Showing posts with label change. Show all posts
Showing posts with label change. Show all posts

Saturday, November 07, 2015

Wǒ hěn hǎo, xièxie


Some time ago I had a peek into The Other Side and didn't take it any further - but maybe that's because I didn't have a purpose or reason to take it further but I couldn't see a reason to progress, so I didn't. It just came across like a hobbyists environment with a community of snobs driving progress.

Wind the clocks forward another year or more and the landscape is vastly different. I've moved on to learning about network security, information management and have trained myself to think like a black hat (a good defensive strategy). I'm working on some exams that will give me the foundation to absorb that within my work as an architect too and because of the nature of this research I've been working on Linux.

There's some aspects of Windows (e.g. restrictions on packet injection / tampering) which the Linux community seems to lambaste Microsoft for. To me - as a noob at least - it looks like this is by design for commercial reasons. Whatever the reason it just isn't feasible to do a lot of this research on Windows.

So I created VMs through Hyper-V and researched distributions and their capbilities, settling on Debian as my initial preference. It's used as a basis for a number of other flavours including Kali, Raspbian and Ubuntu. KDE is nice and the apt system makes sense to me at this stage.

But then, of course, you start discovering limitations in the virtualised environments leading to one conclusion: You need to deploy to hardware to gain direct interaction with that hardware (and mitigate problems with networking especially). I started beefing up my knowledge of networking stacks and how to analyse network traffic, creating sandbox WiFi networks on my test router and trying to see how to break them / break into them. I found that Kali was a great place to look at this as it contained all the tools and was designed to run OotB so stuck with that on a Pi B+ for a while.

After a while I was using Archimate to design the domains of our house network and started building a HIDS and IDPS, then a DNS server, then spent a bit of cash at ModMyPi getting all the bits I needed. I set up high-grade SSH keys and improved security - I may add a VPN server in the DMZ at some point too. I've got DD-Wrt on the inner router and a custom network set-up which provides additional protection for everyone in the house.

ATX Mid-tower was replaced and needed a new use. Stick a PiRack in there and all the cables.
I suddenly realised I'd become one of the hobbyists I'd turned my nose up years ago. Now our house provides media services so the kids can fire up a film of their choice on any Surface or XBox, iPhone or Windows Phone. We have network protection running in the background emailing me when it detects or fixes a problem. The kids came up with the idea of an underwater camera so they can see the fish even when they hide (yet to be designed and built). None of this involves a Windows server.

Of course I've made significant progress in my learning and research - the next pot of which will be a short study on effective WiFi passwords vs. advice from the pub - but as a by product I've gotten far more technical than I'd expected; you end up finding things to investigate that you'd never considered before and research topics or techniques far from the original purpose.

For example, I've moved my trust away from BitLocker and am testing alternatives, using local accounts for BAU and my Microsoft accounts for connected services (such as OneDrive and XBox). It's not about tin-foil hats, the X-Files or any part of government; it's just a simple case of protecting your assets against criminals or other similar attackers.

I went with Ubuntu because it is Debian-oriented and it seems to have the most support for things that Surface Pro needs. If Debian covered a lot of it I'd have just gone straight there. I don't like the whole Amazon / internet integrations on Unity; the volume buttons don't work; the SP pen buttons don't work; sometimes the left-mouse / pen touch / finger touch just stops responding at random. There's too many suggestions out there on the forums that don't explain what each command suggested actually does (do people just copy and paste these suggestions without understanding the implications first?).

Today is the first time I've used Windows in a week - I love Windows 8.1, especially on Surface Pro. It's beautifully designed, easy to use, makes the switch between keyboard-oriented and tablet seamlessly and OneNote /OneDrive / Office is pure brilliance in design and productivity. LibreOffice and Evolution do Office well but the UX is far clunkier. There is no OneNote outside of Windows and I miss the right click pen button (I only use a mouse on Ubuntu for apps that use context menus a lot). Office365 means I get proper Powerpoint instead of the terrible LibreOffice Impress. There's no Visio equivalent though I'm learning to use Camunda Modeller and Archimate instead. I can operate on client site without Windows now though.

For me Windows 10 is a disaster as it stands. They've ruined OneDrive (where is "Available Off-line Only" for files?) although are promising to rectify the situation and I think they've been led by too many Windows XP-ers in their UI-design-by-community instead of holding their ground and pushing 8.1 on to the next level. Continuum is awesome though - the new W10/Xbox dash is great (game streaming is by far the best add-on here), W10Phone looks superb and I hope they iron out the creases on W10. None of the privacy issues bothered me because you can turn off the telemetry services and disable the data sharing but the OS itself just doesn't feel as coherent or as well thought out as 8.1 on my SP3 or Windows Phone 8.1 on my Lumia.

I'm now in a position where I've had to remove Windows 10 from my replacement Surface Pro 3 as the software licensing service locked the whole machine out (Access Denied); despite this being the default build as supplied by Microsoft. USB boot won't work even after changing the UEFI settings to enable it - I suspect something to do with the Win10 installation - but I've now copied the 8.1 Enterprise installer to a new partition on the SP3 SSD and hacked the Grub2 bootloader to give me the option to boot from it and I'm going to get Windows dual booting on it for OneNote and firmware upgrades. Encrypted SD and data partitions allow sharing between OS-es and decent OpSec can ensure Windows only knows how to access one of those for transfer.

Phew. If you'd suggested and of that to me a year ago my eyes would have glazed over and I would have probably just sent the device back to manufacturer.

But the thing is I'm still afraid to install Win8.1 in case it fudges up all the work done installing and configuring Ubuntu. I know Windows will install its own boot-loader (I've modified the same on my desktop to add back the Ubuntu option enabling dual boot again). I like Ubuntu, Raspbian and Debian - I also like the Windows ecosystem and the journey is never over but I'm reaching the point where I have enough foundation to build on for the security architecture courses. In order to design an architecture or provide solid options for businesses I still feel it's beneficial to understand the inner workings.

It's good to be bilingual between Windows and Linux and none of this has been as difficult as learning Mandarin (as I originally thought it might be). It just sounded more tricky to get started than it was.

Sunday, April 19, 2015

Test & Learn



The last few years have been a really interesting adventure for me - I've set up two businesses and things are moving in the right direction. Along the way I've made some mistakes but more importantly; learnt from them.

Hopefully :)

This one relates to B2B late payments and lessons learned in preventing the situation. It's definitely worth getting a background in your monetary rights from UK Plc too.

When I first started it would have been fair to say that I was a novice in the world of contracting and it's nuances - Only good advice from my accountants and contractor colleagues really got me moving. However it was soon clear that even that wouldn't solve the underlying problem: What do you do if the customer doesn't take your invoice due dates seriously?

The first example is from my time working as a contractor for Woodrow Mercer. I don't think the recruiters themselves are really at fault but that doesn't excuse the accounting department. Most agencies seem to have rude and unprofessional accounts department staff - with few exceptions - and they frequently seem to attempt to bully or turn their nose up at contractors.

One agency, ERG, were particularly bad at this back in 2012 - I was sent threatening emails from senior recruiters and directors when I terminated the contract with them. They made wild [incorrect] guesses about where I'd taken the next contract and on recruiter even attempted to get in touch with relevant hiring managers. It was all bluster, aiming to play on the submissive psyche normally present in technical people. However I just prepared the particulars of claim document I'd need to take them to court for non-payment - they paid before the deadline to pay expired though.

Woodrow Mercer failed to pay on time on three separate occasions - the worst thing about this was that the client involved were such a nice bunch to work for. Really well gelled group of people who enjoy what they do. The second time payments were missed there was no excuses or apologies from WM so I called them.

They sent me an abrupt email saying that they'd pay one invoice but the other would have to wait - regardless of the fact that they were legally obliged to pay on both invoices due dates. In that scenario they did pay, but one week late on one and two weeks late on the other invoice.

The third time they missed payments I'd had enough of being passed off with bluster and excuses - Had a word with the client manager and respectfully noted that I would not be returning to site until the invoices were settled. One invoice is still outstanding 11 months on although for a relatively nominal fee. They've since stated that they will "...rigorously defend.." any claim in the courts - I may update that with another approach depending on some parallel research.

Wind the clocks forward a year or so and two other agencies have attempted to bully their way out of late payments. In both cases both the contract and the invoice T's and C's supported an instant late charge along with interest growing daily.

Uniting Ambition fell short of the mark after neglecting to pay the final invoice on due date (I would have been fine with it had their been discussion beforehand, some reasonable negotiation solves a lot). They attempted to negotiate a portion of the fines but then paid in full when I delivered a "notice before action". If it was the first time they'd paid late I might have let it slide but they'd failed to pay every single contractor at that client (~30 people) on the first invoice date. No apology was given and only a few vague excuses. An inexcusable attitude.

In all cases a reasonable discussion up front prevents any of this - Just a phone call to say there's payment problems and that your invoice will be 5 days late will make a huge difference to your planning. Having said that consistent late payments should give you all the indication you need. Try doing some research first and getting a credit check of the company before you sign a contract with them. That's often due cause for respectfully requiring them to change the payment terms on your contract. Talk to your bank about their B2B credit checking offering. You can throw the payment terms on any contract they offer back at them if they telling you they do 30 days payment but their credit rating barely supports 7.

Normally a lot of contract terms in the UK make it very tricky in relation to IR35 - never mind just getting paid. Lots of unprofessional agencies initially reject requests to change the contract; "it's a standard contract we use for everyone and do not change it". It's all bullshit. A contract review by your accountant or legal representative is worth every penny.

I work with other types of organisation directly and although some of these problems are common elsewhere, the attitude towards invoice due dates is not. You've worked hard for your rate and perhaps even worked far away from home to do so, why should getting paid be a struggle?

Thursday, December 04, 2014

New Questions


It's been a while since I've had a chance to post anything: I've been really busy with a client and there's been a lot of travel, I've also started a new business ... with a new blog.

From now on those aspects of business focused on research and consumer advice will appear there.

Friday, September 26, 2014

Disclosure Dilemma


Being able to find a flaw in a system isn't going to win you any friends - depending on your intent you may or may not profit from it - but the developers won't appreciate being told they screwed up and a project manager somewhere is quietly weeping over their previously impeccable Gantt chart1.

One of my clients asked me if they could get one system to "integrate" with another by automatically logging on for the user. Aside from the usual question marks about stored credentials I did point out that unless there's a central authentication model (such as OAuth) it would not be advisable. Nevertheless I completed due diligence. In the process of doing the impact assessement I ended up doing a lightweight mini pentest after finding some interesting behaviour.

In this situation I'd normally contact the vendor and let them know about some areas for improvement and say nothing to anyone else but before I started the client specifically asked me not to contact the vendor of the system for any reason. Politcs aside they're clearly intending to replace the system and do not want to engage the vendor in the process.

Reading the papers yesterday puts the issue list in perspective - none of the issues I found are particulary serious but it does affect an HR system (and therefore real people data).

I could provide the information to the client and let them decide whether or not to disclose to the vendor but the problem here, again, is politics. They could also use it as a bargaining chip to either better the price or cut loose of a contract without giving the vendor a fair chance.

Knowing the client as well as I do they probably wouldn't expand the budget for upgrades so the vendors natural patch path has a chance to resolve some of these issues. To me this isn't an ethical approach because you're putting the power of blame essentially out in the open, which defies the point of responsible disclosure.

At some point the contract I have with the client will end but siding with the client vs. the vendor should have nothing to do with the financial incentives - Only bug bounties are the exception to this ethic.

I spent some time thinking about it and decided to get in touch with the vendor, against my clients wishes. I need not divuldge the detail of the political situation and only the tech detail.

Is that the right thing to do? What would you do?



1: No plan survives first iteration. Ok, ok, ok this could be a burndown chart but it seems most environments say "agile" but make it synonomous with "waterfall". Or Wagile™.

Wednesday, August 29, 2012

Preservation, Physics and Psychology


Make sure you're kit is in good order for that time you'll really need it

I've had some time to think and reflect since the frenetic pace of my last permanent role and I thought I'd share some of the lessons learnt over the years. These thoughts relate to hiring and expectation management - Numerous other hiring managers adopted the process I developed due to it's success in finding the right people; I've even been recommended because of it. I spent a lot of the beginnings of my career working at consultancies so I got to see a lot of different IT & development departments.

I took those experiences into the latter half of my career and built on them in ISV's and online gambling & gaming firms. After I left my last employer a number of people there approached me about grumbles and for career advice so maybe if you're thinking about getting on your bike, some of these observations from the last 15 years may help you make sure that bike's in good working order before you need it...

So What's Physics Got To Do With It?

Relax, I'm not about to yell "In the NAME of SCIENCE!!", wave a sword in the air and the lead nerd equivalent of the charge of the light brigade. In simple terms, inertia is simply defined as "a body's resistance any change in motion". So if a body is already moving, that body won't change direction unless something forces it to. For example, if there was no gravity or air-resistance on a tennis ball, Nadal's returns would never bounce in but just continuing to  travel on at their fantastic speed.

That's some pretty boring tennis.

In terms of the people that you have working for you right now, at what point does their reluctance to change career direction become inferior to the options, choices or influence to move to the next stage? They will be the forces that eventually inspire them to change course and jobs, their inertia overcome.

For example, we've probably all worked for companies at one point or another that fail to deliver on promises and end up only inspiring dissent. I'm sure we've all see the kind of offices I'm talking about - The last drops of enthusiasm drain away at around 10am on Monday mornings, where senior management just weren't interesting in keeping you happy, would often take credit for yours & your teams achievements as their ideas - often right in front of you. The kind of places where it's very difficult to conceal what's happening from your team. Your superiors are making your job even more difficult then criticising you for not hitting those moving targets. But hey - that's the same in any company to a greater or lesser extent so we just learn to deal with it better!

A simple exercise in shared ownership and expectation setting for team members can mean that what the seniors do above you is irrelevant to your team members. It can also ensure that senior management get the ammunition to laud amongst their peers and their seniors whilst your people further build a sense of achievement and self-worth.

So let's look at inertia, and that seeming reluctance to take that next step. The deciding factor there is levels of personal happiness.

Happiness Is Not An Illusion

Even your own happiness shouldn't be measured by short-term pressures such as "how do I keep my boss from getting angry?" or "how do I make sure I don't get fired?". Both those questions conceal underlying issues about your relationship with your line manager that you need to review. Maybe you need to think about how to set expectations more realistically, or maybe that boss refuses to have his or her expectations set any differently and you need to define delivery plans differently.

No-one is going to fix it for you - you've got to take charge and do it yourself. Your boss will be impressed if you resolve a problem via initiative anyway and relying on other people for your own happiness is a bad idea.

For example, I could define my own happiness at work measured against certain criteria. So if those criteria included whether I can be in a position where I'm learning something new (or how to do something I already knew better) and I'm able to contribute to the organisations mission statement, that satisfies my own happiness criteria. There's nothing complicated there and it's pretty easy to keep that learning mode switched on.

I've been fortunate enough to work for two great organisations in the last six years who have enabled a massive personal leap forward in both technical and business acumen. My reasons for leaving both organisations were to springboard into a specific career channel on my own for the next ten years, and I'm incredibly grateful to both companies for the immense wealth of experience gained. 

For my personal happiness the problem at my most recent employer was that it's a thankless, hard-working environment where politics are constantly at play - There's someone trying to pull the rug from under your feet all the time, listing all of your smallest shortcomings alongside none of your major achievements to the heads of department and above. Most of the senior management originated at the same group of companies and there's little longtitudinal career travel. However, the amount I learned and the various performance and security concepts I got exposure to combined with the great technical people I was fortunate to work with outweighed all those negatives instantly. Overall I'd actually describe the entire experience as extremely positive and constructive but then I'm known for having a very optimistic approach!

On one project we worked from October through to January missing out Christmas and New Year entirely. We got the project live with 30 seconds to spare (failure would have meant the company ceasing trading in certain countries) and I finally celebrated xmas / new year with friends in February. I really enjoyed the vibrancy and energy across the teams but the level of effort isn't sustainable for any length of time. Some of the developers involved were getting serious grief from wives and partners as a result, others just reaching the end of their tether entirely. Around five percent of the department handed their notices in over the following eight months.

Of course, whilst I could have stayed at my present employer for many years there was nothing there to provide any kind of objectives or markers of success. Crucially, the exposure to new things or improving things stopped over the course of a quarter. I'd already learnt how to do push-ups in space and I'd be stuck in the same career situation for the foreseeable future; fantastic experience but no longevity. It's a shame because the business itself is a global success.

If you've ever read Soul of a New Machine by Tracy Kidder you'll get an idea of what the environment could be like in places. Sometimes the development department delivered requests even the CTO thought impossible to implement, other times we'd fix live security issues that few people seem to have ever heard of. All sorts of people wanted to consult with us ranging from a very large software company from Seattle to security departments in national government. The company has it's own patents, creates relationships with specific ISV's in order to get feature requests and help develop those products. Almost all the companies in the same market sector viewed this organisation as the target to aim for and we were used to building software that would come under attack every minute of every day.

So the inertia here - the reluctance to move on - was big but the force enacting a change in career direction was much bigger. It took quite a lot to make me think about moving on despite an extremely tough working environment with a very high turnover of staff but after going through two or three relationships and having all your friends make some very unsubtle comments your perspective is adjusted. Forest. Trees.

It's a personal thing and defining your own happiness is very much up to you. 

Moving on from recent examples, some places do have an entrenched management structure that all used to work together at whichever organisation(s) they all came from - usually only creating glass ceilings for everyone else, or bring in people who won't question them. It's very difficult to make your way through that structure although it is possible with the right strategy. There's an element of that in most organisations to a greater or lesser extend though, more so in family-run businesses.

A good friend of mine whom I've known for many years went from working in a call centre to working in banks, then on to being an accountant. In his case, happiness is defined as caring about the people you do business with (as well as being able to use his brain!). He couldn't do that in a call centre, and banks generally have too much internal politique for good people like him. It took years but he's happy - it's still hard work but it's the sense of achievement and associated rewards that provide him the next objective.

That inertia was overcome by a desire to improve himself and his quality of life combined with the determination to succeed - An admirable level of tenacity.

Should I Stay Or Should I Go?

Perhaps it's more about the Psychology of Staying - At what point do you assess your own happiness and realise that your current situation falls far short of your expectations? How many times will you grumble about leaving then never get round to it because "the time isn't right"? How many holiday requests will get refused before you (and your partner) start having serious issues?

I think we've all had difficult situations motivating staff where they've seen the grass on the other side (especially when you have contractors as well as permies) and are struggling to justify their current life choices as a result. Your aim should be to take care of their best interests and create more feathers for their cap. Give them something "for free", like a new programming technique or methodology, and you'll see an increase in enthusiasm. They're going to get that "new thing" one way or another, so you may as well get the perceived credit.

An occasional pat on the head, perhaps a bonus or a payrise a little over the rate of inflation may keep someone quiet for a while but eventually it'll be the same situation and same grumbles again. Remember that no pa-yrise is the same as a pay-cut and there's no such thing as a "job for life" in information technology so don't assume long-term loyalty. As an employer, the people that come to you threatening resignations unless they get a pay-rise will only do the same to you again in a year. Making your people feel valued is worth far more than any pay-rise or bonus in the long term (although they can help), assuming your paying fairly for the market to start with. 

Beating people with a stick then criticising them for not being stick-proof is not a good approach. I remember on a particularly large and difficult project being told that I wouldn't be given any project management or architectural resources. I spent some time with my boss explaining that growing the perm team by another 50% in six months, taking care of the BAU tasks and covering live issue support was plenty (along with my actual day job). Doing all the project planning and architectural support within the team wasn't possible at that stage, and wouldn't be until we could hire or promote some senior developers. A massive redevelopment project, in a proprietary development environment on bespoke frameworks was going to be tough enough on everyone..Never mind doing it on our own.

Both myself and members of the team had to work 60-80 hour weeks for over a year to make sure we got the job done. I was denied requests to promote within the team or find senior developers on the market so nominated technical leads to perform the senior dev functions. Kudos to the guys I put in those roles, they achieved an incredible amount and it's a huge credit to them that the products and frameworks were delivered.

Following what became a tricky product delivery I was ironically pulled up for planning and architectural criticism. Don't take that as shifting blame though, it was my responsibility to ensure delivery and mine alone. By the way, that taught me that "I told you so" comments need to be very carefully phrased :)

Back in the world of physics, impulse is defined as force multiplied by time. Essentially, a large force for even a short time creates the same amount of change as a smaller force for a much longer time.

In people-terms, impulse is far more dangerous. One person leaves and starts telling their former colleagues about the benefits (the "grass is always greener" effect). They start making impulsive decisions about their futures that you have no control over and cannot convince otherwise. All it took was a little extra nudge to focus those existing thoughts and ideas. 

It's a visible indicator of your working practises when your people start leaving in numbers, especially in the current market where perm developers can almost name their price.

Sound-Bite Summary

In order to get closer to that state of equilibrium, start at the beginning; the recruitment cycle for your growth or replacement phase. Usually it's better to wait to find the right people - the people that have a particular vocation or love of a job - to fill a vacancy than shoe-horning in a bad fit. Long term it'll save you (and them) a lot of pain. No-one checks all the boxes but if you can find someone with an attitude that fits your working environment and is hungry for it, the situation will be more constructive for both sides. In fact, far more constructive than a star player [prima donna] who needs to be the centre of attention all the time (and whom the rest of your team will probably hate).

Contractors don’t matter - they're just there to see you through until you've built your teams the way you'd envisioned it. That's not being mean or heartless, I'm a contractor myself coming from a  development management and development background and I know where I stand.

Whilst the axiom of "A happy workforce is a productive workforce" rings true, what you're really doing is preparing and training people for their next job. The only choice you have to make is whether or not that next job is going to be within your organisation or your competitors.

Which would you prefer?



Monday, May 28, 2012

Altitude


Very relaxing weekend for me last weekend, how was yours?

Signed up at a gliding club nearby and they got me airborne on the day. I'd forgotten how much fun winch launches are :) The instructor was pretty nice about it - "Yeh, you can definitely fly a plane, you're just a bit rusty". I'll happily take that!

Pretty impressed with the new phone, too. Seems to cope with pretty much anything although I'm not sure I remember the pre-flight briefing from the stewardess mentioning turning off my phone so...

Please note: I was P2 in the aircraft and not in control at the time this photo was taken. Do not try and juggle text messaging with aviation.

Got a couple more ideas for phone apps and some sunburn out of the day. Sometimes you need to get up and away from the grind to really relax.

Good bunch at the gliding club and a far better way to spend a sunday than sitting in front of the TV.

Tuesday, May 15, 2012

Great scott, Marty!

I handed my notice in yesterday in what will be the biggest career change I've experienced in my short career.

When you take an objective view of any situation you're involved in and realise that nothing about that situation benefits any of your own goals or objectives, sometimes you come to the conclusion that it's just not worth doing.

The time I've had at this company has been a huge benefit - I've learnt so much about so many subjects and had the chance to work with the most highly skilled group of people I've ever met, but from this point I'm not going to learn anything new and there's virtually no opportunity to progress career or add to my achievements.

It's not as if there's any animosity or resentment either, if I can I aim to ensure my departure is a blip rather than a bump and that there's adequate continuity.

It boils down to time - I can't get to my long term goals without time spent with the latest technologies on my resume, and potential employers aren't interested in talking to someone with the length of notice clause I have in my contract. I need to apply my core experience to more specific areas in commonplace use. Some of the clauses in the contract prohibit particular blog topics too so it'll be akin to being set free in some respects (I won't miss being permanently on call either :) ).

When I was in Alberta earlier this year, the guy organising the NHL trip to Saddledome spoke about his motivations and experiences in setting up his own business. Struck me that it's (whatever "it" may be for each of us) a lot easier than we think or fear.

The Axiom Of Larry: "Make it happen".

I've also quit smoking with the help of the local quit clinic. So really, it's all about time and travel.

1.21 Gigawatts