Haral's Blog

Erfaringer med trusselmodellering

2012-02-08T17:45:00.004+01:00

Sammendrag av presentasjonen min på Software 2012 - Erfaringer med trusselmodellering.

Trusslemodellering er en plattform for kommunikasjon. Kunden lurer på hvordan problemer er løst, og leverandøren har behov for å forklare det samme, og i tillegg belyse antagelser og konsekvenser av endringer. En slik plattform er nyttig gjennom hele livssyklusen, og kanskje særlig som dokumentasjon av tidligere avgjørelser.

En veldig viktig egenskap ved en trusselmodell, er konsistens mellom opptegning av systemet, og analysen av det. Derfor er det nyttig å bruke et verktøy som besørger denne konsistensen, og synliggjør eventuelle avvik. Truslene kan modelleres med "STRIDE"-prinsippene: spoofing, tampering, repudiation, information disclosure, denial of service og elevation of privilege. Hvert av disse appliseres til de forskjellige delene av systemet, som er modellert med komponenter som dataflyt, prosesser, aktører og datalager.

Gjennom analysen kommer man frem til diverse tiltak som er gjort tidligere. Av og til finner man også mangler. Modellen beskriver hvor inndata kommer fra eksterne aktører. Generelt fins det flere aspekter som kan tas ut som forskjellige rapporter som passer ulike roller, feks arkitekt, funksjonelt ansvarlig, kundens sikkerhetsansvarlig, prosjektleder etc.

Ved å bruke en dedikert applikasjon til trusselmodellering er det også enklere å oppdatere og endre modellen. Mangler og endringer blir svært synlige i analyse-bildet, og lar seg enkelt oppdatere. Dermed er det også enkelt å "holde liv" i modellen.

Dessuten er denne prosessen en veldig nyttig kunnskapsdeling mellom kunde og leverandør. Kunden (eller driftsleverandøren) synliggjør situasjonen i produksjonsmiljøet. Leverandøren viser hvordan løsningen opprinnelig var planlagt. Prosessen fører til en dyptgående modell av den eksisterende situasjonen i produksjon.

Disse erfaringene er basert på bruk av Microsoft SDL Threat Modelling Tool.

Building a telescope from your old optics

2011-11-08T15:21:00.000+01:00

I've had a Tamron 500mm f/8 reflector lens around for years. Now I've finally put it to use. With fixed aperture f/8 it's rarely useful for photography, but using it as a secondary telescope is actually really clever (got the idea from someone on the net, obviously).

The mount goes, from left to right:
- reflector lens
- t2/fd adapter
- fd rear cap /w drilled hole & glue
- celestron t-ring/eyepiece holder
- 1,25" eyepiece

And there's a bonus: because of the customised fd lens cap, it is possible to mount the eyepiece to any of my old Canon FD lenses. Works great with 35-105 f/3.5 and 100-300mm f/5.6 for both 25mm and 12mm eyepieces. Way to re-use your FD optics :)

Innbakte pølser på grillen

2011-04-29T18:33:00.002+02:00

En enkel og knallgod fredagsrett:
- 1 pk pølser
- 1 klump fin deig

Lag en lang, flat stripe deig, og surr den rundt pølsa. Pensle med litt smør. Grill på lav varme i ~5 minutter. Enklere blir det ikke :)

Firespice

2011-04-08T16:34:00.000+02:00

Røykespon bruker man vanligvis til å røyke fisk og denslags, men Weber har en type litt større trebiter som funker bra i grillen. Firespice er små biter av treverk av feks mesquite, hickory eller epletre som kan puttes i grillen for å lage litt ekstra røyk.

Det funker flott til biff, og også pizza som jeg skrev om i forrige post. Det er lurt å legge flisene i vann et døgn i forveien, så de brenner mindre og ryker mer.

3xP: Predicting production performance pt. 2

2011-04-07T14:17:00.003+02:00

In my previous post, I ranted on about testing environments, and how everything would look like if us tech nerds were to run a project. Well .. everything would be tested and running smoothly, but the users might not enjoy the command line interface.

Anyway, what to do when you're unable to reproduce performance issues that appear in production, disregarding excuses and previous assumptions ?

There are a number of non-intrusive metrics that is - or should be - available from your production environment. These should be used to monitor the application, and warn whenever something is about to come out of control.

But since we're already working on this - I guess the metrics failed, or someone did ignore the alerts and flags and whistles. Here's my short recipe for finding performance bottle necks:

1) Draw a diagram of the application stack
2) Map out the different diagnostics available from each layer
3) Figure out if each layer itself believes it is healthy
4) Let each layer figure if the layer below is healthy
5) Start fixing issues from the bottom. With each change, re-assert that the layers below still are hearty.

A typical example would be a long-running sql statement. It would be visible in database monitoring tools, and easily fixed either in the database or by altering the statement. Good.

But it's still a bottle neck. Why? Looking good at the data layer, there may still be issues with transporting the query results to the application server. So, next you look at the database driver, and see that there are a lot of result pagination. You query yielding 20 000 rows gets paginated into 1000 chucks of 20 rows.

So you fix the prefetch size, and now things run a bit smoother. But there's still some issues, because instantiating all of these results can take a while.

So you may be altering the data transfer model to be be more precise of which objects to fetch. But in doing so, you complicate the query again, yielding longer execution time ..

And so on you weave a path upwards to the application level, possibly introducing and resolving several issues as you go. This process is orders of magnitude simpler if you are able to simulate the results instead of actually deploying small fixes to production. In addition, you may unknowingly touch upon stuff that break other performance metrics. So again - monitoring of the entire stack is crucial.

Finally, when you reach a conclusion and have solved all of the current issues - ensure that your current footprint or benchmark is monitored for changes. Future maintenance and development will surely introduce new issues. Get at them early instead of letting them grow and interweave with each other. Then your next job won't be untying complicated knots of system behavior.

Grill-pizza på steinplate

2011-04-02T16:10:00.005+02:00

Av og til oppdager man ting som er så fantastiske at man lurer på hvordan man ikke har oppdaget dem før. Igår hadde jeg en slik opplevelse, takket være en gammel steinplate som fikk plass inni grillen.

Pizzabunnen som ellers blir litt kjedelig i ovenen ble helt eksepsjonell i grillen. Og det hele var enklere enn svint: fyr opp grillen til ca 250 grader, forvarm steinplaten, kjevle ut deigen og stek den i 2 minutter på hver side. Den siste stekingen med litt ost og fyll på, feks creme fraiche, skinke, ananas, basilikum og mozarella. Genialt!

3xP: Predicting production performance pt. 1

2011-04-01T13:59:00.003+02:00

I've recently worked a bit on performance tuning several applications that have been in production for several years. They range from 70 users to 3000 users, but have one thing in common: None of them have a performance management scheme.

Of course, it comes down to a question of cost. To be able to make, say, 99% correct predictions of how a system will perform, you need to run a bunch of tests in a sensible environment. There are two cost drivers: creating and managing the tests, and acquiring and maintaining the environment.

Creating load tests for a huge custom made application in three weeks is not possible. There are so many tweaks and processes and different behavior, that you'd need a load of domain experts just to tell you about all the things you can do. If the load tests were written in parallel with development, it would at least be possible to get somewhat complete coverage. But that's a huge overhead that cannot be added to the vendor budget. And the customer didn't specify inferior performance, so why should they take the cost?

I guess the lesson learned is that "good" performance may be governed by a tedious technical project management. Great performance has to be a concern even wider than the project scope, also including pre- and post-processes.

The second cost driver - environment - requires the first driver to be implemented. No need for realistic testing if you don't have a clue of what to test. But if you do - having a faulty or incorrectly scaled environment gives you either a number of falsely positive performance issues to solve, or a number of excuses for bad testing results. None of which is a good thing.

So, if you got your tests - do go the extra mile and ensure that the environment in which they are running is enabling you to do realistic testing and get correct predictions.

Oracle Identity Management - Governance, Risk and Compliance Architecture

2011-02-01T01:00:00.002+01:00

I'll have to admit that my primary reason for reading this book was not to kindle my knowledge of Oracle products, but rather get a picure of the IAM world. That proved a bit difficult, because it was not clear how the O-IAM model connected to the non-vendor-specific side of things. Not very suprising, but the foreword do describe the book as definitive guide. I'd recon the book would have been better with a "middle tier" of conceptual IAM.

Java EE6 with GlassFish 3 Application Server review

2011-01-12T12:19:00.005+01:00

Just got through this interesting book. It provides a quite nice perspective on a default set of tools for web application development in Java. Obviously focused on config and deployment of GF, the book also covers JSP, JSF, taglibs, messaging, security, ejb, cdi and web services. Althought all very familiar topics, it's nice to have a collection to point to for referencing these proven technologies. It should be pointed out that there are no comprehensive code appendixes in the book. So it's not bloated with code, but on the other hand it's not entirely clear how web services and messaging fit into the big picture.

The primary audience of this book is web developers wanting to move a bit towards the server side, learning how to integrate scalable data providers into their applications. I'll be recommending this book to a couple of web developers.

Knowledge sharing days

2010-10-22T16:12:00.002+02:00

Today is of our knowledge sharing days in Computas. I haven't reflected on the actual value of such days before, except the practical value of giving and attending lectures and talks.

But today I discovered that there is actually more to it than just the knowledge sharing. Being away from your current project, you get to reflect on things that are not immediatly useful to your work, but rather expands your horizon on other topics.

Such a day differs from a day at a conference in that you feel free from an obligation to learn directly useful stuff. So, with this new state of mind I got to attend .NET sessions, project management sessions and sales sessions.

And guess what - I actually learned a lot more than I expected! There are so much knowledge around that will come in handy at some point, which you never can afford spending time on learning in a normal day. But when disconnected from everyday obligations, the mind seeks other kinds of producing useful thoughts, and so attending sessions from other fields than your primary becomes so much more efficient!

So, today I'm truly appreciating this opportunity to learn something that belongs to another everyday set of mind. +1 for Computas :)

JavaOne 2010 tag cloud

2010-09-23T01:48:00.004+02:00

I'm trying to grasp the trends of JavaOne 2010, and I figured it would be a cool approach to create a tag cloud. So - here it is: Tag cloud composed of the titles of all JavaOne 2010 sessions.

created at TagCrowd.com

JavaOne 2010 day 2

2010-09-22T17:22:00.006+02:00

Attended a great session on ESB best practices by Earl Nolan and Monal Daxini. Then some REST stuff of various quality. The big thing of the day was the general technical session with Mark Reinhold.

Most of the presented material were old news: Java SE 7 and EE 6. I guess the value of it is to say it's still in the pipeline. SE7 is now planned released in 2011 and SE8 in 2012. I.e. lambda expressions has been postponed till the 2012-release.

The session also had a nice and rather technical twitter client demo which can be found at https://glassfish.dev.java.net/twitterdemo

JavaOne day 1

2010-09-21T17:43:00.003+02:00

What's better than a day full of Java? Such a day, and an BOF evening cruise on the bay :)

Contemplating on how many participants there are on these conferences, we figured about 60 000. That's a lot of hotel rooms being occupied, dinner services etc. But then there's not a room available anywhere in the city. Wonder what happens when everyone goes home on Friday ..

JavaOne 2010 !

2010-09-20T01:05:00.003+02:00

Yess! I'm here at Hilton Hotel, San Francisco, ready for 5 days of concentrated Java juice! Tonight at 0530 pm Larry will kick off the show, and we'll be ramlin' down a path of tech discussions over an Anchor Steam pint. This will definitely be awesome!

JavaZone 2010

2010-09-09T20:27:00.005+02:00

Yay, JavaZone 2010 has come to a conclusion. 2 full days of dev and tech. Great fun! Thanks a lot to javaBin for a great event!

The slides for my lightning speech: "Enhance your Maven plugins with Groovy" is available on slideshare: http://slidesha.re/aiimmL

Presenting a RESTful web service

2010-08-20T08:03:00.003+02:00

Lately I've been pondering on how to create a unambigious description for the RESTful web service I am designing. The kink is to create a description that will work both ways: For consumbers AND producers. In addition it should be easy to maintain and develop.

So I figured that there is a description language called WADL - Web Application Description Language. Suitable for REST they say. Great indeed, but as it is not a formal standard, there are very few tools supporting the format. I.e. neither MagicDraw nor XmlSpy supports designing a service, Microsoft Visual Studio doesn't seem to support. For Java, there's wadl2java, which generates the services proxies. But still there's no design tool.

GlassFish and maven-wadl-plugin can reverse engineer your annotations, and create a WADL describing your service. If you implemented it with JAX-RW. My service was already tentatively implemented using Spring Web, so no luck.

A lot of services offered "in the cloud", or as we said previously "on the Internet", have textual descriptions for their APIs. Such services include Google Search API, Twitter, Flickr, Sun Kenai etc. But textual descriptions can be ambigious if not carefully written, expecially when it comes to describing message exchange formats. For message consumers, this is probably a reasonable tradeoff. But having several producers, this would most certainly lead to ambigious services.

So, my solution was to 1) describe the services/resources as text in the API document, and 2) describe the resource models/message formats using XSD. XSD have wide tooling support. This takes us where we want to be.

The next step would be to hand-craft the WADL using the generated XSDs, but I'll leave that as an excercise to the reader :)

JavaZone 2010 accept

2010-07-02T15:12:00.003+02:00

Great, two of my collegues at Computas and me got accepted each our talk for the JavaZone-conference in Oslo 8-9. september. The three of us will contribute with these presentations:

Geir A. Lund:
Erfaring med konvertering fra CVS til Mercurial i stort Javaprosjekt

Filip van Laenen:
Why We Should Start Tagging Our Code

Harald Søvik:
Enhance your Maven plugins with Groovy

Along with a small army of other experts and geeks, we will fill the venue with experience, knowledge and pure java-happiness for two entire days. Don't miss out on this event - it's probably the best java conference in this part of the galaxy :)

NDC2010 material

2010-06-16T22:29:00.005+02:00

Here are some material that will be referred to in Mortens and my talk at NDC2010:

The slides for Modularization, testing and technical debt (in a large agile project) is available at http://www.slideshare.net/harals/modularization-testing-and-technical-debt-in-a-large-agile-project

A whitepaper on the same topic (from the proceedings of the XP2010-conference) can be found at http://www.slideshare.net/harals/cou

XP2010 accept

2010-05-25T15:41:00.003+02:00

The 11th International Conference on Agile Software Development is coming up (June 1-4 in Trondheim). Unfortunately, I will not be able to be there. But I have been authoring and co-authoring some material for the conference.

First, Morten's and my experience report "Tech Challenges in a Large-Scale Agile Project" was accepted, and will be both presented and included in the conference proceedings:

This experience reports focuses on the major technical challenges that arose during the project, especially those challenges that we think can be attributed to the SCRUM methodology. For each of them, we try to identify the consequence and the cause, and then follow up with any solutions we tried, and an analysis of whether the problem was successfully solved or not. The session paper lists three major examples of such problems.

Then, I got accepted a lightening talk as well: "Agile Methods may Discourage Quality". However, since I have to be attending a customer at the time, Morten will be presenting this instead of me.

Agile methods, and in particular scrum, have a very strong focus on productivity and immediate business value. The developers are encouraged to complete their tasks in due time, and this may lead to quick and dirty solutions. Thus, a quality assurance system is required to ensure that technical quality is within required bounds. This system may be implemented through pair programming, code review, design review etc. It is crucial that whatever QA systems one choose, it has strong enough authority to inflict a decrease in focus factor, or even a postponed deadline.

Cheers and good luck to you all in Trondheim! See http://xp2010.org/

Technical debt in agile projects

2010-05-10T12:45:00.003+02:00

I'll be presenting my opinions on technical debt in agile projects at Communities in Action 2010 tonight.

The presentation can be found at slideshare but I'll let you in on my three "lemmas" as a tech lead:

make it simple and easy to report a technical shortcoming
don't let it backfire on the whistleblower
decide the matter in a setting with both technical expertise and executive power

Java Microbenchmarking

2010-04-22T21:29:00.003+02:00

Working late on preparing a performance test tomorrow, I stumbled over something called microbenchmarking. The idea is to put small performance tests within you code to evalute the system. This gives you the liberty of extracting performance measurements regardless of what environment the platform runs in (i.e. your development desktop vs. testing vs. production).

There are an awful lot of obvious (and perhaps not so obvious) things not to do while microbenchmarking. Consider e.g. if you should invoke any large or small load, what layer to stress, when to do this ..

I'm implementing this as a JBoss MBean, which will let me invoke a test suite with a HTTP request, and get a "ping"-style timer response.

I'll post my results later if this happens to be an interesting feature.

NDC 2010 accept

2010-04-05T15:15:00.007+02:00

Against all odds (?) - Mortens and my paper ("Modularization, Testing & Technical Debt in a Large Agile Project") was accepted for the Nordic Developer Conference 2010. Well then, even though it's experiences from a Java project presented at a .Net conference, both sides has the agile dimension in common.

But it's still somewhat comical to present in "the dragon's lair". The presentations is scheduled for day 2, track 2 at 11:40 - in parallel to Eric Evans .. yikes.

The abstract reads:

This experience reports focuses on the major scrum–related technical challenges that arose during a 120 000 hour scrum controlled project. For each of them, we try to identify the cause and the consequence, and then follow up with any solutions we tried. Finally we sum up and assess whether the problem was successfully solved or not.

In addition, my colleague Filip van Laenen was accepted with his presentation "Distributed Computing 2.0". See http://www.ndc2010.no

Wannabe Linux "#¤(=¤/"!?%/¤

2010-03-08T16:52:00.004+01:00

For some reason, we are using Cygwin at work to ease our scripting burden. It's a great tool for using bash-ish scripting power. Lately, my find command has behaved in strange ways. Whatever flags I pass, the result is always the same:

[/usr/bin] hasov@HKS-ADAMSTUA300 $ find
FIND: Parameter format not correct

After about 3 days this problem became unbearable, and I dedicated myself to hunt down the cause. Neither a cygwin upgrade, nor my configurations files was to blame. Windows stole my find !

[/usr/bin] hasov@HKS-ADAMSTUA300 $ which find
/cygdrive/c/WINDOWS/system32/find
[/usr/bin] hasov@HKS-ADAMSTUA300 $ rm `which find`
[/usr/bin] hasov@HKS-ADAMSTUA300 $ which find
/usr/bin/find
[/usr/bin] hasov@HKS-ADAMSTUA300 $ sleep 10s
[/usr/bin] hasov@HKS-ADAMSTUA300 $ which find
/cygdrive/c/WINDOWS/system32/find

Note that even though I remove the bogus find, some devil puts it back after a few seconds! Very strange indeed.

Anyway, I decided to get rid of the entire system32-thingy. I didn't want the break the fragile windows PATH variable, so I decided to handle the problem in .bashrc.

export PATH=`echo $PATH | sed -e 's/:\/cygdrive\/c\/WINDOWS\/system32:/:/'`

And that was just another nail in the windows/cygwin/hybrid coffin.

Java 7 chapter 4: client and web changes

2009-12-17T20:32:00.000+01:00

XRender
Old Java2D had to do a lot of rendering in software. This was fixed, but with OpenGL and poor Linux drivers, it can still be a problem. Thus, an X11 renderer should be created. Java2D is used by Cairo, GTK+, QT4 and KDE4.

Deployment features
Enable better access to installed JREs for applets, webstart and javafx applications. Also seamless JRE installation, and single line javascript deployment.

Swing updates
Translucent and shaped windows, heavyweight/lightweight mixing, and the improved AWT security warning.

JXLayer (glass pane overlay, control everything) component decorator, JXDatePicker, and possibly CSS-based styling.

DROPPED: Swing Application Framework to make it easier to write applications. May provide co-existence with JavaFX.

Nimbus look and feel. JGI.

Web changes
Upgrade the JAXP, JAXB, and JAX-WS APIs to the most recent stable versions.

Java 7 chapter 3: core

2009-12-16T22:08:00.000+01:00

Modularization
JSR 277: JAM module system eller OSGi. Applying JSR 294 to the rt.jar, creating virtual machine “profiles”. The core has been reduced from 15 MB to 5 MB. There might be profiles for headless, rich apps, realtime ..

ClassLoader architecture
Modifications to avoid deadlocks in non-hierarchical (cyclic) topologies.

Close URLClassLoader
Often in use by application servers. When a new URLClassLoader is constructed, the old one can be garbage collected when there are no references to this object. Only then can files and directories under this CL be unlocked. Because of the nature of GC, it is unpredictable when this will happend. A close method will make this behavious more predictable.

Unicode 5.1
Standard for representing various characters, now supporting even more characters.

Concurrency/collection updates
166 is a package of different concurrency stuff. 166y is defining a fork/join-framework (Parallel Array). Operation on a collection of elements, like incrementing a number across an array.

New I/O APIs
A file system interface that supports bulk access to file attributes, change notification, tunnel to FS-specific APIs, service-provider interface for pluggable FS implementations.

Asynch I/O operation on both sockets and files. Socket level UDP stuff.

EEC
Approac to public-key cryptography. Now supported with a native java library.

Java 7 chapter 2: Language changes

2009-12-15T12:39:00.003+01:00

Annotations
Annotations is limited to declarations in java 6 (method parameters and the declarations of packages, classes, methods, fields, and local variables). This jsr extends the annotation system to use on any type. It is limited to defining the syntax of the extended annotations, leaving the semantics out.

Modularization
Will promote testability and maintainability. Much like OO and interfaces, but at larger scale. A JAR is like a module but does not define dependencies. All classes are put on classpath, which enables interface type checking at compile time. However, the classpath can be different in runtime, i.e. different or multiple library versions. ClassLoaders can be used to segment the classpath, but they are hard to use. OSGi is a module system. It uses metadata in the manifest-file to determine inter-jar dependencies, and provides one ClassLoader per library. OSGi is a specification with several implementations. Project Jigsaw is the effort of modularizing the jdk itself. It will introduce a “module” keyword which combined with maven/ant-style dependencies can be used to create runtime module dependencies.

Coin
Project Coin defines a set of small language changes should be added to JDK 7. Seven features have been selected:

Strings in switch
Language support for collections
Automatic Resource Management
Improved Type Inference for Generic Instance Creation
Better integer literals
Simplified Varargs Method Invocation
Language support for JSR 292

See i.e. http://blogs.sun.com/darcy/entry/project_coin_final_five

Java 7 chapter 1: The Virtual Machine

2009-12-04T13:12:00.006+01:00

To prepare for the arrival of the Dolphin, I will indulge in some research entitled "What's new in Java 7". The story will consist of 5 chapters: the vm, the language, the core, the client and the Web. First came the change to the virtual machine.

CompressedOops
OOP is an “ordinary object pointer”, and it’s length is usually similar to the length of the native operating system pointer. Increasing the length from 32 to 64 bits will cause the heap in a 32-based program (running on a 64-bit system) to expand by 50%. Memory is cheap, but bandwidth and cache is expensive, and it is should not be very costly to port applications a new platform. Using a 64 bit vm and the UseCompressedOops flag will keep addressing overhead similar to that of 32 bit systems at the cost of cpu cycles.

Garbage First GC (“G1”)
Replacement for Concurrent-Mark-Sweep GC, but still “generational”. CMS divides memory into young generation (eden, survivor) and and old generation. Move live object into a more “persistent” generation. Stops the world to do complete collections. G1 divides memory into small “regions”, and these are labeled “young” or “old”. During a GC, those objects who are “live” in a region, will be compacted with other “live” objects in another region, depending on their age. Each region has a “remembered set”, which contains all external references to this region. This reduces the need to pause the world to mark.

G1 is a server-style garbage collector, targeted for multiprocessor- and large memory systems. It aims at being more predictable than CMS. It’s also available in 6u14.

JSR 292: The Da Vinci Machine Project
The JVM should be extended with general support of languages other than Java, and in particular dynamically typed languages. Such language implementers have observed a range of painful aspects of the byte code language, and this projects aims to remove those in a general manner. The noteworthy suggestions is: dynamic invocation, continuations, tail-calls and interface injection. The JSR specifically targets dynamic invocation and hot class modification. Today dynamic languages produces a lot of different options for signatures that all have to be stored in permgen space. This is very inefficient, and one should be able to narrow down these options at runtime.

Twitter programming session

2009-11-13T10:44:00.006+01:00

Last night I had a live programming session with ~30 CS students at the University of Oslo. The goal was to show how easy it is to interact with RESTful webservices in Java. I started out with explaining about HTTP and Jersey, REST vs SOAP, JSON vs XML and jsonlib vs jaxb. Those were the major design decisions.

I subsequently implemented a bot that would befriend anyone that was following the bot. Doing this with jsonlib was pretty straightforward, but showed the weakness of not having a higher level abstraction of the domain. Therefore, the next bot would get status updates from his friends timeline, and show them in a simple GUI. This proved a lot smoother when jaxb was at work, because it created two separate layers: one interacting with twitter restful webservices, and another showing model objects in the GUI. Last I showed a bot that used twitters search api to follow a trending topic.

Overall it was a good session, but I think it was a little bit too packed with technology choices. I guess it would have been of greater value to just show the magic of jaxb, and skip the primitive alternative.

The javabots is available for download at http://bit.ly/FyeqT for a while.

Scrum and Technical Debt

2009-10-29T16:18:00.006+01:00

This years Smidig-conference is over, and I've had a week to digest the impressions. Overall it was a great experience. Lots of lightning talks, open space discussions and even some beer. My talk on Scrum and Technical Debt created some fuzz in the following open space discussion, so I guess it must have stroken s chord in some of the listeners :)

Janniche from Bekk challenged me on my claims, and frankly I think she may have a point. She argued that if tech debt seems to hide away in scrum, we are using scrum in the wrong manner. Technical debt should be up front, and thus decrease the focus factor. It requries developers to be honest and professional about their craftmanship. So maybe we should spend some hours on tutoring instad of repairing old defects ..

The presentation is unfortunately not available on video, but the slides can be found at http://www.slideshare.net/harals/scrum-skjuler-teknisk-gjeld-2277766

Time Snapper

2009-10-01T16:19:00.003+02:00

I’ve been using TimeSnapper for a few days, and I’m definitively amused by it’s fancyness. Even though I’ve been present at work for perhaps 30 hours, it reveals that I’ve spent nearly a third of that time away from my workstation.

Moreover, it reveals that I spend most of my day inside if the www with opera. I haven’t been able to break that time slot down, but I’m afraid that most of my opera-time is devoted to issue tracking.

Maven: updating you version tags

2009-09-29T10:29:00.002+02:00

When you create another branch of your multimodule maven project, updating version tags all over the hierarchy can be a pain. You keep that snippet of code that does the job with 'find -iname pom.xml | xargs sed -e 's/4.0-SNAPSHOT/5.0-SNAPSHOT/g' .. and it works in most of the cases.

But there's another way: using the maven-versions-plugin. It allows you to change the pom version and parent version with a single target, e.g. mvn versions:set -DnewVersion=4.0b-SNAPSHOT.

Now, all of your maven modules in this project have been updated to the correct version, and their parent dependencies as well. Voilà :)

Speeding up the development cycle at JavaZone

2009-09-11T12:47:00.004+02:00

JavaZone 2009 has come to an end. It was a top notch conference: Great speakers and free beer.

My contribution was a lightning speed with entitled Speeding up the development cycle: Stash your files on a Solid State Drive

The abstract reads: Solid state drives have recently become easily available. Their performence may provide a way of reducing the time spent on on the development cycle: compiling, packeting and deploying applications. This paper shows promising results by locating the code base and local maven repository on a solid state drive. Initial experiments shows that time spent on waiting for your code to compile may be reduced by 50%.

You can get the slides at: http://www.slideshare.net/harals/ssd-dev

J2EE 6 på norsk

2009-08-17T21:12:00.006+02:00

Jeg kom tilfeldigvis over denne engelske bloggen, som også kommer i internasjonalisert utgave: http://blog.taragana.com/index.php/archive/java-ee-6-highlights/no/

Og hva kan man si. Her er det flust av gullkorn. Skulle ønske Sun kom med en norsk utgave av Java EE 6.

The key features of Java EE 6

= Nøkkelen vise egenskaper av Java EE 6

RESTful web services
= Hvile web tjenestene

Annotations across Web API
= Merknader vannrett Web API

Mobile developers
= transportabel utviklerne

Scripting languages
= Skriften språkene

Manual editing of web.xml
= håndbok redigere bort av web.xml

Og andre mer anvendelige oversettelser:

Submit tips
= Underkaste seg drikkepenger

Albert Einstein
= Enskjønt Einstein

Blog blah blah

2009-08-12T09:13:00.003+02:00

I just can't enought of them interesting blogs to read. And none of those publish exclusively interesting content. I find myself skimming titles to decide what posts to read.

So I got this idea: Combine Delicious and the blogsphere, and let me subscribe to tags or semantics or even something from a dewey-style categorisation of the world. Let me decide that I want all blog posts concering acquisitions of OSS companies by enterprise organisations. And let something, somewhere handle where to find those blogs, how to rate them, decide what to present to me.

Sort of like when people tweet about their blog postings.

Spoils of Peopleware

2009-08-11T21:58:00.002+02:00

So,
I read this black bible of technology workers satisfaction. Or perhaps programmers satisfaction. Or perhaps even skilled programmers satisfaction. It is said that this book should be kept secret from any management spy which happen to hoover over your desk. This because it is said to contain revolutionary ideas and truths about productivity, contrary to management theory and practice. So what is it all about?

Projects are failing to meet deadlines, to implement the specifications, to specify what the costumer really needs. The book claim that there are often no technological issues to explain this, but rather political and sosiological issues.

"Development is different from production". It's not a process that can be tuned and kept in a steady state, but instead a dynamic organism that should be nourished and kept happy. It's about creating value through ingenuity, not by running the motor at full throttle. One hour of overtime (at which you seldom can work at 100%) may cost an hour of undertime (where you recover and clean up after last nights desperate moves). Deadlines are not always absolute. Sometimes it's acceptable and even sensible to delay a deadline to fulfill quality requirements. I wish we could have both. "Quality is free, but only to those who are willing to pay heavily for it".

Then there's this part about the office environment. Cubicles and uniform environments are strongly discouraged. As opposed to factory workers, programmers are said to be intellect workers, and there are different rules that make them perform better. Cramped and noisy quarters can be a killer to productivity. Personalization enhances smartness. Interruptions steals a whole lot more of time than their duration, due to interruption of flow. You need at least 20 uninterrupted minutes to start working efficiently, and you need at least one hour to produce efficient results. Thus, behold of the E-factor: uninterrupted hours per working hours. Try measuring them by yourself. It's suggested that your will achieve a factor between 0.1 and 0.4. The number alone tells no story, but try to calculate it prior to and after a change, like moving to another office space, tearing down the office walls, putting up walls, switching offices and so on.

The right people is another keyword. A short formula for success: get the right people, make them happy so they won't leave, turn them loose.

The first clause is about hiring. Have an audition. Make the candidated program. Accept those that your collegues think highly of. Measure the cost of turnover. It can easily be as much as 5 months of lost work. Consider them people instead of workers. Most people leave because 1) they're just passing by, 2) they are feeling disposable or 3) they are not loyal because they are being threated as workers.

It's all about putting a kick-ass team together. There's this concept called jelling, which is rather difficult to quantify. It happens when people are professionally happy with each other, they feel identity and ownership and eliteness. Don't change a winning team. Spend some money on jelling acitivties, like teambuilding. A few hundred hours can easily be spent, or what?

So, this was a quick and superficial summary of the epic. Mostly written down to serve as my own mindmap for remembering things. Everything favors the developer, and I guess any manager would have loads of counter arguments to any of the claims. I agree with the majority of claims, and then I guess the rest is not applicable to my situation. It seems as if the paradise of developers is a small company owned by the developers themselves. Growth implies overhead, and the overhead eats up the advantage.

But then there's some advantages of working in a production environment as well. Your schedule is predictable. Your hours are predictable.

Your duties are predictable. Your requred skills are predictable. And then sometimes they're not, but then it's no longer a stable and optimised production process, is it?

Installing Debian on EEE 901

2009-08-08T10:33:00.003+02:00

For some reason, my Asus 3e 901 decided to freeze during boot. No magic would heal the system, so I booted into a live distro, salvaged the content of my home directory, and decided to offer myself a brand new debian installation.

For once, I didn't have a linux machine to help me. That caused some trouble, but I was able to get windows utilities to perform the same tasks as dd.

I decided to use the eee community edition of debian. It is available at http://eeepc.debian.net/debian/images/debian-eeepc.img. Used HP usb disk storage tool to format a pendrive and flashnul to write the image to the device.

Struggled a while with booting the 3e from a usb device. I figured out that you should enter bios (f2 during boot), and enable removable device as primary boot medium, and turn off silent boot and quick boot. It might also be a good ide to set the bios in "install os" mode.

Save, reboot. Then hit ESC while booting to get a boot menu, and select USB.

The installer was able to detect both ethernet and wireless NICs. I was able to retrieve the base system as a charm. Promising. I got some hints out of http://wiki.debian.org/DebianEeePC/HowTo/Install

Then boot. Remember to revert the bios settings - at least set os install mode to "installed".

After boot, I installed those xorg packages suggested by the debianeee howto, and then fluxbox with dependencies. And behold, Xorg started without a glitch. Amazing. Nothing like those old days of xorg.conf hacking, hsync, vsync yadda yadda.

apt-get install bliss

Global Hosted Operating System

2009-07-21T14:38:00.006+02:00

A little rant about this new thingy ..

So, in the beginning there was the web. Then came the desktop. Then the web became web 2.0. Now, behold of the desktop 2.0.

You've already heard of it. Google Crome OS. Software-as-a-service. Cloud. Virtual computers. Virtual desktop. Have you tried it ?

Ghost Inc. provides you with a virtual desktop. That's a full-screen web 2.0 flash application that mimics a desktop. There are about just those applications you use during a week: Web brower, email client, media player, office suite, and storage space.

Wait. This sounds just like your average work terminal server .. and yes: Ghost is in practice a citrix clone that runs inside your browser. You treat it as your desktop-away-from-home. You've already got one for work. Now you get one for your private use. I'd imagine it being great for those travelling and using different computers every day.

Actually, Ghost call this application a virtual computer, but hold your horses. You won't get an internet adress. There are no background processes. You spend your own CPU. And the network traffic travels between your own interface and your target network.

So, this seems to be more of a virtual pseudo operating system running combined inside of your browser and on the cloud. What goes where is hard to tell, but certainly the storage space is in the cloud, since it's provided by Amazon S3. A lot of the applications available at the desktop may be using Cloud Power (tm).

Mobile access is supported. You can access a downsized and stripped version of your desktop, with mobile-enabled versions of some applications. Neat.

So, whats the downsides? Applications will probably be your major pain. You can't apt-get install your favourite vim edition. There is no nethack! Just like your strictly managed work citrix terminal ..

Privacy? I would not bet on it, but they claim it. I've yet to enter any external credentials. Me might be paranoid.

Availability? Best effort.

And then there's this thing called shared files, which lets any ghost user access the file. This directory can be searched, so there's this small search engine thingy inside of your desktop. It turns up some really interesting executables. Take care. Your invulnerable virtual desktop may bring death and destruction to your hardware platform.

There is of course a whole lot of copyrighted material shared. How can you avoid that kind of abuse? Let's see who is being punished ..

Lastly, there are some cool features to be mentioned: Google Drive lets you use your gmail account file system for additional storage. (Just like gmailfs for linux). OpenSAM provides SSO with all of your web applications. FTP access to your slice of S3.

Enough ramble. Time to go fishing. Cheers!