Where's My Gate?

Hi Folks,

I travel a lot. I have almost 2 million program miles just on American.

A couple of weeks ago, I experienced a new one. My wife and I were returning from Orlando and StarEast, connecting through DFW on American. (By the way, we had a great week at StarEast. It was good to see everyone.)

We were stranded in DFW on Friday evening due to the flight being delayed from Orlando so we stayed at the Hyatt in Terminal D. On Saturday morning we cleared security in Terminal D and saw that our gate to OKC was A22. So, we hopped on the SkyTrain and went to Terminal A. As we were walking to the gate, I looked at the monitors and saw to my dismay that the flight to OKC was leaving from gate D28. "Crap", I thought (and said, I think). I looked again just to make sure I wasn't looking at arrivals. Nope, it was D28.

So, we went back to Terminal D. As a sanity check, I looked again at the monitors and the flight was listed at gate A22. The information man must have seem my stunned look and asked if he could help. When I asked "Yes, which gate is the flight to Oklahoma City really leaving from?" He said, "Gate A22, just like it says there." I tried explaining that in Terminal A, the monitors said something different. By then, my wife was threatening to file for divorce.

We verified there was no plane at gate D28 heading to OKC, so BACK we went to A22. Finally, at gate A22 (my critical mistake was not actually going to gate A22 the first time), I told the gate agent that the monitor was showing the wrong gate. Her response? "Oh, those are wrong all the time."

Here's my question. Shouldn't the monitors be getting the data from the same source? Second question. If these are wrong "all the time" should someone be looking in to that? Oh well...at least we made it home. I just won't be quite as trusting in the future.

Now for something completely different....

I keep finding these great videos I intend to share and never get around to it. You really need to check these out.

The "Retroincabulator" - This must have been filmed for the Rockwell Christmas party!

http://www.youtube.com/watch?v=pb7OWlVYYRw

If you liked that, check this one out as well: http://www.youtube.com/watch?v=rLDgQg6bq7o

Watch your grammar. Otherwise, you may be visited by the grammar police!

http://www.youtube.com/watch?v=u9_kahA_wQo

Here is amazing one. Three guys playing one guitar!

http://www.youtube.com/watch?v=lrpwDvuNWro

Finally...Do you have ping pong ball skills? These guys do!

http://www.youtube.com/watch?v=LLByTnNwico

OK...now back to work! Have a great week!

Randy

Project Life

Hi everyone!

I know you may have been wondering if I fell off the face of the earth, got abducted by aliens, or whatever. Well, I have ventured on to a full-time project in San Francisco. This requires that I commute from Oklahoma City each week, which is about 7+ hours each way, including connections. (That is, when I actually make it home without getting stranded someplace!)

Of course, this really constrains my time for blogging and writing. I've also not presented a podcast or webcast for over a month. I hope to get back into that soon.

This has presented some other interesting challenges and changes. For the past 6 or 7 years, I have done about 80% training and 20% consulting. Now, it's 5% training and 80% consulting and 15% travel! I enjoy consulting and getting into the trenches of testing. I'm doing a lot of mentoring, which is gratifying.

I am also experiencing death by meetings. Take today, for example. I had to cancel by participation in one last-minute called four-hour meeting so I could attend attend another more important four-hour meeting (at least they had better food!). I also had to cancel three other meetings because of the two other four-hour meetings. Then, this afternoon, I had back to back meetings from 1 until 6 PM. That's almost 10 hours straight! I look forward to the meetings tomorrow may bring.

OK...enough about that. I'm not bitter, I'm better.

I am posting three pictures I took recently. The first is a rainbow over downtown San Francisco taken from my hotel room on the 30th floor of the Westin.

The next two are also unique. I have found that one of the best places to grab a quick dinner that's really good is in the basement of Macy's across from Union Square. There's a Boudin Bakery (which has some of the best clam chowder and tomato soup I've ever had - and yes, I've been to Boston!), also there's a Wolfgang Puck Express (I love the rosemary chicken there), and other places that are good.




Outside of Macy's nearly every day, you will see people with their cameras and cell phones out taking pictures of this guy. He's got a big dog, a cat that sits on the dog, and a rat that sits on the cat. Now, it's amazing to see them just laying there on each other.

Believe it or not, the other day, I saw him walking his dog, with the cat STANDING balanced on the dog, and the rat resting on the dog. There are many homeless people on the street begging for money. I saw this guy counting his tips the other day and he had a wad of bills. I think that's awesome! He asks for a dollar tip for taking a picture. The way I see it, he's in the entertainment business. I was happy to contribute to a friendly guy with quite a little show going on.


I ought to title this picture, "Can't We All Just Get Along?"












I am also working on two books - Testing Dirty Systems and also one on UAT. I do get some time to write a little in the evenings.

I'm really looking forward to presenting a tutorial, track session and keynote at StarEast in a couple of weeks. Then, I conduct two days of training on use cases and root cause analysis in Kansas City on May 13 and 14. (We still have some seats available - go to www.kcqaa.org for details.)

I also have some other blog posts cued up, so I should have another posting soon.

Thanks for checking in!

Randy

5 IT Roles That Drive Cost Reduction...Plus One.

I just got this e-mail promoting a slide show from Forrester Research about 5 IT Roles That Drive Cost Reduction. Being an inquiring mind, I was curious as to what they had. I was disappointed but not surprised to see that no relationship between quality and cost was there. For example, no mention of QA or testing, process improvement, etc.

When you consider the billions of dollars ($59.5 billion to be in the ballpark, based on a NIST study), that are spent on software defects, it would make sense that this is one gap to be closed.

This also shows me how far the business case for quality has fallen. Back in the last recession (early nineties), Deming was king and U.S. industry was clammoring for anything about quality. Unfortunately, here in the USA we fell victim to the marketing (TQM) and forgot the discipline involved. So, a few years later we had regressed to the same attitudes that had prevailed earlier.

Here's my point. If you want to cut costs AND increase profits, learn from those defects we all experience. Take those learnings and improve the processes, or at least learn how to catch the defects while they are small and less expensive to fix.

I won't list the other 5, you can read the slide show here:

http://www.cioinsight.com/c/a/Bottom-Line/5-IT-Roles-That-Drive-Cost-Reduction/?kc=CIOMINUTE03232009CIO1

Just don't forget my nomination of #6 - Software Quality

Have a great day!

Randy

New Service Offering - Live Online Training in Software Testing and QA

Good Thursday everyone!

I just finished speaking at the Oklahoma City Red Earth QA SIG at lunch today. Thanks to everyone that attended. I spoke on the same topic I'll be presenting as a keynote at StarEast (May 4 - 8). I hope you can make it to Orlando in May. It will be a great conference!

I've been very busy lately. First, we have a totally redesigned web site - same URL - www.riceconsulting.com. If you haven't seen it, please drop by and let me know what you think.

Part of this effort is a new service offering for me. Sure, web seminars are nothing new. However, I haven't used this medium as a standard training offering - until now.

Because the current economy has forced many companies to cut training budgets, travel budgets, etc. Since 2001, I have been working to deliver online training in effective ways.

So far, we have a great line-up of pre-recorded training courses, which many people have found a great way to balance time, money and content.

However, some people just like live training - and that's fine. The problem is that it's not always feasible to have me live at your location.

Imagine having your team of any size in any number of locations linked together, being taught live! You can ask questions, make comments and work on exercises - just like if I was at your site.

We've been doing this type of training on a limited basis for several years. Now we are offering it to you and your team at very affordable prices. You pick the course and we work together to set the outline and schedule.

The possibilities are many. You can have:

• a 3-hour morning session and a 3-hour afternoon session
• a 3-hour morning session or a 3-hour afternoon session, conducted for as many days as needed to complete the course. You can train half the day and still work on your projects.
• a weekly session of 3-hours on the day of your choice

(the 3-hour sessions have a 15 minute break at the 1.5 hour point)

Example: Your team can take our Basic Training in Software Testing course (a 2-day class) in four 3-hour sessions! All-day Monday and Tuesday, or just in the mornings or afternoons four days out of the week.

Here's the best part - the pricing!

Because of the current economic conditions, I am going all out to help. Each 3-hour training segment is priced at $500! Course books can be printed and shipped to your site for roughly $30 per book in the USA. For international pricing, please contact me for options.

So, you could have your entire team trained live online in a 2-day class (4 sessions) for $2,000 plus books. No travel expenses, even if your team is located in multiple locations. A one-day (2 session) class would be $1,000, plus books.

There are some logistical details that have to be planned, such as getting a training room with projector, computer with Internet access, and having someone you can designate as an on-site facilitator.

If you want to learn more, contact me by e-mail or call 405-691-8075. Let's keep building those skills so you can do more with less!

Today's Webcast on Charting For Root Cause Analysis

Help me test a new platform for web seminar delivery!

Today, March 13, 2009, 12:00 Noon Eastern Daylight Time I will be conducting a live web tutorial at:

http://webmeeting.dimdim.com:80/portal/JoinForm.action?confKey=rrice

The topic will be Charting Events for Root Cause Analysis. In this session you will learn how to diagram a timeline of events, identify contributing causes, and hopefully, identify the root cause of a problem.

You can download the notes here:

http://www.riceconsulting.com/public_pdf/charting_for_root_cause_analysis.pdf

This is a free session and is limited to 24 people, so please arrive a little early to get a spot. The session will last one hour or less.

Also, please understand that this is also a test. We may experience some problems, so please be patient in that regard. The audio should play over your computer speakers.

I hope you can be there!

To hear this session, click here:
http://recordings.dimdim.com/view/dimdim/da27f404-6136-102c-9991-003048944478

To download the session, click here:

http://recordings.dimdim.com/saveflv/dimdim/da27f404-6136-102c-9991-003048944478

Randy

Getting Started in Root Cause Analysis

Today's podcast will be on the topic of "Getting Started in Root Cause Analysis". This is a topic that many people are interested in, and another one of the ways you can do "more with less" in software testing and QA.

To listen live toady at 12 Noon, EST, just go to:

http://www.talkshoe.com/tc/27009

You can call in or type in your questions. After the live session, you can visit the same link and listen to the recorded call.

Here are the notes for today's call:

http://www.softwaretestingtrainingonline.com/public_pdf/getting-started-in-root-cause-analysis.pdf

I hope to see you in the podcast today!

Thanks,

Randy

Five Ways to do More With Less in Software Testing

It seems that many test managers are in the squeeze of tight testing budgets or no budgets at all. That means there is a lot of interest in doing more with less. The economy is bad, but we still have the need to do software testing well.

While I understand the need for efficiency in today's economy, this is not a new message. When I first started training in software testing back in 1990, there was a recession underway. There was also a quality crisis as U.S. manufacturers were battling against higher quality foreign imported items which included everything from VCRs to cars.

We learned how to recoup for the cost or quality with high-quality methods. This is what Phillip Crosby wrote about in his book "Quality is Free". In IT, however, the message of the economy of high quality has been lost over the years. In fact, in recent years I have found that senior IT and business management in many of the companies I have worked with will spend lots of money and take lots of risks with little to show for it.

So, for this window of time (hopefully a small stretch of time), the kinds of things I'll be discussing here have a home in the minds of people. However, the principles are profitable in any economy and we need to remember them.

#1 - Know What You are Doing

The number one value of training and skill building in my opinion is to learn the best and most efficient ways of doing things. After all, someone with no training could attempt just about any job but the results wouldn't be very good in most cases.

In software testing, there is a popular misconception that anyone can test. I have learned that many people have the ability to test, but there are skills that must be developed before someone can do a decent job of testing. And, some people just don't have the mindset or patience to be a good tester.

Training is how you learn what to do at the right times. Repetition is an important part of the training process. So, a three-day class once a year isn't enough to build skills.

Training can be expensive, but doesn't have to be. There are effective options:

* Self-study on the web and by reading books
* Team study such as reading and discussing the same book for a month or more
* Design and conduct your own in-house mini-course
* Have someone share a great new technique or tool at each test team meeting
* Webinars and teleconferences
* E-learning - its better than it used to be!

#2 - Reuse What You Use

This is really basic, but can be a big timesaver. If you have a good test plan or test strategy for one project, make a template and use it as the basis for other projects.

This idea can extend to detailed test design and test automation.

Perhaps the hardest part of reuse is managing the items as they are shared. This is the situation when people share and reuse test cases and test automation. There must be control over the items.

#3 - Define Tests Efficiently

There is an economy of testing. More tests are not necessarily better. In fact, each test case you have is one more you must maintain and perform. If a test case isn't adding specific value to your understanding of the software under test, you should consider why it is in the test.

Many people are surprised that once they start to analyze combinations of tests, how few tests they actually need.

While not every project is a good application of pairwise testing, it is a good technique to explore and try.

#4 - Automate Well

There is a great potential in good test automation. Some have realized this value is actual practice while others still struggle. In my experience, test automation is one of those areas where you can spend a lot of money in a hurry with little to show for it.

There are some free test tools such as FitNesse (www.fitnesse.org) that can be helpful, as well as scripting languages. Other free tools are at www.opensourcetesting.org.

It's good to learn the lessons of automation on the free and less expensive tools before moving on to the more robust and expensive tools.

#5 - Learn From Your Defects

Each defect tells a story. If you take the top 10 defects (as measured by the frequency and impact) in the previous month and perform root cause analysis to learn why the defect occurred, you will make significant strides toward improving your processes. The main investment in this effort is time. It will also take management support to fix the processes. However, these are things you can often do with very little direct cash outlay and they yield big value.

#5.5 - Bonus - Write and Use Checklists

Checklists are easy and inexpensive to create. They help improve processes and prevent mistakes. They also add consistency as to how things are done. If you don't believe me about the value of checklists, ask a pilot.

Summary

Going back in time again, one of the first books I read when starting out as a consultant in the early 90's was Jerry Weinberg's, The Secrets of Consulting. One of the laws is the "Law of Raspberry Jam", which basically says the wider you spread something, the thinner it gets.

Like jam, you can only spread people and tests so far before they lose their effectiveness and value.

We should be lean and mean in our testing because we just don't have the luxury of time (and right now, of money). So it's a good thing to learn efficient ways of testing. Just remember there are limits.

To hear my podcast on this topic, visit http://recordings.talkshoe.com/TC-27009/TS-182201.mp3

Software Testing e-learning

One of the best ways to stretch your training dollars - whether you are paying for training personally or from corporate accounts - is to consider e-learning.

Not only does e-learning cost less than live public or in-house training, it is a great solution for people who don't have the time to devote 7 or 8 hours (or 2 - 5 days) for training.

Studies have shown that e-learning is just as effective in getting the information across as live training. I think it may be even more effective because you can repeat material as needed. You can't do that in a live class.

It's also a great way to make sure everyone gets the same training no matter where they live.

And...for those training managers concerned about any trainer behavior (jokes, comments, etc.), e-learning is safe. No profanity, no inappropriate remarks, etc.

I have found that the key for effective e-learning is to interact with the instructor. That's why I offer teleconference sessions for my e-learning participants. You get the chance to ask questions and interact with me. Of course, I am always reachable by e-mail and try my best to answer questions by phone.

These are just a few of the benefits of e-learning. If you want to learn more about my e-learning courses (I have 13 of them now, including an ISTQB foundation level course), just visit http://www.riceconsulting.com/training/e-learning.htm.

To experience free demos of any of my courses, just visit http://www.softwaretestingtrainingonline.com/moodle and select the demo section. You can login as a guest.

To buy a course, just visit www.mysoftwaretesting.com. We have a sale on right now!

Riceconsulting.com banned from Google

Well, the saga continues. Because of the redirects on my site, then my subsequent removal of the malicious links, I have been banned from Google. I'm not upset at Google - I understand their need for maintaining integrity in the search results.

It is frustrating to go from the #1 listed site for "software testing consulting" and the #4 site for "software testing training" to not even being in the search results at all.

So, if you are looking for me on the web, I hope this post helps you to find me.

I have gone through the steps to request re-inclusion and hope to be back in there soon.

Battling the Russian Hackers

I've been having an interesting time the past few days dealing with a bot attack on my web site. Don't worry - if you are a customer for my e-learning or anything else that required credit card payment. Your information is not kept on my server. Several months ago I got out of the shopping cart business and went with Volusion.com. Volusion is PCI certified and is as secure as it gets.

Also, my Moodle e-learning environment is on a new secure server as well for several months now.

So, here's what happened. I hope this helps someone else defeat these guys.

In early December I noticed that my home page at riceconsulting.com was no longer an html page, but rather a php page. Also, my htaccess file had been changed to point to this new php file. I called my web host and they didn't know how it had been changed. So, I changed my ftp password and changed things back.

Last week, this happened again and I changed it back again to index.html. The next day the home page was index.php again.

After doing some research I discovered that my old version of Moodle still on the site had vulnerabilities which allowed the attackers to place the first Mad Shell script. So, I deleted every php application on my site. I also got rid of some old cgi scripts.

Then, they messed up. That's why I think it was just script kiddies.

They added a new file, named after one of my other pages, but appended with .php. By listing the main directory in my ftp client, I found the recent change.

I looked at the page source and found an encoded script on the page, which I was able to identify as Mad Shell. Now, this is a powerful script. It allows an attacker to do anything an ftp program can do. If you want to know more about Mad Shell, visit this blog.

I deleted that page, changed my htaccess file back to normal and started watching the server logs.

Sure enough, about 10 hours later, another change!

So I started studying the server logs again. This attack was using a redirect to bounce traffic from Yahoo Slurp through my site and on to a site selling drugs that enlarge things.

I was able to identify exactly when the redirects started happening again in the log and found two deeply embedded files - both newly created as php files. So, I deleted them. They had tried to hide them deep in my folder structure, but sorting by modification date helped find the folders.

Finally, that stopped the attack.

Here are my lessons learned (you may see others - if, please comment):

1) Whenever you introduce an application to a web site you are very likely to also introduce vulnerabilities. This is especially true for php apps and even more true for open source php apps.

2) Don't leave unused apps laying around on the site. I'm the kind of person that doesn't like to throw things away. In this case, I should have!

3) Take those security updates seriously. However, in the case of open source, you may not be notified of a vulnerability. It helps to keep an eye out on the support boards for the apps you use.

4) Keep an eye on your server logs and visitor stats. I have known for some time that bots kept hitting my site, but that's just the deal with bots. Every web site owner deals with bots. However, the server logs can be very revealing.

5) Don't expect much help from the web host. While a couple of people at my web host were informative and helpful, one guy told me to "do a Google search" to learn how to secure my files. I was looking for some specific ideas and his response was one of the most unhelpful. Back in December when I was asking support for reasons why my htaccess file had changed, they didn't have a clue. I would expect a tech support person with about one week of experience to suggest that an attack might be occurring. I think I'm ready to change hosting service providers.

6) Stay vigilant and fight back. These attacks can be defended and defeated.

Now, hopefully, it's on to more productive work!

Calling All Dashboards

In my December newsletter I asked for any of you that have created and/or maintained software testing or software project dashboards to let me know some of the most helpful metrics you track on those dashboards. I have received a few responses, but could use a few more to get a good sense of trends.

The reason I'm asking is because I am working on a keynote presentation for StarEast 2009 on that topic. It would be good to share the most popular dashboard items as described by you, my loyal blog readers, clients, students and friends (hey, some of you may be in all three of those categories!).

In case you are wondering what a testing dashboard is, you can view and listen to my original presentation here: Keeping it Between the Ditches - A Dashboard to Guide Your Testing. It's about 35 minutes long.

By the way, for all those who submit their ideas, I will send a copy of my StarEast presentation.

Also, I hope you can join me and my special guest Fiona Charles on Friday, January 16th at Noon Eastern time as we discuss the new book "The Gift of Time". This book is a tribute to the life of Jerry Weinberg and is a collection of essays by people like James Bach, Michael Bolton, Ester Derby, Johanna Rothman and many others.

I think you will leave this teleconference with wisdom and insights that Jerry Weinberg has imparted to us that can add a new perspective on "why" you do "what" you do in IT.

This Friday (January 16th) at noon Eastern time, you can get in on this call. You can also call in to ask your questions live!

There is no cost for this call, except for the long distance charges if you choose to call in. (You can listen free on the web.) If you can't be there live, it will be recorded for later listening.

Just go to http://www.talkshoe.com/tc/27009. The call in number is (724) 444-7444 Call ID: 26874 The start time is 12:00 EST (Friday) and the call will last no longer than an hour.

Once again, you can listen over the web and ask your questions by text message if you are in another country or just don't want to call in.

Thanks!

Randy

New Year, New Goals

Happy New Year everyone!

It seems that everyone I've been speaking with over the past week or so is really glad we have 2008 behind us. I am, too, but I'm not very sure 2009 will be better (at least in terms of the economy). I hope it is better, but I like to keep my expectations in line. We have pretty big challenges as a country and world.

I try to avoid making New Year resolutions because they are so easily forgotten. Instead, I try to focus on goals. One year, I made a list "10 things I want to remember" for the coming year. That was interesting to bring to mind throughout the year the important things.

I have some pretty major goals this year:

• Finish three books I have in progress
• Get about six more e-learning courses produced and out on the website.
• Develop some test strategies and content for cloud computing (Thanks, Mike for that suggestion).
• Contact at least two people in my network each day, just to stay in touch (so don't be surprised if you get a call from me).
• Complete my advanced level test certification (one part down - two to go!)
  
• Actually publish my newsletter every month this year!
• I'm also working on this major project to document all of the processes used in my office - all the way from accounting to website maintenance.

Then, there are my personal goals: books I want to read, people I want to develop deeper relationships with, a better use of my time, and then the big one: to organize my office!

I also have this car restoration project (a 1949 Plymouth) I would like to finish while my dad is still alive to see it and ride in it.

One more thing - My goal is to journal each day. I have been hit and miss, but at least have been doing it for a few years. Back in November while in London I was able to stop by Harrods and get their 2009 Diary, which I find perfect for journaling. Plus, it's expensive enough to give me the incentive to actually use it.

I learned a great tip on this from my mentor, Jim Rohn. Mr. Rohn says that it's good to have a notebook with loose leaf pages for all my projects. Each project gets a tab. Throughout the year I will make notes about how each project is going. On the journals, the one time I spoke face to face with Mr. Rohn he told me that if I stay consistent, one day I'll have an entire shelf of journals to document for my kids and grandkids my ideas, experiences, pictures and thoughts. Today, I look at my shelf and I have about ten of those books. My goal is one book per year.

I hope this prompts you to make a short list of things you would like to do, be, or experience this year. It's easy to dismiss goals, like resolutions. But they really do propel us forward and give a chance to review at the end of the year the progress we have made. For me, if it's not a goal I probably will get distracted and not do it.

Your goals might be:

• To learn a new skill
• To visit a new place
• To make a new friend
• To be better at what you do

Just remember, it's not the economy that determines our success or failure - it's your outlook, faith and philosophy. There are always people that do well in bad times as well as good.

I hope you comment on this post and share some of your goals and thoughts about the New Year!

Blended e-Learning Gets Higher Grades

As many of you know, I've been working on making e-Learning an effective and attractive method for skill building in software testing. The number one thing I have learned is that there must be interaction with the instructor to make the learning effective. This interaction can take many forms - e-mail, phone, chat sessions, teleconferences, etc. That's why in my e-Learning courses I include live call-in teleconferences at talkshoe.com. My goal is to do 90% of my training this way!

One of the tools I use for creating e-Learning content is Articulate. It creates Flash presentations from PowerPoint and has a nice interface with many good features such as bookmarking, notes, attachments, etc. I ran across an interesting post on the Articulate blog recently about how one college professor compared the grades of two similar classes - one using traditional classroom teaching only and the other using blended learning (e-Learning with live reinforcement).

From the report: "A technical report from a University of Houston Department of Health and Human Performance researcher finds that students in a hybrid class that incorporated instructional technology with in-class lectures scored a letter grade higher on average than their counterparts who took the same class in a more traditional format."

You can read more here:

http://www.articulate.com/blog/use-articulate-get-better-grades/

So, why is this important to testers and managers? I think the way we build skills is as important as the skills we build. Training and skill building can be transforming and exciting, or it can be torture.

Some people look forward to a day of training (for more reasons than just getting away from work) while others dread it. When people get excited about learning, amazing things can happen. The link to the Articulate blog is interesting because it goes "behind the scenes" in the theory and practice of e-Learning.

As testers and managers, we must learn about learning. We need to understand the different learning styles, attention spans and what works in training adult learners. My observation is that it's the people that don't care about how to make training effective that are the worst trainers.

By the way, as my way of saying "thanks" for reading this post, here is a link to one of my conference presentations (The Risks of Risk-Based Testing) created using Articulate:

http://www.riceconsulting.com/articulate/risks_of_risk_based_testing/player.html

Best regards,

Randy

COTS Testing Course is Now Online

I'm excited to announce the launch of my 14th e-learning course, Testing Commercial Off-the-shelf (COTS) Applications. This online course gives you the approaches you need to test commercial software. Many organizations, especially government, have been building systems comprised of commercial software. However, problems arise when people try to integrate the products to work together. Many people work under the misconception that all you have to do is buy the software, install it, maybe configure a few things and then start using it. Unfortunately, the truth is that there are a lot of things the vendors can't test. This course will lead you through a process of testing COTS products all the way from selection through maintenance.

To see a free demo of this course, just visit http://softwaretestingtrainingonline.com/moodle/course/view.php?id=45. To buy a registration, go to https://www.mysoftwaretesting.com/ProductDetails.asp?ProductCode=COTS101.

To see all the details about my e-learning courses and how they can help you build your skills on your own schedule, visit http://www.riceconsulting.com/training/e-learning.htm.

Thanks!

Merry Christmas!

Hi friends - Just a note to wish you all a very Merry and Blessed Christmas. To all my Jewish friends I wish a Happy Chanukah.

At this special time of year I will be thinking of all my friends around the world and will be enjoying time with family here in Oklahoma.

Regardless of your beliefs, my wish is that the Prince of Peace will be real to all of us this year.

Warm regards,

Randy

A Good Resource for Government Computing Projects

I am working on a new book project about software failures and I came across this resource from the Center for Technology in Government at the University at Albany especially aimed at government computing projects. The name of the report is Making Smart IT Choices - Understanding Value and Risk in Government IT Investments. You can get this at http://www.ctg.albany.edu/publications/guides/smartit2. In fact, you can download the entire book as a pdf file.

I like this book because it hits at the heart of IT projects - making the right choices based on risk and value. It's all common sense stuff tailored for the government sector. It proves that the answers are in plain sight. Now, the tough part is to actually act on them.

My experience is that the hard part is dealing with the stakeholders who want something different every day and the vendors who are more than happy to promise it to get more money by stringing the project out almost forever. We as taxpayers end up paying the enormous bill for this nonsense.

Doing the research for this even makes me sick, but I am glad there are those out there at least shining a light in the darkness of many IT projects.

Book Review - Clean Code by Robert C. Martin

"Clean Code" by Robert C. Martin
Published by Prentice Hall
Buy at Amazon.com -
http://www.amazon.com/gp/product/0132350882?ie=UTF8&tag=randyricessof-20

(5 stars out of 5)

I knew I was going to like this book after I read the Foreword and
Introduction. I know not many people read those and as an author
myself this bothers me, but it gives insight to why the author has
written the book, which is a very important thing to understand. I
was hooked by the affirmation that details are important and that
the only meaningful metric is the number of "wtfs" per minute in a
code review. For a long time I have kept my "profanities per test
session" metric as a way to measure software usability.

Long before I was a software testing guy, I was a coder. Back in
those days it was common for rookie coders to sit next to guys with
gray hair and bad breath (or if lucky next to ladies with better
appearance and who smelled better) to learn the craft of writing
code. Yes, coding was a craft before the attempt to make it an
engineering discipline. Although there was a lot of bad code, there
were plenty of people who took pride in how they coded. This book
reminds me of what it was like to sit next to these intelligent
people as mentors.

I have often lamented that today's young coders don't have this
mentor/apprentice relationship. A reasonable facsimile would be to
read this book and practice these very sensible and helpful lessons
in coding. As a testing guy who has been through those 30 wtf/hour
code reviews, my bulletin to developers is that: Your code can be
better! This book can show you how!

Here's one example: Have meaningful names. Instead of a function
named "int d", how about "int ElapsedTimeInDays;"? There's a whole
chapter about naming things. It reminds me of the coder I knew that
liked to label COBOL paragraphs after towns and cities in Kansas.
Why? So he could write GOTOs that read "GOTO Topeka." He thought
that was cute but the rest of us found it confusing and not-so-cute.

I also appreciated the chapter on Unit Testing. As a tester, I love
it when testing is mentioned, but Martin actually has specific
guidance on what makes for good Test Driven Development and Unit
Testing.

This book is very readable, makes a lot of sense and would make
most coders better. For testers that sit in on code reviews, this
would be a great read for understanding how good code should be. I
wish every coder in college or tech school would read this book
before unleashing their creations upon the world.

Skills for Software Testers in the Future

Last month I delivered a keynote address at EuroStar on "Trends that May Impact the Future of Software Testing." There were some interesting questions following my talk, one of which I would like to discuss in this post. "What do you see as essential skills for testers in the future?" Great question.

First, let me say that the list could be long and your list probably will differ from mine and that's fine. In fact, please comment with your answers to this important question.

Skill #1 -Thinking Skills

Too many testers fail to think through what they are doing and why they are doing it. They also fail to use imagination and instead rely on a repository of knowledge somewhere that is probably outdated and incorrect. Sure, we can curse the darkness of bad documentation, but we've been doing that for over 30 years already so let's get over it. Let's light a few candles to illuminate the subject of hidden understanding.

So, for example, when doing a boundary test, ask, "Is this test meaningful?", "What will it prove or disprove?", "Are there more important tests that I haven't done yet?".

As testers we have to be very careful about falling into ruts and thinking the same way all the time. Learn to look at problems from different angles.

I like to play thinking games just to stay in practice. One game that is helpful for test teams is "20 questions for software". I improvised this game in a class on exploratory testing when only I had my computer at the front of the room. Here's how it works. The leader (perhaps you) are at the front of the room with an application projected on a screen. Then, go around the room in order (a u-shaped room or circle is best), with one person starting the questioning of the application. They should ask a question such as "What happends when you...(fill in the blank)?". Then, the person next to them asks a question based on their question. This continues around the room, maybe even multiple times. There are only two rules: 1) you must wait your turn, and 2) your question must be based on someone else's question or answer before you.

You may be surprised about how much you can learn about the application by doing this. You may also be surprised (perhaps dismayed) about the quality of questions. This gives the team leader insight into where to develop the thinking skills of the test team or individuals on the team.

I also like to work Sudoku puzzles because they require deducing, eliminating possible solutions to find the right number(s), and using other thought processes that are the same as used in exploratory testing. I've never tried to work one puzzle together as a group, but that would be an interesting experiment.

Skill #2 - Communication Skills

I believe that communication is the basis for everything else we do in IT. Without good communication, we can't even define the problem to be solved, much less define the solutions to the problem or the testing of the solutions. Ironically, communication is the last thing we take training for, or practice, or apply in the workplace.

Testers especially need to be good communicators in the following ways:

Accuracy - People must be able to trust the accuracy of test results and other information from testing. Once the accuracy slips, so does the credibility.

Timeliness - Timely communication helps people to form good responses to problems, take advantage of opportunities, and generally work together better. Sitting on bad news, hoping for it to become better news, is not a good approach.

Thoroughness - Telling only part of a story is as bad as giving inaccurate information.

Courtesy - How people say things is just as important as what they say.

Helpfulness - Overall, the information a tester provides should help the rest of the project team to fix issues, make improvements and deliver a great project on or ahead of schdeule.

Meaningfulness - The information must have value to the audience, otherwise people will disregard it as "just another report" that may or may not be read.

Skill #3 - Measurement Skills

When you think about it, testing is measurement. However, we as testers often struggle with what to measure, how detailed the measures should be, what to do with the measurements, etc.

It takes skill to know what to measure without going overboard. It also takes skill to make the correct interpretation from the measurements and metrics. But how does one build these skills? I'm going to suggest a radical approach. Don't start by reading books on measurement, unless they are basic.

Like many things, including testing, we are up against Parkinson's Law that says "work expands to fill available time." My variation on this is that simple things can become complex just by writing books, having conferences, etc. As an example, function points started as a fairly simple idea but then evolved into more complex ways to count and apply them. So when you read a book on measurement your first thought may be that you need a large set of measurements to "do it right."

Instead, simply look at what needs to be improved and find two or three things to measure that could show progress in meeting those goals. You can also consider a typical project and what you need to know to stay on track. This is the dashboard concept. Have five or six indicators at the high end.

Then, find ways to measure without being intrusive. This in itself can be a big challenge. That's why simple is good.

Skill #4 - Configuration Management Skills

CM has always been an essential skill for testers. After all, what good is it if you test the wrong version or configuration of the software?

With virtual environments, it is even more important to know how to manage them. At this point, you may be thinking, "Yes, but the tool has features for that." Consider though, that a tool is not a process.

So testers need to know how to control all the items in the environment - software, hardware, data, and any other system components.

Skill #5 - Technical Skills

This is an interesting debate. How technical does a tester need to be anyway? On one hand, it is the lack of technical perspective that gives testers the same view as users. Too much technical knowledge and they may apply workarounds that users would not think of, therefore not seeing problems from a true user perspective.

The term "Technical Skills" is a fuzzy one, so I'll clarify my meaning a bit. The technical skills I refer to here are those that allow testers to use new tools and approaches effectively. I don't believe that testers need to be coders, although sometimes that skill comes in handy. But, if a tester likes to code and they can maintain objectivity, it does open some options.

I believe it is a mistake to eliminate a tester from hiring consideration just because they can't code or work with a particular tool. There are simply too many other needed skills and attributes to limit the decision to technical skills alone.

It's like being in a swimming pool and being able to go in the deep end as opposed to just staying in the shallow end. While we can all be in the pool and have fun. Some will be able to do more advanced things, like diving and snorkeling. It's not about worth or value, but about the ability to experience different things. So, if an inexperienced swimmer gets thrown into the deep end, it's "sink or swim", and that can sometimes be a dangerous thing. You may have experienced that "over my head" feeling.

Another example is owning and driving a car. Some people are happy just driving the car and keeping it filled with gas and having the fluids changed on schedule. Others want to get more involved in their vehicle's maintenance and repair by doing things such as changing the oil, replacing air filters and spark plugs, replacing fan belts, hoses and brake pads, etc. A few braver souls with older cars get into major engine repair or replacement. All of these types of car owners can drive the car well. Some can perform maintenance but due to time issues prefer to have the work done for them. All are valid owners and I would rather be on the road with good drivers who know little about auto maintenance than bad drivers who can replace engines in a day.

At the end of the day, the answer to this question of should a tester have technical skills may be a firm "it depends!" It depends on the person and their abilities, the projects they work on and the types of testing their job requires them to perform.

Skill #6 - Business Skills

Testers need to be able to speak the language of business. How can we as testers expect to be invited into business-level meetings if we don't understand the culture and language of business? This is more than just understanding business processes. We must know what's important to the business - profits, market share, strategic goals, markets, growth, legal, return on investment, and trade issues.

So, these are some of the important skills as I see them. Agree or disagree? I would like to hear your comments and ideas!

Leadership by the Book

I ran across this online article in Federal Computing Week. It's an interview with Dave Wennergren, deputy chief information officer of the Defense Department. It struck a chord with me because I'm such a believer in reading as a form of personal development and skill building.

It's not how much you read, but what you read and how you apply it. You could read a book in one day and get nothing from it, or you could read a page a day and get a nugget of wisdom each day.

Unfortunately, too few IT professionals read books or articles about our profession. Testers are no exception. When I meet people in IT or not, I can normally tell within 10 minutes if they read very much.

For the price and payback, books are a great value. A $50 book can well contain thousands of dollars worth of valuable ideas and advice.

When faced with a problem, I usually ask myself, "Who can I ask?", or "What can I read?" to get a solution.

Here's a great quote from this article:

"When I was the Department of the Navy CIO, I started a leadership forum called Expanding Boundaries, which I have now continued in my DOD job as Expanding Horizons. The idea is to get the leadership team together once every couple of months, read a good book and then discuss how we could apply the book, to our work and our lives. It’s been a great way to understand the art of the possible and best practices, but even more importantly, it has helped to align the leadership team, improve trust and serve an idea creation engine as we strategize about next steps in our information transformation work."

One challenge that teams have is to communicate together well. This would be a good venue to help break that ice.

So, here's the assignment. Read this article, then let me know your thoughts.

Thanks,

Randy

The Sports Secret to Building Software Testing Skills

Every once in a while, I'll run across an airline magazine article that really catches my attention. Yesterday on my way to Harrisburg on Continental, I read this article about how collegiate and professional sports stars improve their skills. I couldn't help but think of all the parallels to many of the concepts I teach in my Becoming an Influential Test Team Leader tutorial. Namely:

1) To improve a skill, you must focus on it like a laser beam. Improvement often occurs a little bit at a time (painfully slow at times), but then sometimes you have a breakthrough moment.

2) You must be willing to move out of your comfort zone to improve. Don't just work on your strengths, but also your weaknesses. Actually, I teach becoming exceptional in your strong areas and not to worry too much about the weak points. While I still believe in this philosophy, I also believe that we can all work on our weaknesses to become more well-rounded.

3) A good coach is willing to place a player in a position to fail so they will learn and improve. The player must also have the mindset that failing is an essential part of improvement.

Here's a quote I liked in the article from Steve Bzomowski, a former NBA scout and founder of Never Too Late Basketball Camps: “Pros take themselves seriously. And even though recreational players aren’t going to become pros, there’s no reason for them not to take themselves seriously. We’re always preaching, ‘Respect the game.’ So when you don’t run the court, you’re not respecting the game. Play the game right.”

So, testers, take heart. Identify your strengths and weaknesses. Practice on both, remembering it's OK to try things and fail - if you learn and improve.

Wrapping Up in Rome

It's been a busy week for me here in Rome as I taught two public classes - Software Testing and Advanced Software Testing. Thanks to all the participants that made it a great experience. I look forward to a return trip in June.

In the Advanced class, we got into test efficiency techniques and how to design tests that are creative and challenging. We also discussed test metrics and how to use them to improve development and testing.

It's hard for me to remember to slow down my rate of speech when speaking through an interpreter. Italian requires many more words than the English equivalent. And forget humor. It just gets lost in translation. I really do appreciate my two interpreters and the other support during the class. You guys are the best!

Sunday was my only sightseeing day. I've been here twice before, last November and last June, so I'm getting to know my way around pretty well. My next goal is to learn more than six words in Italian!

I had not been in the Castle St. Angelo yet, so I decided to check it out. I'm glad I did. The views are spectacular. If you explore around you can go all the way to the top, which allows a full view of central Rome. It's a great value for just 5 Euros. Muphy's law was at work, though. I was taking pictures throughout the castle but when I got this wonderful view - dead battery in the camera.

Fortunately, my hotel is close by so I went back and recharged for an hour, then returned to the castle. They let me back in and I took the pictures.

Here's a travel tip: Always take a spare ATM card. In Europe, the ATMs require fully inserting your card. I like the swipe option because I don't temporarily give up my card. Sunday I was trying to get some cash from an ATM and for some reason, it kept my card. Had I not been teaching on Monday, I could have gone to the bank and retrieved it, but since the banks close at noon and at 4 P.M., I had no options except to report it lost and use my spare at a different bank closer to my hotel.

Tomorrow I head home but have an overnight layover in London. It has been a great trip, but I am ready to be home and celebrate Thanksgiving!

Travel Tips Around the Hague (World Forum and Museum Area)

As a traveler, I always like to pick up and share helpful tips when possible. I like to be a traveler instead of a tourist. As a business-oriented traveler, this can be challenging. For example, instead of paying $30 for breakfast at the hotel, I like to experience local color and less expense.

So while I was staying at the Golden Tulip by the World Forum in The Hague (which I thought was a great place to stay), here are some little finds:


Right around the corner and down the block there's a little coffee shop. It's right on the #17 tram line after the museum stop. That's where locals gather in the morning and have coffee and breakfast. The owner fixed me a great breakfast of fried eggs, bacon and real coffee (brewed - not the Americano-style) for 3.20 Eur. It was great! I ate there three or four times in all. If you explore around, you will find a shortcut trail that takes you from the coffee shop to the World Forum.



Find #2

I am on a two-week trip, so I must do laundry, or have it done for me. Hotels charge an arm and a leg for this, so I scouted out this self-serve laundry just a few blocks from my hotel in the shopping district, which is only 3 - 4 blocks from the hotel. I was able to do two small loads of laundry for 12.50 Eur. While I was doing laundry, I browsed in the many stores in the shopping area. If you have trouble finding it, just ask the people in the coffee shop!

By the way, there is also another laundry just down the street.


Find #3

The shopping area just blocks from the hotel has almost anything you might need on a trip: clothing, groceries (there is a large store there by European standards), banks (ATMs), drug store, carryout pizza, restaurants, hardware, a copy shop, bookstores, amazing bakeries, chocolate and cheese stores, and more. Just watch out for the chicken wings - they didn't agree with me.



I hope these make your trip to the World Forum in The Hague a little easier and more interesting!

Thoughts About EuroStar 2008

I thought EuroStar 2008 was a great conference. The tutorials, keynotes and tracks were strong in my opinion (I must also say I want to give my perspective as an attendee as well as a speaker. It's hard sometimes to step back and be objective, but I'll try.).

One of my tests of a good conference is whether I'm torn between attending track sessions - and I was. I also spent a fair amount of my time in the interactive sessions, such as the ones on the testing manifesto and testing standards. It was nice to be working on things to advance our testing profession. I'm not sure where the whole testing manifesto thing will wind up. I hope it is someplace similar to the agile manifesto - something simple, meaningful and easy to read and remember.

James Whittaker was his insightful and entertaining self (that video he shows about the future of medical software is amazing and shows we're going to need better testing). His talk was "The End of Testing as we Know it", and I felt all the keynote speakers made me think. James Lyndsay spoke on "Becoming Agile - Reshaping Testing for an Agile Team." He had great points and I'm always impressed by the simplicity and impact of his slides!

The expo was amazing. In the U.S., the exhibits tend to be rather bland. In this show there were two coffee bars, a cocktail bar (I had a smoothie), a chess match, a bicycling competition, etc.

They had a contest where if you got all the exhibitors to stamp your card, you could enter the drawing. So, I computed my odds (about 1 in 30, I figured) and went for it. The grand prizes were two free passes for next year's conference and eight Nintendo Wiis. All I wanted was a Wii. Guess what? I won a conference pass. I didn't factor that in my odds! Oh well, I don't have the luggage space or weight anyway.

The gala was also fantatstic. It was held in the Grote Kerk, which is a former cathedral. It was big night for me, winning the best tutorial award. Thanks so much to the 60 or so people in my "Becoming an Influential Test Team Leader" tutorial that made that happen. It was totally unexpected! Much more important than the award was that we experienced and learned things together that will help us be better in our leadership roles.

My prize was a beautiful 9 pound Waterford crystal vase which I will find a great place for at home. Thankfully, security in the U.K. has relaxed security rules to allow two carry-on pieces of luggage!

One other thought concerns model-based testing and how it differs in Europe than in the U.S. - At U.S. conferences, model-based testing is often presented as a manual process. In Europe, they talk about the tools that can make model-based test design happen faster and more completely than using manual methods. I just thought that was interesting.

Dot Graham will be the chair for next year's conference in Stockholm, Sweden. I wish her all the best!

I would like to thank all the kind people who helped me feel right at home. Many thanks to the Qualtech Conference team - Tracy, Siobhan, Lorraine and others. Also, thanks for the conference committee for selecting my talks and to John Fodeh for my keynote introduction and to Bob van de Burgt as conference chair. You all did a great job!

Greetings from The Hague and EuroStar 2008

I've been pretty busy since StarWest, so I haven't blogged any since then. Hopefully, I'll make up for that on this trip to The Hague and Rome. I plan to blog on three topics the next couple of weeks: 1) Highlights from EuroStar, 2) My thoughts on the economy and software testing, and 3) Travel tips for The Hague and Rome - complete with pictures.

The flight over went well - as good as it gets in coach on American Airlines. In the airport in Oklahoma City I discovered I forgot my power supply for my MacBook (Darn - I didn't use my checklist!). The Apple factor introduced a complexity factor because the airport shops assume nobody owns a Mac! So, using my iPhone in Dallas, I saw there was a PC World store in Heathrow which carried Apple accessories.

I had a five-hour layover at Heathrow in the new Terminal 5. It is an amazing place. And yes, I found a power supply for my MacBook at a great price. Even with the exchange rate, I was happy to pay it!

The British Airways club there is awesome. Man, the American Airlines' Admiral Club could take some lessons from them. They have all sorts of food and drink at no charge (of course there is the elite status required), plus wi-fi included, and one of the best things after a long flight are the individual wash rooms. This all made the long layover not so bad.

I was surprised that BA had food service on my 45 minute flight to Amsterdam. We don't even get pretzels anymore on US airlines!

Luggage is often a challenge when travelling solo overseas. I took the train down to The Hague. I had a large suitcase plus a duffle bag for my computer and other carry-on essentials. I had two people (other travellers) that helped me with my bags on and off the train. I was impressed by their hospitality!

The room here at the Golden Tulip hotel by the World Forum is great. A nice bed with a U.S. sized room and weekly rate wi-fi is awesome. I only can use 3 TV channels - CNN and 2 BBC channels, but at least I keep up with news back home.

Yesterday I presented a full-day tutorial on "Becoming an Influential Test Team Leader", which seemed to go well. I haven't seen the evaluation results yet, but we had about 50 people and it was a great time together. By the end of the day, we were all good friends!

The biggest challenges are getting adjusted to the time change (I started my session at 2 a.m. CST and ended at 10 a.m. CST!) and adjusting to the cultural differences in my remarks.

This afternoon the conference starts. James Whittaker from Microsoft speaks. Later, the guys from Google (Bharat Mediratta and Antoine Picard) give their "Testing on the Toilet" talk. That has been a big hit in the U.S.

Tommorow morning I deliver my keynote address on "Trends that May Shape the Future of Software Testing". I'm making some last-minute tweaks to reflect some recent events.

Better go now, but I'll post again soon with some impressions from the conference and some pictures.

StarWest 2008 - Part 2

OK, so I had good intentions about blogging during StarWest. I was too busy!

I thought the conference was good. The keynotes seemed to hit the right level of interest with people. Rob Sabourin spoke about "Testing Lessons from Springfield—Home of the Simpsons". That was a light note to start on and had some interesting application for testers. You've got to love it when someone in the audience shouts, "Eat my shorts, man!" in the middle of a keynote presentation.

Jon Bach spoke next on "Telling Your Exploratory Testing Story". Jon used the connection between journalism and testing to show how to explain to people the performance and outcome of a test.

I sat in on two of Julie Gardiner's sessions: "Five Things Every Tester Must Do" (track session) and "Branch Out Using Classification Trees" (keynote). Julie did great in both sessions. It was great to see people really get excited about the classification tree technique and tool to help optimize testing.

I wasn't able to make it to Julian Harty's session on "Six Thinking Hats for Testers" but I have heard it before and it's a great presentation.

The best I could tell, most people were having a good time and picking up good ideas. I enjoyed meeting a lot of new people, catching up with friends, and learning new things.

On one of our excursions during the week, Janet and I got to see a taping of the Tonight Show. Then, after the show we saw Jay Leno leaving driving his Ariel Atom. He smiled and waved at us. You can't beat that!

StarWest 2008 - Part 1

I'm here at StarWest 2008 with several hundred of my closest friends this week.

Yesterday I presented my tutorial on Becoming an Influential Test Team Leader. We had a really great time together as a class - all 70+ of us. It's always exciting to me to have this opportunity to present this session.

Today I present my half-day tutorial - Pairwise Testing with a Twist, which describes how to apply pairwise testing to scenario-based tests. This is a very interesting technique that can be applied to UAT and SOA testing or any time you need to test an end-to-end process.

I don't have any observations to report at this point, but once the main sessions start, I'll post some of the key points.

SOA Testing Online Training Course Finally Ready!

I've been working the past month or so to bring my newest course, Testing Service-Oriented Architectures to the online format. Well, the day has arrived!

To register and learn more about the course, visit:

https://www.mysoftwaretesting.com/ProductDetails.asp?ProductCode=SOA101

To see a demo:

http://softwaretestingtrainingonline.com/moodle/course/category.php?id=11
(you can login as a guest and stay anonymous.)

The great thing about my e-learning courses is that you can learn at your own pace. Plus, it's ideal for small teams. The online course has exactly the same content as the live course, except the lecture is more time-compressed (I don't take as long to explain things.) and the exercises are optional, but encouraged.

You may also notice I have a new shopping cart!

On another note about SOA, I was interviewed my Mike Kavis recently for an article at www.cio.com on "Six Questions to Consider Before Building a SOA Testing Team". You can read the article at: http://www.cio.com/article/448970/Six_Questions_to_Consider_Before_Building_a_SOA_Testing_Team?page=1

When it comes to testing, just like development, SOA has a different set of technology, business and project concerns. You really need to be thinking about the testing aspect of SOA early in your project because there are some far-reaching implications, such as performance and security that you just can't piece together at the end of the project.

I the article, I mention finding 2 or 3 people in other organizations that have some lessons learned and tapping them as mentors. You can't find every thing you need to know in books, articles and courses (even mine!). When you are on the "bleeding edge" of technology, you need people to brainstorm with!

Now I must go and get my September newsletter out. Have I mentioned I've been busy lately?

More on Agile, Requirements and Modeling

Today was the third and final day of the private conference I mentioned in my previous post. Today's keynote speaker was Scott Ambler, who discussed Agile Modeling.

A few notable things I jotted down from a 90-minute session:

* According to research at Dr. Dobbs Journal, 69% of those surveyed said they were currently using agile methods on projects, 15% of those that aren't currently using agile are planning to.
* In a 2007 survey (Dr. Dobbs), 72% of agile projects were considered successful, 63% of traditional projects were successful and 43% of offshore projects were successful. That's interesting! http://www.ambysoft.com/surveys/success2007.html
* According to the Standish Group in the Chaos Report, version 3, 45% of implemented requirements are never used. 19% are rarely used. Wow, that's a whopping 64% of features that probably no one would ever miss! Only 7% of the implemented requirements are used always.
http://www.agilemodeling.com/essays/examiningBRUF.htm
* To determine the effectiveness of documentation, ask "What is the probability that:
C - the documentation is correct
R - the docs are read
U - they are understood
F - they are followed
T - they are trusted"
Then, multiply C*R*U*F*T to get the overall effectiveness score.

* When you hand off a document to someone there is an immediate 25% information loss (much like the old game of "gossip").
* Models do not equal documentation. Modeling is a key scaling strategy for agile, is an important communication technique, and many agile practitioners perform modeling whether they admit it or not. Drawing on a whiteboard can be considered modeling.

Good information to think about!

Here's an interesting article:

Asimov solved internet fraud 30 years ago

See you later!

Being Smart About Agile

I've had a great time this week at a private developer/tester conference at a large world-class company. I've been staying busy speaking and consulting here and enjoying every minute of it.

Today we heard a keynote address from Ivar Jacobson that was very interesting. It was about being smart in software development. Here are a few of the main points that resonated with me:

* Being smart means being agile plus doing the right thing in a particular situation.
* Knowing the right thing to do requires knowledge, training and experience.
* Interesting "factoid" - 90% + of companies still use waterfall methods.
* Small, cross-functional teams are best (10 people or less)
* Trying to define requirements early at a level of 80% completeness or higher is futile.
* Only 5 - 10% of requirements have a critical impact. These are the ones needed to build the initial interation(s) - the "skinny system".
* Agile isn't what it was 5 years ago. It's smarter today.
* Architecture is still important. Without it, you have a chaotic mess.
* On the other hand, "An architecture without executable code is a hallucination."
* Refactor over releases. Large scale refactoring is costly.
* "Whatever you do, you are not done until you have verified that you did what you wanted to do."
* We are all testers.
* A law of nature: People don't read documents
* Make sure your documents add value
* Practices over processes. Practices can be assembled from a variety of sources. They are separate but composable. In this way, you can select what works for you.
* Appropriate mentoring can help you become smarter faster.
* Change through evolution, not revolution.
* Agility responds to risk and unknowns.

I thought this was a thoughtful and helpful session. It gives me some new ways to think about agility as I help my clients make the transition from traditional methods.

What's Big in SOA Security?

I got this question recently, so I thought it would be good to answer here as well. Basically, the question is, "With all the threats out there, which of them should SOA architects be concerned with?"

What I see most are the threats that are related to messaging in terms of access to the XML payload. In traditional applications, we have gotten pretty good at authentication (even though that is still hackable sometimes). However, in SOA with web massaging across HTTP/HTTPS, it is easier to find a point in the messaging process where the payload can be accessed. This can lead to a variety of attacks: malware, large payloads, XPath injection, etc.

In my SOA testing course (which is soon to be in an online format - stay tuned!), I describe the nature of these attacks. Most are similar to traditional attacks, except oriented to SOA. Take for example XPath injection. It is similar to SQL injection attacks, except is uses the XPath to gain access to data that is thought to be protected.

Keep in mind that SSL secures the message in transit only, while WS-Security maintains encryption until the message is processed. There are some other advantages of WS-Security over SSL, such as being able to specify securing only part of a message if you like. This can help reduce the performance cost of security.

What have you seen as the "big threats" in SOA security?

A Lesson Learned in Really Bad Customer Service from Bob Howard Toyota

It's been an interesting weekend. I like to try to see the lessons even in bad situations in life. I also like to use real-life business situations to learn and apply lessons about customer service. For example, if you want to experience really great customer service, just visit any In-n-Out Burger. I'm always amazed.

On the other end of the spectrum, just visit most MacDonalds. They seem to have mastered the ability to forget that the customer is the one that keeps them employed. I experienced that this weekend, but here's the one that really got me.

I spent Saturday morning with my adult son trying to get some help on a car deal gone bad. It's a long story, but the short version is that we went to a supposedly reputable dealer here in the Oklahoma City area (Bob Howard Toyota) looking for a used 4Runner. We were shown and sold a Land Runner which belonged (but not exactly - we found out later he had just registered the vehicle but didn't have the title yet) to one of the salesmen. Therefore, it was a private sale which took place on the lot. About a week later, the vehicle started overheating and eventually (after $600 of repairs) learned that it is a blown head gasket. (About another $1,300 in repairs)They told us if we had any problems, just to come back in and they would help us get anything fixed. OK. That didn't happen.

You can read the longer version here: http://ryanrice.blogspot.com/.

So, we went back in yesterday and asked to speak with the general manager. I was expecting at least a somewhat friendly attitude. Instead, we got a jerk who acted like we were wasting his time. He took no ownership of any issue. When I asked him how he felt about salesment flipping cars on his business lot (essentially taking away his business), he agreed he didn't like that.

OK, so here's the point of this story. 1) I want the local community to know through Google, and 2) it amazes me that the manager could not even treat like a potential customer, which we were.

I would point you to a great book called "Customers for Life" by Carl Sewell, who owns one of the premier car dealerships in the U.S. From Sewell's experience, a satisfied customer who returns to your business for life will spend hundreds of thousands of dollars. Plus, they will tell their friends. I know many people who have used the lessons in that book to transform their businesses into customer-friendly businesses.

I wonder how much money Bob Howard Toyota spends on television ads. (In Oklahoma City, it seems that all you see are car and furniture ads!) I'll tell everyone I know about how badly my son and I were treated there. I've later learned, there have been others. This story makes ours look tame: http://www.ripoffreport.com/reports/0/155/RipOff0155248.htm

This experience has burned in my memory the value in treating my customers right. My current and past clients will tell you that I will bend over backwards to serve you well. That's why I offer a no-risk, no-hassle guarantee on all my e-learning offerings. If you aren't happy, neither am I.

It's not just about the money, either. It's about doing the right thing, about being treated like I would like to be treated. I learned my lessons in customer service from my father who owned and ran a service station when I was a child. I saw first hand how well he treated people and how they kept coming to his station for gas. Those were the full service days - I washed my share of windwhields!

As testers and QA professionals, we all have customers. Yes, internal developers and users are our customers. One of the best ways a QA or test team can earn respect and show value in a company is to treat our customers well. Like at any business, it is the customer that keeps you in business. That is true for both you and me!

Thanks for listening. It was cheaper than therapy!

Have a great week!

Integration and Interoperability Testing of Software

My last post about the American Airlines baggage system failure mentioned interoperability testing and it got me thinking about this important type of testing that is often minimized or overlooked in systems testing.

First, I just need to make a distinction realizing that software testing terminology is often applied in a variety of ways depending on how you were exposed to it. For example, a test case can mean many things to different people. Although standard definitions exist, they are often unknown to professional testers.

So, here are my working definitions:

Integration testing is the verification or validation that data and control can be passed correctly between two or more related systems or system components. In other words, "Can each component or system talk to each other correctly?"

Interoperability testing is the verification or validation that data and control, once passed correctly between two or more related systems or system components, can be applied correctly to achieve the expected results or behavior. In other words, "Can the passed data or control be used correctly to get the right outcome."

The idea is that it's one thing to have integration between items, but another for that integration to be applied correctly. By the way, the definitions I used are the same or similar to that used in defense applications where integration and interoperability testing is paramount.

I consider integration testing a phase or level of testing performed once the related items or systems are available. I consider interoperability testing a type of testing, which can be performed at any phase of testing, from unit to user acceptance testing.

Here's a fictitious (but realistic) example of the two tests in action based on some of my previous rants (er.., comments). Let's say that I am passing some data to another system for sending a passenger's bag to the right destination - either the conveyor belt to be picked up, or on to their next flight. The integration test would tell me if the data made it correctly to the sorting system. The interoperability test would tell me if the sorting system processed that data correctly, made the right determination, and then sent the bags to the correct destination. It is possible that a logic error could send bags that were meant to be on a connecting flight to the conveyor belt for pickup. (NOTE: I must emphasize this is just an example and not what happened with the American problems. It may have been something similar, but the information is not available yet to know what happened.)

The lesson we can all learn is that this type of end-to-end interoperability testing is hugely important but not necessarily easy. Many times it requires validation in the actual operational environment to get a true assessment of correctness.

By the way, I offer a course in Integration and Interoperability Testing.

One more realted note - I found this link to one of my favorite articles from Scientific American on software defects. It's called "Software's Chronic Crisis". Although it's from 1994, don't let the date keep you from reading this very informative article. I'm really glad I found it!

Do you have any experiences with performing (or not performing) interoperability testing? If so, I would love to read your comments.

American Airlines Baggage Failure Gets Personal to Me

I have posted previously about my disdain for the term "glitch", especially when it is misused to describe a major computing problem or failure. "Glitch" just sounds too casual and minor. Such was the case last week when a software defect caused the separation of thousands of bags from their owners and the delay of flights at New York's JFK airport on Wednesday and Thursday.

My wife and I got caught up in the mess. It all began when we missed our connection in Miami. It was close, but the plane left EARLY. Our only recourse was to change routing through JFK. I asked the lady at American, "But isn't that where they're having all the problems with baggage?" She assured me everything was in order. But...we had to spend the night by JFK without our bags, hoping they followed us to our final destination. Guess what? They didn't.

So, we had to buy all the things we needed, plus clothes to wear at the event we were attending, which had a dress code. The "I heart NY" t-shirts just wouldn't cut it. So, the glitch cost an extra $500. I wonder how many other people had similar experiences.

Some people think delays aren't a big deal. Well, with tight connections, cancelled flights and full flights, they can make life miserable is a hurry. Some of my friends had their flight cancelled in this debacle and missed the first day of a vacation they had really looked forward to.

I know, I know....I normally carry on everything. This time I was with my wife who must check a bag, so I thought, "what the heck?" I broke my own rules!

So now I've had a little taste of what the people at London Heathrow's new terminal 5 experienced.

When we think about the cost of computing defects, these are the costs we often forget - loss of time, loss of opportunity, loss of credibility (I trust an airline to get my bags from point A to point C only at my risk. Actually, anymore when I arrive on time at my destination, I'm ahead of the game. I'm so used to being delayed, I've come to expect it.).

OK, now I'm just whining.

In this case, the suspected problem was the interface with the baggage sorter's communication network, which is only less than one year old. Those darn interoperability problems! I wonder...if the system was ever tested end-to-end in the actual operational environment (also known as validation). If anyone knows the answer to that, please let me know.

I am on my way home and I sure hope our bags make it with us. Oh, and yes, we are flying through JFK again!