What's the technical reason behind the 2010 bank card problems in Germany? - banking

It's been in the news (1) (2), but there's been no technical explanation, besides that it is a software bug on the chip.
Is there any further information on what kind of bug this is? A one-off bug, some number conversion problem or ...?
EDIT: Apparently the bug can be circumvented by modifing the terminals' software. I'd be nice to know, how this is done.

A similar problem what happened with SMS's received by some windows mobile phones. They appeared to come from 2016. This probably had to do with the interpretation of BCD numbers as hexadecimal.
This results in interpreting BCD 10 as decimal 16 instead of decimal 10
maybe something similar happened here.

My guess is that we're simply seeing the results of management cutting costs on development and testing. There is probably just a simple little bug at the bottom of everything, and it escaped QA.

Related

Rational Requisite Pro

My company wants to use Rational Requisite Pro to manage their requirement documents, and they want me to come up with a plan.
I need to know where can I go to start this process?
I would start by asking what problem the company expects Requisite Pro to solve for them. More often than not companies select a tool as a band-aid for a process that's fundamentally broken to begin with. If an organization doesn't fix the real problem then they'll end up just spending a bunch of money and get little value out of it.
My 2 cents.
Brandon
Sounds like downloading the trial and looking at the docs would be a good place to start:
http://www-01.ibm.com/software/awdtools/reqpro/
Unless some eejit manager has already made the decision, I'd wonder if a survey of tools would be a good idea. Sometimes an open source tool can be better than a licensed product. For example, Subversion is the hands-down winner over ClearCase, the Rational source code management system. Perhaps that will be the case here as well. You owe it to yourself and your company to know who leads in this space and what open source alternatives there are:
http://sourceforge.net/projects/osrmt/

What should a tester report?

I have a web site I am building for a client. I now have a tester on the project with me.
I feel testers are needed. REALLY! I cannot test my own code. I also appreciate the value of a new set of eyes. But what desires reporting?
It is easy to say everything should be reported, but I don't have someone between me and the tester to filter out the unimportant requests. The tester does not know the system nor the target user well. She is assigning me tasks and not the project manager. I think this will change soon, but until it does, what do you recommend? There seems to be a believe that our users have NEVER used the interent before at all, and they are as dumb as rocks.
The problem I am having is that EVERYTHING the tester suggests is being accepted automattically and assigned to me.
I have many cases that make me drop my jaw and say "Really? Are you serious? This deserves to be a issue?"
Ex: Need to add text at top of page that says "* = Required" for required fields.
Have you ever felt this way? How did you deal with it?
For now, I am just doing as I am told, but I am making it clear I do not agree.
It sounds to me like your tester is doing the right thing. You can't assume any level of user expertise when testing an application. If a user can break something, they will.
You and your tester need to work out a severity scale. The outliers (those that anybody with Internet experience could probably work around/would never hit) would be considered low priority and sit on the back burner until you knock out the high priority items.
...never the less, those outliers should still be logged because they can definitely come back to bite you in the ass in the end.
You need to add priorities for your issues. This will allow you to do the important issues first, and cosmetic issues last. Here is example priorities from Jira:
Priority 1 - a reproducible crash; issue blocking any further testing or development of a specific feature; loss of user's persistent data; huge memory leak
Priority 2 - a major issue that must be fixed before the product is released; prevents users from using a feature; negatively affects partner; significant memory leak in frequently used functionality
Priority 3 - a minor issue that should be fixed before a product is released; does not prevent users from using a product; highly visible usability issue; small memory leak in rarely used functionality
Priority 4 - a purely cosmetic issue; doesn't affect functionality
Actually it sounds like your tester is doing the right thing (and the text for "* = required" is a very good idea).
In addition to the suggestions about prioritizing reports, I would suggest that you categorize the reports as to whether they refer to user experience or functionality.
You and the tester will never exactly agree on what "needs" to be reported. Just set the priority on issues correctly, and get on with fixing the high-priority stuff first.
One thing you absolutely do not want to do is to discourage the tester from filing bugs. That'll come back to bite you when something ships totally broken, and they say "I thought that was just how it worked".
Do make sure that you're communicating the development schedule and status properly, so they don't waste time testing features that aren't sufficiently complete.
I would report to the client what each change will cost in terms of time and money. Things that are legitimate bugs you'll probably need to fix on your own time (unless your contract says otherwise). Things that are design / subjective issues you should be able to assign a cost to. Let the client know what it is going to cost them and they can decide if they want to proceed or not.
Hopefully you've got some sort of a project specification that the client has signed off on so that you know when the project is complete and what sort of things are not included in the project scope. If not, you might have a bit of a fight on your hands. For changes that you think are outside of the project scope, you might need to compromise - maybe bill them at a cheaper rate or split the cost with them. If you're in that situation it's a good learning experience to get everything documented in the project specification so that there is no question about what falls outside of the project scope. I've been there - one experience like this is enough to teach you to put more work into your specifications.
Report everything and triage. After a bit of time, she'll start to understand what gets past triage and what doesn't. Humans can learn; teach.

Is it wrong not to prefer an IDE? [closed]

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.
Closed 10 years ago.
Lately I've been job hunting, and for the most part, they would ask me what type of IDE I like to use.
Now, I usually answer with;
Well it all depends on what language I'm developing it in. If it's Java then it would be Eclipse, if AS3 then either Flash CS4 or Flex Builder 3. For HTML, CSS, PHP, and Javascript, I prefer to use PsPad. (almost identical to Notepad+ or textmage).
Now why is it that they always seem to become immediately disgusted with the fact that I said PSPad? Truth be told, I don't like to use DreamWeaver because I feel like it's bloated. I mean to each his own I guess ... but I've tried using it and I honestly work faster with PSPad.
Should I start using Dreamweaver just to put in my resume?
Theoretical Advice
It's quite reasonable not to like IDE's, though you do need to acknowledge their usefulness, and everyone has their own most efficient ways of working, which makes sense.
Practical Advice
You can't deal with recruitment agents logically, I'm afraid. You need to check their checkboxes, and get past them, to talk to someone real.
Once you get into a real interview with a programmer, be honest about everything, about why you don't like IDE's (especially DreamWeaver) and then you can just hope for the appropriate outcome.
But with recruitment agents you need to appreciate that they don't understand anything about our industry; and you typically need to give them the answers they want.
I'd say your are "familiar" with DreamWeaver and leave it at that.
Maybe they don't know what PSPad is - I didn't. As for Dreamweaver, I would actually look down on somebody who uses Dreamweaver. It's much better to be able to code from scratch.
And to answer your question - it's definitely not wrong to not prefer a single IDE for everything. You should use whatever tools you feel comfortable with, and if it's different for each language, then so be it.
No, just like it's not wrong to prefer:
Horses over cars;
Kerosene lamps over electrical lighting;
Aqueducts over water pipes;
Storing food in a cold cellar instead of an "icebox";
Punch cards over keyboards and visual displays;
and so on.
Sucks that we have to go through people who care not about the programmer but the programs we use!
I mean I think I lost a few chances just by trying to explain that I am decent with HTML and CSS but don't use Dreamweaver (because I cant afford it).
Though I am not that worried, I did eventually stumble across a person who does understand these things and love working for him. So no it's not wrong, you're just unlucky to have come across wrong recruiters.
Good luck finding a job though!
PS It doesn't take more than 10 minutes to get familiar with an IDE, so always a plus to try out some (so you're not completely lost later).
One way to spin such answers is to make yourself the expert. So you could say something like, "I'm familiar with Dreamweaver, but once I got really good at coding HTML, CSS etc. I found it more efficient to just use a really fast and simple text editor like PSPad."
I used the same trick after I worked in C++ and was applying for a Java job. In that case, it went like this, "Well, the nice thing about having started in C++ is that it's such a rich and low level language that once you've done that, Java seems really easy by comparison."
The recruiter doesn't know what DreamWeaver is -- they just know what a commission is. Show them you'll make them one by selling yourself to their principle and they'll send you out to interview more often than not.
Look: when you're job hunting the person who is looking at your resume is either a:
Human Resource person (Needs a person to fill a position or just interview)
Head Hunter (Needs a body to fill a job so they can get their placement pay)
IT Manager (Needs a qualified soul for the best price).
Depending on the person interviewing you over the phone or in person they are just trying to get the best candidate for a position. Sometimes they have prepared questions to see how much you know, how you think and do you match up to your resume.
I went to a .NET code camp once and a head hunter was asked how one goes about showing the interviewer their experience. The head hunter said show them your work:
Bring a laptop with samples of your work.
Print out code sample.
Direct the interview to a website with samples of your work.
Things like this get you past the IDE question real quick.
As silky alluded to above, it's probably a simple mechanism in use by the HR agency to filter out candidates. If you're not using an IDE on the selected list, you're filtered.
For me, when interviewing, I would find somebody who says they use VIM or Emacs as their IDE to be a more advanced developer than perhaps somebody using Notepad.
Last time a CTO asked me what I use, I immediately said "Emacs, of course". He said, "OK, now I'm interested!". I've been working there since.
(I don't know why PSPad would be any worse than Dreamweaver or Eclipse. I find all IDEs hard to really customize. Everybody I work with has gobs of elisp, much of it shared, to make it much more productive for our project.)
Maybe you're talking to the wrong people for the kind of job you want. Where are you finding these "they" who ask you this?
It's certainly not worse than depending on one.
I use EMACS as my primary programming environment. It has a few big advantages:
It's available practically everywhere.
You can use it without having a window system installed.
You can use it over SSH.
It lets you edit multiple files at the same time.
It understands most programming languages.
You can run subshells.
Oh, you can read your email from within it, too.
This question has no good answer. It depends on the culture of the place you're interviewing for. At my current job, I play up my Unix experience and can impress other folks that also enjoy non IDE toolsets. vi, one liner scripts, etc. At my former gig, people were enamored with Visual Basic, and thought the command line was horrific. I'll bet if you were interviewing for the company that develops PSPad you would not have had the same result. ;-)

What are some options for future proofing your application?

I am looking at minimizing the future impact on a yet to be written application. I am trying to avoid any 3rd party products, and even avoid operating system specific calls. Can anybody suggest other ways of future proofing the application. The idea would be not having to rewrite major portions in 10 or 20 years, and that only maintenance (bug fixes) would ever need to be done.
If you want your program to keep running (on modern OSes) for that kind of time period, you'll probably end up having to write it in only pure ANSI C (or C++). Anything else is likely to need some kind of tweaking over the years - and nobody really knows what'll happen over the next 10-20 years.
That said, here are a few tips to minimize these kinds of problems:
Avoid weird dependencies. If you're going to depend on some library, make sure it is very well-established (and thus likely to survive at least 5 of those 10-20 years), or at least open-source so you can fork it yourself if need be.
Avoid OS-specific calls. This will be a balancing act with 1. - you can use a wrapper library like boost or Qt or glib or what-have-you - but that would increase the chance for compatibility issues on that front.
Document everything. Fact is, no matter how hard you try, this program will need compatibility fixes and bug fixes, and probably feature additions too. So make life easier on that poor maintenance programmer who comes along 15 years later. :)
Dig out some 10 and 20 year old programs that still run on todays machines and see why they still run and why they are of value. I see a number of computation intensive console based apps still in occasional use, mostly written in C and FORTRAN, called by other apps. If your app has a lot of GUI, are you sure it will still have any value in a few decades time? Perhaps consider seperating the user interface from the core functionality, in such a way that the UI can be replaced in the future as UI paradigms change and evolve. If you write your system in a very modular fashion, modules that still provide value can be kept while those that are clearly obsolete can be replaced.
Write with 64-bit in mind. We're discovering now that many of our third-party dependencies don't support 64-bit, and so we have issues.
The best way to build an application that is still functioning with little-to-no maintenance in 10 years is to look at the systems that were built and are still running from 10 years ago.
From my experience, most of those systems, which did not need major upgrades are doing so by running on the same or similar hardware that they were deployed to 10 years ago and use the same interface.
The maintainers chose to trade away the performance improvements due to Moore's law or usability improvements in favor of little to no maintenance over the years.
Automate Testing can also help.
Not that your application will be "proofed", but I you'll have some idea of what has to be fixed when things changed.
A lot of the applications I develop run on a cycle (example: yearly). The most important thing I do to ensure they continue to work is not hard-coding dates or date ranges. Example:
year(now()) for the year
DateSubmitted BETWEEN year(now()) AND DATEADD(year,1,year(now())) for a range
Of course, these are just examples.

Should we be tracking defects in things other than code? [closed]

Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 3 years ago.
Improve this question
At various times in my career I have encouraged staff I worked with and/or managed to track defects in artifacts of the development process other than source code (i.e. requirements, tests, design). Each time the request has been met with astonishment, confusion and resistance. It seems so obvious to me that I'm always a little shocked when people resist the idea.
What we get from this exercise is a picture of where bugs are created and where they are found (in what part of the process). If we are building bad requirements then we we'll know it and can work to improve them.
Is anyone else collecting information on defects not in source code?
Yes, track them all.
Documentation, design docs, requirements, etc.
I am also as astonished as you when I hear "arguments" against it.
At the very least the tracking system should be able to identify where the defect was found and what part of the process it was injected.
Absolutely. Just look at Ubuntu Bug #1.
Yes, definitely. The artifacts surrounding your code--models, specs, doco, requirements info, use cases, etc--can all contain errors that affect the code itself.
Normally bug tracking systems have an assumption that they're a list of things that are to be fixed or implemented. Tracking bugs in requirements or other documentation (e.g. task lists) doesn't seem like it's the same thing. It's more a matter of keeping records so you can trend problems and evaluate if you're making fewer of them.
I'm tracking them, but outside of our bug tracking system.
Well duh... anything you can improve, do what can to improve!
Treating it all as bug tracking makes sense - opinion will vary, as you note - but using one tracking system would give a coherent big picture of it all, let tasks be assigned, etc. Maybe a demo, a slide show or something aimed at using these systems in ways beyond the original source code tracking - pictures convince more than words.
I've normally tracked the source of all defects. They may get fixed in the code, but they don't necessarily get caused by that.
Wrong requirement, wrongly interpreted requirement, bad design, developer brainf*rt, bad documentation, wrong test, missing test, outdated test, code that doesn't do what the developer does, tool/compiler error (very rare, in my view), build system problem....
To me, they're all "the system doesn't do what the customer wants it to do", and all indicate something must be changed in order to make it do what the customer wants it to do. Arguing whether it's defect or feature, or a source code bug or some other issue distracts from addressing the issues to me.
One biggie that no one seems to have mentioned is to start a database of bad smells and traps for use when performing peer reviews.
This is an invaluable resource for the peers actually performing the review.
It definitely pays off in the long term. This should also be a live document, database, etc. that is added to as:
bugs are fixed
as peers perform reviews, and
as new blood arrives to join the team(s) bringing with them new knowledge and experience.
HTH.
cheers,
Rob
aboslutely. if your process is well enough along to trace back source of defect to orgin great. it helps customers and designers qualify the constraints in which they operate.
customer: develop robot to cut grass where all blades of grass are to be cut to a precise uniform length
designer: we will use left-handed kindergarten scissors mounted perpendicular to the ground ensure crisp/precise cuts
QA: cuts are precise.
customer: why does it take the robot 6 days to cut grass. we need in in 30 mins or less!
clearly tracking the source of the performance defect can help in molding conversations and improving the process going forward.
We track bugs in software, errors in documents, errors in drawings, and requests for new features all using the same track tool.