Posts

An unflattering commentary on Rackspace cloud server security

I recently needed a new server instance for some testing. Normally I would go back to AWS as I've had problems with Rackspace in the past . Being open minded and assuming things have changed in the last couple years I thought I'd go back and try out Rackspace cloud for my testing (for reasons I will not name here). My first and most shocking revelation is that they have NOT fixed a key security problem. I'm going to outline this right now and hopefully somebody can fix it Problem #1: Login as root via ssh Guys...guys...guys(or gals)... It is baffling to me that you still allow this. Yes I get that you have a wonderful "Blacklist the my server ip when something goes wrong" and "then disable access to my console to fix" routine going on to protect your network if MY machine gets compromised due to your silly lackadaisical security. Wait, that's actually a negative thing too :) please stop, I'm not going to use you as a provider un...

Java's problem is that Jidigava idigis gididibidigeridigish

I posted a while back about how ruby's syntax is better for designing software than java because it removes extra language cruft and enables developers to write more succinct and direct code. A common response to this from detractors is that "it's only three extra characters" and "my IDE can automatically generate that code for me". Sitting at the train station today reading a comment from someone that said something similar to "geeze, if you've got thousands of lines of code, why do you care about a couple of letters and a parenthesis or curly brace here and there?". I started thinking about why I care and discovered the reason: With those little three letters here and there, your code literally becomes a type of Gibberish In gibberish, you use simple rules to add extra characters here and there (sounds familiar) to create and quite confusing language that is a 1 for 1 direct translation to/from english. While gibberish, pig latin, an...

Software is design, how ruby is better for that job than java

As a long time java developer and ... well ... at this point also a long time ruby developer, I've found some things about the ruby language are much less bothersome than in java. Groovy takes an interesting middle road, but only gets about halfway in my mind. I'll leave the runtime differences and the dynamic/static compiled/interpreted debates for other forums and just focus on the Focus on this one irksome quirk. Property Accessors are too verbose Java Definition class Car { private Color color; public Color getColor() { return color; } public void setColor(Color color) { this.color = color; } } and to use it: Car car = new Car(); Color blue = car.getColor(); car.setColor(blue); The whole getter setter thing is a pain to me. The bean pattern used by java is just overly verbose. For all the OO purists, I get it, we need to hide the private variables and put them behind methods to abstract away the inner structure, but I'm so...

Fixing Perverse Incentives in Software Development

I read with interest an article about picking the right metric to incentivize desired behavior and thought I would add a little of my own personal insight. One problem with many (maybe most) software development organizations is that they inadvertently create perverse incentives , rewarding undesireable behavior and creating confusing and chaotic environments that, despite best efforts of all involved, seem to only on a hit or miss basis produce the desired result. Just as important, often the rewards are implicit and it isn't obvious that developers are actually being rewarded for the errant behavior. Some short examples of widely used, but poor metrics I've observed as well as some simple and arguably better alternatives follow. For example: Rewarding developers for "count of bugs fixed". Without accountability for who created the bug, this simply incents developers to release buggy half finished softwa...

When to refactor code

As a die hard refactorer, but also pragmatic programmer, I often have a tough time articulating to other developers when a refactor is important and when it is gratuitous. I can imagine many people look at decisions I've made about when it is and isn't appropriate and think it's simply a whim or "when I feel like it". To clarify this for both myself and any future victims/co workers involved with refactoring decisions I may make, I submit this 10 item checklist. Is the cyclomatic complexity of the function below 5? Did you completely understand what cyclomatic complexity was without following that link? Do you have an automated test or documented test case for every path through the function? Do all of the existing test cases pass? Can you explain the function and all it's edge cases to me in less than 1 minute? If not, how about 5 minutes? 10 minutes? Are there fewer than 100 lines of code in the function (including comments)? Can you find two o...

Apologetic Agile Development

Having lived through numerous attempts to build software embracing the concepts behind the agile manifesto , I feel there are three large categories folks fall into when talking about agile principles. The curmudgen - these folks have been writing code since punchcards where the state of the art, OR they have been brainwashed by large consulting organizations into thinking that a large heavyweight process is the only way to succeed. Note, a subset of these folks believe that "no process" is actually OK and are quite happy to cowboy-code their way through life. The fanboy - these folks think "everything agile all the time" and will rename status meetings to "scrums". These are folks who are used to working solo on projects that they can do in their heads... or they are simply not clued into the implications of actually having a repeatable process or delivering working software. The apologetic - these folks understand the principles and the value they...

java static fields

A great many people starting out with java development have only a vague understanding of the difference between a "public static String", "public String", and the difference between a class and an object. As this was confusing to me at first, I thought I would give a quick overview. A class defines a template for what data and operations are available when you tell the JVM to create an object. So, for example: class BlogPost { public BlogPost(String inString) { text = inString; BlogPost.latest = this; } public String text = ""; public static BlogPost latest; } When you do the following BlogPost myPost = new BlogPost("Hello"); You're telling the JVM to allocate some memory on the heap to store a reference to a memory location and from now on, when I refer to myPost, it means that memory location. BlogPost is a class, myPost is an Object that is a reference to a memory location that is an ins...