<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" version="2.0">

<channel>
	<title>Shaping Software</title>
	
	<link>http://shapingsoftware.com</link>
	<description>Patterns and Practices for Software Success.</description>
	<pubDate>Wed, 11 Nov 2009 04:49:43 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.7.1</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" href="http://feeds.feedburner.com/ShapingSoftware" type="application/rss+xml" /><feedburner:emailServiceId>ShapingSoftware</feedburner:emailServiceId><feedburner:feedburnerHostname>http://feedburner.google.com</feedburner:feedburnerHostname><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="hub" href="http://pubsubhubbub.appspot.com" /><item>
		<title>Drive from Quality</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/iyC7fR3ww8c/</link>
		<comments>http://shapingsoftware.com/2009/11/11/drive-from-quality/#comments</comments>
		<pubDate>Wed, 11 Nov 2009 04:47:53 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[General]]></category>

		<category><![CDATA[Headline]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/11/11/drive-from-quality/</guid>
		<description><![CDATA[My recent road trip was a great reminder how quality is durable.  As I passed through familiar territory, it was interesting to see how many building and places stood the test of time.  ]]></description>
			<content:encoded><![CDATA[<p><a href="http://shapingsoftware.com/wp-content/uploads/2009/11/drivefromquality.jpg"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; margin-left: 0px; border-left-width: 0px; margin-right: 0px" title="DriveFromQuality" src="http://shapingsoftware.com/wp-content/uploads/2009/11/drivefromquality-thumb.jpg" border="0" alt="DriveFromQuality" width="304" height="216" align="right" /></a></p>
<p>My recent road trip was a great reminder how quality is durable.  As I passed through familiar territory, it was interesting to see how many building and places stood the test of time.  Whether it was a business or a building, it was quality that survived in the long run.  Some of the restaurants I remembered were gone.  Every restaurant I remembered that was high quality, was still around.</p>
<p><strong>Competing on Price Fails in the Long Run</strong><br />
Competing on price failed, time and again.  There was no customer loyalty when it was the price play.  There was no compelling distinction beyond price.  Chasing the price play, meant getting priced out of market by somebody better or cheaper or you name it.  There are only so many corners you can cut before your value is insignificant.  On the other hand, the quality play is focused on differentiation and distinction in terms of value.  In a globabl market, where cycles of change are faster, competing on price is a game I just don&#8217;t want to play in.</p>
<p><strong>Do You Stand Behind Your Work?<br />
</strong>One of my most important tests, and it&#8217;s a simple gut check, is, do you stand behind your work?  It&#8217;s a cutting question.  When your results are something you&#8217;re proud of, and quality is your game, and continuous improvement is your way, and excellence is your bar &#8230; you set yourself up for success.  When you can put yourself into your work, the journey becomes as enjoyable, if not more so, than the destination.</p>
<p>In times of change and uncertainty, driving from quality is a guiding principle that helps us find our path.</p>
<p><em>Photo by </em><a rel="nofollow" href="http://www.flickr.com/photos/cornelluniversitylibrary/" target="_blank"><em>Cornell University Library</em></a><em>.</em></p>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=iyC7fR3ww8c:L03Ma0UutJk:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=iyC7fR3ww8c:L03Ma0UutJk:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=iyC7fR3ww8c:L03Ma0UutJk:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=iyC7fR3ww8c:L03Ma0UutJk:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/iyC7fR3ww8c" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/11/11/drive-from-quality/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/11/11/drive-from-quality/</feedburner:origLink></item>
		<item>
		<title>Vision Scope Examples</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/HCMzfMyFDaM/</link>
		<comments>http://shapingsoftware.com/2009/09/24/vision-scope-examples/#comments</comments>
		<pubDate>Thu, 24 Sep 2009 13:47:57 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Project Management]]></category>

		<category><![CDATA[patterns & practices]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/09/24/vision-scope-examples/</guid>
		<description><![CDATA[On the Microsoft patterns &#038; practices team, we use Vision / Scope as a key milestone.  It’s where we frame the problem, identify the business opportunity, and paint a vision of the solution.  It’s a forcing function to get clarity on the customer, their scenarios, and our scope for the project.  We generally use a “fix time, flex scope” pattern, so this means having a candidate backlog that we prioritize with customers.]]></description>
			<content:encoded><![CDATA[<p><a href="http://shapingsoftware.com/wp-content/uploads/2009/09/visionscopeexamples.png"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; margin-left: 0px; border-left-width: 0px; margin-right: 0px" title="VisionScopeExamples" border="0" alt="VisionScopeExamples" align="right" src="http://shapingsoftware.com/wp-content/uploads/2009/09/visionscopeexamples-thumb.png" width="308" height="234" /></a></p>
<p>On the Microsoft patterns &amp; practices team, we use Vision / Scope as a key milestone.&#160; It’s where we frame the problem, identify the business opportunity, and paint a vision of the solution.&#160; It’s a forcing function to get clarity on the customer, their scenarios, and our scope for the project.&#160; We generally use a “fix time, flex scope” pattern, so this means having a candidate backlog that we prioritize with customers.</p>
<p>On the execution side, we expect to know the team, key partners, the budget, the schedule, and the deliverables.&#160; We also need to know the risks and their mitigations.&#160; At the Vision / Scope, the real key is first selling people on the vision, and then selling them on the execution.&#160; It’s basically about answering, “why?” should we go do this, and “why now?.”&#160; This can be either about reducing pain or exploiting an opportunity.&#160; It’s also about answering these questions in the context of trade-offs.&#160; When you can tell a compelling story from problem to solution, and how you’ll get their incrementally with a team people trust, you dramatically increase your odds of getting a “Go” decision, and the support you need.</p>
<p><strong>Vision / Scope Baseline      <br /></strong>This is my rough sketch of the key pieces I need in my Vision / Scope presentations for success:</p>
<table border="1">
<tbody>
<tr>
<td valign="top"><em>Vision / Scope</em></td>
<td>
<ul>
<li>Agenda </li>
<li>Problem </li>
<li>Vision </li>
<li>Approach </li>
<li>Prioritized </li>
<li>Tests for Success </li>
<li>Scope Key Activities </li>
<li>Deliverables </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Execution</em></td>
<td>
<ul>
<li>Team </li>
<li>Budget </li>
<li>Schedule </li>
<li>Risks </li>
<li>Asks </li>
<li>Go/No Go </li>
</ul>
</td>
</tr>
</tbody>
</table>
<p><strong>Vision / Scope Examples      <br /></strong>Here are some examples of various Vision / Scope slides from over the years:</p>
<table border="1">
<tbody>
<tr>
<th>Example</th>
<th>Items</th>
</tr>
<tr>
<td valign="top"><em>Example 1</em></td>
<td>
<ul>
<li>Problem </li>
<li>Vision </li>
<li>Approach </li>
<li>Prioritized Tests for Success </li>
<li>Scope </li>
<li>Key Activities </li>
<li>Deliverables </li>
<li>Team </li>
<li>Schedule </li>
<li>Budget </li>
<li>Asks </li>
<li>Go/No Go? </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 2</em></td>
<td>
<ul>
<li>Vision / Strategy </li>
<li>Solution Concept </li>
<li>Scope </li>
<li>Outcomes </li>
<li>Deliverables </li>
<li>Scorecard </li>
<li>Team </li>
<li>Budget </li>
<li>Burn Rate </li>
<li>Schedule </li>
<li>Go/No Go? </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 3</em></td>
<td>
<ul>
<li>Agenda </li>
<li>Customer Proof Points </li>
<li>Business and Technical Scenarios </li>
<li>Project vision </li>
<li>Project Scope </li>
<li>Target Customer </li>
<li>Development Strategy </li>
<li>Project Objectives </li>
<li>Go-to-Market Release Strategy </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 4</em></td>
<td>
<ul>
<li>Agenda </li>
<li>Project Justification </li>
<li>Team and Extended Teams </li>
<li>Project Vision </li>
<li>Business and Technology Threats </li>
<li>Primary Business Scenario </li>
<li>Associated Technical Challenges </li>
<li>Quotes from Target Market </li>
<li>Top 5 Customer Requests </li>
<li>Potential Beta Customers </li>
<li>Project Scope </li>
<li>Project Deliverables </li>
<li>Assumptions </li>
<li>Risks </li>
<li>Development Strategy </li>
<li>Delivery Options </li>
<li>Single Release Schedule and Budget </li>
<li>Dual Release Schedule </li>
<li>Dual Release Budget </li>
<li>Go-to-Market Strategy </li>
<li>Current Status/next Steps </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 5</em></td>
<td>
<ul>
<li>Agenda </li>
<li>Customer Proof </li>
<li>Project vision </li>
<li>Business and Technical Scenarios </li>
<li>Scope </li>
<li>Pre-Release Strategy </li>
<li>Go-to-Market Strategy </li>
<li>Goals </li>
<li>Current Status/Next Steps </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 6</em></td>
<td>
<ul>
<li>Agenda </li>
<li>Project Lifecycle </li>
<li>Habits and Practices </li>
<li>Scenario-Based Guidance </li>
<li>What is a baseline architecture? </li>
<li>Reference Architecture Space </li>
<li>Baseline Architecture Applied </li>
<li>How will customers use it? </li>
<li>Vision </li>
<li>Strategy </li>
<li>Why create this baseline architecture? </li>
<li>Target Customer and Business Requirements </li>
<li>Customer Scenarios </li>
<li>Technical Challenges </li>
<li>Deliverables </li>
<li>Project Schedule </li>
<li>Budget and Resource Allocation </li>
<li>Risk and Mitigation </li>
<li>Project Team </li>
<li>Dev Update </li>
<li>Development Velocity </li>
<li>Test Deliverables </li>
<li>Testing Coverage </li>
<li>Bug - Status to Date (Test) </li>
<li>Support Strategy </li>
<li>Market Distribution </li>
<li>Partner Strategy </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 7</em></td>
<td>
<ul>
<li>Challenges </li>
<li>Opportunity </li>
<li>Vision and Strategy </li>
<li>Scope </li>
<li>Feature Prioritization Approach </li>
<li>Candidate Scope </li>
<li>Scope: Components of the Deliverable </li>
<li>Iterative Development Process </li>
<li>Staging and Release Strategy </li>
<li>Success Metrics </li>
<li>Alignment with SC-BAT </li>
<li>Team Roles </li>
<li>Product Group Feedback </li>
<li>Risks </li>
<li>Issues </li>
<li>Schedule </li>
<li>Test Deliverables and Coverage </li>
<li>Requests </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 8</em></td>
<td>
<ul>
<li>Agenda </li>
<li>Customer Proof Points </li>
<li>Business and Technical Scenarios </li>
<li>Project Vision </li>
<li>Project Scope </li>
<li>Target Customer </li>
<li>Development Strategy </li>
<li>Project Objectives </li>
<li>Go-to-Market Release Strategy </li>
<li>Current Status/Next Steps </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 9</em></td>
<td>
<ul>
<li>Agenda </li>
<li>Customer Pain </li>
<li>Vision/Strategy </li>
<li>Opportunity </li>
<li>Solution Concept </li>
<li>Scope </li>
<li>Deliverables </li>
<li>Scorecard </li>
<li>EcoSystem </li>
<li>who Are We Working with </li>
<li>Team </li>
<li>Test Scope </li>
<li>Alignment - Relation to Projects/Programs </li>
<li>Schedule </li>
<li>Budget Ask to M0 + 30 days </li>
<li>Total Budget </li>
<li>Risks </li>
<li>Asks </li>
<li>GO / No GO </li>
</ul>
</td>
</tr>
<tr>
<td valign="top"><em>Example 10</em></td>
<td>
<ul>
<li>Situation </li>
<li>Opportunity </li>
<li>Vision </li>
<li>Goals </li>
<li>Guidance Team </li>
<li>Guidance Frame </li>
<li>Strategy - Program and Project </li>
<li>Program </li>
<li>Customer Data </li>
<li>Customer Scenario </li>
<li>Technology Landscape </li>
<li>Target Personas </li>
<li>Solution Concept: Deliverables </li>
<li>Scope - Phase 1a (Preview Release) </li>
<li>Candidate Pattern Map </li>
<li>Possible Phase 1b Scope </li>
<li>Scope </li>
<li>Release Strategy </li>
<li>Customer Validation Plan </li>
<li>Risks and Mitigation Strategy </li>
<li>Issues </li>
<li>Schedule </li>
<li>Budget </li>
<li>Technical and Organizational Dependencies </li>
<li>Asks </li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>&#160;</p>
<p><strong>My Related Posts</strong></p>
<ul>
<li><a href="http://shapingsoftware.com/2009/08/09/vision-scope-template/">Vision Scope Template</a> </li>
<li><a href="http://shapingsoftware.com/2008/12/09/lessons-learned-in-patterns-practices/">Lessons Learned in patterns &amp; practices</a> </li>
<li><a href="http://shapingsoftware.com/2009/05/31/whats-a-frame/">Framing the Landscape</a> </li>
</ul>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=HCMzfMyFDaM:iqHtVs7KzLo:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=HCMzfMyFDaM:iqHtVs7KzLo:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=HCMzfMyFDaM:iqHtVs7KzLo:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=HCMzfMyFDaM:iqHtVs7KzLo:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/HCMzfMyFDaM" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/09/24/vision-scope-examples/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/09/24/vision-scope-examples/</feedburner:origLink></item>
		<item>
		<title>Cloud Security Frame</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/Od3rj8HZ8NA/</link>
		<comments>http://shapingsoftware.com/2009/08/20/cloud-security-frame/#comments</comments>
		<pubDate>Thu, 20 Aug 2009 00:08:38 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Headline]]></category>

		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/08/20/cloud-security-frame/</guid>
		<description><![CDATA[Here is a draft of our Cloud Security Frame as part of our early exploration work for our patterns &#038; practices Cloud Security Project.  It’s a lens for looking at Cloud Security.  The frame is simply a collection of Hot Spots.  Each Hot Spot represents an actionable category for information.  Using Hot Spots, you can quickly find pain and opportunities, or key decision points. ]]></description>
			<content:encoded><![CDATA[<p><a href="http://shapingsoftware.com/wp-content/uploads/2009/08/cloudsecurityframe.png"><img style="border-top-width: 0px; display: inline; border-left-width: 0px; border-bottom-width: 0px; margin-left: 0px; margin-right: 0px; border-right-width: 0px" title="CloudSecurityFrame" src="http://shapingsoftware.com/wp-content/uploads/2009/08/cloudsecurityframe-thumb.png" border="0" alt="CloudSecurityFrame" width="292" height="304" align="right" /></a></p>
<p>Here is a draft of our Cloud Security Frame as part of our early exploration work for our patterns &amp; practices Cloud Security Project.  It’s a lens for looking at Cloud Security.  The frame is simply a collection of Hot Spots.  Each Hot Spot represents an actionable category for information.  Using Hot Spots, you can quickly find pain and opportunities, or key decision points.  It helps us organize principles, patterns, and practices by relevancy.  For example, in this case, we use the Cloud Security Frame to organize threats, attacks, vulnerabilities and countermeasures.</p>
<p><strong>Hot Spots</strong></p>
<p>This is our current set of Hot Spots for our Cloud Security Frame:.</p>
<ul>
<li><em>Auditing and Logging</em></li>
<li><em>Authentication</em></li>
<li><em>Authorization</em></li>
<li><em>Communication</em></li>
<li><em>Configuration Management</em></li>
<li><em>Cryptography</em></li>
<li><em>Exception Management</em></li>
<li><em>Sensitive Data</em></li>
<li><em>Session Management</em></li>
<li><em>Validation</em></li>
</ul>
<p><strong>Cloud Security Frame<br />
</strong>Here is our draft of the Cloud Security Frame with a description of each Hot Spot category:</p>
<table border="1">
<tbody>
<tr>
<th>Hot Spot</th>
<th>Description</th>
</tr>
<tr>
<td><em>Auditing and Logging</em></td>
<td>Auditing and logging refers to how security-related events are recorded, monitored, and audited. Examples include: Who did what and when?</td>
</tr>
<tr>
<td><em>Authentication</em></td>
<td>Authentication is the process of proving identity, typically through credentials, such as a user name and password.</td>
</tr>
<tr>
<td><em>Authorization</em></td>
<td>Authorization is how your application provides access controls for roles, resources and operations.</td>
</tr>
<tr>
<td><em>Communication</em></td>
<td>Communication encompasses how data is transmitted over the wire. Transport security versus message encryption is covered here.</td>
</tr>
<tr>
<td><em>Configuration Management</em></td>
<td>Configuration management refers to how your application handles configuration and administration of your applications from a security perspective. Examples include: Who does your application run as? Which databases does it connect to? How is your application administered? How are these settings secured?</td>
</tr>
<tr>
<td><em>Cryptography</em></td>
<td>Cryptography refers to how your application enforces confidentiality and integrity. Examples include: How are you keeping secrets (confidentiality)? How are you tamper-proofing your data or libraries (integrity)? How are you providing seeds for random values that must be cryptographically strong?</td>
</tr>
<tr>
<td><em>Exception Management</em></td>
<td>Exception management refers to how you handle applications errors and exceptions. Examples include: When your application fails, what does your application do? How much information do you reveal? Do you return friendly error information to end users? Do you pass valuable exception information back to the caller? Does your application fail gracefully?</td>
</tr>
<tr>
<td><em>Sensitive Data</em></td>
<td>Sensitive data refers to how your application handles any data that must be protected either in memory, over the network, or in persistent stores. Examples include: How does your application handle sensitive data?</td>
</tr>
<tr>
<td><em>Session Management</em></td>
<td>A session refers to a series of related interactions between a user and your application. Examples include: How does your application handle and protect user sessions?</td>
</tr>
<tr>
<td><em>Validation</em></td>
<td>Validation refers to how your application filters, scrubs, or rejects input before additional processing, or how it sanitizes output. It&#8217;s about constraining input through entry points and encoding output through exit points. Message validation refers to how you verify the message payload against schema, as well as message size, content and character sets. Examples include: How do you know that the input your application receives is valid and safe? Do you trust data from sources such as databases and file shares?</td>
</tr>
</tbody>
</table>
<p><strong>Threats, Attacks, Vulnerabilities and Countermeasures<br />
</strong>Here is our working draft of our threats, attacks, vulnerabilities and countermeasures organized by our Cloud Security Frame:</p>
<table border="1">
<tbody>
<tr>
<th>Hot Spot</th>
<th>Threats, Attacks, Vulnerabilities and Countermeasures</th>
</tr>
<tr>
<td><em>Auditing and Logging</em></td>
<td><strong>Vulnerabilities</strong></p>
<ul>
<li>Failing to audit failed logons.</li>
<li>Failing to secure audit files.</li>
<li>Failing to audit across application tiers.</li>
</ul>
<p><strong>Threats / Attacks</strong></p>
<ul>
<li>User denies performing an operation.</li>
<li>Attacker exploits an application without trace .</li>
<li>Attacker covers his tracks.</li>
</ul>
<p><strong>Countermeasures </strong></p>
<ul>
<li>Identify malicious behavior.</li>
<li>Know your baseline (know what good traffic looks like.)</li>
<li>Use application instrumentation to expose behavior that can be monitored.</li>
</ul>
</td>
</tr>
<tr>
<td><em>Authentication</em></td>
<td><strong>Vulnerabilities </strong></p>
<ul>
<li>Using weak passwords.</li>
<li>Storing clear text credentials in configuration files.</li>
<li>Passing clear text credentials over the network.</li>
<li>Permitting over-privileged accounts.</li>
<li>Permitting prolonged session lifetime.</li>
<li>Mixing personalization with authentication.</li>
</ul>
<p><strong>Threats / Attacks</strong></p>
<ul>
<li>Network eavesdropping.</li>
<li>Brute force attacks.</li>
<li>Dictionary attacks.</li>
<li>Cookie replay attacks.</li>
<li>Credential theft.</li>
</ul>
<p><strong>Countermeasures</strong></p>
<ul>
<li>Use strong password policies.</li>
<li>Do not store credentials.</li>
<li>Use authentication mechanisms that do not require clear text credentials. to be passed over the network.</li>
<li>Encrypt communication channels to secure authentication tokens.</li>
<li>Use HTTPS only with forms authentication cookies.</li>
<li>Separate anonymous from authenticated pages.</li>
</ul>
</td>
</tr>
<tr>
<td><em>Authorization</em></td>
<td><strong>Vulnerabilities </strong></p>
<ul>
<li>Relying on a single gatekeeper.</li>
<li>Failing to lock down system resources against application identities.</li>
<li>Failing to limit database access to specified stored procedures.</li>
<li>Using inadequate separation of privileges.</li>
</ul>
<p><strong>Threats / Attacks</strong></p>
<ul>
<li>Elevation of privilege.</li>
<li>Disclosure of confidential data.</li>
<li>Data tampering.</li>
<li>Luring attacks.</li>
</ul>
<p><strong>Countermeasures</strong></p>
<ul>
<li>Use least privilege accounts.</li>
<li>Consider granularity of access.</li>
<li>Enforce separation of privileges.</li>
<li>Use multiple gatekeepers.</li>
<li>Secure system resources against system identities.</li>
</ul>
</td>
</tr>
<tr>
<td><em>Configuration Management</em></td>
<td><strong>Vulnerabilities</strong></p>
<ul>
<li>Using insecure administration interfaces.</li>
<li>Using insecure configuration stores.</li>
<li>Storing clear text configuration data.</li>
<li>Having too many administrators.</li>
<li>Using over-privileged process accounts and service accounts.</li>
</ul>
<p><strong>Threats / Attacks</strong></p>
<ul>
<li>Unauthorized access to administration interfaces.</li>
<li>Unauthorized access to configuration stores.</li>
<li>Retrieval of clear text configuration secrets.</li>
<li>Lack of individual accountability.</li>
</ul>
<p><strong>Countermeasures</strong></p>
<ul>
<li>Use least privileged service accounts.</li>
<li>Do not store credentials in clear text.</li>
<li>Use strong authentication and authorization on administrative interfaces.</li>
<li>Avoid storing sensitive information in the Web space.</li>
<li>Use only local administration.</li>
</ul>
</td>
</tr>
<tr>
<td><em>Cryptography</em></td>
<td><strong>Vulnerabilities</strong></p>
<ul>
<li>Using custom cryptography.</li>
<li>Using the wrong algorithm or a key size that is too small.</li>
<li>Failing to secure encryption keys.</li>
<li>Using the same key for a prolonged period of time.</li>
<li>Distributing keys in an insecure manner.</li>
</ul>
<p><strong>Threats / Attacks</strong></p>
<ul>
<li>Loss of decryption keys.</li>
<li>Encryption cracking.</li>
</ul>
<p><strong>Countermeasures</strong></p>
<ul>
<li>Do not develop and use proprietary algorithms (XOR is not encryption. Use platform-provided cryptography.)</li>
<li>Use the RNGCryptoServiceProvider method to generate random numbers.</li>
<li>Avoid key management. Use the Windows Data Protection API (DPAPI) where appropriate.</li>
<li>Periodically change your keys.</li>
</ul>
</td>
</tr>
<tr>
<td><em>Exception Management</em></td>
<td><strong>Vulnerabilities</strong></p>
<ul>
<li>Failing to use structured exception handling.</li>
<li>Revealing too much information to the client.</li>
</ul>
<p><strong>Threats / Attacks</strong></p>
<ul>
<li>Revealing sensitive system or application details.</li>
<li>Denial of service attacks.</li>
</ul>
<p><strong>Countermeasures</strong></p>
<ul>
<li>Use structured exception handling (by using try/catch blocks.)</li>
<li>Catch and wrap exceptions only if the operation adds value/information.</li>
<li>Do not reveal sensitive system or application information.</li>
<li>Do not log private data such as passwords.</li>
</ul>
</td>
</tr>
<tr>
<td><em>Sensitive Data</em></td>
<td><strong>Vulnerabilities</strong></p>
<ul>
<li>Storing secrets when you do not need to.</li>
<li>Storing secrets in code.</li>
<li>Storing secrets in clear text.</li>
<li>Passing sensitive data in clear text over networks.</li>
</ul>
<p><strong>Threats or Attacks</strong></p>
<ul>
<li>Accessing sensitive data in storage.</li>
<li>Accessing sensitive data in memory (including process dumps.)</li>
<li>Network eavesdropping.</li>
<li>Information disclosure.</li>
</ul>
<p><strong>Countermeasures</strong></p>
<ul>
<li>Do not store secrets in software.</li>
<li>Encrypt sensitive data over the network.</li>
<li>Secure the channel.</li>
</ul>
</td>
</tr>
<tr>
<td><em>Session Management</em></td>
<td><strong>Vulnerabilities</strong></p>
<ul>
<li>Passing session identifiers over unencrypted channels.</li>
<li>Permitting prolonged session lifetime.</li>
<li>Having insecure session state stores.</li>
<li>Placing session identifiers in query strings.</li>
</ul>
<p><strong>Threats or Attacks</strong></p>
<ul>
<li>Session hijacking.</li>
<li>Session replay.</li>
<li>Man-in-the-middle attacks.</li>
</ul>
<p><strong>Countermeasures</strong></p>
<ul>
<li>Partition site by anonymous, identified, and authenticated users.</li>
<li>Reduce session timeouts.</li>
<li>Avoid storing sensitive data in session stores.</li>
<li>Secure the channel to the session store.</li>
<li>Authenticate and authorize access to the session store.</li>
</ul>
</td>
</tr>
<tr>
<td><em>Validation</em></td>
<td><strong>Vulnerabilities</strong></p>
<ul>
<li>Using non-validated input in the Hypertext Markup Language (HTML) output stream</li>
<li>Using non-validated input used to generate SQL queries</li>
<li>Relying on client-side validation</li>
<li>Using input file names, URLs, or user names for security decisions</li>
<li>Using application-only filters for malicious input</li>
<li>Looking for known bad patterns of input</li>
<li>Trusting data read from databases, file shares, and other network resources</li>
<li>Failing to validate input from all sources including cookies, query string parameters, HTTP headers, databases, and network resources</li>
</ul>
<p><strong>Threats / Attacks</strong></p>
<ul>
<li>Buffer overflows</li>
<li>Cross-site scripting</li>
<li>Canonicalization attacks</li>
<li>Query string manipulation</li>
<li>Form field manipulation</li>
<li>Cookie manipulation</li>
<li>HTTP header manipulation</li>
</ul>
<p><strong>Countermeasures</strong></p>
<ul>
<li>Validate input: length, range, format, and type</li>
<li>Constrain, reject, and sanitize input</li>
<li>Encode output</li>
</ul>
</td>
</tr>
</tbody>
</table>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=Od3rj8HZ8NA:Ea-kuB56PqE:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=Od3rj8HZ8NA:Ea-kuB56PqE:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=Od3rj8HZ8NA:Ea-kuB56PqE:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=Od3rj8HZ8NA:Ea-kuB56PqE:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/Od3rj8HZ8NA" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/08/20/cloud-security-frame/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/08/20/cloud-security-frame/</feedburner:origLink></item>
		<item>
		<title>Vision Scope Template</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/2LcmjVzLfnU/</link>
		<comments>http://shapingsoftware.com/2009/08/09/vision-scope-template/#comments</comments>
		<pubDate>Sun, 09 Aug 2009 18:54:51 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Project Management]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/08/09/vision-scope-template/</guid>
		<description><![CDATA[At patterns &#038; practices, we use Vision Scope milestones to sell management on how we'll change the world.  Knowing the vision and scope for a project is actually pretty key.  The vision will motivate you and your team in the darkest of times.  It gets you back on your horse when you get knocked off.  The scope is important because it's where you'll usually have to manage the most expectations of what you will and won't do.]]></description>
			<content:encoded><![CDATA[<p><a href="http://shapingsoftware.com/wp-content/uploads/2009/08/visionscopetemplate.jpg"><img style="border-top-width: 0px; display: inline; border-left-width: 0px; border-bottom-width: 0px; margin-left: 0px; margin-right: 0px; border-right-width: 0px" title="VisionScopeTemplate" src="http://shapingsoftware.com/wp-content/uploads/2009/08/visionscopetemplate-thumb.jpg" border="0" alt="VisionScopeTemplate" width="304" height="245" align="right" /></a></p>
<p>How do you convince a team of venture capitalists to bet on you?  There&#8217;s a lot of ninja techniques but here I&#8217;ll share the fundamentals.</p>
<p><strong>Vision and Scope<br />
</strong>At patterns &amp; practices, we use Vision Scope milestones to sell management on how we&#8217;ll change the world.  Knowing the vision and scope for a project is actually pretty key.  The vision will motivate you and your team in the darkest of times.  It gets you back on your horse when you get knocked off.  The scope is important because it&#8217;s where you&#8217;ll usually have to manage the most expectations of what you will and won&#8217;t do.</p>
<p><strong>Thinking in Terms of Venture Capitalists</strong><br />
When I do a vision scope, I think of the management team as the venture capitalists (a tip from a friend.)  This helps me get in the right mindset.  I have to convince them that I have the right problem, the right solution, the right customers, the right impact, the right team, the right cost and the right time-frame.  Hmmmm &#8230; I guess there&#8217;s a lot to get right.  A template helps.  The right slide template helps because it forces you to answer some important questions.</p>
<p><strong>Template for Vision Scope</strong><br />
Here&#8217;s the template I used from my last vision scope meeting:</p>
<p>Vision / Scope</p>
<ul>
<li><em>Agenda </em></li>
<li><em>Problem </em></li>
<li><em>Vision </em></li>
<li><em>Approach </em></li>
<li><em>Prioritized Tests for Success </em></li>
<li><em>Scope </em></li>
<li><em>Key Activities </em></li>
<li><em>Deliverables </em></li>
</ul>
<p>Execution:</p>
<ul>
<li><em>Execution </em></li>
<li><em>Team </em></li>
<li><em>Budget </em></li>
<li><em>Schedule </em></li>
<li><em>Risks </em></li>
<li><em>Asks </em></li>
<li><em>Go/No Go</em></li>
</ul>
<p>It&#8217;s implicitly organized by problem, solution, deliverables and execution.  While the slides are important, I found that the real success in vision scope isn&#8217;t the particular slides.  It&#8217;s buy in to the vision, rapport in the meeting, and trust in the team to do the job.</p>
<p>What works for you?</p>
<p><em>Photo by </em><a rel="nofollow" href="http://www.flickr.com/photos/29233640@N07/" target="_blank"><em>Robert Couse-Baker</em></a><em>.</em></p>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=2LcmjVzLfnU:LcWDhROOMqg:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=2LcmjVzLfnU:LcWDhROOMqg:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=2LcmjVzLfnU:LcWDhROOMqg:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=2LcmjVzLfnU:LcWDhROOMqg:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/2LcmjVzLfnU" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/08/09/vision-scope-template/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/08/09/vision-scope-template/</feedburner:origLink></item>
		<item>
		<title>Lessons in Software from Mike de Libero</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/DnTjZ-xNd2s/</link>
		<comments>http://shapingsoftware.com/2009/07/20/lessons-in-software-from-mike-de-libero/#comments</comments>
		<pubDate>Mon, 20 Jul 2009 04:27:58 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Guest Posts]]></category>

		<category><![CDATA[Lessons in Software]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/07/20/lessons-in-software-from-mike-de-libero/</guid>
		<description><![CDATA[Editor’s note: This is a guest post from Mike de Libero.  Mike has been doing software development for more than 9 years in a variety of settings.  He’s worked as a freelance developer.  He’s also worked on a small team of developers maintaining 30+ programs at one time.  He’s even worked as a security tester on the Microsoft Office team. ]]></description>
			<content:encoded><![CDATA[<div class="noprint" style="float: right; margin: 0px"><img style="border-top-width: 0px; display: inline; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" title="MikeDeLibero" src="http://shapingsoftware.com/wp-content/uploads/2009/07/mikedelibero-thumb.jpg" border="0" alt="MikeDeLibero" width="304" height="204" /></div>
<p><span style="color: #5399c4;"><strong>Editor’s note</strong>: This is a guest post from Mike de Libero.  Mike has been doing software development for more than 9 years in a variety of settings.  He’s worked as a freelance developer.  He’s also worked on a small team of developers maintaining 30+ programs at one time.  He’s even worked as a security tester on the Microsoft Office team. </span></p>
<p><span style="color: #5399c4;">I first met Mike through <a href="http://securitybuddha.com/" target="_blank">Mark Curphey</a>.  Software security is a small world.  The funny thing about many of the people I meet in software security is that they 1) tend to break things to make things better, 2) like to help, and 3) focus on improvement.  The great thing about Mike is that he&#8217;s got a passion for development, and he&#8217;s more focused on principles, patterns, and practices, than on a particular technology.  Here are Mike&#8217;s top lessons learned in software development &#8230;</p>
<p></span></p>
<p><span style="color: #5399c4;"> </span></p>
<p><strong>Top 10 Lessons in Software Development</strong></p>
<p>Here is a summary of my top lessons in software development:</p>
<ul>
<li>Lesson 1. All software is flawed.</li>
<li>Lesson 2. Check-in often.</li>
<li>Lesson 3. Tests, gotta love them.</li>
<li>Lesson 4. Refactor, check-in and repeat.</li>
<li>Lesson 5. Coding is easy, humans are tough.</li>
<li>Lesson 6. The more eyes on your code the better.</li>
<li>Lesson 7. Keep learning and improving.</li>
<li>Lesson 8. Simple is beautiful.</li>
<li>Lesson 9. Learn software development not coding.</li>
<li>Lesson 10. Think about your audience.</li>
</ul>
<p><strong>Lesson 1. All software is flawed.</strong><br />
Anyone who has written a software program larger than “hello world” knows that there will be bugs.  That is just a fact of software development.  These flaws occur because the way a piece of software is written is a reflection of what the developer’s though processes are and what challenges he or she is trying to solve.  Because human thoughts are not logically perfect all of the time, errors will occur.  Also, software development is always a trade-off between time/money and features leading to items left partially coded or rushed through.  Which leads us to the next lesson…</p>
<p><strong>Lesson 2. Check-in often.</strong><br />
Everyone is using source control, right?  If you are not, start now!  When developing software or doing heavy refactoring, source control is your friend.  The more often you check-in a usable piece of code the easier it is to rollback if you completely screw something up.  On teams that require a code review before check-in or they freeze check-ins setup a private source control server it is so quick and easy.  I always think of source control as an undo button and it partially frees the developer from the fear of screwing up publicly.  If you use source control and unit-tests almost all fear just goes away.</p>
<p><strong>Lesson 3. Tests, gotta love them.<br />
</strong>Ahh unit tests… Everyone says you have to use them and they are the best thing since sliced bread.  I happen to agree for the most part.  When doing greenfield development I make sure unit tests are always written and used.  However the idea of unit tests as a part of the normal development cycle has only become semi-common in the last five years and good software was built long before then.  Keeping a list of common tests that should be ran outside of an IDE is also a great thing to have.  I think the greatest advantage of unit tests is that as long as they are quick to run it allows for a quick sanity check for the developer.  If source control is the development undo button then unit-tests are the babysitter that yells at you for doing something you wouldn’t do if your parents were around.</p>
<p><strong>Lesson 4. Refactor, check-in and repeat.</strong><br />
No piece of code is perfect but it can hopefully become better (and yes it could get worse) by going back over and asking the questions “what can I do to make this shorter, easier to understand, etc…”  People do this all the time when writing papers but it doesn’t happen often when writing code.  After each interval, check-in the code in case you go too far and removed some needed piece of code.  Depending on the size of code being refactored there might be many iterations.</p>
<p><strong>Lesson 5. Coding is easy, humans are tough.<br />
</strong>Don’t get me wrong, there are some hard problems in coding but they are not as hard as figuring out what our fellow beings want out of a piece of software.  Humans tend to be fickle and contradict what they say.  On top of that it is very hard to communicate clearly and a barrier exists between “geek-speak” and normal vocabulary.  It becomes extremely difficult to figure out what users are asking for.</p>
<p><strong>Lesson 6. The more eyes on your code the better.<br />
</strong>Whenever I go into a new code base or one I haven’t been into for a few weeks I always spend a few minutes browsing around looking for things to improve.  When I spot something that was a bad implementation or just a bug I shoot an email over to the developer and let them know how it could be improved (I also change the implementation to make it better).  I ask for and expect the same thing out of any developer I work with.  Why?  Because it keeps us honest and teaches us ways to make our programs better.  Sure, this might not be a sit-down code review but I find this to work fairly well at least for smaller teams.  The more formal code reviews are nice to and have similar goals: higher quality code, bugs found before QA gets it and information transfer.  I think it all depends on the environment you are in.</p>
<p><strong>Lesson 7. Keep learning and improving.</strong><br />
This lesson is pretty obvious but it has to be said.  If you don’t learn and/or keep improving you risk becoming a <a href="http://www.randsinrepose.com/archives/2005/01/24/avoiding_the_fe.html" target="_blank">fez</a> which I doubt anyone wants.  My usual metric is:</p>
<ul>
<li>1)    What new language / technology / technique did I learn in the past month?</li>
<li>2)    When looking at my old code can I easily find better ways to do things?</li>
</ul>
<p>I think the second metric is very important.  If you can’t think of ways to improve the code - even if it is not feasible in the current code base – then you should be concerned as that is one sign you are not growing.</p>
<p><strong>Lesson 8. Simple is beautiful.</strong><br />
The acronym KISS is awesome and I try to follow that when developing software since I also believe in the idea that as software grows it becomes more complex.  Whenever I have to fix an issue or write code I always ask myself “can it be any simpler?”  Simplicity has many benefits and not just from a development perspective some of them are:</p>
<ul>
<li>Code is easier to understand</li>
<li>Maintenance tends to be easier</li>
<li>Simple UIs tend to make programs easier to use</li>
</ul>
<p><strong>Lesson 9. Learn software development not coding.</strong><br />
Personally I make a distinction between coding and actual software development.  I think there are far too many people who focus on just the coding portion and not the bigger picture.  Many people can write code but it seems fewer people can design a system, test a system, write the code, document the architecture, talk to users to figure out requirements, create semi-accurate estimates, help other team members and when designing a user interface know the basics of user interaction.  There are things all developers should know about coding as well but I feel improving your coding chops is pretty easy and is done as you develop software.  Learning and improving in regards to software development is not necessary for one to hold done a job as a programmer.</p>
<p><strong>Lesson 10. Think about your audience.<br />
</strong>When reading this point did you immediately jump to the users of the program for which it is being created?  If you did you forgot a few other audiences :).  Whenever you code I find that there are at least 4 audiences: the compiler, other programmers / your future self, attackers/malicious users and then the users of the program.  All of these audiences require different things and the easiest audience to please is the compiler.  The other audiences take a bit more work while creating software.  For example the attacker audience we really want to piss off instead of please and pissing off an attacker is fairly easy by just not trusting input and properly encoding output (note: this won’t protect you from everything in the attacker arsenal but it will take care of a huge amount).  The developer audience is fairly tough as we tend to think all other code is stupid or at least have an opinion about it, this stems from the differences in how each person thinks (at least that is my opinion on it).  Commenting business logic, writing clean and clear code and keeping it simple usually helps the development audience.  For the actual users of the program they are an interesting group.  There are many books on usability and design so I am just going to suggest you pick-up a few good books on that matter (if you need any suggestions feel free to get in touch with me).</p>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=DnTjZ-xNd2s:xpqGZ2-1nSg:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=DnTjZ-xNd2s:xpqGZ2-1nSg:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=DnTjZ-xNd2s:xpqGZ2-1nSg:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=DnTjZ-xNd2s:xpqGZ2-1nSg:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/DnTjZ-xNd2s" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/07/20/lessons-in-software-from-mike-de-libero/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/07/20/lessons-in-software-from-mike-de-libero/</feedburner:origLink></item>
		<item>
		<title>Lessons in Software from James Waletzky</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/bbc4FkCro1U/</link>
		<comments>http://shapingsoftware.com/2009/07/06/lessons-in-software-from-james-waletzky/#comments</comments>
		<pubDate>Mon, 06 Jul 2009 06:12:59 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Guest Posts]]></category>

		<category><![CDATA[Lessons in Software]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/07/06/lessons-in-software-from-james-waletzky/</guid>
		<description><![CDATA[When J.D. asked me to share my thoughts on some top software development lessons I've learned throughout my time as a developer, I jumped at the chance. I have had successes and failures, and consulted with teams that share the same. Below is my list of 10 lessons I have learned through hard experience. This list is by no means definitive, but is gleaned from years of development experience. 
Without further ado…]]></description>
			<content:encoded><![CDATA[<div class="noprint" style="float: right; margin: 0px"><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" height="244" alt="James Waltesky" src="http://shapingsoftware.com/wp-content/uploads/2009/07/james-waltesky-thumb.png" width="238" border="0" /></div>
<p><span style="color: #5399c4"><strong>Editor&#8217;s note</strong>: This is a guest post from James Waletzky. James is a Development Lead at Microsoft and he maintains a blog about software engineering at http://blogs.msdn.com/progressive_development. James has shipped quite a few products and has worked on the Microsoft Engineering Excellence team, where he taught developers about agile and other software engineering practices and consulted with internal product groups to improve their engineering practices.</span></p>
<p>When J.D. asked me to share my thoughts on some top software development lessons I&#8217;ve learned throughout my time as a developer, I jumped at the chance. I have had successes and failures, and consulted with teams that share the same. Below is my list of 10 lessons I have learned through hard experience. This list is by no means definitive, but is gleaned from years of development experience.   <br />Without further ado…    <br /><strong>Ten Software Development Lessons</strong></p>
<ul>
<li>Lesson 1.&#160;&#160;&#160; Keep it simple. </li>
<li>Lesson 2.&#160;&#160;&#160; Define &#8216;done&#8217;. </li>
<li>Lesson 3.&#160;&#160;&#160; Deliver incrementally and iteratively. </li>
<li>Lesson 4.&#160;&#160;&#160; Split scenarios into vertical slices. </li>
<li>Lesson 5.&#160;&#160;&#160; Continuously improve. </li>
<li>Lesson 6.&#160;&#160;&#160; Unit testing is the #1 quality practice. </li>
<li>Lesson 7.&#160;&#160;&#160; Don’t waste your time. </li>
<li>Lesson 8.&#160;&#160;&#160; Features are not the most important thing. </li>
<li>Lesson 9.&#160;&#160;&#160; Never trust anyone. </li>
<li>Lesson 10.&#160;&#160;&#160; Reviews without preparation are useless. </li>
</ul>
<p><strong>Lesson 1.&#160;&#160; Keep it simple.</strong>    <br />I lost count of the number of over-engineered, over-complicated designs that I have seen throughout the past few years.&#160; Software developers are ever in search of the most elegant solution to a problem. Guess what? Complexity causes problems - like prohibiting understanding of the design and code, causing maintainability issues, increasing the likelihood of bugs, generating bloated code, and often causing difficulty in testing. From the age old adage:    <br /><em>&quot;Perfection is achieved, not when there is nothing more to add, but when there is nothing left to take away.&quot;</em> — Antoine de Saint Exupéry    <br />Build in extensibility only when you need it. Accommodate change in your designs - don&#8217;t anticipate it. Keep class definitions small. Follow the Rule of Seven (i.e. 7 +/- 2 rule) when grouping concepts like methods on a class. Measure code complexity and refactor as necessary. There are many other strategies for keeping design and code simple. Use them.</p>
<p><strong>Lesson 2. Define &#8216;done&#8217;.</strong>    <br />Have you ever asked a developer how far along they are in their feature development? I am willing to bet that the most typical answer is 90%. Then next week you ask the same question and get the same answer. When they are eventually 100% &#8216;done&#8217;, do you know exactly what that 100% entails from the quality side? How exactly would you define &quot;code complete&quot;? I bet your answer would be different than mine, and different from J.D.&#8217;s.    <br />It is important to have a clear, agreed-upon definition of &#8216;done&#8217; at many different levels, including individual check-ins, component development, feature development, short iterations, milestones, and finally, release. On my team, code is ready for check-in when all unit tests pass, unit tests achieve 80%+ code coverage, code has been reviewed, design docs are in place, the code is free of memory leaks, and several other criteria. Our check-in checklist is arguably our most important tool. In fact, checklists are a great way to track these definitions. The meaning of &#8216;done&#8217; should become commonplace and a part of your team&#8217;s vocabulary. Write it down so there is no confusion.</p>
<p><strong>Lesson 3.&#160;&#160;&#160; Deliver incrementally and iteratively.</strong>    <br />Unfortunately, my crystal ball is in the shop being repaired. Until I get it back, it is hard to predict the future and derive a detailed plan that I am sure will hold true for the development of many features . In the absence of that crystal ball, delivering software in a piece-wise fashion helps achieve success. Break your scenarios into pieces and deliver small chunks in short iterations of 2-4 weeks in length. Get feedback early and often. Fold the feedback into the next iteration and incrementally build upon the results of the previous iteration, refactoring as needed to keep the design clean. You will end up with a better result than if you swim down the river and fly over the waterfall.</p>
<p><strong>Lesson 4.&#160;&#160;&#160; Split scenarios into vertical slices.</strong>    <br />Assuming you are practicing scenario-based development, which could also easily make this list, to help deliver real business value in short iterations, it is important to break functionality into chunks. One method of chunking, assuming a typical architecture of data, logic and presentation layers, is to deliver the lowest level (data) followed by the middle layer (logic) followed by the user interface (presentation). The user does not care about the data layer and you miss the chance to gain valuable feedback if you deliver in this first. Instead, break things up vertically - deliver an end-to-end scenario with just enough data, logic and UI to support the scenario. The feedback you receive will factor into future scenarios and you adjust the design as you go. Additionally, you never write code that is not used, and adhere to the principle of YAGNI, or &quot;You Ain&#8217;t Gonna Need It&quot;.</p>
<p><strong>Lesson 5.&#160;&#160;&#160; Continuously improve.     <br /></strong>Tightly coupled with delivering software in an iterative fashion is the idea of continuous improvement, often called &quot;Kaizen&quot;. Nothing is ever good enough - at least, that is the way you should think. Work to constantly improve your processes, the way the team works together, your tools, and anything else that contributes to your software development. Step back early and often and do a retrospective on the previous iteration, feature delivery, or even past few days of work. What went well? Continue to do those things. What didn&#8217;t go so well? Get beyond the symptom to the root cause of why there were issues and come up with actionable ways to fix them. Put those actions into practice in your next iteration.&#160; Always strive to become a high performing team with the world&#8217;s best product.</p>
<p><strong>Lesson 6.&#160;&#160;&#160; Unit testing is the #1 quality practice.     <br /></strong>I often get asked the following question: if I could change one thing about software development to encourage improved early-development cycle quality, what would it be? Easy - improved unit testing. Historically at many companies, developers would write the code, run the &quot;happy path&quot; through the debugger, and throw the code over the wall to the test team for validation. Quality would be &quot;tested in&quot;. On more recent teams we have been doing much more unit testing&#160; using code coverage as a feedback mechanism and quality has risen substantially. Additionally, unit tests give you the confidence to refactor your code at any moment in time leading to cleaner designs and more maintainable code. The icing on the cake is having the tests run as part of a daily build, so you always have quick feedback as to whether functionality is broken. The disadvantages are that unit tests take time to write and you add 50%+ more code to your product, but the investment is worth it.</p>
<p><strong>Lesson 7.&#160;&#160;&#160; Don’t waste your time.</strong>    <br />The agile development manifesto values working software over comprehensive documentation. This guideline has proven valuable. Several projects I have experienced went overboard on plans, requirements specifications, designs, test plans, process documentation, release plans, etc. Don&#8217;t get me wrong - there is value in these documentation artifacts. The key is to do &quot;just enough&quot;. Know the audience for your documentation and do the minimum amount to meet their needs. Any more than that is waste. Every activity in the development cycle should add value to the business, product or end user. Spend your time on activities that count.</p>
<p><strong>Lesson 8.&#160;&#160;&#160; Features are not the most important thing.</strong>    <br />Yes, you heard correct - features are not the most important thing. Of course, if you are writing a v1 product, features are pretty important. However, in today&#8217;s software market, quality and fit and finish are just as important as features. The software needs to &quot;just work&quot;. Quality attributes such as performance and reliability are huge satisfiers and are expected by customers. Fit and finish, or polish, on a product set it apart from competitors. A good example of fit and finish that could have been cut from the Apple development cycle are the rubber band effects on the list control on the iPhone. When I bought my iPod Touch I flicked that thing over and over because I thought the effect had a significant cool factor. It delighted me. I fell in love with the device. Of course, polish goes hand-in-hand with features and quality attributes - the device must do what I want it to do and not crash while doing it. The point, however, is that fit and finish is very important in today&#8217;s software world and should not be neglected.</p>
<p><strong>Lesson 9.&#160;&#160;&#160; Never trust anyone.</strong>    <br />Ok, not literally. I am not talking about trusting your teammates - that is extremely important, and if you ask Stephen Covey, &quot;trust is the life-blood of an organization&quot;. Here I am talking about trusting calling code outside of your boundary (e.g. any public method). I have seen more security vulnerabilities than I can count resulting from a failure to validate input parameters. I have seen more bugs than I count that could have been prevented by programming defensively. Use assertions liberally in your code to validate internal state.&#160; Use trace statements strategically to dump out debugging state. Assume that some client with bad intentions will call into your code and handle all the error cases gracefully. One piece of advice that a good friend of mine and contributor to this blog, Corey Ladas, once told me: &quot;write code as if the debugger doesn&#8217;t exist&quot;. That slight switch in mindset, coupled with a focus on unit tests, will make you a much more efficient developer reducing your time in the debugger, where you are generally least efficient.</p>
<p><strong>Lesson 10.&#160;&#160;&#160; Reviews without preparation are useless.</strong>    <br />If you ever get invited to a spec review or code review without having seen the document or code prior to the review, just say &quot;no&quot;. In this case, you are about to violate lesson #7 and waste your time as well as everyone else&#8217;s. Code reviews are a valuable quality control technique that every software development organization should practice. The key to a successful review is receiving the artifact up-front and having that focused alone time to prepare and find issues. The meeting is simply used to gather the feedback and learn from one another. The meeting is not used to find more issues. It pains me to see many hours wasted in useless reviews. Don&#8217;t be a victim.    <br />The above list of lessons learned in software development is the tip of the iceberg. There are many more lessons that could be added to this list to make us all more successful. I would love to learn from all of you as well, and hear about your top lessons learned. Care to share?</p>
<p><strong>Additional Resources</strong>    <br />There are many resources for each of the lessons in the above list. For a gateway to many good resources, see the Progressive Development blog listed below, as well as many of the other postings on this site.</p>
<ul>
<li><a href="http://www.progressivedevelopmentblog.com/" target="_blank">Progressive Development</a> (James Waletzky&#8217;s blog) </li>
<li><a href="http://leansoftwareengineering.com/" target="_blank">Lean Software Engineering</a> (Blog) </li>
</ul>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=bbc4FkCro1U:aE8mzknMtEQ:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=bbc4FkCro1U:aE8mzknMtEQ:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=bbc4FkCro1U:aE8mzknMtEQ:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=bbc4FkCro1U:aE8mzknMtEQ:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/bbc4FkCro1U" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/07/06/lessons-in-software-from-james-waletzky/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/07/06/lessons-in-software-from-james-waletzky/</feedburner:origLink></item>
		<item>
		<title>Lessons in Software from Alok Srivastava</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/uHiZDieAWeU/</link>
		<comments>http://shapingsoftware.com/2009/06/29/lessons-in-software-from-alok-srivastava/#comments</comments>
		<pubDate>Mon, 29 Jun 2009 05:00:29 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Guest Posts]]></category>

		<category><![CDATA[Lessons in Software]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/06/29/lessons-in-software-from-alok-srivastava/</guid>
		<description><![CDATA[This is a guest post from Alok Srivastava on software lessons learned.  Alok is a solution architect at Microsoft with more than 17 years of industry experience.  He specializes in software architecture, large-scale systems, and distributed computing.  Alok has filed for a dozen patents, published several papers, and presents his ideas at seveal conferences. He has a wealth of experience across large scale projects, database extensibility, multimedia and content management in RDBMS, Web services, portal technologies, and content distribution networks.  In this post, Alok shares his lessons learned ...]]></description>
			<content:encoded><![CDATA[<div class="noprint" style="float: right; margin: 0px"><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" height="244" alt="Alok Srinvastava" src="http://shapingsoftware.com/wp-content/uploads/2009/06/alok-srinvastava-thumb.jpg" width="220" border="0"></div>
<p><span style="color: #5399c4"><strong>Editor’s note</strong>: This is a guest post on software lessons learned from Alok Srivastava.&nbsp; Alok is a solution architect at Microsoft with more than 17 years of industry experience.&nbsp; He specializes in software architecture, large-scale systems, and distributed computing.&nbsp; Alok has filed for a dozen patents, published several papers, and presents his ideas at many conferences. He has a wealth of experience across large scale projects, database extensibility, multimedia and content management in RDBMS, Web services, portal technologies, and content distribution networks.&nbsp; In this post, Alok shares his lessons learned &#8230; </span></p>
<p>These are my top lessons learned drawing from my years of software experience.&nbsp; I am sharing them with you here.</p>
<p><strong>Summary of Lessons</strong><br />Here is an index of the lessons that follow:</p>
<ul>
<li>Lesson 1. Software development is a team sport.
<li>Lesson 2. More lines-of-code does not mean better software.
<li>Lesson 3. The Cloud is an inflection point.
<li>Lesson 4. Scalability, performance and diagnostic ability are better achieved at design time.
<li>Lesson 5. User experience and user expectation change continuously that is why UI projects are never done.
<li>Lesson 6. Software maintainability is a key to longer life for any software.
<li>Lesson 7. Development process should help development produce good quality software, if it comes in your way change it.
<li>Lesson 8. Take agility with a grain of salt; result –oriented software development is what agility should help you gain.
<li>Lesson 9. A great software engineer never stops working.
<li>Lesson 10. Know the keys to writing great software; magic isn’t one of them. </li>
</ul>
<p><strong>Lesson 1. Software development is a team sport</strong>.<br />Complexity of software systems has grown over past several years. If a software solution has to reach a customer, they need a lot more than just code. They need to install, configure, administer and monitor what they are getting. Developers may need to program with the platform that you are providing. They may also need to bill for usage, measure performance, increase load and add users. At the same time they need to be able to learn, get help, and localize the software for their audience. If the software doesn’t work right, they need to be able to tell you what is not working right. The list goes on and on. Just the software that solves a specific problem can not cover all of this. Developing an industry strength, enterprise class software isn’t something one person can even comprehend. You need a team of folks who are good in their areas of responsibility. This team includes, program managers, development leads and developers, quality team, configuration and install team, management tools team, documentation and release team and of-course evangelists, trainers, support professionals and consultants.<br />When I started to think about bringing my ideas to life, I could prototype and come with demonstration quite easily without depending on anyone else but turning those ideas to product was a whole different story. I needed a virtual-team that could help me with everything I needed to get the product to price list. Even while working on a startup, a team was needed to get the concept to customers.</p>
<p><strong>Lesson 2. More lines-of-code does not mean better software.</strong><br />For many years, I have been hearing that the larger lines of code (LOC) somehow indicate that it is better and complex software. I have used that metric in my conversations as well but I have not been convinced that that is actually true. Some of the code that has lived for many years has grown in size as additional functionality was added but one has to understand that back then there was no managed environment and languages such as C# or Java. Operating system may not have helped you much therefore there was a good reason to write all you needed from ground up and that made the code grow fast. Over time even these systems (Windows for example) also have come to realization that they can do better with fewer lines of code. When it comes to managed code environment (like Java and C#) one can do a lot with very few lines of code. In fact, fewer lines of code mean that you are using the facilities that the managed environment provides in the way they were meant to be used. Any time my software team came to me to tell me that they have written a hundred thousand lines of managed code, I had to make them pause and review parts of the code to make sure they were not trying to re-invent the wheel. Given the level of functionality that is available from managed environment, toolkits and operating environment, the LOC measure for code quality complexity should now be outdated and better measures should be developed for the same.</p>
<p><strong>Lesson 3. The cloud is an inflection point.</strong><br />What we know as cloud and cloud computing started many years ago when Internet started to form. While the most commercially viable applications focused primarily on web site and e-commerce in 1997-1998 early ideas of using Internet as a network that separates users from servers were already taking shape. As usual, it has taken a while for technology to make that scenario viable. Virtualization has also followed the trend to make it possible for cloud to finally form. At the same time, managed environments and Internet based application delivery has eased the fear of losing control if you did not see the hardware running your app underneath your desk. It has taken several computing and IT areas to mature before cloud can be realized. Now that the cloud is here, we are nearing closer to utility computing. If my vision serves me well, we are not too far away from a time when a consumer will be able to create their own way of doing business on the Internet by picking the services that are available and are willing to compete for my business. We are still in learning mode though. Many corporations haven’t yet figured out what the cloud is and what it could mean for their business (or their competitor’s business). Add social interactions on the Internet to the mix and you can see the picture better. Cloud should not be very confusing but when it comes to defining what a cloud is, many people have different perspectives. The way I like to understand cloud is that cloud is a method of service delivery. It defines application/service deployment and access patterns and it is built on services on the Internet (be it platform as a service or software as a service). If cloud is the way we started, the picture would have been simpler and transition much easier. Unfortunately we have many years of legacy dealing with client-server and n-tier applications and it will take time to comfort all weary souls that cloud is all new beast that they need to deal with. Say whatever you like, define it the way you want but the cloud computing is going to have a major impact on our industry and will change the way software business is conducted.</p>
<p><strong>Lesson 4. Scalability, performance and diagnostic ability are better achieved at design time.<br /></strong>This is something I have learned over time and having learned my lessons, the first thing I try to tell anyone writing software is to think hard, design more, analyze as much as you can before the coding begins. When you are first developing application functionality is always on the top of your mind and everything else that software needs takes back seat. I can understand why a software engineer wants to implement functionality first; they get to see the outcome of their hard work. They always say, let’s get it working first and we will deal with the rest of it later. I wish I could give them the budget to build the software from idea to customer and over the life of the software, they will see what I see most of the time. These are the primary reasons why almost all software start ups have to go through a re-architecture cycle before they can have a sustainable software system that works well as their company grows. While I understand that it is not practical to worry about performance and scale when you have to have something in market next month. Many times that is not what pushes the thinking around performance and scale (diagnostic ability is implied throughout our conversation) simply because we don’t want to deal with this. If one could see the overall cost (translate to time spent by many people and re-architecture), they will not ignore these. I would rather extend the design and architecture phase a bit longer in order to save a lot of time and headache later. During design time if your desired parameters for performance scale and diagnostic ability were defined, your design will have to meet those criteria before being accepted. During design time, though experiments and prototyping can help open up the system for large scale and better performance later. If you have thought about it while designing your system (and software) you would know what the impact of scale would be, where your system is likely to become resource constraint and what you would have to do to allow the scale and better the performance. If nothing else you will be able to pre-define the use criteria for your system in order to not fail or get customers in trouble and you will have your requirements for the next release. You may get a chance to put in place low level instrumentation that will help you achieve your performance, scale and diagnostic ability goals during next development cycle even if you did not have time to do it now.</p>
<p><strong>Lesson 5. User experience and user expectation change continuously that is why UI projects are never done.</strong><br />I have been involved in many UI projects to experience this first hand. The user experience pendulum swings from rich and responsive interface to interface available everywhere. Something that gets the job done or something that keeps people engaged and involved is also a topic of discussion when you are doing a UI project. Sometimes you will also hear productivity argument when it comes to UI. Usability, compliance, localization ability, customizability and personalization are all the terms that get considered when UI project is at hand. First thing that I have learned over time is that no matter how good a UI you think you have there will be some people who will hate that little button. What I am trying to say is that you can never make everyone happy with whatever UI you give them. And that’s not all, people will change over time. If your application is going to be in use for many years, be assured that even those who loved it first may have changed their taste and would not be happy anymore. In short you will never ever be all done with your UI work. So what can you do to succeed in an environment that changes all the time? A few things always help: make it customizable and allow users to personalize (if possible). Define personas and profiles you are targeting, learn from them and have them test your UI before it gets implemented and keep UI work on project every single release so that you get a chance to update the looks as the fashion changes.</p>
<p><strong>Lesson 6. Software maintainability is a key to longer life for any software.<br /></strong>This is a pain most of us working on software that has lived a long life, have faced so many times. Countless hours of productive development time has been spent trying to figure out what a piece of software does, how a system works and what will happen if the code logic was changed. We have all heard of side effects in piece of software that can challenge the best of analytical minds. So why does maintainability get such a low priority in software development. First it is laborious work that has no impact on software features. When your reward system recognizes developers who do magic with their software no matter what they do inside, that’s what they will focus on. If you lucky, you will have that super developer on your staff for more than a few years working on the same software. Unfortunately our industry does not work that way and a career path for a great developer keeps them moving. That brings us back to maintainability of the software. All software is designed with an intention that it will keep selling over time (every tried to figure out why the margins on software sale are so high). If that is the intention, you should keep maintainability on design goal on all your projects. Developing maintainable software is a disciplined approach to software development. It does take time and it is usually difficult to measure but it is as important as some of your features. So what makes software maintainable? Usually having a design/architecture doc is useful but inevitably you will hear that that goes out of sync and cannot be relied upon. Usually what I have seen work the best is using the code itself to keep everything about the code inside it. Who designed it, what it was designed for, what are known limitations, what are the assumptions, did anyone fix a bug there and what did they do, what bug was fixed (a reference to bug tracking system helps) should all be captured in the code or alongside the code. Code comments should be written while code is being written just because they are the most relevant and accurate at that time. Code intent (call it design for the module) should be right there with the module being designed. All developers design before coding, they can easily write it there (provided they are motivated to do that). If a cryptic and hard to read code is being developed, it should need more comments and design details than anything else. The system design (original design) and changes to it should be maintained in sync through code management system (even though it may stress your code management system a bit). There is a lot one can do to save time and money over the life of a code. This is going to become even more relevant with SOA and assembled software. One measure for maintainable software is the time require to have a new developer become productive on an existing software (the shorter the time the better maintained your code is).</p>
<p><strong>Lesson 7. Development process should help development produce good quality software, if it comes in your way change it.<br /></strong>This is my favorite topic of discussion with management as well as developers. I am doing this because that’s what you are supposed to do. The process calls for it and if I do not follow the process, I will not be able to check the code in or something else like that. While I agree that process and guidelines are necessary and important but lets’ not forget the purpose for those. Software isn’t a bi-product of processes and guidelines, software is the product. Process should make it easier to develop software, ensure that all requirements are being met. This is why processes should be reviewed periodically with an intention to change and fix it as necessary. This is one of the many things that I would listen to developers and first level managers for. They should be trained to recognize when a process is not working for them. They should be able to identify shortcomings and someone responsible should review the processes and change it to make sure that the intentions behind those processes are still being taken care of without overburdening developers. Automation helps as well. Simpler, meaningful and reasonable processes and guidelines are likely to aid developers in their daily job as well as help get the best product out and everything should be done to get to the state where developers start to feel that guidelines are processes are their friends and they have a good say in shaping these. Process agility is a key to the success of a development team. It should also be recognized that the same processes and practices may not work well with all the teams. The experience level of developers and the nature of project should help shape processes necessary. Cost of changing process is far less than extra time your developers spend getting frustrated because of outdated and meaningless processes.</p>
<p><strong>Lesson 8. Take agility with a grain of salt; result –oriented software development is what agility should help you gain.</strong><br />Agile development methodology; if you are not following it, you are not current. It has become a fashionable new term for management to say – yeah we follow agile methodology in our development. While it sounds cool to say you are agile, stop and take some time to see what are you agile about. Agility isn’t just following Scrum; it is a way to become result-oriented software development team. Lots of time I have seen that software development teams are either forced into following agile methodology or they opt into it because everyone else is doing it. They usually know what to do but they don’t know what to expect. What is also not clear to most is that not all parts of software development benefit from agile methods; The truth is that agile methodology can hurt the overall development if it is applied without proper thought. For example the kind of agility needed for an online SaaS software development shop is quite different from what is needed for traditional development products that get shipped to customer. The right participation in agile method is also key. Program management, quality team, deployment and even documentation team should follow agile method and synchronize with other teams at appropriate time. Architecture, design and requirement gathering is usually not amenable to agile methods (at least the same kind of agile methods that something like Scrum proposes). They can be done in progressive detail as a complete phase before development kicks in. Through my experience on reviewing many projects, I have seen that some of the projects took a lot longer to complete even though they followed the methodology as well as they knew how to follow. Agility is a great achievement for any project team but they have to figure out how they need to adopt it, what would be the impact, what are the expected outcomes and which activities should be pre-conditions or post activities. A lot needs to be considered including involvement of all teams in coming up with agile process before actually executing a project with it. The price for making a mistake could be high and sometimes benefits are never realized. The right kind of agility is what helps reach the ultimate goal- result-oriented software development where everyone involved had a clear insight into how the progress is being made, they can course correct as necessary without having to take a blind approach and just go on faith. While one should take great care and do analysis before adopting agile methodologies, not adopting one can do more harm than good.</p>
<p><strong>Lesson 9. A great software engineer never stops working.</strong><br />I bet you are wondering about this. I thought of picking this topic after hearing (and sometimes practicing) that many teams wanted their developers to log their time to measure productivity and I tried to see how one can measure this. The only thing you can measure is the time you spend typing in from of computer screen but is that really the place where software is created? Sometimes yes but not always. Developing software at its core is a problem solving exercise and when you have a problem, you think about it everywhere. While watching TV, playing soccer, driving or (for some very dedicated individuals) while sleeping. Now how do you measure that as part of your work? The fact is that when presented with real challenging issues, a software engineer will devote all their time until they solve the problem or find someone to help with that. It is just in their nature, their entire engineering training and required educational background shapes them that way. So the real reason I brought this up is to make you re-consider asking your software engineers to log hours to declare how productive they have been. Just use their accomplishment, commitments and goals to measure them with. Forcing software engineers to declare that they work 40 hours a week or more will get you exactly that answer and you know as much as your engineer that there is no real productive measure in knowing that.</p>
<p><strong>Lesson 10. Know the keys to writing great software; magic isn’t one of them.<br /></strong>No matter what development methodology you decide to follow for your software development there are some fundamental things that you should seriously consider accomplishing in order to get quality software to your customers. Keep in mind what I am writing here applies to packaged software development (one can modify these steps for SaaS model but I won’t be covering that in this article):</p>
<ul>
<li>Understand requirements and use-cases: This helps your team understand what they are up against, what assumptions they can make and how they can proceed with their activities. Like every good reviewer, challenge the requirements and question it’s validity. Even though your program manager may be presenting the requirements to you, they need to be able to confidently explain and defend each and every one of those. A requirement may be coming from imagination (new markets), customer demands, customer feedback, steering groups, industry changes, competition and so on. It is a good idea to know what they are.
<li>Assess the needs: Next you should assess the needs for what major software blocks are going to be needed and how they could fit together. In the process of doing this find out what others within your company may already have done (you can simply use their code) or if there are some know publications (make sure you have rights to use it) that address what you are trying to do.
<li>Gather what you can find and identify the gaps: Gather the software/modules you can get and identify where you will need to develop new software. In the process also identify risk area (areas that you don’t know much about).
<li>Prototype: There are several reasons for doing this. First you can eliminate or highlight situations that you thought were risky. Get a sense of is the problem can be solved or a different approach is needed and if there are multiple ways to solve a problem which path will be the best to take. You are also getting insight into what it will take to develop software and that will help you plan and estimate better. This is the first milestone where course correction in terms of planning and schedule should be made. You would also find out if you have to license/acquire technology or if your endeavor is infeasible and should be abandoned. If you are able to carry on, this is your first chance to demo something and improve your team’s credibility.
<li>Design and Architecture: By now you have a great idea about elements needed to build the software. Go ahead and build it … on paper. Write down design, complete architecture, deployment scenarios, test scenarios and also demo scenarios. You know what you need to build and the parts involved, you should be able to accomplish design to a fair amount. If is ok now to become agile and identify isolated areas that have defined interfaces and behaviors but can be designed in detail later. Getting on the paper makes everyone know the system better, question and challenge assumption, incorporate performance and scale parameters, address maintainability and so on. This phase does take time and the whole team is involved but by the end, your team would know the order in which the development will take place, how will systems communicate, how they will fail and recover, are you getting software from inside or acquiring from elsewhere and other details. All that remains is to implement.
<li>Code and document: the previous exercise will give you enough confidence if not all details and a good plan with reliable schedule to complete this phase faster than ever before and perhaps with fewer high impact mistakes. This phase could get a lot smaller and pain-free if all the activities are being taken up accurately. This is great phase to follow full agile method for so you can show progress as you go along finish design details for you was an isolated module and engage documentation and quality teams to start their work. Installation and release teams can get started right here and start to work with shell of an application while features are being put in. Program managers can start to verify use-cases and at some point engage close customers for feedback. You can track to your schedule and see if you need to adjust. By the time coding is done, very little is now remaining to complete the project and hand it over to quality team for final test and sign off, after this phase is completed.
<li>Verify use-case, get user feedback, and fix bugs (no new features): Now the software is ready for final phase of testing user feedback, demos, and bug fixes. If everything else has gone as planned before this phase, one should not be surprised if not too many bugs are discovered in this phase and many of the really bad issues should not show up. </li>
</ul>
<p>What I am describing here is not a methodology for software development rather than distinct activities that should be performed. If you are following agile methods then you can imagine some of these activities will be mixed in as necessary for every iteration. I would strongly recommend not to short circuit design and analysis phase and force that in an agile method since that has a huge chance of making all you agile efforts ineffective or even harmful. I have seen one too many projects suffer through this painful exercise and in the end they did not benefit at all from agile method (although not measured but it may have cost them more due to course correction in between the project). These mistakes will force a lot of back and forth during iterations and will cause developers to wait for corrections to be made or will force them to go back to previous iteration for re-design. Requirement analysis and design phase will help eliminate that and will help better plan and schedule for agile methods to produce desired results.</p>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=uHiZDieAWeU:gbPV5q-b-xU:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=uHiZDieAWeU:gbPV5q-b-xU:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=uHiZDieAWeU:gbPV5q-b-xU:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=uHiZDieAWeU:gbPV5q-b-xU:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/uHiZDieAWeU" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/06/29/lessons-in-software-from-alok-srivastava/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/06/29/lessons-in-software-from-alok-srivastava/</feedburner:origLink></item>
		<item>
		<title>Patterns and Practices of Lean Software Development</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/kD4QUSy74tg/</link>
		<comments>http://shapingsoftware.com/2009/06/22/patterns-and-practices-of-lean-software-development/#comments</comments>
		<pubDate>Mon, 22 Jun 2009 09:21:18 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Guest Posts]]></category>

		<category><![CDATA[Process]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/06/22/patterns-and-practices-of-lean-software-development/</guid>
		<description><![CDATA[Lean Thinking is a paradigm of production and can’t easily be reduced to a process recipe.  The particular form of any Lean process will always depend upon the form of the product that is created by that process.  However, any Lean process will realize a few essential principles.  If we apply these Lean principles to software development, we may find some practices that express those principles in a way that is useful and sensible for the medium.]]></description>
			<content:encoded><![CDATA[<div class="noprint" style="float: right; margin: 0px"><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" src="http://shapingsoftware.com/wp-content/uploads/2009/06/patternsandpracticesforleansoftwaredevelopment-thumb.jpg" border="0" alt="PatternsAndPracticesForLeanSoftwareDevelopment" width="304" height="244" /></div>
<p><span style="color: #5399c4"><strong>Editor’s note</strong>: This is a guest post on Lean Software Development by Corey Ladas. If you don’t know Corey, he is a product development methodologist extraordinaire.  if you missed Corey&#8217;s previous post, <a href="http://shapingsoftware.com/2009/06/15/introduction-to-lean-software-development/">Introduction to Lean Software Development</a>, be sure to check it out.  This is a follow up post for readers who wanted m</span><span style="color: #5399c4">ore information on some principles, patterns, and practices that could help support Lean Software Development. </span></p>
<p>Lean Thinking is a paradigm of production and can’t easily be reduced to a process recipe.  The particular form of any Lean process will always depend upon the form of the product that is created by that process.  However, any Lean process will realize a few essential principles.  If we apply these Lean principles to software development, we may find some practices that express those principles in a way that is useful and sensible for the medium.</p>
<p><strong>One Piece Flow<br />
</strong>A central concept in Lean is that planning, executing, and delivering work in small batches minimizes waste. The ideal limit of working in small batches is the single unit. Creating one piece at a time with zero waste is the ideal of <strong>one-piece flow</strong>.</p>
<p>A Lean goal in software development would be to define a minimum batch size that delivers value to stakeholders.  One such approach for product development is the <strong>minimum marketable feature (MMF)</strong>.  Not all software development is product development, so “marketable” is not always the right criterion.  But every enterprise has some kind of goal that determines value, and this goal can be applied to a minimum stakeholder-valued feature.</p>
<p>There may be many steps involved with the creation of such an atomic work product.  Some of the work that is scheduled in association with a product will directly add value to the product. Other work may be incidental or even unnecessary.  It is important to distinguish between these categories.  <strong>Value stream maps</strong> describe the sequence of value-adding improvements that are necessary to deliver the product.  The “flow” in one-piece flow means that these activities should be performed in an uninterrupted sequence from start to finish.</p>
<p>Dividing the work into independent business-valued features enables the <strong>staged delivery</strong> of those features.  Your highest-value customers may receive most of their benefit from some subset of your planned features and would prefer to take earlier delivery of a smaller system.  Revenue earned from these customers can fund your ongoing development in an <strong>incremental funding model</strong>.</p>
<p>An incremental delivery strategy may still be executed against a predetermined plan.  An even more adaptive strategy is <strong>evolutionary delivery</strong>, where frequent deliveries are made in response to evolving market conditions and each delivery is a complete, fully functional system.  Many hosted applications and open-source projects fit this model.  Tom Gilb has written extensively on engineering practices than enable evolutionary delivery at a high level of rigor and quality.</p>
<p>The extreme interpretation of evolutionary delivery is <strong>continuous deployment</strong>, where very small incremental improvements are released to production at a high frequency.  Flickr, for example, releases new code to production every 30 minutes.  IMVU releases every 8 minutes.  This level of operation transforms the metaphor of software development from the construction of an object to the refinement of a fluid.</p>
<p><strong>Let the Market Pull Value from the System<br />
</strong>If we are very flexible in our delivery capability, then we can respond to market conditions as they evolve.  Rather than deliver a feature in a planned release 18 months from now, we can deliver it next month if the market demands.  The faster we can plan and deliver a new feature, the more we can allow the market to <strong>pull value from the system</strong>.</p>
<p>Customers may not have the right understanding to express what they really need.  Allowing the market to pull will still require interpretation from a producer.  In order to understand what the customer really needs, you should <strong>go and see for yourself</strong> the need that the customer is trying to satisfy.   The methods of <strong>Quality Function Deployment</strong> allow us to discover and express the voice of the customer in a way that we can translate into detailed and actionable product specifications.</p>
<p>If we deliver work in high-frequency iteration, we will have to find a way to make that work flow smoothly within the development organization.    If that value stream includes operations that require the services of specialized or scarce resources, then we will need a way to coordinate the scheduling of those resources.  A <strong>kanban-controlled workflow</strong> regulates the productivity of individual process steps in the value stream, so that each step produces only at the rate that is required by the pull of the market.  A kanban system creates an internal market where downstream consumers pull value from upstream producers.</p>
<p>Pull systems enable us to create value <strong>just-in-time</strong>.  Market value does not always come in uniformly-sized chunks and sometimes we can see changes in market trends before they are expressed as specific product demands.  We can strike a balance between meeting the demand of the present and anticipating the needs of the future with just-enough-planning.  <strong>Rolling wave planning</strong> scales planning detail according to time, so that we make detailed plans about things that will happen very soon, and more general plans about things that will happen in the future.  The further the time horizon, the less specific the plan.  Then we must revisit the plan frequently as we learn new things about market conditions.</p>
<p><strong>Real options</strong> are an approach to project management that are analogous to financial options in investment management.  A real option may allow us to purchase in the right to defer a management decision to some future date.  When that date arrives we can exercise the option or allow it to expire.  We can then create a planning portfolio of options instead of a portfolio of commitments.  Rolling wave planning and staged delivery are examples of options thinking.</p>
<p><strong>Set-based development</strong> means that we may pursue multiple competing design alternatives simultaneously, and defer commitment to any particular design alternative until we have more information.  This is another example of options thinking.  <strong>Distributed version control</strong> systems enable inexpensive branching and merging and thereby facilitate evolutionary selection of the fittest features and designs.  Some well-known large open source projects operate according to a set-based strategy.</p>
<p><strong>Visual Control</strong><br />
Another key principle of Lean thinking is that we should optimize the whole system, as a system.  Uncoordinated local optimizations never lead to a system that is optimized as a whole.  In order to optimize the system as a whole, it helps if we can see the system as a whole, and this leads us to the practice of <strong>visual control</strong>.  Visual controls are usually created to illuminate the relationship between a local process and the system, in order to provide the operators of the local process with context.</p>
<p>A popular type of visual control in software development is the <strong>card wall</strong>.  If a card wall is used in conjunction with a kanban system, then we might call it a heijunka board or kanban board.  A heijunka board is used to implement a process called <strong>production leveling</strong>, where the parts of the system operate at a consistent rate, without booms and busts, and the flow of work through the system is smooth.  A card wall can also be used to implement the practice of the <strong>andon signal</strong>, which is used to communicate a problem in the development process.</p>
<p>Visual controls work best when they are ubiquitous and inescapable, but we can always enforce a minimum shared understanding with a <strong>daily stand-up meeting</strong>.</p>
<p><strong>Build Quality In</strong><br />
A Lean development process should not allow defective work to move downstream.  A policy of one-piece flow enables a policy of 100% inspection, with an aim towards discovery of any defects at the earliest possible moment.  This translates directly to software development in the form of <strong>design review</strong> and <strong>code inspection</strong>, which are greatly facilitated by small batch size and pull workflow.  When a defect is discovered, a Lean process should <strong>stop the line</strong> and apply root-cause analysis in order to discover the source of the defect.  If the root cause is repeatable and preventable, then we should adapt our process to prevent that kind of defect in the future.</p>
<p><strong>Jidoka</strong> is a philosophy of optimizing the balance of work between people and machines, so that people only do work that people are good at and machines only do work that machines are good at.  Lean processes use automation, but always in the service of and under the control of a human operator.  A Lean process should prefer <strong>simple tools</strong>.  Over-reliance on complex tools and technology may lead a business to be enslaved by the capability of their technology and disconnected from customer value.  Lean tools should be as flexible as the marketplace they serve.</p>
<p><strong>Continuous integration</strong> is a automation practice that reduces work-in-process and can greatly facilitate the early discovery of defects.  <strong>Design-by-Contract</strong> instruments source code to self-detect design anomalies.  Automated design verification can then be accomplished with <strong>static analysis</strong>.  Specification-based verification strikes a nice balance between work that people are good at (expressing intent) versus work that machines are good at (exhaustive search).  Requirements specifications can also be made verifiable in this way.</p>
<p><strong>Continuous Improvement<br />
</strong>The <strong>PDSA</strong> (or PDCA) cycle is a time-tested approach to continuous improvement.  <strong>Plan</strong> the work that you need to do, <strong>Do</strong> the work, <strong>Study</strong> the results of the work you have done, and <strong>Act</strong> on what you learn in order to improve.  The application of Lean principles create an environment where the PDSA cycle can be sustainable and effective.</p>
<p><strong>Standard work</strong> is the foundation of continuous improvement.  Standard work in Lean means that the operators of a process reach a consensus about appropriate results of a process and the best known methods to achieve them.  A work standard only remains the standard until a better way is discovered, which then becomes the new standard.  These standards should never be imposed by an external agent. In software development, such standards may take the form of design rules, coding rules, checklists, inspection procedures, or even the workflow itself.  PDSA is the process which drives the evolution of standards.</p>
<p><strong>Throughput metrics</strong> provide useful information to discover the causes and effects of production problems.  The primary throughput metrics are time-series metrics, so we can associate changes in the metrics with known historical events.  Inventory levels are a leading indicator of lead time, which we can use to guide management action.  A stable throughput process is predictable and enables estimation of future deliveries based on historical data, instead of guessing.</p>
<p><strong>References</strong></p>
<ul>
<li>Corey&#8217;s blog:  <a href="http://www.LeanSoftwareEngineering.com">http://www.LeanSoftwareEngineering.com</a></li>
<li><a href="http://www.amazon.com/Lean-Thinking-Corporation-Revised-Updated/dp/0743249275" target="_blank">Lean Thinking</a>, James Womack and Daniel Jones</li>
<li><a href="http://www.amazon.com/Software-Numbers-Low-Risk-High-Return-Development/dp/0131407287" target="_blank">Software by Numbers</a>, Denning and Cleland-Huang</li>
<li><a href="http://www.amazon.com/Principles-Software-Engineering-Management-Gilb/dp/0201192462" target="_blank">Principles of Software Engineering Mangement</a>, Tom Gilb</li>
<li><a href="http://www.amazon.com/Lean-Software-Strategies-Techniques-Developers/dp/1563273055" target="_blank">Lean Software Strategies</a>, Peter Middleton and James Sutton</li>
<li><a href="http://www.amazon.com/Implementing-Lean-Software-Development-Addison-Wesley/dp/0321437381" target="_blank">Implementing Lean Software Development</a>, Mary and Tom Poppendieck</li>
<li><a href="http://www.amazon.com/Principles-Product-Development-Flow-Generation/dp/1935401009" target="_blank">The Principles of Product Development Flow</a>, Donald G. Reinertsen</li>
<li><a href="http://www.amazon.com/Scrumban-Essays-Systems-Software-Development/dp/0578002140" target="_blank">Scrumban</a>, Corey Ladas</li>
</ul>
<p><em>Photo by <a rel="nofollow" href="http://www.flickr.com/photos/cayusa/" target="_blank">Cayusa</a></em><em>.</em></p>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=kD4QUSy74tg:jlqSWBKRYkU:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=kD4QUSy74tg:jlqSWBKRYkU:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=kD4QUSy74tg:jlqSWBKRYkU:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=kD4QUSy74tg:jlqSWBKRYkU:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/kD4QUSy74tg" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/06/22/patterns-and-practices-of-lean-software-development/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/06/22/patterns-and-practices-of-lean-software-development/</feedburner:origLink></item>
		<item>
		<title>Introduction to Lean Software Development</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/OmlDqv18naA/</link>
		<comments>http://shapingsoftware.com/2009/06/15/introduction-to-lean-software-development/#comments</comments>
		<pubDate>Mon, 15 Jun 2009 07:14:52 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Guest Posts]]></category>

		<category><![CDATA[Process]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/06/15/introduction-to-lean-software-development/</guid>
		<description><![CDATA[
Editor’s note: This is a guest post on Lean Software Development by Corey Ladas. If you don&#8217;t know Corey, he&#8217;s a product development methodologist. He brings more to the table than most on engineering process because of his background working on integrated mechanical / electrical / software products.&#160; What I like about Corey is his ability to take start of the art and bridge the gap with state of the practice. He has an uncanny ability to boil complex things down into their essence. without further ado, here&#8217;s Corey with ...]]></description>
			<content:encoded><![CDATA[<div class="noprint" style="float: right; margin: 0px"><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" height="244" alt="IntroductionToLeanSoftwareEngineering" src="http://shapingsoftware.com/wp-content/uploads/2009/06/introductiontoleansoftwareengineering-thumb.jpg" width="324" border="0"></div>
<p><span style="color: #5399c4"><strong>Editor’s note</strong>: This is a guest post on Lean Software Development by Corey Ladas. If you don&#8217;t know Corey, he&#8217;s a product development methodologist. He brings more to the table than most on engineering process because of his background working on integrated mechanical / electrical / software products.&nbsp; What I like about Corey is his ability to take start of the art and bridge the gap with state of the practice. He has an uncanny ability to boil complex things down into their essence. without further ado, here&#8217;s Corey with an introduction to Lean Software Development &#8230;</span></p>
<p>The application of Lean principles to software development process requires interpretation, and there is more than one school of thought about the best interpretation of Lean Software Development.&nbsp; Some focus on Lean principles applied to common development practices, some focus on workflow management, others focus on complementary product development processes used by Toyota and other Lean producers.<br /><strong>Five Principles of Lean Thinking</strong><br />The principles of Lean Thinking are necessarily abstract compared to the detailed methods used by Toyota for making cars, but this generalization allows of to think of a great variety of business applications.&nbsp; The authors of <em>Lean Thinking</em>, Jim Womack and Daniel Jones, define the five core principles as:</p>
<ul>
<li>Specify <strong>value</strong> from the standpoint of the end customer by product family.
<li>Identify all the steps in the <strong>value stream</strong> for each product family, eliminating every step and every action and every practice that does not create value.
<li>Make the remaining value-creating steps occur in a tight and integrated sequence so the product will <strong>flow</strong> smoothly toward the customer.
<li>As flow is introduced, let customers <strong>pull</strong> value from the next upstream activity.
<li>As these steps lead to greater transparency, enabling managers and teams to eliminate further waste, pursue <strong>perfection</strong> through continuous improvement. </li>
</ul>
<p><strong>Why Lean - The origin of Lean Thinking in the Toyota Production System<br /></strong>The history of business over the last two centuries is largely the history of industrial mass production.&nbsp; Methods of accounting, project management, organizational design, and many other institutions of business culture developed in service of the needs of mass production.&nbsp; The success of mass production has been so profound and so enduring that its practices have become synonymous with the practice of business in general, even when those practices are inappropriate for the specific problem at hand.&nbsp; Mass production became traditional, traditional practice is taught in business school, and when all you have is a hammer, everything looks like a nail.<br />Unfortunately, there are a wide and increasing number of business problems for which mass production thinking is poorly suited.&nbsp; Software development would be a major category.&nbsp; There has been an ongoing mismatch between traditional business practices and the needs of software development throughout the entire history of software development — a fact which has been greatly lamented over the years, often under the label of “The Software Crisis.”</p>
<p>Sometimes it takes an historical event to disrupt an historical process.&nbsp; In the case of mass production, it was the recovery of post-World War 2 Japan, and the emergence of the Toyota Motor Company as a global producer.&nbsp; Mass production assumes a) capital is scarce and must be optimized, and b) the market wants large quantities of a limited variety of goods.&nbsp; Toyota found itself in a situation where a) labor is scarce and must be optimized, and b) the market wants limited quantities of a wide variety of goods.&nbsp; Japanese consumers expected comparable value and quality from Japanese producers as they did from American producers, but Toyota could not support the economics of mass production in the marketplace of postwar Japan.&nbsp; Faced with such circumstances, Toyota’s only options were to exit the business or get very creative about how to make automobiles.&nbsp; They got creative, and today they are the largest and most successful auto manufacturer in the world.</p>
<p>The problems that Toyota faced foreshadowed the problems that an increasing number of businesses would face in the late 20th century:&nbsp; customers want more variety and better quality, and they want it now.&nbsp; Traditional business practices are often poorly suited to deal with these expectations, and management theorists became increasingly restless in their pursuit of new understanding.&nbsp; Much as the industrial practice of yesteryear evolved into more general business practice, the principles of the Toyota Production System were abstracted into the general business philosophy we now call Lean.</p>
<p><strong>The Metaphor School of Lean Software Development<br /></strong>Since software development is really nothing like assembling an automobile, it will require some interpretation in order to make sense of Lean principles. The first school of thought in Lean Software Development is the interpretation of Lean principles in terms of native software development methodology.&nbsp; If we can identify existing methods that are analogous to concepts in Lean, then this will help us deliver the value that Lean promises or help us align software development teams with a surrounding Lean business.</p>
<p>The founders and chief proponents of this school of thought are Mary and Tom Poppendieck, publishers of the popular <em>Lean Software Development</em> series of books.&nbsp; The Poppendiecks interpret the general Lean principles into something more intelligible for software development:</p>
<ul>
<li>Eliminate Waste
<li>Create Knowledge
<li>Build Quality In
<li>Defer Commitment
<li>Deliver Fast
<li>Respect People
<li>Improve the System </li>
</ul>
<p>This approach to Lean software development has been attractive to some who believe that software is fundamentally a craftwork discipline.&nbsp; The individual craft mode of production is inconsistent with a strict interpretation of Lean, so craftwork proponents that are sympathetic to Lean tend to favor a more abstract interpretation.</p>
<p>The Agile software movement have been the most visible proponents of the craftwork philosophy in recent years.&nbsp; The part of the Agile community that has adopted Lean thinking typically calls their flavor Lean/Agile development.&nbsp; Lean/Agile proponents typically describe practices of methods like Scrum or Extreme Programming in terms of Lean principles, and sometimes modify or elaborate on those practices accordingly.&nbsp; Craig Larman and Bas Vodde are notable proponents of this view, as expressed in their recent book Scaling Lean &amp; Agile Development.&nbsp; Alan Shalloway and Curt Hibbs are also well-known advocates of this approach.</p>
<p><strong>The Workflow School of Lean Software Development</strong><br />Another major school of Lean thinking in software development is more focused on management and is more comfortable with words like “software engineering.”&nbsp; This “workflow school” believes that the majority of software development processes can be described in terms of…workflow, and that any workflow process is directly subject to the five principles of Lean Thinking, without need to abstract away the details.&nbsp; There have been a few false starts since the 1980’s, but the modern founder of this approach is generally considered to be Donald Reinertsen.</p>
<p>Peter Middleton and James Sutton are advocates of a Lean approach to software engineering, including the application of systems engineering methods like Quality Function Deployment and software engineering methods like formal specification.&nbsp; Enthusiasts of Tom Gilb’s evolutionary delivery approach to software engineering have been reinterpreting and updating some of Gilb’s methods in terms of Lean ideas.</p>
<p>The workflow school has experienced substantial growth over the last two years, with the adoption of the kanban style of workflow management popularized by David Anderson.&nbsp; My book, <em>Scrumban</em>, is the first book to describe the kanban approach in detail, but there are a growing number of sources online.</p>
<p>Describing Lean software development in terms of “schools” might paint a more adversarial picture than is actually the case.&nbsp; Most teams using kanban systems today would consider themselves to be Agile teams, but perhaps an emerging second generation of Agile that embraces Lean more openly.</p>
<p><strong>Additional Resources</strong></p>
<ul>
<li>Corey’s Blog – <a href="http://www.LeanSoftwareEngineering.com/">http://www.LeanSoftwareEngineering.com/</a>
<li><a href="http://www.amazon.com/Lean-Thinking-Corporation-Revised-Updated/dp/0743249275" target="_blank">Lean Thinking</a>, James Womack and Daniel Jones
<li><a href="http://www.amazon.com/Lean-Software-Development-Agile-Toolkit/dp/0321150783" target="_blank">Lean Software Development</a>, Mary and Tom Poppendieck
<li><a href="http://www.lulu.com/content/3864767" target="_blank">Scrumban: Essays on Kanban Systems for Lean Software Development</a>, Corey Ladas </li>
</ul>
<p><em>Photo by </em><a href="http://www.flickr.com/photos/my_world_perspective/" target="_blank" rel="nofollow"><em>One man&#8217;s perspective</em></a><em>.</em></p>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=OmlDqv18naA:8NJ6oggZxX0:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=OmlDqv18naA:8NJ6oggZxX0:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=OmlDqv18naA:8NJ6oggZxX0:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=OmlDqv18naA:8NJ6oggZxX0:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/OmlDqv18naA" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/06/15/introduction-to-lean-software-development/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/06/15/introduction-to-lean-software-development/</feedburner:origLink></item>
		<item>
		<title>Key Project Practices</title>
		<link>http://feedproxy.google.com/~r/ShapingSoftware/~3/JELTWmxldEU/</link>
		<comments>http://shapingsoftware.com/2009/05/31/key-project-practices/#comments</comments>
		<pubDate>Sun, 31 May 2009 21:30:17 +0000</pubDate>
		<dc:creator>JD</dc:creator>
		
		<category><![CDATA[Project Management]]></category>

		<guid isPermaLink="false">http://shapingsoftware.com/2009/05/31/key-project-practices/</guid>
		<description><![CDATA[The following is a short list of some of the project practices that have helped me maximize impact, while shipping  on time and on budget. 

Verification

Dog fooding.  Throughout the project, I have the team dog food what we build.  See Dog fooding (WIkipedia.)
5 customers.  This is an critical check throughout the project that 5 customers stand behind the project.   They key is these are 5 customers that actually use the deliverable.]]></description>
			<content:encoded><![CDATA[<div class="noprint" style="float: right; margin: 0px"><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" height="217" alt="KeyProjectPractices" src="http://shapingsoftware.com/wp-content/uploads/2009/05/keyprojectpractices-thumb.jpg" width="304" border="0"></div>
<p>The following is a short list of some of the project practices that have helped me maximize impact, while shipping&nbsp; on time and on budget.</p>
<p><strong>Verification</strong></p>
<ul>
<li><strong>Dog fooding</strong>.&nbsp; Throughout the project, I have the team dog food what we build.&nbsp; See <a href="http://en.wikipedia.org/wiki/Eat_one's_own_dog_food" target="_blank">Dog fooding</a> (WIkipedia.)
<li><strong>5 customers</strong>.&nbsp; This is an critical check throughout the project that 5 customers stand behind the project.&nbsp;&nbsp; They key is these are 5 customers that actually use the deliverable.
<li><strong>Product teams stand behind / promote</strong>.&nbsp;&nbsp; Given that I create prescriptive guidance, it&#8217;s vital that the product teams can stand behind what I create.&nbsp; If they aren&#8217;t promoting it and using it to solve customer problems, then something is off.
<li><strong>Scenario Evaluations</strong>.&nbsp; Walking the scenarios and testing against scenarios is one of the most effective ways to verify the solution against the problem.&nbsp; I try to identify key criteria so the team knows what to look for.
<li><strong>Sign-off by key stake-holders</strong>.&nbsp; The key is to get everybody&#8217;s finger prints on it and to make sure they can stand behind it.&nbsp; It helps avoid the scenario where stakeholders shoot down the project. </li>
</ul>
<p><strong>Domain Analysis Artifacts</strong></p>
<ul>
<li><strong>Question List.</strong>&nbsp; I create a list of what people &#8220;ask.&#8221;&nbsp; Knowing the questions people have, verbatim, helps me quickly know what problems people care about.
<li><strong>Task List</strong> (input for scenario frame).&nbsp; I create a list of what people &#8220;do.&#8221;&nbsp; A task list is simply a set of the tasks that users perform.&nbsp; Ideally, these are goal-based.&nbsp; As Alan Cooper might put it, &#8220;persona-based scenarios with goals.&#8221;
<li><strong>Scenario Frames</strong>.&nbsp;&nbsp; I create a Scenario Frame.&nbsp; Scenarios (or stories) are a simple way to organize the things that your users do.&nbsp; Organizing them in a frame makes them easier to manage and share.&nbsp; See <a href="http://shapingsoftware.com/2009/05/31/scenario-frames/">Scenario Frames</a>.
<li><strong>Real Problem Feedback</strong>.&nbsp;&nbsp; I find concrete instances of real problems.&nbsp; Finding people who actually share the problem helps.
<li><strong>Project Specific Personas</strong>.&nbsp; I identify the types of users, along with their context, drivers, and needs.&nbsp; Personas help with customer empathy.&nbsp; See <a href="http://shapingsoftware.com/2009/02/02/personas-at-patterns-practices/">Personas at patterns &amp; practices</a>. </li>
</ul>
<p><strong>Product Team Reviews</strong></p>
<ul>
<li><strong>Product Team Reviews</strong>.&nbsp;&nbsp; Regular product team reviews help me keep everybody on the same page.
<li><strong>Whiteboard reviews</strong>.&nbsp; Whiteboard reviews simply mean rather than any formal slides, we simply review key concepts and ideas on the whiteboard.&nbsp; This is a lightweight way of checking and sharing information.&nbsp; They&#8217;re easier to organize because they can be done more ad-hoc.
<li><strong>Modular, incremental reviews</strong>.&nbsp;&nbsp; I try to engage the product teams along the way rather than a big bang at the end.&nbsp; It&#8217;s more effective and let&#8217;s us change course as needed.&nbsp; Most importantly, it let&#8217;s us act on the feedback.
<li><strong>Snapshot Reviews</strong>.&nbsp;&nbsp; I create tickler lists of points for review.&nbsp; Having a bulleted set of items to review makes reviews much more efficient and helps store and share state for a lot of information. </li>
</ul>
<p><strong>Execution</strong></p>
<ul>
<li><strong>Exec sponsor</strong>.&nbsp;&nbsp; Having an exec sponsor helps the project over rough patches.&nbsp; Usually, the exec sponsor puts somebody on point as an escalation path and this helps with cross-group issues.
<li><strong>Cuttable scope</strong>.&nbsp; If you don&#8217;t have cuttable scope, your project is at risk.&nbsp;&nbsp; Cuttable scope means that when you cut something, you actually do gain back time, without messing up quality.&nbsp; To pull this off, it means having a good idea of discreet incremental chunks of value. </li>
</ul>
<p><strong>Communication</strong></p>
<ul>
<li><strong>Internal project site</strong>.&nbsp; I&#8217;ve found that having an internal project site helps have a simple place to point people to let them know what&#8217;s going on with the project.
<li><strong>Agile customer project site</strong>.&nbsp;&nbsp; I find it helpful to have a simple place to share deliverables with customers.&nbsp; For example, this is our <a href="http://www.codeplex.com/VSTSGuidance " target="_blank">Visual Studio Team System Guidance</a> customer site.&nbsp; It made it easy to share news, share releases and get customer feedback.
<li><strong>Team Wiki</strong>.&nbsp; I find it helpful to have a team Wiki to dump information as we go. </li>
</ul>
<p><strong>My Related Posts</strong></p>
<ul>
<li><a href="http://shapingsoftware.com/2008/12/09/lessons-learned-in-patterns-practices/">Lessons Learned in patterns &amp; practices</a></li>
</ul>
<p><em>Photo by </em><a href="http://www.flickr.com/photos/davidrn/" target="_blank" rel="nofollow"><em>Liquid Lucidity</em></a><em>.</em></p>
<div class="feedflare">
<a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=JELTWmxldEU:DqtBsrOdC_k:gIN9vFwOqvQ"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=JELTWmxldEU:DqtBsrOdC_k:gIN9vFwOqvQ" border="0"></img></a> <a href="http://feeds.feedburner.com/~ff/ShapingSoftware?a=JELTWmxldEU:DqtBsrOdC_k:V_sGLiPBpWU"><img src="http://feeds.feedburner.com/~ff/ShapingSoftware?i=JELTWmxldEU:DqtBsrOdC_k:V_sGLiPBpWU" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/ShapingSoftware/~4/JELTWmxldEU" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://shapingsoftware.com/2009/05/31/key-project-practices/feed/</wfw:commentRss>
		<feedburner:origLink>http://shapingsoftware.com/2009/05/31/key-project-practices/</feedburner:origLink></item>
	</channel>
</rss>
