SOFTware is HARD

Use Case Realisation in UML

2013-05-23T16:17:00.001+08:00

This is a sample of a use case realisation (design-level) for a use case “View the Dashboard”.
The implementation uses ASP.NET MVC and the design is documented in the following UML diagrams.
This is an experiment whereby I produced the design in UML for a new developer to implement the use case.

The following Sequence Diagram documents the initial web request to display the empty Dashboard.

The following Sequence Diagram documents subsequent web requests to display the search result.

The next Sequence Diagram specifies the implementation of DashBoardCntrl::retrievePlanListFromCache.

The final is the View-Of-Participating-Class (VOPC) diagram for this use case realisation.

When is a Sequence Number Not Sequential?

2013-05-15T20:05:00.001+08:00

A sequence number or an identity column guarantees the following:

Number served is unique.
Number served is sequential (ascending order) - Identity columns guarantees this; sequence number in Oracle RAC mode doesn't, unless ORDER is used.

However:

It does not guarantee the sequence is gap-free
Sequence number/ identity columns do not partake in transactions

Number loss/ gaps happen due to the following:

Served number does not get utilised (typically due to transaction rollback)
Server restart/ failures - database servers tend to cache sequences in memory for performance reasons. E.g. Oracle Sequence number set-up to be CACHEd in memory.

Serialization appears to be the only solution. However, serialization would be non-scalable and would incur a huge performance impact.

Psychology Behind Dishonesty

2013-05-07T08:22:00.001+08:00

An appreciation to why people are dishonest.
Flash version can be found here.

How to determine if you've been blocked by a WhatsApp contact

2013-04-09T10:35:00.001+08:00

According to the legal clauses in WhatsApp, such blocks have been made non-deterministic to protect privacy.

However, by experimentation, you'd notice the following when you've been blocked:

unable to see the "online" or "last seen" of the contact. Described here
messages sent to the party does not get delivered - indicated by 1 tick instead of 2
unable to create a group with the party - An error message appears "Error while adding participant... not authorized to add this contact"

The first 2 indicators are explained in WhatsApp's FAQ. Of interest is:

We have made this intentionally ambiguous in order to protect your privacy when you block someone. Thus, we cannot tell you if you are being blocked by someone else, since this is a violation of that person's privacy

However, the 3 indicator above (not mentioned by WhatsApp) appears to be a very strong indicator that you've been blocked by the contact.

HTTP Redirection

2013-04-08T19:38:00.000+08:00

According to the HTTP specs, there are a number of HTTP codes used to redirect browser clients.

301 Moved Permanently: Permanent redirect. Document has moved permanently, future requests to use the redirected URL instead. Response is cacheable. Modern browsers change the HTTP method to a GET with the exception of IE (which preserves HTTP HEAD, DELETE method).
302 Found: Temporary redirect. To be superseded by 303 and 307. Response may be cached if headers allow for it. Most modern browsers treat this as 303 with the exception of IE (which treats it as 307).
303 See Other: Request should be redirected to a GET regardless of the original request method. The response must not be cached. Supported by all modern browsers.
307 Temporary Redirect: Temporary redirect. Request should be redirected to the redirected URL. The original request method is to be preserved and a POST request should be re-posted. Response may be cached if headers allow for it. Supported by all modern browsers except Opera 11.5. If the request method is non-idempotent (e.g. POST, PUT, DELETE), Firefox and Opera would prompt the user for confirmation that the form data would be resent to another location.

Tests on existing browser found here.

Some references: HTTP specs & here

Valid Email Addresses

2013-04-08T19:35:00.000+08:00

A valid email address as of this form: local-part @ domain-part

In particular, the local part is required to be one of the following:

dot-atom
quoted string
a combination of the above. E.g. my.name.is."Johannes Kuah"@example.com

Dot-Atom

A string of ASCII characters excluding the following special characters: whitespace ( ) < > @ , ; : \ " . [ ]

Quoted String

A string of ASCII characters including the above special characters enclosed within normal ASCII quotation marks ("). However, the backslash \ and quotation mark " must also be preceded by a backslash \

References

Performance Counters for .NET

2013-03-11T10:27:00.000+08:00

A little dated by now.

From Windows 2000 Resource Kit:
http://technet.microsoft.com/en-us/library/cc938609.aspx
http://technet.microsoft.com/en-us/library/cc940375.aspx
http://technet.microsoft.com/en-us/library/cc938586.aspx
http://technet.microsoft.com/en-us/library/bb734903.aspx

For .NET
http://www.symantec.com/business/support/index?page=content&id=HOWTO9722

From Windows 2003:
http://technet.microsoft.com/en-us/library/cc779038(WS.10).aspx

Cookie, Security, OWASP

2013-03-05T18:32:00.001+08:00

We just had a Security Assessment for our web applications. Some points of interest follows:

Cookie

XSS security: Where possible, all cookies should be configured to be httpOnly. This is to prevent client-side scripts or applets from accessing the cookie. Incidentally, this is the default for ASP.NET session cookie and cannot be changed via httpCookies element in Web.Config: <httpCookies httpOnlyCookies="true"/>
Prevent MITM from accessing the session: Ensure that the session cookie is delivered over secured HTTP session (TLS). Setting the cookie as secured indicates to the browser that the cookie should only be sent over a secured channel. To configure the httpCookies element: <httpCookies requireSSL="true" />
Note that Forms and Session cookies have slightly different behaviour with Forms cookie being more secured and more configurable.
1. Interestingly, setting requireSSL to true for Forms cookie mandates that the communication channel to the web server be secured whereas Session cookie does not. This scenario applies in cases where the SSL terminates at the load balancers (LB) and the channel between the LB and the web server isn’t secured.
GA sets several persistent cookies by default. The cookies are well examined here. Although the cookies appears to be issued from the same domain (1st party cookie), modifying the httpCookies element (httpOnlyCookies, requireSSL) does not appear to affect GA’s cookies.

IIS Server

IIS is susceptible to HTTP 1.0 attacks whereby a HTTP 1.0 request without the host header would cause IIS to leak the IP address of the host.
This issue has been discussed here.

How to put up Maintenance Page for ASP.NET Web Application in IIS

2013-01-24T20:19:00.001+08:00

Put in a static file named app_offline.htm in the root of the site. Afterwhich, all requests for that site will be served from this file.

Technically, what happens is that the entire application domain will be stopped and unloaded, all without performing an IIS reset.

Note the following caveats:

Any error in the Web.Config may result in the app_offline.htm page not showing up!
The file (app_offline.htm) must be of at least 512 bytes for it to take effect for IE browser. Otherwise, IE would display a “Friendly Error" message by default.
The effect of this file is that the server will serve out a HTTP response bearing this header: HTTP/1.1 503 Service Unavailable

Internet Explorer Compatibility View

2013-01-10T19:12:00.001+08:00

The newer Internet Explorer comes with the F12 Developer Tools wherein you find the Browser Mode and the Document Mode.

Difference between the Browser Mode and the Document Mode

Document Mode is something that the web server can control. By specifying the HTTP header, the HTML meta-tags, or the DocType declaration, the Document Mode changes accordingly. See my earlier article.

However, the Browser Mode cannot be changed by the server.

What really happens when IE Compatibility View is activated?

when IE Compatibility View is activated, the HTTP user-agent header is changed to that of IE7.

The user-agent sent by the browsers follows:

IE Browser Mode	User-Agent
IE10	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)
IE9	Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
IE8	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)
IE7	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1)
IE10 WinPhone	Mozilla/5.0 (compatible; MSIE 10.0; Windows Phone 8.0; Trident/6.0; IEMobile/10.0; ARM; Touch)
IE Compatible View	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0)

Note:

Operating System differences:
1. Windows 8 uses NT 6.2
2. Windows 7 uses NT 6.1
3. Windows Vista uses NT 6.0
Layout Engine differences: regardless of Browser Mode in use,
1. IE 10 browser uses Trident 6.0
2. IE 9 browser uses Trident 5.0
3. IE 8 browser uses Trident 4.0

How to Display/ Load Videos in Browsers

2012-12-28T23:34:00.000+08:00

Here is everything you need to know about videos: http://diveintohtml5.info/video.html

Considerations

In general, these are the considerations when displaying/ rendering videos over the web:

where is the video stored/ hosted? – On premise or in the cloud? Cloud-hosting can be a good option for load distribution if the videos are huge.
what is the streaming/ downloading protocol? – The trend these days appears to be to stream videos using HTTP rather than specialised (and often expensive) protocols.
who is the target audience and what browser/ platform are they using to view these videos?
- what browser? – Chrome, IE, Firefox, Opera?
- which version(s)? – still required to support IE6?
- what operating systems/ environment? – do we have Unix/ Mac users?
- need to support desktop/ tablet/ mobile? – some or all of these?

The challenge for the 3rd consideration is to be able to accommodate everyone (from IE6 on a desktop to the iPad safari browser). To do this, a number of “tricks” need to be employed:

Since Adobe Flash penetration is deep, embed a Flash Video Player (think HTML4):
1. For both commercial/ personal use, try FlowPlayer based on GPLv3.
2. Flash version from 9.0.115 allows playing MP4 files on top of SWF
HTML5-capable browsers should not be deprived their native/ optimised capabilities
Firefox only plays Ogg or WebM (FF4+) for HTML5All these “tricks” are well-documented here.

Embedding a YouTube Video

If you are embedding a YouTube-hosted video, the best is to use an iframe. Using an iframe allows YouTube to determine the best viewing experience based on the client browser’s capabilities.
There are a number of parameters to configure for the optimum experience. To embed the iframe, all that is required is to determine the #width#, #height# and #videoID# of the YouTube video.
The HTML code follows:



   1: <iframe id="youtubeplayer" type="text/html" 
   2:  width="#width#" height="#height#" frameborder="0"
   3:  src="http://www.youtube.com/embed/#videoID#"/>

YouTube allows passing GET parameters to configure the video player. An example of what I may use to append to the URL could be:

?autohide=1&fs=0&loop=0&modestbranding=1&rel=0&showinfo=0&theme=light&autoplay=0.

For a complete description of the parameter, see here.

Embedding a Video Stored in a Web Server

Preparing the Files

Encode at least 2 video file formats: MP4 and OGG. In case you need to fix the MP4 to correctly support streaming, you may need this.
Create a poster image (either JPEG or PNG formats)
Download the excellent Flash-based FlowPlayer.

Preparing the Server

Store the following files on the web server:

MP4 (accessible via #http://somewhere.com/VIDEO.mp4#) and OGG (accessible via #http://somewhere.com/VIDEO.ogg#) Videos
Poster (accessible via #http://somewhere.com/POSTER.png#)
Flash Player files (flowplayer-3.2.15.swf & flowplayer.controls-3.2.14.swf)

Ensure that the correct mime-types for each file-type is configured correctly.

ogg to be served as video/ogg
mp4 to be served as video/mp4

HTTP Streaming

Ideally, the web server should support the HTTP/1.1 “Accept-Range” header to allow HTTP streaming (allows downloading of partial content instead of the entire file all-at-once). To confirm if the web server supports the feature, look for Accept-Ranges: bytes in the HTTP header for a HTTP/1.1 GET or HEAD. If the server returns Accept-Ranges: none, the feature isn’t be supported. To support (random) seeking, disable (gzip) compression for these video files.

The HTML Page

Next, create an HTML page with the following general structure:

Create an HTML5-compatible page
Use HTML5 video tags (video/ source entities)

Load the MP4 file first
Followed by OGG

Fall-back onto embedded Flash Player to play the MP4 file
Fall-back further to allow downloading of both the MP4 and OGG files

An example generated from here:

<!DOCTYPE html><html>

  <head><meta charset="UTF-8" /></head>

  <body>

    <video controls="controls" poster="#http://somewhere.com/POSTER.png#" width="#width#" height="#height#">

      <source src="#http://somewhere.com/VIDEO.mp4#" type="video/mp4" />

      <source src="#http://somewhere.com/VIDEO.ogg#" type="video/ogg" />

      <!-- Fallback onto Flash Player -->

      <object type="application/x-shockwave-flash" data="flowplayer-3.2.15.swf" width="#width#" height="#height#">

        <param name="movie" value="flowplayer-3.2.15.swf" />

        <param name="allowFullScreen" value="true" />

        <param name="wmode" value="transparent" />

        <param name="flashVars" value="config={'playlist':['#http://somewhere.com/POSTER.png#',{'url':'#http://somewhere.com/VIDEO.mp4#','autoPlay':false}]}" />

        <!-- Fallback onto download -->

        <img alt="My Video" src="#http://somewhere.com/VIDEO.png#" width="768" height="432" title="No video playback capabilities, please download the video below" />

      </object>

    </video>

    <p><strong>Download video:</strong>

      <a href="#http://somewhere.com/VIDEO.mp4#">MP4 format</a> |

      <a href="#http://somewhere.com/VIDEO.ogg#">Ogg format</a>

    </p>

  </body>

</html>

2-Way SSL for WCF Web Service Hosted on IIS

2012-12-26T22:34:00.001+08:00

I recently was involved in getting the above to work in our environment. The steps follows:

Ensure that the SSL certificates are correctly signed
Ensure that the SSL certificate chain is present and valid
Install the certificates in the “Current User” account for validation
1. Execute mmc.exe, add “Certificates” snap-in with “My user account”
2. Install the certificate within “Personal” store
3. Verify by using Internet Explorer to retrieve the WSDL from the remote web service
4. If the certificate and chain are correct, Internet Explorer will validate them and report so with “Certificate is OK”
Install the certificates (and the entire chain) in the “Local Computer” account
1. Execute mmc.exe, add “Certificates” snap-in with “Computer account”
2. Install the certificate within “Personal” store
3. Note the thumbprint of the certificate
Configure the WCF web.config to make use of “Client Certificates” by finding the certificate
1. within the “LocalMachine”
2. using the thumbprint (remove the spaces)
Note the IIS application pool name configured to execute requests to the WCF web service (e.g. web service pool)
Find the certificate in mmc for “Local Computer” account, right-click on the certificate to “Manage Private Keys”
In the Permissions Dialog,
1. add the user “IIS AppPool\PoolName” (e.g. IIS App Pool\web service pool)
2. allow the user “Full Control”

Microsoft CRM Main Concepts & Relationships

2012-12-03T22:36:00.001+08:00

I came across MS CRM while searching for a solution for leads management. In the process of trying to appreciate the main concepts and relationships as well as a basic gap analysis against our requirements, I created a set of UML class diagrams to document my understanding.

The following are the main concepts (or entities, according to CRM’s nomenclature):

Main CRM entities
Sales Force entities
Sales Person entities
Activity entities
Teaming entities
Campaign entities

Main CRM entities

Sales Force entities

Sales Person entities

Activity entities

Teaming entities

Campaign entities

Web References

Some useful links for read-up:

HTTP over TLS/ SSL: What is Really Secured?

2012-10-02T20:07:00.001+08:00

HTTP over TLS/ SSL performs encryption of transferred data. However, what is really encrypted and what isn’t?

Part of the TLS/ SSL negotiation will not be secured. Everything else is securely transmitted.

What is in the clear/ can be derived will be the destination hostname or IP address and the port (usually 443)
URLs for GET/ POST/ HEAD request methods are secured
- GET URL parameters, e.g. ?data=12345678&id=123
- POST URL
All HTTP headers are secured. These include:
- Cookies
- Content-type/ content-length
- Cache control
- User-agent
- Accept (-encoding)
HTTP payload is secured. This may be:
- POST parameter
- HTML/ XML data

Does it therefore mean that the GET URL over HTTPS is secured? You decide for yourself….

As the GET URL method information is secured, any sniffer between the source and destination would not be able to “see” the URL parameters.
However, the web browser would track the full GET URL (including the parameters) in the browsing history. As such, anyone having access to the web browser might be able to view the URL.
Similarly, the access logs in the web server would typically store the full GET URL

How to Send an iCal File as an Exchange Appointment

2012-09-01T02:18:00.001+08:00

Creating an iCal is rather straightforward, so is sending out an email with the iCal file attached therein.

What is required in our case is to automate sending out an appointment thru’ MS Exchange in a way that it behaves as though an appointment has been manually sent by someone thru’ Exchange.
This would mean that the appointment has to appear in the Exchange Calendar whether or not the recipient remembers to accept the appointment.
This is not possible with a typical iCal sent as an attachment in an email as the recipient would need to open the iCal file and save it before it appears in the Exchange Calendar (sort of an import function).

Apart from making use of Exchange API, a much simpler solution would be to (still) send the iCal as an attachment in an email but “trick” Exchange into recognising the mail as an Exchange appointment.

Credits to this website for first uncovering the solution.

First and foremost, understand the difference between an Appointment and a Meeting Request. The former doesn’t require inviting attendees while the latter infers inviting some attendees.

While the iCal file is a standard, the attaching email is special in that:

the email subject becomes the name of the event/ appointment (and supersedes the summary of the iCal)
it must not contain any attachment
if the email contains a content body, the body will supersede the description in the iCal
it can only have the view/ part containing the iCal

The email-sending code looks like the following:

  1: MailMessage mm = new MailMessage("<sender>", "<recipient>");
  2:  
  3: mm.Subject = "<The Name of the Appointment>";
  4: mm.Headers.Add("content-class", "urn:content-classes:calendarmessage");
  5:  
  6: AlternateView calPart = new AlternateView("<filepath and name of iCal>", \
  7: 	new ContentType("text/calendar; method=REQUEST; name=\"<iCal filename>\""));
  8:  
  9: calPart.TransferEncoding = TransferEncoding.SevenBit;
 10:  
 11: mm.AlternateViews.Add(calPart);
 12:  
 13: return mm;

In line 7

the name part of the ContentType is strictly not necessary for Exchange but is required for non-Exchange servers to determine the name of the attachment.
the method depends on whether this is an appointment (method=PUBLISH) or meeting request (method=REQUEST) or a meeting cancellation (method=CANCEL)

The attached iCal file looks like the following:

  1: BEGIN:VCALENDAR
  2: PRODID:-//Microsoft Corporation//Outlook MIMEDIR//EN
  3: VERSION:2.0
  4: METHOD:REQUEST
  5: BEGIN:VTIMEZONE
  6: TZID:Singapore Standard Time
  7: BEGIN:STANDARD
  8: DTSTART:16010101T000000
  9: TZOFFSETFROM:+0800
 10: TZOFFSETTO:+0800
 11: END:STANDARD
 12: END:VTIMEZONE
 13: BEGIN:VEVENT
 14: CATEGORIES:<Category>
 15: CLASS:PUBLIC
 16: CREATED:20120831T100824Z
 17: DESCRIPTION:<Content or Agenda of the appointment> \n\n
 18: DTEND;TZID="Singapore Standard Time":20120903T160000
 19: DTSTAMP:20120831T100824Z
 20: DTSTART;TZID="Singapore Standard Time":20120903T140000
 21: PRIORITY:5
 22: SEQUENCE:0
 23: SUMMARY;LANGUAGE=en-us:<Name of the iCal Event>
 24: TRANSP:OPAQUE
 25: UID:<Some unique GUID e.g. 000012345>
 26: BEGIN:VALARM
 27: TRIGGER:-PT15M
 28: ACTION:DISPLAY
 29: DESCRIPTION:Reminder
 30: END:VALARM
 31: END:VEVENT
 32: END:VCALENDAR

Again in line 4, the method depends on the nature of the message (appointment or meeting request).
That is all required for things to work.

Some salient references/ websites are:

Reference for iCal standard here
MSDN on Exchange Server Protocol (esp. X-)
iCal validation services here and here
.NET iCal implementation here

National Do-Not-Call Registry (Singapore)

2012-08-22T16:16:00.001+08:00

Information regarding the proposed National DNC registry can be found here.
The DNC registry allows individuals to opt-out of marketing messages in the forms of ~~email~~, SMS/ MMS, faxes, phone-call.
A message is regarded as a marketing message as long as it is determined that part of the message has a purpose which is marketing in nature as defined.
Messages that are marketing in nature if one of the purposes of the message is:

to offer to supply, advertise or promote goods or services, the suppliers or prospective suppliers of goods and services
to supply, advertise or promote land, interests in land, business or investment opportunities

Poor Man's SSO with Multiple ASP.NET Web Applications

2012-08-10T14:04:00.000+08:00

It is quite straightforward to have (poor man's) single sign-on for multiple ASP.NET web applications without sourcing for an enterprise solution.

Based on the following premise:

assuming the web applications are in the same domain
forms or custom authentication is used for the web application

In order to have things work, a couple of steps are required, namely:

Enable Forms authentication for the relevant web applications, use:
<authentication mode="Forms">
Ensure that the validationKey and decryptionKey settings (under the machineKey element) are not auto-generated but are explicitly coded and shared across the relevant web applications (and web farm, if applicable).
1. For IIS6, you can use this website to generate the keys
2. For IIS7+, you can use IIS Manager to do so.
Customise the name of the cookie (instead of the default .ASPXAUTH) but more importantly, set the cookie path to the default root "/" and the domain to a valid one, use:
<forms name=".PoorMan.SSO" domain="?" path="/" requireSSL="true|false" timeout="30" slidingExpiration="true|false" protection="All" />
To determine if the user is authenticated, use: HttpContext.Current.User.Identity.IsAuthenticated
To determine the identity of the authenticated user, use: HttpContext.Current.User.Identity.Name
To set the Session cookie after the custom authentication is successful, use: FormsAuthentication.RedirectFromLoginPage(username, false);
To log-off the user, use FormsAuthentication.SignOut();
Due to breaking changes in .NET 4.0, for mixed-mode deployment using different CLRs (i.e. CLR 2.0 and CLR 4.0), the machineKey needs to use the same (older) validation algorithm. CLR 2.0 uses HMACSHA1 while CLR 4.0 uses HMACSHA256. Use:
<machineKey validation="SHA1">

Additional resources (often outdated) can be found:

Dealing with Team Member's Performance Issue

2012-07-28T23:36:00.000+08:00

The CRAM model suggests to investigate poor performance in a team member in this top-down order:

Constraints - is the member experiencing certain constraints in his/ her life that limits productivity or effectiveness? For example; married, birth, or death of a close one, debt or addiction issues.
Resources - are there resource issues that prevents productive contribution? E.g. lack of test environment, IDE, tools, software licenses, hardware.
Aptitude - is the team member cut-out for the role? Are there other more suitable roles available?
Motivation - is the team member motivated to perform the role or is he/ she just passing time? Is it time to change the role or the job?

SAN or NAS storage systems… How do they affect my applications?

2012-07-24T00:12:00.000+08:00

Here are some salient difference I gathered:

	SAN	NAS
Connection	FC/ SCSI	Ethernet
Speed	Typically faster (unless over Ethernet like FCoE or iSCSI)	Typically slower
Cost	Typically higher	Typically lower
Intrusiveness	Appears like locally attached storage to OS	Remotely accessible filesystem using protocols like: NFS (Unix)/ CIFS (Windows)/ AFP (iOS) or even HTTP
Can same unit be shared across different servers?	No – every server mount will have its own exclusive blocks	Yes. Concurrent access and locking is handled by the access protocols
Unit of storage	block-level	file-level

Issues with IE9 Compatibility

2012-07-17T18:40:00.000+08:00

The following should help:

Javascript inspector
IE9 Compatibility Cookbook
IE9 Javascript changes
Preparing website for IE9
IE9 document modes and Javascript support
Even Baidu uses DocType to resolve issues!

General Flow for Web Access Management

2012-07-16T09:21:00.001+08:00

Three aspects are typically handled by Web Access Management software:

protect resources
authenticate users
authorise users

The flow is depicted in the following Activity Diagram:

Personal Data Protection Bill

2012-07-11T23:56:00.001+08:00

Some information regarding the proposed Personal Data Protection Bill 2012 (Singapore):

Covers the regulation pertaining to the collection, use, disclosure, transfer & security of personal data.
The PDP Bill consultation paper found here
The proposed PDP Bill found here
The Model Data Protection Code for the Private Sector found here
A subsequent report of the above-mentioned Model Code by the NIAC found here

The PDP bill interprets “personal data” to refer to data, whether true or not, about an individual who can be identified

from that data; or
from that data and other information to which the organisation is likely to have access

The bill does not provide greater clarity to the definition of “personal data” and a prescriptive list of personal data would not be provided. Fortunately, the definition was largely adapted from the Model Code which provided certain implementation & operational guidelines with specific examples.

An excerpt from the Model Code follows:

Persons are identifiable not only by their names but also by their pictures, their telephone numbers, or by some special identification number (e.g. NRIC and Passport numbers), etc..

"Personal data" may include an individual’s:

name, age, weight, height
NRIC/FIN number
medical records
income, purchases and spending habits
race, ethnic origin and colour
blood type, DNA code, fingerprints
marital status and religion
education
home address and phone number

While such data taken separately may not identify a person, a conjunction of a number of such data could be sufficient to identify an individual.

For those who are not legally trained (including myself), this should give some ideas to the type of information that needs to be protected with the proposed bill.

Stages in Competency

2012-07-10T01:56:00.001+08:00

Just read about the 4 stages in competence that applies to learning and measuring competencies in new skills. It’s always good to know where one stands for each competency.

From the lowest to the highest, they are:

Unconscious Incompetence

Individual does not know the required skill/ competence exists, let along the relevance of it.
Individual is incompetence and does not know it
Call this individual ignorant, clueless
To do: Need guidance to identify deficits
“Don’t know what you don’t know”

Conscious Incompetence

Individual recognises deficit in competency/ skill but is not addressing it/ not able to address it
Appreciates the value of the competency/ skill
Call this individual a beginner, a learner
To do: Offer vast sources of learning resources and even training. Also allow for mistakes.
“Know what you don’t know”

Conscious Competence

Individual is able to demonstrate basic competency when required and at will
Takes conscious effort/ concentration to demonstrate competency/ skill
Call this individual an apprentice, a novice
To do: Offer step-by-step guidelines, reminders and directed sources of information
“Know what you know but requires exertion”

Unconscious Competence

The highest cognitive level where the competency/ skill is “second-nature” or automatic to the individual
Competency/ skill can be performed easily due to much practice
Individual may even be able to multi-task where performing the skill
Individual has achieved mastery
Call this individual an expert, a master
To do: Having reached a mastery level, have the individual teach/ impart the competency/ skill
“Mastered what you know”

Browser wars

2012-07-10T00:44:00.001+08:00

Around the world, Chrome appears to have overtaken IE for the desktop recently.

Source: StatCounter Global Stats - Browser Market Share

Singapore is heavily dominated by iOS but Android is catching-up fast!

Source: StatCounter Global Stats - Mobile OS Market Share

Excerpts From “What Can DevOps Learn from Formula 1” Presentation

2012-07-02T22:47:00.001+08:00

Full presentation available here.

A list of salient points follows:

How to define success?

Developers want Agility & Change
Operations want Availability & Stability

F1 car lifecycle

Design –> Develop –> Test –> Deploy –> Support
Support (Operations) need to always provide feedback to Design (Development)
Engineers need to work hand-in-hand with Operations

Success must be measured

F1: Telemetry and monitoring are required to deliver drivers’ results
IT Systems: Performance data collection and analysis as well as performance monitoring are required to deliver success
Monitoring is critical in managing change

Need to constantly monitor and manage impact of change. Need to provide feedback for where the car:

Is fast – where things are done right
Is slow – where to optimise and improve
Failed – where to fix

Three key aspects that impact application performance

Concurrency
Data volume
Resources

Where does one find the real bottlenecks?

Not often in Development – no issues in concurrency, data volume, resource
Less often in QA/ Test – concurrency issues may likely surface, resource issues may occasionally surface
Often in Production – concurrency, data volume and resource issues become evident