Wednesday, 15 May 2013

Certified Agile: The PMI-ACP Exam

I sat for the Project Management Institute’s Agile Certified Practitioner (PMI-ACP) exam earlier this week. The PMI-ACP tests your understanding of common Agile development methods, values and practices. It focuses on basic Agile principles, and on Scrum and XP in detail, as well as fundamentals of Lean and Kanban.



Unlike the PMP, there is no Book of Knowledge which defines best practices and a process framework for this certification. Instead there is a certification content outline that explains at a high level the tools, techniques, knowledge and skills that you will be expected to know and will be tested on, and a reference list of books to read which includes some of the usual suspects. Out of this list I’d recommend reading Mike Cohn’s books on Agile Estimating and Planning and User Stories - they are useful for the exam and they're worth reading regardless. If you’re not working in an XP shop you should also read Kent Beck’s Extreme Programming Explained to make sure that you understand XP, and you must read up on the basics of Lean and Kanban. And of course you need to memorize the Agile Manifesto and the Twelve Principles of Agile Software Development front to back.




But I know from writing the PMP several years ago that experience and general reading aren’t enough to prepare for a PMI certification exam. PMI wants everyone who holds a certification to know the same things, and to share the same values and to think and act the same way. There’s an emphasis on orthodoxy – you’re tested not on what you would do (based on your experience and common practical knowledge), but what you should do according to PMI's definition of what “the right way" is to do something. And PMI’s exams are as much a test of your ability to read and write an exam as they are of the subject matter, with trick questions and trip-up answers and questions which are purposefully hard to understand, and even some extra questions thrown in which don’t make sense at all. Writing a test like this is not fun, although the PMI-ACP exam is certainly not as hard as the PMP exam - you shouldn’t need the 3+ hours that you’re given to complete this test.



So like others, I decided to use an exam prep guide to finish my studying.



The PMI-ACP Exam: How to Pass on Your First Try by Andy Crowe is a quick overview of the material that you should know for the exam. Easy to read and easy to follow, it defines key terms and “doing Agile right”, roles and responsibilities and rituals and tools, and covers communication and collaboration issues, and includes some sample questions (and access to a sample online exam). This is not an especially insightful book, but I found it useful for last minute review and cramming.



I did most of my studying with Mike Griffiths’ PMI-ACP Exam Prep: A Course in a Book for Passing the PMI Agile Certified Practitioner (PMI-ACP) Exam, a much more complete study guide, and a good overview of Agile development that is worth keeping and reading on its own. This book builds on materials that Griffiths published earlier on his blog and it is especially good on Agile reporting tools.



Griffiths is one of the experts who created the PMI-ACP program and so he understands what you need to know in depth, and he is a good writer. However, his book is harder to study from than Crowe’s, because it contains a lot more details and because it is structured around the artificial domains that PMI uses to describe Agile development. This results in several discontinuities, where an idea or practice is introduced under “Value Driven Delivery” and then continues later under “Adaptive Planning” or “Continuous Improvement” or one of the other domains (it is not necessary by the way to learn the domains for the exam).



If you have solid experience with Agile development (which you need to in order to meet the qualifying bar) especially Scrum and XP, you should be able to pass the exam with the help of Griffiths’ guide and some general reading to fill in gaps.



Studying for the PMI-ACP has made me examine Agile development ideas and practices in more detail (which is why I decided to apply for the certification). But it hasn't changed how I think about Agile practices and methods or how I think you should follow them. I am just as convinced today as I was before that the key is not following some method in a pure way, but instead to build your own toolkit, to borrow what works from different methods and adapt them to your specific requirements, constraints and situation. And the more that you know and understand about Agile methods and practices, the more tools you have for your toolkit.


Monday, 13 May 2013

Speciale: 15 anni di Gran Turismo







Il 2013 segna il quindicesimo anniversario di Gran Turismo su PlayStation.

Per festeggiare la ricorrenza, ripercorreremo la prestigiosa storia del simulatore di guida realistico.




Nel 1998, la copertina dell'edizione europea di Gran Turismo per PlayStation ritraeva una misteriosa supercar nascosta da un telo. Dietro si celava l'esordio del più grande successo nella storia di PlayStation, una serie che con la sua grafica e i suoi controlli ultrarealistici avrebbe ridefinito il genere dei giochi di guida.





Gran Turismo univa l'adrenalina delle gare arcade con il realismo di una simulazione. Il gioco includeva quasi duecento auto, un numero nettamente superiore a quello di qualunque altro titolo automobilistico dell'epoca. I giocatori potevano mettere alla prova le proprie capacità di guida per ottenere patenti con cui partecipare agli eventi, mentre i premi in denaro consentivano di acquistare le auto più esclusive al mondo, insieme a pezzi di ricambio con cui migliorarne le prestazioni. Un simile livello di dettaglio non aveva precedenti e consentì a Gran Turismo di travalicare i confini del videogioco, facendo parlare di sé anche nel mondo dell'automobilismo reale.







L'evoluzione dell'esperienza di guida






Gran Turismo 2, pubblicato due anni più tardi, portò il numero di auto disponibili all'incredibile cifra di 650. Merito dell'entusiasmo del creatore della serie, Kazunori Yamauchi, che con la sua profonda conoscenza delle auto classiche e moderne ha contribuito nel tempo a instaurare un rapporto di stretta collaborazione tra gli sviluppatori di Polyphony Digital e le case automobilistiche stesse.





"I rapporti con le case produttrici sono sempre stati fondamentali", spiega Yamauchi. "Questo perché le auto che inseriamo nei nostri giochi sono parte integrante della società e Gran Turismo punta da sempre a raggiungere anche chi non conosce il mondo dei videogiochi".





PlayStation 2 fu distribuita in Europa nel 2000, generando in tutto il mondo grande attesa per ciò che Polyphony sarebbe riuscita a creare con il nuovo hardware. La risposta giunse un anno più tardi con Gran Turismo 3: A-Spec, di fronte al quale un osservatore distratto stentava a credere si trattasse di un videogioco e non di una gara reale.







A tutta velocità






L'arrivo di Gran Turismo 4 fu anticipato da Gran Turismo 4 Prologue, che fornì un'anteprima del futuro della serie. Pubblicato nel 2005, Gran Turismo 4 includeva più di settecento auto di ottanta costruttori diversi, dalla Daimler Motor Carriage del 1886 a prototipi che immaginavano il futuro fino al 2022.





Fu introdotta anche la modalità B-Spec, che consentiva ai giocatori di passare dal ruolo di pilota a quello di caposquadra. Un'altra novità di Gran Turismo 4 erano le missioni di guida, che sfidavano i piloti a padroneggiare tecniche specifiche, come l'uso della scia.





I giocatori europei di Gran Turismo hanno iniziato a gareggiare online nel 2008 grazie a Gran Turismo 5 Prologue per sistema PlayStation 3. Quest'ultimo è stato il primo titolo della serie a includere funzionalità di rete come le gare online, le classifiche e GT-TV, un servizio che permetteva di guardare programmi automobilistici direttamente all'interno del gioco.







Si scende in pista




A Gran Turismo 5 Prologue va inoltre ascritto il merito di aver scoperto un potenziale talento come Lucas Ordoñez. Il vincitore della prima edizione di GT Academy, un concorso per i migliori giocatori europei di GT, ha successivamente conseguito la patente da gara e preso parte all'endurance della 24 Ore di Dubai, il premio in palio, e ora è un pilota professionista.





GT Academy è per Yamauchi un motivo di grande orgoglio: "Era un sogno che cullavo fin da quando ho sviluppato la mia prima simulazione di guida, soprattutto perché ero sicuro che un giorno lo avrei realizzato. E quando si è finalmente concretizzato nell'edizione 2008 di GT Academy, l'emozione è stata fortissima".





Nel 2009, Polyphony Digital ha esplorato nuove strade con Gran Turismo per PSP, che ha fatto breccia sul sistema di intrattenimento portatile con più di ottocento auto e trentacinque tracciati, oltre alle gare online e agli scambi di auto tra giocatori. Grazie alla sua profondità e spettacolarità, il gioco è diventato ben presto un grande successo tra gli appassionati delle console portatili.







Un nuovo punto di riferimento per il settore




L'attesissimo Gran Turismo 5 è stato pubblicato su PS3 nel novembre 2010, innalzando ancora una volta il livello di realismo delle auto e dei tracciati. Il gioco include più di mille auto, dai classici del passato alle utilitarie per famiglie, fino ad arrivare a bolidi da sogno come la Bugatti Veyron. I circuiti reali sono stati ricreati con un'incredibile dovizia di particolari e affiancano tracciati storici come il Nürburgring tedesco a circuiti cittadini da sogno, che consentono ai piloti di guidare tra le strade di Roma, Londra e Tokyo.





Dopo l'introduzione del gioco online nell'edizione Prologue, Gran Turismo 5 non si è limitato a offrire gare online per sedici giocatori, spingendosi ben oltre. Le prove a tempo speciali e gli eventi stagionali garantiscono un numero di sfide in continuo aumento, mentre con l'Editor Tracciati i giocatori possono creare percorsi personalizzati da condividere con la comunità.





In Gran Turismo 5 è stato dedicato ancora più spazio al mondo dell'automobilismo reale. Il pilota di Formula 1 Sebastian Vettel e il campione NASCAR Jeff Gordon compaiono come ospiti speciali, mentre il famoso programma automobilistico Top Gear ha prestato la sua celebre pista di prova. Dopo il debutto del 2008, inoltre, GT Academy ha raccolto un successo sempre maggiore, portando alla scoperta di sei talenti in tutta Europa e alla nascita di una squadra classificatasi al secondo posto nella categoria SP3 della 24 Ore di Dubai.





Dopo quindici anni, appare ormai evidente come Gran Turismo non abbia semplicemente cambiato il volto dei giochi di guida, ma anche quello del mondo delle corse in senso lato. È quindi doveroso lasciare l'ultima parola al primo responsabile del suo successo, Kazunori Yamauchi:





"Considero Gran Turismo una sorta di movimento. E sarei davvero felice se il movimento che ruota intorno a GT lasciasse un segno nella storia".



Via / it.playstation.com

Wednesday, 8 May 2013

Paper Pool - Coming soon for iOS and Android


We are excited to announce that our new game Paper Pool is coming soon for iOS and Android!

Ever wish you could play with the stars in the sky? Now you can! Equal parts planning and execution, Paper Pool is mini-golf combined with billiards and set in a lush panoramic world created from construction paper.

From the creators of the hit mobile game Drawdle, Paper Pool offers a fresh challenge for billiards experts and novices alike.

Screenshots and trailers coming soon, stay tuned.

Tuesday, 7 May 2013

Appsec – Can anything Stop the Bad Guys?

WhiteHat Security recently published their 2012 report on website security. Like Veracode, WhiteHat collects and analyzes data from security tests run across their customer base each year. WhiteHat's analysis focuses on data from dynamic testing of 15,000 sites at 650 organizations – all results manually reviewed and verified. From this data they are able to see trends and to build industry scorecards. The report makes for fascinating reading.



On average, web sites are getting more secure each year: the average web site had over 1,000 vulnerabilities in 2007, and only 56 in 2012. SQL injection, the most popular and most serious attack vector, is found in only 7% of their customer’s web sites.



This is the good news.




What made WhiteHat’s analysis this year especially valuable is that they also surveyed customers about their secure SDLC practices and the effectiveness of their security programs. Although the survey set was small (less than 20% of customers responded), this data allowed WhiteHat to correlate vulnerability data with secure SDLC practices operational controls, as well as appsec program drivers and breach data.


Compliance impact on Appsec




White Hat found that the main driver for fixing security vulnerabilities is compliance – this matches up with findings from the SANS Appsec survey last year.




But they also found that compliance is the number one reason that some vulnerabilities don’t get fixed: many organizations are following the letter of the law, doing what compliance says that they have to and only what they have to, not going any further even if it would make sense to do so from a risk management perspective or to meet customer demands.


Best Practices and Tools – What Works?



Training developers seems to help. More than half of White Hat’s customers had done at least some security training for developers. Organizations that invested in security training for developers had 40% fewer vulnerabilities and resolved them 59% faster.




But other best practices and tools don’t seem to be effective.




Just over half of customers relied on application libraries or frameworks with centralized security controls. Relying too much on these controls seems to provide a false sense of security: organizations that used security libraries or frameworks with security controls had 64% more vulnerabilities and resolved them 27% slower.




One factor that makes these organizations more vulnerable is that if the underlying framework is exploitable, then all of the sites that rely on it are vulnerable, like the recent security problems with Rails. Another problem may be that developers are naïve about what a security library will do for them: Apache Shiro or something like it for example will take care of a lot of application security problems, but it won’t protect your app from SQL injection or XSS or CSRF or other common attacks, leaving big holes for the bad guys. There’s more work that still needs to be done to make an application secure.




Organizations that use static analysis had 15% more vulnerabilities found through WhiteHat's dynamic testing, and resolved them on average 26% slower. Maybe because running a tool doesn't do anything if you don’t fix the vulnerabilities. Or because there isn't a high overlap between the vulnerabilities that static analysis finds and what’s found through dynamic analysis.



But Nothing Stops Breaches



85% of WhiteHat's customers test their apps pre-production, a third of them before every change is pushed out. These organizations are trying to do the right thing.




But almost one quarter of White Hat’s customers had experienced security breaches as a result of an application vulnerability. It doesn't seem to matter if they tested often, or if they trained their developers, or how much they trained them, or if they used use static analysis or secure libraries or a WAF or other operational security controls. These organizations were just as likely to experience a breach as organizations that didn't do as much training or as much testing or didn't use the tools.




WhiteHat’s report raises a lot of fascinating questions. Do the breach findings mean that security testing, or developer training or using secure libraries or other tools don’t work?




Or is this simply evidence of the essential asymmetry of the “Attacker’s Advantage and the Defender’s Dilemma”? Even though the number of serious vulnerabilities on average is declining significantly year on year, 86% of all the web sites that WhiteHat tested had at least one serious vulnerability (and keep in mind that WhiteHat - or any other vendor - can't catch every vulnerability). On average only 61% of these vulnerabilities were fixed and it took 193 days for this to get done. All it takes is one vulnerability for the bad guys to get in, and we’re still giving them too many chances and too much time to succeed.





Or maybe we just need more time to see the results of training and testing and tools and other best practices. Time for developers to understand and fix legacy bugs and to change how they design and build software to be more safe and secure in the first place, to “build security in”. Time for management to understand that compliance shouldn't be the main driver for building secure software. Time to raise the bar enough that the bad guys start looking for another, easier target. We’ll have to wait another year to see WhiteHat’s next report and see if some more time makes any real difference.


Monday, 6 May 2013

Announcement right around the corner

I've posted some screenshots of Sunset Pool back in March, but now we are close to being ready to make a formal announcement soon. Watch this space, and in the meantime here is a bonus screenshot of a new area:

(click to enlarge)

Saturday, 4 May 2013

Seven months later...

Hello!

It's been an absurd amount of time since I posted an update on here, during which not a lot of progress has been made on the PC versions of AJ1&2, or indeed much else programming-wise.

This is mostly due to my poor, abused back, which has spent several years propping up my arms and head while I tap away at the computer, with no back rest to support it. Turns out that this is VERY BAD, and the final stretch Apple Jack 2 pretty much knackered it completely, to the point where I had to lay off the computer work until I could make it stop bloody hurting all the time.

Thankfully, after getting a proper chair and doing stretches for several months it's finally back to normal and I can get on with finishing the conversions. No more testing is required at this stage, but thanks to everyone who has continued to offer help in that area.

Once THAT'S done, I can finally start to work on a new game! There are dozens of ideas ready to go, from the simple to the absurdly ambitious. The one I really want to do is a very peculiar shoot'em up, which would involve hooking up with a decent artist (due to the amount of drawing required), and an actor to play the part of a giant space orange. Brian Blessed would be the perfect man for the job, but he's a bit expensive and there's a lot of dialogue.

Other ideas include a stealth game, a one-button platformer, a 3D platformer, a body-hell beat'em up and a puzzle game. I've also got the set-up and plot of Apple Jack 3 nailed down, but I really want to work on something else first.

Progress should be swift on the PC conversions, so keep your scanners peeled for more updates.



P.S. To Futil1ty in the comments section of the previous entry - there isn't really a trick to completing 5-13, you just have to be good at wall jumping. It was actually even harder when the game was first released, but so many people got stuck I had to patch it. Think yourself lucky!

Monday, 29 April 2013

What does Code Ownership do to Code?

In my last post, I talked about Code Ownership models, and why you might want to choose one code ownership model (strong, weak/custodial or collective) over another. Most of the arguments over code ownership focus on managing people, team dynamics, and the effects on delivery. But what about the longer term effects on the shape, structure and quality of code – does the ownership model make a difference? What are the long-term effects of letting everyone working on the same code, or of having 1 or 2 people working on the same pieces of code for a long time?



Collective Code Ownership and Code Quality



Over time, changes tend to concentrate in certain areas of code: in core logic and in and behind interfaces (listen to Michael Feathers’ fascinating talk Discovering Startling Things from your Version Control System). This means that the longer a system has been running, the more chances there are for people to touch the same code.
Some interesting research work backs up what should be obvious: that the people who understand the code the best are the people who work on it the most, and the people who know the code the best make less mistakes when changing it.



In Don’t Touch my Code!, researchers at Microsoft (BTW, the lead author Christian Bird is not a relative of mine, at least not a relative who I know) found that as more people touch the same piece of code, it leads to more opportunities for misunderstandings and more mistakes. Not surprisingly, people who hadn't worked on a piece of code before made more mistakes, and as the number of developers working on the same module increased, so did the chance of introducing bugs.



Another study, Ownership and Experience in Fix-Inducing Code tries to answer which is more important in code quality: “too many cooks spoil the broth”, or “given enough eyeballs, all bugs are shallow”? Does more people working on the same code lead to more bugs, or does having more people working on the code mean that there are more chances to find bugs early? This research team found that a programmer’s specific experience with the code was the most important factor in determining code quality – code that is changed by the programmer who does most of the work on that code is of higher quality than code written by someone who doesn't normally work on the code, even if that someone is a senior developer who has worked on other parts of the code. And they found that the fewer the people working on a piece of code, the fewer the bugs that needed to be fixed.



And a study on contributions to Linux reinforces that as the number of developers working on the same piece of code increase, the chance of bugs and security problems increases significantly: code touched by more than 9 developers is 16x more likely to have security vulnerabilities, and more vulnerabilities are introduced by developers who are making changes across many different pieces of code.



Long-term Effects of Ownership Approach on Code Structure



I've worked at shops where the same programmers have owned the same code for 3 or 4 or 5 or even 10 years or sometimes even longer. Over that time, that programmer’s biases, strengths, weaknesses and idiosyncrasies are all amplified, wearing deep grooves in the code. This can be a good thing, and a bad thing.



The good thing is that with one person making most or all of the changes, internal consistency in any piece of code will be high – you can look at a piece of code written by that developer and once you understand their approach and way of thinking, the patterns and idioms that they prefer, everything should be familiar and easy to follow. Their style and approach might have changed over time as they learned and improved as a developer, but you can generally anticipate how the rest of the code will work, and you’ll recognize what they are good at and what their blind spots are, what kind of mistakes they are prone to: as I mentioned in the earlier post, this makes code easier to review and easier to test and so easier to find and fix bugs.



If a developer tends to write good, clean, tight code, and if they are diligent about refactoring and keeping the code clean and tight, then most of the code will be good, clean, tight and easy to follow. Of course it follows that if they tend to write sloppy, hard-to-understand, poorly structured code, then most of it will be sloppy, hard-to-understand and poorly-structured. Then again, even this can be a good thing – at least bad code is isolated, and you know what you have to rewrite, instead of someone spreading a little bid of badness everywhere.



When ownership changes – when the primary contributor leaves, and a new owner takes over, the structure and style of the code will change as well. Maybe not right away, because a new owner usually takes some time to get used to the code before they put their stamp on it, but at some point they’ll start adapting it – even unconsciously – to their own preferences and biases and ways of thinking, refactoring or rewriting it to suit them.



If a lot of developers have worked on the same piece of code, they will introduce different ideas, techniques and approaches over time as they each do their part, as they refactor and rewrite things according to their own ideas of what is easy to understand and what isn't, what’s right and wrong. They will each make different kinds of mistakes. Even with clear and consistent shared team conventions and standards, differences and inconsistencies can build up over time, as people leave and new people join the team, creating dissonance and making it harder to follow a thought through the code, harder to test and review, and harder to hold on to the design.



Ownership Models and Refactoring



But as Michael Feathers has found through mining version control history, there is also a positive Ownership Effect on code as more people work on the same code.



Over time, methods and classes tend to get bigger because it’s easier to add code to an existing method than to write a new method, and easier to add another method to an existing class than create a new class. By correlating the number of developers who have touched a piece of code with method size, Feathers research shows that as the number of developers working on a piece of code increases, the average method size tends to get smaller. In other words, having multiple people working on a code base encourages refactoring and simpler code, because people who aren't familiar with the code have to simplify it first in order to understand it.



Feathers has also found that code behind APIs tends to be especially messy – because some interfaces are too hard to change, programmers are forced to come up with their own workarounds behind the scenes. Martin Fowler explains how this problem is made worse by strong code ownership, which inhibits refactoring and makes the code more internally rigid:


In strong code ownership, there's my code and your code. I can't change your code. If I want to change the name of one of my methods, and it's called by your code, I've got to get you to change the call into me before I can change my name. Or I've got to go through the whole deprecation business. Essentially any of my interfaces that you use become published in that situation, because I can't touch your code for any reason at all.



There's an intermediate ground that I call weak code ownership. With weak code ownership, there's my code and your code, but it is accepted that I could go in and change your code. There's a sense that you're still responsible for the overall quality of your code. If I were just going to change a method name in my code, I'd just do it. But on the other hand, if I were going to move some responsibilities between classes, I should at least let you know what I'm going to do before I do it, because it's your code. That's different than the collective code ownership model.



Weak code ownership and refactoring are OK. Collective code ownership and refactoring are OK. But strong code ownership and refactoring are a right pain in the butt, because a lot of the refactorings you want to make you can't make. You can't make the refactorings, because you can't go into the calling code and make the necessary updates there. That's why strong code ownership doesn't go well with refactoring, but weak code ownership works fine with refactoring.


(Design Principles and Code Ownership)



Ownership, Technical Debt or Deepening Insight



An individual owner has a higher tolerance for complexity, because after all it’s their code and they know how it works and it’s not really that hard to understand (not for them at least) so they don’t need to constantly simplify it just to make a change or fix something. It's also easy for them to take short cuts, and even short cuts on short cuts. This can build up over time until you end up with a serious technical debt problem – one person is always working on that code, not because the problem is highly specialized, but because the code has reached a point where nobody else but Scotty can understand it and make it work.




There’s a flip side to spending more time on code too. The more time that you spend on the same problem, the deeper you can see into it. As you return to the same code again and again you can recognize patterns, and areas that you can improve, and compromises that you aren't willing to accept any more. As you learn more about the language and the frameworks, you can go back and put in simpler and safer ways of doing things. You can see what the design really should be, where the code needs to go, and take it there.

There's also opportunity cost of not sticking to certain areas. Focusing on a problem allows you to create better solutions. Specifically, it allows you to create a vision of what needs to be done, work towards that vision and constantly revise where necessary... If you're jumping from problem to problem, you're more likely to create an inferior solution. You'll solve problems, but you'll be creating higher maintenance costs for the project in the long term.

Jay Fields Taking a Second Look at Collective Code Ownership



So far I've found that the only way for a team to take on really big problems is by breaking the problems up and letting different people own different parts of the solution. This means taking on problems and costs in the short term and the long term, trading off quality and productivity against flexibility and consistency – not only flexibility and consistency in how the team works, but in the code itself.


What I've also learned is that whether you have a team of people who each own a piece of the system, or a more open custodian environment, or even if everyone is working everywhere all of the time, you can’t let people do this work completely on their own. It’s critical to have people working together, whether you are pairing in XP or doing regular egoless code reviews. To help people work on code that they’ve never seen before – or to help long-time owners recognize their blind spots. To mentor and to share new ideas and techniques. To keep people from falling into bad habits. To keep control over complexity. To reinforce consistency – across the code base or inside a piece of code.