The FizzBuzz problem asks the person to create a small program in a language of their choice. This program must enumerates from 0 to 100. If the number is evenly divisible by 3 print the word “Fizz” if divisible by 5 print the word “Buzz”… if divisible by both 3 and 5, print ‘Snap Pop’

In pseudo code that would be something like-
for index=0 to 100
if( index mod (3*5))
print “snap pop”
else if( index mod 3)
print “Fizz”
else if (index mod 5)
print “Buzz”

But that’s so easy?!

Or is it, if you think about it the problem shows that the person understands arrays and branches. These are two very simple concepts for coders but for people that are not coders this tends to be completely foreign and weeds them out really quick.

In contract that to a common question such as ‘reverse the linked list,’ which that same person would painfully fumble around on the whiteboard for 30 minutes and waste a lot more time. Additionally it leaves an open questions, do they not know programming or do they not know data structures? Depending on the job I might only care that they can do basic scripting, but haven’t concluded anything other than they should not make production code.

What about people that get it instantly?

For those people we are really testing more interesting competencies. How did they approach the problem did they bust it out in 5 seconds or did they pause and think is there another element to this question?

People that are to egger to jump right into the solution are likely the same group of people that do not plan, are unorganized, and will statistically cause more regressions in the project.

One thing to note is that they might be nervous about the interview but that can be quantified from other body language that they are presenting.

What mannerisms did the person present? 

It is important to remember that having technical skills are only the minimum bar to work for an organization. Past that their social skills will be far more important as no one wants to work with an rude negative person no matter how smart they are.

When answering the question did they act cocky or like the question was below them? These are quick tells that the person will be difficult to work with on larger or more complex problems.
 

The intent of the project was to take an ugly web site and make it presentable. In addition to this a web design plan needed to be created.

For extra fun I also devised a marketing strategy to help grow the business through the use of SEO and SNO methodologies.

http://wasntnate.com/wp-content/uploads/2013/05/Taylor-Ambulance-Company.pdf

Mash up services are what the UoP uses to describe a web service or re hosted content. A simple example would be I subscribe to ebay.com for auction items under a category. eBay provides a feed of items which my site consumes, stylizes and then rehosts the content to sell on my site.

What Logic Should We Apply?
When designing a web site or any other program for that matter, the authors always need to be thinking of where is the data coming from? Do I trust that source? What evidence do I have that it is actually the source I think I just agreed to trust?

Then we need to apply the S-T-R-I-D-E model of identifying issues. STRIDE stands for: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Every security bug fits into one of these 6 categories.

Mock Example Scenario
For example lets say that our site example.com is getting product information from BobsMashup.com. Once this data is consumed we touch it up a little bit add some CSS and other visual effects and render into the view presented to our end users.

Spoofing
What if BobsMashup is hacked? Well then we are going to take hacked content and repush it to our end users, potentially spreading malware. The best defense to this is to always take the content and make sure it is HTML or URL encoded. Then if it is compromised it is less likely to directly spread through your site similar to XSS attacks. A famous story about this was the MySpace worm which was able to take down the once huge social networking site.

Tampering
What if an attacker can spoof EvilMashup as appearing to be BobsMashup? In this scenario our site would grab content from EvilMashup and rehost it as though it came from Bob. Most major web sites combat this by the use of SSL/TLS technologies (aka https versus http). By using SSL the identify of our site can be confirmed to Bob and Bob’s to us. Afterward the content is cryptographically signed to prevent tampering or eves dropping. While the concepts of crypto are crazy difficult using them is often just a matter of pointing at https://bobsmashup.com versus http://bobsmashup.com and the hard work is done in the background transparent to us =D

Repudiation
Bob changes based on the number of times their content is rehosted on your site. If there are no systems in place to audit when what is shown, how do we know the bill is right? Sure Bob is a nice guy, but he might also like to over bill 3%.

Information Disclosure
What if BobsMashup charges for access to their content? In these scenarios access is often controlled through an “ApplicationID” access token. If our site has javascript that is calling directly from the users web browser to bob and the applicationid is available to them. Then there is nothing that prevents random web surfer from reusing that access token to get the content from bob freely while you pay the bill.

Denial of Service
What if the first time a product needs to be retrieved from Bob, it is very network or CPU intensive for the web server. If a non existant item is requested it is just as intensive? Because of this small bug it makes it possible for hackers to flood the site with requests for non existant products, which can slow down the entire web site possibly to a grinding halt in some scenarios.

Elevation of Privileges
Similar to the spoofing attacks getting unexpected content on the page may lead to elevation of privilege attacks. Say for example the attacker can inject JavaScript into the view. That JavaScript would be controlled by the attacker and execute as the viewing person. The viewer might have the ability to do other interesting actions that the attacker cannot. Perhaps the viewer has edit access to the site and the attacker injects jQuery to drive those admin pages.

How I see it there web design has three parts:

• Layout
• Look
• Effect

How the page’s content is logically blocked into chunks is controlled by HTML. These chunks possess metadata such as <nav> denotes SEO navigation section or <article> which says “hey this part is the body of the document.”

The look is the coloration, ‘float’-ation, max width and height, or other visual effects presented to the user. These are controlled through CSS and provide the most direct approach to doing these things.

The effects are form validation, loading dynamic content, sending content back to the server, restructuring the current page and providing business logic. This layer is typically created through ECMA Script or its most common implementation engine, JavaScript.

Each of these layers is fully able to do the work of a different layer, but the cross over can cause problems. For example the Layout can use inline style attributes, the look can execute JavaScript, and effect can build document elements.

As one layer creates the other the model quickly breaks down and inefficiencies begin to emerge. By inline encoding style attributes my page will quickly only work ‘right now and not in the future.’ The look can execute Java but it quickly introduces hacks and falls apart in many browsers. For the effect layer to build elements is tedious.  Additionally the load times of downloading then executed JavaScript code versus tags being read during the initial page load, will be significantly longer.

By following this design model it becomes easier to decide which of the “big three” is best for which scenario. Simply classify the code’s purpose and one can deduce between HTML (Layout), CSS (Look) or JavaScript (Effect).

Online only colleges are really good at the first part, however it is very lacking in the second part. There isn’t really an infrastructure that is likely to foster relationships between teacher and students that will last more than 5 weeks. It is not a secret that many people later in life will get jobs through the help of their peers in class. Heck that’s how I got my first and third “real” job.

In order to combat this organizations like Coursera[1] and UoP should be investing heavily in become Social Network Optimized (SNO) and investing heavily in building and fostering those bonds.

As for proving value and legitimacy that is going to come not from the UoPs of the world but through Massively Online Open Classes (MOOC). MOOC is becoming the standard way that members of the developing world, foreign nations, or anyone else can get a world class education for free.

I highly believe and would even bet money, that this shift in ideology will happen within our generation if not sooner. It will come to be expected not pondered as just another aspect of living in a cloud services and high availability world.

What I found along the way is that HTML5 can be a pain to position things. Then I stumbled across this article on codeproject[1] which did a great job of explaining the rational.  

To make my site I used Visual Studio 2012 For Web[2] which setup everything I needed in a single click. From here I choose to make a “MVC 4 application.” Model View Controller is a programming model the problem is divided into three parts: the UI, the Database, the Server Code. It was fairly easy to follow the code and start building something right away.

During the editing process it auto fixes dumb typos and provides hints as to what you probably want to do next. Later when I compared their validator against the w3c validator, there was two minor issues missed but the rest of the document passed. Also when I ran it in IE9/10, iPad, droid, chrome; looked the same.

There is also some slick ways to link up jQuery and server methods in the Controller making it simple to add Ajax features on the page.

Also if you need a photo editor Paint.NET was free and provided more than I needed[3].

With that solved, I wanted a place to host it and opted for Azure and their free for 90 days. This is more than enough time for this course and they do not automatically renew you on day 91. Publishing to Azure was right click publish then click ok[5].

I hit an issue at first when I published that I didn’t have all the images added into the VS Project. Right click add existing then right click push, resolved that issue.

If you want to look at the outputted page (View Source):
1) Right click save as normal
2) Open  that file in VS
3) Edit->Advanced->Format Document

Links:

[1] http://www.codeproject.com/Articles/146409/Semantic-HTML5-Page-Layout

[2] http://www.asp.net/mvc

[3] http://download.cnet.com/Paint-NET/3001-2192_4-10338146.html?spi=09369c06bc2cea9e4636fbf1f4977a35&idl=n

[4] http://www.windowsazure.com/en-us/

[5] http://www.windowsazure.com/en-us/develop/net/tutorials/get-started/

When I create a site for this course, I’m not sure if I will have a need for this or not. There are certainly many interesting scenarios where importing an object can add unique behaviors. Alternatively one could use JavaScript and many of the additions exposed through the HTML 5 superset of to provide the same behavior.

The rendering between browsers can very significantly. The differences come from the ability to import and utilize the foreign object. For example if I were to import an ActiveX object into IE, it would be understood the same way as any other COM component. Meanwhile if it was loaded into Mozilla or Chrome; these systems do not support ActiveX and would not be able to render the content.

To compensate for the differences many larger sites will use a technic called “browser detection.” This detection method can occur on the client or server side. Server side relies on the client to send an additional header called the ‘User Agent’ while the client side version relies on the API document.useragent. In either case the code checks if the plugin should be supported and uses it or displays an alternative message or different supported control.

I tend to believe that everyone is always out to get everyone else; it might make me paranoid, but it doesn’t mean I’m wrong.

A lot of scams should be easy to see right through like the classic ‘Nigerian scam’ which still trick people even today, not just Murray from Flight of the Conchords. Cormac Herley of Microsoft Research wrote an interesting paper analyzing the scam and why it continues to work.

Once people have been trained to identify and filter the obvious V¹ágiá®â and promises of enlarged genitals scams, then they can focus on the remaining and interesting 10%.

In that 10% one needs to look at the evidence which proves the sender is legitimately someone you have or would do business with. First thing to rule out is anything with improper grammar and spelling errors. Even if they are legit do you really want to get some high school fluky your credit card number?

For mails look at the links do they go to http://bankofamerica.com.evil.hacks.com/secure or a bit.ly style other url forward? These are all signs of a scam. If they do want you to go somewhere always type in the address instead of clicking it.

Let’s say you get cold called about a problem with your account; thank them, hang up and call then back through their public contact information. I’ve had several of these that led to “we didn’t call you.” While you are talking to them you can always punch the callback number into bing/google and the phone numbers that are scams always come up first hit as “this is a scam.”

But above all else, if it is too good to be true; then it is and you are the product, so don’t sell yourself short

It is possible to get by with an abacus or slide ruler, but it is a lot easier to work in terms of spreadsheets and data tables. There is a lot of technology in the world to address making an accountant more efficient, however it doesn’t do any good if they are not tech-savvy enough to use it.

There are two sides to this coin; on one hand it may seem that it is perfectly reasonable to demand the person be able to write complex VBA macros and build complex Sql statements to fine tune their data views.

On the other side is the inverse idea which states they should not need to be tech-savvy and instead only focus on their profession. Or to put it another way this is a breath versus depth discussion.

When building enterprise systems, one does not want a collection of general systems. They need a collection of specialized systems which tightly integrate with its peers, providing more depth through the sum. The same can be said about employees as the need for vendors and outsourcing become higher in order to stay competitive.

In order to achieve such a design, the tools of need to focus not only on the problem but more importantly on how the work was done. As engineers we should always be asking ourselves, would a person that only knows their profession be able to use our work? If not then we have failed them, not the other way around.

Befor reading the chapter, I assumed that accounting was only about keeping track of accounts billable and receivables. After reading this week’s lessons view the role of an accounting system to also include quantifying effectiveness, audit for anomalies, and provide monitoring of trend data.

During the IT Management course we learned that a system that cannot be monitored and results quantified is neither well-designed nor manageable system. In order to mitigate this challenge account systems need to be utilized.

Recently at work I have been spending a tremendous amount of time improving the internal accounting of my IaaS. From aggregating the log statistics into Excel Pivot Charts it is becoming visually clear which areas of our environment are unhealthy. Along with finding general areas of concern we have also starting using accounting technics to quantify the business justification of fixing these issues.

Having such patterns and practices will lead to our organization to making better data driven decisions which will result in higher customer satisfaction on fewer resources.