I have with MS in general is being treated like we will jump through hoops to help them succeed. There have been a number of “tech x is launching in a few weeks so build something” so we can showcase it emails I have received. Well that is great but how am I going to build a good app on a new technology with little documentation and no access to anyone at MS who can give me some accurate answers to issues? I understand that MS staff are not there to troubleshoot my application but on new/unreleased technology it would be good to have some sort of access if only an internal message board.

There are some internal lists at MS for MVPs as well. I found out about the security one after being a security MVP  for OVER A YEAR. Now that I am on it…. Not much happens. There is little in the way of solicitation for feedback and there is little feedback provided. I assume this is because the security space is pretty quiet but then I am surprised to see things at the summit that I had no idea were being developed.

The most surprising thing to me was when I told my MVP lead that I was not interested in participating in the program. The response was: “No problem.  Thanks for letting me know Dave.  Good luck in the future”. I expected maybe a bit more of a “Why?” response but I am not surprised that MS does not care about what other people think. Maybe, because I have become harder on MS that they are happy to be rid of me. Who knows.

Maybe I am being hard on the program. Our MVP lead is great and tells us that whatever we need he will make happen. Great but how about you let us know some of the things that you can do for us? If you want something like WP7 to succeed get more than 5 dev phones and let us know you have them if we want to build applications. If MS is thinking of a new technology solicit the MVPs for people that use or have an interest in the new tech and get their feedback at the START of development instead of at the end.

Rewards

The MVP award is given to those that contribute to the community. I enjoy doing this and I will continue to do this whenever I can. Unfortunately it costs a lot of time and money to contribute to the community. If I give a talk I have spent 40 to 200 hours preparing (yes 200 hours on a 1 hour talk) plus the costs to travel to another city, food, and accommodation.  MS’s reward is a MSDN subscription and half of a hotel room if I attend the summit (there used to be more benefits but they have been rolled back to save costs). It would probably be more affordable for me to purchase an MSDN subscription on my own and stop speaking entirely. I have gained no additional work from the MVP program, no additional speaking gigs, and have not made relatively few connections to others because of the MVP program.

Fin

The program has become a black mark to me. It does not contain just experts (heck, they let me in). It does not certify that anyone has a clue about anything (and some of the MVP only lists prove this). It has not opened any doors for me. It does not help me stop MS from releasing crap that I have to work with. All it does for me is give me an MSDN subscription and another line on my resume.

Filed Under: General, Rants

Integration – Is It Worth It?

Aug 28

One thing I get asked to do a lot is integrate systems with each other or incorporate other systems into one we are currently building. In a lot of scenarios I have been starting to give some pushback on this. Sure integration is cool and all but should it be done?

Expense
The first (and ongoing) issue is the expense of integrating systems. First you have to understand the systems (or at least the APIs being exposed) of each system which can take a lot of time. Secondly we have to write code to integrate the services and adapt concepts from one system to another. This work also needs to be tested and debugged.

Perpetuating The Legacy
The bigger issue I have seen in organizations is that tying a legacy system into your system makes it harder to change or replace the legacy system. If a legacy system has 3-4 systems that depend on it then any changes have to be tested and approved by the consuming systems (expense again).

If we want to replace the legacy system with something better then we have two options. We can either rewrite the system and keep the old API exposed or we can throw it away and force our consumers to change. Rewriting a system and keeping the API may work IF the original API was perfect (or close to perfect). In practice I find that the API is ok but if a person were to rewrite it they could alleviate a lot of the issues and shortcomings discovered over the years. If we do a brand new interface then all our consumers need to change their code which can be…. expensive.

From being in this situation before I have compromised. I created a new system with a better API that was more expressive and simpler to use. I then created a separate project that exposed the old API and translated that to the new API. This does add some performance overhead in translation and lots of things to test (expensive).  It does allow new consumers to use a better API and allowed consumers of the old system to decide if it was worth migrating to the new API.

Integration For Integrations Sake
Many people automatically assume that if the information is in another system that we should integrate the two systems. This does help centralize rules, reduce duplication, and centralize information. This is all true but not always necessary. I would find it acceptable to have some minor duplication if it eliminated a coupling on another system. This is a very careful call to make though as this duplication can lead to duplication of maintainance. Even worse it can lead to their now being two sources of data so when a third system comes along it now consumes both sources for data to try and determine which one is accurate.

One classic example I have is from a client of mine. They have a system that dispatches their vehicles and another system that uses GPS to track their vehicles. They asked for these systems to be integrated as they are always switching between the two. In this case the value of integrating the systems was very low. Instead I recommend that all their operators get two monitors and have both applications open. This is not the 100% perfect solution (unless you are an accountant) but it gets the job done for the right price.

Alternatives
There are ways to integrate but not integrate. One of the simpler ones is to have a button/link/menu item/whatever that fires up a system you would normally integrate with and pass along necessary data. I.e. a button that runs “otherProgram.exe /RunSalesReport 10-10-2009 10-10-2010″ or http://server/SalesReport.aspx?start=10-10-2009&end=10-10-2010. Granted there is a bit of coupling there and some things to maintain but not as much as if we had to call a service, translate the results, and show it on a UI.

Another method is to use manual entry. An example of this would be to use one system to find a product and then type that products manufacture code into your system you are building. Sure it is not as fast and the costs of this slowdown will add up over time but is the cost of integration still higher than the cost it takes for a user to copy/paste a code from one program to another? Not an easy question to answer but one that should be evaluated.

The last method is one typically avoided: double entry. This is where the same (or similar) data is entered into two separate systems. An example of this might be for a sales operation. It may be acceptable for the sales system to have a list of all products, descriptions, and prices of products that they sell. The warehouse system might have its one list of products, dimensions, and inventory levels. As long as when a sale comes in that the order can be filled AND that the sales system does not need to know inventory levels when they make a sale (i.e. if there is none in the warehouse it will just get backordered). This is a very tight line to walk as if an item were entered into one system incorrectly the customer may order 20 Widgets but instead get 20 Gadgets due to the product codes not lining up.

Final Thoughts
I have learned that integration is more expensive than I first thought it would be. I thought that reducing code I had to write would make life easier. It does in some ways but in other ways it adds overhead to development and maintenance. If we just stop and think if it is really necessary to tie two systems together then we might just have a little less coupling and a little more freedom to upgrade some legacy systems. Not integrating is not the only solution…. but neither is integrating.

Filed Under: General, Rants

MSTest = Fail

Jul 30

One of my current clients is really embracing all the MS clones of great open source tools like MSTest, Team Build, Entity Framework, etc. Although I love the open source tools like nUnit, Team City (ok not so open source but still free), and nHibernate, I thought I would try MS Test out even though I have not heard many good things about them.

First I will say something nice: MSTest has a nice code coverage suite. I really like that it is integrated with visual studio and can even highlight the areas that are covered and not covered which is the ONE feature of MSTest that I like.

Other than that the code coverage I think MS test is a complete miss when it comes to development for the following reasons:

  • Only being able to add tests to a test project. I like my unit test classes to sit in the same project as the code I am testing as I find it easier to navigate the code, easy to spot if I did not test a class (As there is no [ClassName]Tests.cs file next to it. It appears that with MS Test I can only add tests to a test project
  • VSMDI File. When a test project is created it adds a .vsmdi and .testrunconfig file to the solution. Why these are needed at the solution level (or at all), I have no idea. Adding these items makes me have several spots to go to for changing settings instead of just one
  • Poor IDE integration. In VS I now have a test view tab, a test results tab, and a test runs tab docked into the editor (plus a code coverage tab but I can agree with this being a seprate tab). All I need is one area where I can run the tests and see the results. Just a heads up but SIMPLE THINGS ARE EASY TO USE!
  • Notification about having run more than 25 test runs. Apparently MS Test keeps 25 copies of the old tests around and when you try to run your unit tests for the 26th time you get a warning about this which is annoying. In 99% of situations you will not need to go back to the first time you ran tests so why bother even telling me?
  • Release/Debug Suprises: I had a set of tests constantly failing in the MSTest runner yet constantly passing in my Resharper runner. Also the code coverage went screwy (the code coverage was not accurate and  line highlighting did not match up). After a few hours I discovered that it was because the app was set to compile to a release but MS test just look at the debug DLL’s with no warning that it is doing so. I agree that the same thing would happen with nUnit but nUnit is not integrated into the UI and is therefore not expected to be able to pick up on these things MSTest is supposed to be this integrated wonder that should know when the tests are compiled in release to maybe use the release code instead of the stale debug code (or at least warn me)
  • Hard to Navigate. When a test fails you can see some of the description of the error message but if you want further details you need to double click the item which oepns a new editor tab which explains the error a bit more. I find having to manage these tabs an annoyance and much perfer the nUnit or Resharper test runner approaches myself.
  • Hard to just run one set of tests. I have two test projects one for unit tests and one for functional tests (items that hit the database and other costly resources). It seems hard to just run tests for one of the projects. It is also hard to run tests for just one namespace. Again these things are easy with other unit testing frameworks.
  • The context menus are confusing. Right clicking on the test project and selecting “add” yeilds “New Test”, “Unit Test”, and “Ordered Test”.
    New Test: Gives you the option of creating a new test, an ordered test, or use the test wizard
    Unit Test: launches the test wizard
    Orderd Test: creates a new ordered test
    I find the multiple routes a bit confusing (not to mention how it adds 3 elements to my already crowded context menu when I only need one)

Now these are just the issues I have had with it. A quick stop on a search engine brings up many other issues but so far I have not experienced them. I find that MSTest is not as clean, fast, or simple as other unit testing frameworks out there which makes me not want to use it on another project.

 

Filed Under: .NET, Rants

Things I Can’t Develop Without: Removing Pain

Aug 19

Recently I have been helping several other developers in the shop I am consulting at and realized another item for this series: Removing Pain. I am amazed by how many times I see developers repeating the same things over and over again.

Builds/Deployments
Builds should be the simplest and most repeatable thing you do in a day. If you have a checklist on your desk of steps then stop and automate. It is such a time saver to have a script that will do the things you need it to do. Wether it is using a build system like nANT, msBuild, finalBuilder, a batch file, or adding automation to visual studio (pre and post build events can be quite handy in a project). I have even used Auto Hot Key to build a macro to repeat some tasks that I could not automate via code.

Coding
Well I am a huge fan of resharper. I probably owe JetBrains about 400 hours of my life so far. There are lots of great tools to help you be productive in your IDE so try some of them out! I am not a fan of code generators but if you are doing tasks that feel like copy,paste, change 1 or 2 things then you should extract it to a generic way of doing it OR if that will not work then look at code generators

Frameworks
There are lots of great tools out there that enable you to do things faster. Things like ORMs for your data access, logging frameworks to make your life easier, and testing frameworks to help you increase or maintain the quality of your code.

If something is painful to do at work that is the first thing you should address. By removing the things that eat away your time you will have more time to be productive and just get more done.

Filed Under: General, Rants

Stop Biting Your Tongue…. It Hurts!

Oct 16

I was going to write an ALT.NET recap article but I think James and Donald really said everything I would have said. Instead I thought I would write about what changed since I got back.

One of the things I came back with from the ALT.NET conference was a lot of renewed energy in that the way I am trying to develop software is the way a lot of talented industry people are developing software. Now not to say that I want to follow what person xy does dogmatically, I want to combine ideas and techniques into what works for me and my client organizations.

A lot of discussions were around our favorite person…. Mort. For those of you that have never heard of Mort he/she is a developer that makes a quick solution to a problem and learns as they go (I am really paraphrasing here for more info check out the Microsoft Personas). Now I must say I hate the term as it used in a derogatory fashion. We all have developers at our shops that do not spend their time reading blogs, reading books, and tinkering with new (or old) ideas and we have to accept the fact that they will always be there. We also need to accept the fact that just because they are not up on all the latest techniques and tools that they still put out good code (well, depending on the quality of the programmer but an Elvis or Einstein is just as capable of outputting garbage code).

One of the common things with the personalities though is that they all learn things. There is no personality type that will fight learning. It is how they learn new things that varies.

One of the things I have resigned myself to is just accepting that I will learn new things ahead of the curve. Others will wait until either MS includes it as a practice / toolset or the organization forces it upon them. How depressing and untrue! Since coming back I have found myself talking with colleagues about a lot of things debated there which has started some good conversations and energy. I have also noticed that me constantly blabbing about x or y and code camp coming up has seemingly built a lot of energy here to want to attend and find out what alt.net is all about or find out what nHibernate does.

I was about to start a really simple task today of creating and retrieving a translation table from our database today. No one here does TDD and I am a one man show on this project (why 7 people come to our project meetings I may never know) so there is not much in the way of pairing. Just before I started I went and grabbed two developers and invited them to come sit down with me and test drive our development down to the data layer. For some reason I was surprised that they said yes and happily sat down for the short time it took to build this out. They asked a lot of good questions about what to test and how to do it so was great to see the gears turning.

The thing I am realizing is that it is not other developers that are the problem. Its that myself and I think a lot of other people that think that no one will listen so we bite our tongues and just do things our way. Granted, not everyone will listen or like what you say and that’s fine! Agile does not work for everyone, UML is not the only modeling language, and drag and drop apps can be successful (I have not heard of one, but I am sure it can and has be done). It’s all about making people informed of different ways to do things and let them choose!

So start talking, sharing, and asking questions! Have lunch and learns. Talk about a problem you have at coffee/lunch. Grab other developers and just show them something that might help them. If they have a pain point in their application give them some advice or sit with them for 10 minutes and show them different ways to do things!

Filed Under: General, Rants

SCO files for US bankruptcy protection

Sep 17

For those of us in the *nix space the whole SCO debacle has been going on for years. They claimed that they bought what was UNIX (UNIX actually does not actually exists as a technology really anymore and is more of a family of products now) and that all sorts of linux distributions stole code from it and were therefore violating copyright infringements. They then seemed to put all of their energy and money into suing distributions of (usually) free.

While I can see where they are comming from that it was their code but then they started to sue everyone they could which is not a very friendly action towards the open source community and really angered a lot of people.

In a supprising turn of events it turns out that Novell actually owns the UNIX copyrights so SCOs lawsuits (which it won some big money) are null and void meaning they have to refund all the money they weaseled out of people (in my opinion). So in a not so supprising turn of the SCOtanic they have filed for bankrupcy protection.

Novell says they will not sue people for using code that is 15 years old and really wants to encourage the Linux community.

Filed Under: Rants

Ranting on Piracy & DRM

Nov 23

I feel that piracy is a consumer response to poor quality. If only 10% of the movies / music released are good in my opinion. Do I really want to waste 90% of my money for a product you are unhappy with?

So going to see a movie that might/might not be good with another person will cost $20-$40 dollars depending on theaters and if you smuggled snacks in with you. That’s a lot of money on something you can buy that you will get more use out of. For me that might be a DVD of the movie when it comes out. So the movie industry still makes its money off me.

Lets have a look back on the past though. Some of us might remember when VCRs came out that the movie industry was crying how it was the end of their industry. Well it was not and spun in MORE income in the sales of movies in stores. When cassette tapes came out it was going to destroy the music industry. Well that never happened again. further to that the movie industry has a great revenue stream in DVDs that is making way more money than VHS ever did (bet they are glad that they lost their court cases against home VCRs now).   

The Internet is simply a new medium and businesses will have to adapt and learn to make new revenue from that. We already have more music download sites than I could ever name, movie rental / download sites, movies on demand over cable (or IPTV), and items like the video ipod that are really starting to take off. 

The thing I see stopping this medium is Digital Rights Management (DRM). If this is the first time you have heard of DRM then its basically a copy protection scheme imbedded into the media file. Now the issue with this is that if you download something from iTunes with DRM you can play it on your computer and on your Ipod. You can not play this file on any other mp3 player, your car mp3 player, or a home stereo. This means that even though YOU legitimately purchased the music you can not play it on every device YOU own. You also get tied into the company you purchased it from. If you have a bunch of iTunes music and buy a Zune…. well have fun repurchasing all your music from the MS store.

I read something interesting today (which inspired me to write this post in the first place):

“In six years of tracking piracy, we’ve never seen a statistical difference in piracy of a popular song that was released without DRM and a popular song that was released with DRM.” 
-Eric Garland, CEO of the market research firm BigChampagne.

So if DRM has zero effect on piracy and only encumbers the user why keep going with it?

The answer to that is revenue (well for apple at least). Look at how many spin off  devices there are that use the iPod on the apple store alone! There are armbands, speakers that dock with the ipod, alarm clocks, video docks, gift certificates, remote controls,  armbands, and to my surprise… Ipod Shoes (yes the Nike runners talk your iPod nano about your run).

Apple figured it out that there is a lot of money to be made in the technologies surrounding the technologies and has turned this into a huge revenue stream. Why hasn’t the music/movie industry realized that you adapt or die?

Now I don’t like to rant about a problem without a few solutions or new ideas at least:
-Provide 48 hour movie downloads for free but with a link to buy them.
-Have samples of music / movies delivered to clients based on preference.
-Enable them to be played on a toaster if need be (please don’t steal my idea for the video toaster)
-DRM free subscription services where people can download whatever they want and pay a low monthly fee
-Make the products you purchase have more to them (i.e. the extra features on a DVD)

For more reasons to hate DRM please read 30 days of DRM by Michael Geist. This was a post a day series about DRM and is so informative about this subject that my posts could never do it justice.

</rant>

Filed Under: Rants

.NET 3.0

Nov 7

Well .NET 3.0 is out now and I have to play the devils advocate on this one. I really feel that these frameworks are comming out too fast. I am still working in a a place that is on 1.1 mainly and we are finally moving to 2.0 thanks to some microsoft hotfixes that address our migration problems (apparently 1.1 com+ components are not playing well with 2.0 components).

I really can not wait to start using 2.0 as there are some really nice things there and am happy they released it. I know that most people who read this will say I am behind the times with not switching but business move slow on these things and for good reason.

With 3.0 out now (and I really know nothing about 3.0 but I assume it includes wcf, linq, and other goodness) its kind of depressing that fellow coders will jump on it as I move to 2.0 with the business world.

I know technology needs to move forward but I think that this new framework (and associated new framework headaches) are the weakness of the .NET platform. I think businesses will start to see that the cost of migrating to a new framework every year will be a little expensive so I really hope that there is a large time gap between 3.0 and 4.0 personally.

</rant>

Filed Under: Rants

The problem with deadlines

Aug 29

Everyone has deadlines which keeps us motivated to work. Personally I can not seem to work without one. The problem is that when a deadline approaches quality seems to decline. You start coding faster, testing less, and missing some of the minute points of spec in my experience. Although it is semantics I like to have a target window for a task that allows the developer to feel they have a bit of room to move other than a set date in time.

Clients and deadlines are when things get ugly. When something does not get delivered by that date then you are in trouble. I do give my clients a completion date for their problem but if I feel that there is a delay I tell them so that they are prepared when it is not ready for the initially expected date. For most projects I recommend to give a deadline past when you think you will have it done. If something is delivered a little early the client is usually happier (if it is months early they will feel ripped off though).

Filed Under: Rants