Archive for February, 2009

Web application security

Wednesday, February 25th, 2009

A couple of people on my team are heavily into security, and I have also been part of several security reviews in the past.

It is high time I had a look at OWASP, which is why I am going to my first ever OWASP meeting in 15 minutes.

For those of you who have not had a look already, OWASP is a community focused on improving application security. Nice project. These people have a comprehensive reference about all things security related.

There is a very real need for this kind of project. I am still seeing SQL injection problems caused by people assembling SQL by concatenating SQL and user-supplied data instead of using prepared statements. I would have hoped we were rid of this kind of problem years ago, but this is not the case.

So – if you haven’t already, have a look at OWASP. There surely is something to learn there for everyone.

Evangelists and developer groups

Friday, February 20th, 2009

I have been silent for a while. There are reasons for that. My two daytime jobs at Objectware take up a lot of time, and so does the family furniture store.

I had thought I would spend the winter writing code. Haven’t. Instead, I have been caught up in reading a number of books. For a change, they are nothing to do with Java. They are to do with teamwork.

I have decided most books about agile methodologies describe a fairytale world, where everyone agrees which methodology should be used. This is almost never the case. In the real world, people disagree.

An example: A while back, I got into a situation where someone wanted to build a wiki page, and we started discussing how the information should be organized. I have been doing document management systems for many years, so my first thought was to have a look at what librarians have been up to. There is a fairly substantial amount of work underlying the Dewey classification system. Recently (the last ten years, that is), people have come up with stuff like topic maps and ontologies. I have been discussing how Amazon and similar sites have taken ontology creation to a new level with a librarian in the family. Instead of some greybeard sitting in an attic somewhere designing an ontology, classifications are made on the spot by the users. If I read “The pragmatic programmer”, Amazon will offer me other books which have been looked at by other people who have looked at “The pragmatic programmer” on their site. This is my world model.

During the discussion about the organization of this wiki, one of the participants stopped the discussion short. “We will use ITIL”, he said. No discussion. Simple. We will use ITIL.

I find what happened in this discussion fascinating. I think this kind of argument is seen a lot in development teams. I am sure I have been guilty of doing it myself. I think this is part of any technology adoption cycle, especially the earlier parts where the evangelists appear.

Evangelist is such a good word for the position that is often taken by someone who wants to adopt a technology. Thou shalt not doubt. Sometimes, this is for the good – the spring framework has killed off EJBs, at least around here. Good riddance.

Other times, we get testing for the sake of writing tests, we get “SOA is the same as web services”, “agile means not writing documentation and standing up” and all sorts of other easy solutions which look good on paper. Buzzwords.

Next time this happens, try to ask “why”. I have great fun doing this – at least as long as I won’t get hurt by the project going bad. If you get a sensible answer that does not lead to a circular reference, walk away. You are probably more needed somewhere else. You clearly have a well-reasoned person on your hands, maybe lacking a bit in communication skills, but someone who has thought things through. Keep that guy happy. He is at least worth his weight in silver.

If you are strung up as a disbeliever, ridiculed, told about “best practices”, or get pitted against God (meaning a reference is given to someone outside the room), there may still be hope. Whoever is talking to you may want to try something out, or have good reasons he is not able to communicate. I have done this myself, sadly. If you are very good, you will be able to get this wish into the open so you can start mitigating risks. There is absolutely nothing wrong with trying something new. It is the only way to get better. The trick is finding the right time.

Then again, there are the pure, honest evangelists. Haven’t figured out what to do with them yet.

This is why I am reading books such as “communities of practice” right now. Someone has to have done this before. Hopefully, there is no need for me to reinvent the wheel. So – no development right now. Gotta get through a couple more books first.