OK, so obviously it’s been offline for over a month now. I’m just making it official.
I’ll be back online in April 6.
When the dev team sends an app to the QA team and gives them a list of QA tests to run … they might be forgiven for expecting the QA team to run the aforementioned tests. In a reasonably prompt manner. Such as: if the app is to deploy in a month, the QA could be done in that month.
And if the QA team wants to take that month of open-endedness to test some new QA tool or process or whatever, then perhaps the QA lead should tell someone on the QA team to do something with it.
And when dev asks after 3 weeks about progress, don’t start blowing smoke up their skirt about how it was given out and the person just didn’t recognize the name of the app when the QA appointee has stated that he doesn’t have anything in queue …
*sigh*
One of the email lists i’ve been sub’d to for a few years now is the SANS NewsBites .Unfortunately, in the last year or so, i keep finding myself without the time to read it in my inbox reasonably. As in, I purged a bunch of them this summer from the first half of the year, and I think I still have the rest in my box now. Whee 
On the other hand, I manage to hit my newsfeeds on Google Reader semi-regularly. I tend to just skim the headlines on the BBC News feed, and I may not read all of my articles, but it’s nice to have them there. Unfortunately, the SANS NewsBites RSS has the headline and then a tiny bit of the actual article. And I like to read the SANS articles or notes from the editors and the related links a bit more frequently than I do the BBC … And I really hate having to open a new window for every article.
So one of the things I worked on the last few days was to set up a system whereby I could convert the emails to an RSS feed. And I have! SANS NewsBites E-Mail RSS
It’s still a work in progress, but if anyone wants to use it, I’ll be seeding it through the weekend probably, not sure how many old newsletters I’ll bother with but the feed is set to show the entries entered in the last seven days. And I’m still working out how to display everything well, since the <script></script> tags I obviously want to escape out to make them visible, but if i do that they become < instead, but if I leave them in I’m afraid they’ll parse Still working on that one … I’m sure there are other issues with it that I’ll hammer out over time. For now it looks like it will work ‘decently’ so I’m running with it. The next step is to set up something to auto-parse the emails so I don’t have to log in to get them in.
And once I have this one working , I may look at SANS Ouch! and @RISK too … but those are more freeform and self-related …
So, this is what we call a slow week.
No one above lower-management is in (and hasn’t been in since last week) … there’s no new work coming in, plenty of time for everyone to catch up on old tasks …
So I walked through my list of open tasks … deployed, deployed, deployed, deployed, deployed, waiting for feedback, waiting for feedback, in testing for the QA team, waiting for feedback, waiting for user response on whether to proceed, waiting on direction on what this cryptic task title MEANS …
well, hell.
Tired and heading for bed, but finished the QA writeout today. Found (and fixed) a slew of issues during that process, so I SUPPOSE it was good 
Final tally was ~110. Would have been more like 125, but by the time I finished the grouping with 40 tests I had lost what little enthusiasm I might have had, and so the following tests are somewhat …. less exhaustive :/
Going to try to find my notebook and notes for the DES example. AGAIN. Which means I’ll probably write about NIST’s SHA-3 stuff in the meantime … Or more code follies
You know you’re in trouble when a “Good Day” consists of saying “Well, the database only crashed once, but since we have a caching proxy almost no users will have noticed. ”
Of course, when that’s a Good Day … Bad Days are freakin’ hilarious
For instance, one day the network router connecting the incoming pipe … got turned off?
The main web server … got rebooted? and didn’t start the web server up? wtf?
The database starts crashing every twenty minutes … and starts eating data occasionally …
Mind you, the guys who got tasked with beating the test servers within an inch of their lives to figure out the crashes seemed to be enjoying themselves!
So, we’re working on conjoining our quick development and structured development groups, at work.
First off, to define those …
- Quick Development
- I intentionally renamed this after initially calling it “rapid development” because RD is a defined methodology of development, which isn’t what I’m talking about. QD is, if you will, just development of scripts and small applications that consistently need a short turnaround. Get the project Monday, and if it’s a big project maybe get until the following Monday. But frequently of the “we need this by noon” variety. Small things, change this text, whip up something that provides the user with XYZ, etc.
- Structured Development
- The SD team, on the other hand, gets requirements, builds design documents, has a QA team associated with them, and frequently can get 6-12 months for a significant update.
Now, I’m not saying that the SD team doesn’t get “uh oh! the code in this app is wrong, it needs to be fixed before anyone goes home tonight!” issues (Error Reports, they get a high priority), and QD gets some tasks that take months, like completely changing how the system works. But QD is much less formalized and closer to “whoever reads their email first grabs whatever’s come in” in the morning, while SD has weekly meetings to assign out new tasks. Because no one expects them to be done immediately anyway, a few days here and there doesn’t slip the deadline any
But, as I said, they’re trying to conjoin the two teams. Which makes sense, why have two sets of developers? Except it’s running into some problems. First of all, the two teams use entirely different programming tools, in general. Java and PHP share little in common. Second, the mindsets are drastically different “I wonder if anything is on fire?” vs “What is on fire now?”. And then there’s the QA process. QD does their QA by internal testing. Usually the developer runs some tests based on vague commandments in the requirements. And if you ask for guidance, what you get is “Click around and make sure everything works.”
Now with QD expected to use QA for testing, we’re having to document our QA tests. And most of our tests are either vague (“I clicked a few things and nothing exploded”) or non-existent (“They said to change this to do X, now it does X”). This has led to some amusing issues of late.
On one project, we were asked to write a script that generates an email and lists the records matching X and Y. So we wrote the script, working with the people who needed the email to make sure we were matching X and Y correctly. When the script was done, we had them tell us that the email was correct and matched what they wanted. Then we had to send it to QA. Uh? OK. Here’s the script. Testing procedures? You run it. What’s the output supposed to be? Ask the people who want it, or I can give you the output from the last test I did and you can make sure it still matches itself … You want to test the automated execution of the script? But that not working is user, not coding, error! *sigh*
The other I’m still working on. This literally had directions of “Try various View links and make sure it displays the right stuff.” For my own testing I had expanded it to note the various KINDS of links to make sure I checked multiple options. I noted the various uses and the various conditions that should work or not (as in, if you change the date to before today to look something up, you can’t create a new entry in the past. Only the future. But today is OK, even before now today, as long as it’s still today. But not after 8pm, because that’s not today anymore, it’s tomorrow, but still show today … see why I needed notes?) Now I’m working on formalizing the testing for the QA team to test the latest updates.
It turns out that the set of options for just CLICKING AND LOOKING had 16 different variations. Maybe only 8, but to make sure that various links work I had to end up looking at the same generating page multiple times, but with slightly different data. Make sure that entries created by admins show up differently than entries created by users, make sure that if you choose column A and then change the date that you still get column A on the new date. Now make sure that picking column B leaves your date alone. Three views of the same page, but different tests.
I’m truly fearful of the vast number of tests for creating and editing entries. Because there are two types of entries, and each type has 3 or 4 sub-classifications. And they’ll all need to be tested. And that’s just for tests that should succeed. Then I need tests that should fail, to make sure the failure is meaningful and functional. Wheeee
Hopefully by the time this posts I’ll have finished the test listing and can fill this in with how many total tests there were in the end. But I’ll be shocked if it doesn’t clear 100. If it gets near 200, I won’t be done when this posts, because this is boring and that’d be like 40 a day … plus other projects that get higher priorities
When we went to India, I had intended to take my logbook and the DES algorithm and work through it (again), methodically and structured this time. You know, at the top of each page I put the numbers from the last iteration for start, then work the iteration in the same places, so I can always see which piece is where because it’s not changing.
But then I left the docs on the kitchen counter where they were from taking the pics. And I simply do NOT remember the DES algorithm off the top of my head. Are you nuts? So that didn’t get done.
Because I know the DES work would get tedious, I had also picked out ~10 of the Project Euler problems that I could work out on paper, maybe type in a code when we got back to test it and get the final result or something. But then the printer choked hard and wouldn’t print anything. So I didn’t take those.
Part of the intention of those had been to get some content that I could post easily during the recoup time between India and Thanksgiving. So nothing got posted in November because all of that content didn’t get done. But now Thanksgiving is over, and we’re not (AFAIK) going anywhere until next summer for holiday … so here’s hoping I can get back to posting at least twice a week here.
Going to try sticking to the TTh schedule, it’s a good twice a week set.
So, small organizations, teams, groups, what-have-you, have some things going for them.
- Easy communication
- Easy to identify who to contact
- Quick collaboration
Of course, there are some problems
- Low overlap of work
- Hard to pass work over for vacations
- Easy to miss communicate something
See, it’s nice that we have 2.5 devs on our team. Technically two, but there’s a third dev in our “group” who sometimes helps even though he’s technically part of a different project. They just only have something for him ~25% of the time, so he fills in some downtime with working with us. When a task comes in, whichever of us has the most detailed knowledge of the area of code involved gets that task, or at least balanced against their workload. If they have a big or time-sensitive issue, then it may slide to the other dev, who then becomes that expert for the next task.
But, going on vacation? Yeah, that’s complicated. Because when asked “Does anyone else know this code?” the answer is, quite frankly, “No.” Not that they can’t figure it out or understand it, but they haven’t before now. Because they were working on their tasks.
If we had 5 or 6 devs, then there might be two of us working on any given task, so when one goes out, the other has general familiarity and may just be missing out the details of this small piece where they weren’t primary.
For instance, I had three big code projects finishing up as I left. One is deploying after I get back, one can wait because it still has to go through acceptance with the customer .. and the other deploys the day before we fly in … AWKWARD.
Of course, that’s nothing compared to the call I got at 3pm on my last day asking if we could deploy another project, that had been waiting on feedback for 3 or 4 months now, ASAP. They wanted “before you leave on vacation” but THAT wasn’t happening. It simply wasn’t on the schedule to deploy, and we have a 1-week advance policy. But it can’t wait until I get back apparently, they promised the customer it’d be out by the end of the month … Yeah, oops, sucks to be you?
So I put together a deployment request and the release files … and told my boss about it and said “you all have fun now, y’hear? ” Because I garauntee I’m not cancelling international flights because they’re morons
So, I screwed up the DES example somewhere I think. I’m fairly sure, anyway. Yeah.
Somewhere in:
First 8 iterations of DES Example
I made a mistake. I’m fairly sure the setup was correct:
Initial DES Setup Steps
And the first few iterations:
DES Iteration 1
DES Iteration 2
DES Iteration 3
You can see where I botched R’(2) by shifting the wrong values around.
Then F(3), K(4), R’(4), C(6), K(6), F(5), R(5), R(8), D(9), K(9), F(8), R(9) …
DES Iteration 4
DES Iteration 5
DES Iteration 6-7
DES Iteration 8
Those are the errors I found while I was working.
I’m also fairly sure that at some point I started getting R and L confused, in F most likely, when I’m XOR’ing. And I just didn’t have the … energy to go through it all to find the issue. I may work it after thanksgiving, or I may restart it in a more structured manner that will force me o keep track of the C D L R in proper manners.
OTOH, If I ever get this done properly and find a good way of displaying it, this is basically what I started this blog for. Showing the process, so that it’s easier to grasp, rather than just the mathematics and the sometimes hard-to-follow standards definitions. Not that I’m looking forward to MD5, RSA or Blowfish, for example