Monday, September 29, 2003

Daniel Geer fired for speaking Truth to Power?

From Computer Reseller News, and Yahoo! News as well:
The chief technology officer for a technology firm that works closely with Microsoft lost his job after he helped write a study critical of the insecurity of Microsoft software.

Daniel E. Geer Jr., an expert with nearly three decades studying technology and computer security, learned Thursday he was no longer employed by AtStake of Cambridge, Mass.

AtStake declined to say whether Geer resigned or was fired. Spokeswoman Lona Therrien said Microsoft did not call for Geer's dismissal, which AtStake said was effective two days ago. Microsoft also said it was not involved in the decision.

But critics said Geer's firing was reflective of Microsoft's far-reaching ability in Washington and across the technology industry to silence experts who complain about weaknesses in its software or its aggressive business practices. The Justice Department struggled years ago to find technology executives willing to testify against Microsoft in its antitrust trial.


Daniel Geer was also a board member of USENIX; a pretty prominent figure in the unix community.

The times we live in... might be time to join EFF?

Pete

Wednesday, September 24, 2003

Agile-flavored development processes 20x better than CMM level 5 shops?

Mary Poppendieck recently posted the following article in the Lean Development list at yahoo. Great statistics - of course kLOC is a bad metric for anything, but when you're talking about a 20x factor, even kLOC-based measurements become interesting.

The contrast of Tayloresque Scientific Management to Agile processes, where teams own the work and own the process themselves, is pretty stunning.

Message: 1
Date: Mon, 22 Sep 2003 09:20:39 -0500
From: "Mary Poppendieck"
Subject: How to improve on CMM Level 5

At Software Development Best Practices in Boston last week, Watts Humphrey gave a keynote talk, and, never having heard him before, I thought I should sit in. He spend a lot of time discussing how improvements in sporting records come from decomposing the event into very tiny segments and improving on the performance of each segment. Then he drove this analogy into software development. It sounded like pure Scientific Management to me - straight out of Frederick Taylor's 1911 classic on work decomposition.

So after the talk we asked him about it. Oh yes, he said, he was a firm believer in Scientific Management. But, said we, didn't he know that Scientific Management has been largely discredited in all the industries in which it has been used? Well, he said, people ought to re-read Taylor's book; it has a lot of good stuff in it. Maybe, but it is based on a very condescending attitude toward workers. Taylor felt that work decomposition and measurement by industrial engineers is necessary because workers are lazy, don't
care about quality or productivity, and are incapable of designing their own jobs.

Later in the talk Humphrey put up a slide titled Defects per Delivered kloc (thousand lines of code). It showed this:

CMM Level 1 - 7.5
CMM Level 2 - 6.24
CMM Level 3 - 4.73
CMM Level 4 - 2.28
CMM Level 5 - 1.05
TSP - 0.06

WHAT???? Here we have a process which produces only 5% of the defects of CMM Level 5. Great! Tell me more about that process!

According to Humphrey, TSP (The Team Software Process) builds self-directed teams and guides these teams in building the best software. Sounds like a winner to me. Humphrey went on to say that the
best teams:

1. Have skilled and committed members
2. Set aggressive but achievable goals
3. Define their own processes [sic]
4. Produce their own plans
5. Make their own commitments
6. Direct their own projects [sic]
7. Consistently use their selected methods
8. Develop the best products

This sounds like the opposite of Scientific Management to me. When one uses the team approach rather than the decomposition approach, one can expect defect rates to drop a couple of orders of magnitude below a CMM Level 5 shop. Great stuff! If only these two highly contradictory approaches weren't being advocated by the same (influential) person in the same talk.

Mary Poppendieck
www.poppendieck.com
952-934-7998

Author of Lean Software Development: An Agile Toolkit


Tuesday, September 23, 2003

Java as a SUV?

This post is making the rounds at some of the blogs I occasionally read. I think it has a critical bit of insight into Sun's character - make hard things possible, but ignore the fact that you're making easy things hard. The explosion of complexity in Java over the course of the past 5-6 years echos the development of Solaris NEO prior to that. Sun abandoned NEO due to a lack of market acceptance, and NEO suffered a lack of market acceptance because CORBA is hard in the first place, and Sun didn't really make it any easier.
That might be a little unfair - Sun removed some of the drudgery of CORBA development with some clever code generation and declarative programming tools, but then you had to understand the code generation and declarative programming tools to get anything done.

You could build really cool, super-scalable, multi-threaded apps, but "hello world" was hard to write.

This seems to be the fate of all too many technologies. Go look at the first edition Bjarne Stroustrup book "The C++ Programming Language" - C++ in the late 80's was a nice, clean, simple language. Then go look at the 911 page "The C++ Programming Language - 3d Edition" - what a nightmare.

Greenspun's article ignores the fact that someone using a specialized tool appropriate for the task at hand, will ALWAYS do better than someone using a generic low-level systems tool. Using PHP for doing web page development is probably a perfect example of this. PHP is simple and doesn't try to do anything other than let you code up templated webpages. Java lets you do a lot more than that, but you pay for the added complexity.

Friday, September 19, 2003

Test Driven drudgery

I've been working on a JNI layer to the iXmatch matching engine. Lots of the JNI code would really be amenable to a code generation system. I'm opposed to code generation most of the time, but this is one area where it feels like it would make sense. Once it's done, I might have to go back and look at what I can abstract out from this.

In the interest of having rock-solid code, I'm writing a substantial test suite to exercise the various elements of the API. The tests would also lend themselves to automatic generation, or at least a macro to spit out most of the setup and teardown code that's specific to each method.

Doing the tests is an interesting exercise in discipline. I feel a LOT slower than I usually do when I'm coding. There are two reasons for this, as near as I can tell. The first is that I gotta write the test, so I'm writing 2x the amount of code I usually do. The second is that writing JNI code isn't that much fun. I suppose it's what writing Objective-C would be like without any compiler support and you had to invoke the objc runtime manually.

However, there's a payoff. The code feels a lot more solid at this stage in the development cycle than I'm used to. That's pretty damn cool, and is probably worth the effort. Now if only I could find some way to make the JNI side of things less painful.

Fun with MP3s

I have an iPod. I love it dearly. I've even swapped mp3s with friends. KaZaa? Not anymore, thank you, the hint of a threat of a lawsuit is more than that's worth.

Are mp3s theivery? Is file sharing theivery? Depends on how you read copyright law, and (like many many other things in the US) how much money you have to spend on lawyers. The Wall Street Journal recently published an editorial from Lee Gomez where Gomez thinks the RIAA is doing the right thing. I heartily disagree. Turns out that a favorite author also disagrees. (Thanks to Chris Sells for providing the link).

Tuesday, September 16, 2003

Hee hee hee - new PowerBooks, at long last

Apple today finally announced updates to the powerbook lineup. Nothing drastic, except in the 15" model, which was waaay overdue for a refresh.

And I see "Apple Mail" SMTP headers in more and more of the emails I get from Sun. Gosling himself is a powerbook user, and IntellJ runs on OS/X.

Getting to be time to retire the thinkpad and switch.

Mac OS/X at Infoworld

Seems like Macintosh and OS/X is getting more respect in the enterprise development world. 'bout time. You don't have to scratch OS/X very deep to get to NeXTStep underneath it, and NeXTStep has always been an enterprise-ready operating system.

Friday, September 12, 2003

JNI annoyances

I've been working on a JNI interface to the iXmatch matching engine. The matching engine API is geared to straight C programming - not Objective-C, not C++, just straight C. As such, it doesn't know much about exceptions, and it doesn't know beans about objects. It likes to shove around arrays of ints. Or better yet, single-precision floats typecast as ints (hey - here's 32 bits in a row, and that's all you need to know about!)

It also likes to return data structures via pointers - if I expect to get back up to 64K of text data, I need to malloc() 64Kchars, and tell the matching engine where to put the result, and how much space is available for it.

None of this maps well onto Java. So, we're tackling this in two steps. The first is to do a private Java class that exposes native methods that map as closely as possible onto the C code, and produce C-side JNI code for this. The second step will be to do a more usable public Java API that maps onto the private API.

The reason for this two-step dance is to let me do most of the marshalling work between the human-usable Java API and the C API in Java rather than in C. This is important, because the JNI interfaces for dealing with java data structures from C are painful at best.

One thing that does want to happen in C, however, is some final validation of data before things are passed off to the engine itself. The Java-appropriate thing to do if these validation tests fail is to throw an exception back to the caller. One would like to be able to write something like:

env->throw("java.lang.InvalidArgumentException", "bogus parameter");


but you don't get to do that. Since java exceptions are classes, you need to get a handle to the class object for the exception you want to throw, and then you can throw it.

This makes the exception handling code uglier than it needs to be, until you write something like the following:


/*
   JNI doesn't make it easy to throw an exception,
   so this utility method might help.
   Throws an exception back to the VM, of the type passed in
   via 'className', and with the message specified in 'message'.
   If the exception class named 'className' isn't found,
   then throw a java.lang.ClassDefNotFoundError
   exception back to the caller.
*/

jobject throwException(JNIEnv *env, const char *className, const char *message)
{
   jclass exc = env->FindClass(className);
   if (exc != NULL)
   {
      env->ThrowNew(exc, message);
   }
   env->DeleteLocalRef(exc);
   return NULL;
}


which is fine, and a reasonable thing to write, but it seems to be that EVERYONE who has to write JNI code is going to have to write that sort of function. Why isn't it part of JNI itself? And if, god forbid, you want to throw a chained exception, you have to go find the method ID of the constructor of the exception you want to throw, create it, and then pass it to throw, checking for exceptions all along the way. Painful painful painful.

Thursday, September 11, 2003

Why geek boy?

The word 'geek' has always amused me, both in its original meaning of:
"1 : a carnival performer often billed as a wild man whose act usually includes biting the head off a live chicken or snake"
and its newer meaning of:
"2 : a person often of an intellectual bent who is disapproved of"

I guess my amusement dates at least back to high school. I was at a friend's wedding this past winter, and was talking with my 12th grade english teacher. I had recently had new business cards made for the pclark.net consulting business, and had a few 'fun' cards made. I asked if she wanted a card, and she said "I bet it says geek on it." The card, of course, listed a job title of 'geek boy'.