The Search for Quality

Measuring the Value of Testing

2008-12-07T01:33:00.001-08:00

One of the best and most obvious ways to excel in any company is to show how your work is making the company money, or providing value that directly leads to making the company money. The more directly you can show your connection to how much money is being made, the better position you're in. For instance, if you can easily show that the feature you developed, or the feature you designed and brought to market, made the company $X over a time frame of Y years, you're doing well. If you can optimize the function such that X is large and Y is small, you're on a fast track to upper-management.

Showing this sort of result in testing is a much harder proposition. It's easy to say that you tested a feature or product that made $X over a time frame of Y years, but lets be honest here: being the product manager or lead developer and making the same statement definitely carries more weight when attached to a resume. The person generating the idea and the person originally implementing the idea will always be seen as being closer to the end result and positive cash flow than the person ensuring the value of the idea, and ensuring that the mass market can actually use your idea as expected. I'm not saying that this is "the way things should be", I'm just stating it's the way things are.

That being said, here's why I think demonstrating the value you've directly provided to a product is harder for testers: you can't show the diff between what the product would have made had the bugs you found been released to the public. That is an alternate reality we don't have access to; it's an A-B test that can't be run.
If it were possible to conclusively show that the company made $Z more because of the bugs that had been found, I think testing would be taken more seriously across the industry.

Testing in Layers

2008-12-05T00:13:00.000-08:00

My old boss and mentor was chatting with me over Facebook recently about a concept that he termed, "testing in layers". It is the basic idea of slowly testing out a new release with people who are close to the code, then providing the release to people a little further away (friends/family/investors), then a little further (active members on your forums), while eventually moving out toward your normal everyday users. This idea struck me because it provided a simple mental model for actions that I think many in the testing community are already doing at a basic level, and provided much room for complexity if need be. It's nice to provide a concept around an existing process, so that it can be better codified and thought out.

In my world, I use this idea in the following context:

Test internally with engineering (QA)
Test internally with non-engineering (Marketing, etc)
Test by releasing to trusted users on our forums
Test by sending the release to particular people who email into Support, whose problems may be fixed with this release
Test by releasing to everyone on our forums
Test by releasing to a small number of people who download through the website

One of the issues with this idea is that a feedback loop needs to be in place at each layer. If we should release a build to the forums and don't listen to the complaints and issues that this layer is having, then this testing is pointless. However, the further out you get from the center, the harder it is to get solid feedback. When we release to a small number of people through the website, they probably don't know that they're getting a brand-spanking new release. In this case, how do we get their feedback? As of right now, we simply watch to see if they uninstall, and if the stars align, they might even leave us feedback. It's not perfect, and can use improvement, however so far it's a process that is working adequately to help us determine how the release is doing.

The idea of quality feedback loops for your product will be saved for another blog post. Lets just say that twitter has been proving quite useful in getting product feedback lately.

When has Outlook "Started"?

2008-12-04T23:53:00.000-08:00

I have recently had the opportunity to work with a small team to define and run some basic performance tests for Xobni. If you've done some serious performance tests before, I probably don't need to tell you what a peculiar beast performance testing can be. The fun part about this project is that we are measuring areas where are customers are having pain points, and building tools to automate the running of those measurements. On the other side of the coin, creating a consistent and controlled environment where performance measurements can be taken without fear that something external is affecting your measurements keeps me up at nights. No, not literally, but environmental control is one of our biggest problems.

One particular measurement which we've been stuggling with for some time is simply known as "Outlook Startup Time". How do you know when Outlook has fully, really, finally, finished starting? Most importantly, when do our users think that Outlook has really "started"? This is an important question for us: if we're going to improve Outlook startup time with Xobni installed, we have to know what that means. Well here are a few ideas for measuring Outlook startup that we've implemented in a tool of ours:

When the "Reading Pane" is visible and has text
When the Xobni sidebar appears AND the Reading Pane is visible
When the Application.Startup event fires in Outlook
When Outlook has finished syncing with Exchange
When you are able to move to the next mail and have it load within a certain period of time
When the CPU usage drops back to a level on-par with usage before you started Outlook

As you can see, we're measuring a lot and trying to see what sticks. What are your thoughts? When is Outlook usable, by your definition?

A Different Kind of QA: Calling all Engineers

2008-05-29T10:08:00.000-07:00

This is a repost of a blog post I made on the Xobni blog. You can read the original post here.

It’s common for people to ask why a good engineer like myself would want to work in QA, especially when you have to fight the stigma’s of QA, namely:

1) You are in QA because you are not good enough for development

2) You are in QA as a stepping stone for development

3) You are in QA because you don’t like coding

My response to those statements: pish-posh. While these statements may apply to some people in the field, they certainly don’t apply to the people serious about QA. A good QA Engineer solves quality problems with an algorithmic intensity that rivals traditional programmers. They are a true hacker in the older sense of the word - they are here to find and exploit the problems in the system in any way possible.

Every problem has its boundaries. For most developers, the boundaries for implementing solutions are usually confined to one language, stack, or technology. The boundaries for problem solving in QA are generally much wider, simply because our solutions don’t have to be productized, exposed to the public, and aren’t necessarily even in the same language or stack.

This allows a much wider range of creative freedom when solving problems. Learning new languages and technologies becomes essential for your work. Having a large arsenal of tools to attack a problem becomes a necessary part of the job. This provides you with even more of a reason to learn about the latest and greatest in tech, which is something that appeals to all engineers alike.

At Xobni we approach QA differently than most. The people we look for are not here because they are not good enough for development. They are not here because they don’t like coding. The QA people here are expected to be at the top of their game. They are expected to build and create software that can topple the Jenga-like building blocks of our product. They are expected to be creative people who like to learn, explore, and exploit software.

That being said, Xobni is looking for a QA engineer! Check out the job post, and send resumes to ryan dot gerard at xobni.com if you think you can rock our world.

Productivity and Flow

2008-03-11T23:04:00.000-07:00

I've been thinking a lot recently about that state of mind where you lose track of time, focus intensely, and generally are very productive. This state of mind is not only associated with working; it can be found when exercising, playing games, and other associated focus-intensive activities, but generally I associate it with work, mostly because my best work is done in this state of mind. I find that if I can lose myself for a while and disassociate with reality while working, I generally come out of that state with an amazing amount of work done.

I was thinking recently that if I could induce this state of mind more frequently, I could become a more productive person. After a short amount of googling, I discovered that there is an entire area of research in psychology devoted to this subject; it's known as "flow". One of the main researchers in this field is a Hungarian psychology professor named Mihaly Csikszentmihalyi. He's published a few books on the subject, and the one I picked up is called "Flow: The psychology of optimal experience".

The book itself was a little too self-helpy for my tastes (if you look carefully, you'll see that the subtitle of the book above is "Steps toward enhancing the quality of life"), however I found tidbits inside could have been taken out of any of the software management books I've read.

After skimming through the bits on how and why you desire happiness, I found the core of the book: the elements of flow experiences.

1. Engaging in a Challenging Activity

He explains that the activity you're engaged in has to be at the edge between skill and anxiety. Even if your activity is complex, if you're too familiar with it, it won't be considered "challenging" to your psyche. You have to find something that is within your reach to learn or finish, but isn't easy.

2. Merging of Action and Awareness

Your attention is completely devoted to the activity, such that you have no awareness of the outside world. It is intense concentration, but seems effortless when deeply involved.

3. Clear Goals and Feedback

This is fairly self-explanatory, and it is also where I started seeing parallels in software development and management. On the development side, having small coding goals that are constantly achieved and iterated on is how I think many productive people program. On the management side, providing clear feedback and goals to your employees is a staple of good management.

4. Concentration on the task at hand

This is probably obvious, however what I found interesting was that he believes only a select range of information can be allowed into your awareness when in this state. Irrelevant information in your mental activity can break your concentration, and hence your flow.

Relating this to back to software environments, he goes on to state that quiet environments are essential to keeping your concentration. Much has been written already about how loud environments are productivity killers, and this just provides more evidence to that.

5. The Paradox of Control

He says that the flow experience is strongly associated with a sense of control. This resonates strongly with programming in my experience. One of the psychological benefits of programming (in my non-expert opinion) is the sense of mastery and control one gains over the system you're programming against. "Hacking" (in the Paul Graham sense, not the Kevin Mitnik sense) is merely another way of asserting your control and power over the system, by finding a non-obvious or faster solution to a specific problem. It's a very primal feeling that I think many, if not most of us, desire.

Mihaly then writes that the "paradox" of control "...is that it is not possible to feel a sense of control unless one is willing to give up the safety of protective routines". In essence, your sense of control comes by putting yourself into situations where you actually have less control, since the unknowns are much greater than in situations that you've experienced before. As he writes, "Only when a doubtful outcome is at stake...can a person really know whether they are in control".

6. The Loss of Self-Consciousness

Losing your sense of self-consciousness is a phenomena typically talked about in association with meditation, or zen-like activites. This loss is typically accompanied by, "a feeling of union with the environment". Projected onto programmers, this environment you feel a union with is typically whatever framework, system, or specific program you're working in.

Mihaly explains that what is temporarily lost is not the sense of self, but the concept of the self. High-performing violinists are very aware of their fingers, as runners are aware of their breathing. They haven't lost their sense of self, but the boundaries for how they define the self have temporarily vanished. This can be a very liberating experience, as "...the feeling that the boundaries of our own being have been pushed forward".

7. The Transformation of Time

It is normal to emerge from a flow experience and see that hours have passed without your awareness. What you're measuring when in this activity is not time, but states or milestones. When programming intensely, it's not uncommon to think of your progress not in terms of minutes and hours, but in terms of functions written, functionality working, and pieces integrated. Your world turns into a state-driven world, and not a time-driven one.

For the skeptical types (like me), I want to say that these elements are conclusions drawn from many studies of people experiencing flow in many different types of activities. While this doesn't mean that the conclusions are true, it does have more credibility than just some quack spouting off what he thinks brings about flow experiences.

Hopefully this has provided you with some thought-food to chew on regarding your own productivity. I think the main take-aways from this for me are that to really engage deeply in an activity, one needs:

A challenging task
A quiet environment
Clear Feedback (usually in the form of finished functions and functionality in what I'm writing)
A clear mind
Enough time set aside to engage deeply with the activity

I said earlier that I found parallels with this book and other software books I've read, and these take-aways prove it. These bullet points could be taken directly out of "Peopleware" or "Managing Humans", or any other book that deals with the topic of software productivity. It's always interesting to find parallels between different disciplines, and I think the psychology of programming to be particularly interesting.

The Great TODO List

2008-01-23T09:00:00.000-08:00

Organizing and planning your work is tough. It's not hard to list everything you need to do, but prioritizing what you need to do can be an artform. For instance, do you focus on exploring a problem with the server (which is high-priority to your co-worker), editing a design document (which your boss wants done soon), or finding the root of that newest bug (which is really what I'm getting paid for)? There are definitely subtle tones of politics in these decisions, but I try to keep those matters out of my head when prioritizing.

I was discussing day-to-day planning tactics with some friends yesterday, and we found we all had different methods. I thought I'd share mine with you. I call it the Great TODO List. It's quite simple really. Anyone can start using this method immediately. The low-techness of it is astounding.

Step 1: Open Notepad
Step 2: Write down everything you need to do
Step 3: Put everything you need or want to do today at the top of the list

Amazing, isn't it?

Every day or so I go through the list and roughly prioritize what should be at the top that I may have forgotten about. As I go through the day, when I start to feel like I should be working on something else, I just consult the list, and pop from the top. Yes, the list is a stack.

The one downside to this method is that the list continually grows. I have stuff on my list from a few weeks back that I should still do at some point, but the likelihood of me doing that stuff is getting smaller and smaller by the day. The list needs love and pruning.

Quality and Perception

2007-11-13T00:14:00.000-08:00

Well it's a new start for me. I have a new job with Xobni as their Quality Jedi, and it's a nice change. The startup life has been something I've been talking about for a while, and the time for action presented itself in the form of a ripe opportunity.

I've been thinking a lot more about product quality lately, in the general sense. This is probably because product quality will be much more on my shoulders than before, as I'm working with a relatively new product that has already been launched (in the form of a beta). I've been thinking about how one can attribute the status of "high quality" to any product, and I've realized that the only person who can bestow that status is the consumer.

Ultimately, no matter how much a product is tested and sent through the wringers of QA, the consumer is the one who decides whether your product is of high quality. It is the perception of quality that makes something of high quality. Everyone I know who has owned a BMW has moaned a little about how often it has to be taken into the shop for repairs. And yet BMW retains the status that their cars are of high quality, due to the fact that they are "german-engineered".

The perception of quality is powerful, and can directly contribute to product success. The first product put out by Xobni is called "Insight", and is a plug-in for Outlook that gives you a "people-centric" view of email. Email is data that is important to the consumer (vitally important to some), and anything that builds on top of that data must provide value while not corrupting or interfering with the basic tasks (emailing) in any way.

That is the quality challenge with this product, as I see it from a high-level. What is more important than verifying the product functionality is working as expected, is making sure that the consumers current tasks and environments aren't disturbed by the product.

That being said, now the question is, how can we affect the perception of quality to the user? This is a question I'll have to ponder more. The value we're building into Outlook will allow them to accomplish their tasks faster, and more efficiently. I think this increase in efficiency is the key to the quality perception for our product: the users are getting more done by using our product, without having their current email environment disturbed. This may sound quite basic and obvious, but I think it's good to reinforce these base points as to why we're building what we're building.

Interesting times are ahead.

GTAC!

2007-08-23T11:47:00.000-07:00

Sorry for the lack of posts -- I've been out of town recently.

I'm currently at the Google Test Automation Conference, at Google's New York office. Thus far, it's been a great experience. There are two things I've learned about (this morning) that I wanted to blog about: how to design a conference, and Google's testing philosophy.

Allen Hutchinson, an engineering manager at Google, gave some good insight into how they designed the conference, and why they made the decisions they did. I pulled lots of good insights from this talk.
*Keep the conference to under 150 people. Sociological research has shown this is an upper bound (and a magic number) that allows a group to keep a sense of community
*Provide outlets for people to discuss the conference. Their high-profile testing blog is open for unmoderated comments on this conference, and a google group was created as well.
*Make the talks available online after the conference
*Try to decrease the amount of repeat speakers from past conferences. They want fresh blood and new ideas introduced in their conference
*Ask old speakers to help select new speakers - or just have people outside your organization help select the speakers

Allen also mentioned that they kept the conference to a single track so that you can see all the talks, but to be honest I rather like the multiple track system. It allows more speakers, and allows you to skip talks that do not interest you.

Pat Copeland, a Director in Google, then spoke about the testing philosophy that Google maintains, which I found quite interesting.

*Measure everything you can. More data allows for more analysis.
*Continuous builds and faster builds allow more time for testing
*Focus on improvement of the system, and not the bits and pieces
*Testing Goal: fully test a product in one day

Pat also mentioned some challenges that they face as an organization, which I think applies to pretty much everyone:
1. Simulating real-world load, scale, and chaos is difficult
2. Deciding what to measure is difficult
3. Complex failure scenarios are expensive to test

The talks (and more importantly, the people) have been quite interesting thus far. I'll hopefully have more to update after tomorrow.

My Favorite Laws of Software Development

2007-07-24T21:41:00.000-07:00

There was a great blog on the Laws of Software Development, and there were a few I saw as related to testing that I thought I should share.

Brooks' Law: Adding manpower to a late software project makes it later. Or testers, in this case.

Conway's Law: Any piece of software reflects the organizational structure that produced it. Good to keep in mind when testing.

Heisenbug Uncertainty Principle: Most production software bugs are soft: they go away when you look at them.

Hoare's Law of Large Programs: Inside every large problem is a small problem struggling to get out. Finding those small problems is worth searching for.

Lister's Law: People under time pressure don’t think faster. Or test faster.

Nathan's First Law: Software is a gas; it expands to fill its container.

Scalable Test Selection

2007-07-15T14:08:00.000-07:00

A few weeks ago I gave a presentation at the Google Scalability Conference on the idea of Scalable Test Selection (video can be found here). Now that the video is up, I thought I'd share with you all this idea developed within my team. I must preface this by saying that this was not my idea -- the credit belongs to Amit and Fiona.

As Cem Kaner has said before me, there is never enough time to do all the testing. Time, in essence, is your scarce resource that must be allocated intelligently. There are many test strategies one can choose from when testing a product, however the question must be raised: how do you know whether you're testing the right things, given the amount of time you have to test? This is an impossible question to answer, however there are situations where the question is pertinent. For instance: when a change is introduced to your product at the last minute before release, and you have to decide what to test, how do you choose? There are probably some intelligent guesses you can make on what to test based on what has changed, but how can you know that this change hasn't broken a distant dependency?

This is the situation where we believe Scalable Test Selection can help. Given a source code change, what test cases are associated with that source code? Essentially, how can we link test cases to source code using test artifacts?

We have identified (and presented on) three ways to associate test cases with source code:

Requirements: If source code is checked in to satisfy requirements, and test cases are checked in to satisfy requirements, then a connection can be made.
Defects: A test case fails, which then is associated with a new defect. When source code is checked in to fix that defect, an association is made between the code and the test case
Build Correlation: For a single build, you can associate a set of source code changes with a set of test case failures. Now iterate that over successive builds, and you have a large set of source code and test case associations

With all this data that you can use to associate source code to test cases, when future source code changes are checked in, a tool can be written that can find all the test cases that are associated with that source code. In the case that you're in a time-crunched situation, you can have another source that suggests what test cases you should run in your limited amount of time.

What we're doing is applying simple data-mining techniques to the test data. There is much more to the idea that I'm not talking about (prioritization of test cases, implementation ideas, etc), however I hope you get the jist. I fully recommend you watch the video if this topic interests you, and feel free to email me if you want the slides :).

CAST Conference

2007-07-09T23:22:00.000-07:00

I just finished Day 1 of the AST Conference (CAST), and boy did I have a good time. The talks were good, but the people were better. There was definitely a general feeling of community there, which is something I haven't seen much at conferences I've been to lately. The crowd was relatively small (~180), but all good people.

Highlights for me:
* Hearing Lee Copeland talk about the role of QA as a services group (this makes almost too much sense to me)
* Talking to Jon Bach about the future of AST, CAST, and the other conferences that AST is hosting
* Watching a small group gather after my talk on Meta-Frameworks to share their experience with Meta-Frameworks

Anyway, now that I'm leaving tomorrow, I wish I was staying another day.

The Time Trade-Off

2007-07-07T11:03:00.000-07:00

I started prepping for the CAST conference next week by reading up on some test patterns that the AST group has produced in the past. I was reading some great stuff this weekend by Cem Kaner on Scenario Testing, when I came across a fantastic quote:

"The fundamental challenge of all software testing is the time tradeoff. There is never enough time to do all of the testing, test planning, test documentation, test result reporting, and other test-related work that you rationally want to do. Any minute you spend on one task is a minute that cannot be spent on the other tasks. Once a program has become reasonably stable, you have the potential to put it through complex, challenging tests. It can take a lot of time to learn enough about the customers, the environment, the risks, the subject matter of the program, etc. in order to write truly challenging and informative tests."

It's so true, it's painful. Deciding on what to test is becoming increasingly important in my own work, as the amount of work stacks up, and the amount of time to test it decreases. It's an interesting balancing act.

An interesting bug in Java binarySearch

2007-06-29T06:10:00.000-07:00

Josh Bloch, author of Effective Java Programming and one of the best in the biz, blogged last summer about an error in his own implementation of binary search within Sun's JDK. It turns out that the most straightforward implementation admits a flaw so subtle that the version in java.util.Arrays, in particular, lay dormant for almost a decade. It is one of the most interesting bugs I have seen in a long time, and in fact I didn't notice it myself. Simplified slightly from the original:


// locate an index of key k in sorted array a[], 
// or if k is not present, return -1
int binarySearch( int[] a, int k ){
  int i = 0;
  int j = a.length - 1;
    
  while( i <= j ){
    int m = (i + j) / 2;

    if( k < a[m] ){         // left half
      j = m - 1;

    } else if( a[m] < k ){  // right half
      i = m + 1;

    } else {                // found
      return m;
    }

  }
  return -1;                // not present
}

The culprit is sly: Operating on a large enough array, computing m = (i+j)/2 is subject to integer overflow, becoming negative due to wraparound, e.g.


  int M = 0x7fffffff;         // 2^31 - 1
  int[] a = new int[ M ];
  a[ M - 1 ] = 1;

  // the call...
  int r = binarySearch( a, 1 ); 
  // ...throws an ArrayIndexOutOfBoundsException !

Fortunately the midpoint can be computed safely via m = i + (j-i)/2. Already there are many blog posts on this blemish, but none concerning quality. What might a software engineer learn about testing from this long-hidden oversight?

1. A lesson from numerical analysis, that time-honored formulas aren't necessarily robust when copied to finite arithmetic.

2. Vary your test data. Surely the Sun test battery for binarySearch passed, again and again, on the same sets of arrays and keys. Fine for 9 years -- but static lists of tests become stale. Which arrays should we select, or search for? Read on...

3. Specialized conditions are required to pinpoint rare defects. This flaw cannot be exposed for sizes below 2^30, about 1 billion; no wonder nobody noticed. The truth is that the endpoints of anything almost always provide interesting insights. Here, searching far to the left always passes, and only searching far enough to the right can throw the Exception. Aha. This leads to a favorite maxim...

4. Design tests specific to the implementation. The greatest of the Java int primitives is M -- nothing to do with binary search -- instead, a boundary in the language itself! Therefore, an array of that length makes a worthwhile test case in Java (cf. Mathematica, Python). Something to remember when writing your own test suites.

Professor Kahan at Berkeley once summed up his lessons about testing (from the infamous Pentium divide glitch) into a fitting quote:

Seek singularities!  There lie all the errors.

Wisely put, as are Josh's remarks about programming defensively, vigilance, code reviews, static analysis, solid proofs, and formal verification. (I would disagree with his view that there will always be bugs, but opposing formidable Dr. Bloch isn't really something one ought to do).

The paradox is that although testing can't exterminate our errors, it still needs to be done to provide corroborative evidence of correctness, even for well-proved algorithms! Later, I'll augment this post with test strategies which might have exposed the flaw. With test methods in mind, we might be able to expose ever more errors, and add to our QA repertoire.

An exercise: Using 32-bit two's compliment integer arithmetic, compute the average of i and j, correctly rounding to even. Test it with i and j at the extremes. My solution is not short.

Ubuntu: A Fresh Perspective

2007-06-19T23:30:00.001-07:00

I decided to replace the Fedora core 4 machine I had at home with the bizarrely named "Feisty Fawn" version (7.04) of Ubuntu, which has gotten oh so much attention as of late. Having never installed Ubuntu, I wanted to know what the big deal was.

There was only one disk to burn. That was a nice surprise. I started booting, and found that the CD I burned was actually a Live CD. It booted me right into Ubuntu. Naturally, I didn't read much about installing the distro, so I surmised for a minute that perhaps Ubuntu was just a Live CD. Not so -- after I actually looked at the items on the desktop, I found a single "Install" icon. Clicking this proceeded with the install of Ubuntu on my local hard drive.

The distro has so far proved to be very usable. There is an "Add/Remove Applications" feature which is remarkably like the "Add/Remove Programs" feature in Windows. That is very useful for users who grew up in a Windows world. My one complaint thus far is that I can't login as the root user. I'm sure that if I look around the net enough I can find a way around that :).

Concurrent Programming: The Next Best Thing

2007-06-09T13:53:00.000-07:00

I was one of the lucky few to attend the Google Developer Day in San Jose last week. It was quite interesting. One of the best talks I went to concerned the Google backend infrastructure. One of the topics they've worked on extensively is storing and organizing massive amounts of information. This probably isn't a surprise to anyone, but it highlighted to me the coming importance of concurrent programming.

For a short one-line introduction to the subject: concurrent programming concerns the simultaneous execution of multiple interacting computational tasks. O'Reilly recently pointed out that as the processor speeds remain stable, but the number of processors inside a computer continue to increase. In 5-10 years, having a computer with 50-100 processors will probably not be unusual. The real question is: how do you take advantage of all those processors?

I think many consumers assume that all these extra processors in their computers are being leveraged. I would say they are most likely assuming incorrectly, or at least, they are being leveraged inefficiently. Concurrent programming languages (such as Haskell) allow multiple processors to execute tasks simultaneously, and coordinate tasks between them. Now that's some sexy programming.

It can also make good financial sense to move into this area of programming. In O'Reilly's article, "The Faint Signals of Concurrency", utilizing an 8 CPU machine for processing data is much cheaper than buying a cluster of 8 machines for processing data.

Haskell is already a "hip" programming language (stop laughing). Among nerds, it is the cool language that wears its sunglasses at night, listens to jazz, and can recite quotes from famous philosophers. I would say that this is a bleeding edge language, and really needs more investigation by me.

User Expectations

2007-05-22T21:23:00.000-07:00

Bill Higgins has recently written a fantastic post titled, "The Uncanny Valley of User Interface Design". He discusses how people have a basic mental model of how things should appear, and when they differ from that mental model, we reject them.

He has a great example of this concerning the lack of an explosion of Java GUI apps:

"My own experience with using Java GUI apps of the late 1990s was that they were slow and they looked and behaved weirdly vs. standard Windows (or Mac or Linux) applications. That’s because they weren’t true Windows/Mac/Linux apps. They were Java Swing apps which emulated Windows/Mac/Linux apps. Despite the herculean efforts of the Swing designers and implementers, they couldn’t escape the Uncanny Valley of emulated user interfaces."

He's definitely on to something. This got me thinking about user expectations, and how yet another thing a pursuer of quality must keep in mind is this difficult to quantity quality. The sort of je ne sais quoi of a web or desktop app that maybe meets all requirements, but just doesn't feel right. Sorry, was that french phrase a bit too pretentious? I couldn't find a better phrase to use. It had a sort of je ne sais quoi about it.

High Performance MySQL

2007-04-29T18:31:00.000-07:00

Databases have recently become interesting to me. Previously, they've always seemed like these massive beasts that provide such simple and basic functionality, I didn't understand how companies such as Oracle could make billions selling databases. Yes, it was a dirty word in my vocabularly. And yes, I'm now a reborn DBA in training.

Recently I've been working on a small PHP project reporting statistics on some data from our network. The small project has been collecting for some time now, and has begun to attract some attention. It's also started to slow down considerably. I read a few MySQL performance articles and blog entries, which had quite a few tips and tricks, but in reality I was adding indicies and making config changes without really knowing how to measure the performance differences, or how the change was really affecting my web app. It was blind performance tuning.

And then I picked up "High Performance MySQL". This book is changing my life one page at a time. I've noticed that most of the articles and blogs around MySQL on the web (at least, the ones I could find) were centered around the basic stuff: installation, basic configuration, and cookbook recipes. This book goes to the next level and answers many questions that I've previously had, but didn't have an aggregated place to find.

The key to that last statement is aggregated. I'm sure there are articles out there that explain the differences between InnoDB, and MyISAM, various ways to benchmark your queries to measure performance differences, or methods to cache your queries to improve performance, but having them all aggregated in one place provides context that has proved valuable.

If you're looking for the next level of intelligence on using MySQL in real-world environments, this book is highly recommended.

Testing Old Versions of IE in Linux

2007-04-24T11:46:00.000-07:00

As much as I wish people would move off their old versions of IE and Firefox as fast as possible, it's rather hard to induce this. Microsoft has tried hard to move people to IE7 by making it a Windows Update. However, the simple truth is that when developing web sites, you must support many different browsers, including those old, terrible versions that you wished had never been released.

There is a small problem with this: finding these older versions of IE is rather difficult. Oh they are out there somewhere, but it's not easy and obvious. I usually resort to downloading some version of IE 5.5 off of a sketchy website, and then proceed to do multiple AV scans of the file I've downloaded.

And what should come to the rescue...Linux, naturally! I recently found a project called IEs4Linux that installs IE 5, 5.5, and 6 off of Wine. It's meant to be used for web designers to test site compatibility in older IE versions. Personally, it will be useful for my own web testing -- and now I don't have to use Windows to test IE anymore.

Apple Rising

2007-04-06T20:26:00.000-07:00

Paul Graham, that most prolific of writers for any tech geek, recently posted an interesting article titled "Microsoft is Dead". I think the title was for dramatic effect, as what he means is that Microsoft is dead in the same way IBM is dead, i.e., not innovative or interesting anymore. I believe he's right, for the most part.

One of the reasons he touted as a sure sign of Microsoft's death piqued my interest:

"Nearly all the people we fund at Y Combinator use Apple laptops. It was the same in the audience at startup school. All the computer people use Macs now. Windows is for grandmas, like Macs used to be in the 90s."

Without a doubt, Apple is rising. It's something I've discussed with friends, and spent time trying to decipher. At any tech conference I go to, there are tons of people with Macs. Whenever I visit the Google campus, there are macs all over the place.

What does this mean? Why are people moving to Apple, rather than installing Linux on their laptops with cheaper commodity hardware? There are a myriad of small reasons that I can come up with, but there is no denying the trend. Or fad. I'm not sure which it is.

A good quote to be reminded of

2007-04-06T20:21:00.000-07:00

A recently came across a Peter Drucker quote that struck me as very true.

"Growth that increases productivity is healthy, growth without an increase in productivity is fat, and growth that decreases productivity is cancer...."

I think it's often easy to forget that, in software at least, output is king. If what you're doing doesn't contribute to output or productivity, you may want to rethink what you're doing.

AppVerifier

2007-04-05T16:21:00.000-07:00

I've been introduced to a pretty interesting test tool that was released by Microsoft: AppVerifier. From the intro page of the tool:

"AppVerifier encompasses areas that are specifically designed to test for commonly encountered application compatibility issues, and some very subtle kernel issues."

Pretty nice. AppVerifier works by attaching to the program you want to test, and performing configurable tests whenever the program is accessed. There are five main areas you can configure for testing:

Memory: This ensures that virtual memory API's are used correctly
Thread Local Storage: This just ensures that the TLS API's are used correctly.
Low Resource Simulation: This simulates a low resource environment
Limited User Account Predictor: This lets you know whether a non-Admin user can properly use the program
Misc: Dirty stacks and dangerous API's, according to the website

I'd say it's worth a look if you're testing a program on Windows XP.

Wasting time at Microsoft

2007-03-28T13:52:00.000-07:00

Ryan's Tech Blog (good name) recently had a nice ranting post about how Microsoft wasted 6 months of developer time re-creating a source control client for Codeplex.

"This problem is ingrained at Microsoft, which feels the need to brand everything, but it is in no way limited to them. A search on Sourceforge for “issue tracker” gives 585 results. Sifting through those to pick a winner is difficult."

It's hard to argue with his logic. He makes a strong argument about the need to work with extensible tools that can plug into each other. I think this exemplifies one of the basic differences between Windows and Unix tools that I've noticed: Windows tools are designed as "solutions", whereas Unix tools are designed to be extensible. It's almost unheard of to see Windows tools that are designed to be pluggable, but in the Unix world, the opposite is true.

Collaborative Filtering: An introduction

2007-03-26T14:14:00.000-07:00

Recommendation algorithms are hot right now. NetFlix, Amazon, and StumbleUpon all have examples of working recommendation algorithms that are not only interesting, but useful. Collaborative filtering is the method of prediction that has been widely adopted across these sites.

The underlying assumption with collaborative filtering is that your preferences in the past will help predict your preferences in the future. Assuming that this is true, CF makes itself unique by finding users with similar preferences as you. Once this neighborhood of users is found, it can be reasonably assumed any items they like, you will also like, and hence, an intelligent recommendation can be made.

Using the NetFlix analogy, if you and another user named "Jack", who is completely unknown to you, have rated the same movies in the same way, it can be assumed that you have similar tastes. Therefore, if Jack rates a new movie very highly, the likelihood that you will also like that movie is very high, and it can be recommended.

There are issues with this algorithm, of course. First, you have to build up a reasonable list of preferences for the algorithm to make successful matches of other users. If you only rate 1 item ever, you can't expect great recommendations to come your way. Second, if your tastes change, the algorithm will be able to pick it up, but only with time. There must be time for the new change to affect the weight of your past selections. Last, this algorithm doesn't scale very well. For massive sites like NetFlix and Amazon, I'm sure there are some sort of caching or iterative methods involved so that the recommendations aren't recomputed everytime you login to the site. With millions of users and millions of products, it would simply take too long to load any sort of user-specific recommendation.

There is another method way to implement CF outside of the user-centric CF model described above. You can do an item-centric recommendation too. Rather than find a neighborhood of users with similar tastes, you can look at the specific items you've rated well and find a neighborhood of items with that share similar traits. If you're in a world where the number of items doesn't grow as fast as the number of users, this algorithm would scale much better.

Adobe Apollo Launches

2007-03-19T20:58:00.000-07:00

Adobe Lab's project Apollo has officially launched today. It's an interesting project that lies in the realm of creating "Rich Internet Applications", a buzzword I've been seeing a lot lately.

Apollo is essentially a runtime, similar to Flash. What makes this new and different is that the Apollo technologies are focused on bringing web functionality back to the desktop. It tries to solve the online-offline data problem that people currently have with mail, contacts, news, etc. Gmail is a great application, but when I'm offline (on a place, perhaps), I can't write emails in Gmail to send later. If, however, there was a Desktop app that synced with Gmail when you were back online, that would be pretty sweet.

Apollo is a recognition that as wired as we are, and as popular as the web has become, some major functionality and synchronization issues were not addressed in the jump from the Desktop to the web. Some smooth transition apps that allow you to host your data online on central nodes, but then have that data available locally on distributed nodes, would be very nice to have.

Read more about it here.

Bash has a debugger

2007-03-14T16:57:00.000-07:00

One of my biggest complaints with interpreted languages in general is that the debugging tools available are rather limited. When trying to find the root of a problem, having some sexy surgical tools available to cut into your program are nice. No, more than nice - sometimes they're necessary.

To my surprise, I discovered that Bash has a debugger! Bashdb, where have you been all my life? You can set breakpoints in your code, and step through the script line by line if desired. In terms of basic functionality, it's matches gdb fairly closely. Amazing!

I've used the PHP debugger XDebug before, but I found it to be a bit intrusive into the source code. You have to add PHP commands to the source to enable XDebug. I've never used Python or JS debuggers. Anyone know if good debuggers exist for those languages?

WiX: Windows Installer XML Toolset

2007-03-07T16:02:00.000-08:00

While reading "The Build Master" this week, I was introduced to the tool that I find quite interesting: WiX. It's a MSFT produced and supported tool that has been open-sourced (gasp!). Open-source? Microsoft? Useful? My head hurts.

The WiX toolset allows you to create an MSI rather painlessly using an XML format that they've defined. It's actually quite intuitive and useful. The WISE and InstallShield guys have had the market on creating Windows Installers for the longest time. In addition, the horror stories I've heard from people who have the strength to use the WISE / InstallShield tools really caused me to do a double-take when I saw this tool.

In addition, there is no "setup" to speak of with this toolset. It's literally a set of binaries that you can execute from the command-line. There is no installation overhead, making these tools easy to store and version for build escrow purposes.

There is another open-source tool called Votive that ties in to Visual Studio and allows you to create and control the MSI build using WiX from within the GUI. As Borat would say, Niiice.

The Comfort Zone

2007-03-04T22:54:00.000-08:00

Steve Yegge had a really interesting blog post last week about the average programmer. Take a looksey:

"But how do programmers compete? Generally, they just don't. Not in the way chess players or golfers compete, anyway. The reason? You can't compare programmers quantitatively, so you can't compute a score or a rank. Competitions and competitors have to be scored. Sure, you can set up scored programming competitions, but they're so tightly controlled that they don't resemble real-world software development anymore. Professional programmers basically just don't compete with each other.

Hence, you're probably not pushing yourself. Even if you're trying to improve your programming skills, you're probably just doing it in areas you're already comfortable in. And your improvements probably still aren't happening as fast as they would if you were competing to improve them."

Very true. He goes on to discuss how programmers are ranked relative to each other, since there is no quantitative method of ranking programmers, which in itself is completely subjective (and hence, his complaint). Programmers are ranked according to the context they are in.

His main complaint is about the comfort zone we all find ourselves in. He believes that since it is difficult to quantify the skill of a programmer, incentive is provided for pigeonholing yourself into an area you feel comfortable with.

I think this is true in most professions, not just programming, but I find this very true in testing as well. It is very easy to turn to the same tools and oracles to help with your problems and give advice.

"See, I always thought I was a perfectly competent programmer: as good as you can get, basically. I was building cool stuff, doing seemingly complicated things, and I felt I knew a tremendous amount of lore about the art of programming. I had won or placed in programming competitions, could program in Java for weeks on end without referring to the API docs, and pretty much felt on top of things.

Every few years, I would read some critical book, or have some weighty flash of insight, and realize that I'd been operating all this time in what could only be termed "clueless mode", and that I hadn't really known what I was doing after all. Amusingly, I was always relieved that now I could consider myself to be a good programmer, since I now knew whatever it was I'd been missing before.

Last year it finally dawned on me, after 16 or 17 years of this, that I just might possibly still be clueless about something important that I really ought to know, something that would make me a much better programmer."

Word. Hopefully I'll be that inspired and insightful after 16 or 17 years of working.

Test Personality Traits

2007-02-19T17:29:00.000-08:00

I've begun to wonder what affect personality traits have in testing. The main question I pose to you is: are there specific personality traits that one should look for in good testers? This isn't to say that there aren't people who are excellent testers who have personality traits that aren't amiable to testing, but I'm looking for some generic pattern.

Take cynicism. Cynical people could be described as untrusting. I think it could be argued that this is a good trait to have in a tester. If by nature one does not trust the very inputs, outputs, data flows, and processes of a system system under test, it is possible that one could find more problems, assuming that there is proper motivation to do so.

On the opposite side of the spectrum, what about optimists? If you by nature are a very trusting person, would you unknowingly overlook problems due to your sunny outlook? Or is it possible to seperate your innate optimism from the technical job at hand?

You can probably already read my biases in the writing above, but I'm curious what the world at hand thinks. I'm not suggesting that hiring people should be based on personality traits, especially since I think it is impossible to get a good feel for someone's personality in 4-5 hours; but perhaps, just maybe, it should be taken into account.

The Brotherhood of Building and Testing

2007-02-19T17:13:00.000-08:00

In the past few weeks, I've been embedded in the world of build engineering and configuration management. It has been an eye-opening experience, believe me. There are many splinters and specializations in the software industry, and the area of build engineering is one that I've never really paid attention to until recently. From what I've seen thus far, there are far more connections between building and testing than I've previously known.

There is a web of trust in the process of building any project that one takes a bit for granted, and indeed one must take it for granted. It's impossible to know every detail that every responsibility entails, so you must take for granted that the program manager is doing his job, and the product manager's requirements have been adequately reviewed and vetted out. The one area where the web of trust stops is between developer and testers. The testers are present to be cynical, and in general not trust the output of the developers. This ensures more quality in the software so that the users are not the ones consuming poor products.

I've recently started to think that the web of trust should be breaking down in another place: building. I would say that most engineers take the output of the build engineer a bit for granted. You assume that the build is an instrumented build because the build engineer says so. You assume that the build has the correct fixes in it because the build engineer says so. Well what happens if the build engineer is wrong? Having the correct build is the first step in the testing process, and depending on where you are in the life cycle, the main consumer of the build will be the testers.

I don't think it's too far-fetched to say that a new specialization should open up: build test engineer. The process of building can be complicated enough, depending on the size of your project, and can be a full-time job by itself. Adding value on top of that could be another full-time job. The value I'm referring to is build testing, build metrics, and build consumption.

Just as testers are considered a trusted third-party that can tell you with certainty (i.e., data) the risks and issues found in a product, a build test engineer would be a trusted third-party who could tell you with certainty that the build has or contains the attributes it says it does.

Nerdiest. Comic. Ever.

2007-02-15T23:55:00.000-08:00

This is a bit off topic, but xkcd had quite possibly the nerdiest comic ever tonight, and I thought I should share with you all. It involves Lisp, God, and Perl.

http://xkcd.com/c224.html

Amazing.

The Desire to Build

2007-02-07T13:38:00.000-08:00

My girlfriend and I had an interesting conversation last week about how so many test engineers feel the need to create and recreate tools upon more tools, even if a tool already exists that does what they need to do. This is a situation that has its own acronym: YATT (yet another test tool).

It brings up an interesting question: does this desire come from the very core of what it means to be an engineer, to build and create; or is this possibly something more? Is it possible that this desire stems from deeper feelings of inadequacies at not being a "developer", at least in title? When you need a test tool to perform an action, and there are twenty tools out there already that do this, why should one create another tool?

It's true that some stigma remains around the role of the tester. When people ask what I do, I feel the need to stress that I'm an engineer, but in the testing field. There are times at work when I feel I should be creating something in order to be taken seriously by my fellow engineers. I feel this is true, at least in part. Doing your job, and doing it well, is an exceptional way of getting respect, but there is nothing like showing off something cool to get instant cred. It's like we're in 8th grade again.

Which brings up an interesting conclusion that we came to in our coversation. The testing field needs to a mature a little before such problems will be alleviated. I think that when testing is taken as a serious discipline across the industry, testers will stop trying to be developers and start trying to be testers.

Ethical Hacking

2007-01-23T10:13:00.000-08:00

A common question I get from people is, "What do you like about QA?". Actually, it's also a common question I ask people during interviews, but I digress. It's a question I've thought about much during my time in the industry, and I have a few answers, but my favorite one is that I consider testing to be a form of ethical hacking.

Putting the negative connotations aside, hacking (in my opinion) is understanding a system so thoroughly that you can discover weaknesses to exploit in order to gain some sort of advantage. These advantages could be an escalation of privileges, using the system for ways not intended or devised, or simply disturbing the data in the system. Not to be too picky, but the actual term for this is "cracking". The idea of hacking extends well beyond computers, as many of you know I'm sure. Using the correct combination of coupons to get a good deal at Best Buy (as seen frequently on Techbargains) is using the system in a way that wasn't intended, and is a form of hacking.

Since hacking unfortunately already has negative connotations with it, I like to use the phrase "ethical hacking". As part of my job, I must understand a system well enough to exploit it. Truly there are an infinite number of combinations of actions that one can try to exploit a system. As members of a larger system, one must understand more than just the application under test. You must also have knowledge of the underlying operating system(s) it may be used on, any network protocols that may be in use, the pitfalls of the underlying architecture, the caveats of the language it was written in, etc., etc. It is the understanding of the external world housing the application that one must learn, and in that, there is so much to learn. Which keeps life interesting.

Inducing Low Memory Conditions

2007-01-19T12:14:00.000-08:00

Testing under stress and load conditions are important for every application. Having empirical knowledge of what the breaking point is for any computer hosting an application helps you to plan for such an occaision, as well as giving you an idea of what sort of load the machine can handle before it buckles. If you're aware that having 1000 simultaneous users on a web application you've built is the down-hill tipping point for failure, and you're seeing peak usage at 1200 users a day, you know that it's time to either get another machine or tweak the code to allow for more users on the machine.

Recently I did some searching for a program that would induce low memory conditions on my linux box. I wanted to do some stress testing on a web app while the machine was low in memory. Unfortunately I couldn't find a decent program, so I wrote one! Since I've found that "tutorial" sites are very popular (I visit them myself daily), I thought posting this might be good for the blog. And what's good for the blog, is good for Ryan.


#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define MEGABYTE 1024*1024
#define LOWMEMORY 30000

/*
 * SUMMARY: Induce low memory conditions by allocating memory in 1 MB chunks and checking free memory until there is only LOWMEMORY KB of free memory left
 * REQUIREMENTS: Must be run on a Linux machine, and the LOWMEMORY number should be in KB
 * AUTHOR: Ryan Gerard, ryan dot gerard at gmail dot com
 */

int main(int argc, char *argv[]) {
     void *myblock = NULL;
     int count = 0;
     int freeMem = 0;

     //Allocate memory in 1 MB chunks as long as the free mem can be found and the free mem is greater than LOWMEMORY KB
     while( (freeMem = getFreeMem()) != -1 && freeMem > LOWMEMORY)
     {
          myblock = (void *) malloc(MEGABYTE);
          if (!myblock) break;
          memset(myblock,1, MEGABYTE);
          printf("Currently allocating %d MB\n",++count);
          printf("Free mem is %d KB\n", freeMem);
     }

     //Print out amount of free memory left
     printf("%d free memory left\n", getFreeMem());
     exit(0);
}

/*
 * Parse the output of 'vmstat' to determine the amount of free memory left on the system
 */
int getFreeMem()
{
     FILE *readFile;
     char string[256];
     int cnt = 0;
     int freeMem = -1;

     //Output memory information to file tmpfile
     system("vmstat -a 1 1 > tmpfile");

     //Open the file for reading
     if ( (readFile = fopen("tmpfile", "r")) != NULL )
     {
          //Get the third line of text from the file
          while( fgets(string, 256, readFile) && cnt < 2 )
               cnt++

          cnt = 0;
          char* token = strtok(string, " ");
          while(token != NULL && cnt < 3)
          {
               token = strtok(NULL, " ");
               cnt++;
          }

          //Convert to an integer to return
          freeMem = atoi(token);

          //Close the file
          fclose(readFile);
     }

     return freeMem;
}

A Timeout for Amazon

2007-01-15T23:06:00.000-08:00

I wanted to take a timeout from testing to discuss an area I find interesting: the web services platforms being built by Amazon. I am, of course, referring to S3, EC2, SQS, and Mechanical Turk. I was reminded of these services by Marc Hedlund's post on the O'Reilly Radar today.

The game is afoot in the race to develop the next best thing, and Amazon has released these rather interesting technologies that enable developers to build that next best thing cheaply. Jeff Bezos strikes again with services that leverage the idle parts of Amazon's computing infrastructure and provides it to the people at extremely reasonable prices. Here is a quick overview of the various technologies described above.

Mechanical Turk

"Developers use the Amazon Mechanical Turk web services API to submit tasks to the Amazon Mechanical Turk web site, approve completed tasks, and incorporate the answers into their software applications."

This web service is in reality a masked human-computer interface. Instead of humans asking computers to perform actions, computers are asking humans to perform actions, and using the results in whatever computations are being performed. The entire developing area of funnelling work off that is easy for humans to do but hard for computers (visual pattern recognition, reading obscured text, etc) is interesting, and efficient, assuming you can assemble people to actually do the work.

S3: Simple Storage Service

This is truly a simple web service that allows you to store and retrieve any amount of data from the Amazon infrastructure, and you only pay for what you use.

"It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of web sites."

This is a very simple idea, and easy to grasp the significance. Storage is cheap, so make is available anywhere through standardized methods. The first obvious idea around this technology, online backup, has been done by a few companies already. The cost, you ask? $0.15 per GB-month of storage used, and $0.20 per GB of data transferred.

E2: Elastic Computing Cloud

E2 is to computing what S3 is to storage. E2 provides a web service that allows you to increase your computing capacity on the fly.

"Amazon EC2 reduces the time required to obtain and boot new server instances to minutes, allowing you to quickly scale capacity, both up and down, as your computing requirements change."

The first obvious idea I can see with this is reducing the Digg /Slasdot / reddit effect on smaller sites. I hate clicking on a link from one of those sites to only find out that it maxed out its bandwidth limits two hours ago.

Virtualizing all computer resources like this is quite interesting - I'd be interested in reading a story by someone who completely runs a site from Amazon's infrastructure. Requests made to the domain would use the EC2 computing cloud to retrieve the page requested from the S3 storage service. Traffic would be monitored, and in the case of a statistical spike, more computer resources could be called within minutes to serve your new readers.

Again, the cost is very reasonable. $0.10 per instance-hour consumed, $0.20 per GB of data transferred, and any associated S3 costs.

SQS: Simple Queue Service

"Amazon SQS offers a reliable, highly scalable hosted queue for storing messages as they travel between computers."

SQS is a giant distributed queue using Amazon's messaging infrastructure. This service-based asynchronous message technology is a little less obvious in terms of realistic functionality, but very geeky, and hence, very interesting. It reminds me of when Google released Google Sets. My first thought was, "What sane person would use this?", and my second thought was, "I wish I could think of a reason to use this".

Extreme Testing

2007-01-12T00:36:00.000-08:00

I'm sure many to most of you are familiar with the principles of extreme programming. It can be quickly characterized by writing unit tests before coding and pair programming, but you can read more about it from this webpage.

I was thinking on the way home today about possibly modifying the rules of engagement into something called Extreme Testing. It would focus more on the relationship of the two people in the pair. In particular, one of the two would be a QA engineer. They would work closely together in the planning and designing phase - not much would change there. During the coding phase, the two would spend half their time together in a modified pair programming mode; most likely the main developer would do most of the coding, and the QA person would be there making recommendations and understanding what's going on. The other half of the time would be spent on their own: the developer doing his thing, and the QA person developing test plans, documenting the design, and creating process flows and timing analyses. Then in the end there is a big celebration with much rejoicing.

Why would one think of such a scheme? What is the possible value of this to you? A more effective method of knowledge transfer. Very loosely, here is how the software development process works today: the developer designs the component and hands you a design doc. That developer then builds his component, and hands you (the QA person) a finished product to test. Meanwhile, you must learn the intricacies of this component on your own, for the most part. You have a design document, and checked it code to sift through to understand the inner magic.

Being in QA, understanding the component better than the author is your quest. You must know it so well that you can break it with your left pinky. However, the process of transferring that understanding and knowledge is somewhat broken. Here is the current process: developer's head --> design document --> QA's head. Stuff is lost inbetween, I assure you. Developers stereotypically dislike documenting their component, making the knowledge transfer process more difficult. Seriously, I love a well-written design doc. It's like crack-cocaine for me. I would mainline a well-written design doc if I could only fit it on that little spoon.

So what is the solution? Well how about some extreme testing? Working side by side with the developer while he's working, and documenting the component and processes involved are a better way in my opinion of guaranteeing that the knowledge is tranferred more effectively.

Quality Problem Solving

2007-01-09T23:45:00.000-08:00

All good engineers are at their roots good problems solvers. Despite the fact that my degree is in computer science, I feel that I should have received a bachelor's in "Technical Problem Solving". This may be obvious to some of those reading this blog, but this point was definitely not emphasized going through school. Until you're pretty deep into the program, you are led to believe that this education is in how to program, and nothing else. I'll have to write later about the issues I have with computer science education before I digress any further, as this post is about a book.

I've started a book that has turned out to be quite interesting. The book is called Quality Problem Solving by Gerald Smith. Now before you laugh at the fact that I found this interesting, hear me out. Being that I'm a member of the QA community, it is problems of quality that currently concern me. I find the book to be very realistic in its view of quality and problem solving in general, without any hokey aphorism's or a-b-c methods of solving problems. For instance, take this gem:

"The most common weakness in practical reasoning, as in problem solving, is incompleteness. Poor outcomes result not so much from the mistakes we make as from the possibilities we overlook."

Gerald starts the book with a very sober view of the word "quality" and how it has been manipulated and had its meaning raided by corporate vandals, citing TQM and other quality fads frequently. He rightly states that these movements had good principles and ideas behind them, and if used in the right context were very useful. However many were applied to solve every problem known to man and beast, and hence, fell out of favor after failure in those contexts.

He continues on to lay down a philosophical yet clear foundation for solving problems, discussing problem identification, problem definition, diagnosis, and alternative generation. He discusses these topics in general terms, and provides good examples for each.

The last part of the book applies the problem solving foundations to specific problems related to quality. I can't evaluate that part of the book, as I have not yet read it, but it looks promising. The TOC lists the topics of conformance, efficiency, product design, process design, and unstructured performance problems.

Basically what I'm saying is this book is good, and I recommend it.

More learning materials

2007-01-06T23:58:00.000-08:00

Continuing with the last past of highlighting good learning materials, I saw on Michael Howard's blog a post about online security sessions from the Microsoft TechEd IT Forum. It looks like pretty awesome material. There are videos profiling "real" hacking techniques live, Vista UAC internals, and Vista kernel changes.

For anyone in QA that will be working on Vista, these look like good resources.

Google London Test Automation Conference Video's

2007-01-06T15:43:00.000-08:00

I realize that this is old news (September 2006), but I wanted to remind people that there are some fantastic videos available through Google Video. Specifically, the London Test Automation Conference video's being hosted. Some great stuff is covered if you have the time, including a video on Selenium (a programmatic cross-browser web GUI test tool), and distributed testing with SmartFrog.

These videos are highly recommended if you have the time and inclination.

Exploratory Eating

2007-01-03T11:39:00.000-08:00

My girlfriend and I sometimes perform these food experiments. For one month, we do or eat something differently just to see what happens. For instance, we were vegetarians for one month. This month of January, we're cutting all sweets and desserts out of our diet.

I guess these are more like body experiments. The point is just to see what happens when we change our diet. You can call it "exploratory eating". Do we feel more energized? Healthier? More tired? Is there no change?

The point I'm trying to make is that the testing mindset can (and should) be applied outside of software. Applying your skills in testing on your finances, health, and mental well-being could be a interesting (and possibly rewarding) experience.

Test Automation Architectures

2006-12-31T00:38:00.000-08:00

I recently received an email that held gold. Well gold in the way of interesting reading material, but gold nonetheless. It was a link to a PDF on "Test Automation Architectures" by Bret Pettichord, and linked off of the famous CSTER website.

The entire concept of testing and automation patterns is one that interests me, and I think is one that is ripe for some research and further investigation. Patterns in software development are common now with the Gang of Four's famous book, Design Patterns. But the development of niche patterns, in areas like testing and automation, are very interesting indeed. I am aware that work in this field is being distributed and collected by testing.com, and I think their work is fantastic.

The Absolute Need to Document

2006-12-24T16:17:00.000-08:00

During my time in the field of QA and testing, I have learned to appreciate the need for documentation. As a student, it always seemed that commenting and documenting your code was a frivolous waste of time and energy. To be truthful, as a student, documentation was a waste of time and energy. Nobody will see your code ever again after it's turned in. Nobody will be inheriting your code later on, and have to struggle to figure out what the hell you were doing with your code. Also, most of my projects simply weren't large enough to warrant thorough documentation.

However, this lack of documenting creates bad habits that are passed on after one eventually graduates and enters the work force. The size and complexity of the programs one works on become much grander in scale, and yet the skill and desire for proper documentation is not present. This creates more problems than you can know, and has caused severe headaches and a lot of wasted time in my case.

If an alpha-geek super programmer makes you an amazing program that does exactly what you want, is completely localized, and has very few defects, I'm happy for you. If he or she didn't document it, you're completely screwed. When the program in question needs to be updated, added to, patched, or modified in any way (which is almost a certainty), you are dependent on the original programmer to be able to remember how they implemented the program the first time (assuming that the original programmer still works for you), or you must have another programmer waste considerable amounts of time understanding how the program works. If, however, that original programmer effectively documented the program in a way that made knowledge transfer possible, you can have another programmer pick up the slack with much less ramp-up time.

In this world where knowledge is king, there must be a way to transfer knowledge effectively, or it is essentially lost. Enforcing documentation is simply a smart way to protect your company assets. You cannot assume that the developers who know how something works will work for you eternally, and you must provide a way to communicate the internal workings of the program to others. Otherwise those that need to know how something works (QA, managers, other programmers) will waste the programmers time over and over again while they explain how their program works.

In addition, I've found that documenting helps me to focus on what I'm working on, and flesh out implementation details that I'd put off in the back of my mind. By having it down on paper, it's like I have a map of exactly what I need to create and implement. Documenting is about looking ahead, thinking ahead, and spending time now to save it in the future. So the next time a programmer tells you he doesn't need to document his program, tell him to suck it up and do it anyway, because documenting isn't about him or her - it's about everyone else. Spending a couple hours now to document a program will save you and others hours and hours later on.

Despair.com takes on Testing

2006-12-22T11:25:00.000-08:00

I couldn't help but laugh at this picture. All comedy has its roots in tragedy.

The Importance of Test Design

2006-12-22T10:47:00.000-08:00

"More than the act of testing, the act of designing tests is one of the
best bug preventers known. The thinking that must be done to create a useful test can discover and eliminate bugs before they are coded - indeed, test-design thinking can discover and eliminate bugs at every stage in the creation of software, from conception to specification, to design, coding and the rest."
-Boris Beizer, Software Testing Techniques

This is so true it's almost painful. I've seen projects where thousands of tests are run, but they aren't the right tests, and hence defects are missed. Creating massive automation infrastructures and purhasing expensive commercial testing programs (or "solutions", as they like to be called), is really a worthless exercise in time and money if you're not designing intelligent tests.

For example, lets say you have a function that takes in a string and returns the number of characters in that string. All the fancy test programs in the world aren't going to help you if your QA engineer doesn't test it with unicode characters, null strings, or strings with no null terminator.

Test design is absolutely one of the more interesting and creative aspects of QA. The simple process of coming up with possibile ways that one can break a component is a creative process on its own, but also one that requires technical expertise. How can you know the many ways to break a product on a Windows platform if you don't have indepth technical knowledge of Windows? It's almost a philosophical question - how can you know the things you don't know? There is only one answer: keep learning and expand your knowledge boundaries.

Defining Automation

2006-12-20T22:36:00.000-08:00

I find the big problem with automation is that the word "automation" is generally used as some sort of all-encompassing silver bullet keyword. Cold feet? Try automation! Lost your sense of smell? Try automation! The very word seems to imply some sort of panacea for all your testing aches and pains.

I've found that automation works best when it is solving specific problems, with a narrow scope and focus. A good problem or process to automate would be one where you want to build your program, copy it to a server, run some sanity tests against it, and then email you to tell you it's done. A bad problem to attempt to automate would be trying to run all unit, functional, and system tests on your build, across multiple operating systems, programming languages, and is extensible enough to withstand future changes in requirements. In my opinion, this type of program is too large in scope to be reliable. I'm sure there are people (or companies, rather) that have attempted and succeeded at such a project, but an automation project of that size needs its own separate QA team.

What I'm trying to get at is when testing complex systems, don't use even more complex systems. Complexity will by nature introduce errors into the system. Keeping your testing systems simple will reduce the amount of errors within your test system. Obviously there is some loss of functionality, which is why I'm a fan of stringing together multiple simple systems in order to do more complex automation, when necessary. Modularity in automation is the key to success.

Here are a few good blog posts on the subject that cover different ways to view the same problem:

Open Source Chocolate Factory

2006-12-17T17:32:00.000-08:00

I had a fantastic visit to the Scharffen Berger chocolate factory in Berkeley today. They were quite generous with the samples, and even more interesting, they showed us the exact process they use to make their chocolate, recipes and all. They even let us take pictures of their equipment inside the factory. As the tour guide (Mandy) told us, "We're the only chocolate factory in the US or Europe that not only allows you inside the factory, but we let you take pictures". It's like an open source chocolate factory.

Ok, not exactly. I can't start modifying their chocolate making process with my own beans and spices. But the transparency of their process and ingredients reminded me of open source software. The transparency builds trust with their clients, who are now more confident about exactly what they're eating. They are obviously confident that nobody will steal their processes, and for good reason. I may know now how they make chocolate, but investing the millions of dollars to copy them is not something I'm willing to spend the time and effort to do. As you can probably tell by now, I'm making parallels to software here.

PHP Static Analysis Tools

2006-12-15T20:32:00.000-08:00

I did some searching today for PHP static analysis tools, and came across some interesting ones.

PHP-Front: Not yet even at v0.1 yet, but I await the release eagerly. You can download unstable releases if you want to test it out.

PHP-SAT: Made by the same people (person?) as PHP-Front, and also not yet even at v0.1 yet. You can download unstable releases if you want to test it out.

Pixy: This looks like an academic project, but at least they have something working! The analysis tool deals mainly with detecting XSS vulnerabilities.

Searching for PHP dynamic analysis tools did not turn out as fruitful.

Mutation Testing

2006-12-14T21:26:00.000-08:00

When thinking of the phrase, "who polices the police?", I immediately think of testing. Indeed, who tests your tests? How does one even delve into the process of meta-testing, which seems to create an infinite loop of testing? Why would one think of such a thing?

The fact is that some companies are very keen on simply having test cases pass, and don't consider whether or not those test cases were even worth executing. A coworker recently told me that on his last team, a test suite that was run on a computer that didn't even have the software installed passed with an impressive rate. Why? Because they were being measured on how many test cases passed, not whether they were good test cases. As stated by Dr. Adam Kolawa,

"In general, there is no easy way to tell if the test suite thoroughly tests the program or not. If the program passes the test suite, one may only say that program works correctly on all the cases that are included in the test suite. The more cases a test suite contains, the higher the probability that the program will work correctly in the real world."

Outside of fixing the reviewing process in such a company, which is absolutely a solid way to help alleviate this problem, there is a method of testing known as Mutation Testing that I'd like to discuss. Lets assume that you have a perfect test suite, and the perfect program. All test cases that can be run, are run correctly. If you change the code of the program (creating a mutant), and run the test suite against it, the suite should detect some kind of error. If the suite fails to detect the change in the code, you have another test case to create :).

Obviously there have to be some kind of bounds on this. First, selecting what code to change has to be the intuitive and creative task that abounds in engineers involved in testing. Changing a variable name is not inherently an interesting piece of code to change if the change is global. Changing the database calls is an interesting test case. Second, you must limit how much mutation testing you do. There is no end to the number of different mutants you create, and with a smart enough engine, I'm sure you could semi-automate this task. However, mutation testing is merely one of many types of testing one should focus on, and should not be the main focus.

You can read Dr. Adam Kolawa's paper on Mutation Testing on StickyMinds.

The New Outsourcing of Testing

2006-12-13T23:49:00.000-08:00

Most programmers I know that get excited about a new idea are really only interested in creating prototypes. The creation of the initial 60-70% of the program is exciting and fun, especially if there are new languages and technologies to learn, but finishing or even *gasp* testing the program are not within their world-view of fun and exciting. This in itself isn't a problem - I am also guilty of such facts when I have a new idea in my head.

However, that doesn't excuse the person or company for releasing that prototype out to the public as a "Beta". Yes, the new outsourcing of testing I'm referring to is the shift of the testing duties from in-house engineers to the external users. By labelling the product or site as a "Beta", the company can reduce their own testing effort and force the burden on their users. When users do have problems, the company can say with confidence, "Well no wonder, it's a beta!".

Unfortunately, the psyche of the Beta user has decided to go along with this plan. When using a Beta, the user feels like an early adopter, and is less likely to feel angered when the system crashes and causes their hard drive to catch fire. I mean, it's a beta, right?

Lets face it, creating quality products is a difficult task, but that's no reason to get lazy. Beta used to mean, "it's basically done, but we want feedback on the feature sets and usability". To be fair, some companies still operate this way. Most of the startups I know in the bay area do not operate this way. They are in line with the "release early, release often" mantra of such greats as Paul Graham and Tim O'Reilly, however for them, release early means release crap and see what happens.

With the many high-profile security problems plaguing businesses across the world over the past 5-10 years, security has become a big deal in the computing industry. I'd like to see the same push with Quality.