With the number of coding for cash contests, popularly called hackathons, exploding, now might be the time that you should consider spending part of your weekend or an evening participating, even if you aren’t a total coder. Indeed, if you are one of the growing number of citizen developers, you might be more valuable to your team than someone who can spew out tons of Ruby or Perl scripts on demand. I spoke to several hackathon participants at the QuickBase EMPOWER user conference last month to get their perspective. You can read my post in QuickBase’s Fast Track blog today.
Category Archives: Published work
Fast Track blog: Lessons Learned From IT Asset Management
As a citizen developer, trying to manage your IT assets can be tough. Keeping track of such things as programs, servers, policies and procedures requires discipline, organization, and best practices that those of us who were raised in the IT school of hard knocks had to learn along the way. Here are a few tips from the IT pros to help you out.
Wanted: more women in software
The tech business for years has had an awful record of employing and retaining female engineers, and this record is getting worse. Women represent less than a third of the typical firm’s engineering staff, and in some cases such as Twitter only 10% are engineers. Top tech management ranks are almost exclusively male.
Over the years, I have accepted this sad fact of our industry, but this week I was at a conference that was almost all populated with women and girls. It was an eye opener for me. Like many of you, I have gotten used to being in a mostly male audience when I attend or speak at tech conferences. This event was called “She’s Pivotal” and the title was purposely multiple meanings. It was organized by the software vendor to showcase the brainy and accomplished women that it employed, along with some stalwarts from St. Louis. It was inspiring and a bit uncomfortable, which is what I imagine many of the female nerds feel when they sit in a typical meeting. One woman in her 50s spoke about when she first started her career; she was the sole member of her gender in most of her meetings. “Now things have progressed to where there are two or even sometimes three of us in a room.” I guess that is progress.
Then there is this: engineering schools graduate many more women that either never end up actually doing any engineering, or who leave the field after a few years. This research from last year found that nearly 40 percent of women who earn engineering degrees quit the profession or never enter the field at all. There could be a variety of reasons for this: after all, many male engineering grads also don’t end up doing engineering too.
One of the ways for tech firms to get more sensitive about women engineers was an effort last year that started to count their actual makeup. Software developer Tracy Chou’s began a voluntary collection effort on GitHub to keep track of these numbers, and numerous firms have entered their workforce gender info on her project. Most firms have less than 20% women, but there are a couple of standouts. For example, Thoughtworks has 29% with 655 women engineers, and Wells Fargo has 24% with 1300 engineers. While not listed, I do know that Mastercard has lots of women in their workforce, and they had several of them (as shown above) attending the event.
Another way is to start recognizing how women can make an engineering staff better, just by their presence. The women managers on the panel spoke about how it wasn’t their coding prowess but their ability to collaborate with others and form strong teams to get projects done. They came from companies such as Express Scripts, EMC and Monsanto. All held management titles and some of them have been around for 15 or 20 years in various engineering positions.
One speaker gave three suggestions for women to succeed in tech. “Try everything to see what you like, when in school take at least one business and engineering class, and just remember that it’s never too late to get more technical education or experience.” All are great ideas.
Ironically, Pivotal themselves isn’t the best example. While Cornelia Davis, their CTO, gave an excellent talk at their event, if you go to their management page online you can see a page of all male faces there. But at least they recognize that it is time for a change, and allowed Davis and other staff members to participate in this event. Certainly, Pivotal isn’t alone: most tech companies, indeed most companies, have all male executive suites. Sadly, the glass ceiling is still firmly in place.
Then there is the movement called #ILookLikeAnEngineer on Twitter. Last year women engineers started posting their pictures with this hashtag. It is a great idea, because the more we all can see them and can realize that there is no singular “look” the better we all will be. Of course, I posted this picture from my childhood that fits the popular stereotype. (Once a nerd, always a nerd.) Those of you that are engineers, I encourage you to post your own selfie.
One of the goals for the event was to get young girls interested in engineering fields while they were still in high school, or even younger. The event was co-sponsored by CoderGirl, a local effort that holds weekly coding meetups to help teach women and girls programming concepts. I spoke to several of the girls at the event who were considering going in this direction, and they all felt encouraged by what they heard from the professional presenters. One girl asked whether she could actually cut it in engineering, given that she wasn’t very good in math. The answer was most definitely yes: Tammy Hawkins, who went on at Mastercard to invent the “Selfie Pay” authentication app, told us that she too wasn’t a math whiz, and managed to just barely pass her last college math course. “But that was fine, because there are always people who can help you who know more,” she said.
That is actually an important point. Many of us – men and women alike – don’t often apply for a job because we don’t think we have the self-confidence or skills required. Programming is a very collaborative culture, and these days teams of programmers work together on solving problems and producing code. You aren’t always going to be the smartest person in the room.
It is time that all companies adapt to a more diverse workforce if they want to succeed. And we need to be on the leading edge in tech. It is time to fix this.
The Fast Track blog: How Can a Non-Programmer Learn to Build Business Applications?
Last month’s Wired magazine featured a cover story entitled, “The End of Code.” Its thesis is that machine learning and neural networks will eventually obviate the need for programmers to write code. While it is an interesting thought, we are far from that situation actually happening anytime soon. Rather than seeing the end of coding, I think we are just at the beginning of a new era where coding and business-led app building is becoming more plentiful and exploding. This is the era of the citizen developer who has to carry the water for the rest of the world.
The issue isn’t whether any of us will or won’t code, but how we can do a better job with the coding tools and low-code platforms that we have at our disposal. My Fast Track blog post today talks more about these issues.
Network World 9-vendor multifactor authentication roundup
Due to numerous exploits that have defeated two-factor authentication, many IT departments now want more than a second factor to protect their most sensitive logins and assets. The market has evolved toward what is now being called multi-factor authentication or MFA, featuring new types of tokens and authentication methods.
For this review in Network World, we looked at nine products, five that were included in our 2013 review, and four newcomers. Our returning vendors are RSA’s Authentication manager, SafeNet’s Authentication Service (which has been acquired by Gemalto), Symantec VIP, Vasco Identikey Authorization Server, and TextPower’s SnapID app. Our first-timers are NokNok Labs S3 Authentication Suite (pictured above), PistolStar PortalGuard, Yubico’s Yubikey and Voice Biometrics Group Verification Services Platform.
All of these products are worthy of inclusion in this review as representative of where the MFA market is heading. In addition, if you want to stay on top of MFA developments, we recommend you follow our Twitter list here.
My review also features a collection of screencaps here, and an overall trends rundown as well here.
Fast and furious under the sea
When the Internet was first getting used by ordinary commercial businesses back in the early 1990s, those businesses didn’t own any of the underlying infrastructure besides their own connection to the nearest peering point. My how times have changed. This week, Microsoft and Facebook announced they are building the next transatlantic cable to exclusively carry their own Internet traffic between their American and European data centers.
When you think about this, it isn’t that surprising. After all, it represents the next step in the evolution of how private companies have built their computing systems on top of the public Internet. It isn’t the first such private cable: Google has been partnering with telcos for years to share their bandwidth, and a new connection from the US to Japan went online earlier this year. Facebook (and others) are even building their own servers, routers and racks out of specialized spare parts, since they need so many of them to run their online businesses.
Another result of this is how many businesses are running without any data centers at all, using private clouds and co-locating their servers at peering points. What used to be all about the connection to the Internet is now about owning the entire stack, down under the sea if you are big enough to afford it.
Certainly, the cost of Internet bandwidth has plummeted in the 25 or so years that a business could buy it. In the early 1990s, if your business was big enough, you purchased a T-1 digital line that topped out at the then amazing speed of 1.5 Mb/s. If you had a lot of demand, you could get a T-3 line that was 30 times as fast.
Of course, when you tell folks today about these early speeds, they look at you strangely and start thinking you date back to the days when there were payphones with actual dials. Given that today the worst DSL speed you can get from your local phone company still gives you a better connection than that old T-1 line it is pretty amazing how fast and far we have come. Today a cable Internet connection can deliver at least 10 Gb/s rates (at least in the download direction). Google and other fiber providers are talking about 100 and 1000 GB/s speeds in both directions, and there are cities (such as Chattanooga) where you can get a gigabit connection at every address. These places have realized that supplying a ultra-fast Internet is an essential part of their municipal services, just like supplying water and staffing the fire and police departments.
And that Microsoft/Facebook undersea cable? It will start out carrying 160 Tb/s, which is at least twice as fast as older cables. I can’t even think at those speeds.
Quickbase blog: How citizen developers can do better with managing their own apps
We have written extensively about the rise of the citizen developer movement, whereby everyone can become a developer because of the widespread availability of rapid app dev tools.
IT professionals have been trained how to manage their app portfolios, and there is no secret to doing this. Here are some ways to start thinking about how you can manage and build more capable apps.
First off, do you need to build a separate app or can you deliver the same functionality with something entirely running entirely on a Web server? While building apps can be cool, it might be easier to set up a URL that your users can access and run the app from their web browsers. Web-based apps can require more skill to understand how to setup the best user experience and appropriate user controls, however. And web-based apps also demand a different skill set than building apps too.
Do you have reliable pool of beta testers? You want to start recruiting people that will give you the best feedback and can identity bugs and other issues before the app gets deployed and used widely. Ideally, they will be users who are forthcoming with their experiences but don’t bury you with numerous and irrelevant email comments. That is often a fine line to walk, however.
How often do you need to update your app? The hard part about app construction isn’t the initial app build, but what happens when your ultimate users get ahold of it and realize 17 new features that they now want as a result of seeing your app. So plan up front for how these updates will happen, how often you intend to do them, who will take responsibility for them and how the updates will ultimately end up in your users hands. Also think about what happens when you have to expire an app or remove it entirely from your portfolio.
Can you build the app with its own security built-in? The answer should be yes: your users should be able to authenticate themselves and obtain the appropriate access rights to the app without having to rely on external Active Directory permissions or other security apparatus. Also, you should build in a mechanism to protect your data generated or used by the app too.
Do you need separate web, desktop, tablet and mobile versions for your app? If so, choose the appropriate tool that can create apps in those operating systems and form factors. Or focus on one or two versions and stick with them. Learn about responsive Web design to make your webpages more effective and useful to users who are running smaller tablet and phone screen sizes. Also, be sure to test the app with the collection of OS versions that your users are running to make sure it operates as expected. And when Google and Apple come out with new OS versions, make sure you stay on top of these updates and find out if your app still works properly.
As you can see, building an app is just the beginning. But the more you cover these issues up front, the better your app experience will be for everyone.
The implications of automated license plate readers
One of the more interesting aspects of our surveillance society is the use of automated license plate reader (ALPR) technology by law enforcement to track the movements of vehicles. Our legal system is far behind in treating this technology, and activists are just beginning to challenge our government in terms of proper use, managing citizen expectations, and shedding daylight on the technology and the resulting data collections.
I got interested in this technology after several trips to Israel: the main north/south freeway uses both the ALPR system and an RFID system to send tolls to those who use the roads. If you have a transponder, you are recognized by the RFID system. If you don’t the ALPR system will send you a bill from the rental company for the tolls a few weks after your rental. Theses sorts of systems are also used in several cities around the world for congestion pricing (London has been doing this for years) when a driver enters the central business district.
Then I read this article in Motherboard about how the Philadelphia police department was using ALPR equipment that was mounted to a vehicle with Google markings. While police departments often use decoy vehicles with fake business logos to hide in plain sight, I think this is the first time anyone was attempting to pass off a Google Street Maps vehicle in this fashion. Naturally, Google was not amused nor apparently consulted in this move. And while the Philly police is allowed to collect license plate data, they can’t just appropriate some legitimate business.
These automated readers are pretty powerful tools: some can collect thousands of plates an hour and can even recognize mud-splattered plates through infrared imaging. When I did my ride-along with a St. Louis city cop, he had me running plates the old fashioned way: by entering them one at a time into a car-mounted computer terminal to query a central database. It wasn’t a cumbersome process, but it did take a moment, if I typed in the plate correctly. (There is a great plot point in the Amazon series “Bosch” that hinges on a mistyped plate number, for fans of that fictional detective.)
But you might start asking questions, which is what I did, about what happens to this data once it is collected. Obviously, the chances of abuse are huge. Several years ago, the ACLU issued a report that looked in the potentials for abuse and said that ALPR technology can be “deployed with too few rules and could become a tool for mass routine location tracking and surveillance.”
On top of this there is an open data movement that allows anyone with a webcam to upload the plates they have collected to a central website. While I am normally a fan of open data, this also has great abuse potential too. What if one of my neighbors starts tracking my movements inadvertently?
There are no federal statutes that limit this collection of data, and of course each state has their own regulations about how long data can be retained and who has access to this data. Minnesota, for example, limits the data collected to only active investigations, and requires the rest to be destroyed. Some states don’t have any requirements about destruction of their data, and others allow agencies to keep the data for years. And there are two private companies that collect plate data and share the information with insurers and car repo vendors, among others.
The Electronic Frontier Foundation has already brought one lawsuit against the Los Angeles police departments. According to the EFF, LAPD and LA county sheriff’s departments have collected millions of plates each week. The EFF has a nice page summarizing what these rulings across the country are at the moment.
So what can you do to defend yourself, especially if you aren’t a suspect? The answer is not much. You might be able to obscure your plate on your car if it is parked in your driveway on your own property, but once you drive it on a public street you have to keep it visible. Also, you should become familiar with the EFF talking points for activists, which are illuminating. In the meantime, keep an eye out for strange vans parked on your street.
iBoss blog: Turning the tide on polymorphic malware
Security startups are using the techniques of polymorphic malware to better protect enterprises and use a tool from the hacker’s world for good instead of for evil. Let’s look at why is this important and why you should care.
Polymorphic malware is nasty stuff. It adapts to a variety of conditions, operating systems and circumstances and tries to evade whatever security scans and protection products to infect your endpoints. It is called that because it shifts its signatures, attack methods, and targets so that you can’t easily identify and catch it.
But turnabout is fair play, especially when it comes to infosec. And now some very clever companies are taking the notion of polymorphism and using it as a defensive countermeasure. These vendors such as JumpSoft, Morphisec, Shape Security and CyActive (now part of PayPal) who can make a target Web server or other piece of network infrastructure appear to change frequently so it can’t be easily identified or infected.
This can thwart attackers that are trying to identify your servers or domain accounts or unpatched endpoints and used targeted exploits to worm their way into your network. As Dudu Mimran, the CTO of Morphisec says on his blog, “An attack is composed of software components and to build one, the attacker needs to understand their target systems. Since IT has undergone standardization, learning which system the target enterprise uses and finding its vulnerabilities is quite easy.”
Actually, poiymorphism isn’t exactly new. Academics have been writing research papers about it for years, under the rubric of “moving target defenses.” There are been two Association of Computing Machinery (ACM) conferences: one in November 2014 in Arizona and a second one last November in Denver. Both covered many ways of implementing such a defense, such as with game theory and other advanced algorithms.
In an article for Network World, a Morphisec executive wrote about three categories of polymorphic defenses. These include using network actions (such as changing the apparent IP address), host actions (such as changing host names and other characteristics), and application actions (such as changing the memory layout of a process to find and execute the app).
The products are still mostly at the startup stage, but they are quickly evolving and gaining customers. For example, Shape sells an appliance that sits behind an enterprise load balancer and with a few configuration commands can protect your network from DDOS, man-in-the-browser and account takeover attacks. It dynamically changes the code behind each page displayed by your webserver every time it is loaded. This defeats many of the automated scripts used in these kinds of exploits.
Today’s polymorphic defenses generally perform a series of actions. First, some kind of trusted source controls the dynamic, real-time changes to a host server, such as a web or database server. Then they create something that isn’t easily recognized by typical attack patterns. These changes are then implemented so that external users can predict what will happen, and thus can’t easily respond or use existing attack methods. Finally, they make sure their code is hardened in such a way that it can’t be easily reverse engineered.
Whether these polymorphic defenses will prove vulnerable to even more sophisticated exploits isn’t yet clear. And whether they will ultimately prove unworkable given all the security features that they have to manage under the covers also isn’t a sure bet. But at least the bad guys are finally getting a taste of their own evil-tasting medicine, and they could prove to be a valuable tool in your security arsenal.
Quickbase blog: How to Make Scheduling Meetings Easier and More Productive
One thing that hasn’t changed about today’s office environment is that meetings are still very much in force. Certainly there are ways to make their end product – such as linked spreadsheets poked fun of by this Xkcd comic — more productive. But there are other productivity gains to be had with meeting scheduling and tracking and online calendar technologies that can be had as well. Before you dive into any of these, realize that you will probably need more than one tool to help, depending on your needs. In my post today for the Quickbase blog I talk about various tools that you can use.