Always Get Better

Coast to Coast

December 31st, 2020

I didn’t want to end the year without posting at least once.

In case anyone wants to know what I’ve been up to, last year I left my CTO role at a startup in Vancouver, changed my base of operation to Nova Scotia and joined an non-profit. I’m working with a fantastic group of people and couldn’t be happier right now.

My public output has been pretty low for the last year or so. Looking back, I think I needed to get out of the fast lane for a bit. The last decade I moved across the continent twice, immersed in startup culture, published two books, homeschooled three kids, and generally had an iron in the fire constantly. The pace of life is much slower here and I’ve enjoyed taking some time to regroup, enjoy the kids, and heal.

Some big stuff is in the works. I’m looking forward to announce some new projects I am excited to share with the world.

Here’s to a fantastic 2021!

12 Months of Agile

January 29th, 2019

I keep running into folks with cool job titles like Advanced Agile Scrum Master, or business leaders bragging about how their company is “doing Agile”. And I used to crack jokes about how we practice “Agency Agile” – where you don’t plan anything but just accept and work through orders in the form of tickets whenever your project manager comes up with them.

I don’t think those jokes are very funny anymore.

Everyone should read the agile manifesto. Even though it’s been usurped by talking heads in the business community as some kind of silver bullet it was never intended to become, there is a lot of value in the principals it puts forth. The most important is the focus on human interaction.

All problems are human problems.

Someone Smart

Working software is the most visible output of my work but my job is less about writing code and mostly about figuring out what problems people are having. Usually there’s a big disconnect between what folks think will make things work better and what things actually will. If your developers are spending most of their days writing code instead of talking to other people, you might be missing something important.

Organizations truly embracing Agile are internalizing workflows that put people first and prioritize delivering results quickly. Who wouldn’t want that? But it takes more than a piece of software or a new process checklist to get the benefits. It all starts at the top by creating and sharing a strong vision. People want to do well so give them a mission and get out of their way.

Let’s get back to our roots this year. Every month we’ll look at one of the Agile principles and remind ourselves what it means in our daily life.

Do you have any Agile adoption success stories (or horror stories) to share?

Decennial

January 16th, 2018

Hard to believe I’ve been running this blog for 10 years now. So much has changed, but the really important stuff (people) is the same year after year. I am constantly reminded that the focus should always be the opportunities we create through tech, not the tech itself.

Speed Up Page Load By Tricking the Browser

November 25th, 2017

Nettiquette is built into web browsers. When you go to download a page, its contents will load in at a max of 2 files at a time (by default). So if there are 12 CSS and JS files, you’ll only get 2 at a time until you load them all.

The good news is you can trick browsers into doing more at a time.

Enter subdomains.

Offload your CSS to css.yoursite.com, and your JavaScript files to js.yoursite.com. Now your website will load 6 files at a time (2 CSS files, 2 JavaScript files, 2 HTML/Image files from your main site).

It doesn’t matter if each subdomain is pointing to the same website. Web browsers go by the site URL and nothing more.

HTTP/2 is supposed to eliminate this problem, of course, but in the meantime doing this helps when you can’t crunch down your files any more.

Fun With Amazon X-Ray

November 19th, 2017

While riding on the train the other day, I was watching The Man in the High Castle on Prime and thought I recognized the actor on screen. “Too bad they only show the main actors. It would be nice if we could get a listing of who is in each scene,” I thought to myself. Imagine my surprise when I found out the app does exactly that.

So Cool

The info screen doesn’t just show the main actors for the show like I thought, it shows who is in the current scene!

It even changes as the scene changes. If you leave the info screen on, the actor list updates in real time as actors enter and leave the screen.

Trivia

The info screen doesn’t just show which actors are in the scene, it shows trivia about things going on in the scene; either actions of the characters or story background based on what’s being said.

As the action unfolds, the info changes to provide even more context.

How It Works

As best I can tell (maybe someone has better information?) the x-ray data is filled in large part algorithmically.

The main actor data comes from IMDB. I assume Amazon is using facial recognition technology to match profile photos with actors in each frame. Background actors aren’t included so there’s some intelligence there to either filter out people by screen time or dialogue.

There’s no way everything is done automatically, so there has to be a human component in there as well. Very likely they are using something like mechanical turk to have humans verify the raw data and add contextual tagging.

Your World Augmented

When I think about “augmented reality” this is the kind of thing I’m excited to see. Computer systems that provide more context about the world around us, not try to replace it entirely. Humans augmented by machines to make our whole experience better.

Next time you ask “who is that actor!?” try checking the app you’re watching – it may be able to tell you more authoritatively than a Google search or the person you’re sitting with.

Don’t Trust Your App to Node.js

October 14th, 2017

One of the most common questions I get is around my bullishness toward Node.js. People assume because I wrote two books about it, I should be an expert in all things Node (nope!) or at least a major cheerleader for it (hah!).

My problem has never been with Node or even Javascript. I use both every day and will be the first to reach for them when a problem needs solved. Just not for web development. I’ll stick to PHP or .NET for that.

Again: Node is great, but it isn’t the platform for the web.

Don’t take my word for it. During a recent Mapping the Journey podcast, Ryan Dahl (Node’s creator) echoed these sentiments:

So, kind of the newer versions of Javascript has made this easier. That said, I think Node is not the best system to build a massive server web. I would use Go for that. And honestly, that’s the reason why I left Node. It was the realization that: oh, actually, this is not the best server-side system ever. (Source)

Bottom line is: pick your tech stack based on your objectives, not because something was cool today.

5 Ways to Keep Your Web Server Secure

September 19th, 2017

Equifax recently revealed that they were hacked and exposed the personal information of over 143 million people. You may not be sitting on such identity-theft rich material, but keeping your server secure is absolutely a must for any business. Fortunately it really isn’t very hard to achieve and maintain a decent level of protection.

1. Hire a Competent Developer

Cloud computing makes web servers super accessible to everyone; unfortunately that means it’s really easy  to get a website running and get a false sense of security thinking everything is right when it’s not. A lot of developers claim they can do it all for you when all the really know is how to install Apache but not how to lock it down.

A good giveaway is: If your developer can’t get by without using a gui tool or web interface to set up and administer the website, they don’t have any business on your server. These are great tools for setting up local development environment but they take shortcuts to make things more convenient for the user – not to improve security.

So if your guy doesn’t have deep command line knowledge and the ability to work without these tools, fine. He’s still a great developer, he can build  you a secure website following all the security best practices. He just doesn’t have any business touching your web server; have someone else set up the “live” environment.

2. Lock Down Ports

When you’re setting up a web server, lots of supporting programs get started that don’t directly affect your website. Things like email, ICMP, DNS, time and DHCP are important to keep the system running but have no business leaving the local network. Everything that you don’t absolutely need to access should be locked down. No access except from inside the server.

Web services like Apache and nginx are specifically designed to prevent people from using them as attack vectors to control your system, and they get compromised routinely. MySQL has no chance at all – don’t open it to the outside world… ever.

3. Separate Database Servers

It’s super common to find database servers improperly configured so they become a major security hole. On MySQL, most people don’t know to add users better than “GRANT ALL PRIVILEGES ON x.* TO y@z;”. Since the SQL server itself is often running with elevated system access, it only takes a single unsecured query to let people create files wherever they want on your server.

The easiest way to prevent this from affecting your websites is to move SQL to another server. Not only do you get the bonus of having a machine configured exclusively for web work and another exclusively for DB work, but bad things happening on one won’t mean bad things happening on the other.

4. Keep Up With Software Patches

If you want to keep your server secure, keep it updated right away when vendors release updates for their software.

In a world full of zero-day exploits, any software with a security update is definitely a risk. Maybe even part of a malware package being sold in some dark corner of the Internet.

Don’t be a victim, keep your server secure by keeping it up to date.

5. Enforce User Permissions

One of the most compelling reasons to use Linux traditionally has been the strong separation between services using user permissions. Even Windows Server supports it these days.

If you’re using PHP, don’t use Apache’s modphp, use php-fpm. Set up your pools to give each website its own user. Again it’s all about compartmentalization. Bad things will happen and a good sysadmin makes sure the damage done by those bad things gets contained to a small area.

BONUS #6: Keep Your Server Secure by Never Logging In

Never allow yourself or anyone else to log into the web server.

There’s no reason for it. If you need to deploy a website update, use a CI tool like Jenkins. If you got rooted, trash the server and launch a new one.

People make mistakes, people forget about config changes, people can’t be trusted. You don’t need to worry about password scheme, RSA keys, iptables goofs or any of a million common problems if you just acknowledge the human risk factor and remove it from the equation.

When we move to programmed servers, we make it easier to bring new people on board, faster to verify and test new software versions, more repeatable in the case of a data failure, and more secure across our entire network. Don’t make humans do the work of computers, automate all the things!