MathJax

Monday, June 2, 2014

PSA: Authentication != Authorization

Unfortunately, it's tempting to abbreviate both authentication and authorization as "auth." This common abbreviation causes people to confuse the two in their minds. I BEG you all to disambiguate as follows:

  • Authentication = AuthN
  • Authorization = AuthZ
(as per common sense and this other site I found)

Non-tech explanation:

Authentication (AuthN) is a means of confirming your identify. A weak real-world example is when a cashier checks your photo ID to match your name and face to the credit card you're using for a large purchase.
Authentication (AuthN) to match the human to the credit card
Authorization (AuthZ) is verifying that you have permission to perform an action. A weak real-world example is when a cashier checks your photo ID to verify you're old enough to legally purchase alcohol.
Authorization (AuthZ) to verify the human may purchase alcohol
By information security standards, our real-world mechanisms are extremely weak.
These are confused all the time because they both start with "auth" and you can use a driver's license to explain both. Really, they're quite different. Here's a non-driver's license example for both:

AuthN: You recognize your significant other's voice before engaging in flirtatious conversation.
Authentication (AuthN) to know you're flirting with your SO, not your parents
AuthZ: You know a secret handshake to get into a club.
Authorization (AuthZ) to grant access to premier plumbing services as a member of the Stonecutters
AuthN: Who am I?
AuthZ: May I?

Call to action for tech people:

Grep your codebase for instances of /auth[^enz]/ and eliminate them. Add a FindBugs rule to weed them out. Call out auth conflation in code reviews. WHEN TAKING NOTES, PERSONALLY ABBREVIATE VIA AUTHN OR AUTHZ, NEVER AUTH.

Also, OAuth is actually OAuthZ. OAUTH is a reference architecture for OAUTHN. Got it? 

Monday, March 31, 2014

I miss Lyft enough to use bold typeface at some point

I don't hate taxi companies. I hate
  • Calling for a cab
  • Not knowing where my cab is
  • The impersonal divide between me and my driver
  • Haggling over directions/expecting to be "taken for a ride"
  • Having my dispatched cab mistakenly take another customer
  • Paying via carbon-paper credit card machines as I'm stepping out of the cab


I've seen what it's like when these things are fixed and I love it. I first tried Lyft in the summer of 2013 and I was instantly hooked. I understand Uber, SideCar, and a few other rideshare companies offer similar services. I wouldn't say I love unconditionally Lyft, but I do love
  • Hailing a cab with a few taps on my smart phone
  • Knowing exactly where my cab is
  • The friendly vibe with each and every Lyft driver I've ever had. It really brings the city together.
  • Regular navigation system use with a point-to-point fare structure. Common sense!
  • Knowing exactly which Lyft is mine--seeing exactly what the car and driver look like, and having the driver recognize my face, eliminating confusion even when several Lyfts are being hailed on the same block.
  • Paying via phone with my linked credit card and allowing my driver to get to his next fare.

Then there were several other things that Lyft did that delighted me to the point of addiction:
  • Smart phone chargers as a regular feature
  • Water (even though I didn't usually take it)
  • Candy (even though I didn't usually take it)
  • Swapping stories and news about the city

This represents a clear example of what's technically known as "deshittification:" a vast improvement on a substandard customer experience.
This Lyft car looks like what it feels to take a rideshare cab.
Then then Seattle city council enfuckified (once again, a technical term) the situation by capping the total number of drivers rideshare companies were allowed to have on the road. When I went to try to get a Lyft today for the first time in months, there were no drivers and I was forced back into using a traditional taxi company again (ugh). I wouldn't say I hate the Seattle city council. I hate
  • Siding with interests who want to kneecap competitors with legislation rather than adapt to delight their customers
  • Wiping out transformative improvements in industry at the stroke of a pen
  • Telling the citizens it's for their own good
I didn't take taxis often, but when I did, it wasn't pleasant. Then I switched to Lyft and loved it (though I'm still an occasional customer only).

I pay attention to politics not to achieve a deeper meaning in my life, but to prevent those who seek meaning through meddling from messing it up for people who are just trying to live their lives--situations just like this.
DEY TOOK ER LYFT!
The good news for the Seattle city council is that I don't hate them. The bad news for the Seattle city council is that I don't have to hate them to vote against them next election. 

The council members who have insisted on rideshare caps don't deserve the vote of the great city of Seattle. They have screwed Seattle rideshare customers in the name of "fairness"[1]:
  • Mike O'Brien
  • Kshama Sawant (her particularly anti-progress position was quoted here)
  • Nick Licata
  • Bruce Harrell
These four have betrayed the trust of our city. Vote against them the next time you have a chance.

There was one ally for consumers against kneecapping rideshare services whose support is easily Googleable: Sally Bagshaw. Her position in favor of a superior riding experience can be found here. She's earned her position. Yay Bagshaw!

The founders gave us a Republic, if we could keep it. Go out there and keep the crap out of it.



1 - If you read both sides, part of the argument for caps is to limit the unfair advantage that rideshare companies have against the more regulated taxi cab companies. It's hard not to notice that this lower regulation accompanied a tremendously improved customer experience. If regulations are making it difficult for taxi companies to compete, I submit to you that pushing the burden of these regulations yet wider is a substandard approach. In other words, this demonstrates that more regulation != more consumer protection.

Monday, March 17, 2014

Reader questions: Software Development Job Search from Quantitative Background

A Notre Dame alum reached out to me recently about switching to software development from a quantitative background. My response seemed like they'd be of general interest, so please use it for good, not evil.

In the job search in general, the task is to match what a company needs and wants with what you have done and what you can do. Your task is to make that mapping as clear as possible throughout the process. The resume gets you the phone screen. The phone screen gets you the interview. The interview gets you the job. The best person for the job doesn't necessarily get the job; the person who is best at getting the job gets the job.
1)  How do you think I should pitch myself in my resume / cover letter to software companies?  How can I play down the fact that I have no work experience with "real" languages (e.g. Java / C++).
In my book, any Turing-complete language is a "real" language--anything from writing expense report software in Java to writing Tetris in Brainfuck. To me there seems to be an anecdotal inverse correlation (whatever that means) between demanding proficiency in a particular language and the quality of a company's software.

Amazon, Google, Microsoft, Facebook, etc. will all let you solve interview problems in the language with which you're the most comfortable. Even if the language is esoteric (e.g. Haskell (don't actually try to solve interview problems in Brainfuck)), if you can explain how your code works and runtime characteristics like big-O memory and runtime performance then you should be just fine.

So how do you play down your hipster programming language work experience and real language academic experience in a cover letter? Just don't bring it up. There's no template for a cover letter. You have experience in legitimate programming languages and your coding and problem-solving skills will be assessed interactively anyway. Map what you've done and what you can do to what the company's needs and wants.
2)  How helpful would it be to start taking on Python/Java projects on GitHub?  I've heard that showing people that you're a "doer" makes a really big difference in marketing yourself.
Project experience is always impressive. Any opportunity you have to hyperlink your resume to something you've built is worth taking advantage of. Each hyperlink is an incarnation of the mapping between what you've done and what the company needs or wants (in the most general sense, it shows you have written code that does something).

Contributing to existing projects also mirrors what you'll do on the job. Very rarely do you start on a new system from scratch, and when you do the new system becomes an existing system after only a few months.

Finally, contributing to projects is a great way to learn a new language and see how it's used in practice. A good project will show good habits not only for the code itself, but for the code's organization and tests. This will also expose you to a lot of bad habits (which you can also learn from: if a stanza of code seems to make no sense, it's probably poorly written. Once you figure out what the code is actually doing, think about which language features could have made the code more readable) and get you used to setting up development environments and getting new code running.

Now for the flip side: Contributing to a project is a time investment. It's easy to get over-committed in life, so get a handle for what you can include in your routine and live within your time budget. The most helpful thing I've done on this front this year was to start using a to-do list app. Many of the benefits I just attributed to contributing to a project on GitHub are accessible by merely browsing the source code on GitHub. You have to decide whether to prioritize the additional work of contributing a patch (or just forking your own branch) in return for a compelling work sample. Having such a link isn't a prerequisite by any means, but it's definitely a boost.
3)  Let's assume I don't have the legendary skills / experience required by tech firms like Amazon/Google.  What are some examples of tier-2 tech firms that are known / respected?  I feel like I might have a shot at firms that aren't quite as good as Amazon.
I'm a bad person to answer this question since my tech career started with a summer internship at Johnson & Johnson followed by full-time at Microsoft followed by full-time at Amazon. I probably have a big head about it.

There's a range of consulting firms, smaller tech companies, companies that specialize in mobile development, high-frequency trading firms, startups, and contractor agencies outside of the megacorporation world. There are also large companies and various government agencies that do some in-house software development.

If I were good at answering this question, I'd be able to give the pros and cons for working at each, as well as what they're looking for and how to prepare. If you insist on preparing for not being good enough (wow, I definitely have a big head), I recommend researching some specific example companies for these categories. Employees at these companies will have better answers for the pros and cons of where they are.

No matter where you go, your first goal is always to make yourself as awesome as possible. It's easy to take jobs as a proxy for self-worth, and it's okay to be proud of where you work, but don't let where you work define your identity. When I got my offer from Microsoft senior year of college I'd felt that I had made it. Being smart and achieving was a big part of my identity, and my employment by Microsoft was a nice encapsulation of my achievements and sacrifices. I had a view of myself as a Microsoft employee. It defined my identity. The problem was I wasn't happy with my work there. Deciding to look around for other jobs was very liberating: First I saw that my team was bigger than my role, then that Microsoft was bigger than my team, then that the software industry was bigger than Microsoft, then that the world was bigger than the software industry. When I went from Microsoft to Amazon I also went from thinking of myself as an SDET who works for a great company to a great SDET who happens to work for Amazon (and I friggin' love Amazon). I'm an SDE at Amazon now, but the principle holds: I'm a sharp guy with a lot going on who happens to work for Amazon as an SDE (a fitting incarnation of such awesomeness (there's that big head again)).