Agile Process

My first reading about Agile was the Agile Manifesto. I think this was enough to get the whole picture of the agile philosophy.

I really don't recommend that you get a book to read about the agility; it will be a contradiction to read a book as long as the Agile methods emphasize working software as the primary measure of progress. It is better you spend the time understanding your working environment and maturity to apply the best process that can fit with it.

I lived a similar experience with eSpace when they were aiming to get a CMM certificate, CMMI or whatever they will call it after couple of years.

I think that finally the people here got the good decision by putting this plan away, and put their own standards, the standards best fitting with their teams and their environment. I doubt their was a need to some white collar guy to supervise our documents and our working styles to decide whether we fit to Mr XYZ standards or not. I also got the chance to meet some guys from another company having this certificate. What I found is that they modified their hierarchical structure just to accommodate the standard although their team wasn't capable at all to support this hierarchy.

Anyway, let's move to another point...

When we talk about the agile process we should identify very well any possible limitations before adopting it. It is very clear for me that it needs mature people, and this can be considered as one of the limitations.

Another factor that may limit the agile adoption is the "distributed software". Lately all our projects are distributed. Customers are from Europe, USA, Gulf. Developers are working remotely from different areas.

What are the challenges behind such distributed agile work???

The answer of this question can be summarized in knowing that agile methods mainly rely on informal processes to facilitate coordination while distributed software development typically relies on formal mechanisms.

Challenges in Agile Distributed Development

1. Communication need vs. communication impedance: How can we achieve a balance in formality of communication in agile distributed environments?
2. Fixed vs. evolving quality requirements: the Agile relies on ongoing negotiations between the developer and the customer while Distributed Development often relies on fixed, upfront commitments on quality requirements.
3. People- vs. process-oriented control: We appreciate the people-orientation the most.
4. Lack of cohesion: Generally speaking about the distributed environment, people may feel In distributed development, participants are less likely to perceive themselves as part of the same team when compared to co-located participants. the agile adds some more excitement to it :)

Practices

1. Process Refactor: Continuous process adjustments instead of following strictly the agile practices. It is also recommended to document the requirements at different levels of formality.
2. Knowledge Spreading: the team should share their knowledge regarding different domains(business, code, test cases..etc). Alot of tools were developed to reduce the overhead of knowledge-sharing activities. Code/process Repository is a must. the Wiki also is a very important way to share the How-Tos between members. I can't neglect the Bugzilla with its role in creating database to help teams report issues and assign priorities.
3. Short Iterations: any iteration should not exceed 2 weeks. short iterations help to detect any misunderstandings for the project business and prevent any time waste.
4. Start with well-understood functionalities: In order to create the best atmosphere for developers there should be a solid sand to start to be familiar with the processes, tools, and the application. this can be some kind different that the agile which advocates the development of features prioritized as critical by the customer.
5. Improve Communication: Synchronized work hours are very important for the team. Also try to make the informal communication be done through formal channels. for example, let it through the emails so that it can be archived. In the distributed Projects it is recommended that the project leader/manager should be involved in the communication and the synchronization process than the Agile practice. finally, some daily mechanisms should be done to maintain minimal communication like morning online meeting.
   
6. Building Trust: trust involves both the team and the customers.

References:
1. Ebert, C. and Neve, P.D. Surviving global software development. IEEE Software 18, 2 (Mar./Apr. 2001), 62–69.
2. Highsmith, J. and Cockburn, A. Agile software development: The business of innovation. IEEE Computer 34, 9 (Sept. 2001), 120–122.
3. Matloff, N. Offshoring: What can go wrong? IT Professional (July/Aug.2005), 39–45.

Web Antivirus

Web Services are increasingly becoming an essential part of your everyday life. How much time you spend surfing the internet pages?

To be more specific how much you feel now that Google is too much involved in your daily routine? Can you imagine your life without Google? your search, your Calendar, your email, your blog, ...etc

Well, it seems that you will look for Google to be your web antivirus. Before you access a page, type the url in google search and pray that you won't get "this site may harm your computer".

you have just to obey, otherwise your PC will be affected.

the story begins with researchers from the firm surveyed billions of sites, subjecting 4.5 million pages to "in-depth analysis". Actually they found 450,000 pages guilty.

It is sufficient only one visit from you to make the attacker able to detect and exploit a browser

vulnerability. Therefore, the goal of the attacker becomes identifying web applications with vulnerabilities that enable him to insert small pieces of HTML in web pages.

An example for this is iframes, which can successfully install a malware binary "drive-by-download".
Are the web masters, or the site creators are responsible for this?
The answer is, it is not always the case.

User Contribution

Many web sites feature web applications that allow visitors to contribute their own content. This is often in the form of blogs, profiles, comments, or reviews. they usually support only a limited subset of the hypertext markup language, but in some cases poor sanitization or checking allows users to post or insert arbitrary HTML into web pages.

Advertising
Although web masters have no direct control over the ads themselves, they trust advertisers to show non-malicious content. Sometimes, advertisers rent out part of their advertising space; in this case the web master needs to trust the ads provided from a company that might be trusted by the first advertiser. And so on, you may find nested relations which considered as pitfall in the trust relation by making it a transitive one.

Third-Party Widgets
A third-party widget is an embedded link to an external JavaScript or iframe that a web master uses to provide additional functionality to users. Example for this, Google Analytics :)

Webserver Security

The contents of a web site are only as secure as the set of applications used to deliver the content, including the actual HTTP server, scripting applications (e.g. PHP, ASP etc.) and database backends. If an attacker gains control of a server, he can modify its content to his benefit. For example, he can simply insert the exploit code into the web server’s templating system. As a result, all web pages on that server may start exhibiting malicious behavior. Although we have observed a variety of web server compromises, the most common infection vector is via vulnerable scripting applications. We observed vulnerabilities in phpBB2 or InvisionBoard that enabled an adversary to gain direct access to the underlying operating system. That access can often be escalated to super-user privileges which inturn can be used to compromise any web server running on the compromised host. This type of exploitation is particularly damaging to large virtual hosting farms, turning them into malware distribution centers.

Exploitation Mechanisms
A popular exploit we encountered takes advantage of a vulnerability in Microsoft’s Data Access Components that allows arbitrary code execution on a user’s computer.
Typical steps taken to leverage vulnerability into remote code execution:

• The exploit is delivered to a user’s browser via an iframe on a compromised web page.
• The iframe contains Javascript to instantiate an ActiveX object that is not normally safe for scripting.
• The Javascript makes an XMLHTTP request to retrieve an executable.
• Adodb.stream is used to write the executable to disk.
• A Shell.Application is used to launch the newly written executable.

Another popular exploit is due to a vulnerability in Microsoft’s WebViewFolderIcon. The exploit Javascript uses a technique called "heap spraying" which creates a large number of Javascript string objects on the heap. Each Javascript string contains x86 machine code (shellcode) necessary to download and execute a binary on the exploited system. By spraying the heap, an adversary attempts to create a copy of the shellcode at a known location in memory and then redirects program execution to it.

Detecting Dangerous Pages
Simply, by monitoring the CPU and the processes executed on accessing the page. When some unknown processes are added to the list, this will be a strong sign that a drive-by download has happened.

Google will be more and more involved in our life, it will report to you malicious sites for free....
anyway, it is not a big deal, you can do it yourself for some levels. but there a little bit sophisticated cases when you need multilevel reverse engineering...

source: Google Research Paper

Update: Google online security blog, the latest news and insights from Google on security and safety on the internet.

Upgrade your Experience with Google Analytics

Few days ago Google Analytics has released a new version. The new user UI enables easier use of the reports and metrics within the data sets,

NEW:

• Email reports and improved clarity of graphs allow users to explore and discover new insights
• Customizable dashboards ensure the right data gets to the right people at the right time
• Plain language descriptions of the data allow users to take action to improve their web site

This is awesome :)

Attitudes for Creativity

I just remember the Bernards Shaw's quote:" You see things, and you say, "Why?" But I dream things that never were, and I say "Why not?"
I am sure if the creativity can be learned anyway, a lot of people just born to be creative...
maybe someone can see this link listing 9 attitudes for creative people, and tell me if creativity can be learned or not.
the attitudes as listed by the link are as follows:

1. Curiosity

"What if?", "Why?", "Why Not?"...

2. Seeing Problems as Interesting and Acceptable

Creative people see problems as a natural and normal part of life - in fact they often have a fascination with problems and are drawn to them.

3. Confronting Challenge

Asking ‘how can I overcome this’?

4. Constructive Discontent

Awareness of what’s wrong with the world around, then let it be a motivation to doing something constructive.

The 100 most Influential Personalities

Time magazine.....Created a list of the 100 most influential people in the world.

The Saudi monarch Abdullah bin Abdul Aziz was ranked 36 among the 100 most influential personalities on the political level in the world for 2007. The list included personalities from diverse backgrounds, including Sudanese President Omar Al-Bashir, along with Egyptian Islamic preacher Amr Khaled. It was striking absence from the list the name of the American President George Bush, leaving the place for Osama bin Laden and the Pope Benedictos XVI and Al Gore, Leonardo de Caprio and others. For the politicians, the list included the name of the American Secretary of State Condoleezza Rice, and the Supreme Leader of the Revolution, the Iranian Ali Khomini, and Raul Castro, brother of Cuban President, along with the Democrats, the main candidates to the American presidential elections of 2008, Hillary Clinton and Barak Obama, in addition to the Chairperson of the American House of Representatives Nancy Pelosi. The 34/39 former U.S. Vice President Al Gore in the category of "scholars and thinkers," along with the co-founder of Microsoft Paul Allen.

In the category of "heroes and pioneers," the name of the multi-millionaire Warren Bouvet, and French soccer star Thierry Henry and an activist in the issue of Darfur Representative George Cluny. It also named for the founder of the site "youTube" electronic videos on the list and the name of the founder of Apple, Steve Jobs.

The journal does not rank such personalities, not necessarily to justify why chosen figures, only saying that it wants to honor the "men and women who change the world using their talents, their authorities or their moralities"

This is a strike to the Egyptian system, choosing Abdullah is an indication of the absence of the Egyptian effect on the middle East, where Egypt has been always the most effective player. Currently, it is really obvious that Saudi Arabia stole this role from Egypt.
We don't forget picking Amr Khaled is also a big strike, there were rumors that Amr Khaled was forbidden from Egypt because of the worry of his effect on the Egyptian people, and he faced a lot of Media battles to deny his effect and his role in the islamic world.

The BlackWater's Danger

I think the phenomenon of BlackWater is too dangerous concept...
The USA uses these kinds of gangs to fight for them instead of get involved in IRAQ, Afghanistan.
These gangs cannot be punished for war crimes, because they are not nothing actually. they are not a military, nothing except...........
They achieved numerous massacres in IRAQ and Afghanistan, wearing Navy Uniform.

Privatization in Egypt is totally different than privatization all over the world :)...This is about the privatization of war and how that subverts even basic notions of democracy. The blackWater is used as a mirror for "Radical Christian Right".

If we are still not aware of wt does this really mean...then here we are..
Blackwater is also the name of private company, formed by an ex-Navy Seal, which owns the training facility and sells "security" to countries or organization doing business in high-risk areas of the globe.

Blackwater's security services included making available - for a price - a small army of heavily armed, experienced mercenaries with access to their own helicopter gun ships, armored vehicles and war planes.
Some says that in 2006, Blackwater had 2300 soldiers deployed in nine countries with a database of 21,000 additional on-call mercenaries.
Where these soldiers come from?????
There are EX-Special Forces from US and UK. they simply can't find inner peace in thir civilian life, so they looked for wars in other countries (Islamic ones). We don't need to say that they r very cruel, experienced, commandos, seal...etc everythg we may think about.
the BlackWater can defeat a significant number of countries.

Some others confirmed that Blackwater has won - on a sole-source basis - more than $500 million of US government contracts, not including unlisted "black" contracts. In addition to Iraq, Blackwater has contracts for work in the Louisiana flood area and on the Mexican boarder. The total global value of private military security contracts is estimated to be $100 billion and rising.

Aren't these terrorist gangs?
they make me sick, that's enough for now :S

Communication Barriers

I think that we are the most skillful people to achieve a team work. I thought that the majority of us have been working in teams since their first academic year, and for me, this was good reason to justify my theory.

Ironically, I am totally convinced with my theory, while all other careers look to developers as freaks. Well, I show up hands to agree with this. My theory isn't precise...I should add "teams of developers". At least the freaks can understand each other :)

Team chit chat

It should be curious that our teams may still have problems in communication. I got some remarks from my partners, through the projects, concerning my communication success with them.

The big majority confirmed that:

1. I have a problem in transferring my knowledge to them.
   
2. I am "expression-less", so that someone asked me to put a sign indicating my mood whether "I am sad" or "I am happy".

The 2nd point is little bit tough. The 1st point can be analyzed and managed.

It was normal that I spend time thinking about how much people think that I have deficiencies in transferring my knowledge and my talk skills. At the beginning I was trying to evaluate myself and think how can I overcome my problems.

hence, whenever someone asks me about anything, I make a flash back to the days when I was still learning that thing, memorize all the questions I got at that time, and then start my brief session.

I worked on this thinking that I am overcoming my problems with partners. But I was totally wrong.

one day, I was making a brief introduction to my partner, he shouted "Fizo, I really don't get you, your explanation is really vague....Why don't you make a flash back to the days when you started to learn this thing and explain to me based on the question you got in your head?"

"huh...?" That what I am doing all the time.

Again, there should be something wrong...This time I thought about it in more abstract way.

Evaluation Barrier
My partner's comment made me notice a small problem...

It's the "Tendency to Evaluate", this is a human nature, the first reaction of a statement is to evaluate it from "your" point of view. It's a tendency to judge, approve/disapprove person's statement. What was really happening is that my explanation was evaluated by my partner more than listening with understanding.

Listening with Understanding
You should achieve real communication by avoiding evaluative tendency. This means seeing the attitude from the other person's point of view, touch his/her frame of reference about the subject.
I see that I should answer question, in the contest I can do it. Some efforts should be done by the questioner to get and understand the whole picture. In practical life we are not open books, my head is not indexed like the book, I have no appendices pointing to keywords which the questioner look for.
What will happen when you listen to my answer and analyze it to get your satisfactory answer? Does this sound absurdly simple??
Actually "listening" is not widely used. There are a lot of reasons in my opinion to avoid the "listening" thing.

1. Most of us have a defensive attitude when it comes to opinions' discussions. We are afraid to get affected and changed by what we hear. Weird, isn't it?
2. Emotions, in some discussions emotions become strongest, so they forbid us from achieving the frame of reference of the others. (let's not focus on this right now, as we are more involved with technical discussions)
   

I don't think I am saying something new. What the entry includes is very obvious for all of us, "the importance of listening"...But the fact, is, the problem has endured because it is a basic truth about human interaction.

Practical RESTful rails Example

Using PUT and DELETE with GET and POST is the main idea behind REST to simulate the CRUD mappings.
Note: Web-Browsers neither support PUT nor DELETE

Create a Rails project and the Resource Scaffolding

$ rails warehouse
warehouse> ruby script/generate scaffold_resource product name:string desc:text
exists  app/models/
exists  app/controllers/
exists  app/helpers/
create  app/views/products
exists  test/functional/
exists  test/unit/
create  app/views/products/index.rhtml
create  app/views/products/show.rhtml
create  app/views/products/new.rhtml
create  app/views/products/edit.rhtml
create  app/views/layouts/products.rhtml
create  public/stylesheets/scaffold.css
create  app/models/product.rb
create  app/controllers/products_controller.rb
create  test/functional/products_controller_test.rb
create  app/helpers/products_helper.rb
create  test/unit/product_test.rb
create  test/fixtures/products.yml
create  db/migrate
create  db/migrate/001_create_products.rb
route  map.resources :products
warehouse> rake db:migrate
== CreateProducts: migrating ==================================================
-- create_table(:products, {:options=>"default charset=UTF8"})
-> 0.0160s
== CreateProducts: migrated (0.0160s) =========================================

We can now have a look to the generated controller.

URLs.
An example of URL in REST is (/product/1) instead of (/products/show/1). We notice that the action is dropped from the URL, we can't know what is the action that should happen to the addressed resource.
The REST actions are activated through a combination of resource-url and HTTP verb. Another feature in the REST action, is that it can react with different response-formats . REST uses the respond_to. We can see this in the generated controller we got from the above steps.
The format specification can be simply done by appending it to the request.(http://localhost:3000/products/1.xml)

Views
Remember the old days when we used to find the following line in the generated views:

link_to :controller => "products",:action=>"show", :id => product
>>>< href="/products/show/1">Show

Looking to our generated views, we see the following code instead:

<%= link_to 'Show', product_path(product) %>
>>>< href="/products/1">Show

The 'link_to' call is the same, but the hash is replaced by the path_methods.

Same thing for the following methods:

<%= link_to 'New product', new_product_path %>
>>>< href="/products/new">New product

<%= link_to 'Edit', edit_product_path(product) %>
>>>< href="/products/1;edit">Edit

It is not surprising to expect that the REST will affect our forms too. Now, we have to use Path-Methods in our Create/Edit forms.
The :url-hash is replaced with the calling of a Path-Method

• product-path for the new-form.
• product_path(:id) for the edit form.
  

<%= form_for(:product, :url => products_path) do |f| %>
>>>< action="/products" method="post">

<%= form_for(:product, :url => product_path(@product),
          :html => { :method => :put }) do |f| %>
>>>< action="/products/1" method="post">
< style="margin: 0pt; padding: 0pt;">
 < name="_method" value="put" type="hidden">
< /  div>

Finally, the Destroy. The method used for both showing and deleting is 'project-path'. The only difference is that the destroy link additionally uses the parameter :method to name the HTTP method to use (:delete) because the browser doesn't support DELETE.

<%= link_to 'Show', product_path(product) %>
%= link_to 'Destroy', product_path(product),:method => :delete %>

In the same manner controllers have to take special care in using the new technique during redirect operation. Rails uses the URL methods generating a method for each path methos:
project_url for project_path
projects_url for projects_path

redirect_to :controller =>"products", :action=>"show", :id=>@project.id
>>>>
redirect_to project_url(@project)

RJS

Ruby on Rails has excellent support for Ajax baked right into the framework. Remote JavaScript (RJS) templates build upon the Ajax support offered by Rails, allow to easily update multiple page elements.
This is a quick start to work with RJS.

$ rails RJS_Example

Create your controller:

RJS_Example> ruby script/generate controller Examples
         exists  app/controllers/
         exists  app/helpers/
         create  app/views/examples
         create  test/functional/
         create  app/controllers/examples_controller.rb
         create  test/functional/examples_controller_test.rb
         create  app/helpers/examples_helper.rb

Let's modify the default controllers now:

class ExamplesController < ApplicationController  
 def index  
 end   
 def display    
  @statement = params[:statement]  
 end
end 

Now, we should go to create our views.
Create in the $RJS_Example/app/views/examples create your index.rhtml
In the header include this tag

    <%= javascript_include_tag :defaults %>

The :defaults helps to add all the Scriptaculous visual effects and controls.

In the body, add this code.

    <%= form_remote_tag :url => { :action => 'display' },
    :html => { :id => 'display-form' } %>
   <%= text_field_tag 'statement', nil, :size => 40 %>
   <%= submit_tag 'submit statement' %>
   <%= end_form_tag %>    

We use the form_remote_tag() helper instead of the form_tag().
:html option helps to reset the form after completion.
:url option specifies the controller action that receives the form data.
Finally the empty "div id=statement",The id provides a way to reference the element from the RJS template.

Create partial template app/views/examples/_example.rhtml

  [<%= Time.now.to_s(:db) %>]
  <%=h example %>

Create the RJS template: app/views/examples/display.rjs

page.insert_html :bottom, 'statements', :partial => 'example'
page.visual_effect :highlight, 'statements'
page.form.reset 'display-form'

The page object is an instance of the Rails JavaScriptGenerator.
the partial template app/views/examples/_example.rhtml is rendered, and the resulting content is inserted into the bottom of the statements div.

Globalize on Ruby-On-Rails

The Globalize is an internationalization and localization plugin.

• Translates both db content and view text.
• Supports automatic selection of an alternate, localized template for each view.
• Built-in localization and translation of strftime, numbers, and currency formats.
• Supports pluralization.
• All based on three automatically migrated database tables.

I is the best solution to support multi languages for your rails application.
The globalization wiki is not yet complete. But I think the "Get Started" part is fair enough to help you out making your globalized application, it provides very helpful external links.

1. Sven’s Globalize Writeup – has many times been refered to as “the best documentation available for Globalize” .
   
2. Example Application – takes you step by step through the process of creating a Globalized example application.
3. Unit-tested Example – a walkthrough using a test-driven approach by Josh Harvey.