Time for a whitelist?

Here’s a new approach to a safe internet: instead of trying to filter out unsuitable content for children, how about an opt-in system?

A low-tech solution. But some of the high-tech solutions are worse.

For some reason, the news story that’s all the rage at the moment is how to stop children looking at internet porn. I’m not sure exactly what’s happened to bring this, but I can vouch it’s a tricky one. Not so long ago we were looking into testing a website for, amongst other things, checking content was suitable for everyone to access. It would potentially involve moderating everything posted, including forums, applications and documents. And even if we could vet all of that, what’s to say a linked page site will be suitable? And what about linked sites from linked sites? And linked sites from linked sites from linked sites? Not easy at all.

Now, I’ve always thought that the same rules should apply on the internet as apply everywhere else. For adults, the basic principle, quite rightly, is that you should have the choice to view what you want (bar a few accepted limits such as paedophilia, certain depictions of rape, incitement to violence and so on). For children, there are a few rules such as 12-, 15- and 18-rated films, but it’s broadly viewed as the job of a parent to decide what they should see, and that’s the way it should be. The internet, however, has made this job harder. Yes, in the old days there was lying about your age when seeing an X-rated film, or borrowing the mag your mate got off the top shelf, but it’s now possible to view this stuff without even leaving your room, so it must be taken very seriously.

Newbies are your friends

All programmers and testers share one weakness: they don't know what it's like to not be familiar with computers.

Easy to laugh - but in IT the equivalents to push and pull signs aren't so obvious.

(Cartoon from The Far Side, in case you live on another planet.)

I have a confession: for a long time, I couldn’t get the 3G internet to work on my smartphone. When I bought it six months ago, I could make calls and connect to wi-fi, but the mobile broadband stubbornly refused to work. I read the manual from beginning to end, trawled the internet, fiddled with every setting and swore at it, before I finally realised mobile broadband wasn’t switched on.  After all the times I’ve been showing off making things look easy that other people struggle with, I can consider this a taste of my own medicine.

But, embarrassment aside, that was a good lesson in what it’s like to not be a techie. As a late entrant into the smartphone market, I was getting to grips with things that are second nature to most users. To someone who is familiar with Android, checking 3G internet is activated is such an obvious thing it’s not even worth mentioning,^[1] any more than a locksmith would consider it worth asking if you were pushing a door with a “PULL” sign. But little things like this add up and can stop people using new products completely. This is where usability testing comes in.

The dreaded feature creep

Even in the best managed projects, feature creep is difficult to avoid. Here are my tips for how to reduce the risk.

Apologies for another quantum mechanics in-joke. But this explains a lot.

Right, I’ve been told off for starting too many blog entries with “I’m afraid this is going to be another moan”, so this time I’m going to try to be a bit more positive. My last post had a go a web designers often over-charge for websites, and people who actually pay them that much. This contained an observation that this can apply to IT procurement more widely, with an example of the notorious contracts for £3,500 per computer in some government departments. Having thought about this, it was a harsh generalisation.

Where government IT projects overrun costs, it’s rarely because a company charged a fortune upfront. It’s usually because the initial costs are cheap but the contractor charges extra for things like including additional features, or installing new hardware. In some cases this gets out of control, like ridiculous call-out fees for something as simple as changing a mouse, and that is a key driver to the argument that IT companies rip off Whitehall. But the IT companies do have a good counter-argument. They often say that if government departments ask them to do a simple task, and then keep changing their mind in mid-project, it really does cost that much to keep making all the changes. I have come across both scenarios in my time.

But if we forget these two extremes and assume both client and contractor are genuinely motivated to work together and keep costs down, the fact remains that controlling costs is an absolute bugger. It is very difficult to get every detail of a working IT system right when the system currently only exists in paper plans. The mistake that must be avoided at all costs is “feature creep”, where more and more changes are requested to software in development, until costs rocket, the original design is no longer fit for purpose, and if you’re the NHS – well, we know what happened there. But there’s nothing new about feature creep, so why is does this mistake keep being made?

Are web designers the new car mechanics?

Websites are easier to make than most people think. Bear this in mind when a website designer wants a hefty payment.

A joke, obviously. But does this sales pitch work in IT?

Advance warning: this post is another moan. Up to now, I’ve had two pet hates: people who sign up to wildly optimistic cheap/convenient IT projects that turn out to be unreliable and expensive; and at the other end, people who block trivially easy IT projects because of silly overblown cost estimates. I’d forgotten the third type. But we’ll get on to that later.

This story begins with my website – you know, the one in my shameless plug masquerading as a piece on Search Engine Optimisation. Well, my web traffic is still quite abysmal, in spite of pushing up the Google rankings. But from the few people who’ve looked at the site, I’m quite likely to set up a website for an arts organisation, which I’m happy to do as a freebie; and if all goes well I may get some paid work off the back of that. And in this scenario, the obvious question is: how much should I ask to be paid?

The thing is, there’s nothing special about my web design knowledge. What I created for myself was technically very basic (I was using a free web template and Kompozer if anyone's wondering). I’d rate my skills above those of a 13-year-old who has discovered FrontPage – I do at least understand the importance of Cascading Style Sheets, W3C compliance and not doing fancy animated backgrounds – but ask me to produce a site that handles user-uploaded content, streaming video or credit card payments and I wouldn’t have a clue. And yet paltry offerings to the interweb like mine seem to be regarded as the height of technical genius.

Give penguins a chance

Would switching to open source software save public money? I don’t know, but we should at least try to find out.

The Windows logo versus the Linux mascot. A little-known but very bloody feud.

I know software testing is a very absorbing activity, but in between bouts of testing you might have noticed there’s a bit of a financial crisis going on. As tax rises, benefit cuts and axing public services don’t go down that well with the public, the government is keen to find less painful ways of saving money. This, in part, was the idea behind the Spending Challenge letters that went out to all public sector workers shortly after the 2010 election asking for ideas to save money. The ideas ranged from the pragmatic to the ridiculous, but one suggestion that caught my eye was to switch proprietary software for free open-source alternatives. This is not an unthinkable as you might expect; the Lib Dem manifesto said they’d look into this, and George Osborne himself is said to be interested.

I’ll be open and upfront here: I use Linux, LibreOffice (effectively the successor to OpenOffice) and other free open-source products wherever possible. It’s partly I don’t want to pay for software when free stuff does the job, and partly because I have problems with the way Microsoft uses its dominant position to make life difficult for people who use competitors’ products. But I don’t believe in imposing my views on other people, and I’ll help out with any IT problems whatever software they’re using. (Indeed, a software tester who doesn’t is a short-lived one.) I wouldn't push savings too much with a charity (Microsoft usually heavily discounts software for them). I’d also be hesitant to encourage a small business to switch to open-source when everyone they work with expects them to do all things Microsoft. The public sector does not have that problem – they mostly communicate with each other, and they’re big and ugly enough to insist anyone else works with their software if they wish – but any move away from Microsoft or any other proprietary software must save the public money, and not just be done to prove a point.

SOPA is not the answer to piracy

Ordinary people’s livelihoods need protecting from copyright theft somehow – but SOPA is too high a price to pay.

Apologies to software testing blog entry fans, but this week it’s another generic IT-related post. This can’t wait because, as you may have noticed, there was a blackout of several websites last week, most prominently Wikipedia. This was in protest over the Stop Online Piracy Act  (SOPA) going through the US House of Representatives, and although this is only a US law, like software patents it stands to affect the UK. The participation of Wikipedia has suddenly brought this issue into the spotlight, with pro-piracy activists, pro-control record companies and all sorts of people in between giving their points of view.

Let me be absolutely clear: I have no time for pirates, especially not those who run websites like The Pirate Bay. They are not noble crusaders selflessly standing up for internet freedom – they are big businesses who make a packet from advertising and subscriptions without the tedium of sharing the proceeds with anyone who made the stuff in the first place. Yes, the music industry has survived home taping, CD copying and bootleg market stalls, but file-sharing makes the practice much easier, so the issue must be taken seriously. I couldn’t care less if Jay-Z or the chairman of Sony-BMG can’t afford an extra Mercedes, but they aren’t the real victims. And I’m not talking about the people who work in the music industry (although this is a valid point the record companies make), but the small-time artists struggling to make a living.

Don’t be afraid to upgrade

Upgrading software in the workplace requires caution – but some companies make this far more complicated than it needs to be.

No, you’re not having a strange dream, Microsoft really is celebrating the demise of a flagship product. Continuing the tradition of celebrating milestones in web browser development with cakes, Microsoft’s latest cake marks the “death” of Internet Explorer 6 – or, more accurately, the decline in US IE6 usage to 1%. Microsoft have make a huge effort to get people off Internet Explorer 6 (obviously, they’d rather you went to Internet Explorer 7, 8 or 9 than Firefox, Chrome or Safari, but an effort nonetheless) through hasty development, advertising campaigns, and now even silent updates to upgrade remaining computers. And with Microsoft themselves admitting IE6 has had its day and even the die-hard open sources fans accepting that IE7 onwards is a big improvement, you’d think everyone would be happy.

If, however, you’re reading this blog from a UK government building, you may think you’re accessing news from a parallel universe. The UK public sector is inexplicably at odds with the rest of the world. IE6, like most early browsers, has a sluggish Java engine that runs at snail’s pace on modern Java-Rich pages. Most public web pages have now dropped support for IE6. And yet when the China hacking scandal exposed hugely embarrassing security flaws in IE6, and the French and German governments warned everyone off IE6 (and , for a while, later versions), the Cabinet Office insisted there was nothing to worry about.  To be fair, web browser security isn’t the be-all-and-end-all for government buildings – their strongest defence will always be the safeguards within the Government Secure Internet – but the web browser is the last line of defence in a compromised network, and it’s a reckless to rely on a web browser written before widespread broadband adoption and the security threats it brought along.