MettaProgramming » Miscellany

Trolling, Sexism, and Dealing with Disappointment

john — Fri, 23 Mar 2012 19:53:50 +0000

This past week has been one is extreme disappointment for me as I survey the landscape of my beloved profession. From Portland’s own Postgres genius Selena Deckelman getting hazed on IRC to the incredibly immature sexism of Sqoot listing women as “a feature” of a hackathon I’ve just been feeling really depressed that there is this scale of stupidity toward our fellow programmers– our fellow people– in a field where, at one time, we’ve all known what it’s like to feel out of place and unaccepted.

Sqoot is just a light on what’s seemingly rampant in a field where I just assume there are awesome women doing awesome things. How much of this stupidity am I unaware of? How much do I add to it. Does it really make us feel better to treat other people like shit?

Sexism At Hydrasi

Kerridra and SI1138, Hydrasi's lovable mascots

It strikes me as somewhat odd that I am a man, in an really male dominated field, in a male dominated world, who’d write about this. I mean, what do I know? Just as with white people who don’t see things that every person of color takes for granted, I’m sure there are a great many things than I just blindly ignore in my happy placement of gender-based privilege. In fact, I know there are.

Recently, we were having some graphic design work done for Hydrasi.¹ Hydrasi has a lot of inside jokes based on our name² and our mascots, one of which is a Sasquatch and one is a cute, blue robot.³

The short story is that there are tiers of service, and for the top “enterprise” tier we were trying to make yet another cultural reference joke that could have gone bad.

For every tier, we have a different image. The free tier shows our Sasquatch, Kerridra, holding a pitchfork, the next tier– the lowest paid tier– shows Kerridra with his robotic companion SI1138. The idea, of course, is that you get more robots, more power, with higher subscription rates.

Attempt at referencing Madmen

At the top tier, the enterprise tier, I thought it would be fun to have a reference to the TV show Madmen, where rich advertising executives have martini parties and red-headed secretaries wear mini skirts. My thought here was not “focus on red-headed chics in mini-skirts” but rather on “At the enterprise level, we take care of everything for you so you can sit back and drink a martini.” Here’s the first rough cut of that design.

The final version. You get a computing rack, NOT a secretary

Again, the idea was to have something immediately identifiable as from the show Madmen, but we looked at it and felt that it came off as sexist, pointless, and sort of missing the point of what it means to be at the upper level of service. In the end we axed my Madmen idea and went with another reference, this one not to a cultural reference, but to service. We put a rack of servers behind Kerridra and decided to say “You are getting people, robots, and servers” instead of “You can get a hot red-head.”

Mindless Sexism

There’s a large part of me that’s embarrassed at the whole idea. I mean, I was just trying to go for a funny pop-culture reference in the same way as we have Star Wars references and WALL-E references. In the end, we recognized it as a misplaced, and overly sexist image, and decided to pull it before it ever went anywhere, but how many things like this don’t get pulled?

I guess the take away is that we did sit down, and make a conscious decision to axe that train of thought because if it’s overtones. We thought about it, we decided. That’s sort of what worries me. How much do we– all of us– throw out there because we don’t think about it. How much is just simply cultural privilege that we swim in like water?

Seeking The Positive

This week kind of got me down, both because of the shitty nature of the way things are, and because of my worry (as my wife and I watch her belly grow and I, at least, hope for two daughters) that I add to it as much as anyone.

I guess one thing to look toward positively is a responses to everything this week. Responses like Selena’s. She chose not to battle, but to, almost quietly, Storify the interaction and then ask for feedback (http://bit.ly/GW1XT7). This was an incredibly mature and awesome way to handle a troll (Cheers to you, Selena, for so much restraint and thoughtfulness). And there was a lot of outrage about Sqoot’s mindless objectification of women, including posts like this by Tom Morris. There’s a lot of outrage and a lot of people, not only women, saying “Why is it this way? It doesn’t have to be, and you need to stop perpetuating it!” That’s positive.

For what it’s worth, Sqoot apologized with a “we can do better” post. This made me feel worse instead of better because it just seemed way too late and seemed to radiate insincerity. The only thing I could think of while reading that was an image of Steve Carrell from The Office, spouting an apology speech which had all of the right words that he knew other people would want him to say.

Coda

Overall, it’s been a disappointing week in Tech. I’m trying to see the positive. Good, strong, well-reasoned responses to stupidity and sexism. That should make me feel good. But the fact that there’s such a culture of “brogramming” makes me feel sad. I hope we can change that, but I’d really expected it to have been changed by now, so am not sure how much faith I have in me and my fellow man.

These images are secret, don’t tell anyone you saw them!
Oh no, it broke! It’s Brokedrasi!
The Star Wars connection here is obvious, but there are others we play with as well

Rails: SQL Injection over Configuration

john — Mon, 05 Mar 2012 17:59:50 +0000

It was an interesting weekend for the Github team, the Rails core team, and lots of Rails users who worked at all through the weekend. There are a lot of details about the weekend to discuss, but my main discussion point is one of philosophy and intention of the Rails project. We’ll get to that towards the end. First, a bit of background.

Hacking Github

This weekend, a Github user named Egor Homakov hacked Github in such a way that allowed him to commit directly to the Rails core project. Since Homakov is not a Rails team member, this is a really big deal.

Since this happened, there’s been a lot of talk about the Rails core being fundamentally insecure. In fact, Homakov has been harping on this for at least 1000 years. A few days ago he filed an issue about a mass assignment vulnerability in the Rails core, and later he illustrated this vulnerability by filing an issue report from the future. He was illustrating that you can inject attributes into a Rails model with an HTTP request.

So, when no-one took him seriously, he took the next step. He created HTTP PUT requests adding his SSH key to a Rails core user id, then pushed a commit directly to Rails core.

How to Hack Rails

It turns out that Rails apps, by default, are easy to hack. Peter Nixey wrote a very detailed post about how Homakov hacked Github and the one line of code that could have prevented it, so if you want the full details, read there. The summary is much shorter.

Let’s create a simple User model which has two attributes, name and role. By default, every attribute of every model can be modified by using update_attributes. We all know this, and we’ve known it for a while. What it means is that any User, even if they don’t have permission, can update their own role. Imagine if I log in to our example app and submit a PUT request to the UsersController with the package {'params': {'id': 23, 'role': 'superadmin'} }. By default, the app will accept this and update the user with the new role.

This is exactly what Homakov did. He sent an HTTP request to Github and used update_attributes to change the Github database. All of this could, he argued, be prevented by adding attr_accessor to the User model.

Rails: Convention over Configuration Security

Now, the philosophical point I want to make about this is that the Rails core team seems to be ignoring their own mantra. All of us know that Rails adheres strongly to the Convention over Configuration design pattern. It’s a pattern that Rails users are taught from day one. In fact, it’s embedded in the framework’s name.¹

One of the outcomes of Convention over Configuration is that sensible defaults should be, well, sensible. The Rails core team feel strongly that attr_accessor should not be a default² and that security is the responsibility of the app developer. I agree that security is our responsibility, but disagree that the dominant Rails design-pattern-come-mantra supports this.

It’s almost as if no-one wants to say “Yeah, we should really take care of this.” Everyone is saying “You know, you should really take care of this.”

Stop the world! We’ve found a SQL injection

There’s a term that makes all software developers give pause: “SQL Injection.” It’s a phrase that keeps us lying awake at night, and gives us nightmares when we finally fall asleep. The idea that someone, using nothing more than a web browser, can change our database willy nilly. It’s a terrifying thought.

I can’t help but take an initial read of all the hubbub and think that we’re not giving it the importance that it’s due. Everyone sees a headline saying Rails has a ‘mass assignment vulnerability’ and says to themselves ‘I should probably look into that at some point.’ It’s too vague, to uncertain. To unemotional.³

I have to assume that everyone would be treating this differently if we called it what it is. Imagine your thoughts (and actions) if you read a different headline, something like “Rails apps prone to SQL injection by default”

Don’t you think you’d get something done? You should, because that’s what we’re talking about. This is a path to SQL injection, full stop.

Who owns this issue

I love Ruby on Rails. Like Python, Scala, Node.js, and a host of other technologies that we have at our disposal, Ruby’s web framework makes being a developer both powerful and fun. There’s so much we can do– and so much we can do very quickly. But there’s a cost to pay. Convention over Configuration is a good thing, but we can’t expect people to learn fast, develop fast– create fast– if we don’t respect the logical outcome of that philosophy.

That outcome is this: We, Rails developers, understand that we are responsible for our security; however, we also believe in you, the Rails core team. We trust you. We believe it when you tell us to follow “Convention over Configuration,” and so we naturally believe that the defaults you give us will be a safe, or at least not horribly, dangerously wrong. We, all of us– developers and Rails core team both– can’t have it both ways. We are telling ourselves to follow Convention over Configuration, but we’re also telling ourselves that SQL Injection is a viable convention, thus, that we have security as a configuration.

Now, personally, I don’t believe that attr_accessor belongs in the model– or at least that security from view-based actions belongs in the model. Rails is an MVC framework, and therefore I don’t like forcing myself to define my model based on actions in the view. I don’t want my view owning control of my model that way. I think the controller should manage these permissions and there are others who feel the same. In fact Yehuda Katz argues this as well.

Still, the overall question remains: How can we reconcile the mantra of Convention over Configuration if we support the standard of dangerous insecurity by convention?

Look, just stay on these rails and you’ll move fast. We’re not responsible for what happens if you go over there
Incidentally, I don’t either, but you can set this as the default by using ActiveRecord::Base.send(:attr_accessible, nil), but this causes all sorts of problems
In fact, to be honest, that’s how I was reading it.

A Web App Went Live Today

john — Mon, 13 Feb 2012 21:25:26 +0000

A new web app went live today, and I shed a tear.

The Power of Good Questions

Some history.

Years ago, I was starting to question my decision to become a hydrologist. Not because I hated hydrology, I did– and still do– deeply love it, but because I couldn’t find a job. Since I’d been a programmer for 20+ years (indeed, I programmed all the way through 10 years in the sciences), I decided to see what options were out there in that field.

So I interviewed for this software development company. I was nervous because I hadn’t actually worked as a programmer in a long time. My title had been “researcher” and “scientist” for a decade. Even though I’d been programming that entire time, I was nervous about being labeled as a “wannabe.”

My interviewer saw through that nervousness right away and immediately started asking me questions that were not the basic “do you actually know programming” but were much more geared toward “what do you think of this subtle programming construct.” It was, without a doubt, the best interview experience I ever had, and made me respect the interviewer and want to work with him even if not at this job– which I didn’t even get.

I never forgot that interview.

What Goes Around

Fast forward a few years, and last year I happened to see that same interviewer at the coffee shop. He said that he’d just left his last job and was looking for work. That, to me, was a wide open door. Finally, a chance to work with this guy!

“Really,” I said, “It’s not much, but I’ve got some Ruby work I could use some help with for my company if you’re interested”

“I don’t know Ruby, I’ve been learning a little bit, but I can’t do work in it.”

“Tell you what, work with me. I’ll help you learn Ruby while you do small bits of work on my site. Fair trade?”

As I suspected from this now barely remembered interview so long ago, he was a sharp tack and things progressed fast enough that he never even did any work on my site. Rather, I took another contract that was a wee bit too big for me, and brought him on as a sub. And so, finally, I was working with this guy, and helping him learn Ruby, and getting him paid to do it.

A Favor, Returned

A couple months later, I got contacted by another company who wanted me to create a web app. I was just too busy, so I brought this fellow to the first meeting. My response was, basically, “I’m too busy to do this, but I can speak from experience that this fellow here is a good candidate. I’ll let you take it from here.” And I walked away. Now, here we are, a couple months after that, and MyLunchIn.com has launched for our local restaurant Nora’s Table. It’s another Rails app that he created, start to finish, entirely free of my involvement.

I don’t know I started to cry when I placed my first lunch order today. I didn’t create that site, and honestly, I didn’t teach this guy Ruby– I just happened to be around while he was teaching himself. But it still feels good.

All those years ago, I was a scientist scared that I wouldn’t be accepted by “serious” developers and I was. It feels good to think that I brought some happiness back to that person, a favor returned. It just feels like this new website is part of a rising tide that floats all of our boats when we work together, when we look out for each other. When we remember a good conversation.

I’m on my way now to pick up my first ever lunch ordered on this new site. It’ll be the best tasting lunch I’ve had in a while.

Science in Corporate America

john — Mon, 06 Feb 2012 19:16:47 +0000

There’s a bill in Congress called “The Research Works Act”¹ which threatens open access to science in a very disturbing way. The bill basically gives control of publicly funded research to private companies. There’s a petition to oppose this bill. I wanted to write up why I think we should sign it.

The Research Works Act

Unlike many bills, The Research Works Act has very short text:

No Federal agency may adopt, implement, maintain, continue, or otherwise engage in any policy, program, or other activity that–

(1) causes, permits, or authorizes network dissemination of any private-sector research work without the prior consent of the publisher of such work; or

(2) requires that any actual or prospective author, or the employer of such an actual or prospective author, assent to network dissemination of a private-sector research work.

Now, this seems like a reasonable request at first glance. It sounds like we’re saying “If private people paid for it, private people should own it,” right?

Wrong. Let’s look at the definitions in this bill:

In this Act:

(1) AUTHOR- The term `author’ means a person who writes a private-sector research work. Such term does not include an officer or employee of the United States Government acting in the regular course of his or her duties.

(2) NETWORK DISSEMINATION- The term `network dissemination’ means distributing, making available, or otherwise offering or disseminating a private-sector research work through the Internet or by a closed, limited, or other digital or electronic network or arrangement.

(3) PRIVATE-SECTOR RESEARCH WORK- The term `private-sector research work’ means an article intended to be published in a scholarly or scientific publication, or any version of such an article, that is not a work of the United States Government (as defined in section 101 of title 17, United States Code), describing or interpreting research funded in whole or in part by a Federal agency and to which a commercial or nonprofit publisher has made or has entered into an arrangement to make a value-added contribution, including peer review or editing. Such term does not include progress reports or raw data outputs routinely required to be created for and submitted directly to a funding agency in the course of research.

What’s the gist of this? Let’s look at the National Institutes of Health for an example:

The NIH is a publicly funded institution. Taxpayers– you– pay for its existence. You also pay for the research they do. Because the NIH knows that you pay for their research, when researchers publish papers² the require that the researchers also post the research for free, to you, on their website.

You pay for the reasearch, you should have access to it.

The Research Works Act would make that illegal. Under the act, any “network dissemination” of that research is illegal. The NIH can’t offer it to you for free, the scientist can’t give it away for free. The publishing company owns the information.

You pay for reasearch, you might, if the company wishes it, be able to pay dearly for it… again.

This is wrong.

Life in a Free Market

Don’t get me wrong, I’m a free market citizen. In fact, I’m something of a corporate zealot. After spending years working for the government– a proud publicly paid employee– I got completely fed up with the government’s inability to accomplish what I thought was possible. I left to start a company instead.

I’m a believer in the corporation. It’s the nearly perfect problem-solving entity. In fact, I don’t think of a corporations purpose as “revenue generation,” I see their purpose as “problem solution.” But they solve those problems within a market, and people pay for the solution, so everyone wins. I believe corporations should be allowed to make money within that market. What I do not believe, is that our government should enshrine a market for the corporation. That’s not a market, that’s a baby crib. Nice, protect, safe, with mommy’s breast readily available.

If the market does not exist, or is not strong enough, then the corporation needs to put its big-boy panties on and get lean, or get lost. Period.

Government should not make laws that take tax-payer funded information and require taxpayers to pay corporations for it again. This is not the protection of the real market, and it is not the protection of market values. This is the governmental protection of corporate profits by creating an unreal market.³

Publishers argue that they add value to the work because it is their peer review process that confirms scientific legitimacy.

That’s complete bullshit. I’ve been part of this process. It involves me volunteering my time to review a scientific paper. If this is a “service” that the publishing companies offer, then they are offering it because thousands of people are working for them for free. The publishing company doesn’t do this, university scientists, while they are getting public salaries, donate their time to do this. And they’re mandated to do it, and do it for free. Not by the government, but by the community. I dare you to try to be a scientist without participation in the peer-review process.

The “added value” that the publishers offer is essentially the time of public scientists who are volunteering because they have to. The publishing companies make a mint off of this public time. The researchers do the work, do all the writing, and do all the peer review. Meanwhile, the publishing companies rake in amazing profits.⁴

I’m not against all of that. It’s a great system. Companies taking advantage of a market? Fine. Sounds like a good deal.

Government Should Not Coddle Corporations!

But now we have this thing called The Internet. Now we have this idea of “openness.” Now we have a public that demands open information, that demands access to the research that they paid for– and we have the tools to give them that access, easily.

In short, we have a market that changed– and a publishing industry that, rather than changing and growing up, sits in its crib crying for mommy’s breast of federal subsidies.

This bill is not about protecting a real market. This bill is about enshrining a federal subsidy of the scientific publishing industry. Let’s call it what it is.

If the federal government wants to subsidize the publishing industry to protect its profits, it should say that. If the federal government wants to allow a publishing company to use old-market strategies, by making the new market reality illegal, it should say that. If the federal government wants to restrict access to publicly financed scientific research by putting that research into corporate ownership, it should say that.

And then we’d all acknowledge that this bill should fail.

If we keep passing federal laws to protect and subsidize companies and markets solely to protect their historic profits in a changing market, we risk ruining the entire idea of a free market altogether. If I have a company and can talk the federal government into passing arbitrary laws that make my company profitable despite market forces, it may seem like a good deal to me. It is emphatically not a good deal to our country.

Publicly funded scientific research should be public. Period. If a company cannot remain profitable given that constraint then the result is simple: The company perishes. It is not Congress’ mission to protect the lives of private companies as if they were fragile fluffy bunnies, protecting them from the big-scary coyote called ‘a free market economy.’

HR3699
as they are essentially obligated to do by the scientific community
Maybe I’m wrong. Maybe we should do this. After all, China is doing loads of this and it’s working out great for them, right?
in the billions, people. Lots of these journal subscriptions are in the thousands or tens of thousands of dollars per year

New to testing? Just wash one dish

john — Fri, 03 Feb 2012 17:39:26 +0000

I have a team I’m working with of great tactical programmers. These guys take the craziest specs you’ve ever seen from clients and turn them into shit that actually works. Tactical programmers are great, they are needed in every organization. Nothing will get you to a deliverable better than a solid tactical programmer. One thing I’ve found with many tactical programmers– it’s almost a universal trait– they don’t often write tests.

It’s not that a tactical programmer will never write tests, it’s just not their focus. They are on the front lines, working, well, tactically. Tests are a strategic issue. To many tactical programmers, tests are not something that are necessary. To the tactical programmer, unit tests are this vague, unimportant, time-consuming thing that someone else tells you that you really should do if you want to have good dental health into your later years. They are not something you need to make this feature work, they are something someone else wants for some unimportant reason.

I’m not going to argue why testing is important. There are enough flies on that carcass. What I want to give, to my team of great tactical programmers, especially, is a concept about writing tests that will make it more palatable.¹

Why Starting To Write Tests Sucks

The fundamental thing is this: The best way to actually accomplish testing is to start writing tests.

The problem is that you look at this huge codebase you’ve written without a single test, and you start feeling sick to your stomach and grumpy about your chair and angry at the fact that you’re coffee is too cold and you say “Screw that, I don’t have time for that stupid shit.”

So, what do you do? You write another feature, that adds more untested code to your codebase, that makes you even more sick to your stomach the next time you think about tests.

And before you know it, the only thing you actually know about tests is this: Those fucking things make me sick to my stomach!

The One-Dish Theory of Work

When I clean my house, I don’t start and say “I’m going to clean the house.” There’s too much to do, too much to even think about. I start in the kitchen– but I hate cleaning, so I can’t even think about the kitchen. When I clean my house, I start by going to the sink and washing, not everything in the sink, but one, single dish.

I tell myself, “I’m going to wash one dish and see where I go.”

The thing is, of course, that soaping the sponge, washing that dish, and putting it away requires a small amount of set-up. Thus, when I’m done washing that one dish, it’s much easier to wash just one more dish. I mean, I’m already there, and I’ve got the sponge in my hand.

Before I know it, all the dishes are washed, and the counter next to my sink is clean. Well, with one clean counter, it’s easier to clean off this other counter. I’ll just clean this one other counter.

Just Write One Test

That’s how a non-test writing, tactical programmer can think about writing tests. Just write one. Because here’s the thing: It’s not that bad. The reason it’s not that bad is that the best way to accomplish testing is to start writing tests.

Not all of the tests. Just one test.

The beauty of testing is that they work no matter how many you have. You don’t have to wait until you have time to go back and write tests for everything all at once. If you just start writing tests for the things you work on today, now, then it’s not such a big task. Don’t write tests for every class in your codebase, but write tests for this one, small class you’re working on today.

Write one test, for just this one method in this one, small class, that you are working on today. Tomorrow, write one test for what you’re working on then. Maybe write two if you’re feeling cheeky.

What you’ll find is that, as you write tests here and there, for just the thing you’re working on, it gets easier and easier. Very soon, you’ll say “Well, I was going to just write a test for just that one method, but since I’m here in the test class, it’ll only take me another 20 minutes to write tests for _all_ the methods, so I might as well.” By the time you have a few weeks to actually fill in the rest of the tests, it might only take a few days, because you’ve been doing it and are more familiar.

Just write one test. Just one. You can decide after you write that one whether you want to write another, but at least write one.

Today.

This is not news for seasoned developers, I’m not saying that it’s new

The Ever-Deployable Github Workflow, v2.0: Branches and Issues

john — Mon, 30 Jan 2012 19:31:33 +0000

Here at CHOAM, we love to live at the junction of creating and learning. In fact, it’s one of the primary reasons I became a programmer. As a little kid with my TI 99/4A I could create software I never dreamed possible. Sitting down with my BASIC compiler, I could type a few lines of code and suddenly do something that I could never do before. I’ve been creating ever since, the ability to create was too addictive to let go.

Software is a world where you need to improve your skills everyday.¹ That’s a heavy toll, but a wonderful one, because you’re always just about underwater, you’re always challenged. But, and this is the wonderful part, you’re always discovering. Every day as a developer is a day that I am doing something that I haven’t done before. Whether it’s creating a new architecture, or just improving a workflow. Everyday is about improvement.

Problems with The Ever-Deployable Git Workflow

I’ve been using my Ever-Deployable Git Workflow for a few months now with much success. It’s been a great way to keep a project up to speed with multiple people working on multiple issues with barely any conflict. Still, nothing is perfect.

One thing I’ve found is that naming branches is problematic. Few people want to type “git checkout -b make-javascript-popups-easier-to-maintain,” it’s just too long. Also, searching through a long list of issues with names like that just gets troublesome. What is John working on? Oh, something about making Javascript popups better. Well, is that Issue #216? The one about JS file location? Or is it Issue #384?

This brings up two ways that we can make the Ever-Deployable Github workflow better. First, unify with the issue tracker, and second, make better branch names.

The Github Issue Tracker

Github’s issue tracker is probably one of the least functional issue trackers I’ve ever used. It basically has nothing you’d expect or want. It’s little more than a title, some text, and maybe a label.

For that reason, it’s the best issue tracker I’ve ever used.

How many of us get sucked into the feature set of a piece of software and end up spending all of our time maintaining the software. Github’s issue tracker forces us to avoid that tendency by not giving us that feature set. It’s brilliant. All I can do is write a title, write a description, and then get back to work. It makes logging issues super fast. So recently, I’ve started to take advantage of that. I log issues for nearly every small, atomic change I want to make.

Furthermore, you can close issues with commit messages like “Fixes #216 by shuffling the JS files as if they were a deck of cards,” and the commit then gets linked to the closed issue automagically. It’s really a great system.

10 Steps to a Better Workflow

So, we have a way that we can quickly make issues to log things we want to change. And we want to get rid of insanely long branch names. Why don’t we branch the issue? This means our branch name is minimally descriptive, but there is as much description as we want in the actual issue. Using this methodology, our new Github Workflow is this:

Only work on documented issues. The idea here is that no one is ever just blindly mucking about in the code without a documented reason²

Look to see if anyone else is working on the issue you are going to start.

Create an issue describing work to be done, or use an existing issue

Create a branch using that issue number. We use “issueNUM” as the branch name, so something like “git checkout -b issue516″

Immediately, before doing any work, push that branch back to master: “git push origin issue516.” This tells everyone that someone is actively working on this issue. This is why you don’t work on undocumented issues. It’s very easy to know what the entire team is working on.

Work on your code following The Ever-Deployable Github Workflow. Making commits fairly atomically, or as atomically as your team decides.³

Rebase to master

Commit the branch with a final message like “Fixes #517 by doing lots of stuff.”

Push to remote, submit your pull request, and “git checkout -b ”

Lather, rinse, and repeat

Fixing other things along the way

This workflow has done a few things for us. One, it encourages atomic work on the code. By that, I mean it encourages us to stay away from commits that change “a little of this, little of that.” We are working on a single issue, and our branch is named with that issue. So we focus on that issue.

If we want to fix other, most often very small, issues during the work, we fix them in a single commit, and log that in the commit message “Fixes #214 by changing something, since I’m here already.” If we want to fix bigger issues, we do it a bit differently.

For instance, say we are working on our issue #516, and during that, we come up with a decent way to correct another issue, say issue #212, that comes up because of our work on this one, but which we don’t want to dump right into production- maybe we have to test it more:

git checkout -b issue516 git push origin issue516 … do some work and decide to fix issue 212, but not to push it to production without first finishing 516 git checkout -b issue212 git push origin issue212 … fix 212 and commit git commit -am "Fixes #212 by mucking about in the code" git push origin issue212 git checkout issue516 … continue working on issue 516 git commit -am "Fixes #516" … then do the standard git rebase workflow: git checkout master git pull origin master git checkout issue516 git rebase master … Then submit your pull request for Issue 516. Now, it's a good time to push up 212 git checkout issue212 git rebase issue516 git push origin issue212

With this, issue212 is fixed on top of issue516 and is ready for either a pull request or more review and work. From a git log perspective, it appears that issue 516 was completed, and then issue 212 was completed. Nice and clean.

Coda

I’ve been using this workflow on various teams for about 2 months now, and it’s working out extremely well. I’d be interested in what you think.

Admittedly, there are those who don’t. But I try to keep them far away from my projects. Nothing is more dangerous than a developer who is happy at being stale
or at least without creating an issue like “Issue #516: Blindly mucking about in the code”
I like smaller commits, since they are easier to review and revert

Hourly work, fairness, and the scamming of lawyers

john — Tue, 24 Jan 2012 23:32:58 +0000

I’ve been working full-time as a contract programmer for a few years now, and have recently begun to realize something very disheartening:

My clients get a lot of shit for free.

Now, that’s not disheartening in a “they get stuff I don’t get” sort of way. I mean, good for them. I’m a happy person who likes spreading happiness, so I’m not against them getting shit for free on principle. The problem here is that my clients get a lot of shit for free that I do– and thus, it means that I’m doing a lot of work for free.

Today is a perfect example of this. Today I did some quick work for a client that submitted a request using my ticketing system. Since I wasn’t actually working for someone else at the time, I went ahead and tackled it. The time I spent on that, from initially seeing the email to completing it barely scraped 20 minutes. I loosely round to 15 minute increments, and generally don’t charge for a quick 5-15 minute bit of work. Thus, I did that for free.

Then, since I was already outside of a context, I checked my email, and there was another request. Similar thing, similar outcome. A wee bit of unbilled work.

Then, there was another request from another client. This one took about 45 minutes. So, I went into FreshBooks and went to bill them, only to realize that it was the first time I was billing them this month. I’ve worked for that client almost 4 times already this month, and this is the first time I’ve billed them.

I am extremely hesitant at this point to back calculate just how many of these little things I do without billing.

Metric billing

When I was working in environmental consulting¹, I had this ridiculous billing sheet that I had to keep. It was 10ths of an hour, which makes sense from a percentage perspective– easy calculations– but becomes mind-numblingly frustrating when you have to actually write down the fact that you used two billing increments because it took you 10 minutes to go to the bathroom!

I mean, think about that: 10ths of an hour: 6 minute increments. Imagine tracking what you do by looking at every 6 minutes! “No, I don’t have time to glance at your stupid Star Wars link, that’s like 2 whole minutes!!”

I thought I would go crazy at that job. And yet, oddly, lately I’ve become to realize that it makes an insane sort of sense. My base rate is $85/hr, which means that one of those billing increments is effectively $8.50, which means that my “barely scraping 20 minute” task that I did for my client was worth $25.50.

Again, I am extremely hesitant at this point to back calculate just how many of these little things I do without billing.

Small clients, hourly work, and the fallacy of ‘free’

And so we have a problem. I basically refuse to bill more harshly– admittedly out of my own laziness– but continue to have lots of small contracts which, by their very nature, necessitate harsh billing. It makes my relationship with my clients more lopsided, which doesn’t stay positive. I’m starting to realize that this is far from a “good deal” for my clients. In fact, it’s a pretty bad thing.

Think about it. I do work for my clients for free, and I do this free work all the time, right? That’s great because my clients are getting stuff and not paying for it, right? Wrong. The more I do work for free, the more working for this client becomes a burden, either real or perceived, and the worse my work gets. I get less engaged, and more frustrated, with every task.

That’s not good for either of us. Good business isn’t about getting shit freely. That’s a fallacy. Good business is about getting shit fairly.

I understand the lawyers

Lawyers. Those bastards.They do this thing which I always thought was really shitty and unfair. They charge you for work they don’t do. It’s this scam they have called “being on retainer.”² They charge you this monthly amount for work they “might” do. If you call them, you pay. And if you don’t call them, you pay. Then, if you want them to do a lot of work, you pay more!

I understand this now.

Lawyers aren’t bastards at all, and they are not scamming at all. It may not be perfect, but what they are doing is trying to get as close as possible to “fair.”

This is why my lawyer doesn’t charge me when I call to ask a simple question, yes. But more importantly, this is why my lawyer is actually engaged when I call to ask that simple question. I now realize why the lawyers do what they do, and I have to say that it’s a seriously good idea.

I’ve got a couple clients that I don’t hear from for months, who will then call with work for me to do. This is a bad situation. Since I’m not getting paid unless they call me, I have to take on other work, so I fill my schedule, book myself up, then get this call from someone asking me to do work, and I can’t.

At that point, I have no time for work. It’s not like I set aside time just in case they called me. I can’t do that and survive. So we’re screwed. There’s no good solution, and anything we come up with is the least crappy choice of either “fitting it in” or doing a less than perfect job just to “get it out of the way” or even saying “sorry, you’re out of luck.”

From now on, I’m on retainer

Here’s the thing: I want clients who value their own work, who take their own work seriously– seriously enough that they demand that I take it seriously. Because I take my own work seriously. I spend enormous amounts of time working to improve myself, to work better. I value my work, and I want clients who value me.

I’m no longer working hourly for any contract that is not a significant portion of my time. My plan is to set a “retainer rate” at some fraction of my base rate, which my client will pay monthly in exchange for me guaranteeing that they have a certain amount of hours. Those are hours that I don’t have to fill with other work. Those are hours I can set aside for my client, and if I don’t use them for my client, then great, I use them to work anyway, learning another framework, or another language, or just playing with a design pattern, or refactoring something in their code. All of which makes me better, and more valuable to my clients.

It’s all about value.

Retainer doesn’t mean “I’m charging you for work I might not do.” Not at all. I see that now. Retainer means “I have to find work, and you’re going to get shoved aside and treated like shit, unless I don’t have to find work.” Retainer means “You value your business enough that you don’t want stuff to ‘maybe get fit in.’” Retainer guarantees access, but more than that, it guarantees fairness.³ It says “I care about my product, and I care about it enough that when I want you to work, I don’t want to wonder whether you can.”

It shows that the client values their product, it certainly shows that the client values me, but most of all it shows that I’d damn-well better value this client.

That, my friend, is good business.

during my short, foolish attempt to convince myself that I’m not a developer in my heart
Yes, I realize they are not the only ones who use the retainer, but they are my foil for this article, so shut up.
or, at least, comes as close as we can get easily in our system.

Don’t be an idiot like me, mock your services!

john — Sat, 17 Dec 2011 19:02:28 +0000

You know the old saying, a derivative of: “Test are like flossing, we all know we should write them, but no-one does.” That’s an old saying because, while it was true 10-20 years ago, it’s not so true now. For the most part, the modern development world is a beautifully tested one. These days, nearly everyone flosses.

Still, there are always improvements. Sure, we test, but maybe we don’t really test the web interactions, or test the controllers as well as we should, or whatever. We’re flossing, but we’re not really flossing as well as we could be. We’re missing some teeth.

Today, I got a toothache.

Mock your services

My company, Hydrasi, has what is a fairly common architecture these days. We have a front-end website (in Rails) that sessions users and does various pretty things, and we have various back-end servers (our main is in Scala) that do things like manage data, send messages, etc. Everything connects to everything else via messaging and API calls. This is basic “concern separated” design. The Rails site shouldn’t care what the hell happens in the Scala server, it should just care that when it says “give me a monkey,” it get’s a monkey. It’s a nice separation because I “own” the front end, and my partner “owns” the back end.

And yet, with all of this architectural decision making and best practices, today I’m at a work-stoppage point because my front-end tests are failing. Why? Because I’m an idiot and built them all while I had a back-end server that was functional. Today, that service is *not* functional, and my partner is out, probably doing what he should be doing on a Saturday– having fun.

Yes, I feel really stupid. I spent an hour trying to hack around and get the back-end services running so I could work.

Yes, I already feel stupid, and yes, it’s obvious that I haven’t really been flossing.

So now, instead of working on what I thought I was going to work on, I’m heading over to grab the FakeWeb gem so that next time I work, it won’t matter whether any other servers are running.

(in a month, I’ll write a post about how I forgot to write integration tests

A Farewell To Facebook, Reason #3: Obsession & Stupidity

john — Tue, 13 Dec 2011 18:52:58 +0000

This is the last in my posts about why I left Facebook.

No, really, I promise!

Like many things I write, they’ve come off a bit as “explanation” and/or “justification,” but– also like many things I write– they were meant more as “exploration.” They are a personal exploration, through writing, of my own decisions and motivations. That is what writing is to me. That ability to use it as a forum, not with others, but with myself. It’s as much an internal dialog as an external representation. It is more-so that, actually.

And that’s the point of this post.

Longform writing

I’m going to be honest with myself and not describe the way I like to write as “essay.” It often doesn’t have the deep research and editing that such writing would require. Still, it is longform writing. It’s not sound bites, it’s analysis. It allows me– forces me, really– to dive deeply into myself to ascertain my own thoughts and motivations. Whether I’m writing about myself, or about someone else, or about some arbitrary situation removed from me completely. Writing is analysis.

Facebook is not writing as analysis. Facebook is a focus on the soundbite. Facebook is a headline. Headlines are catchy. They are short and pithy. Headlines grab people’s attention, and Facebook is really good at that. But that was the limit. Longform writing is the actual story, and I truly believe in “story.”

Longform writing is what I want to do, but Facebook writing is what I did.

Strangely, I would find that I was spending almost as much time internally preparing a Facebook post as I would spend preparing a longform blog post such as this. And no, that’s not to say that I spend only a few minutes preparing a blog post. What that means is that a stupid Facebook post would take, quite literally, days to prepare.

Just think for a moment about how incredibly fucking stupid that is.

I mean, seriously, did you read the previous posts where I describe how I don’t take Facebook seriously? Good. So I’m not the other one who realizes that I’m completely full of shit. I take it too fucking seriously!

A day to swim, a week to post about it

Think about this small post:

The Hood River pool, where you learn that no matter how out of shape you thought you were, you’re more out of shape than that.

Which took me almost a week to write. Yes, you read that correctly, almost a week.

I’ve written before about trying to learn how to swim with the masters swimmers. It’s difficult, but it’s also amazing who’s there. There are 60+ year old women who, despite my best efforts at focusing on what I’m doing, I can’t help but notice are really in shape and… well… hot! There are people who are so in shape and so good in the water that it’s difficult to believe that I’ll ever be that good.

So, I’m there watching people who I can’t help but compare myself to– me, this former martial arts loving competitive cyclist who is now little more than an out-of-shape middle-aged oaf. I watch them while meanwhile I can barely make it back and forth across the pool once before I’m out of breath and dizzy enough to pass out.

And there’s this aspect of body preparedness, which I’ve never thought of, but which explains why I can get on a bicycle after two years of doing basically no riding, and still hold my own in the Tour de Hood. It’s the reason I keep thinking of myself as “fairly fit” despite all the evidence to the contrary. It’s not that I’m “fit.” It’s just that my body, after an entire lifetime of doing this sport, is uniquely prepared to, well, do this sport.

But any other sport is up for grabs. I can ride 40 miles at the drop of a hat, but jogging around the block is deadly, and swimming kicks my ass.

That’s a sampling of the analysis I did before writing that Facebook post. It’s a sampling of what I wanted to write about. But, of course, on Facebook, you’re not going to write all of that. So, I took a couple days thinking about that, then a couple more deciding whether I was going to write about 60 year old women who look hot in bathing suits, and how I could do that in a way that was funny, but still appropriate and respectful to them, and then a while deciding whether I was going to mention body preparedness or just feeling out of shape, and a couple days to…

And what do I get out of that? One fucking sentence that doesn’t express any of that.

Don’t give up writing for writing

Here in Hood River, wind sports are big. The windsurfers and kiteboarders here have a saying: “Don’t give up wind for wind.” There’s a lot I learned from that saying.

Say you’re out on the river, and you have wind, and you’re windsurfing, but then you look way up the gorge and it looks windier. You might be tempted to go there, but you shouldn’t. You have wind here, and you don’t know that the wind is better up there. Furthermore, even if it is better up there, by the time you get off the water, break down, get there, rig up, and get back on the water, that wind could be gone. That wind could have left by that time– and the wind you had at the first place could have left too.

Don’t give up wind for wind.

I realized that what I was doing was just that. I was obsessing about posts. Do they capture everything I want them to capture, do they have enough comedy, do they poke at, or not poke at, family members who will be upset, or not upset, at being poked at. I’d spend a week thinking about how I was going to post a short two sentence statement on Facebook, and I found that I had no mental energy for actually writing the longform analysis that I wanted to do, so I didn’t do it. I was doing all the longform analysis for shortform writing.

I gave up writing for writing.

Archery and The Final Twist

But that’s not even the real, really real, reason I gave up Facebook.

I obsessed over Facebook posts. I would literally sit with someone in conversation and think about how I was going to relate that conversation– or maybe even think about how I was going to relate a completely different conversation on Facebook. At the pool, I thought just as much about how I was going to relate my experience at the pool on Facebook as I did about how I was actually experiencing the pool.

I had inklings of this for a while, but it hit home when I was practicing archery one day. Coming from a martial arts background, I have a consciousness of focus and presence. I use that in many things, of course, but I’m more conscious of them when I do martial arts-like things, of which archery is one. So one day, I’m out shooting, and I shoot a really beautiful quiver. I was calm, focused, present, and 5 of 8 arrows are all virtually dead center and spaced about the distance of two quarters. Beautiful.

Now, what I should have done, what I knew I wanted to do, was to ignore those arrows that I’ve already shot. They don’t exist. I needn’t think of the two arrows still in my quiver either, because they don’t exist. The only thing that exists is this arrow I have nocked and the target. There is nothing but this shot. Quiet, peace, breath, and this one shot are all that exist in the world. That is what I should have thought.

But what I did think is this: Wouldn’t it be awesome to post a picture of 8 perfectly shot arrows in the target! I’d love to post that on Facebook.

The next shot I fired was almost a foot off. The shot after that missed the target all together. My final shot even missed my backboard and hit my shed. I realized at that point that I hadn’t given up writing for writing. I’d given up the presence of my life for Facebook.

I unstrung my bow, collected my arrows, came inside, and deleted my account.

A Farewell To Facebook

Me leaving Facebook had nothing to do with the concept of friends, or with the concept of interaction. It had to do with the concept of presence. Specifically, with my inability to have that presence while I was focused on my obsessive, stupid desire to describe that presence to others.

Sure, I think about how I’m going to post something on my blog, but it’s different. I can’t explain how it’s different except to say that when I think about my blog, I don’t actually think about how will I say this on my blog, but rather I think how do I feel about this– and then I write about those feelings on my blog.

Maybe it’s because longform is the process of understanding of how I feel about something, and then the writing of those feelings. It’s focused on the feeling, the understanding. Shortform writing is, for me, often focused on just the writing.

I can’t explain it, really. But I know that when I was standing there with my bow in my hand, looking thirty feet beyond my target at a fletching sticking out of my shed, I wanted to cry. I wanted to cry not because I missed a good shot, or because I missed the opportunity to describe that good shot, but because I was thinking so much about Facebook that I missed the experience of living that shot.

And of so much other living.

A Farewell to Facebook, Reason #2: Interaction

john — Tue, 13 Dec 2011 16:15:27 +0000

In a previous post, I described the confusion of the term “friend” as a primary reason I left Facebook. Another reason I left was confusion over the term “interact.”

It just seems that much of Facebook is not “interaction.” It’s short anecdotes that people comment on. That’s not interaction. Interaction is real conversation with someone, where you learn about what’s going on in their lives, in their head. More importantly, interaction is where you learn what’s going on in your own head.

It’s growing, it’s changing, it’s becoming. It’s not talking about your cat and having someone else comment on it.

But that’s what I kept feeling. I felt as though we’d all sit with our Facebook comments and think that we’d really interacted with someone because we read about them being sick, or read about them mowing the lawn. I’d see people that I hadn’t seen for some time, and they’d start talking about things that happened a couple weeks ago that they’d read about on my Facebook page. Most of the time, this would not be comfortable- not because I was uncomfortable with them knowing details of my life, but because they didn’t know details about my life.

When someone reads a quick Facebook post about something anecdotal that happened in someone’s life, all they have is an anecdote about what happened. They don’t have the story, they have a soundbite. They just have a meaningless quip, because they haven’t actually interacted with the person, with the information.

This is especially true for me and my information. Since I felt that way about Facebook– that it’s not real interaction– I would liberally sprinkle my anecdotes with comedy, or spice them up to make them much more funny than they’d otherwise be.

Rate these two possible Facebook posts for comic value:

I didn’t feel too hot this morning, but after I ate breakfast, I felt a little better.
While sickness sucks in general, throwing up immediately after breakfast is a surprisingly effective weight loss strategy

See? Number one is boring. I generally shy away from boring– or at least things that make me feel like I’m being boring. So I’d… embellish a bit… and add some comedy… because really, it’s Facebook, no-one’s going to actually take it seriously, right?

Wrong. I’d see someone and they’d start talking about what’s going on in my life as if they know about it, and I would often think “Eh, yeah. Uh, so, that’s not even really close to what’s going on. You take Facebook seriously, don’t you?”

After enough of these interaction, I start thinking that either a) I need to start taking Facebook seriously too, or b) this is not the best place for my type of semi-realistic humor.
The joy of rumor

So, one day, my wife, Jessica, get’s a call from her sister saying that shit has hit the fan and she really needs to call her mom.

So she calls her mother, who starts immediately bitching at Jessica for keeping her in the dark and not telling her what’s going on and why does she have to learn about me getting fired by having Jessica’s aunt call to gloat about how maybe her son-in-law is not so great after all and maybe she’ll know what it’s like to have kids who are unemployed and maybe when one of us gets unemployed Jessica could think to call her mother and tell her her mother instead of giving her aunt a reason to call and gloat!

Now, I’m a contractor. I have a small business– me– that provides services to other companies that they cannot provide for themselves– software development. Most of the time, those services eventually, well, end. Not in a bad way, mind you, because hopefully I’ve actually done my job, which is to do something, afterwhich, since there’s nothing else to do, I leave. So, you could say that I am a complete failure unless I leave a job, because if I don’t leave, it’s probably because I never actually finish what I’m supposed to do.

But sometimes– most of the time really– I really like the people I work with, and grow to think of them as friends, and miss them when I’m gone. Also, quite often, I’m not sure about how my work is going to live in the context of the company. Usually, I build something near completion and then the company has to take it and finish it and/or use it. So, because I care about what I make, I worry that it’s good enough, that it lasts, that it solves the problem I wanted to solve.

So, one day, thinking about all of this, I posted something on Facebook:

“Last day on the job. Always a bittersweet experience. Gonna really miss it here and the people, and worried about what’s going to happen next”

This post is read by my wife’s cousin, who apparently tells his mom that I’m leaving my job. His mom, apparently assuming that I’m only leaving because I’ve been fired– which is good because she’s constantly in competition with her sister– i.e. my wife’s mother– so she calls her sister to gloat. This makes Jessica’s mom freak out because her daughter’s husband has been fired, so she naturally calls Jessica’s sisterto freak out and complain about how she’s been left in the dark about me being fired because her daughter doesn’t care to tell her anything.

Jessica’s response to learning all of this was “Huh, what?”
You could just ask, people

Now, admittedly, this isn’t Facebook’s fault. The family political firestorm that swept through Jessica’s family was entirely fed by the dry tinder that is “Jessica’s family members relationships with Jessica’s other family.” Which is to say that it’s basically the norm if not exactly normal. Facebook was, at worst, a match carelessly thrown from a car into a pile of dry grass.

Still, the family is flammable, and so we need to be exceptionally careful with sparks. We, I, need to be ever conscious of my matches. And it’s not just hers. My own family has mis-read sometime comic, sometimes off-color, posts on my Facebook wall and assumed the worst. The thing about all this is that, if it were honestly interaction, then there would be… well… interaction. Think of the two ways the situation above could have been handled:

Freak out and immediately assume the worst. Call all the other members of your family to ensure the firestorm is as big and as violent as possible. Start preparing your daughter’s spare room for her post-divorce life, and prep yourself for your unemployed son-in-law to start borrowing large sums of money and never paying them back
Actually talk to your daughter and find out that they are celebrating over a glass of Oregon Pinot Noir.

One of these really stupid and childish, the other is thoughtful and involves interaction. The thing about Facebook is that it encourages us all to take the stupid and childish path. Facebook does this because it tells us that it is providing interaction- and we all, me included, are dumb enough to believe it.

You see, true interaction would be “call your daughter and find out that everything is fine.” That would be interaction. But Facebook has already provided “interaction.” So we assume that the actual interaction has already taken place, so the next logical step is to freak the fuck out, right?
Another twist

Of course it’s an exaggeration. Just as with Facebook, I’m going for comedy as much as anything. Still, the point remaint, and the point is that if Facebook, as a system, honestly was interaction, freakouts probably wouldn’t occur at all. And if Facebook honestly encouraged interaction, then the freakout would be avoided because we would all… well… interact!

Rather, Facebook encourages us to assume we have the whole story. It encourages us to assume that the soundbite is all the information that we need. This is bad enough, but it’s worse when someone like me doesn’t take it seriously at all, and further obscures reality with comedy and embellishment.

But there’s another twist. Similar to the first. This wasn’t the reason I had for leaving. It wasn’t other people freaking out that caused me to have second thoughts, it was my own change.

I found that I had to be really conscious of what I posted. “Can I post this? Will her family freak out?” “If I post this, can I make it comedic without fallout?” It was becoming troublesome to make sure that what I posted was… safe.

And so I actually swung the other way, purposely posting stuff that was unsafe just because I shouldn’t have to worry about it being safe. I’d post about Jessica walking around wearing nothing but cellophane, not because it has (or ever actually would) happen, but because “dammit, if I have to worry about posting something that might upset her mother, that pisses me off, so I’m going to post something that will surely upset her mother.”

So I went from posting whatever I wanted, to posting only what I thought was safe, to posting what I hoped was unsafe. Which means I went from being angry at other people being stupid to actually being more stupid.

No. Stop. Time to leave.

That’s the real reason. Because, apparently, I don’t have the wisdom and self-control to fight stupidity with integrity. Maybe one day I’ll learn, but until then, I just thought it best for me to go away.