Architecture, SOA, BPM, EAI, Cloud

Burn Chart

2012-01-21T09:41:00.000-08:00

In Scrum, Burn chart is used extensively by each stake holder. But if someone looks at the assumptions which are used to draw Burn Chart, utility of it diminishes.

One of the assumptions while drawing Burn Chart is that each Pig is loaded 100%. In real life is this true? I do not think so.

What do you say?

Book Review: Inside Cyber Warfare

2012-01-17T16:39:00.000-08:00

Book Review: Inside Cyber Warfare by Jeffrey Carr: Publisher- O’Reilly: ISBN- 13: 978-0596802158

This is second edition of book. I read book’s first edition and found fascinating. My motivation of reading the book is from software architect perspective. I found the book interesting though information provided in the book is readily available on internet but not at one place.

Jeffrey Carr maps cybercrime, cyber espionage and cyber aggression from state and non-state actors and how they are inter-related.

Book nicely explains complexities of cyber-attack and its implications.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the author. I got this book under Orielly’s book review program.

Further reading: A competing book is Cyber War: The Next Threat to National Security and What to Do About It and Cyber Warfare: Techniques, Tactics and Tools for Security Practitioners

One can get more information about book and related topics from:
1. Book at Amazon: http://www.amazon.com/Inside-Cyber-Warfare-Mapping-Underworld/dp/1449310044
2. Publisher: http://shop.oreilly.com/product/0636920021490.do

Book Review: APIs: A Strategy Guide

2012-01-11T13:09:00.000-08:00

Book Review: APIs: A Strategy Guide by Daniel Jacobson, Greg Brail, and Dan Woods: Publisher- O’Reilly: ISBN- 13: 978-1449308926

This is one of the first books on strategic part of API in software industry. APIs: A Strategy Guide is not for developers or designers but for non-technical folks of Software industry – PMs, Business Development staff, C Level Executives and anyone who is interested in Software marketing and Sales and its management.

Book is written in very lucid manner though in initial chapters same information and facts are repeated but still overall book maintains good flow.

Mix of Authors makes good combination. Provider of API related products and Services - Greg Brail, CTO Apigee , customer - Daniel Jacobson, Director of Engineering Netflix API and Researcher, Speaker, & Entrepreneur - Dan Woods.

Book is consisting of eleven chapters and each chapter takes a dive into API strategy and business. Neither a deep dive nor a shallow one.

Book is certainly a good read and going to be on my book shelf for long time.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I got this book as reviewer from publisher. I do not have any relationship with the author.

Further reading: A complementary book is REST API Design Rulebook by Mark Masse and RESTful Web Services Cookbook: Solutions for Improving Scalability and Simplicity by Subbu Allamaraju.

One can get more information about book and related topics from:

1. Book at Aamazon: http://www.amazon.com/APIs-Strategy-Guide-Daniel-Jacobson/dp/1449308929
2. Apigee: http://apigee.com/
3. Publisher: Orielly: http://shop.oreilly.com/product/0636920021223.do

Feedback and business software

2011-12-22T03:43:00.000-08:00

If we look at business software (custom made or off the shelf), most of them rely of feedback mechanism but feedback mechanism is built into the process which is largely human driven not on the automatic path. This thought makes any process human intensive and resource hungry.
Any process can be represented as

In this system it has been assumed that system is perfect, input received by system are perfect and comply to specifications ( zero tolerance), System is perfect (Zero tolerance) and always work as though of ( not only as designed). But we do not live in utopia.
To accommodate imperfect world, feedback based systems are used.

Feedback systems are basis of control engineering.
Control engineering basic foundation can be summarized as:
1. A system that has no corrective feedback is likely to diverge from the desired output.
2. A system that tries to correct too quickly will likely overrun the mark and oscillate around the desired value.
3. A system that corrects too slowly will take a long time to reach the desired value, if it ever does.
4. A system with delayed corrective feedback will generally oscillate at a frequency related to the delay time.

From system thinking perspective, where cause and effect loop into feedback system, one can think of:

1. Stabilizing Loop: It leads to a balance. The more food I eat, and then the fuller I feel. The fuller I feel then the less food I eat.

2. Reinforcing Loop. This loop continues till some external agent intervenes. The more I think of food then the hungrier I get and the hungrier I get then the more I think of food.

3. Choice: This is not about loop but making a choice. Our machines are not intelligent (sic!) enough to make choice, so human (or living being) are invariably get involved in these type of system. I think about food and make a choice to eat food. Choice may lead to increase or decrease in effect.

4. Choice and Reinforcing Feedback: In some cases choice and reinforcing feedback combine and create an addictive effect. I think about money, I earn more money. I think more about money.

The clouds represent observable (and potentially measurable) quantities. A plain arrow indicates that an increase or decrease of one quantity influences a similar increase or decrease of the other.

If there is a dot on the arrow, then the effect is the opposite—an increase of one influences a decrease of the other.

With all of SOA and BPM why we are not able to deploy Stabilizing and Reinforcing Loop mechanisms in business software?

References:
1. http://www.developerdotstar.com/mag/articles/gray_diagram_of_effects.html
2. Quality Software Management, Vol 1: Systems Thinking by Gerald M. Weinberg
3. The Fifth Discipline: The Art & Practice of The Learning Organization by Peter M. Senge

Top Tech trends of 2012

2011-12-21T15:06:00.000-08:00

1. Android based devices
2. Rise of Java alternative but running on JVM languages
3. HTML5
4. Social networking Analysis
5. Big Data will rise further
6. Touch based computing devices
7. Voice operated devices
8. Spatial gesture sensitive devices
9. Merging of Gaming, Social Media and TV
10. Mobile payment
11. Flexible Screens
12. Walled garden approach for IT solutions in consumer space – Apple (iTune, iOS, ect), Window 8, etc
13. App Internet will rise to new heights

Ref:
1. http://architecture-soa-bpm-eai.blogspot.com/2010/12/predictions-for-next-decade-2011-20.html
2. http://architecture-soa-bpm-eai.blogspot.com/2011/12/prediction-for-remaining-decade-2012.html

Prediction for remaining decade (2012-2020)

2011-12-20T15:06:00.000-08:00

1. Android (and its derivatives) will be omnipresent in embedded, mobile and hand held devices.
2. In laptops/desktops, windows or some flavor of it will be preferred operating system.
3. SAAS and PAAS will prevail for small and big enterprise.
4. IAAS will thrive in enterprise data centers.
5. Fragmentation and Alternatives of Java and Enterprise Java (like Apache harmony, and Spring) will emerge stronger and official java from Oracle will loose its sheen due to lust for its monetization by Oracle.
6. Laptop, mobile and tablet will merge into one.
7. Indian IT workforce will shift from permanent job to contractual jobs like in USA.
8. 3G and 4G (BWA) will bring internet book in India over smart phone and tablets.
9. Developing countries will swept by telecom revelation like India in previous decade.
10. Gamification will engulf almost all experiences especially of social media.
11. Outsoucing will change from India focused to 2I + 1 (2 location in India and one elsewhere)
12. Apple will loose its grip on smart mobile phone market.
13. Application will be pervasive in devices and appliances like phones (mobile and fixed line), TVs, automobiles, refrigerators, disk (CD/DVD/BlueRay) players, and any computing device.
14. Fragmentation of Internet - There will be walls around country or region specific internet
15. Rise of china based technology companies.

Ref: http://architecture-soa-bpm-eai.blogspot.com/2010/12/predictions-for-next-decade-2011-20.html

HiTech Marketing Rant

2011-12-15T17:02:00.000-08:00

Even after more than a decade, “Inside the Tornado” still companies following advice illustrated. Take example of Fusion Middleware by Oracle.

Oracle Fusion Middleware is in middle of Tornado. Oracle Fusion Middleware is Gorilla of current time and replacing TIBCO – Gorilla of past.

No SQL (Big Data) is in initial state, any standard yet to emerge so not in the tornado. Only companies who are very enthusiastic about technology have adopted.

Though, Inside the Tornado very effectively suggest marketing strategy for products/solutions which have migrated from enterprise to consumer segment but it did not cover the solutions whose evolution has happened from C2C or B2C ( Auction, Social Networking, classified advertisements).

Geoffrey A. Moore should write a book where major focus should be eBay, Facebook, Twitter, LinkedIn, Gmail, FourSquare, Gowalla, MySpace, Hi5, Bebo, Amazon, iTune, Orkut, and other similar successful or not so successful phenomena (sic!).

Capacity Planning Playbook for Oracle Fusion Middleware

2011-12-09T12:12:00.000-08:00

Capacity Planning Playbook for Oracle Fusion BPEL PM

Security Gateway Comparision

2011-12-08T15:18:00.000-08:00

Security Gateway Comparision

Book Review: The Future of Looking Back

2011-11-11T13:29:00.000-08:00

Book Review: The Future of Looking Back by Richard Banks: Publisher- Microsoft Press: ISBN- 13: 978-0735658066

The Future of looking back is book which very clearly and concisely take you journey where you learn effects of technology on common people. The book is well written and easy read. Banks creates a world where he takes you slowly and see how transition is happening from physical to virtual, analog to digital.
In the end of each chapter, design challenges are fantastic and provide a quite peek into Bank’s designer brain.
This book is certainly good read.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Future-Looking-Back-Microsoft-Research/dp/0735658064
2. Bank’s Blog: http://www.richard-banks.org

Book Review: Privacy and Big Data

2011-10-19T16:33:00.000-07:00

Book Review: Privacy and Big Data by Terence Craig and Mary E. Ludloff: Publisher- O’Reilly: ISBN- 13: 978-1449305000

Privacy and Bigdata is survey of privacy philosophy and laws in USA and Europe. Book covers privacy debate in very comprehensive way across USA and Europe.

Though book is short but very extensive in its approach and provides links to related material.

It cautions us about free stuff (sic!) on internet for which we trade our personal information and compromise privacy in pieces. With advent of techniques of information aggregation any one with sufficient resources and make profile and …

Book briefly touches Australia and Canada and completely ignores rest of world especially developing counties where privacy has very different meaning in culture as well as in law.

Book is must read for any internet entrepreneur to understand privacy laws in USA and Europe.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book.

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Privacy-Big-Data-Terence-Craig/dp/1449305008
2. Publisher – Oreilly: http://shop.oreilly.com/product/0636920020103.do
3. Authors Blog: http://blog.patternbuilders.com/
4. Federal and Trade commission: http://www.ftc.gov/bcp/menus/consumer/tech/privacy.shtm
5. Wikipedia on Internet Privacy: http://en.wikipedia.org/wiki/Internet_privacy

Book Review: Social Network Analysis for Startups

2011-10-14T12:35:00.000-07:00

Book Review: Social Network Analysis for Startups by Maksim Tsvetovat and Alexander Kouznetsov: Publisher- Oreilly: ISBN- 13: 978-1449306465

One of the hot topics in business is Social Media and its effect on it. This has led to growth in Social Network Analysis.

As the name suggest book Social Network Analysis for Startup deals Social Networks’ Analysis but not for startups but for Beginners. If we take the name thing apart book is excellent introduction of Social Network Analysis in very simple language. Book not only talks theory but also give hands on practice sessions on the concepts using python (to be very precise NetworkX - http://networkx.lanl.gov).

Book consists of seven chapters. Chapter one and two focuses on Basics of Graph theory. Chapter three, four and five talk about metrics in a Social Network. Chapter six discusses how “a thing” goes viral and what the characteristics of phenomena are. Final Chapter talks about volume of data to be dealt with in Analysis of Social Networks. Appendix A is about ethics involved while doing SNA and listing of APIs and software which can help in SNA. Appendix B is about installation of software (Python and more).

Book might have discussed NetworkX more in details to help understand the library in detail. I strongly recommend reading NetworkX documentation along with book.

With all of its flaws, book is fantastic for beginners in field of SNA. This book certainly be on my bookshelf for long time.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book.

Further reading: Few of the competing books are Social Network Analysis: Methods and Applications (http://www.amazon.com/Social-Network-Analysis-Applications-Structural/dp/0521387078), Linked: How Everything Is Connected to Everything Else and What It Means (http://www.amazon.com/Linked-Everything-Connected-Else-Means/dp/0452284392), Networks, Crowds, and Markets: Reasoning About a Highly Connected World (http://www.amazon.com/Networks-Crowds-Markets-Reasoning-Connected/dp/0521195330), Social Network Analysis: A Handbook (http://www.amazon.com/Social-Network-Analysis-John-Scott/dp/0761963391), and many more.

One can get more information about book and related topics from:

1. Book’s facebook page: http://www.facebook.com/pages/Social-Network-Analysis-for-Startups/267625796601385
2. Amazon: http://www.amazon.com/Social-Network-Analysis-Startups-connections/dp/1449306462
3. Publisher -- Oreilly: http://shop.oreilly.com/product/0636920020424.do
4. Author’s Linkedin page: http://www.linkedin.com/in/mtsvetov
5. Author’s company’s site: http://www.deepmile.com/
6. Wikipedia on Social Network Analysis: http://en.wikipedia.org/wiki/Social_network
7. Wikipedia on SNA tools: http://en.wikipedia.org/wiki/Social_network_analysis_software
8. List of SNA tools: http://www.gmw.rug.nl/~huisman/sna/software.html
9. NeworkX:

Database Selection

2011-09-28T12:36:00.000-07:00

Typical API Design Goals

2011-09-16T17:13:00.000-07:00

1. Clear separation in Content and Transaction API
2. Call on URL must be separate for regular site and API site
3. API site must be divided into two – test and prod
4. API site must be clearly demarked - json, rest and soap (myapplication.com/api/json, myapplication.com /api/rest, myapplication.com /api/soap).
5. Throttling/Rate Limiting for API calls must consider following factors
a. Time of call
b. Number of records per call
c. Number of calls per second using a API key (free and well as paid)
d. Hits per method/function
e. Test or prod API site
f. Content and Transaction API
g. IP address
h. Geographic Location
i. Specific Key may have enhanced SLAs/priority
j. Developer or Enterprise Key
k. Class of Enterprise – Platinum, Gold, Silver
l. Class of developer – MahaGuru, Guru, GuruBhai
m. Read or Write Call
6. API vs normal site traffic prioritization
7. API response caching ( not now but as application grow this should be pluggable)
8. Provision of deprecation of API
9. Versioning of API
10. Full backward compatibility
11. SSL/TCL availability for critical data – password, payment, etc
12. The call from client may be synchronous but internally it must go to queue (logical) and the requests must be served as per throttling priority  Example sfdc custom or enterprise WSDL
13. The outward call from myApplication.com must go to queue (logical) and then served synchronously to client (myApplication.com will make synchronous call). Messages remaining in queue will die after certain amount of time. This time is not configurable by API users but by admins of myApplication.com.  Example salesforce outbound message
14. To access API each developer must register and must be given key which identifies him/her.
15. To access user (normal site user – API should supply user credentials in secure fashion – SSL). Usage of OAuth needs to be explored.
16. Developer Key will be deactivated if not used for certain period of time.
17. If certain key tries to break throttling. First give warning, then deactivate for certain period of time and then deactivate permanently. Three Strike rule.
18. Reporting
a. Track overall API performance
b. Track API performance for each operation
c. Track API performance by developer
d. Track API performance by specific developer customers
e. Track API performance by client IP
f. Report on API usage by individual developer
g. Report on API usage by developer group
h. Report on API usage by specific developer customers
i. Ability to generate reports in multiple (i.e., CSV, PDF and HMTL) formats
j. Ability to integrate with an existing enterprise reporting system
k. API throughput report
l. API routing failure report
m. API utilization report
n. API availability report
o. API usage report
p. API availability report
q. API methods report
r. API response times report
s. API backend latency report
19. Billing & Metering and API integration
a. Support for Developers account
b. Support for Developers’ customers
c. Ability to bill specific API feature/function

How to achieve Business Goals

2011-09-15T17:11:00.000-07:00

1. Prepare API strategy which cater to developers in comprehensive fashion
a. Open API
b. Separation of Content & Transaction API
c. Major part of API should be free
d. Thorough but easy and efficient developer registration process
e. Developers should be able to showcase their work
f. Developer should be able to discuss and share issues/challenges (forum)
g. Comprehensive documentation (developers manual) – pdf book as well as Wiki
h. Over the time period 3rd party developers should be major contributor to API management.
i. Some mechanism like Java Bug Parade
j. Involve developers in documentation translation
k. Distribute small projects – tool specific like – SOAP UI, Sahi, etc
2. API must be marketed at/via
a. Company microsite at facebook, linkedin, twitter
b. API documentation – manual & presentations must be available at webapplication/platform, document repositories – scribd, slideshare, desi forums, etc
c. Sample applications must be available at mobile application development sites – android, iPhone, iPad, HTML5, etc
d. Sample application must be available at Webservices sites – java, c#, scala, .net, php, etc
e. API details must be available at programmableweb.com and other similar sites
f. Conduct competition for innovative, most traffic generated web application
g. Pay application developer if that application develop uses paid API and generate certain amount of traffic over a time period.
3. No differentiation on the basis of end product (developed by 3rd party) licensing regime.
4. Developer portal
a. Discussion forum
b. Documentation
c. Bug Parade
d. Gamification ( Badge, enhanced role in management of API, etc)
e. Facility to showcase developers’ work
f. Enterprise and individual accounts

API Business Goals

2011-09-14T22:04:00.000-07:00

1. Develop mobile applications, MS office plugins etc
2. Spur the 3rd party application development which can drive traffic and hence usage of web application/platform
3. Use it as marketing tool for developers
4. Collect analytic to design future strategy for platform/web application
5. Data collection about developers which can be utilized in future.

Book Review: Codermetrics Analytics for Improving Software Teams

2011-09-12T14:47:00.000-07:00

Book Review: Codermetrics Analytics for Improving Software Teams by Jonathan Alexander: Publisher- O'Reilly: ISBN- 13: 978-1449305154

Codermetrics is the first book which takes the benefit of research and understanding in the area of professional sports and brings into software development.

This book is heavily influenced by Moneyball (http://en.wikipedia.org/wiki/Moneyball) and The Blind Side (http://en.wikipedia.org/wiki/The_Blind_Side:_Evolution_of_a_Game) by Michael Lewis (http://en.wikipedia.org/wiki/Michael_Lewis_%28author%29).

This book is segmented into three parts. Part one: Concepts covers basics of coder related metrics and how and why the affect big picture of software development. Part two: Metrics lists various metrics developed by author for coders/developers and third part Processes explains how system to be developed to measure metrics developed in book.

As the name suggest this book is solely focused on coders/developers but if metrics developed in this book need to be successful then similar metrics need to be developed for other stakeholders of SDLC – like testers, support and maintenance developers, and business analyst.

Book is good attempt in exploring brand new area of software development and bringing in the learning’s from professional sports, it lacks in articulating few of the assumptions made while defining metrics. For example Chapter 4: Skill Metrics assumes that all tasks are of same size. And if tasks are of not same size then several of metrics needs re-definition. Also Chapter 5: Response Metrics has assumed that all software development is product related but reality is far from this.

Book is silent on statistical analysis of metrics. At most book does trend analysis which is very simplistic approach.

Though the ideas articulated by books seems to have very high potential and may get with agile very well but requires deep revision.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: This is the first book on the subject. I am not able find any book on the subject.

One can get more information about book and related topics from:

1. Book’s web presence http://codermetrics.org/
2. Amazon: http://www.amazon.com/Codermetrics-Analytics-Improving-Software-Teams/dp/1449305156/
3. Publisher – O’Reilly http://shop.oreilly.com/product/0636920020134.do
4. Review: http://startier.wordpress.com/2011/08/25/codermetrics/

Book Review: The Art of Managing Professional Services

2011-09-09T10:58:00.000-07:00

Book Review: The Art of Managing Professional Services by Maureen Broderick: Publisher- Prentice Hall: ISBN- 13: 978-0-13-704252-4

It is very difficult to find a good book on Professional services but The Art of managing Professional Services by Maureen Broderick fills that gap very efficiently and effectively.

This book covers diverse facets of professional services in very precise and concise fashion which makes is must read for leaders in Professional Services.

Book beautifully covers practices employed by variety of Professional services and then set best practices. Book is divided into eleven chapters.

1. Professional Services
2. Shared Vision, Values, and Culture
3. People
4. Portfolio
5. Services
6. Finance
7. Positioning
8. Partnership
9. Strategy
10. Structure
11. Style of Leadership

Each chapter focuses on one topic and details on that.

As I always look for improvements, this book also needs few. Book is very much focusing on USA based PS organization which totally ignores rest of world’s reality. Secondly book does not include any big player from software services.

Nevertheless, book presents good over view of PS and certainly it will be in my book shelf.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: A competing book is Managing The Professional Service Firm by David H. Maister at http://www.amazon.com/Managing-Professional-Service-David-Maister/dp/0684834316 and Building Professional Services: The Sirens' Song (Harris Kern's Enterprise Computing Institute Series) by Thomas Lah ,Steve O'Connor, and Mitchel Peterson at http://www.amazon.com/Building-Professional-Services-Enterprise-Computing/dp/0132762102.

One can get more information about book and related topics from:

1. Book’s web presence http://www.theartofmanagingprofessionalservices.com
2. Amazon: http://www.amazon.com/Art-Managing-Professional-Services-Insights/dp/0137042523
3. InformIT: http://www.informit.com/articles/article.aspx?p=1667484

Book Review: Gamification by Design

2011-08-18T11:49:00.000-07:00

Book Review: Gamification by Design: Implementing Game Mechanics in Web and Mobile Apps by Gabe Zichermann and Christopher Cunningham: Publisher- O’Reilly: ISBN- 13: 978-1-4493-9767-8

Gamification is latest buzzword in It industry, particularly in product designing. Gamification by design book attracted me because it talks about the though process of gaming of business applications not of gaming systems.

Gamification is well written and easy to understand. It covers gamification from product design perspective not from developer perspective.

The book consists of eight chapters. Chapter one and two cover foundations and motivation part of gamification. Chapter three, four, and five cover game mechanics and dynamics. Chapter six is full of gamification case studies. Chapter seven talks of some coding about gamification and lastly chapter eight is tutorial on gamification.

Though book present the gamification in very lucid manner but nothing is perfect. It might have better if chapter seven has covered the logic of coding in terms of flow charts.

Nevertheless, book is excellent read and must be on my shelf for long time.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: Following books gives further insigh into gamification:
1. Game-Based Marketing: Inspire Customer Loyalty Through Rewards, Challenges, and Contests (http://www.amazon.com/Game-Based-Marketing-Customer-Challenges-Contests/dp/0470562234)
2. Total Engagement: Using Games and Virtual Worlds to Change the Way People Work and Businesses Compete (http://www.amazon.com/Total-Engagement-Virtual-Businesses-Compete/dp/142214657X)
3. Game On: Energize Your Business with Social Media Games (http://www.amazon.com/Game-Energize-Business-Social-Media/dp/0470936266)
4. Gamestorming: A Playbook for Innovators, Rulebreakers, and Changemakers (http://www.amazon.com/Gamestorming-Playbook-Innovators-Rulebreakers-Changemakers/dp/0596804172)

One can get more information about book and related topics from:

1. Book’s web presence http://gamificationu.com
2. Amazon: http://www.amazon.com/Gamification-Design-Implementing-Mechanics-Mobile/dp/1449397670
3. Publisher – O’reilly http://oreilly.com/catalog/0636920014614
4. Author’s blog: http://gamification.co/
5. Review: http://www.rojotek.com/blog/2011/05/03/gamification-by-design-by-gabe-zichermann-and-christopher-cunningham/

Book Review: Securing the Cloud: Cloud Computer Security Techniques and Tactics

2011-08-11T16:11:00.000-07:00

Book Review: Securing the Cloud: Cloud Computer Security
Techniques and Tactics by Vic (J.R.) Winkler: Publisher- Syngress: ISBN- 13: 978-1-59749-592-9

Securing the Cloud ion one more me too book on cloud computing. It is heavy on theory but light on practical. It covers cloud from beginners perspective and more interested in making checklist.

The book is divided into the following 10 chapters:

1. Introduction to Cloud Computing and Security
2. Cloud Computing Architecture
3. Security Concerns, Risk Issues, and Legal Aspects
4. Securing the Cloud: Architecture
5. Securing the Cloud: Data Security
6. Securing the Cloud: Key Strategies and Best Practices
7. Security Criteria: Building an Internal Cloud
8. Security Criteria: Selecting an External Cloud Provider
9. Evaluating Cloud Security: An Information Security Framework
10. Operating a Cloud

I do not find anything interesting in this book.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: Few of the competing book are Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance (http://www.amazon.com/Cloud-Security-Privacy-Enterprise-Perspective/dp/0596802765), Cloud Computing Explained: Implementation Handbook for Enterprises (http://www.amazon.com/Cloud-Computing-Explained-Implementation-Enterprises/dp/0956355609), and many more.

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Securing-Cloud-Computer-Security-Techniques/dp/1597495921
2. Review: http://www.hostreview.com/news/110531-research-and-markets-securing-the-cloud-cloud-computer-security-techniques-and-tactics
3. Itroduction: http://www.channelprosmb.com/article/24318/Cloud-Computing-Key-Security-Concerns-in-Cloud-Computing/

Single point of failure: Partial Remedies

2011-08-10T17:14:00.000-07:00

This post is in continuation of earlier blog. Here I have listed few of strategies and techniques which can be utilized to minimize the impact of single point of failures:

SSO: Application users (for example users used for integration) should not pass through SSO mechanism.
MDM: Employ distributed and segregated MDM on the basis of business objects. It means Customer Master and Partner Master should be running on two different MDMs.
Use separate servers to preserve audit, log and error data. These servers must be separate from business servers. This technique is pretty good while employing in Integration (EAI and B2B) and BPM.

Reference: http://architecture-soa-bpm-eai.blogspot.com/2011/07/single-point-of-failure-in-enterprise.html

Limitations of Relational Database Systems

2011-08-09T17:13:00.000-07:00

Relational databases are based on relational algebra, which requires data to be stored must be modeled as relational only. This also means that, data read from RDBMS modeled back in its original model (say tree, graph, key value, or any other). This requires significant stress on computing resources.
Columns of tables can only store similar data.
Document storage (images, multimedia, business documents, XML, etc) is big sore point for RDBMS
RDBMS is not real time system. It is poll based.

Software Architecture Metrics

2011-08-08T17:11:00.000-07:00

Software Architecture Metrics

Mind Map: Security Guidance for Critical Areas of Focus in Cloud Computing V2.1

2011-08-04T18:54:00.000-07:00

Information Lifecycle for Data Security in Cloud

2011-08-03T18:37:00.000-07:00

Security Guidance for Critical Areas of Focus in Cloud Computing V2.1, Chapter on Information Lifecycle Management assumes very simplistic view on Data Security Lifecycle.

This view hides subtle lifecycle stages. Typically, Information follows following lifecycle:

In my view CSA should revise ILM and so the recommendations.

IT involvement

2011-08-02T23:22:00.000-07:00

Book Review: Virtualization: A Manager’s Guide

2011-07-25T12:18:00.000-07:00

Book Review: Virtualization: A Manager’s Guide by Dan Kusnetzky: Publisher- O'Reilly: ISBN- 13: 978-1449306458

First I am thankful of O’Reilly of providing me free copy of book before publication.

As title of book suggests, this book is not for techie. This thoughts is further reinforced by intended audience section of book.

Virtualization: A Manager’s Guide is pretty short and very lucid and easy read. Book covers virtualization model developed by author ( or his company) which seems to be pretty good.

The definition of virtualization given by book “Virtualization can create the artificial view that many computers are a single computing resource or that a single machine is really many individual computers” is very correct as most of the definition ignore the many computer part.

I am not going to keep this book in not bookshelf as this lacks technical rigor but certainly it is useful for someone who is not very technical but faces technical staff.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Virtualization-Managers-Guide-Dan-Kusnetzky/dp/1449306454
2. Publisher -- http://oreilly.com/catalog/0636920020417
3. Review: http://smoothtommy.wordpress.com/2011/07/05/book-review-virtualization-a-managers-guide/
4. One more review: http://santoshonsoftware.blogspot.com/2011/07/book-review-virtualization-managers.html
5. Third Review: http://mohamedazar.wordpress.com/2011/06/25/virtualization-a-managers-guide/
6. Dan Kusnetzky: http://www.kusnetzky.net/

Book Review: Art of Application Performance Testing

2011-07-22T23:03:00.000-07:00

Book Review: Art of Application Performance Testing by Ian Molyneaux : Publisher- O'Reilly: ISBN- 13: 978-0596520663

This is the first book, I have read on performance testing after long years of development.

Book is straight forward and is fast read. Book covers lot but just touches the surface. This book is good to know basic concepts of Performance Testing but as person will be reading more and practicing more this book will be of little use.

Certainly this book is just stepping stone for any aspiring Load and Performance tester.

Book does not focus on any platform or tool.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: Software Performance and Scalability: A Quantitative Approach (http://www.amazon.com/Software-Performance-Scalability-Quantitative-Engineering/dp/0470462531) and Performance Testing Guidance for Web Applications (http://www.amazon.com/Performance-Testing-Guidance-Web-Applications/dp/0735625700) are two books which might be interesting to you.

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Art-Application-Performance-Testing-Programmers/dp/0596520662
2. Publisher -- Oreilly http://oreilly.com/catalog/9780596520670
3. Review: http://artur.ejsmont.org/blog/content/review-the-art-of-application-performance-testing
4. Second review: http://antognini.ch/2010/01/the-art-of-application-performance-testing/
5. Third review: http://matt.eifelle.com/2009/07/14/book-review-the-art-of-application-performance-testing-help-for-programmers-and-quality-assurance/
6. Webinar by author: http://uktmf.com/index.php?q=node/553

Single Point of Failure in Enterprise Computing

2011-07-20T21:37:00.000-07:00

With SOA as central body of thinking, lots of enterprises are adopting:

Centralized Authentication system ( more fancy name is Single Sign On – SS0)
Master data management – MDM
Queuing services – generally JMS
Enterprise Service Bus – ESB
Integration utilizing Hub and Spoke system
Business Process Management (BPM) Engine

If you look very carefully in all of these systems has one underlying philosophy – Centralized logic and control. These component with fault tolerant and clustered deployment get benefits of distributive computing but still hardware is still co-located.

Does this mindset bring single point of failure in enterprise computing?

My take is: YES. How to minimize this – wait for future posts.

NO SQL = Not Only SQL

2011-07-16T10:55:00.000-07:00

No SQL

Non Functional Requirements of Integration Projects (EAI and B2B)

2011-07-15T21:15:00.000-07:00

No Data loss in any case. Data should be recoverable in integration layer.
Recovery should be automatic in majority of the cases in case of integration layer failure.
Replay of messages must be possible in all case of failure.
End systems to be integrated, should be decoupled in time, space and semantic.
Contingency path/scenarios (if deployment fails or integration is need to be rolled back after successful run in production after a while) must be defined and rehearsed.
There must be clear separation between Integration and Services.
Underlying integration service failure (like audit, logging, notification, error handling, etc) must not affect integration as well as enterprise services.
Audit, error notification, error repository should be deployed on separate servers/infrastructure from business services and integration.

Forecast, Foresight and RoI

2011-07-14T10:52:00.000-07:00

Whenever technical person take a business proposition to business owners in any typical business, the first question asked is “What is RoI?”
Is this question correct? Before reaching to answer let us consider few scenarios.

Scenario 1: Foo Inc has its HRMS developed in house. With growth in number of employees and globalization of business, current HRMS is not able to keep pace and requires frequent tweaks and hacks to do the job. This is leading to broken HRMS and potential disruption of services and day by day increasing cost while maintain the system. The proposals to change current HRMS by some contemporary HRMS – Self hosted or SaaS are in wild.

Scenario 2: Bar Corp is in groceries retail business and has stores across countries. Its PoS (Point of sales) system is working great and designed and developed in late eighties. The programming languge used is Basic C. Even today (2011), system is working fine for current needs. Bar Corp management has foresight for market in China, which has entirely different legal system, language requirements. Should Bar shift to contemporary technology?

Scenario 3: We are in 1990. QUX LLC is in investment banking. Its computer systems are rock solid and rely heavily on Mainframe. New technology and paradigm are emerging. Java on UNIX and distributive technology is seen as next game changer. Internet is seen as bright star on horizon. Should QUX LLC start evaluating Internet, Java and UNIX?

In the three scenarios built above will ROI justify the investment? In case of Foo Inc ROI certainly a justification but apart from ROI addition decision criteria comes into picture: Should employee data be on cloud or internal? In case of Bar Corp, lot of speculation and unpredictability comes into picture. Certainly RoI is the decision criteria here. For QUX LLC do I have to argue?

The picture is very clear, when ever forecasting is involved, ROI argument hold good but for foresight ROI is the criteria.

Book Review: Seven Languages in Seven Weeks: A Pragmatic Guide to Learning Programming Languages

2011-07-13T13:30:00.000-07:00

Seven Languages in Seven Weeks: A Pragmatic Guide to Learning Programming Languages by Bruce A. Tate: Pragmatic Bookshelf: ISBN- 13: 978-1934356593

Why I read this book! Because book’s title is interesting. Book covers language spanning from object orientated, prototype, and functional and since ancient time of modern programming. Certainly book does not teach you 7 languages but gives you flavor of each. After tasting you can decide which one is suitable for your dinner.

Very nicely book cover seven languages though there will be conflicting views on selection of languages. Book introduces philosophies of these languages ( Prolog, Io, Ruby, Scala, Haskell, Erlang, and Clojure), basic syntax and main constructs. Book very carefully avoids unnecessary details like how to install, IDE, etc which can be found online very easily.

The last chapter “Wrap-up” serves you cocktail with distinct hint for each.

Certainly I am looking for more of these type of books covering various components of software – Operating system, IDE, etc.

Seven Languages in Seven Weeks will certainly be on my bookshelf for quick reference.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: One can get more information about book and related topics from:

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Seven-Languages-Weeks-Programming-Programmers/dp/193435659X
2. Review: http://slightlymore.co.uk/7-languages-in-7-weeks/
3. Dr Dobb Review: http://drdobbs.com/blogs/tools/228700160
4. One more review: http://iprug.org/book-review-seven-languages-in-seven-weeks
5. The bulky review: http://javaheap.wordpress.com/2011/03/13/review-7-languages-in-7-weeks
6. One more: http://blog.founddrama.net/2011/05/on-seven-languages-in-seven-weeks/
7. The second last: http://fiveholiday55.blogspot.com/2011/05/my-review-of-seven-languages-seven.html
8. The last review: http://www.nofluffjuststuff.com/blog/matt_stine/2010/05/first_thoughts_on_seven_languages_in_seven_weeks_

Security threats posed by public cloud computing

2011-07-12T17:43:00.000-07:00

Criminal Use of Cloud Computing: The ease of the registration process for services opens up services to abuse by spammers, malicious code authors, and other criminal elements.
Solution: Strengthen verification process of the registration.

Insecure Application Programming Interfaces: Cloud computing services management and interaction interfaces have very coarse authorization which opens up security hole.
Solution: More granular authorization and multifactor authentication process.

Malevolent Insiders: The threat posed by a malevolent insider is not unique to cloud computing. However, the threat is inflated by the convergence of IT services and customers under a single cloud environment, economic scale and a lack of visibility into the hiring standards and practices of cloud employees.
Solution: Enforce strict supply chain management security and comprehensive background check of cloud employees. Also setting up legal framework to tackle such malicious scenarios.

Shared Technology Vulnerabilities: Cloud computing delivers services by sharing infrastructure. This opens up the entire system to security breaches.
Solution: Defense-in-depth strategy that includes computer, storage, and network security enforcement and monitoring

Data Loss/Leakage: The enhanced risk of destruction or loss of data, whether accidental or intentional, due to increased number of actors and interactions.
Solution: Encrypt data in transit and implement strong data backup and retention strategies. Granular authorization strategy.

Service Disruption: Due to large number of customers on cloud, service disruption or reduced QoS may enhance impact to manifold.
Solution: In-depth replication of infrastructure across location.

Account, Service, and Traffic Hijacking: Account, service, and traffic hijacking, such as phishing, fraud, and exploitation of software vulnerabilities, pose risks to any computer system. With cloud these risks increases due to large number of interactions and actors.
Solution: use strong authentication techniques and unauthorized activity monitoring. Granular Authorization.

Unknown Risk Profile: Due to outsourcing nature of public clouds risk of losing track of the security ramifications of cloud deployments are very true. Security by obscurity may be low effort, but it can result in unknown exposures.
Solution: Maintain detailed information about who is sharing the cloud infrastructure, as well as network intrusion logs, redirection attempts, and other security logs. Deeper engagement with cloud computing provider.

Reference:

Characteristics of a Good API

2011-07-11T12:56:00.000-07:00

Easy to learn
Easy to use, even without documentation
Hard to misuse
Easy to read and maintain code that uses it
Sufficiently powerful to satisfy requirements
Easy to extend
Appropriate to audience

Benefits of API Driven Design

2011-07-10T12:55:00.000-07:00

Saves development time in medium to long term
Reduces errors and debugging time.
Facilitates modular design.
Provides a consistent development platform.

Why a Good API is difficult to Design

2011-07-09T12:53:00.000-07:00

Forces designer to anticipate future usage of code.
Requirements are incomplete (may never be complete).
Requires abstraction.
Requires modularization of functional as well as non functional requirements
Requires in-depth skills in programming and design.
Loads initial investment in terms of money, time and intellect.

Software without API Design

2011-07-08T12:53:00.000-07:00

+ves

Fast and easy to implement in small projects
Can serve as a starting point for API design. Agile!
No need to consider how code interfaces with other softwares.
Relaxed resource requirement in terms of intellect
Immediate results

-ves

Code has a limited (as opposed to general) functionality.
Code might not be reusable.
Code is evolution will be difficult so the functionality.

SaaS Integration Challenges

2011-07-07T14:37:00.000-07:00

1. Security

Authentication

Data Encryption

2. Volume of data transfer

Continual Basis (Real time)
Traffic Bust
Batch Mode

3. Error and Exception Handling
4. Contingency
5. Data Migration
6. Turnaround Time
7. Cost proposition
8. Support Organization

Choreography in Business Systems

2011-06-23T16:36:00.000-07:00

Most of the current computer systems (from software perspective) work on two core principles:

Deterministic Model
Centralized control
Feedback system
Optimization at component/Sub System Level
Evolution Proof

Deterministic systems hate uncertainty. In most of the cases logic boundaries are predefined.

Today’s most of business systems are built around centralized control where one piece of code directs others to act in particular fashion. In this scheme essentially all logic is confined at one place, interacting parties are just slave without brain. This approach keeps system simple on overall basis.

Most of the business systems do not use feedback system (If they use, they go for periodic feedback not on continuous basis). More over today’s feedback systems assume that there is one correct way, if deviation occur feedback will try to correct the system. Essentially designer of system assumed a perfect correct position. System cannot go beyond that level of correctness.

We simply assume that if individual components are optimized then system will be optimized. This thought does not leave any room for redundancy, fail over in the system. We like to make system as lean as possible to achieve high performance.

Though we understand concept of evolution but in today’s computer system, evolution is creator driven.

All of the five points mentioned above make today’s computer system not fit for Choreography. Choreography requires flexibility
All the five points above mentioned make computer system rigid, high performing and evolution proof. For choreography systems should be based on Probabilistic Model, distributive control to contain error/exception conditions, evolving feedback system which is based on increasing correctness, system level optimization and open to evolution.
But:

Does business need such systems?
Do we have capability in terms of sustenance of self evolving business processes?
Do we have such high level of computing capability to support such system?

So, do we need Choreography in business systems? Is SOA ready for Choreography?
Reference:

Webservices for eighth grader

2011-06-15T22:31:00.000-07:00

Son: What is web service?

Father: It is a mechanism for computer to computer communication. This communication is independent of make of computer and its operating system. So Windows machine can talk to Apple machine or to Linux machine without any heavy duty translation. Webservice enforces one language across variety of machines. More over this language is readable by humans as well.

Son: Hmm… So which language it enforces?

Father: Let me correct myself. Webservices do not enforce common language but common script. Like Devnagri and Latin are writing systems, scripts to various languages. Devnagri is used to write Hindi, Gujrati, Marathi, and other languages. Latin is for English, German, and French. For Webservices based communication Script is XML and various languages are WSDL, and SOAP. So XML is a system by which one can create new languages.

Son: It is OK. But then how actual communication happens between computers using web services?

Father: Let us make an analogy. You know, how we listen and how sound travels.

Son: Little bit.

Father: No problem. Let us build a scenario. You are asking questions and I am answering them. So you are Client or Customer and I am Provider or Server.

Son: It is easy. One who asks question is Client and one who answers the questions is Server.

Father: Perfect. Let’s move on. We are talking in English. So there is contact between me and you which says that you can ask only in English and I can answer in English. So there is contract between Client and Server. This contract in web services world is defined using WSDL – Web Service Description Language. WSDL also defines what questions a client can ask from Server. Because Sever cannot answer all questions in world, its ability is limited.

Son: It is getting complicated, but still manageable.

Father: Good. Now when I and you are talking we are using air as medium.

Son: Yes, I know it.

Father: In Webservices you can replace air by HTTP. Just think of browser address bar.

Son: Oh! Yes. I see http with your blog address in browser address bar whenever I open browser on your laptop.

Father: You are smart. One more thing, yours and my ears can hear sound if are within certain frequency range. Can you hear sound from dog whistle?

Son: I know humans can hear sound waves which fall between 20 Hz to 20 KHz.

Father: That’s good. You should get good grades in Science.

Son:Thanks .

Father: So, there should be something similar to frequency range. It is SOAP. This is something which defines how information is packed, flowing over air – HTTP.

Son: Cool. It is very straight forward. Script which defines language is equivalent to XML. Contract between client and server is WSDL. Information pack is SOAP

Father: Fantastic. Now you know what Web Services is.

Are we still living in Waterfall era?

2011-06-13T22:17:00.000-07:00

Project Closure Documentation

While going through PMBOK about Project Closure Phase (Project Integration Management --> Close Project and Phase), I realized that output of this phase requires:

1. Final Product, Service, or Result Transition ( very obvious)
2. Organizational Process Assets Update ( again very natural)
       a. Project Files: Documentation resulting from the project’s activities
        b. Project or phase closure documents: Documentations indicating successful or not closure of project
        c. Historical Information: Historical information and lesion learned.

At closure look reveals a glaring gap (especially for software oriented projects), there is no wish list for next iteration. Both Functional and non functional (technical as well) are important. This gets more spot light with agile methodologies.

A close survey of various Software service providers ( USA as well as Indian biggies) reveals same gap in their mandatory and recommended documentation list as well.

Does it reveal that we are still living in Waterfall era?

WSDL Architectural Patterns

2011-06-12T20:43:00.000-07:00

While working with Webservices, we all invariably encounter WSDLs. As Software architect and Designer I have noticed four distinct types of WSDLs.
1. A business entity do various operations

2. A business entity do one operation

3. One operation for various entities

4. Various operations for various business entities

Each pattern has its own pros and cons. Except option 3, all are widely used. Salesforce Enterprise WSDL follows option 2 while Oracle AIA is big fan of option 2. Lots of home grown applications in enterprises uses option 2.

For detailed list of operations in webservice refer: http://architecture-soa-bpm-eai.blogspot.com/2011/02/operations-in-service-interface-v-50.html

Contemporary non function requirements of a Software Product – Part 2

2011-06-10T15:30:00.000-07:00

With feedback of my blog readers and my learnings, I have added few of the # 27 to # 32) non functional requirements.

In any software product one has functional and non-functional requirements. It is always easier (is it so?) to identify and define functional requirements. But not so easy to define non functional. With increasing experience of software development communities, traditional non functional requirements like availability, usability, robustness (http://en.wikipedia.org/wiki/Non-functional_requirement) becoming commodity. But with changing business and technological landscape, new set of non functional requirements are emerging.

1. Open API ( synchronous and/or asynchronous)
a. Remote Object
b. Service (for example)
i. SOAP based Web Service
ii. REST Based Web Service
iii. JSON based web service
2. Multiple Channel Access (for example)
a. Connected Desktop (web browser)
b. Disconnected Desktop
c. Mobile application
d. RSS/Atom
e. WAP
f. Mobile browser
3. 3rd party/partners can build on your platform/product
4. Product as vehicle for 3rd party content
5. User as editor of relevant content
6. Content is made available to user when it is ready (push mechanism or at least reactive alert)
7. User add ancillary data ( like rating, reviews, ranking, link submission, recommendations, etc)
8. Settings/configurations can be exported and imported
9. Allow product to run as slave as well as master while integrating with other applications
10. User as owner of identity
a. Published Privacy policy with some control to end users
b. Authentication and authorization using industry wide acceptable standards ( like OpenID, facebook Id, google ID, Yahoo ID, etc)
11. Variable licensing options (for example)
a. Transaction based
b. Revenue sharing
c. User based
d. Fixed onetime cost
e. Time based
f. Cloud compliant
g. Processor based
h. Virtualization compliant
12. Social Networking features
13. Serving high band width as well as low band width environment
14. Information and data search capability
15. Domain Specific language
16. Framework for customization
17. Support distributive SDLC with multiple out sourcing partners
18. Hardware independence
19. Place for online advertisement ( like google ad)
20. Open to migrate to cloud or to non cloud deployment
21. User Analytics
22. Dash board
a. Users
b. Administrators
c. Maintenance and support staff
23. Hooks to monitoring tools
24. Early release and flexible design & architecture to modify
25. Concepts of Roles and Permissions (Identity Management)
26. Multiple Browser compatibility
27. Reporting Requirements
28. Audit Tracking
29. Multiple level of authorization
30. Certification Requirements
31. Compliance Requirements
32. Automated Unit testing just after deployment

Reference
1. http://en.wikipedia.org/wiki/Non-functional_requirement
2. http://en.wikipedia.org/wiki/List_of_system_quality_attributes
3. http://broadcast.oreilly.com/2010/02/nonfunctional-requirements-how.html
4. http://en.wikipedia.org/wiki/Requirements_analysis
5. http://en.wikipedia.org/wiki/ISO/IEC_9126
6. http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=22749
7. http://architecture-soa-bpm-eai.blogspot.com/2010/10/contemporary-non-function-requirements.html

Software Product Strategy Types

2011-05-24T21:46:00.000-07:00

1. No Strategy
2. Shortsighted: Time duration is very small, some time just next step of No Strategy
3. Tunnel Vision: Narrowly focused
4. Too Broad: Opposite of Tunnel Vision
5. Follow the leader
6. Peripheral Integration: Integrate related and unrelated product lines/platforms to define a new product line/platform
7. Rat Race: Just running for me too products
8. Ahead of Time: Envisioning a product line/platform which is ahead of time in terms of availability of infrastructure, availability of supporting systems, cultural and societal acceptability
Practically in any successful product company a mix of above strategy types remain in practice.

Migration of Applications to Cloud

2011-04-18T16:39:00.000-07:00

To migrate an application to cloud there are 4 possible options:

1. Rehost: Redeploy the application on HaaS (Hardware as a Service) such as Rackspace or IaaS (Infrstructure as a Service) such as EC2 virtual machines.

2. Refactor: Tweak existing application (usually web application) to run on IaaS platform (such as Amazon EC2.

3. Rebuild: Rewrite your application (usually web application) and then port it to cloud (utilize SaaS – Software as a Service such as Force.com, PaaS – Platform as a Service such as Windows Azure). You may also utilize Haas and/or IaaS.

4. Replace: It is clear slate approach. Maximum flexibility is available. One can choose to use SaaS (such as salesforce.com), Paas (Microsoft Azure, Google AppEngine, Force.com), and/or IaaS (such as Amazon EC2).

So which one are you doing?

Varity of Type Definition in a Web Service

2011-04-04T21:04:00.000-07:00

In most of WSDLs of enterprise class one finds very simple definitions of types.

But this approach has one serious flaw, if source like to change (generally add) type system, service has to change. To manage changes at source system, multiple versions of a service crop up in enterprise environment. But the good part of this approach is that one looking at types in WSDL can understand the types easily and least documentation is required for attribute/parameters.

To overcome the changing number of attributes/parameters and containing changes in source and target systems only (not in the system which facilitates exposure of functionality as service – web service) one can follow one of the following approaches:

Approaches 2 and 3 have their own set of challenges. Understanding of types is not intitutive and needs documentation with greater details.

BPM Project Life Cycle

2011-03-09T04:04:00.000-08:00

When not to use Scrum

2011-03-08T02:28:00.000-08:00

1. When team size is big ( more than 10)
2. When deadlines are fixed for fixed features
3. When multi vendor team is involved and especially part of team is not co-located
4. Onsite and offshore teams has inconvenient time differences
5. When pigs do not have decision making authority
6. When Enterprise Integration need to be executed with implementation of Enterprise Information System.
7. Offshore teams consist of fresher (very typical scenarios with IT offshoring companies).
8. Product vision and architecture is not ready.

Book Review: Cloud Security: A Comprehensive Guide to Secure Cloud Computing

2011-03-05T12:34:00.000-08:00

Book Review: Cloud Security: A Comprehensive Guide to Secure Cloud Computing by Ronald L. Krutz & Russell Dean Vines: Publisher- Wiley: ISBN- 13: 978-0470589878

As the name suggests this book covers security aspects related to Cloud. But book fails to add any substantial to the subject. Book is just collection of IT security concepts appended by cloud.

I do not recommend this book.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: Competing book are Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance By Tim Mather http://www.amazon.com/Cloud-Security-Privacy-Enterprise-Perspective/dp/0596802765 and Cloud Application Architectures: Building Applications and Infrastructure in the Cloud by George Reese http://www.amazon.com/Cloud-Application-Architectures-Applications-Infrastructure/dp/0596156367

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Cloud-Security-Comprehensive-Secure-Computing/dp/0470589876/
2. Publisher -- Wiley http://www.wiley.com/WileyCDA/WileyTitle/productCd-0470589876.html

Book Review: The Decision Model: A Business Logic Framework Linking Business and Technology

2011-03-02T09:25:00.000-08:00

Book Review: The Decision Model: A Business Logic Framework Linking Business and Technology by Barbara von Halle’s and Larry Goldberg: Publisher- CRC Press: ISBN- 13: 978-1420082814

The Decision Model – A Business Logic Framework Linking Business and Technology (IT Management) collect scattered knowledge and repackage the same in beautiful package and add some heavy words to it. Book claims to introduce Decision Model to model Business Logic (essentially Business Rules) but it the idea of separation of Business Logic and process is old. Book essentially formalize the idea and add rigor to it.

Book is good read and the most important aspect of book is separation of business process and business logic. The book is very theoretical and good for those who like to understand theoretical aspects of Decision Model. Book does not talk about how to implement separation of Business Process and Business Logic in real business applications.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

One can get more information about book and related topics from:

1. Book’s web presence http://thedecisionmodel.com/
2. Amazon: http://www.amazon.com/Decision-Model-Framework-Technology-Management/dp/1420082817
3. Publisher – CRC Press: http://www.crcpress.com/product/isbn/9781420082814
4. Review: http://realworldsa.blogspot.com/2010/04/decision-model-business-logic-framework.html
5. One more review: http://www.tdan.com/view-special-features/10969

Enterprise Dash Board

2011-03-01T23:12:00.000-08:00

Recently, I was involved with very large enterprise which like to purchase or develop Enterprise Dash Board (essentially Business Activity Monitoring system) which can cater to its growing needs. After surveying the market for various BAM and Dash Boards, none was able to fit into requirements. The dream BAM system was envisioned as:

Challenges of Authorization in a Software System

2011-02-25T22:00:00.000-08:00

While discussing security in a software system, lot of attention is given to Authentication, integrity, availability, authenticity, non-repudiation, and confidentiality. But from this list authorization is missing. For authorization simple RBAC (Role based access control) or its variations are widely used. But RBAC does not account for following major aspects in contemporary enterprise systems:

1. Dynamic nature of business objects – dynamically altering attributes, their meanings, and operations as system evolve and flexible nature of architecture and design (for example systems based on template - http://architecture-soa-bpm-eai.blogspot.com/2009/06/template-based-design-technique-part-1.html, http://architecture-soa-bpm-eai.blogspot.com/2009/07/template-based-design-technique-part-2.html, http://architecture-soa-bpm-eai.blogspot.com/2009/12/template-based-design-technique.html).

2. Adhoc demand of access to business objects by users (humans or machines). For example, in case of delegation.

3. Multi dimensional organizational structure on various parameters (hierarchical, project/matrix based, or process based, geographical expanse, etc). This challenge becomes more complicated with realization that each dimension have its own characteristic such as hierarchical structure is a tree structure, matrix structure is graph, and process based is linear. In real enterprise most probably all organizational structure exist at a given point of time.

4. Negative permissions (not to access or do something). Practically in all of the current models only positive permissions are handled but they are silent over negative permissions.

5. Permissions are given on a business object but if permissions are required over particular instance of object then none of the model is capable of solving this challenge.

Although some attempts have been made to address such complex challenge (for example Capability Based security, Brewer and Nash model, etc). But all of these models cover partial of the challenges stated above.

Does Enterprise need SOA for Integration?

2011-02-18T20:54:00.000-08:00

One of the most overlooked requirement in Enterprise as well Integration Architecture is seamless replacibility of enterprise applications ( custom made, off the shelf, Cloud, Enterprise Information System, etc). For example, enterprise XYZ wish to replace Siebel CRM by Salesforce. To achieve this target, Enterprise IT has to develop customizations on Salesforce and integration harnesses with other EISes.

Certainly, customization of Salesforce need to be developed but can Integration harness development is reduced to minimum. If Integration has followed the SOA in true sprit then YES but if Integration has followed SOA by using just Tools and platform then NOT.

Decision is yours.

Complexities in enterprise IT infrastructure (dev, test, UAT, training, prod etc) landscape

2011-02-17T19:42:00.000-08:00

Non synchronized down time of systems/Applications
Simultaneous development & testing (varying projects) on
Satellite systems/applications
Integration layer/components
Varying number of instances of each system/application (satellite as well as integration layer)
Simultaneous presence of multiple integration platforms as well as their multiple versions
Continual introduction and retirement of system/application in environment
Synchronization of data across environments
Growing/reducing data flow within network
Continual introduction and retirement of B2B partners
Support and maintenance of this cobweb

Numbering System in Message Flow (Communication) Diagrams: Part 1

2011-02-14T20:39:00.000-08:00

In any integration project message flow diagrams are one of the most important artifacts along with mapping sheets (among participating systems and CIM- common information model or EBO -Enterprise Business Object).

In Message Flow Diagrams (or Communication Diagram) flow of information depicted and is depicted in terms of numbers for chronological order. This simple number scheme is only good for very simple systems. In any enterprise class systems or integration scenario information may not flow among participating systems in linear chronological order due to asynchronous communication, multi threading, multi processing, clustering, human intervention, etc.
To handle such common scenarios, I have developed a simple scheme which has worked for me in very complex integration scenarios and while architecting/designing products of varying complexities.

Reference

1. http://en.wikipedia.org/wiki/Communication_diagram
2. http://www.xpdian.com/Thecommunicationdiagram.html
3. http://searchsoftwarequality.techtarget.com/definition/collaboration-diagram
4. http://www.uml-diagram.org/communication-diagrams.html
5. http://www.agilemodeling.com/style/collaborationDiagram.htm
6. http://www.modelgoon.org/?p=231

Random Thoughts on Software Design and Architecture

2011-02-13T13:38:00.000-08:00

While discussing with my fellow architects and designers, I realized some of us are infected by disease of too much analysis and drive for perfection. This excessive analysis and perfectionist behavior lead to complicated software which can be simpler.

I have summarized my thoughts on this topic in few sentences:

Most of the software to be architected and designed for happy path, and exception paths not for the disaster paths. For disasters one should have disaster recovery plan which must be separate from core software. Software design should strive to bypass the disaster not to handle it.
It is also true that there are some mission critical systems which must try to handle disaster up to an extent. Some of the examples of such systems are space craft, missile, aircraft, etc.

Good Enough is Good.

Operations in a Service Interface v 5.0

2011-02-12T13:26:00.001-08:00

Prerequisites of Successful Scrum

2011-02-05T13:54:00.000-08:00

1. Team members are highly or moderately skilled.
2. Team is tightly knit.
3. Information exchange among team members is fast, consistent and free flow.
4. Team is co-located.
5. Business is highly involved with team.
6. Architecture ( Business, Information as well Technical) is well defined.
7. Infrastructure is up and running – Dev, test and UAT environment.
8. Automated build and release.
9. High level of test automation.
10. Team’s dependency on external world is minimum (ideally zero).
11. Participating systems count is minimal.
12. Requirements are stable at higher levels so product backlog has minimum changes.
13. Team members are autonomous to take decision on what user story should be part of sprint/scrum as well as total numbers of scrums/sprint needed to achieve stated goal.

EIS and Integration

2011-02-04T22:23:00.000-08:00

While talking to various business and technical architects, I realized that most of them have very confusing ideas behind usage of any enterprise class systems, EIS (Enterprise Information System) like ERP, CRM, SCM, HRMS etc. For most of the persons each of EIS is specialized for some business function and some time domain. This view may be satisfying for business folks but must not be sufficient for architects.
Any EIS serves few of the basic functions:

1. Focuses on a specific business function and or domain.
2. Managing Business objects life cycle.

In any enterprise which has many EISes to accomplish business objectives, need integration. To keep the essence of EIS intact and not duplicating the data across EIS Integration and Information architects has to be very careful. The information flow (essentially business objects transfer from one EIS to another EIS) must be controlled and business objects which have achieved a certain state (in life cycle) in source EIS should transferred to target EIS.

Operations in a Service Interface v 4.0

2011-02-03T21:43:00.000-08:00

Now the fourth version

Book Review: Cloud Security and Privacy

2011-02-01T13:33:00.000-08:00

Book Review: Cloud Security and Privacy by Tim Mather, Subra Kumaraswamy, and Shahed Latif: Publisher- O'Reilly: ISBN- 13: 978-0596802769

Cloud Security and Privacy by is one of the first book which focuses on security, privacy and Audit need of Cloud Providers as well as consuming enterprises. As rightly stated by authors in Preface book is targeted to business personnel who are concerned with processes and methodologies rather than dirty technical details.

Book covers security aspects – Data and Network in detailed manner in initial chapters and then shifts to Privacy and Audit.

For such a vast subject certainly couples of hundred pages are not sufficient but book is a good and successful attempt in right direction.

In the end of book authors has provided sample/template of SAS 70 and SysTrust Reports. The book also covers Open Security Architecture for Cloud Computing in very short and concise manner.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: A competing book is Cloud Security - A Comprehensive Guide to Secure Cloud Computing by Ronald L. Krutz and Russell Dean Vines http://www.amazon.com/Cloud-Security-Comprehensive-Secure-Computing/dp/0470589876/

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Cloud-Security-Privacy-Enterprise-Perspective/dp/0596802765
2. Publisher – O’Reilly http://oreilly.com/catalog/9780596802776/
3. Book webcast http://www.oreillynet.com/pub/e/1514
4. Book Review http://blogs.securiteam.com/index.php/archives/1400
5. One more review http://www.lockergnome.com/it/2009/09/23/cloud-security-and-privacy/
6. Review: http://www.velocityreviews.com/forums/t727353-review-cloud-security-and-privacy-tim-mather-subra-kumaraswamy-shahed-latif.html
7. Review: http://www.infoworld.com/d/security-central/gartner-seven-cloud-computing-security-risks-853
8. Review: https://www.informit.com/articles/article.aspx?p=1582936

Scrum: Beautiful and Ugly

2011-01-27T22:44:00.000-08:00

Beautiful Scrum: Exists only in theory

Ugly Scrum: Real life Scrum

Exception/Fault and Error Handling and Ontology in SOA

2011-01-23T13:07:00.000-08:00

In any SOA enable environment (Enterprise as well as Product) Exception/ Fault and Error Handling forms one of the major areas during Architecture & Design and Governance (especially Design and Run time).

Before moving forward let us set some definitions:

1. Exception/Fault: These are the business and system conditions which can cause temporary or permanent disruption of instance of service/s. In most of cases this disruption is temporary and with some efforts (run time only though coded at design time) service instance remains alive and keep on serving the clients.

2. Error: These are the life killing system conditions which not only kills a very particular instance of service but may also affect deployment of service. There will not be any run time recovery. The best one can expect is graceful death.
In any SOA enabled environment, typical service interaction can be depicted as:

In this diagram the service under consideration is MyService which is calling right hand side service and being called by right hand side service in some business orchestration.

For Exception/Fault and Error occurrence perspective, exception/fault or error can occur in MyService, or called service or calling service.
For brevity let us call Exception/Fault and Error just Exception. If separation required in Exception/Fault and Error then Exception/Fault and Error will be mentioned explicitly.

As a good exception handling practice any exception occurring in any service should be handled in that service and should be resolved there. If resolution is not possible only then exception should propagated to calling service.

For Ontology perspective, exception can be divided into two broad categories:

1. System
2. Business

And if we go into details of each exception then an exception object (sic!) should have following attributes:

a. Exception Group: most of the applications like to group exception for the resolution and notification perspective.
b. Exception Type: Exception, Error, Warning
c. Internal Exception Code: Code to be used by service internally for logging and identification
d. External Exception Code: Code to be used by calling service
e. Detailed Description of Exception
f. Reporting time for Exception
g. Possible Corrective Action/s
h. Severity
i. Service ID
j. Instance ID: of Service
k. Business Object Name: In some cases/implementations payload and/or stack trace may not contain business object name.
l. Stack trace
m. Payload

The code for exception can follow following nomenclature

How to infuse Security in SDLC

2011-01-22T13:05:00.000-08:00

In most of SDLC methodologies (traditional or agile) security is last thought requirement. But as security cyberspace is swamped by lot of security threats, security requirements need to be infused in SDLC as soon as possible and must be tracked as diligently as any functional requirement.
To infuse security requirements in any piece of software, I generally follow a simple rule. Embed Security requirements as early as possible in SDLC.
I have tried illustrating this thought in following graphic.

I understand this illustration is very simple depiction due to variety of SDLC methodologies followed but something is better than nothing.

Book Review: Beautiful Architecture Leading Thinkers Reveal the Hidden Beauty in Software Design

2011-01-21T06:31:00.000-08:00

Book Review: Beautiful Architecture Leading Thinkers Reveal the Hidden Beauty in Software Design by Diomidis Spinellis , and Georgios Gousios: Publisher- O'Reilly: ISBN- 13: 978-0-596-51798-4
Beautiful Architecture book is loosely coupled collection of articles from industry veterans. Book starts with very basics like what is architecture but then deep dive into more complex and intricacies of software architecture. This book is certainly not for green horns.

The book is to be read in non linear fashion. Read first chapter and then on the need and requirement basis, read the respective chapters. I am not going to that what each chapter does which you can get from Amazon or O’Reilly or other reviewers.

As one of the reviewer at Amazon said “too many cooks” and “half backed”.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Beautiful-Architecture-Leading-Thinkers-Software/dp/059651798X
2. BookMooch: http://bookmooch.com/detail/059651798X
3. Publisher – O’Reilly http://oreilly.com/catalog/9780596517984/
4. Book Review: http://www.spinellis.gr/blog/20090204
5. One more review: http://millionchimpanzees.blogspot.com/2009/03/beautiful-architecture-leading-thinkers.html
6. Last one: http://www.i-programmer.info/bookreviews/10-software-architecture/155-beautiful-architecture-leading-thinkers-reveal-the-hidden-beauty-in-software-design-.html

Book Review: Building Web Reputation System

2011-01-13T07:08:00.000-08:00

Book Review: Building Web Reputation System by F. Randall Farmer and Bryce Glass: Publisher- Oreilly: ISBN- 13: 978-0-596-15979-5

Book is primarily originated from the work of yahoo reputation systems employed across various applications. Book also gives examples from eBay, Digg and other systems but strangely leave reputation systems employed by NetFlix, social media (facebook, orkut, etc) and Microsoft.

In initial chapters book focuses on building a graphical language for reputation system. Authors have not leveraged other dominant graphical languages namely BPMN and UML which make things little bit different and difficult.

The primary audience for book are product designers and up to an extent product evangelists.

Book is divided into three parts. Part one focuses on Reputation Systems definition and developing graphical language. Part two covers some advance aspects of language and examples. Part three divulge into details of some of well known reputation systems. Appendix A is devoted to technical details of reputation system (of course yahoo).

Book is light read but certainly deserve an attentive read and particularly from product designers and who ever involved in product conceptualization.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

One can get more information about book and related topics from:

1. Book’s web presence http://buildingreputation.com
2. Amazon: http://www.amazon.com/Building-Reputation-Systems-Randy-Farmer/dp/059615979X
3. Oreilly: http://oreilly.com/catalog/9780596159801
4. Google Tech Talk: http://www.youtube.com/watch?v=Yn7e0J9m6rE
5. One more review: http://blog.ericgoldman.org/archives/2010/07/book_review_bui.htm

Cloud Criticism

2011-01-07T20:04:00.000-08:00

While whole of IT industry is behind Cloud Computing. But are we paying enough attention to dangers of Cloud Computing! Most probably not. I have tried to list few of the points:

1. Lock in of data in proprietary format.
2. Lock in of business processes in third party systems.
3. Lost control over business data and its presentation (Recent spat between Wikileaks and Tableau).
4. Always on network which is in contradiction of “Eight fallacies of distributed computing”.
5. Very few cloud vendors.

Reference:

1. http://www.dbta.com/Articles/Editorial/Think-About-It/Environmental-Group-Targets-Cloud-Computing-Criticism-Justified3f--66406.aspx
2. http://minutiaeetal.wordpress.com/2008/10/25/three-critiques-of-cloud-computing/
3. http://www.riorevuelto.org/site/index.php?text=view&id_articulo=5418
4. http://www.informationweek.com/cloud-computing/blog/archives/2008/10/cloud_computing_4.html
5. http://www.museumstuff.com/learn/topics/cloud_computing::sub::Criticism_Of_The_Term
6. http://gcn.com/Articles/2009/09/14/Reality-Check-cloud-computing-as-red-herring.aspx
7. http://www.cio.com/article/498795/A_Great_Cloud_Debate_Zittrain_Counters_CIO.com_Criticism_
8. http://www.zdnet.com/blog/service-oriented/cloud-computings-earthly-bonds/1114
9. http://www.webpronews.com/topnews/2008/09/29/open-source-guru-rails-against-cloud-computing-%E2%80%98hype%E2%80%99
10. http://www.infoworld.com/d/cloud-computing/busted-three-myths-cloud-computing-098?page=0,0

Simplicity

2011-01-06T19:24:00.000-08:00

Recently, I was asked to define simple system and hence simplicity. I realized there that defining such simple (sic!) concepts requires lot of intellectual stress and time. Fortunately, I bumped to a small video by George Whitesides at TED ( http://ted.com/talks/george_whitesides_towards_a_science_of_simplicity.html) in which he talks about simplicity. After taken cue from George, I realized that a simple system (or thing or concept) exhibits following characteristics:

1. Predictable/Reliable: System/thing must be highly predictable and reliable to ensure consistency.
2. Cheap in monetary terms: Must be cheap so newer innovations can be build over it
3. Intellectually Relaxed: Things/concept/system must be have large target population
4. High Performance or value/cost: Value delivered and cost incurred ( in terms of money, time and intellectual stress) must be sufficiently low to make it attractive
5. Stackable (Building block): Things must be able to act as building block in a larger and/or complex system.

Virtualization Taxonomy

2011-01-03T07:17:00.000-08:00

Hierarchy of Dashboard

2011-01-02T06:55:00.000-08:00

1. CXO Level
a. High level information
b. Summary of highly complex business processes
c. Summary of high business impact events
d. Optimized for smartphones/tablets
e. Should be able to notify business managers
2. Business Manager Level
a. Department level information
b. Summary and detailed information of processes
c. Summary of high and medium business impact events
d. Notification mechanism built in
3. Line Managers
a. Line level information
b. Business application focused
c. Optimized for workstation
d. Notification mechanism built in
4. Maintenance and Support Staff
a. Focus is on technology
b. Application as well as process centric
c. Notification mechanism to staff
5. Infrastructure Staff
a. Focus is on technology
b. Infrastructure centric
c. Notification mechanism to staff

Operations in a Service Interface v 3.0

2011-01-01T16:09:00.000-08:00

I have listed the operations a service should exposes in my earlier post. I have revised the list. The latest is:

Predictions for the next decade (2011 – 20)

2010-12-31T11:59:00.000-08:00

What questions (non financial) should I ask to a Cloud provide?

2010-12-30T22:32:00.000-08:00

1. Number of years in service?
2. Number of subscribers?
3. Number of users?
4. Min number of users per subscriber?
5. Max number of users per subscriber?
6. Average number of users per subscriber?
7. Geographic spread of subscribers?
8. Mode by which Cloud can be accessed ( Browser, hand held device – mobile phone – which one, etc)
9. Does app has offline client?
10. Browser compatibility
11. List of business processes affected
12. Severity of affect to each business process (just touch, requires change, need complete change)
13. How to integrate with existing business systems – batch/real, synchronous/asynchronous, technology/platform?
14. Do employees need training?
15. Does Cloud affect master data?
16. How to integrate with Single Sign On (SSO)?
17. Does proposed cloud will capture any sensitive information (trade secret, patent, customer data, etc)?
18. What are the bandwidth requirements of proposed Cloud?
19. Does proposed Cloud have SSL support?
20. Does Cloud provider share with you external penetration tests and internal network security audits periodically?
21. Does provider have a documented policy for "hardening" the OS under Web and other servers?
22. Does provider have a documented set of controls to separate data and security information among customer applications?
23. Does provider perform background checks on personnel with administrative access to servers and applications?
24. Does provider has documented process for security alerts from IT partners?
25. What are the procedures for business continuity and disaster recovery?
26. Does provider certify the security of scripts and integration code; documented procedures for installing security patches
27. Does provider offer application- or transaction-based intrusion- detection services?
28. Does provider has documented identity management and help desk procedures?
29. What percentage of security staff has security industry certification?
30. What is the average experience of provider's security staff in information and network security?
31. What is the provider’s operational model: a. Self Hosting b. Co-location c. Managed Hosting d. Cloud Computing?
32. Is the provider's data center N + 1 for power?
33. Provider's Data facility: 1. Tier III 2. Tier IV
34. Is the provider's data center certified SAS 70 Type II or Type 1?
35. How many data centers does the provider have?
36. Which data centers will be used to server the application?
37. Is there a DR plan if a data center becomes unavailable?
38. Does the provider use at least 3 ISPs? Who are they?
39. Can a private connection to my enterprise WAN be provided?
40. Does the provider have network redundancy? How is this achieved?
41. How is network latency mitigated?
42. Can the provider provide location specific SLA's measured by a third party benchmarking service?
43. What are the hardware and software components provided by the provider?
44. Are provider servers dedicated or shared? If shared, by what method?
45. Is infrastructure redundant? If so, how is this accomplished?
46. What is Backup and retention schedule?
47. What monitoring is done as well as the interval, and reports that are available to review?
48. Is there staff 24/7? If not, what hours is staff available?
49. What is the provider's change management, patch management and upgrade policies and procedures?
50. What are the downtime notification policies (i.e. is advance notification given? How much?)?
51. Will a staging server/staging sand box be available for testing prior to production deployment?
52. Does provider has sand box for development?
53. How is security alerts handled? What are the security policies?
54. Do you have clear Service Level Agreements (SLAs) established with the service provider?
55. What kind of System Monitoring provided by the service provider?
56. What kind of help-desk support is available?
57. What are the change management processes available from the service provider?
58. Does the service provider provide you a staging environment to test changes before they are promoted to production?
59. Will the service provider support for full data and rule customization recovery on contract termination?
60. What API’s are exposed by service provider to develop application over cloud?
61. What API’s are exposed by service provider to deploy application over cloud?
62. Does my enterprise need new licensees of app servers/database or any other applications to be deployed over cloud?
63. How much time is needed to set up a proof of concept or trial demo?
64. How can offering being customized?
65. Industry references
66. Historical records of service availability?

Maintenance and Support Technical Handbook- Template

2010-12-29T18:12:00.000-08:00

Maintenance and Support Technical Handbook- Template

Legal Challenges in cloud computing: Software Architect Perspective

2010-12-28T17:45:00.000-08:00

Though Cloud gaining currency across the globe and across the industry. But if one carefully observe, he will find slow adoption of cloud in big enterprises. From a Software Architect perspective one should be aware of the legal challenges while evaluating cloud platforms for a solution.

1. Intellectual Property Rights
a. Is application and data protected under intellectual property rights?
b. If cloud provider gives access to your application, data, log etc to third party then what legal responsibility cloud provider assumes?
2. Trade Secrets
a. How secure are the trade secrets?
b. How far cloud provider can go to protect data, log, etc. in case of court summons and/or quasi legal requests/pressure?
c. How long cloud provider keeps application data and logs even after application is deleted from cloud and/or log deleted from cloud?
3. Privacy
a. What responsibility cloud provider assumes to protect Application Owner’s privacy?
b. What responsibility cloud provider assumes to protect Application users’ privacy?
c. Is there any liability coverage for privacy breach?
d. How behavioral tracking is maintained?
4. Data Centre
a. What legal responsibility does cloud provider assume in case of disaster?
b. What legal responsibility does cloud provider assume in case of hacking?
5. Jurisdiction
a. In case of any legal dispute which law apples – location of application provider, location of end user, location of cloud provider, location of server farm or any other?
b. In case of data breach who will send the notice of data breach – application provider or cloud provider?
c. How trans-border laws will be handled?
d. How do reputational risks covered?
e. How long data will be retained for legal and taxation purpose?
f. What is damage policy (say total dames are capped by amount of fee)?
g. Does the flow of data meet the regulatory requirements of each jurisdiction it flows through?
h. Does the cloud provider provides solutions for de-identifying data for transboarder data flow?
i. Where will the data and processes be stored? Can a commitment be obtained?
j. Are there multiple cloud platforms/parties involved?
k. Can the movement of data be controlled?
l. Should/can the data be encrypted?
6. Service Level Agreement
a. What are the SLA’s for cloud provider?
b. What matrices will be used to measure performance of cloud provider?
c. In case of dishonoring of SLA, what are the penalties and they will be enforced?
7. Licensing
a. Do libraries, components, services, servers, etc used in application creation, deployment, etc have cloud compatible licenses?
b. Do libraries, components, services, servers, etc used in application creation, deployment, etc licenses cover upgrade and maintenance as well?
c. How application’s license is structured for end users?
8. Physical Location of Data and processes
a. What is the location of data?
b. What is the location of processes?
c. Is any point of time, location of data and process be ascertained?
9. E-discovery
a. What are the evidentiary issues when client data is in cloud?
b. What are the SLA’s of e-discovery?
c. Who is responsible for e-discovery?
10. Termination
a. In case of contract termination, how data will be moved from cloud to in agreed upon format?
b. Who is responsible to move data?
c. If cloud provider goes out of business then how termination will be handled?
d. If application provider goes out of business then how termination will be handled – data, intellectual property.
e. Is there any lock in?
11. Change in Terms and conditions
a. How change in terms and conditions to be handled?
b. Does cloud provider change terms and condition by inserting URL?
12. Audit
a. Can application provider do audit of facilities and processes/procedures and how extensive are these audits?
b. Can application provider do audit of logs and how extensive are these audits?
13. Miscellaneous
a. What insurance cover cloud provider has?
b. In case of emergencies how data be accesses and who will be responsible?
c. Use of application provider’s name and logo for publicity by cloud provider?
d. Use of cloud provider’s name and logo for publicity by application provider?
e. How service renewal will be handled?

Cloud Computing Taxonomy

2010-12-20T01:14:00.000-08:00

A Small Step for Service Governance

2010-12-19T11:06:00.000-08:00

While talking about SOA Governance, one visualizes big fat software and tools which costs millions of dollars and a platoon of support staff to “govern” SOA Governance platform.
In my experience, I noticed that small baby steps always more helpful and governance should be embedded in architecture and design. Instead of SOA Governance, I like it to be service governance first.
Recently, talking to one of my counterpart at my client place, I encountered a classic case of mis governance in services space. Once service is created and deployed, its contract ( wsdl in case of web service) is freely available across enterprise which makes unknowns its customer (sic) without any controlling authority. This uncontrolled distribution and usage of contract leads to nightmares and fights when service performance decreases or new version of service need to be releases and older version to be retired.

How to avoid such dogfight!

Simply create a registry (not UDDI) of service and make sure that this registry contains the information that who is calling whom and authentication has to pass through this registry. I understand this suggestion violets purist form of SOA but in this world nothing is perfect.

Convention over Configuration

2010-12-18T11:04:00.000-08:00

Now a days every software using or claiming to use convention over configuration.

Is anybody paying any attention on negatives of this paradigm?

1. To utilize a piece of software which is based on Convention over Configuration paradigm, one requires deep familiarity of software.
2. Refactoring becoming difficult and specifically if at any point of time, need arise to change convention, developers have night mares.
3. Bloated code is very normal because of binding the logic with convention. This pain can be reduced if conventions are made configurable.
4. This paradigm makes software very restrictive in view of “ only one way” of doing the things.

Few of the well known examples of softwares using Convention over Configuration paradigm are:
1. Java Bean
2. XDocLet
3. EJB
4. Spring
5. Hibernate
6. Grails
7. Ruby on Rails
8. Apache Camel
9. Struts
10. Maven
11. Apache Wicket

Reference:
1. http://softwareengineering.vazexqi.com/files/pattern.html
2. http://msdn.microsoft.com/en-us/magazine/dd419655.aspx
3. http://elegantcode.com/2009/11/28/convention-over-configuration/
4. http://en.wikipedia.org/wiki/Convention_over_configuration
5. http://marekblotny.blogspot.com/2009/04/convention-over-configuration.html
6. http://codebetter.com/jeremymiller/2009/01/24/convention-over-configuration-in-msdn-magazine/
7. http://www.javalobby.org/java/forums/t65305.html
8. http://www.sonatype.com/books/mvnref-book/reference/installation-sect-conventionConfiguration.html
9. http://weblogs.asp.net/sfeldman/archive/2009/07/20/convention-over-configuration.aspx

Light Weight

2010-12-16T02:09:00.000-08:00

It has become now fashionable to call any software component, application, library, platform, product, and any other piece of code as light weight. Now every piece of software claim itself as light weight. Just like “Life Time Warranty”.
In reality what does light weight means??

In my point of view term “light weight” is comparative. A piece of software is light weight or not in comparison to its contemporary competitors.
I have listed few of the criteria to tag some piece of software as light weight:

1. Deployment memory foot prints.
2. Runtime memory foot prints.
3. Run time consumption of other resources other than memory.
4. Dependency on other libraries.
5. Need of containers (!)

Operations in a Service Interface v 2.0

2010-12-15T02:09:00.000-08:00

I have listed the operations a service should exposes in my earlier post. I have revised the list. The latest is:

BPMS Types

2010-12-13T20:14:00.000-08:00

While doing assessment for one of my client for BPMS platform/tool set, I divided the BPMS system on the basis of three main features.
1. Human Centric
2. Integration Centric
3. Document Centric

Certainly some of the BPMS platforms/toolsets belong to more than one category but majority of them focuses one aspect or another. This focus is at large determined by vendors’ historical association with that aspect of product.

P2P in Business

2010-12-12T20:07:00.000-08:00

With the rise of Cloud (SaaS, PaaS and IaaS) centralization of business application is taking place which certainly offers its own benefits but also introduces single point of failure and too much control by very few entities. Centralization also asks for non interrupted connectivity which may not be feasible in lot of scenarios.

At the same time increasing interdependency of workers and businesses requires networked individuals and resources. In few of such scenarios networks get created on adhoc basis for short duration of project.
To solve these opposing requirements, P2P networks can be of great help. P2P does not require very centralized systems and divide the data ownership and infrastructure needs among participants.
Keeping this paradigm, I looked into various products and platforms and surprised to find that lot of small and big enterprises are using P2P technology and platforms in their business applications. One Further investigation revealed that the biggest share is cornered by BitTorrent.

1. Aggregator Juice (http://juicereceiver.sourceforge.net/index.php) uses BitTorrent
2. Video Player Miro (http://www.getmiro.com) uses BitTorrent
3. Music Retailer DGM Live (http://www.dgmlive.com) distributes using BitTorrent
4. Music Retailer Sub Pop (http://www.subpop.com) uses BitTorrent for distribution
5. Canadian Broadcasting Corporation (http://www.cbc.ca), Norwegian Broadcasting Corporation (http://www.nrk.no) and VPRO (http://www.vpro.nl) have often distributed their content using BitTorrent.
6. The Amazon Simple Storage Service (S3) is equipped with built-in BitTorrent support.
7. Blizzard Entertainment (http://us.blizzard.com/en-us/) uses BitTorrent (using a proprietary client "Blizzard Downloader") to distribute most content for StarCraft II and World of Warcraft, including the games.
8. Entropia Universe (http://www.entropiauniverse.com/) distributes files through BitTorrent
9. Facebook (http://facebook.com) and Twitter (http://twitter.com) use BitTorrent to distribute updates to servers.
10. CRM Ajatus (http://www.ajatus.info) is built on top of CouchDb
11. Bug Traking system SimpleDefects(http://syncwith.us/) is built using Distributed database Prophet
12. Avvenu (http://www.avvenu.com/) is a Personal File Sharing, Mobile Sharing platform. It is acquird by Nokia.
13. Dekoh (http://dekoh.com) facilitates Personal File Sharing with Web Integration platform
14. ShareDirect (http://www.laplink.com/business_solutions/sharedirect.html) is data synchronization tool by LapLink
15. Pando (http://www.pando.com) by Pando is Publishing, Media Streaming, and file sharing solution
16. StreamerP2P (http://www.streamerp2p.com) is a Broadcasting solution over internet
17. Syncura (http://www.syncura.com) has few products for document sharing and collaboration
18. Digital Media Delivery framework by Velocix (http://www.velocix.com) uses P2P paradigm
19. The Digital Media Exchange (DMX - http://cyber.law.harvard.edu/media/projects/dmx) operated by Harvard Law School
20. Social VPN (http://socialvpn.wordpress.com) is a P2P based VPN platform

Some of the Peer to Peer Initiatives:

1. JXTA (https://jxta.dev.java.net) is P2P Networking initiative by Java
2. P2P-Next (http://www.p2p-next.org) is open source initiative which primarily focuses on digital media.
3. Secure P2P Framework (SePP - http://sourceforge.net/projects/securep2p) focuses on security aspects of P2P. It is developed in java.
4. GNUnet (https://gnunet.org) is one more P2P Framework which focuses on security.
5. AntHill (http://www.cs.unibo.it/projects/anthill) is based on Complex Adaptive System paradigm.
6. MsgConnect (http://www.eldos.com/msgconnect) is proprietary P2P framework offered by Eldos.
7. Brunet (http://boykin.acis.ufl.edu/wiki/index.php/Brunet) is P2P library written in C#

Some of the P2P frameworks for developing business applications:

• Apache CouchDb (http://couchdb.apache.org) is a RESTful object database
• DBE (http://swallow.sourceforge.net) is a Java based P2P container for service oriented architecture
• Prophet (http://syncwith.us) is a P2P-replicated database
• Friend to Friend (F2F - http://ulno.net/f2f) is a Java framework for building P2P business applications using the SIP protocol
• Telepathy Tubes (http://telepathy.freedesktop.org/wiki/Tubes) is a framework to channel application information over instant messaging networks
• BitTottent (http://www.bittorrent.com) is one of the most popular P2P framework to develop enterprise grade applications.

Software Architecture Template

2010-12-10T23:16:00.000-08:00

Software Architecture Document Template v 1.0 Dated Oct 17 2010

Lean - Software Development

2010-12-03T18:14:00.000-08:00

Lean has gained tremendous currency in manufacturing industry. Even in service industry Lean has significant influence. But in software development Lean is still in infancy due to two dominant reasons:

1. High level of manual intervention: Can you imagine coding done by robots at present state of technological sophistication. I understand up to a large extent code is automatically generated but still crucial part is requires human ingenuity.

2. Software engineering is still not a science or engineering but art or at the best craft. There is tremendous debate is going around in industry but still craftsman and artist are winning.

Software development is like Research and Development work where new materials and processes are being invented to fulfill newer needs in better way. Nevertheless, pioneers like to convert art and craft into science and engineering and bring automation into main stream to achieve consistency in quality and reducing the cost of development.
Therefore keeping the spirit of engineering, Lean can be applied in software development. The basic principles of Lean in software development can be transformed.

1. Add Nothing But Value (Eliminate Waste): Think of Agile methodologies in software development. Scrum and User stories are few of the efforts in this direction.

2. Center On The Resources Who Add Value: Since Software Development is labour intensive, value humans and then non human resources like software, hardware and processes.

3. Flow Value From Demand (Decide as late as possible): Work only for those features which are essential for customer now not in future. Think of Just in Time paradigm.

4. Optimize Across Organization: Do ever hear of SOA?

5. Optimize Across Organizations: I hope, you know about Cloud Computing?

6. See the whole: Do not make code as Spaghetti. Follow the principle of Code depth first and the breadth in moderation.

In line with seven wastes of manufacturing, software development also has its own wastes:

1. Overproduction  Extra Features: User stories, Scrums

2. Inventory  Huge amount of investment in work in progress. Think of water fall model. Details of Stories for current iteration

3. Over Processing  Paralysis by Analysis. Follow Test Driven Development, Daily build, write enough code to just pass unit tests. Extra Steps: Co-location, better communication

4. Motion  Finding Information: Figuring out what to do, where to go, and how to do.

5. Defects  Defects Not Caught by Tests: Test driven development. Catch defects in early of SDLC.

6. Waiting  Requirement gatherers are waiting for customers, designers are waiting for requirements, Coders waiting for design, testers waiting for code, and finally customer is waiting for product. Release often and early

7. Transportation Handoffs: Close interaction among developers, designers, testers and certainly with customer. Source code branch merging, email maze.

Reference:
1. http://en.wikipedia.org/wiki/Lean_software_development
2. http://www.leansoftwareinstitute.com/art_ilsd.php
3. Applying Lean to Software Development, an Excerpt from The Art of Software Development by Sara Peyton
4. http://leansoftwareengineering.com/
5. http://poppendieck.blogspot.com/2003/04/lean-software-development.html
6. http://en.wikipedia.org/wiki/Muda_%28Japanese_term%29
7. http://www.leaninnovations.ca/seven_types.html

Myths of Agile

2010-12-02T18:10:00.000-08:00

1. Agile is just Scrum or Extreme Programming
Truth: Agile is not a single methodology. It is a collection of Best Practices.

2. Agile methods are not suitable for large projects
Truth: Agile is not a fixed notion but is a collection of best practices. Use whatever suites in the given conditions. Use judicious use of Depth First and Breadth then.

3. Agile means no documentation
Truth: Working software is more valued than documentation but documentation is required for green horns, partners, customers and lots of others. Teams separated by time, space and discipline require documentation to pass understanding.

4. Agile means no upfront design
Truth: Any software system requires infrastructure. So always think of depth with breadth. Agile values ability to change over plan.

5. Agile is undisciplined
Agile requires disciple of high standard. Each member is responsible of her acts and deliverables.

6. Agile Development is not planned one.
Agile believes in rolling wave planning not in static plan.

7. Agile is not suitable for product development
Agile is for software development not for the product conceptualization. Keep proper check and balances on depth vs breadth of code.

8. Agile is not suitable for fixed bid projects
Lot of service companies are using it for fixed bid project. Agile requires transparency from service provider and customer.

References:
1. http://blog.versionone.com/blog/the-agile-development-blog/0/0/five-myths-of-agile-development-myth-5-agile-development-is-just-another-fad
2. http://www.authorstream.com/Presentation/vickydhiman-67414-common-myths-agile-myth-main-science-technology-ppt-powerpoint/
3. http://www.theappgap.com/exploring-ten-myths-about-agile-development.html
4. http://www.wiziq.com/tutorial/7418-Common-Myths-about-Agile
5. http://www.versionone.com/pdf/AgileMyths_BetterSoftware.pdf
6. http://agileworld.blogspot.com/2008/04/agile-myths.html
7. http://www.projectez.com/Files/special%20report%20-%20myths%20of%20Agile.pdf
8. http://stackoverflow.com/questions/1871110/agile-myths-and-misconceptions
9. http://www.drdobbs.com/architecture-and-design/206501655;jsessionid=BQPXX0LZG1ASLQE1GHPCKH4ATMY32JVN

Book Review: I. M. Wright's Hard Code

2010-12-01T02:19:00.000-08:00

Book Review: I. M. Wright's Hard Code by Eric Brechner: Publisher- Microsoft Press: ISBN- 13: 978-0735624351

I.M Wright’s Hard Code is authored by Eric Brechner, veteran a Microsoft. Though book is published in 2007 but still holds its value in software project management. Book is filled with nuggets of wisdom for any person who is involved in Software project management or influence corporate IT culture.

Author is very straight forward and blunt in delivery of his opinion and belief which makes him distinct in crowd.

Book is collection of short essays which are organized in ten chapters. Book covers almost all aspects of software developments and primarily targets project managers and higher ups in management chain.

Certainly this book will stay in my bookshelf. I highly recommend this book.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: Complementary books to I.M Wright’s Hard Code are Getting Results from Software Development Teams by Dr. Lawrence J. Peters (http://www.amazon.com/Getting-Results-Software-Development-Teams/dp/0735623465), Solid Code by Donis Marshall & John Brono (http://www.amazon.com/Solid-Code-Donis-Marshall/dp/0735625921), Code Complete: A Practical Handbook of Software Construction by Steve McConnell (http://www.amazon.com/Code-Complete-Practical-Handbook-Construction/dp/0735619670)

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Wrights-Hard-Code-Best-Practices/dp/0735624356
2. Author’s Blog: http://blogs.msdn.com/b/eric_brechner/
3. Review: http://mvark.blogspot.com/2008/11/book-review-i-m-wrights-hard-code.html

Complexity breeds Complexity

2010-11-18T23:33:00.000-08:00

One of my teachers used to say, just like success breeds success, complexity breeds complexity.

Computers were introduced in business to handle increased size (in terms of customer reach, volume of market, globalization, voluminous production, etc) and complexity of business (different legal frameworks in different countries, understanding of business with increasing attributes, etc). But with increase in computing power and numerous business applications we have computer systems which are to support computer application and even department (IT department) and whole IT industry. Think about following applications/disciplines which exist to support computerization of business.

1. IT department
2. Identity Management
3. Master Data Management
4. Data ware house
5. Business Intelligence
6. Decision Support System
7. Collaboration Suites ( Email, messaging, Wiki, Document management system)
8. Integration Practice/Suite
9. ETL Suites
10. BPM Suite
11. Versioning System
12. Ticketing Systems
13. Software Licensing Management
14. Intrusion Detection System
15. Enterprise Search

Do you think that my teacher was correct?

What need to be standardized in Cloud Computing?

2010-11-17T17:50:00.000-08:00

1. Federated Identity across cloud and non cloud applications
2. Meta data hierarchy and its exchange mechanism across cloud
3. Data exchange – real time and import/export standards
4. Standards for SLA – machine readable
5. Orchestration and Chorographic standards across cloud to create composite applications
6. Policy and Governance standards
7. Monitoring, billing, auditing, logging, and notification standards
8. Common Data Model across clouds for interfacing cloud resources
9. Privacy standards
10. Global standards (across government bodies and across governments) for data movement and its residency
11. Description of Non Functional requirements (Availability, Scalability, Latency, etc)

Some interesting concepts for Software Architect and Designer

2010-11-15T22:38:00.000-08:00

1. Convention over Configuration (aka Coding by convention)
2. Don't Repeat Yourself (DRY, aka Single Point of Truth)
3. Code Reuse
4. The KISS principle (Keep it Simple, Stupid, aka Keep it Short and Simple)
5. 'You Aren't Gonna Need It' (YAGNI)
6. Reinventing the wheel (aka Not built here or Not Invented Here)
7. Worse is better (aka New Jersey style)
8. Occam's razor or Ockham's razor
9. Make everything as simple as possible, but not simpler.
10. MoSCoW Method (M - MUST have this, S - SHOULD have this if at all possible, C - COULD have this if it does not affect anything else, W - WON'T have this time but WOULD like in the future.
11. No Silver Bullet
12. The principle of good enough (POGE)
13. The Pareto principle (aka 80-20 rule, or the law of the vital few or the principle of factor scarcity)
14. Satisficing (a portmanteau of "satisfy" and "suffice")
15. Rule of three
16. The single choice principle
17. Greedy reductionism
18. The principle of least astonishment (or surprise)
19. N - version programming (NVP)( aka multiversion programming)
20. Separation of concern

Design Consideration for SaaS Application

2010-11-14T16:39:00.000-08:00

1. Asynchronous Logging
2. Asynchronous Auditing
3. Tenant level Logging
4. Tenant level Auditing
5. Tenant Aware Controller
6. Functionality Aware Controller
7. Hierarchy of Meta Data Objects
8. Tenant Aware Data Objects
9. Clear demarcation of data on the basis of where to store – RDBMS, Hierarchical data base – LDAP, File system, NOSQL, etc.
10. Usage of Virtual Database or similar technique
11. Tenant aware load balancer
12. Tenant aware data store
13. Caching to be used at every level – View, controller and data layer and must be tenant aware and policies must be well defined
14. Fault Barrier pattern for Exception Handling
15. Heart beat like mechanism
16. Do not treat business conditions as business exception

Book Review: Against the Gods-The Remarkable Story of Risk

2010-11-13T16:04:00.000-08:00

Book Review: Against the Gods-The Remarkable Story of Risk by Peter L. Bernstein : Publisher- Wiely: ISBN- 13: 978-0471295631

Against the Goods – The Remarkable story of Risk gives historical account of concept of Risk and its development in contemporary economic world. This is primarily addressed to economic and financial professionals but my motive of reading it was to understand Risk in context of Software architecture and project management.

Essentially Game theory and Prospect Theory are very important from Software architecture and its development over the life cycle of any software application. Similarly Game and Prospect theories play important role in Project Management specially in software projects due to volatile employment scenario. Since Software development and management is Human Resource intensive and actors are highly qualified which makes them in demand. This phenomenon must be understood from Game and Prospect Theory.

For any serious software architect and project manager, at least understanding of Game and Prospect Theory is must.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Against-Gods-Remarkable-Story-Risk/dp/0471295639
2. Publisher: http://www.wiley.com/WileyCDA/WileyTitle/productCd-0471295639.html
3. Alibris: http://www.alibris.com/search/books/qwork/165523/used/Against%20the%20Gods%3A%20The%20Remarkable%20Story%20of%20Risk
4. Audio Book: http://www.audiobooksonline.com/0671576461.html
5. Flipkart: http://www.flipkart.com/against-gods-peter-l-bernstein-book-0471295639
6. Business Week Review: http://www.businessweek.com/1996/43/b349881.htm
7. Book Review: http://www.ams.org/notices/199901/rev-zabell.pdf
8. One more review: http://www.bainvestor.com/Against-the-gods-story-risk.html
9. Third Review: http://members.cox.net/kdrum/Againstgods.htm
10. New Review: http://www.bos.frb.org/economic//nerr/rr1997/spring/bkrv97_2.htm
11. Review by Insurance Book Review: http://www.insurancebookreview.com/
12. Last Review: http://www.enteleky.com/ag.html
13. Prospect Theory: http://en.wikipedia.org/wiki/Prospect_theory
14. Prospect Theory: http://www.econport.org/econport/request?page=man_ru_advanced_prospect
15. Game Theory: http://en.wikipedia.org/wiki/Game_theory
16. Game Theory: http://levine.sscnet.ucla.edu/general/whatis.htm

Book Review: Software Piracy Exposed

2010-11-11T16:02:00.000-08:00

Book Review: Software Piracy Exposed by Paul Craig, Mark Burnett: Publisher- Syngress: ISBN- 13: 978-1932266986

Though book is published 2005 but still relevant in present context. Book goes in details of software piracy in detail. It nicely covers social structure of piracy and discusses its impact and reasoning. Book might have covered anti piracy measures in software in little more in detail. But is must for any software professional.

Book is divided in two parts, regular chapters and then Appendix. Appendix summarizes the book and covers social reasoning and impact of piracy.

Book does not cover the effect of piracy on actual sale of software (For example Microsoft and Oracle), multimedia and games.

Nevertheless book is good read and gives insight into Software piracy.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Similar Book: Piracy: The Intellectual Property Wars from Gutenberg to Gates by Adrian Johns (http://www.amazon.com/Piracy-Intellectual-Property-Gutenberg-Gates/dp/0226401189)

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Software-Piracy-Exposed-Paul-Craig/dp/1932266984
2. Publisher: http://www.syngress.com/hacking-and-penetration-testing/Software-Piracy-Exposed/
3. Alibris: http://www.alibris.com/booksearch.detail?invid=9846632240&browse=1&qwork=9181080&qsort=&page=1
4. Book Review: http://taosecurity.blogspot.com/2006/08/review-of-combating-spyware-in.html

Book Review: Oracle Fusion Middleware Patterns

2010-11-10T14:08:00.001-08:00

Book Review: Oracle Fusion Middleware Patterns by Harish Gaur and, Markus Zirn: Publisher- Packt: ISBN- 13: 978-1847198327

Oracle Fusion Middleware pattern book is a collection of case studies for Oracle Fusion Middleware across the globe and across the industry. This book is primarily targeted to planners and high level business decision makers with hints of technical stuff. With respect to target audience, packtpb site indicates for IT manager but, I differ here.

Book can be read online at http://www.oracle.com/technetwork/articles/entarch/index-098853.html.

Book is divided into three groups: Process Improvement, Business Visibility, and Collaboration and Security to club case studies accordingly.

Book is good read for staff members of enterprises who are moving to Oracle Fusion Middleware stack.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

One can get more information about book and related topics from:

1. Book’s web presence http://www.oracle.com/technetwork/articles/entarch/index-098853.html
2. Amazon: http://www.amazon.com/Oracle-Fusion-Middleware-Patterns-Harish/dp/1847198325
3. Publisher -- Packtpb https://www.packtpub.com/enterprise-solution-architecture-patterns-by-oracle-fusion-middleware/book
4. Harish Gaur’s Blog: http://blogs.oracle.com/harishgaur/2010/10/fusion_middleware_patterns.html
5. Surachart Opun’s Review: http://surachartopun.com/2010/09/oracle-fusion-middleware-patterns-book.html
6. Wow Books Review: http://www.wowebook.com/business/oracle-fusion-middleware-patterns.html

Characteristics of a Good API

2010-11-07T17:19:00.000-08:00

• Easy to learn
• Easy to use, even without documentation
• Hard to misuse
• Expose only what is required
• Easy to read and maintain code that uses it
• Sufficiently powerful to satisfy requirements
• Easy to extend
• Appropriate to audience

General Principles

API Should Be As Small As Possible But No Smaller
Implementation Should Not Impact API
Minimize Accessibility of Everything
Names Matter–API is a Little Language
Documentation Matters
Document Religiously
Consider Performance Consequences of API Design Decisions
Effects of API Design Decisions on Performance are Real and Permanent
API Must Coexist Peacefully with Platform

Cloud Promises and Truth

2010-11-05T00:04:00.000-07:00

1.
Promise: Scalability
Truth: Absolutely (Think of Salesforce, EC2, Azure, AppEngine, etc)
2.
Promise: Peak Load Capacity on the fly
Truth: Think of Wimbledon, famous case study of Washington and EC2
3.
Promise: Zero Capex
Truth: Reduced not Zero (Think of appliance needed, integration required, and one time fee)
4.
Promise: Lower Beta and Testing cost
Truth: Yet to prove it
5.
Promise: Geographic Independence
Truth: Depends upon cloud provider. But remember of compliance challenges
6.
Promise: Device and Operating System and Technology platform independence
Truth: Depends upon genre of Cloud ( SaaS, PaaS or IaaS). Consider licensing issues.
7.
Promise: Multi tenancy enhances the utilization
Truth: Theoretically, Yes but Still to prove
8.
Promise: Centralization reduces cost
Truth: Theoretically, Yes but Still to prove
9.
Promise: Consistent Performance
Truth: Mostly. Consider network latency, bandwidth, 8 fallacies of distributed computing (http://blogs.sun.com/jag/resource/Fallacies.html)
10.
Promise: Enhanced Reliability
Truth: Questionable (jus remember EC2, AppEngine, and Salesforce outage)
11.
Promise: Cloud Computing Removes the Need for an Internal IT Department
Truth: Lie
12.
Promise: Applications Can Be Moved without Change to the Cloud
Truth: Not possible as of today
13.
Promise: It Is Easy to Switch Cloud Computing Vendors
Truth: Not possible as of today
14.
Promise: Moving to Cloud Computing Just Requires a Credit Card—It’s Computing as a Utility
Truth: Lie. Think of integration, training and other stuff

Why does enterprise need Data Services?

2010-11-04T09:48:00.000-07:00

1. SOA essentially promotes mushup application, which requires data from various sources in any enterprise application. This paradigm shift in application architecture and design requires reusable services to live with SOA promises.
2. BPM is again collection of mush up application.
3. To promote canonical view of data to increase reusability of services across enterprise.
4. To promote consistent view of data across enterprise.
5. To move towards enterprise wide standards and compliance.
6. To reduce work load on application developers by leveraging data services.
7. To promote enterprise wide vocabulary and consistent semantics.
8. To promote consistent data type irrespective of data source (RDBMS, Hierarchical, NOSQL, etc).
9. To promote consistent quality of data.
10. To promote Master Data Management.

Book Review: Beautiful Visualization

2010-11-03T14:29:00.000-07:00

Book Review: Beautiful Visualization Edited by Julie Steele and Noah Iliinsky: Publisher- O’Reilly: ISBN- 13: 978-1449379865

Beautiful Visualization is beautiful book in itself. It has essays from heavy weights from visualization field. The first chapter “On Beauty” is by editor Noah Iliinsky discusses subtleties of Beauty in the context of Visualization in lucid language. Examples quoted by Noah are excellent – Periodic Table and London Underground.

The last chapter “Visualization: Indexed” encompasses bigger picture of Visualization to help think beyond Blind Men’s Elephant. I think this chapter should be second one.

Rest of the chapters in the book covers, various tools and techniques of visualization from various fields – quantative data to medical imaging. Mostly all contributors of this book has one underlying theme – data visualization techniques are not only for visual representation but also for finding out missing (obvious and non obvious) information or at least indicating that information is missing.

From a software professional perspective, whole of the book may not be useful because of its generalist nature but it gives insight into visualization which I feel software professionals’ lack.

Certainly book is worth its price. I highly recommend book to anybody who is interested in software and visualization.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Further reading: Two complementary books are Information is Beautiful by David McCandless http://www.amazon.com/Information-Beautiful-David-McCandless/dp/0007294662 and The Visual Display of Quantitative Information by Edward R. Tufte http://www.amazon.com/Visual-Display-Quantitative-Information/dp/096139210X

One can get more information about book and related topics from:

1. Amazon: http://www.amazon.com/Beautiful-Visualization-Looking-through-Experts/dp/1449379869
2. Flipkart: http://www.flipkart.com/beautiful-visualization-julie-steele-noah-book-1449379869
3. Publisher – O’Reilly http://oreilly.com/catalog/0636920000617
4. Review at http://informationr.net/ir/reviews/revs378.html
5. Review at iProgrammer: http://www.i-programmer.info/bookreviews/6-graphics/1093-beautiful-visualization.html
6. Review at Dr Dobb’s: http://www.drdobbs.com/blog/archives/2010/07/beautiful_visua.html
7. List of Vizualization tools (2008): http://www.readwriteweb.com/archives/the_best_tools_for_visualization.php
8. Five Best Data Visualization Projects of the Year – 2009: http://flowingdata.com/2009/12/16/5-best-data-visualization-projects-of-the-year-2009/
9. Examples of Data visualization: http://www.webdesignerdepot.com/2009/06/50-great-examples-of-data-visualization/

Architectural Quality and Consistency: Rules Rule

2010-11-01T15:09:00.000-07:00

To maintain architectural quality and consistency at macro (architectural) and micro (implementation) level it is necessary to follow certain rules across the life cycle of any software project and product. From easy enforcement, it is recommended to use automated tool set.

There are three types of rules:

1. Enforced: Must be followed in all cases.
2. Advisable: Should be followed and exception must be documented with reasoning.
3. Guidelines: These are the best practices and recommended to be followed in given context. Exceptions must be documented.

To match with SDLC of any software project, rules are also classified as:

1. Architectural and Design Rules: These rules affect larger part of system and define the resulting product. They form the core of the product.
2. Construction Rules: These rules are applied at micro level, programming aspect of product/application
3. Environmental Rules: These rule define construction environment of product/application
4. Test Rules: These rules affect testing (Quality Control as well as Quality Assurance) at all levels – review of artifacts, unit testing, integration testing, functional testing, user acceptance testing, stress (load) testing, etc.
5. Deployment Rules: These rules affect deployment environment of product/application

For quantitative analysis of architectural quality and consistency, matrices must be identified with respect to each rule. To covey weight of each rule in architectural quality, a weightage should be provided to each metric and the preferable a radar chart should be prepared.

To further enhance the matrices, bugs can be classified as

1. Missing functionality
2. Correctness
a. Absolutely
b. Probably
c. Suggestion
3. Rule Violation
a. Enforced
b. Advisable
c. Guideline
4. Confusing or tricky or non-intuitive

Software Testing and Time machine

2010-10-21T23:20:00.000-07:00

Software Testing and Time Machine