Any kind of software development team may learn a good deal from safety-related coding guidelines and recommendations, simply because it also has impacts in regards to stability, security, reliability and last but not least maintainability. One of the primary issues of object oriented technology in regards to safety is dead and deactivated (unused by “design”) code. For instance, when you think about complex software packages like JBoss 5, not many applications can say of themselves that they are truly using 100 percent of the functionality offering of its middleware framework. The thing is, that the more additional features there are – no matter if they are used or not – they can produce unexpected errors and problems.

A very good example is outlined in TWIT’s Security Now podcast episode 211. Developing “single-use” appliances with a Windows machine or a general PC underneath opens up so many potential attack routes that they are hard to manage and can barely be called secure or trustworthy to begin with. Every additional program or functionality stone you heap upon that pile of preexisting “conditions” aggravates the problem one or more degrees. For instance, just today I read about security attacks made possible due to lack of maintenance and security awareness. There are so many nobs you can turn in a Linux system, it can be overwhelming for some people. The result is insecure systems because people weren’t even aware of the potential risks and problems.

However, it’s not just the frameworks we are using, it’s also very much about the programming language we choose. While C++ will treat the programmer like a consenting adult, Pascal will treat her like a child and Ada like a criminal. C++ is a complex and powerful language, but this power can be misguided. We all know there are people who live the “it was hard to code, it should be hard to read” approach, but even if you try to write legible C++ code it happens quite often that a few lines of code can have ambiguous meaning. A misplaced bracket can wreak havoc, literally.

I worked on Flash- and Flex-based interactive kiosk-applications myself which were then deployed on Windows and Mac OS. Did it work? Sure it did. Were there safer alternatives? For sure, however sometimes time and budget constraints require you to choose a technology which has already many of the required functionality built-in. Even though this comes with additional, unnecessary functionality, it permits you to boost your development cycle and produce stable and good applications if done properly. I won’t recommend it for building an airplane navigation system but for a simple kiosk app it is certainly a good thing. This kind of trade-off between using preexisting packages, frameworks and libraries and avoiding dead and deactivated code by building your own specialized niche product will always be looming over IT.

I guess the point of this post is, that when doing software development, very much like running your own servers and applications, it is important to keep safety, security, reliability and maintainability in mind. To exaggerate the point a little: noone wants to crash in his car, because he changed the radio station…

Further references

• In regards to securing JBoss, I can recommend the JBoss Wiki and related Sourceforge article which have a good outline on what should be done before putting a server life.
• There is a really great HOWTO for hardening FreeBSD at bsdguides.org.
• SANS.org has produced a list of top 25 programming errors

For instance, there are the two well known project management certification paths and associated methodologies by PMI and by the IPMA. Their principles are very similar – at least from what I’ve seen so far – but they differ in wording.

PMI’s definition of project management is separated into different knowledge areas:

Project Integration Management: defining the charter and scope statement plus a viable project plan; monitoring and controlling project work

Project Scope Management: creation and planning, protection and fulfillment of project scope, includes creation of work breakdown structure (WBS)

Project Time Management: definition of activities, their properties and how they fit into the project schedule; prioritize and put them into order, define how long they take and decide how long the project will take

Project Cost Management: planning, estimating, budgeting and control of costs; remember the iron triangle: bound to time and quality and scope

Project Quality Management: planning and controlling quality in a project

Project Human Resource Management: staffing or more general staff acquisition and team development (this alone could fill a book)

Project Communication Management: details about how to communicate in the project; defining repetitive communication and outline escalation channels, etc.

Project Risk Management: assessment of risk; planning, analysis, monitoring and control of risk

Project Procurement Management: make or buy decisions; procurements and contract management

It’s a beautiful structure which gives guidance and is easy to understand. IPMA’s competence baseline document (download here or a German version here) in comparison splits into different competence areas:

Technical competence: the foundation of project management procedures like requirements management, risk management, controlling and so on

Behavioral competence: soft skills required for project management; attitudes and inter-personal relationships between project members

Contextual competence: anything relating to the context of projects – the relationship between the project manager and the overall organization and management

From what I’ve read so far, the ICB looks a lot like a glossary of terms outlining all the important project management terms – from startup and writing a charter to project closure (or close-out as it is called in the ICB). It’s a good read but it will not give you any practical advice since this is one of the things the ICB is defined not to be: it is not meant to be a cookbook full of recipes but instead lay the foundation that any organization may pick up to develop into its actual project management implementation. A whole chapter is dedicated to the certification and re-certification procedure. I highly recommend it to anyone considering joining the IPMA or PMI.

A particular nice feature of the ICB is, that the IPMA clearly permits national chapters to add up to 10 percent in content and methods for nation-specific details when building a national competence baseline (NCB).

Overall I think that both programs – IPMA’s and PMI’s – work well even if combined. IPMA’s ICB is certainly more theoretical while PMI’s PMBOK sides more on the practical toolset side – even if just a tiny bit (e.g. by taking into account procedures like EVA and more practical applications in regards to risk management and scheduling).

One of those methods adopted by many organizations worldwide is “standup meetings”. The basic idea: a meeting is being held with all participants standing, not sitting down. As long as some constraints are fulfilled, meetings become more effective. They take less time and get results faster. There’s even special furniture which can be used to hold such meetings.

Of course, there are misguided approaches to stand-up meetings as well – including, but not limited to, managers using stand-up meetings to rant or generally the lack of moderation resulting in meetings taking too long or being hijacked by off-topic discussions.

In this regard, agile methodology experts are quite similar to open source advocates: when agile methods fail – just like when open source projects are difficult to use, install or maintain – the answers are often arrogant and narrow-minded, boiling down to a simple “you are doing it wrong”. Admittingly, there are many ways to do stand-up meetings the wrong way. Specifically, it should not be expected that stand-up meetings are the silver bullet to “meeting-mania”.

Not every shoe fits all sizes

As a matter of fact, it most likely is a good idea to keep stand-ups to a limited set of meetups. For instance, use it only for daily status meetings.

Combining the concept of stand-up meetings with other methods like meeting facilitation and having a well-defined and clear agenda may visibly increase meeting productivity.

For example, stick to stating your current status, current problems and what the plan for today is. The general idea after all, is not to limit interaction, but to speed up the meeting and leave out all the unnecessary fuss. If there is more to talk about or something that needs a follow-up, that is perfectly alright. Just meet up in two or three person groups afterwards or keep it to a separate water-cooler conversation. There are plenty of good suggestions one can try out.

Stand up meetings have a clear meaning; they are not going to resolve the big issues but they are here to inform. There is no use to call in stand-up meetings with 20 stakeholders and try to force a resolution to an issue that’s been bugging a project for several months. Especially not if is a political issue. The motto is – keep it simple!

I personally believe, mobile computing – especially mobile internet access – will keep growing more important over the next years. There might be differing views and statistics (e.g. one pro, one contra) upon the topic, just don’t go to WolframAlpha to try to sort it out (as a matter of fact, the result given has nothing to do with the question given). Then again, if you’re looking for all the socks you lost in the washing machine – you might want to give it a try.

As mobile computing is growing in adoption, security becomes more and more of an issue. As Charlie Miller showed us times and again, that there’s flaws in Apple iPhone operating system and how it handles incoming text messages. Some of those have been fixed, new ones have been discovered and in the meantime we all know that neither the G1 or generally Android phones nor other HTC phones are save from attacks and exploits.

There are a number of reasons why mobile communication is such a great innovation even though it does involve potential security risks:

1. it makes you less dependent on internet access points (be it cable, DSL, WiFI or whatever flavor you have got around),
2. you can always be reached – just like a phone call, but less distracting since you can check your emails when you choose to do so,
3. you can IM with people across the globe without a horrendous phone bill as a result
4. you can blog as you go
5. watch or listen to live streams for news or other educational topics

In the future you might even be able to easily

1. get music,
2. ebooks,
3. podcasts, newscasts, etc.

as you go. I say “in the future” because as far as I’m concerned, I haven’t yet found any solution that would be easy to use on the go. All the choices of music portals available (Amazon and iTunes being the major ones) need a real computer to be operated. eBooks – at least those that are handled by typical ebook readers – are in PDF or ePub format, which needs Adobe’s Digital Editions software. Digital Editions only runs on a PC. Don’t get me wrong, I know there’s ebook reader software for my PDA but I simply do not want to read my ebooks on my PDA due to its small screen and bad contrast in sunlight. Last but not least there’s no iTunes equivalent app on any handheld device for downloading and listening to podcasts. None is really as slick and easy to use.

So for now, I’m sticking to the help of a PC to bridge the gap there. I’m sure it will develop further and what we’ve got so far is really pretty good already. If you ignore the minor annoyance of having to manually transfer data between devices, the available solutions for listening and reading are really good. Since I’m using MortPlayer on my PDA I’m one happy camper. I’m telling you – listening to podcasts and audiobooks while on the go makes things like riding the subway a lot more fun!

• “Hey Bob, you probably heard about the budget cuts IT took last week. I want you to not think about it – it’s not going to be an issue. I don’t want you to think that you’re not getting your certification you have been working on the last six months. As a matter of fact, is there any other course you might be interested in?”
• “Hey Bob, you probably heard about the budget cuts IT took last week. We may be in a tighter spot than before but I still managed to keep the budget allocation for training, so apart from the certification we have been talking about – is there any other training you are interested in?”

In practice, it will most likely be the second one working better because it is stated in a positive way. The idea behind this stems from an NLP approach called “Positive and Negative“. If you say something and tell someone not to think about something, he or she is still going to think about it. The reason lies within the way our brains are wired: to actually not think about something, our brain first has to focus on that specific thing it is supposed to ignore. So, if you tell Bob to forget about the possibility that his certification is canceled, he will ultimately come to have precisely that before his mind’s eye. As a consequence, asking him then if there is anything else he might be interested in, might even look as if you are looking for a cheaper alternative.

As a matter of fact, this can even happen with positive statements as Joanne Wood from the University of Waterloo found: people with low self-esteem who repeated “I’m a lovable person” to themselves felt worse than people who did neither. Obviously, the repeated statements made their minds think exactly of the opposite, namely that they are not a lovable person. On the other hand, people with good self-esteem felt better about themselves when repeating phrases like “I’m a lovable person” to themselves – as it seems because they also did believe in it.

Still, in most cases, it is better to state your thoughts in a positive sense as long as you don’t go the way of Jim Carey’s “Yes Man” and forcefully apply the principle to everything. There are always limits and constraints and of course you should clearly communicate them. Nonetheless there are a  number of reasons why negative statements can become counterproductive:

• they don’t state your expectation, but only what you do not want or what you are not interested in,
• they may insult and
• hinder free flow of ideas and thoughts and
• often don’t leave any room for discussion even if that is precisely what you want.

As Naomi Drury, NLP practitioner, states on his blog – strong positive words bring a strong positive reaction. So stay focused on the goals, strategies, issues or topics you want to communicate and say them positively. It will surely pay off.

Further resources:

• http://www.inspiredprojectteams.com/?p=944 – Just say No
• http://www.engineeranicon.com/ppc/neuro-linguistic-programming-nlp-positive-reinforcement – Positive reinforcement and its use in advertisement
• http://positivesharing.com/2006/07/monday-tip-start-meetings-with-something-positive/ – Start your meeting with a positive round
• http://www.positivelypresent.com/2009/07/disputing-negativity-is-as-easy-as-abcde.html – saying no to negativity is as easy as ABC(DE)

That’s the core of the Internet: anything you put out there, you cannot take back. It’s like any personal relationship. Anything said or done cannot be undone. It is just a matter of time until the latest generation of kids will have to realize that all the Facebook and MySpace ramblings they put out yesterday will bubble up at a Google search twenty years later when they are looking to find a new job. I doubt all HR managers in a hurry will take a closer look to investigate when precisely those alcohol-induced postings were created.

That’s the way the Internet keeps evolving. It’s the humming motors of the web – complaining teenagers, managers, grandmas and technologists are all alike here and they all contribute in one way or another. The web enables everyone to communicate and there is a constant development of new ways to speak, write, tweet, post, comment – simply to participate in this huge melting pot.

So I’m really pleased that HTML5 finally arrives with the latest release of Mozilla’s Firefox 3.5. For instance, it adds a so called “Canvas” tag which permits graphics-laden interactions with the user which previously were only possible with the help of Adobe’s Flash or Flex. 9Elements.com has a nice demo on its site showing some of the capabilities: they created a particle cloud where each particle represents a twitter post advertising the demo.

This whole HTML5 movement just proves one more time that it really is about time that Internet Explorer 6 finally caves and goes away. There is even an organized group effort working on it at www.bringdownie6.com. It’s a fact that it hinders the development of the Internet by lacking security and technology. Still there are many companies and government organizations having trouble with technology adoption due to out-dated policies. As a result, most people cannot choose their own web browser at their workplace – it’s dictated by their employer. As much as I understand a company’s need to streamline its hardware and software for easier maintenance I do wonder why anyone would stick to such an acquainted security problem as big as a barn door.

Whatever the web will bring us in the next years, I’m sure it will blow our socks off. Just think about it – Web 2.0, Ajax… it’s already so 2008. The (r)evolution has already started a long time ago.

Further references:

• http://dev.w3.org/html5/spec/Overview.html – W3C’s HTML5 specification
• http://secunia.com/advisories/product/11/ – Secunia’s Internet Explorer 6 Security Advisories
• http://blog.washingtonpost.com/securityfix/2007/01/internet_explorer_unsafe_for_2.html – Internet Explorer 6 unsafe for 284 days

In the US, the introduction of Amazon’s Kindle certainly took care of that problem by making “e-ink” technology feasible and affordable for the first time. However, the Kindle combines its reading experience with a built-in network connection that only works in the US. This pretty much is a deal breaker for anyone living in Europe since there would be no way to use Amazon’s wireless service to buy books – which is in my point of view, one major advantage and feature of the device, if not reason number one to buy the Kindle in the first place.

So, after some days of considerations I finally treated myself to a Sony PRS-505 ebook reader. It features e-ink technology – just like the Kindle – and sports a nice 170dpi 6″ screen with really good contrast. So far, I need to say: I’m impressed. Reading a 500+ pages book without actually having to lift its weight is absolutely amazing. Being able to switch between several books without having to get up and walk to the book shelve is also great. You can set bookmarks for your books, upload PDFs… in regards to the latter however, I have to tell you that there’s still room for improvement. PDFs aren’t perfectly reflown when zoomed in. Still, most of them can be viewed just alright by switching the device from portrait to landscape mode. Just push and hold the zoom button and the device switches between those two viewing modes.

When you think about it, using an ebook reader is also the environmentally right choice: you don’t need to print all those books and PDFs anymore that you would otherwise have blown through the printer. If you wait a little longer, you will even be able to take notes via a touch screen: Sony is already working on its next generation reader PRS-600 (german article).

Maybe it’s just me, but suddenly it really is so much fun to browse, find and read books. Then again, I even managed to convince my girlfriend to get one for herself – so far, we’ve been taking turns in using the reader…

If you consider buying one yourself and you’re living in Vienna, you should consider going to the Morawa bookstore located at Wollzeile 11 (Google Maps). They are selling Sony’s PRS-505 for 250 Euros, but if you buy it before August 31, 2009 you also get a 50 Euros coupon you can use at any Morawa store. So effectively, you buy the thing for 200 Euros. Another option is to fly to the States where you can get it even cheaper – of course, only if you exclude the airfare from the calculation.

Further references

• http://de.wikipedia.org/wiki/Sony_Reader#PRS-505
• http://en.wikipedia.org/wiki/EPUB