Spearchucker

"... the disaster that was Healthcare.gov"

OMG you worked on that? The blame for this one (and Universal Credit) sits with GDS. Their approach at the time was agile or die, and then try to develop an enterprise system like they did the Guardian's CMS (GDS was staffed initally by ex-Guardian devs).

I had the misfortune of reviewing their Government Gateway replacement, which at the time focused singularly on identity federation. GDS was hugely anti-Microsoft, who built the Govrernment Gateway. And so they chose the SAML protocol over the incumbent ADFS, breaking every dependency.

GDS was way out of its league. An inexperienced 25y/o will draft exactly the kind of architecture document you describe.

I feel for you, and I now understand the cyncism.

The people using my system never skim my document. Lawyers tend to scrutinize it. As for the document being a war-and-peace epic yes, this happens. Mostly because people cannot write technical documentation. The hugest system can be distilled down to a single diagram which should require no words of explanation.

By way of example - here's a conceptual design for an insurer wishing to participate in a panel of protection providers.

https://www.wittenburg.co.uk/images/consulting/conceptual_de...

If you're in this world all of it is self-evident, none of it a surprise, and you understand the flow. That document leads to other more detailed designs that each address one distinct rectangle in that image.

At some point all of this will become a specification. Again the immensity of that depends on the ability of the authors. On their ability to manage complexity, and their skill as technical writers.

Either way yes, when the wheels fall off that document becomes the truth, the one everyone goes to to settle disputes. And with a capable team it never gets to that because the documentation is succint and agreed to, and what is delivered matches what was specified.

Thanks for putting that out there. It's super interesting to see what we consider architecture to be. Your approach appears operational, focused on how the completed system functions, i.e. getting a new team member up to speed on the codebase.

Typically I try to start with tiers (1, 2, n-tiers...?) that show how the system might be deployed. I then list list layers (user/facade/business/data), interfaces between these layers, and components within each layer. I do that for each tier.

After that maybe something about quality objectives and how they might be met, eg: availability (MTTF / (MTTF + MTTR) * 100), efficiency, flexibility, integrity, interop, usability and so on.

This leads to a physical delpoyment model, which shows layers deployed to tiers. And yes, I'm rather fond of Visio.

Then a bit about approach (dev/deployment and operational management) risk and stakeholder management, technical reviews (change control board maybe?), and project reviews.

To be fair I come from a predominantly critical systems world (telecoms OSS and BSS, healthcare, transport and some fintech. And in that world architecture is very far removed from actual code until eventually.

Psychologically the enterprise software industry is actively discouraged from creating secure code. The most-heard mantra is to not do it because it’s difficult, making it a pointless exercise. Another is that security testing is too disruptive to production systems. The software industry is good at recommending specific design ciphers and algorithms, and ignoring symmetric and public key protocols (Alice and Bob).

Also, many attacks today target security protocols rather than, for example, cracking passwords.

Another huge impediment to creating secure systems is agile, which discourages up-front design. The average sprint duration of two weeks is too short for meaningful security testing. Testing is not feasible with nightly builds or pre-release sanity checks, either.

Product owners or customer representatives are too often non-technical stakeholders that have the authority to make technical design decisions. While never a good idea, this has bad consequences on architecture and particularly on security.

Defense in depth suggests using controls to protect each individual resource. This includes individual apps, individual servers and individual user devices. A firewall is a single control, but never the only control. This from experience working with... government things.

Please not the latter. There are sooo many apps out there where you wonder if it's a honeypot, has more or less functionality, or is a completely different product. All because the name is similar, and the app icon the same or imperceptibly different.

I use Office365. Yes it costs money, and yes they provide good support. I also use Outlook so ALL my mail, both sent and received are stored locally and remotely. If my mail bombs I lose max a couple hours' worth of email.

So today, if I want reliable messaging, I use asynchronous, non-blocking functions. Like async/await in .NET. If I want guaranteed delivery I write logic to provide that. Again, using .NET. If in-order delivery is required, again, .NET.

Of course .NET can be replaced by anything that supports async, non-blocking functions.

If instead I used message queuing instead of writing the code myself I'm adding yet another configuration item to my system, replete with security holes, patches, operational management, and sourcing the skills to procure, install and run it. Of course each has idiosyncracies you need to learn and understand - like Rabbit's memory-based queues. When the instance goes, so potentially does reliable messaging.

I'm very much not a fan of message queues. Haven't been for a good many years.

Yeah... not quite. From the article -

"Anger treats its target as someone capable of recognizing that she has done wrong... "

This is true in some cases, but not all. Had a girlfriend once who used anger to get what she wanted. It was like cash to her - a simple means to an end.

When I pushed back it spiraled into abuse. She became ever more hurtful instead of being conciliatory tory. Blew my mind.

I'm firmly in the camp that seeks to eliminate all anger from my life, and avoid it in others. Like the plague.

I will find a copy of the book to see what I can learn from it. Until now I've learnt that one cannot attain happiness as a state. It's fleeting. I stumble across it in moments, and it's gone again. And so I try to be content, which is much more persistent.

Note I said "possible". Your link specifically states "During the transition period the GDPR will continue to apply in the UK".

That said, apparently they've just reached a deal, and the transition period ends in 7 days, so lets see what they decided about with data protection.

This is possible now that Brexit has happened. Whether the UK will need to comply with GDPR or not is dependent on the deal Boris strikes with the EU, if indeed he ever does.

I think the first search engine I used was Magellan. Until AltaVista happened. Loved AltaVista, until Hotbot/Inktomi, which was the only one I had trouble letting go of, I think only because of their really clean and minimal UI. Even when Google came along I was one of the few that had a finite number of web sites I used to use that made Google virtually useless to me. The only search engine I use now is DDG.

It was as insane marginalising Google back then as so many other tech fads since then, including IOT, Bitcoin, XP/agile, Netbooks, 3D TVs (remember those?), and so on.

There is an upside to not having used anything Google - to this day I have zero reliance on any single product of theirs.

If being healthy is too much work then I guess obesity wins. I cannot imagine eating fast foods. Cooking is cheaper, besides the healthy thing. It's also FUN.

I mostly cook German stuff, some French, a little Chinese and a fair few BBQs in the summer. I have quick and easy things I make, and more elaborate stuff that tastes unlike anything you can buy ready-made.

I shop at local markets where you get to know the farmers, smallholders who sell what they grow. Food is way too important to me to not put the effort into it that I do.

Lastly, I'm not a health nut. I don't go to the gym. I see my GP once a year and age usually tells me to try get more sunlight in the winter but otherwise gives me a clean bill of health. I'm approaching 50 and sleep 8 hours most nights.

#3. I agree. Amd yet Ian has this to say under "Firefox was never enough" -

All encompassing: The web hosts most of our desktop applications. It should host even more of them, it should host mobile applications, it should be the universal platform. More APIs. More ways to package and present sites. (See Project Fugu)

I fundamentally disagree with this one. There's just too much of a bad security track record on all 6 of the first 6 levels of the OSI model for me to use web apps for office apps.

And so, as I said, I strongly agree with your #3.

There are a number of frameworks that do this, another being SCIPAB:

- Situation

- Complication

- Implication

- Position

- Action

- Benefit

It's a bit heavy for my tastes but helps focus thinking.

https://www.mandel.com/why-mandel/SCIPAB-how-to-start-a-pres...

Wasn't clear, sorry. Facebook censors things, Freenet doesn't. That doesn't mean there's no place for Facebook, and it doesn't mean there's no place for Freenet.

True. Controlling human thought at scale can be useful though. It stops my 8-y/o from watching what he shouldn't. There's a balancing act between FAANGs, and the wild west where you can go looking for things without being hand-held.

The mistake, I believe, is absolutism. If you're a Replublican everything Democrat is bad. Maybe there's a future in which the best parts of opposing sides meet to create a happy place?

Everything is a balancing act. Some FAANG is good. Some distributed web is good. Where on that scale we live is our choice. Choice is good. And sometimes, very occasionally, the illusion of choice is good.

My boy goes to a European School (schools set up for employees of the Union), because my girlfriend works for a European institution. I sit on the parents association of the school. That said -

There already is a common language and it's English. It may not be officially recognized but it's what everybody working for an EU institution uses.

Not knowing any MEPs by name is your choice and not a deficiency of the EU.

First thought after seeing the screen shot was "whoa way too much whitespace." Second thought was that I do all of this in Outlook, and get world-class email, calendar, tasks/todo and notes with it. Also importantly, all my data is both online and off, and there's a non-intrusive app for all the deives I use. Security is also world class.

I tried blogging once. Also didn't have enough ideas for content and no compelling theme, to boot. Used to have imposter syndrome bad, but at some point I just stopped caring about it.

What I DID do was to write things down. Any time I discovered a new thing (risk managment, recovery-oriented computing, various consulting tips/tricks/and so on) I wrote down what I wanted to remember. But I wrote that down on my web site, in HTML. Sometimes when I procrastinate I look to improve the layout, language or content.

There's not a huge amount of content there (maybe 20 posts?), but it seems to interest others so that's ok I guess. I'm happy with my blogging-but-not-blogging thing. It scratches the itch without consuming me, my time, and I don't need an editor.

That said there's a lot of other stuff on there that floats my boat, so there's that work/play variety which floats my boat.

https://www.wittenburg.co.uk/work

"...I felt like I needed to always be seen either in a meeting or butt in chair..."

Yeah, norms. Like the expectation that employees remain signed into instant messaging apps. And the associated values where for example being signed in is construed as a sign of productivity.

I worked as a financial services company like that once where I maxed out my annual bonus and got the highest raises because I was on top of messaging. From messaging in the bathroom, from bars, and for two days a hospital bed.

And here I was thinking I'm the only weirdo writing raw HTML.

Counter example I've been using bluetooth for keyboard, mouse and headphones on my Surface Pro 1 since the Surface Pro 1 was released in I think 2013 or 2014. Never reinstalled Windows, and it works to this day as it did on day 1. I use it 3/4 times a week for maybe 5 hours when I'm not at my PC.

I used to try Linux once a year or so but gave up doing that a few years ago because there is no single place to go to for answers and it's a time sink. The operating system needs to get out of my way so that I can make software. Windows does that.

I'm sure bias has a lot to do with my perception, I'm ok with that.

Things have indeed progressed. Thanks for going to the trouble.

Disagree. No idea if it's there now or not, I haven't checked in years but they had no Alien Sex Fiend, Damned or Jesus and Mary Chain. Oh and no Soft Cell either although that might have been because of a song called Sex Dwarf. This was formative stuff for me and I still listen to it pretty regularly.

Once can't just delegate responsibility like that. Any company should enage in some form of due dilligence before procuring software. If there are expecations of privacy then those should be proven by the company procuring the software, not the vendor.

I do not consider dysfunction something other than the course describes. What I take issue with is that the course offers an outcome but no approach. Read it again.

Why value efficiency and not quality? Remeber Deming (1)?

             Result of work effort
  quality = -----------------------
                  Total cost

When focus is on quality, quality rises and costs fall. When focus is cost, costs rise and quality falls.

(1) https://en.wikipedia.org/wiki/W._Edwards_Deming

Not in any country I've lived, but I imagine there'll be inevitable outliers. Rent is rent though, no? I'd love to know which country penalises you for finding a place to live with low rent...