Adobe is shooting itself in the foot. Because of Flash’s history, with security concerns and performance issues, downloading the latest and greatest Flash player should be as simple as humanly possible. But that is not the case.

To download Flash Player 12, I had to go through the Adobe’s website. Updating from with Flash Player 11 didn’t seem to be an option.

That isn’t too bad a problem, except for 2 days I tried to download from Adobe’s website, and wasn’t able to.

All I saw was this:

Every time I clicked on “Install Now”, it linked me back to adobe.com.

Until I realized that my Ghostery add-on for Firefox was blocking Omniture. I paused Ghostery, reloaded the page, and saw this:

So McAfee, while it is “optional”, is really required in the sense that it must show. The same cookie is required for the “Install Now” download option to work, otherwise it links back to Adobe.com.

So basically this tells me that to download Flash Player, I have to allow advertising and cookie tracking, and if you running any secure blocking of those cookies, you can’t upgrade your Flash Player, it doesn’t even fail properly to the correct download link.

I also tried the “Are you an IT manager or OEM?” link hoping it would provide an executable I could download, but that required a separate registration process.

Dear Adobe – stop penalizing people who are trying to make their browsing experience as safe and secure as possible. Your desire to track things with Omniture shouldn’t trump basic common sense.

Take a listen!

Things wrong:

1. My name isn’t $first name$
2. How did my resume end up in your database? I’ve been with the same employer for 9 years.
3. Your clients is a global company? Wow? Do they outsource to China or something?
4. “This division is a cloud based software application development company, building multi-tiered SaaS based web based Healthcare applications.” – using the word ‘based’ a little too much? What’s multi-tiered SaaS?
5. “Lead a team of circa 8 Senior and Junior developers and QA staff.” ‘Circa’, really?
6. When I clicked on your link, it looked like an old Geocities web site? Paw prints, really?
7. “We are a highly professional and ethical firm”… sure…
8. Your LinkedIn shows your vast experience working as a Courier for Fedex.
9. Your unsubscribe link says I don’t have Javascript enabled. Nice excuse.

Hi $first name$

Your resume is in our database. Please let me know if you would be interested or if you can possibly recommend someone for one of the following full-time job opportunity in Irvine.

Our client is a global company. This division is a cloud based software application development company, building multi-tiered SaaS based web based Healthcare applications.

1.) Team Manager & Sr Developer – Irvine – 4 year degree with 10 plus years experience. Lead a team of circa 8 Senior and Junior developers and QA staff. Experience with OO PHP, ColdFusion, HTML/CSS, JavaScript, WebServices (SOAP and RESTful), XML, JSON, and SVN version control software Understand of LAMP stack and PHP design standards- Salary 95k -110k plus excellent benefits!

2.) Sr Developer– Irvine – 4 year degree with 5 plus years experience. Experience with OO PHP, ColdFusion, HTML/CSS, JavaScript, WebServices (SOAP and RESTful), XML, JSON, and SVN version control softwareSalary 80k – 100k plus excellent benefits!

http://www.linkedin.com/in/karlsw

This one is serious. You need to be aware as it will, most likely, impact your application.

The issue is simple, and logically CF 10’s fix makes sense, except that is breaks backward compatibility and make some things harder on us.

Let’s work through the use case.

In an ideal world, your application would allow UserA with UsernameA to login to your application. If UserB used the same UsernameA, it should either give an error saying that UsernameA is in use, or kick UserA off and allow UserB in. This second scenario, kicking the user off, is what is the default in CF10.

Normally, you would think this is a good thing. Users shouldn’t share usernames anyways, right? Well, kinda.

Adobe’s assumption that this is the ONLY use case is incorrect. There are valid scenarios where users share usernames. But beyond that, let’s say you do a lot of server-side functional testing using Selenium or JMeter, and you have a single login for the script to use, as soon as user2 logs in, user1 is kicked out. This is what happened to us – all our server side tests started failing in CF10.

And lastly, what if you are developer, and need to login on two different browsers, say IE and FF, to compare how the screen looks and are doing your standard browser compatibility testing, suddenly you can’t – because one will log out the other.

The impact of this change is great in the way we do business as developers. You now have to support multiple logins, and in the case of JMeter test where the script ramps up to 20 concurrent users, provide twenty different logins. And then imaging deleting all that test data. The list of additional work goes on.

Some ideas that have been floated and I support, is to make this functionality optional. I would love to set this up to make it optional for my test accounts. The way I see that is a conditional setting in onSessionStart. Obviously there are other ways to skin this cat.

The downside to this is that it halts all sorts of testing for our app and our migration to CF10 is seriously tainted.

You can do a couple things. Vote here: https://bugbase.adobe.com/index.cfm?event=bug&id=3339008. And contact Shilpi Khariwal https://twitter.com/shilpikm – ColdFusion Security Czar.

I installed CF10 locally, and forgot the password over the weekend. So I did what every other developer does: play with ‘neo-security.xml’ and set ‘admin.security.enabled’ to false. Once I restarted the ColdFusion service, I was able to get into my CF Admin just fine.

But, here is where it gets interesting. Under Security->Administrator, the “No authentication needed (not recommended)” option was selected. Naturally, I changed that to “Use a single password only (default)”. Below that under “Root Administrator Password”, I entered the new passwords and hit ‘Submit Changes’ and CF Admin rejected me saying: “Password could not be changed as the old password is incorrect.”

Below where I set the new password is an input box for “Old Password”. Well – I don’t know the old password! So this means, the old password field is required, regardless of whether you forgot it or not.

So I’m stuck. To close the big security hole of people being able to log into my CF Admin, I set the option to “Use a single password only (default)” without setting a new password, and suddenly my CF Admin requires a password. Hackers can’t get in, but neither can I.

Basically, I’m stuck until Adobe fixes this. After some searching I found a bug logged in May for this. PLEASE VOTE: https://bugbase.adobe.com/index.cfm?event=bug&id=3187494.

All I can do now is set the xml to false, restart CF, make my changes, and set the option to require a password. Not fun.

Does anyone have a workaround? Make sure to vote!

With CF10, I can’t seem to find any documentation on how to do that. Running WSConfig no longer has an option with a drop-down of instances, so I was left scratching my head.

Adobe’s notes @ http://help.adobe.com/en_US/ColdFusion/10.0/Installing/WSc3ff6d0ea77859461172e0811cdec18a15-7ffb.html have no mention of instances.

After much digging, I figured out that you cannot use the Web Server Configuration Tool in the Windows menu, rather you have to go to \*cf dir*\*instance dir*\runtime\bin, and run wsconfig.exe and select the right website from the drop down.

Essentially, every time you create a new instance, you have a new wsconfig.exe that you will use to connect that instance to a website. The one in the Windows menu is only for the cfusion instance, which makes it useless if you are used to a more advanced setup, nor is this documented very well.

Why in the world, when you had the flexibility before, was that taken away and not documented well? Adobe!!!

Over the past 8 years, at my current position as an executive who also develops actively, I’ve reviewed probably over 300+ resumes, and phone interviewed over 200+ CF folks alone from all over the world. There are some things you learn along the way as a hiring manager – how the market for talent works, the general capabilities of CF developers, and what their typical strengths and weaknesses look like.

I did want to mention two recent resumes and hiring experiences that both went south. This is advice for all CF folks, as I’ve waited to write this to make sure nothing I said would be personal or negative, rather that I could put a positive spin on things and give advice.

As a developer, there really needs to be a focus on self-improvement. In most cases, I don’t find that – I’m surprise how many people “settle.” For me ColdFusion enables each and every day to accomplish an overall vision I have for the projects that I work on – ColdFusion is not the goal in and of itself, nor is the pay check that drives me. I couldn’t work in an environment which gave me access to ColdFusion, but restricted my ideas on how to improve the projects I worked on, or paid me a high salary – but denied me a voice.

Very few developers (roughly 2% from experience) have anything to show for self-improvement. Have they kept up on blogs, read books, attended a conference, tried new techniques, improved their understanding of object-oriented (if not aspect-oriented) programming? What drives them? The answer I usually get is that they are interested in new techniques and approaches, it’s just that their work environment never provided them the opportunity to do so. This to me is a red flag – I expect any serious developers to have their own work environment at home, and work on their own pet projects on the side.

But I tend to forgive the developers, and blame the management in those companies for not fostering innovation. How often do folks meet to exchange ideas in your department, present on new findings, and are given time to develop new ideas on their own? As a manager, I think less about micro-managing or macro-managing, but finding opportunities for my folks to shine. I want to always market my team to the rest of the company as a high performing, well motivated team.

And that’s what sets our company apart, and that is also what leads to problems in hiring. I often talk, in the first round of interviews, about my philosophy, how the team is run, and how we’re simply different. This gets people VERY excited and I get them thinking about how they can contribute to this environment, what skills they bring, and what they’d like to learn. I often tell them that they can expect the first 90 days to be like a tidal wave – we use so many bleeding edge ColdFusion techniques (the rights ones, not all), that it can be very overwhelming.

The problem occurs when people come with years of experience, but that doesn’t translate to necessarily years of accomplishments. You may have worked for 12 years as a ColdFusion developers, in senior roles even, but if you have never touched a framework, then that is a problem. One year of experience here, I often say, is worth 3-5 at other places.

If you are serious at getting better as a developer, then you have to find an environment that is going to support (and push) you. That in itself is worth a lot.

And that’s where the problem is. I recently got two resumes from folks – who each had 12+ years of CF development experience, but I could not say they were truly senior (in my perspective). Regardless, I was willing to offer opportunities to them as Senior folks, with the understanding that they would be able to pick up all the exciting things I talked about.

And then… the focus turned to salary. Do you want to guess what both of them were asking for? Well, here it is – $130K-$135K annually plus benefits.

I was dumbfounded. I am no position to offer that kind of salary to anyone. Heck, even I don’t make that kind of money, and I’m a Director! You have to do your research: we’re a small company (less than 50 folks), and you have to add the value given by a supportive work environment.

I’m not saying we can’t attempt to meet your needs, but seriously… You know that old saying – you dress for the position you want, not the one you have? Well, that applies to CF developers as well. If you feel you’re worth a ton of money, then exhibit the qualities of a world-class developer. If I asked you to rate yourself on the scale of journeyman to master – where would you fall? Do you have experience leading a sophisticated team – often times filled with people who are smarter than you? No. Have you worked with OO frameworks in CF for 9 years like me? No. (I celebrate my 9 year anniversary with Mach II next month!) Are you a master of both the back-end and front-end languages? No. Do you have the communication skills to interface with all sorts of different stakeholders? No.

So what then qualifies you to ask for that much? Well – the answer usually is: “I can make that much consulting.” Well, if you want to pay for your own health insurance, forgo benefits, and work in an environment that really is not going to make you a better developer, and for a company that isn’t truly committed to ColdFusion as a development platform of choice, then go ahead. But if you want to earn a real salary, and be given the opportunity to prove yourself, and work your way up the ladder, then I’m here to support you and am all for that. But be real.

There is nothing at my company that say that you can’t make that kind of money, with benefits and possible bonuses, it’s quite possible. But you’ve got to also have the pedigree and focus to enable that. If you’re overly focused on salary, then I’m sorry – I have something to offer that is worth so much more.

There is probably more to say, but I’ll stop here. I’ve probably already said too much.