<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Talk Nerdy To Me - Java, C#, .Net &#187; Commentary</title>
	<atom:link href="http://www.gavaghan.org/blog/category/commentary/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.gavaghan.org/blog</link>
	<description>Mike Gavaghan blogs on Java, C#, .Net, and the software industry</description>
	<lastBuildDate>Mon, 22 Feb 2010 22:09:03 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.1</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Got Requirements?  If Not, You&#8217;re Doomed</title>
		<link>http://www.gavaghan.org/blog/2008/03/31/got-requirements-if-not-youre-doomed/</link>
		<comments>http://www.gavaghan.org/blog/2008/03/31/got-requirements-if-not-youre-doomed/#comments</comments>
		<pubDate>Mon, 31 Mar 2008 11:31:07 +0000</pubDate>
		<dc:creator>Mike Gavaghan</dc:creator>
				<category><![CDATA[Commentary]]></category>

		<guid isPermaLink="false">http://www.gavaghan.org/blog/2008/03/31/got-requirements-if-not-youre-doomed/</guid>
		<description><![CDATA[Yet another software development disaster is headed for the digital trash heap of failed projects.  This time, the casualty is software funded by the U. S. Census Bureau.  The Associated Press reports failure to deliver usable software to census enumerators could add as much as $2 billion to the 2010 census. Worse, the AP reports "census officials are considering a return to using paper and pencil to count every man, woman and child in the nation."

This is a spectacular train wreck that had doom written all over it from Day One.  It’s a familiar, predictable pattern constantly repeated since the first clueless manager commanded "just make it user friendly".]]></description>
			<content:encoded><![CDATA[<p>Yet another software development disaster is headed for the digital trash heap of failed projects.  This time, the casualty is software funded by the <a href="http://www.census.gov/" title="U. S. Census Bureau" target="_blank">U. S. Census Bureau</a>.  <a href="http://www.cnn.com/2008/TECH/03/26/census.problems.ap/index.html" title=" Fancy computers spell trouble for 2010 census" target="_blank">The Associated Press reports</a> failure to deliver usable software to census enumerators could add as much as $2 billion to the 2010 <a href="http://en.wikipedia.org/wiki/Census#United_States" title="United States Census" target="_blank">census</a>. Worse, the AP reports &#8220;census officials are considering a return to using paper and pencil to count every man, woman and child in the nation.&#8221;</p>
<p>This is a spectacular train wreck that had doom written all over it from Day One.  It’s a familiar, predictable pattern constantly repeated since the first clueless manager commanded &#8220;just make it user friendly&#8221;.</p>
<p><span id="more-57"></span>The goal was simple enough: create handheld computers for census field workers to interview citizens and to electronically communicate with a central system.  What the Census Bureau got were expensive paperweights unable to transmit the large volumes of necessary data and too complex for census employees to comprehend during tests.</p>
<p>Census Director Steven Murdock blamed the failure on &#8220;communication problems&#8221; between the Census Bureau and the software contractor.  But, the AP learned, &#8220;interviews, congressional testimony, and government reports&#8221; soundly spell out the failure more precisely: &#8220;census officials are being blamed for a poor job spelling out technical requirements.&#8221;</p>
<p>Gee, doesn’t that sound familiar?  As <a href="http://workinghumor.com/quotes/yogi_berra.shtml" title="Yogi Berra Quotes" target="_blank">Yogi Berra so eloquently put it</a>: if you don&#8217;t know where you&#8217;re going, you might not get there.  The Census Bureau failed to spell out what they wanted, so they didn’t get it.</p>
<p><strong>Building software isn’t like shopping for it</strong></p>
<p>How can there be such viral stupidity in corporate leadership that this failure mode burns up capital and burns out developers with such regularity?</p>
<p>Here&#8217;s an analogy that works for me.  Many years ago, I bought a digital video camera.  To do anything meaningful with it, I needed editing software.  Several were available, so I browsed the stores and surfed the discussion groups to learn my options.  Each came with a unique set of functionality and corresponding price tag.</p>
<p>Many video editing products came with cool features I hadn’t even thought about. Suddenly, visions of green screen magic with pan-and-zoom, slow-motion effects did a fade transition to my Best Director acceptance speech at the Academy Awards!  When my decision was made, I plunked down my credit card and walked out of the store with a set of CDs rattling around inside a cardboard box.  I couldn’t wait to see what it could do!</p>
<p>We’re all familiar with this process of buying software.  Why is it so easy? Because <em>somebody else did the requirements analysis for us!</em>  Someone else spelled out the workflow of the user interface.  A subject matter expert carefully described what processes needed to be automated – and how.  The product was carefully prototyped, evaluated, refactored, and packaged into a polished work of technical elegance.  This process took months or years.  But, all we have to do as consumers is waltz into Best Buy on our lunch break.</p>
<p>But, what if no video editing software had ever been written before?  What if I was the first to identify the market and launch a little startup with the goal of making it big with the first video editing software targeting the consumer market?</p>
<p>Therein lies the greatest challenge in software development: building something that has never been built before, envisioning something never seen, describing an inspiration to someone else with sufficient clarity so they may bring it to reality.</p>
<p>Simply deciding on what features might be useful is hard enough.  Creating an interface and an intuitive workflow requires diligence, collaboration, and lots and lots of prototyping.</p>
<p><strong>Where the Census Bureau, and everyone else, gets it wrong</strong></p>
<p>At some point, the Census Bureau approached its contractor and described their needs.  I picture the conversation going something like this:</p>
<p><strong>Census Bureau:</strong> <em>Make us some software for our handheld computers.</em></p>
<p><strong>Contractor:</strong> <em>Okay.  What sort of work do your field workers do?  What are their most common tasks?  What kind of data will they be collecting?</em></p>
<p><strong>Census Bureau:</strong> <em>I don’t have time to go over that.  Just make sure it’s user friendly.</em></p>
<p>The Census Bureau thought they were strolling through Circuit City looking for “Intuit Census Taker 2010 Deluxe”.  They hadn’t stopped to think about what they really needed, they just figured they’d know it when they saw it.</p>
<p>In reality, they weren’t going to find their software on some store shelf.  After all, they needed software that had not been written before.  They needed careful analysis of their requirements.  They needed to identify <em>who</em> would use the software, <em>what</em> their users would be doing, and <em>how</em> they would be doing it.  Requirements analysis is hard.  It takes time.  It is tedious.</p>
<p>This is not work that can be passed on to the developers.  Developers are not the subject matter experts – they’re merely specialists in building dazzling creations meeting exacting specifications.  Leaving them to guess at requirements guarantees they’ll solve the wrong problem.</p>
<p><strong>How to fix it (and not fix it)</strong></p>
<p>Imagine buying a custom home and telling the builder &#8220;build me a home for $250,000…and make it pretty&#8221;.  Your builder can&#8217;t measure &#8220;pretty&#8221;.  How does he know when he’s done?  Requirements must be measurable and verifiable.</p>
<p>Your builder needs specific questions answered like “How many bedrooms?”, “One story or two?”  Failure to answer fundamental questions ensures you’ll blow 250K on a house you don’t want.  Answering these questions is your job – not the builder’s.  Software is no different.</p>
<p>Poor requirements analysis is the most common thread in all failed projects.  Who is responsible for providing requirements?  The primary stakeholders paying for the work.  Unfortunately, business process owners driving the software’s need see requirements definition as too burdensome – too much “busy work” – to task their own resources to address.  <em>Can’t the developers just write the software?  I’ll see if I like when they’re done.</em>  That’s a costly cycle to rely on.</p>
<p>When projects fail, developers take the heat.  Why?  They have no direct reports.  Everyone in the food chain has underlings to berate and scapegoat for their own failures.</p>
<p>So, an endless stream of passing fads gets hauled out to &#8220;correct&#8221; the waywardness of the development staff.  These fads are called &#8220;process&#8221; and go by important and trendy sounding names like <a href="http://en.wikipedia.org/wiki/RUP" title="IBM Rational Unified Process" target="_blank">RUP</a>, <a href="http://en.wikipedia.org/wiki/Extreme_programming" title="Extreme Programming" target="_blank">Extreme Programming</a>, and <a href="http://en.wikipedia.org/wiki/Agile_software_development" title="Agile Process" target="_blank">Agile</a>.  One process after another is ditched for &#8220;better&#8221; processes that theoretically correct the cause of the previous digital disaster.  When another failed product gets pitched into the bit bucket, the developers are erroneously accused of &#8220;not following the process.&#8221;</p>
<p>Don’t get me wrong.  I don’t mean to disparage the litany of software processes that have come and gone over the years.  But, doesn’t anybody wonder why we need so many?  Doesn’t anybody question why new processes continually come along claiming to &#8220;fix&#8221; the shortcomings of all before it?  <em>Why is a workable software process so hard to find?</em></p>
<p>They’re all workable – they simply fail to address the root cause of the problem.  The problem is leadership laziness.</p>
<p>When even halfway competent programmers are given a goal and sent on their way, you can expect them to deliver on all expectations.  Things like process, skill, and experience can influence the cost and maintainability of the code.  But, with clear requirements, you can always expect to get what you want.</p>
<p>So, business leaders, stop looking for the right “process”.  Instead, roll up your sleeves and do a little hard work.  Think about what you want.  Spell it out.  Be available for questions and clarifications.  Don’t make the developers guess.</p>
<p>It’s time well spent.  And, if your time is well spent, then so is your money.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.gavaghan.org/blog/2008/03/31/got-requirements-if-not-youre-doomed/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Whatever Happened to the &#8220;Old School&#8221; Programmers?</title>
		<link>http://www.gavaghan.org/blog/2007/11/26/what-ever-happened-to-the-old-school-programmers/</link>
		<comments>http://www.gavaghan.org/blog/2007/11/26/what-ever-happened-to-the-old-school-programmers/#comments</comments>
		<pubDate>Mon, 26 Nov 2007 05:25:38 +0000</pubDate>
		<dc:creator>Mike Gavaghan</dc:creator>
				<category><![CDATA[Commentary]]></category>

		<guid isPermaLink="false">http://www.gavaghan.org/blog/2007/11/26/what-ever-happened-to-the-old-school-programmers/</guid>
		<description><![CDATA[Uh, oh. I think I'm way too young to sound like such a curmudgeon, but I just can't help myself. Before my recent move to a post-sales role, I spent 15 years writing software professionally. I thought at this point in my career I'd qualify as "the wise elder" - instead, I guess I'm just "the crazy old man who mumbles to himself."

Remember the days of eagerly poring over core dumps to quash that nasty bug? The fascination of learning something new? The determination to write code properly so it could be maintained and easily understood by others? Remember when "so what? it works" just wouldn't cut it for maintainable design?

I loved it. So, what is it with kids these days?]]></description>
			<content:encoded><![CDATA[<p>Uh, oh.  I think I&#8217;m way too young to sound like such a curmudgeon, but I just can&#8217;t help myself.  Before my recent move to a post-sales role, I spent 15 years writing software professionally.  I thought at this point in my career I&#8217;d qualify as &#8220;the wise elder&#8221; &#8211; instead, I guess I&#8217;m just &#8220;the crazy old man who mumbles to himself.&#8221;</p>
<p>Remember the days of eagerly poring over core dumps to quash that nasty bug?  The fascination of learning something new?  The determination to write code properly so it could be maintained and easily understood by others?  Remember when &#8220;so what? it works&#8221; just wouldn&#8217;t cut it for maintainable design?</p>
<p>I loved it.  So, what is it with kids these days?</p>
<p><span id="more-43"></span></p>
<p>A colleague of mine noted that the best programmers have a raw enthusiasm about their work.  They&#8217;re not 9-to-5 coders.  They&#8217;re driven incessantly to learn new things &#8211; to do things right.  They play with ideas in their off hours and on weekends.  They&#8217;re geeks. Total nerds.  And, they&#8217;re proud of it.</p>
<p><strong>From gearhead to bit twiddler</strong></p>
<p>My degree is in mechanical engineering, but my first love was software.  I was writing BASIC on my family&#8217;s <a href="http://en.wikipedia.org/wiki/TRS-80" onclick="javascript:urchinTracker('/outgoing/trs80');" target="_blank" title="Radio Shack TRS-80 Model 3">TRS-80</a> back in late elementary school.  I shunned a formal education in computer science because the curriculum, at least in the late 1980&#8217;s, was almost pure theory: optimizing data structures, theory of languages, operating system design, etc.  All noble causes &#8211; and certainly a worthy field of study.  But, I wanted to <em>build</em> something!</p>
<p>As I finished my degree, it was clear that, despite my enjoyment of mechanical engineering, my true passion was for software. I abandoned my quest to apply my degree and began looking for pure programming work.  I knew there was more out there than just writing a better compiler. I could make <em>applications</em> that normal people could use and would make the world better.</p>
<p>From the late 80&#8217;s to early 90&#8217;s, a great transformation had occurred.  Once, software was written only for very narrow problem domains and computers were found only in special rooms.  Maybe administrative assistants had one for word processing (anybody remember <a href="http://en.wikipedia.org/wiki/Wordperfect" title="WordPerfect" target="_blank">WordPerfect</a>?), but that was it.</p>
<p>By the time I graduated, PCs were beginning to permeate the workplace. Office workers had PCs as surely as they had a chair and a desk.  It would be only a few more years until Netscape, the Web, and the Internet explosion wowed us all.  Even the bursting dot-com bubble couldn&#8217;t stop this new era.</p>
<p>Software wasn&#8217;t just about scientific calculations and data retrieval anymore &#8211; it was about <em>information management</em>. I just knew that massive, ground-breaking systems were waiting to be built.</p>
<p><strong>Sorry, your real world experience doesn&#8217;t interest us</strong></p>
<p>So, there I was in the university placement office trying to get a programming job without a germane degree.  I had spent the last several years building software for a million dollar research project in the mechanical engineering department.  I was kicking butt at the job that had washed out two computer science majors.  I had mastered C++ in a real world application while the ivory tower academics were poo-pooing the burgeoning relevance of object oriented programming.  Yet, I could barely get my foot in the door with any employer.</p>
<p>Despite years of experience and demonstrable ability, I was self-taught and had never set foot in a computer science class.  In the eyes hiring managers, I was a mere hobbyist without hardcore credentials.</p>
<p>Then, one icy morning in a tiny interview room, I once again began the spiel that was beginning to bore even myself: &#8220;No, my degree isn&#8217;t in computer science, but I built these engineering applications, see&#8230;&#8221; The interviewer nodded knowingly and said &#8220;oh, no need to explain, my degree is chemical engineering&#8221;.  This big-wig IT guy from Citicorp was another engineer!  Better yet, he <em>understood!</em> He understood that passion and enthusiasm &#8211; drive and determination &#8211; are what make the grade.</p>
<p>I got the job, and my career began.  Through years of C++ followed by years of Java, I&#8217;ve encountered countless code wizards who coached me, learned with me, and sometimes learned from me.  They had degrees in physics, history, English, theater arts, and marine biology.  They all came to the software field from seemingly unrelated paths.  They learned their trade through energetic devotion to the beauty of their creations.  They were geeks in the purest form.</p>
<p>All of this fascination with software as an art form meant one thing: a team of people dedicated to doing the best job possible &#8211; not because it was good for their employer, but because they loved their work.  They were, and are, the &#8220;old school&#8221; programmers.</p>
<p><strong>I mean no disrespect for computer science majors</strong></p>
<p>Yes, I also met some hot shot CS majors who leveraged their book smarts along with a keen sense of design to help bring triumph to the team.  But, remember the tech bubble?  Companies were spending billions automating every business process.  There just weren&#8217;t enough people with CS degrees to staff all of the projects. Progressive companies began casting a wider net and bringing on the eager but self-taught.  As a group, this would be the <a href="http://en.wikipedia.org/wiki/Motley_crew" title="Motley Crew" target="_blank">motley crew</a> that lived on pizza and No-Doz to build the systems that made startups and large companies thrive.</p>
<p><strong>So, what happened?</strong></p>
<p>As the IT bubble began to rise, salaries went stratospheric.  This created two problems.</p>
<p>First, every college freshman saw IT as a path to riches &#8211; guaranteed employment with high starting salaries.  Colleges and universities now turn out legions of just-in-it-for-the-paycheck programmers. Writing code is tedious, and doing it right requires extraordinary patience.  It often means rewriting working code as requirements change or better solutions reveal themselves.  If your heart isn&#8217;t in it, it&#8217;s going to drive you nuts.  You&#8217;ll do the bare minimum, then clock out at 5:00 and forget about it.</p>
<p>The second problem is companies clamping down on salaries.  Yes, tech salaries of the late 90&#8217;s were obscene and needed to be addressed.  But, the effort has gone too far.  Companies now staff up on low cost, inexperienced, and poorly motivated drones with little desire for excellence.  There&#8217;s no effort to hire real talent.  <a href="http://www.gavaghan.org/blog/2007/07/22/tip-to-it-staffing-companies-respect-your-recruiters/" title="Tip to IT Staffing Companies: Respect Your Recruiters" target="_blank">HR departments recruit solely by filtering thousands of resumes based on keyword searches</a> and then sorting by salary.</p>
<p>There&#8217;s a misconception that developers are plug-and-play.  Somebody whined about wanting more salary and quit?  Replace them with someone cheap!  Companies place little value on experience.</p>
<p>Companies round out the team with one or two superstars &#8211; either old schoolers, or young heroes with passion.  Too bad they give these champions no authority over architecture or design.  Misguided flat team structures mean the hot shots must rely solely on persuasion to have any influence. They are generally shouted down by sophomoric colleagues too lazy to learn anything new or too insecure to entertain any ideas other than their own.</p>
<p>The hot shots get their life and enthusiasm sucked out of them! They&#8217;re left to support and maintain the wreckage left behind by the loudest code slinger.  They quit under the naive belief that &#8220;this must be the <em>only</em> company <em>this</em> dysfunctional!&#8221;  They soon discover that their new job is no better.  The madness is everywhere these days.</p>
<p><strong>What now?</strong></p>
<p>Oh, I still work on my pet projects at home.  It&#8217;s partly because my job requires me to keep my skills sharp despite leaving the day-to-day programming behind.  It&#8217;s mostly because I still get a kick out of making creations and making them better.</p>
<p>Some of my &#8220;old school&#8221; former colleagues have moved out of development, too &#8211; some to eagerly pursue other career goals, others with great reluctance and resignation.  I know at least one who left software entirely to become a high school teacher.  The rest slog through the nonsense, cuss under their breath, and long for the early days when the work was still fun.</p>
<p>Will the corporate world ever start valuing experience again?  Will they truly trust a project to the &#8220;best and brightest&#8221; and not just the &#8220;cheapest and most readily available&#8221;?  Maybe.  I think it still works that way in the Silicon Valley where true software companies that understand the challenges of the trade still thrive.</p>
<p>Unfortunately, it&#8217;s the companies whose core competencies are not software related that&#8217;ll continue to burn out and demoralize the up-and-coming software gurus.  Telecoms, banks, and airlines, for example.  They all see techies as a pure expense &#8211; not specialists who can efficiently automate and streamline their businesses.  They&#8217;ll burn through millions of dollars on failed digital monstrosities by scrimping on their most vital employees and driving off their best talent.</p>
<p>These companies don&#8217;t need an army of unmotivated minimum wagers. All they really need is a handful of old schoolers, pizza, and little No-Doz.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.gavaghan.org/blog/2007/11/26/what-ever-happened-to-the-old-school-programmers/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Earth to Wells Fargo: Stop Being Stupid About Phishing!</title>
		<link>http://www.gavaghan.org/blog/2007/08/09/earth-to-wells-fargo-stop-being-stupid-about-phishing/</link>
		<comments>http://www.gavaghan.org/blog/2007/08/09/earth-to-wells-fargo-stop-being-stupid-about-phishing/#comments</comments>
		<pubDate>Fri, 10 Aug 2007 03:26:44 +0000</pubDate>
		<dc:creator>Mike Gavaghan</dc:creator>
				<category><![CDATA[Commentary]]></category>

		<guid isPermaLink="false">http://www.gavaghan.org/blog/2007/08/09/earth-to-wells-fargo-stop-being-stupid-about-phishing/</guid>
		<description><![CDATA[Have banks learned nothing? According to Gartner, U.S. computer users lost $929 million to phishing scams from May 2004 to May 2005. In response, major banks have launched aggressive campaigns to educate customers about how to defend themselves and recognize fraudulent emails.

Their recommendations to customers are simple and easy-to-follow. If someone calls you on the phone asking for your ATM number, don't give it to them! Only divulge secret information when you initiated the phone call. Be wary of emails asking for you social security number or credit card numbers. You know the drill.

So, why is Wells Fargo undermining all of these self-defense measures by sending out emails with hyperlinks to a Web site asking for your online banking username and password?!]]></description>
			<content:encoded><![CDATA[<p>Have banks learned nothing? <a href="http://www.csoonline.com/talkback/071905.html" target="_blank" title="How Can We Stop Phishing and Pharming Scams?">According to Gartner</a>, U.S. computer users lost $929 million to <a href="http://en.wikipedia.org/wiki/Phishing" target="_blank" title="Phishing">phishing</a> scams from May 2004 to May 2005. In response, major banks have launched aggressive campaigns to educate customers about how to defend themselves and recognize fraudulent emails.</p>
<p>Their recommendations to customers are simple and easy-to-follow. If someone calls you on the phone asking for your ATM number, <em>don&#8217;t give it to them!</em> Only divulge secret information when <em>you </em>initiated the phone call. Be wary of emails asking for your social security number or credit card numbers. You know the drill.</p>
<p>So, why is Wells Fargo undermining all of these self-defense measures by sending out emails with hyperlinks to a Web site asking for your online banking username and password?!</p>
<p><span id="more-35"></span></p>
<p><strong>It&#8217;s easy to get fooled</strong></p>
<p>My step-mother is timid about computers, but last year she entered the brave new world of online banking. At about that time, I received a phishing email from a scammer masquerading as Chase Bank. The email was slick. It had all the images and logos copied from the legitimate Chase Web site. When you clicked the embedded link, it brought up a beautifully forged Chase Web site with a login screen.</p>
<p>Well, I knew it was a fraud &#8211; mostly because I&#8217;m not a Chase customer. The embedded links were pointing somewhere besides Chase.com, but that was hidden in the HTML. All in all, it was a high quality fake. But I wondered &#8220;what happens if I play along?&#8221;</p>
<p>I clicked a link that brought up a login page. I entered bogus credentials and <em>voila!</em> I was &#8220;authenticated&#8221;. Obviously, they let any username/password combination get through. The next screen asked for my credit card number, ATM number, mother&#8217;s maiden name, etc. At this point, had I been a real Chase customer, the hucksters would have had my login credentials and complete control over my online account.</p>
<p>Adding to their cleverness, they set a cookie in my browser so subsequent clicks on the email link would cause me to be redirected to the <em>real</em> Chase Web site. I guess this was just in case their &#8220;mark&#8221; got suspicious and wanted to check out the link a second time. By getting sent to the real Chase site when the scam was over, you&#8217;d see your real account information and, ostensibly, not get suspicious.</p>
<p>As a techie, I was pretty impressed with their ingenuity. I was <em>so</em> impressed that I had to admit, in a weak moment, I could easily have been snookered. Heck, it only takes a momentary lapse of judgment to type in your password.</p>
<p>So, I told my step-mother and a few other family members about it to show them just how convincing a hustle can look. Not all criminals are bad spellers (one of the most common hallmarks of a phishing scam). I wanted to sensitize them to the danger.</p>
<p><strong>Wells Fargo gets stupid</strong></p>
<p><a href="http://www.gavaghan.org/blog/wp-content/uploads/2007/08/wfemailimage.jpg" onclick="javascript:urchinTracker('/outgoing/wells_fargo_email');" target="_blank" title="Wells Fargo Email"><img src="http://www.gavaghan.org/blog/wp-content/uploads/2007/08/wfemailimage.thumbnail.jpg" alt="Wells Fargo Email" style="float: right" title="Wells Fargo Email" /></a>I&#8217;m not a Chase customer, but I <em>am</em> a Wells Fargo customer. Click on the thumbnail on the right to see a screen shot of an email they recently sent me. While telling me my &#8220;privacy is assured,&#8221; they invite me to click on an embedded hyperlink and &#8220;Sign On To Online Banking.&#8221;</p>
<p>My spidey sense went off on this. Large lights spelling &#8220;Danger! Danger!&#8221; flashed in my headed. I couldn&#8217;t imagine this being anything <em>other</em> than a trick to get me to divulge my online banking credentials to a cyberhoodlum.</p>
<p>But, the email looked eerily familiar. This August 9th email looks similar to an email I received on June 14th. Scammers seldom try the same shtick for too long, so a two-month-old scam seemed unusual. Also, I had recently received a third, similar email that had my full name embedded in it (an unlikely mass-emailed phishing scenario).</p>
<p>So, I dug into the raw contents of the email. Here are the SMTP headers:<br />
<code><br />
Return-Path: <wellsfargo@wellsconnect.wellsfargo.com></wellsfargo@wellsconnect.wellsfargo.com><br />
Received: from om-wellsfargo.rgc3.net ([66.35.244.164])<br />
by smtp.gavaghan.org (JAMES SMTP Server 2.2.0) with SMTP ID 571<br />
for <mike@gavaghan.org></mike@gavaghan.org>;<br />
Thu, 9 Aug 2007 17:58:11 -0500 (CDT)<br />
Received: by om-wellsfargo.rgc3.net id hnee720664ov for <mike@gavaghan.org></mike@gavaghan.org>; Thu, 9 Aug 2007 16:00:00 -0700 (envelope-from <wellsfargo@wellsconnect.wellsfargo.com></wellsfargo@wellsconnect.wellsfargo.com>)<br />
MIME-Version: 1.0<br />
Content-Type: text/html;<br />
charset="ISO-8859-1"<br />
Content-Transfer-Encoding: quoted-printable<br />
Date: Thu, 9 Aug 2007 16:00:00 -0700<br />
From: "Wells Fargo Online" <wellsfargo@wellsconnect.wellsfargo.com></wellsfargo@wellsconnect.wellsfargo.com><br />
Reply-To: "Wells Fargo Online" <reply@wellsfargo.rsc01.net></reply@wellsfargo.rsc01.net><br />
Subject: Online Banking Basics - Privacy<br />
X-cid: wls.1469.253<br />
X-sgxh1: upsLxnHNHnoHgQhjn<br />
To: mike@gavaghan.org<br />
X-valueof-AFFINIUMCODE: 2007080848744<br />
X-valueof-DATA5: null<br />
X-valueof-CELLCODE: YYMMLCOLB22<br />
Message-Id: &lt;4288517.1186700292455.JavaMail.SYSTEM@SOMBRITA&gt;<br />
James-RelayLocation: id=38045;country=US;region=CA;city=Redwood City;postalcode=94065;latitude=37.5331;longitude=-122.247;<br />
dmacode=807;areacode=650;isp=Exodus IDC - SV/SC8;organization=Responsys;error=;<br />
</code></p>
<p>What can we glean from the headers? Most importantly, the IP address of the server that sent the email. I traced the IP address back to a Redwood City, California-based marketing company called <a href="http://www.responsys.com/" target="_blank" title="Responsys">Responsys</a>. (Many thanks to the geolocation technology at <a href="http://www.maxmind.com/" target="_blank" title="MaxMind">MaxMind</a> for making this possible!).</p>
<p>Is it possible Responsys had their email servers compromised by a hacker and turned into spam zombies? I was opened to that possibility, but ruled it out once I realized, from the raw HTML in the email, that this email was definitely legit.</p>
<p>When I looked at the raw HTML to see where the links were really pointing, I saw they were all pointing to the legitimate Wells Fargo domain name. You can see the raw contents of the email for yourself by <a href="http://www.gavaghan.org/blog/uploads/wfphishing/Online%20Banking%20Basics%20-%20Privacy.txt" onclick="javascript:urchinTracker('/outgoing/wells_fargo_raw_email');" target="_blank" title="Raw email from Wells Fargo">clicking here</a>.</p>
<p><u>Conclusion:</u> this is not a phishing scam. This is a legitimate email from Wells Fargo, sent on their behalf by Responsys, as part of a marketing campaign.</p>
<p><strong>Marketing email from banks is bad juju</strong></p>
<p>What were they <em>thinking?</em> The IT security folks at Wells Fargo must be going nuts! They need to give a stern lecture to the brainless suits in marketing who thought this was all a good idea.</p>
<p>Wells Fargo&#8217;s own website<a href="https://www.wellsfargo.com/privacy_security/fraud/operate/examples" target="_blank" title="Fraudulent Email (phish) Examples"> warns customers about phishing</a> on a page replete with real world phishing examples. Their &#8220;fraud tips&#8221; admonish customers <a href="https://www.wellsfargo.com/privacy_security/fraud/protect/fraud_tips" target="_blank" title="Fraud Tips">to be wary of suspicious emails</a>.</p>
<p>My favorite is their page that <a href="https://www.wellsfargo.com/privacy_security/fraud/operate/emails" target="_blank" title="Fraudulent Emails and Websites">characterizes some of the common attributes of fraudulent email.</a> Many of the attributes pertain to Wells Fargo&#8217;s own marketing campaign! Let&#8217;s take a look:</p>
<p>Fraudulent emails will often:</p>
<p><u>&#8220;Ask you for personal information&#8221;</u> Their email contains links to pages that ask for your username and password.</p>
<p><u>&#8220;Appear to come from a legitimate source&#8221;</u> Well, <em>duh!</em> It <em>is</em> coming from a legitimate source.</p>
<p><u>&#8220;Link to fraudulent websites&#8221;</u> The text goes on to say &#8220;fraudulent emails may direct you to counterfeit websites carefully designed to look legitimate&#8221;. The world is filled with spammers who can&#8217;t spell and who do amateurish hack jobs on forged sites. But, Wells Fargo acknowledges that some fraudulent Web sites are so elaborate they&#8217;re nearly indistinguishable from the real thing. The bogus Chase site I went to was probably a copy-and-paste job directly from the actual Chase site.</p>
<p>The moral of the story? There are no easy ways &#8211; particularly for those who aren&#8217;t as tech savvy as the readers of this blog &#8211; to distinguish legitimate marketing from phishing.</p>
<p><strong>What Wells Fargo <em>ought</em> to do</strong></p>
<p>Stop sending email that asks for passwords.</p>
<p>Banks don&#8217;t call you on the phone to ask for your ATM number. That&#8217;s a cardinal rule. Banks always advise you not to give away secret information, like your social security number, over the phone unless <em>you</em> place the call. Assume anyone that calls you is a hustler.</p>
<p>This is easy advice to follow &#8211; and it works. Banks would be ill advised to start initiating legitimate phone calls to customers asking for personal information. It would cause customers to let their guard down if <em>some</em> calls are real.</p>
<p>So, why does Wells Fargo insist on muddying the waters with regard to email? It would be most secure to simply tell customers &#8220;we&#8217;ll never send you email asking for personal information.&#8221; Assume all such email is a scam. Period.</p>
<p>Unfortunately, Wells Fargo is telling customers &#8220;some email that looks like it comes from us is real, and some isn&#8217;t.&#8221; The burden is on the customer to discriminate. But, by Wells Fargo&#8217;s own admission, that&#8217;s pretty hard to do!</p>
<p>Why am I picking on Wells Fargo? It&#8217;s solely because I happen to be a customer (and, despite this rant, I&#8217;m a very satisfied and happy customer). Perhaps Chase, Bank of America, Citibank, and every other major financial institution operates like this. I don&#8217;t bank with them, so I&#8217;m not in a position to know.</p>
<p>But, if other banks send out email like this, they should stop. If not for me, do it for my step-mother and all the other less-geeky folks who could use a hand defending themselves in the sometimes dangerous online world.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.gavaghan.org/blog/2007/08/09/earth-to-wells-fargo-stop-being-stupid-about-phishing/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Tip to IT Staffing Companies: Respect Your Recruiters</title>
		<link>http://www.gavaghan.org/blog/2007/07/22/tip-to-it-staffing-companies-respect-your-recruiters/</link>
		<comments>http://www.gavaghan.org/blog/2007/07/22/tip-to-it-staffing-companies-respect-your-recruiters/#comments</comments>
		<pubDate>Mon, 23 Jul 2007 01:01:43 +0000</pubDate>
		<dc:creator>Mike Gavaghan</dc:creator>
				<category><![CDATA[Commentary]]></category>

		<guid isPermaLink="false">http://www.gavaghan.org/blog/2007/07/22/tip-to-it-staffing-companies-respect-your-recruiters/</guid>
		<description><![CDATA[Ever get a phone call from an IT recruiter that leaves you scratching your head wondering "what was that all about?" You know - the recruiter who wants you to take a gig in a city you don't want to move to, doing work you have no qualifications for, and for $15/hr less than your current rate? Yeah, they rankle me, too.

It's not the recruiter's fault.

Many IT staffing companies are utterly clueless about the extraordinary value their recruiters add to the company's image in the eyes of job candidates. I've been a software professional since 1992 -- C++, Java, and now C# -- and I value the relationships I've formed with a handful of hot-shot recruiters in the Dallas area. Later, I'm going to hold up a lady named Shanna as an example of the sort of top-notch recruiter staffing companies should strive to attract and retain.

Unfortunately, many companies believe technical recruiting is a low-skill, no-experience-necessary sort of job. All they need to do is hire a bunch of low-pay, disposable cube drones like a telemarketing firm filling a call center. Make as many phone calls as possible and they'll maximize the number of techies they reach, right?]]></description>
			<content:encoded><![CDATA[<p>Ever get a phone call from an IT recruiter that leaves you scratching your head wondering &#8220;what was <em>that</em> all about?&#8221;  You know &#8211; the recruiter who wants you to take a gig in a city you don&#8217;t want to move to, doing work you have no qualifications for, and for $15/hr less than your current rate?  Yeah, they rankle me, too.</p>
<p>It&#8217;s not the recruiter&#8217;s fault.</p>
<p>Many IT staffing companies are utterly clueless about the extraordinary value their recruiters add to the company&#8217;s image in the eyes of job candidates.  I&#8217;ve been a software professional since 1992 &#8212; C++, Java, and now C# &#8212; and I value the relationships I&#8217;ve formed with a handful of hot-shot recruiters in the Dallas area.  Later, I&#8217;m going to hold up a lady named Shanna as an example of the sort of top-notch recruiter staffing companies should strive to attract and retain.</p>
<p><span id="more-8"></span>Unfortunately, many companies believe technical recruiting is a low-skill, no-experience-necessary sort of job.   All they need to do is hire a bunch of low-pay, disposable cube drones like a telemarketing firm filling a call center.   Make as many phone calls as possible and they&#8217;ll maximize the number of techies they reach, right?</p>
<p>The recruiters are essentially thrown to the wolves.  They&#8217;re not given the training they need.  They&#8217;re given poor information to pass on to candidates.  They suffer the ire of techies who probably got five <em>other</em> calls recently from poorly equipped recruiters.  When the recruiters burn out, they quit and get replaced by some other college sophomore on summer break.</p>
<p>Technical recruiting <em>is hard work!</em>  It&#8217;s a highly skilled job where experience should not be undervalued.  Give these people the training, tools, mentoring, and <u>respect</u> they need and deserve!</p>
<p><strong>Would you like some fries with that contract?</strong></p>
<p>There&#8217;s a staffing company &#8212; let&#8217;s call them &#8220;Phone Monkeys &#8216;R&#8217; Us&#8221; &#8212; that has me in their database.  So, they call me monthly.  Here&#8217;s an example of a recent call:</p>
<blockquote><p>&#8220;Hello, Mr. Gavaghan.  My name is <em>[mumble, mumble]</em> and I&#8217;m looking for someone interested in <em>[voice fades out briefly]</em> with a lot of experience in <em>[unintelligible]</em>.  Would you or someone you know be interested?&#8221;</p></blockquote>
<p>His pitch was as clear and enthusiastic as the speaker at a fast food drive-thru.  Who can blame him?   He was reading from a script, and he had already called 50 other people that day.   All he knows is he&#8217;s on a short term gig to make a few bucks before he moves on to a &#8220;better&#8221; job.</p>
<p>His employer rationalizes that if he brings in one candidate for every thousand calls, that&#8217;s enough to turn a profit.  Isn&#8217;t that the arithmetic spammers use?</p>
<p><strong>The voice and image of the entire company</strong></p>
<p>I want to find an executive at Phone Monkeys &#8216;R&#8217; Us, grab him by the shoulders, and say:</p>
<blockquote><p>&#8220;So, you&#8217;ve got a stylish office on the top floor of a swanky building in downtown.  You&#8217;ve got leather chairs, a cool looking fish tank, and a pot of freshly brewed Starbucks up front where the eye-candy receptionist greets visitors. Guess what? <em>I haven&#8217;t seen any of it!</em></p>
<p>I need <em>something</em> that&#8217;ll make me believe <em>your</em> company is one worth investing my time to research.  If you&#8217;re different from all the others, <em>show me</em>.  You might be a first rate outfit with some high paying clients, but over the phone you&#8217;re indistinguishable from the scores of fly-by-nights that fill this town.  Your recruiter isn&#8217;t merely my first impression.  Right now, he&#8217;s my <em>only</em> impression!</p>
<p>To job candidates, recruiters are <u>the voice and image of your entire company.</u>  Before I&#8217;m going to sit down in your office to close the deal, it&#8217;s your recruiter that&#8217;s going to bring me in the door.  Now do you see how important they are?&#8221;</p></blockquote>
<p>That&#8217;s why the execs at Phone Monkey should fear a competitor&#8217;s recruiter like Shanna.</p>
<p><strong>It&#8217;s the relationship, stupid</strong></p>
<p>Shanna first called me back in the late 1990&#8217;s when I was still doing Java work. I remember her giving me a detailed job description for the sort of work I&#8217;d be interested in (which is also an accolade for the account manager who put the job description together in the first place).    I was impressed, but unavailable.</p>
<p>Shanna would continue to check in with me from time to time.   Each time, she presented a job opening that seemed tailor made for me.   She was professional and jovial.   I suppose it&#8217;s quite a trick to be aggressive without <em>appearing</em> aggressive.</p>
<p>She checked up on me for <em>years</em> without actually placing me anywhere.   Then, in 2003, I found myself on a disastrous contract, and I needed to get out quickly.   I could have posted my resume on a job board, but I thought I&#8217;d call Shanna first.</p>
<p>Did you catch that? I called <u>her.</u>   Not the other way around.</p>
<p>I&#8217;m &#8220;on the market&#8221; for maybe two weeks every one to two years. Every time a recruiter calls, I&#8217;m probably not looking for work at the moment.   When I <em>do</em> start a job search, the odds of a recruiter calling me within that narrow time window are pretty slim.</p>
<p>With Shanna, however, I had a relationship.   Without actually trying, her name stuck in my brain over the years.  She&#8217;d call, and I&#8217;d think to myself &#8220;Oh, yeah. I remember her.  She&#8217;s the recruiter who&#8217;s always trying to fill the cool jobs&#8221;.</p>
<p>Now, contrast that to Phone Monkeys &#8216;R&#8217; Us.  They call monthly, and I get a different recruiter <em>every time</em>.  If I hit the market today, I wouldn&#8217;t even know which Phone Monkey to ask for!    While the Phone Monkeys are dialing away on fruitless calls to candidates, Shanna has candidates calling <em>her!</em></p>
<p>Sure enough, when I called, Shanna had a position for me.  In days, I had an interview and an offer.   It would turn out to be a nearly two year stint and one of the most professionally rewarding contracts I&#8217;ve ever had.  After years of trying, she and her employer were finally making money off of me.</p>
<p>It gets better.  When colleagues ask for a referral, I send them to Shanna.  I don&#8217;t send them to her staffing company, I send them directly to <u>her</u>.  &#8220;Call and ask for Shanna,&#8221; I say.  Heck, through years of mergers and acquisitions, her employer has had no fewer than three names!  The company&#8217;s current name is generic sounding and carries little recognition among techies.   It doesn&#8217;t matter, because Shanna is their voice and image.  They&#8217;ve got somebody on the payroll who knows how to bring people in.</p>
<p><strong>My advice to IT staffing companies</strong></p>
<p>I don&#8217;t know how long Shanna has been working as a technical recruiter, but she&#8217;s been working with me at least eight years.  In addition to Shanna, I also have a few other recruiters on my &#8220;short list&#8221; of phone numbers to never lose.   All of them have many years of experience.</p>
<p><u>Think &#8220;fewer, but better&#8221; recruiters.</u>   Do what it takes to keep experienced recruiters on board.  Sure, you&#8217;ll need to pay them more, but their bang-for-the-buck will be a win-win.  Leverage their experience to mentor new recruiters.</p>
<p><u>Think &#8220;fewer, but better&#8221; phone calls.</u>   Have recruiters spend more time reading the resume and preparing for the call before dialing the candidate.</p>
<p><u>Don&#8217;t call techies just to ask for a referral.</u> You&#8217;ll only peeve them. I don&#8217;t care if your recruiters call only every other month. You&#8217;re competing with a hundred McStaffing companies that call twice a week. Don&#8217;t let someone else&#8217;s bad reputation rub off on you. If your recruiters are respected by the techie, the referrals will come automatically.</p>
<p><u>Prepare for a conversation, not a sales pitch.</u>   Help recruiters gain a basic understanding of what technology is out there.  Candidates are bound to ask for more information about a job, and it&#8217;s important that the recruiter can either answer the question or accurately relay the question back to the hiring manager.  (i.e., Java is <em>nothing</em> like JavaScript &#8211; not even close!)</p>
<p><u>Build a relationship.</u>    Nearly all calls will be to a candidate who isn&#8217;t available right now.  If your recruiters are good, they&#8217;ll be remembered.  Candidates will call <em>them</em> when the time is right.</p>
<p><strong>What do other techies think?</strong></p>
<p>Am I way off base, here?  What makes <em>you</em> really want to work with a particular staffing company?  What makes a staffing company appealing to techies?  How can great staffing companies &#8211; over the phone &#8211; distinguish themselves from the brainless Phone Monkeys filling the market?</p>
]]></content:encoded>
			<wfw:commentRss>http://www.gavaghan.org/blog/2007/07/22/tip-to-it-staffing-companies-respect-your-recruiters/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Java and C#: Language Nuances Make You Think Differently</title>
		<link>http://www.gavaghan.org/blog/2007/07/18/java-and-csharp-language-nuances-make-you-think-differently/</link>
		<comments>http://www.gavaghan.org/blog/2007/07/18/java-and-csharp-language-nuances-make-you-think-differently/#comments</comments>
		<pubDate>Wed, 18 Jul 2007 21:14:48 +0000</pubDate>
		<dc:creator>Mike Gavaghan</dc:creator>
				<category><![CDATA[Commentary]]></category>

		<guid isPermaLink="false">http://www.gavaghan.org/blog/2007/07/18/java-and-c-language-nuances-make-you-think-differently/</guid>
		<description><![CDATA[When you move from one programming language to another, do you eventually find yourself thinking differently?]]></description>
			<content:encoded><![CDATA[<p>When you move from one programming language to another, do you eventually find yourself thinking differently?</p>
<p>After eight years of slinging Java code, I converted over to C#.  The C# language borrows (steals?) heavily from Java, but it also has added some features.  Some of C#&#8217;s most valuable introductions to the language have now been adopted by Java.  Things like attributes, generics, and auto-boxing &#8211; which first appeared in C# &#8211; have now been added to the JDK as of 1.5.  It&#8217;s only a matter of time until Java adopts <code>using-blocks</code> and the <code>yield</code> keyword, too.</p>
<p>Despite this back-and-forth trading of features and enhancements, each language still maintains its distinct flavor.  Some facets of each language &#8211; many of which are quite subtle &#8211; will probably <em>never</em> be adopted by the other simply because their introduction would create such a fundamental shift in language concepts it would invalidate a lot of prior work.</p>
<p>So, I was careful about my approach to C#.  My Java work had been preceded by seven years of C++, and I remember what that transition was like.  Although Java is strikingly similar to C++, the similarities are deceiving.  Seemingly minor differences between the two languages created a sea change in how I thought, how I designed code, and how I tested applications.</p>
<p><span id="more-17"></span>Java introduced me to new things like garbage collection, type reflection, and meaningful exception handling.  At first, I tried to write Java like a C++ programmer.  It took some time to get my brain adjusted to a new paradigm.  Once I did, however, I was able to unleash the true power of the technology by leveraging new, fundamental concepts of the language.</p>
<p>Hence, I approached C# with an abundance of caution.  Despite C#&#8217;s similarity to Java, I didn&#8217;t want to stay shackled to &#8220;the Java way&#8221; of doing things.  I kept a sharp eye on what other developers were doing and tried to gain insight into the most effective way to adopt the language.</p>
<p>Now that I&#8217;ve gained experience in C# &#8211; but continue to do some Java work on the side &#8211; I can see how seemingly trivial differences in the languages impact my design decisions.  Off the top of my head, two things come to mind&#8230;</p>
<p><strong>C# events and delegates</strong></p>
<p>This is a huge win for C#.  I use the <a href="http://en.wikipedia.org/wiki/Observer_pattern" target="_blank" title="Observer Pattern">Observer Pattern</a> all over the place now.</p>
<p>The Observer Pattern, of course, allows you to decouple the events generated by an object and the objects that listen for them.  In Java, making this work requires a lot of effort on the part of the programmer.  For your observed class, you need to create an interface which captures all of your events, manually implement methods to add and remove your listeners, and manually iterate over your list of listeners in order to raise events.</p>
<p>Even implementing event listeners is ugly.  You need to create an implementation of the event interface &#8211; stubbing out all of the uninteresting events with no-ops &#8211; and have that class make callbacks to your business object.  Anonymous inner classes help a bit, but they still clutter up the code.</p>
<p><code>java.util.Observable</code> &#8211; a weak attempt to encapsulate this design pattern into a class &#8211; has been around since JDK 1.0, but it fails to be useful in anything but contrived, academic examples.</p>
<p>In short, the level of effort required to make the Observer Pattern work in Java is so overwhelming it is seldom implemented except in the most compelling cases.  Most Java developers, though not intentionally lazy, simply don&#8217;t think to reach for this tool and end up creating tightly coupled code which is harder to test and maintain.</p>
<p>C#&#8217;s decision to add events as first-class members of a class and delegates as first-class data types makes hooking up listeners to events as easy as calling the <code>+=</code> operator.  For those of you unfamiliar with C#, think of delegates as typesafe method pointers and events as special class properties that automatically manage a collection of delegates.  All of those listener interfaces and anonymous inner classes from the Java world get reduced to a single line of code.</p>
<p>The complexity of the Observer Pattern in Java makes me reluctant to use it if I can envision a &#8220;cleaner&#8221; solution, but the simplicity of implementing the pattern in C# makes using it second nature.  As a result, I design code in C# that looks fundamentally different from what I&#8217;d design in Java.  It&#8217;s not deliberate.  It&#8217;s just that the nature of each language naturally steers me toward a particular way of solving certain problems.</p>
<p><strong>Virtual methods</strong></p>
<p>In Java, all methods are overridable by default.  To disallow overriding a method, you have to explicitly declare it using the <code>final</code> keyword.  C# is exactly the opposite.  A method on a C# class may not be overridden unless it is explicitly declared with the <code>virtual</code> keyword.</p>
<p>A minor difference?  No way.  In C#, the inability to make minor behavioral changes to third party classes is driving me insane!</p>
<p>The only semi-legitimate rationale I can think of for this default behavior is performance.  Invoking an overridable method requires an extra step of finding the method pointer in a lookup table instead of invoking it directly.  Still, this is a silly argument.  If your application is so in need of this performance boost, you are using the wrong programming language.</p>
<p>Allowing other code to override your class&#8217; methods makes your classes more extensible.  Although some classes use the <a href="http://en.wikipedia.org/wiki/Template_method_pattern" target="_blank" title="Template Method Design Pattern">Template Method</a> design pattern to deliberately leverage overridable methods, most class designers can seldom predict how and where the consumers of their classes might benefit from polymorphic behaviors.</p>
<p>Developers almost always take the default path unless they&#8217;re envisioning a particular usage.  Therefore, the default path for class methods should be the most useful and extensible one &#8211; overridable unless explicitly declared otherwise.</p>
<p>Once again, a seemingly trivial distinction between two languages drives my thought process. Knowing that third party C# classes probably limit polymorphism (unless <em>every</em> method is declared <code>virtual</code>), I&#8217;m forced to approach my problem solving differently than I would in a Java application.</p>
<p><strong>Conclusion</strong></p>
<p>Do these two examples imply that either C# or Java is &#8220;flawed&#8221;?  No.  But, they certainly highlight how moving between the two can create some consternation for developers as they are forced to &#8220;think differently&#8221;.</p>
<p>How does moving between languages make <em>you</em> think differently?  Please comment.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.gavaghan.org/blog/2007/07/18/java-and-csharp-language-nuances-make-you-think-differently/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>The Perils of Experience &#8211; Cutting the Ends Off the Pot Roast</title>
		<link>http://www.gavaghan.org/blog/2007/07/15/the-perils-of-experience-cutting-the-ends-off-the-pot-roast/</link>
		<comments>http://www.gavaghan.org/blog/2007/07/15/the-perils-of-experience-cutting-the-ends-off-the-pot-roast/#comments</comments>
		<pubDate>Mon, 16 Jul 2007 01:40:40 +0000</pubDate>
		<dc:creator>Mike Gavaghan</dc:creator>
				<category><![CDATA[Commentary]]></category>

		<guid isPermaLink="false">http://www.gavaghan.org/blog/2007/07/15/the-perils-of-experience-cutting-the-ends-off-the-pot-roast/</guid>
		<description><![CDATA[I heard the parable about "Cutting the Ends Off the Pot Roast" early in my career. I think it really captures the danger of defending software architecture and design decisions with the simple argument "because that's how it's done." A “best practice” solution applied to the wrong problem is costly.]]></description>
			<content:encoded><![CDATA[<p>In software development, experience matters.<span> </span>A former boss of mine used to say “Good judgment comes from experience.<span> </span>Experience is the result of a lot of bad judgment.” Most of my sense of &#8220;the right way&#8221; to do things has been formed by first doing it in every conceivable <em>wrong</em> way.</p>
<p>In our rapidly changing field, there are seldom &#8220;textbook solutions&#8221; to problems. The textbooks are out of date shortly after they go to press!<span> </span>Thus, we defend our technical decisions &#8211; be it object modeling or database design &#8211; by pointing out the flaws in the alternatives.<span> </span>We become aware of these flaws by reflecting on past experiences with the same problem.<span> </span>A successful solution to the problem then produces a design pattern, and a proven design pattern applied to future projects allows us avoid prior mistakes.</p>
<p>That&#8217;s perfectly reasonable &#8211; mostly. Unfortunately, that can lead to a trap when we forget the original problem behind our so-called “best practice” solution.<span> </span></p>
<p><span id="more-3"></span>I heard the parable about &#8220;Cutting the Ends Off the Pot Roast&#8221; early in my career. I think it really captures the danger of defending software architecture and design decisions with the simple argument &#8220;because that&#8217;s how it&#8217;s done.&#8221;<span> </span>A “best practice” solution applied to the wrong problem is costly.</p>
<p><strong>Cutting the Ends Off the Pot Roast</strong></p>
<p>Our story begins with Bill and Mary &#8211; a happy couple preparing dinner for a family get-together. As Bill busily chops vegetables and peels potatoes, he observes his wife cutting the ends off the pot roast she&#8217;ll be cooking for the meal. As a programmer, Bill believes every step in a procedure should be deliberate and serve a purpose. So, perplexed at his lovely bride&#8217;s decision to chop off and throw out two perfectly good chunks of meat, he asks &#8220;We are you cutting the ends off the pot roast?&#8221;</p>
<p>&#8220;Because that&#8217;s how you make pot roast,&#8221; she tells him.</p>
<p>&#8220;But, what <em>good</em> does it do?&#8221; he asks gently, taking care not to offend someone he recognizes as a far more capable and experienced cook than himself. &#8220;Does it make it taste better?&#8221;</p>
<p>&#8220;My mother taught me how to make pot roast, and she always told me to cut off the ends. That&#8217;s just how you make pot roast.&#8221;</p>
<p>Soon, the guests begin arriving. The first is Mary&#8217;s mother. As an accomplished cook herself, Bill always knew it was his mother-in-law&#8217;s careful mentorship that turned Mary into the culinary wizard she had become. Certainly, <em>she</em> must know the answer to this riddle!</p>
<p>&#8220;You taught Mary to cut off the ends of the pot roast before cooking it. Why is that?&#8221; he asked.</p>
<p>&#8220;Because that&#8217;s how you make pot roast,&#8221; answered his mother-in-law. &#8220;I learned how to cook by watching my mother, and she always cut the ends of the pot roast.&#8221;</p>
<p>Bill married well, and he knew it. His wife was part of a long lineage of masters in the art of fine cuisine. Their experience spanned generations. They had accumulated a wealth of skills and knowledge that could compete with all the great chefs of the world. Certainly, the step of cutting off the ends of the pot roast must be some long held secret to dinnertime delight! But <em>why?</em> How does it help? Does it enhance the flavor? Does it make the meat more tender?</p>
<p>At last, the family matriarch arrives. Mary&#8217;s grandmother, the inspiration behind three generations of pot roasting perfection, is greeted at the door. It was Bill&#8217;s last hope of understanding the most mysterious step of this family recipe.</p>
<p>&#8220;Grandma, you taught Mary&#8217;s mother to cut off the ends of the pot roast. Mary cooks pot roast the same way, too. They tell me that this is the way pot roast is made. Why is this such an important step?&#8221;</p>
<p>Grandma, incredulous, looks at both women and asks &#8220;Do you <em>still</em> cut the ends off of the pot roast&#8221;.</p>
<p>&#8220;Yes,&#8221; they said in unison. &#8220;That&#8217;s how you showed us to make pot roast. We know that&#8217;s just how pot roast is made.&#8221;</p>
<p>Grandma broke into hysterical laughter. After she composed herself again, she explained “Honey, I cut off the ends of the pot roast <em>because my pot was too small!</em><span> </span>Cutting off the ends of the pot roast was the only way I could get it to fit!”</p>
<p><strong>The Perils of Experience</strong></p>
<p>If you don’t see how this applies to software development, then you haven’t been paying attention.<span> </span>Cutting the ends off of the pot roast was a “best practice” solution to the problem of the pot that was too small.<span> </span>Because Mary and her mother never understood the underlying problem that motivated this preparation step, they turned a necessary practice into a wasteful one when their larger cooking pots obviated the need to cut the pot roast down to size.</p>
<p>How can we avoid following into traps like this?<span> </span>Never be satisfied with the rationale of “just because.”<span> </span>Every technology decision that carries any cost must be justified by a savings of greater value.</p>
<p>Mentoring junior programmers is a great way to keep us on our toes.<span> </span>It’s often the uninitiated – those unfamiliar with “how things have always been done” – that challenge us the most to explain why we do what we do.<span> </span>If we can come up with a persuasive argument, we solidify our own understanding of the problem and, consequently, enlightened our student.<span> </span>On the other hand, if we can’t answer the simple question “Why?” then we probably don’t fully understand the problem we’re trying to solve.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.gavaghan.org/blog/2007/07/15/the-perils-of-experience-cutting-the-ends-off-the-pot-roast/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

