Fearing Facebook JavaScript

August 9, 2007

Neil Mix is running a nice series of posts about potential problems with FBJS, Facebook’s effort to sandbox JavaScript in such a way that developers can safely use it:

Thus far I’ve found six security holes in FBJS. I’m sure there are many more, it’s just a matter of finding time to find the holes. To Facebook and Marcel’s credit, they are aggressive about fixing the holes that I find. So while I might complain that the approach of sandboxing-plus-code-generation isn’t an acceptably secure strategy, I’m reassured that they take the issue of security seriously.

I had the honor of working alongside Neil for a short time…several…years ago; Pandora is lucky to have him on board!


Why I Want to Like Coghead But Can’t

July 31, 2007

For awhile late last year I was an enthusiastic beta tester for Coghead. I received an invitation in early December, registered, read over the documentation, tried to create a few applications, posted some questions to the forum, but ended up abandoning the effort after a week or two. As much as I wanted to help their development team find and squash their bugs so the site could be a great one, it just seemed like it wasn’t quite ready for testing and that I was subsequently wasting their time and mine.

Even though I gave up back then, I did make a note to check back later and give Coghead another shot; I kept abreast of their evolution through blog posts, noting that in March they switched BPEL engines, and a couple months ago registered a new account.

Unfortunately this post finds me eight months later still thinking that Coghead is an underwhelming disappointment. In my humble (and fortunately for Coghead, not particularly esteemed) opinion their service is overrated, the application design suggests designers that are too clever by half, and the environment doesn’t seem to present any unique features to draw me away from other options, including my far-and-away favorite, Zoho Creator.

Expecting Too Much

My first and main gripe with the Coghead Application System is the fatigue I experience from too much reading and clicking to get where I need to be. I ran an unscientific experiment wherein I built an identical form with two fields in Coghead and Zoho Creator where Coghead seemed to require roughly 30% more user action to complete the task:

Site Screencast
Coghead
Zoho Creator

Unless I missed something in watching myself click around those interfaces, these are the steps I saw myself performing in each case:

Coghead

  1. CLICK Start from scratch
  2. FILL OUT Application Name
  3. FILL OUT Application Description
  4. CLICK Ok
  5. CLICK wrench icon
  6. CLICK Add Tab
  7. FILL OUT Tab Name
  8. CLICK Tab Type
  9. CLICK Ok
  10. CLICK wrench icon
  11. CLICK Edit Form
  12. DRAG List
  13. CLICK “(i)” icon
  14. CLICK Display this field in the default Collection View
  15. FILL OUT Label
  16. FILL OUT Data Field
  17. FILL OUT Custom Options
  18. Click Add
  19. Finish FILLING OUT Custom Options
  20. FILL OUT Default Value
  21. CLICK Required
  22. CLICK Ok
  23. DRAG Text Box
  24. CLICK “(i)” icon
  25. FILL OUT Label
  26. FILL OUT Data Field
  27. CLICK Required
  28. CLICK Display this field in the default Collection View
  29. CLICK Multiline
  30. CLICK Ok
  31. CLICK Save & Exit

Zoho Creator

  1. CLICK Create New Application
  2. FILL OUT Application Name
  3. FILL OUT Form Name
  4. CLICK Public or Private
  5. CLICK Create Now
  6. DRAG Dropdown
  7. FILL OUT Label Name
  8. CLICK Options
  9. FILL OUT Enter Choices
  10. CLICK Required Field
  11. FILL OUT Initial Value
  12. FILL OUT Field Name
  13. CLICK Done
  14. DRAG Multi Line
  15. CLICK Options
  16. FILL OUT Label Name
  17. CLICK Required Field
  18. FILL OUT Field Name
  19. CLICK Done
  20. CLICK Access this Application

So why did Coghead require me to perform 11 more steps to create those two fields? It seems like in several cases I was asked to click twice where really one click would have worked, and several times it seems I was asked to read about options I should have just been able to comprehend and use, had the icons been more intuitive or replaced by a text link. I’m no UI guru but I really don’t get why I have to click on a wrench icon to be subsequently presented with a single text link.

With Zoho Creator I feel like I’m being asked to do as little as necessary, with the option to dig in and do more when required. With Coghead I feel like I’m jumping through hoops to satisfy the misguided conceptions of a brilliant but misinformed team of user interface superstars. I understand that Coghead is targeting non-technical folks but “non-technical” shouldn’t imply the acceptance or enjoyment of extravagant reading and clicking.

Expecting Too Much, Redux

My second complaint about Coghead is the assumption that I will pay $50 a month so I and four peers can write and use applications with no more than “25,000 Data Records” and a 250 MB attachment limit. Dabble DB lets any user create public applications for free and charges paying customers $25 for 5 users while also offering SSL security and branding features. For $50 a month, Dabble DB gives you room for 15 users. If I read Coghead’s pricing model correctly, 15 users would cost me $250 (5-person plan + 10 extra users at $20 a pop) or $150 (three, 5 user accounts), depending on how application sharing across accounts can work.

When Hope is All You Have

Perhaps my two gripes are a bit unfair, they admittedly stem from my own unique expectations for the nascent market of online application development. Also I am clearly more experienced with Zoho Creator than I am Coghead and Dabble DB, having only flirted with the latter two. But in the case of Coghead there are (two main) reasons why I haven’t gone beyond flirtation with their system. I started with them, after all, and only migrated to Zoho Creator after it became clear the folks at AdventNet were offering something much closer to what I was seeking.

I do think Coghead benefits from a lot of favorable press, their backers fund some impressive companies, their new Coglets look promising, and I’m sure they have a lot of smart people on board who are agressively evolving the CAS. Until I hear of a really good reason though, I’ll stick with continuing to play with Zoho Creator and, when I do venture out to other online application development sites, the next will probably be Dabble DB. At this point I fail to understand how Coghead commands the attention of 17,000 developers and frankly, what all the excitement is about.


Talking to Zoho Creator with Email

July 11, 2007

In Nora Ephron’s Six Stages of E-Mail she documents a gradual descent into madness that the medium tends to propel, saying that although in Stage Two a person tends to regard email as “revolutionary”, by Stage Four they are complaining of drowning in “112 unanswered e-mail messages”.

Fortunately email has other uses beyond helping you neglect correspondence with other people. Google Calendar will email you reminders from your schedule, Feedburner lets you send feed updates through email, and of course lots of newsletters and articles can still be delivered to you via email, though as time goes on people seem to prefer the Web for this sort of thing.

Of particular note when it comes to email’s versatility are automated systems that will send you their output in a message. Most of these are government services and many have been around for awhile; now either sitting next to or effectively eclipsed by more Web-centric applications, but there are still lots to choose from. Check out NASA’s J-Pass Generator, the joint U.S./British project known as INTERMAGNET, and France’s Navimail just to name a few.

Zoho Creator: Email as a data uploader

One little-used and/or little-publicized feature of Zoho Creator is the ability to update a form with an email instead of filling it out by hand:

Zoho Email Import

I don’t know how reliable this facility is or how often the updates run, but it opens up interesting possibilities. I’ve seen it take quite awhile for updates to occur and am not sure what determines when a message emailed into a ZC form will show up, but if you’re not in any hurry to see the data there’s room for experimentation here.

Requesting Airport Weather

Based on the idea that we could have a system out there on the internet do our updating for us, I published a ZC application called simply Airport Weather that demonstrates the concept. It stores about 1700 airports at various spots in the world and prompts you to select one so ZC can dispatch a request to the United State’s National Weather Service who will hopefully eventually reply and update the database with the results of your request.

It works by configuring the Zoho Creator’s sendmail() function to contact the NWS FTPMail system and tell it to send the results back to a ZC form:


sendmail
(
To : input.FTPMail
From : zoho.adminuserid
Subject : "Weather Request"
Message : input.Commands
)

Where input.Commands is a dynamically populated Multi Line field:

set Commands = "reply myzohoaccunt-999@forms.zohocreator.com\nopen\ncd data\ncd observations\ncd metar\ncd decoded\nget " + input.ICAOCode + ".TXT\nquit";

And input.ICAOCode is the International Civil Aviation Organization code for the airport.

This works because the NWS FTPMail service returns data in a way that ZC’s email feature can understand, i.e.:

Houston, Houston Hobby Airport, TX, United States (KHOU) 29-38-15N 095-16-57W 36M
Jul 10, 2007 - 06:53 PM EDT / 2007.07.10 2253 UTC
Wind: from the S (180 degrees) at 9 MPH (8 KT):0
Visibility: 10 mile(s):0
Sky conditions: partly cloudy
Temperature: 91.0 F (32.8 C)
Heat index: 100.2 F (37.9 C):1
Dew Point: 73.9 F (23.3 C)
Relative Humidity: 57%
Pressure (altimeter): 29.95 in. Hg (1014 hPa)
ob: KHOU 102253Z 18008KT 10SM SCT045 SCT250 33/23 A2995 RMK AO2 SLP146 T03280233
cycle: 23

Note that the application can’t grab the full airport name or UTC time since those aren’t in the only format ZC can handle: ‘field: value‘. We grab the Country and Airport name out of the local data after the email arrives by looking it up based on the ICAO code in the ob: field. If we wanted to we could also grab the less-friendly UTC time out of ob: (it directly follows the ICAO code, followed by a ‘Z’).

(You can get the Excel™ files used to import the Country and Airport data as well as the Airport Weather deluge script here.)

Collecting Space Weather data without human intervention

Another example of this sort of thing that doesn’t rely on any user input at all is another ZC application, Space Weather Alerts. It uses a free account at NOAA Space Weather Alerts site to send all the alerts to a Zoho form email address. You can see in the View that I haven’t yet figured out how to truncate the messages to leave out the NOAA Space Weather Scale descriptions can be found at www.sec.noaa.gov/NOAAscales message. Depending on which values are sent in a particular alert, that canned message gets stuck in whatever legitimate field was last sent. Those emails look like this:

Space Weather Message Code: WARK05
Serial Number: 608
Issue Time: 2007 Jul 11 0606 UTC

EXTENDED WARNING: Geomagnetic K-index of 5 expected
Extension to Serial Number: 607
Valid From: 2007 Jul 11 0145 UTC
Now Valid Until: 2007 Jul 11 1600 UTC
Warning Condition: Persistence

NOAA Space Weather Scale descriptions can be found at
www.sec.noaa.gov/NOAAscales

Conclusion

Zoho Creator is a great tool for exploring on-line application development. The email resources above don’t exactly provide exciting or hard-to-find data, but they do show how even a tiny bit of a Zoho Creator API (or AEI, “Application Email Interface”) provides for an extensible environment.

What I’d like to see from Zoho in the future would be more options for interacting with Creator, perhaps a REST API or something along those lines, or maybe just some more options for sending email into an application so we aren’t limited to the ‘name: value‘ format.


Singing to the Require

July 9, 2007

MJMurphy at the requirements defined blog notes that without careful attention to project planning, management, and control there is a tendency for agile projects to deteriorate into chaos.

The post also contains some hints on chaos prevention.

You can click through a step-by-step walk through of the requirements challenge as conceived by the folks at Seilevel.com on their main site.


A BPM state of mind: The Morning Routine

July 6, 2007

Before trying to improve a business process you need to study the tasks that compose it. Find out:

  1. Which tasks are being performed
  2. What approximate sequence the tasks are performed in
  3. How much time is spent performing each task
  4. What kinds of time are spent as each task is underway

Take as an example someone’s everyday morning routine. To help them reduce a tendency to arrive to work late, you could examine their routine as a process. The triggering event would be the person’s alarm clock waking them up, the steps that take place as they are getting ready would be the tasks, and the process’ result would be the person finally arriving at work.

To gather some relevant information about the time spent for each task you could record:

  1. Task description: (”Jogged”, “Walked the dog”, “Showered”, “Brushed teeth”, “Cooked breakfast”, “Rode the train”, etc.) and briefly described (with who, where)
  2. Task sequence: The order this task was performed relative to the others
  3. Task time elapsed: How many minutes spent performing this task
  4. Task time: The types of time expended during a task’s activity.

It’s #4 that can really provide some low-hanging fruit for process improvement. To locate the kinds of time in a process just look for 5 things:

  1. task order: “…certain things work better when done in a particular
    order or at a particular time of day”
  2. wait time: “…time between the moment at which one is ready for an activity to start and the moment at which this activity can actually begin”
  3. setup time: “…the time needed to perform tasks involved in starting up an operation”
  4. time worked: “… the time it would take one worker to do all the work…divid[ed] by the number of workers…it takes less calendar time to finish the job than when just one worker has to do all the work….”
  5. transit time: “…[t]hose idle hours in the car and on the plane…”

Studying the task-level details as they relate to the above help you reduce the cycle time for a process; think of them as control knobs that give you a chance to quickly optimize how long a process takes to complete. Locating the noise in a morning routine process might lead you to make recommendations or ask questions similar to these:

Task order:

  • “Don’t spend time surfing the Web until after you’ve showered and dressed.” (They can just skip the surfing if they’re running late)
  • “Eat after you exercise, not before. You’ll feel less sluggish and have more energy to complete the rest of your tasks.”

Wait time:

  • (If they live with family or several roommates) “You can eliminate the time you spend queuing in line for access to the bathroom by waking up earlier or later than everyone else.”
  • “If you could adjust the rest of your routine to end closer to a scheduled train or bus arrival or to avoid the morning driving rush hours, you won’t have to wait at the stop or in traffic as long as you do now.” (This also sets up the output from all previous tasks with what might be a shorter Transit time)

Setup time:

  • “Instead of searching in the closet or digging through the dirty clothes hamper each morning, you could lay out your workout clothes each night.”
  • “If you stop with the bacon and eggs in the morning, and switch to something like fruit, yogurt and granola, your breakfast will take less than half the time to prepare and the nutrition value will likely be higher.” (If someone is cooking breakfast for this person, maybe it’s Wait time we’re talking here)
  • “You might consider doing your ironing the night before or better yet, stop wearing clothes that require ironing.”
  • (If they take their lunch) “Prepare your lunch the evening before instead of each morning.” (Like choosing their clothes the night before, this doesn’t eliminate the time required but instead shifts its expenditure to outside of the morning routine’s “critical path”)

Time worked

  • “Have your spouse help get the kids ready for school or cook breakfast instead of just you doing it.”
  • “Hire a maid, butler, au pair, nanny, etc. to help out.” (This increases their cost (of living) but frees them up personally for other aspects of their morning routine)

Transit time:

  • “Try to layer in additional activities beyond simply driving or sitting so it’s no longer pure travel: read the news, catch up on your paperwork, listen to your self-help podcasts, surf the Web, read a book, or just meditate so you’re relaxed for the remainder of the day.” (Of course if they’re actually behind the wheel of a car during transit, concurrent activities are hopefully pretty limited)
  • “Let’s find a quicker route to your destination.”

And if you just wanted to take some quick swipes at reducing cycle time you could go at it with items like these:

  • “You seem to take really long showers, averaging close to 20 minutes, could you spend less time in the shower?”
  • “You might try a shorter but more intense exercise routine.”
  • “Could you take the dog on a shorter walk?”
  • “You could probably combine your exercise with your dog’s walk by training your dog to jog with you.”
  • “Does your dog really need a morning walk?”

The average morning routine is simple enough that you probably wouldn’t need to sample many measurements to suggest sensible improvements, but the morning routine is good for a quick analogy.

For actual processes that exhibit some murkiness and/or complexity, you probably ought to put some sensors in place, run some queries, etc., and get some numerical data on time spent to help you get a handle on all the areas ripe for improvement. It will be just a start on gathering important baseline metrics but a great start nonetheless; on top of being a good way to get a handle on where things are at, the basic measurements will provide you and your client with some data to compare with the results of your subsequent BPM magic.

So save the fancy tools for later. And happy BPMing.

By the way, check out Chapter 6 of Alec Sharp’s Workflow Modeling: Tools for Process Improvement and Application Development for a closer and much better study of this aspect of process work. I was fortunate to participate in several of his training sessions and in particular found his teachings on this stage of process assessment to be highly practical.


No Limits

July 6, 2007

An informative ZC post over at Digital Inspiration entitled Create Web Forms with Zoho Creator – WYSIWYG Form Designer points out that:

Zoho imposes absolutely no limits on number of form transactions, the service is free of advertising and best of all, advanced users get more control as they can modify the underlying form logic with simple easy-to-understand scripts (like you have VB in Microsoft Access).

If you are using Zoho Creator to build bug submission forms or for online contests or for accepting job resumes, there’s a special field for you called – “File Upload” where users/candidates can upload their resumes, pictures, documents, etc.


Ganttdead

July 6, 2007

gantthead.com is the premier community for Information Technology (IT) Project Managers

Ganttdead

Gantthead’s mission is simple, to make project managers and their projects more successful.

(beat-us-over-the-head-with-it-why-don’t-you irony courtesy of Google’s cache)


What Wags What: Business Process Redux

July 3, 2007

I realize this is a Nigerian bank we’re talking about but one part of the piece really caught my eye. It reminded me that when it comes to business process work, without vigilance the old mistakes can and will be repeated:

The first stage Flexcube Upgrade project commenced with the Business Process Redesign (BPR) . The BPR project would lead to the establishment of efficient processes in accordance with best practices that would be well aligned with the new version of the Flexcube, while the upgrade project would lead to the upgrade of the Flexcube software from 4.3 to 6.6 (Retail) and from 3.2 to 7.2 (Corporate) to drive the businesses of the Bank.

That seemingly innocent description illustrates one of the biggest pitfalls of engaging in business process work, letting a particular software package be the driver of BPR in the first place. Why is that a pitfall? Because demanding BPR as a precondition for software integration is just a rhetorical technique for mandating that an organization change the way it works for the sole purpose of achieving compatibility with the software it has recently purchased.

Put another way, letting software drive business process work is a euphemism for cramming cookie-cutter “solutions” into a unique organization. The “minor customizations” often deemed necessary to ensure a “successful integration” are the flip side of this coin, modifying the otherwise-cookie-cutter software in often not-so-minor ways so that it can attempt (or appear) to function in places where the organization can’t or won’t change to fit the software.

This obvious example of tail-wagging-dog is one of the main reasons BPR got such a bad reputation in the 90s (so bad, in fact, that many practitioners these days have taken to calling it Business Process Management or “BPM”, just to distance their efforts).

This quote from a 2003 Giga paper entitled Supporting SAP Offshore, under a section entitled Recommendations, shows the deceptive logic that sneaks BPR into places it doesn’t belong:

Business process improvement should be an integral part of any SAP implementation. Companies that don’t take this opportunity to optimize their processes before mapping the software cannot take advantage of the process cost reduction that a package like SAP can enable.

In other words, you can only use this software effectively if you operate like it assumes you do. That might be an absolute key to successfully implementing SAP, but it’s got nothing to do with good reasons to perform business process work.

History has taught us that BPM, or BPR, whatever we want to call it, should quite simply be motivated by a demonstrable need to improve the way an organization operates. Notice how the June 27 article at ZDNet UK, How to roll out SAP, talks a lot about how the award-winning companies were so successful at implementing SAP. Well that’s fine, but what did or will the implementation improve? No mention of that…