MathJax

Showing posts with label rant. Show all posts
Showing posts with label rant. Show all posts

Monday, June 2, 2014

PSA: Authentication != Authorization

Unfortunately, it's tempting to abbreviate both authentication and authorization as "auth." This common abbreviation causes people to confuse the two in their minds. I BEG you all to disambiguate as follows:

  • Authentication = AuthN
  • Authorization = AuthZ
(as per common sense and this other site I found)

Non-tech explanation:

Authentication (AuthN) is a means of confirming your identify. A weak real-world example is when a cashier checks your photo ID to match your name and face to the credit card you're using for a large purchase.
Authentication (AuthN) to match the human to the credit card
Authorization (AuthZ) is verifying that you have permission to perform an action. A weak real-world example is when a cashier checks your photo ID to verify you're old enough to legally purchase alcohol.
Authorization (AuthZ) to verify the human may purchase alcohol
By information security standards, our real-world mechanisms are extremely weak.
These are confused all the time because they both start with "auth" and you can use a driver's license to explain both. Really, they're quite different. Here's a non-driver's license example for both:

AuthN: You recognize your significant other's voice before engaging in flirtatious conversation.
Authentication (AuthN) to know you're flirting with your SO, not your parents
AuthZ: You know a secret handshake to get into a club.
Authorization (AuthZ) to grant access to premier plumbing services as a member of the Stonecutters
AuthN: Who am I?
AuthZ: May I?

Call to action for tech people:

Grep your codebase for instances of /auth[^enz]/ and eliminate them. Add a FindBugs rule to weed them out. Call out auth conflation in code reviews. WHEN TAKING NOTES, PERSONALLY ABBREVIATE VIA AUTHN OR AUTHZ, NEVER AUTH.

Also, OAuth is actually OAuthZ. OAUTH is a reference architecture for OAUTHN. Got it? 

Monday, March 31, 2014

I miss Lyft enough to use bold typeface at some point

I don't hate taxi companies. I hate
  • Calling for a cab
  • Not knowing where my cab is
  • The impersonal divide between me and my driver
  • Haggling over directions/expecting to be "taken for a ride"
  • Having my dispatched cab mistakenly take another customer
  • Paying via carbon-paper credit card machines as I'm stepping out of the cab


I've seen what it's like when these things are fixed and I love it. I first tried Lyft in the summer of 2013 and I was instantly hooked. I understand Uber, SideCar, and a few other rideshare companies offer similar services. I wouldn't say I love unconditionally Lyft, but I do love
  • Hailing a cab with a few taps on my smart phone
  • Knowing exactly where my cab is
  • The friendly vibe with each and every Lyft driver I've ever had. It really brings the city together.
  • Regular navigation system use with a point-to-point fare structure. Common sense!
  • Knowing exactly which Lyft is mine--seeing exactly what the car and driver look like, and having the driver recognize my face, eliminating confusion even when several Lyfts are being hailed on the same block.
  • Paying via phone with my linked credit card and allowing my driver to get to his next fare.

Then there were several other things that Lyft did that delighted me to the point of addiction:
  • Smart phone chargers as a regular feature
  • Water (even though I didn't usually take it)
  • Candy (even though I didn't usually take it)
  • Swapping stories and news about the city

This represents a clear example of what's technically known as "deshittification:" a vast improvement on a substandard customer experience.
This Lyft car looks like what it feels to take a rideshare cab.
Then then Seattle city council enfuckified (once again, a technical term) the situation by capping the total number of drivers rideshare companies were allowed to have on the road. When I went to try to get a Lyft today for the first time in months, there were no drivers and I was forced back into using a traditional taxi company again (ugh). I wouldn't say I hate the Seattle city council. I hate
  • Siding with interests who want to kneecap competitors with legislation rather than adapt to delight their customers
  • Wiping out transformative improvements in industry at the stroke of a pen
  • Telling the citizens it's for their own good
I didn't take taxis often, but when I did, it wasn't pleasant. Then I switched to Lyft and loved it (though I'm still an occasional customer only).

I pay attention to politics not to achieve a deeper meaning in my life, but to prevent those who seek meaning through meddling from messing it up for people who are just trying to live their lives--situations just like this.
DEY TOOK ER LYFT!
The good news for the Seattle city council is that I don't hate them. The bad news for the Seattle city council is that I don't have to hate them to vote against them next election. 

The council members who have insisted on rideshare caps don't deserve the vote of the great city of Seattle. They have screwed Seattle rideshare customers in the name of "fairness"[1]:
  • Mike O'Brien
  • Kshama Sawant (her particularly anti-progress position was quoted here)
  • Nick Licata
  • Bruce Harrell
These four have betrayed the trust of our city. Vote against them the next time you have a chance.

There was one ally for consumers against kneecapping rideshare services whose support is easily Googleable: Sally Bagshaw. Her position in favor of a superior riding experience can be found here. She's earned her position. Yay Bagshaw!

The founders gave us a Republic, if we could keep it. Go out there and keep the crap out of it.



1 - If you read both sides, part of the argument for caps is to limit the unfair advantage that rideshare companies have against the more regulated taxi cab companies. It's hard not to notice that this lower regulation accompanied a tremendously improved customer experience. If regulations are making it difficult for taxi companies to compete, I submit to you that pushing the burden of these regulations yet wider is a substandard approach. In other words, this demonstrates that more regulation != more consumer protection.

Monday, January 2, 2012

Drop the T already

Which T? This T:


The title of Software Development Engineer in Test arose when Microsoft saw a need to have more technical staff involved in testing software than the Software Test Engineer (STE) army it maintained. Managers and recruiters lured candidates to these open positions with assurances that, while there might not be as much coding in these roles as an Software Development Engineer (SDE) would have, SDETs really are just SDEs on the Test team. Some teams got the memo and actually used their SDETs as SDEs on the test team. Others changed their STEs' titles to SDET and told them to learn to code. Others simply changed their STEs' titles to SDET.

Microsoft and Amazon maintain that hiring guidelines for technical skills for SDEs and SDETs are identical. There is an entire discipline devoted to software testing (STEs/Quality Assurance Engineers (QAEs)), so SDETs are expected to master that job as well as their own. This is somehow seen as special, even though SDEs should become very familiar with the business domain of the products they product anyway.

In spite of having an identical coding bar on paper, seeing SDETs as second-class developers is still the rule rather than the exception. This is true wherever SDETs are not expected to deliver as much functionality through building software as their SDE peers, which is also the rule rather than the exception. That SDET you hired in part because he could code at the SDE level? He won't be nearly as valuable to your company in three years if you don't support him in his efforts to add value through building software.

Software Testing/QA teams provide specific services for the products they support. Some of those services, (e.g. tooling, automated test suite creation and maintenance, integration testing libraries to export to other teams, load testing) require good software developers. Developing test plans, traversing exploratory testing checklists, designing test passes to maximize ROI, filing and advocating for bugs and communicating a level of risk assessment with a software product are important disciplines, but they don't require the high computer science technical bar that large software companies demand of SDET job candidates.

Expectations for SDETs don't just vary from company to company; they even very within large companies such as Microsoft and Amazon. Everyone knows that SDEs write code and that SDEs at Microsoft/Amazon/Google/Facebook need to be really good at writing code. They don't know what to expect from candidates with SDET experience.

Your smartest, most valuable SDETs are keenly aware of when their technical skills are growing and when they are not. Your smartest, most valuable SDETs are so smart and so valuable not just because they have talent but because they have spent countless hours perfecting their arts of software development, software testing and software project management. Your smartest, most valuable SDETs will fight tooth and nail to protect these investments in themselves and in their careers, and your smartest, most valuable SDETs will not have any trouble finding employment on teams that can promise the growth they desperately need. And even your smartest, most valuable SDETs need this growth, and need it especially, or else your smartest, most valuable SDETs will fail to measure up against either their QAE or SDE peers since they are spending less than half of their time in one of those roles.

Think about how you treat your SDET interns. SDET internship projects are almost always tool development SDE projects. This is both because you want the intern to have a positive experience and because current full-time SDETs are too bogged down in project delivery (test planning, test plan execution, test plan result reporting, regression test failure troubleshooting) to write tools that would help themselves and their peers. I've seen it over an over again: Teams recognize the need for a tool, think of it as an "intern project" and recruit for the summer while they continue to support customer-facing projects. The summer intern is a sharp kid and delivers a working version of a tool that looks great in the demo. Demand for the tool spikes since the team was correct when they identified the need, and the intern's toy becomes a valuable asset to the team. The problem is that while the tool works as a proof-of-concept, the implementation is awful and the tool needs to be refactored or rewritten to address future needs. "Maybe that's a good project for next summer's intern."

At the end of the day you've lost a valuable technical growth opportunity for your best SDETs who are dying to write more code for you as their job, you've tricked an intern into thinking that SDETs really are just SDEs on the test team (which they should be if you're going to title them SDEs in Test) and you've racked up technical debt with a bunch of rookie mistakes embedded into your new business-critical tool. Any gains you make in the space of a full-time hire for next year will evaporate as the former intern realizes that he liked his internship because he was an SDE, not an SDET and seeks employment elsewhere.

Drop the T for your team's sake. Look at each of your directs. Give them a choice. If their expertise has focused mainly on test planning and how to find the highest-severity bugs in the shortest time possible, they will benefit in a prestige-enhanced QAE or STE role. If they can't measure up as SDEs then they need to know now. If you, as a QA manager, run a team that doesn't have enough value to add through building software, you need to know now, and the SDE+QAE bastardization that is the SDET job title only adds chaos and confusion to the mix. You don't need SDETs; you need QAEs and SDEs on the test team.