Revelations today about a security breach at Sony Pictures. If the claims are true, the company failed to take even minimal steps to protect the identities of their users. Passwords were stored in plain text.

There are many reasons why this happens: naive business sponsors, inexperienced or pliable developers, poorly thought out or narrowly defined requirements, lack of regard for user privacy, and simple schedule pressure that leads to mistakes and cut corners.

It is unacceptable to assume stored user information is not sensitive simply because your site doesn’t do anything sensitive with it.

People re-use passwords. They shouldn’t but they do. They may only be signing up with you for access to white papers but that username and password may crack facebook, paypal, capital one, or any number of other websites.

We can’t treat websites as something less than software, cram as many front facing features into them with as little time and investment as possible and expect a serviceable, safe, and usable consumer experience.

We can’t treat developers as disposable widgets that are there to “work hard” and “do what they’re told” and expect them to watch our back by behaving as ethical professionals and crafts people.

We can’t expose customers to this kind of risk and expect to retain them as customers.

The best way to encourage new and onerous legal obligations is to act irresponsibly because there is no current legal obligation to do otherwise.

There is a historical pattern. A new field starts generating significant wealth and the resulting products and services become widely adopted by society. As a result of that success, failure becomes more visible, more frequent, destroys more wealth and harms more people.

The industry, practitioners and the government step in to reduce the failure rate. The typical result is government licensing of practitioners and regulation of businesses, accreditation of training organizations, and professional bodies with codes of practice and certifications.

I’m not against any one of these things if they evolve gradually.

But if we create another “software crisis.” This time one that affects the safety of large swaths of society or the wealth creation their trust of the internet represents. Then these things will happen too rapidly, too thoughtlessly.

So, here’s my plea to product people and executive sponsors:

• Realize software is complex and websites are software.
• Hire experienced, thoughtful developers, encourage them to tell you the truth and LISTEN TO THEM.
• If you take risks to get something to market, take the time later to circle back and invest to bring that risk down.
• Don’t take risks that can harm your end users.
• Realize a website is not a onetime upfront spend but an ongoing commitment of time attention and resources.
• Realize if you intend to use a website for a short time or an experiment, follow through and dispose of it — or be prepared to invest significantly more in turning it into a long-term asset.

Here’s the plea to my fellow developers:

• Take the quality of our work seriously.
• Learn, learn, learn how to write good code.
• Take our end users seriously. DO NO HARM.
• Band together and demand the best of each other

Short link: http://jkat.me/j5y2Fy

Tag(s): ethics, failure, harm, software development, Sony

Comments: none

I present tomorrow, Tuesday, at 3:30pm.

You can download the draft handout for my presentation here.

Short link: http://jkat.me/mtlYB7

Tag(s): agile, handout, presentation, scrum

Comments: none

My goal was to build a Brightcove player that the layers the videoplayer and playlist in the same space with a way of toggling from the one to the other. I wanted to create minimal code external to the player and I didn’t want to do any custom Flash development.

Brightcove Experience Markup Language (BEML)

Brightcove offers their customers the ability to customize players via an XML extension called BEML which has a complete, if terse, DTDDoc.

I started with the BEML for a standard player template Video with Dropdown.

It contains the video player and the playlist layout I want to use. I basically want to stack the one on top of the other.

I duplicated it, renamed it and then edited the BEML.

BEML layout is pretty straightforward. It reminded me of java AWT. Components are laid out in canvasses with either vertical (VBox) or horizontal (HBox) arrangements.

And there is an element called ViewStack which takes any child components and layers them one on top of the other.

So, the first change was to place the UI within a ViewStack and then make sure the children of that ViewStack are the layers I want (if I didn’t wrap the components correctly the playlist combobox would be one layer and the playlist another).

Next, I need a component that lets me toggle back and forth from the player to the playlist and back. I chose to use a simple link. I placed it directly below the ViewStack.

Next, I added some text below the videoplayer for the title and short description of the video currently loaded into the player.

Finally, some inline CSS as allowed within the BEML dtd in order to have the text fit in the TitleLabel I just added and here’s the complete BEML for the revised player:

I did the rest of the color customizations in the publishing tools in Brightcove Studio.

This only addresses the UI of the player. I now need to wire up events.

Brightcove Player API for Javascript

Now I need to enable toggling between the player and playlist when someone clicks on the link. Brightcove doesn’t enable this within BEML itself. You need to interact with the player externally using the Player API.

The first step is to make sure your player is enabled for the Javascript/Actionscript API. This is a checkbox on the Global Tab of the player settings. It is by default unchecked.

Now, you need to load the Brightcove Javascript library. I loaded the combined js file as described in the Brightcove help page.

Brightcove supplies an API document.

When a Brightcove player loads in a page, it calls an onTemplateLoaded method that you can place in the page to gain access to Brightcove’s objects and interact with the player. There are examples of this on a dozen sites.

function onTemplateLoaded(experienceID) { /*insert code here*/ }

For encapsulation, I’ll create my own Javascript object. Construct it in this method passing the experienceID.

function onTemplateLoaded(experienceID) { new SnsCompactListVideoPlayer(experienceID); }

In the constructor, I obtain a reference to the Brightcove module object, lookup the link element by its ID then add an event listener for click events.

I had to bind the click event to the instance of the video player — otherwise when the event fires, the this keyword references the calling page not the player instance. I did this using the apply method.

In the event handler, I check which layer of the ViewStack is topmost (selectedIndex) and switch to the other one making sure to pause the video if it is currently playing whenever someone clicks to view the playlist.

I also wired an event to the video player to make sure that whenever the player plays, it becomes the selectedIndex in the ViewStack. This handles whens someone clicks on a video in the playlist.

Short link: http://jkat.me/jI11ro

Tag(s): brightcove, javascript, video

Comments: 2

At Agile NYC I presented a pecha kucha. 20 slides. 20 seconds per slide. This is the fourth and final part.

Angel on your shoulder

Agile values call for honesty and trust. A shared ambition to do better and be better while causing each other less unnecessary pain.

I try to remember this in one on ones, retrospectives, coaching and in reflecting on my own decisions and actions.

The great thing about these values is that even as you strive towards them your co-workers will give you permission to demand more of them.

Just as they will demand more of you.

This demand gives you an angel on your shoulder. Watching you as you work. It inspires even as it shames you into substantial actions that go against your nature. And you do this because your team needs you to.

You invest in the hard daily work of adjusting your own bad habits one behavior at a time in the interests of the people you work with and the work you do together.

This isn’t easy. It’s mortifying. It’s scary.

But the reward is that you get to be the same person with your boss that you are with your peers that you are with your staff.

The reward is that you get to work at your best with other people working at their best.

And you carry that potential with you as you move on to other projects and other teams.

Ultimately, I want more than success on a project or in a particular job. I want a career.

I want to be proud of my accomplishments and I want to be proud of who I was as I attained them.

I want to spend my life loving what I do.

And I want to build things that are useful and delightful to people.

Short link: http://jkat.me/ifOHqL

Tag(s): agile, AgileNYC, failure, pecha kucha, Team, values

Comments: none

At Agile NYC I presented a pecha kucha. 20 slides. 20 seconds per slide. This is the third of four parts.

People over process

Robert Stolarik for The New York Times

Cathie Black was Chancellor of New York City Schools for three months. She was hired despite having no education experience and no affinity for public schools, parents, teachers and students because she was, “an excellent manager”.

I love that agile doesn’t celebrate management. It relies on individual contributors. It relies on community.

The oozy failure wrapped in the chocolatey success of agile is when we focus on process mechanics and lose sight of people.

If we do, our practice becomes arbitrary and abstract.

There’s a study that claims the best and worst performers have more in common with each other than those in the broad middle.

While the best are energized by their caring and use that passion to drive to the best outcomes, the worst are demoralized and ruined by it.

The indifferent middle, they just plug away.

When we impose a process upon a workplace to avoid failure. We rob the best performers of opportunities to engage and care.

We preclude the best in an attempt to avoid the worst and ensure mediocrity.

I acknowledge that successful products can emerge from awful workplaces. And that that good teams often create failed products.

But working in a way that tears down talented people’s desire for work is tragic. To repeatedly do this this is to sap the world of its limited supply inspiration, creativity and joy.

Short link: http://jkat.me/g5XN62

Tag(s): agile, AgileNYC, creativity, failure, pecha kucha, process, values

Comments: none