Global Quality Journal

Is Your Company's Performance (engineering) Quotient at Genius Level?

This is from a golden archive of Global Quality Partners. While quoted industry statistics are a bit dated, the problem of web performance is with us as never before.

As children, we were always told to mind our "P"'s and "Q"'s.  Good sound advice.  With the ever present arrival of Mobile ubiquity and "Generation M", it is clear that whatever type of website you host, especially if it is marketed to the general public, you need to mind your PQ^TM (Performance engineering Quotient) as well.

Here are just a few mobile statistics to consider, as mobile computing is, and will transform our lives:

• 56% of American adults are now smartphone owners. (Source: Pew Internet & American Life Project, 2013)

• Mobile now accounts for 12 percent of Americans’ media consumption time, triple its share in 2009. (Source: Digiday, 2013)

• By the end of 2013, there will be more mobile devices on Earth than people. (Source:Cisco, 2013)

• Consumers spent six times as much time in retailers’ apps in December compared to a year earlier. (Source: Flurry, 2013)

• Internet access via mobile is no longer a niche activity and is increasingly becoming part of everyone’s lives. 50% of the average global mobile web users now use mobile as either their primary or exclusive means of going online. (Source: inmobi, 2013)

And to boot, according to other survey results, we now use our mobile devices in bed, in the bathroom, while watching TV, and generally while we are waiting. (Source:  inmobi, 2012).

In recent news, some Executives of today's trendy mobile startups, having experienced some very public scalability debacles, would have you believe that it is impossible to build a scalable mobile web solution (read more here).  It's not true.  Don't believe it for a second.  Don't allow your Company to experience the same fate as these startups!

Now, it shoud be noted that when we say mobile, we are talking about smartphones, tablets, and other handheld or subnotebook devices that access the internet.

So, with the proliferation of such devices, the increased user base, as well as the increased time of usage (compared to desktop and traditional internet access options), you need to take mobile seriously in your Performance Engineering and Scalability endeavors.   You MUST keep up with the times.

To make sure you are keeping pace with the times, take a test below and determine your "Performance engineering Quotient"^TM, or PQ^TM.

It's time to start minding your PQ.  Is your Company working at a Genius level when it comes to your Performance Engineering practice?

We are sure you will find the results of this scorecard both enlightening and informative.

Click the following link to download the GQP Performance engineeringQuotient Scorecard.

If you score 160 or above, then your Company is operating at Genius level when it comes to Performance Engineering Practice.

If you score between 120 and 159, then there is room for improvement.

If you score below 120, then you may want to seek professional help, in order to reach your full potential.  Give us a call, we can help!

If you'd like to discuss your results, the "GQP Performance engineering Quotient Scorecard" in general, or how we may be able to help you improve your PQ^TM, please feel free to contact us.

NOTE:  Throughout the scorecard, we refer to the term ***CFWAs (or Customer Facing Web Apps).  It should be noted that these can be internal, or external to an organization, and that the term refers to any application that communicates via HTTP(S) and it's related technologies (this includes mobile apps, mobile browser apps, desktop browser apps, etc.).

posted by: gqjournal

Integrated Software Quality: Multi-Browser Eclipse, Cucumber, Maven, Groovy, and Selenium

Greg Margolin:

We are continuing to explore and develop the Integrated Software Quality^TM approach to Devops and Agile methodologies. At the heart of the approach, is the use of the Behavior-Driven-Development paradigm, as a way of incorporating various types of testing in a continuous integration model. The emphasis is on a collaborative, cross-team view of software quality.

Many of you have asked us to provide more practical examples. We are happy to do so. In this installment of the series we are going back to Selenium Webdriver, running the same test across Safari, Chrome, and Firefox.

We hope you will find this tutorial useful.  As usual we are looking forward to your feedback. 

This video is meant to be an introduction to QA professionals and others who may never have done this before, and/or who may want to become more familiar with the technologies.

For Full Screen viewing, click play on the video above, then mouse over the video, and click the Fullscreen Icon in the lower right-hand corner.

Alternatively, click here to view the video in full browser page mode.

SUPPLEMENTAL FILES (follow directions in video):

Download:  GQP-Cucumber-Multi-Browser-Selenium-groovy-demo.zip 

posted by: Greg Margolin

BMW: Baby You Can Drive My Car

BMW executives who were not aware of the vulnerability in the first place are comforting the public by stating that they are not aware that hackers took advantage of it. We feel safer already.

USA Today:

In a move that shows just how vulnerable cars have become, BMW says it has found a solution to a security flaw that could have allowed hackers to open doors of 2.2 million BMWs, Mini and Rolls-Royce vehicles, Reuters reports.

The vulnerable cars had the ConnectedDrive software, which uses on-board SIM cards, to identify owners. A German motorist association, ADAC, took note of the security vulnerability and alerted BMW, according the news service in a report from Frankfurt, Germany. But the report also says that officials aren't aware that hackers ever exploited the security flaw.

Affected were mostly BMWs with ConnectedDrive, the Rolls-Royce Phantom and Mini hatchaback. The cars were made between March, 2010, and last December, according to ADAC. Once inside the car, hackers could have potentially put other systems at risk as well.

Fears have been raised recently that hackers could not only break into cars, but access other systems controlled by computers -- including engine, steering, brakes and others -- in age when cars are increasingly going digital. (Read full article)

posted by: gqjournal

How Twitter Lost 4 Million Users Because of a Bug... Or Did They?

Re/Code:

Twitter added a total of four million new users last quarter, a number that seems surprisingly low.

During the company’s earnings call, CFO Anthony Noto provided an excuse for its lack of growth: An “unforeseen bug” in Twitter’s integration with iOS 8, Apple’s mobile software update that launched in September. This “bug” caused Twitter to lose four million users, he added, or half of the company’s actual growth.

How exactly does that work?

Well, one million of those users were people who downloaded iOS 8 and either never reopened Twitter, or forgot their password and couldn’t log back in. The other three million were lost due to Safari’s Reader section, which no longer pings Twitter automatically for content like it did in iOS 7. Users who were counted as active because of this automatic pinging on iOS 7 were then lost when they updated to iOS 8.

So three million of these lost users were accessing Twitter from a mobile browser and really weren’t accessing Twitter at all (at least not consciously). They were counted as “active” because Safari did the work for them.

So that’s how Twitter lost four million users, although it sounds like it was more about the update to iOS 8 than a bug. (Read full article)

posted by: gqjournal

Healthcare.gov - A Gift That Keeps Giving

Healthcare.gov is an ongoing study of the effects of software quality (and the lack of it) on implementation of major policies. For those of us interested in the topic it is a gift that keeps giving.

Dailycaller.com:

On the day before the deadline for Obamacare’s second open enrollment period, some customers looking for health coverage were unable to submit applications on the federal website due to more tech glitches, the Obama administration said Saturday.

HealthCare.gov, which is serving 37 states this enrollment period, is facing “intermittent issues” in verifying customer’s income, according to the Department of Health and Human Services. That’s preventing an unknown number of customers from submitting applications and seeking premium subsidies for health insurance. (Read full article)

posted by: gqjournal

Senate Report: Cars Vulnerable To Hackers

Wired:

Since hackers first began demonstrating that they could take over cars’ digital systems to slam on brakes or hijack steering, most automakers have done everything they can to avoid publicly discussing whether their vehicles are vulnerable. Massachusetts Senator Edward Markey, however, has demanded answers on that car-hacking question. Now he’s released his findings: the answers are messy at best, and dangerous at worst.

In a report published Monday, Markey’s office revealed all the answers he received from a letter he sent to 20 automakers more than 14 months ago, quizzing them on their cars’ and trucks’ security and privacy measures. The results, according to the report, show that nearly all modern vehicles have some sort of wireless connection that could potentially be used by hackers to remotely access their critical systems. The company’s protections on those connections are “inconsistent and haphazard” across the industry. And in addition to security weaknesses, Markey’s survey also found that many auto companies are collecting detailed location data from their cars and often transmitting it insecurely.

Markey’s report first came to light in a 60 Minutes episode Sunday night that showed an unnamed car’s brakes being remotely disabled by a DARPA hacker. But Markey’s office has now followed up by releasing its complete findings, which are embedded below. (Read full article)

posted by: gqjournal

Is Sheriff Google Right About Bugs?

San Jose Mercury News:

Quinn: Sheriff Google, on the software bug beat, is taking prisoners

By Michelle Quinn

Google has anointed itself technology's sheriff, rattling other firms' software doors and windows to see if there are any openings for crooks.

And if the Internet giant finds a vulnerability, it notifies the firm: Make a fix within 90 days or we'll expose the flaw to the public.

"You should be able to use the Web without fear that a criminal or state-sponsored actor is exploiting software bugs to infect your computer, steal secrets or monitor your communications," Google said in a blog post last year announcing Project Zero, its security team on the lookout for software bugs.

Sounds great. But is it?

 Some cheer the firm for pushing companies to repair these so-called "zero day" software bugs, technology jargon for previously unknown problems with no ready fixes, especially amid a wave of increasingly serious cyberattacks exposing the sensitive data of millions of people.

But others argue that Google's disclosures, complete with information about how the flaw could be exploited, could tip off hackers. (Read full article) 

posted by: gqjournal

Application Security Testing…..the Integrated Quality Way! (Eclipse, Maven, Cucumber, OWASP ZAP)

Greg Margolin:

Should QA engineers get involved in application security testing? Should we consider that there might be vulnerabilities in the systems that we release? In a word, should we care? Or is the whole endeavor better off left to professional white hat hackers?

The answer to the question is easy to come by, if we ask a somewhat similar question: should architects, builders, and civil engineers be concerned with structural safety of their buildings? Or is the whole endeavor better off left to first responders -- firefighters, EMTs, police officers, judges, doctors, nurses, and funeral directors?

Well, the good people at the OWASP ZAP project really hope that everybody, developers, ops, QA, would get involved in building secure web applications. They developed a great tool that is useful to everybody on the team -- from complete novices to advanced penetration testers. The tool is an integrated platform that allows users to conduct passive scanning of a web application (the tool is a web proxy), launch active scanning --- attacks, simulate brute force and fuzzing attacks, and conduct authentication testing. When a vulnerability is discovered it is properly flagged and useful background information is provided. On the OWASP ZAP site there are a lot of very useful video tutorials as well.

In this installment of GQP's Integrated Quality series, I show how a QA team could make a first step in integrating application security testing into their daily activities. As a model, I used my previous video tutorial where I showed how JMeter can be driven by Cucumber using Maven within Eclipse. The objective in that video was to show how performance requirements could be surfaced to the design level instead of being buried within a tool and scripts.

Going forward with this model, I have used the same project in Eclipse and very similar Groovy code to integrate OWASP ZAP within the testing cycle. The demo is basic, I specify the requirement of testing for web security vulnerabilities in Cucumber, run OWASP ZAP, inspect generated reports for risk alerts, and then produce a familiar Cucumber report.

Toward the end of the video I run both JMeter and OWASP ZAP to show the Integrated Quality (TM) approach in all its glory.

posted by: Greg Margolin

High Speed Of Coding Killed Application Security

Unsafe at any speed? Jeff Williams of Aspect Security makes a sobering observation that rings very true.

Darkreading.com:

A typical, midsized financial organization has a portfolio of over a thousand applications. The largest firms exceed ten thousand applications. Each of these applications, on average, has hundreds of thousands of lines of custom code, and the largest can have over ten million lines. In addition, each application also includes anywhere from dozens to hundreds of software libraries, frameworks, and components that typically total over ten times the size of the custom code. And this portfolio is growing rapidly -- over 20% of these applications have new and updated code each year.

By comparison, consider the US Federal Tax Code, which has also grown dramatically over the years. Currently, the tax code totals just 4.4 million lines of “code” – roughly equivalent to just a handful of applications. As a security researcher I’ve discovered thousands of vulnerabilities in code. But as a former CEO, I’ve also analyzed a ton of legal contracts for loopholes. What’s interesting is that whether I’m scrutinizing software code or reviewing legal language, the analysis is not as different as you might think. Both require a detailed understanding of specialized language and a solid understanding of the underlying business.

So after two decades of high speed coding, a typical large financial organization has a pile of code as large as 2,000 copies of the entire 73,954 pages in the US Federal Tax Code -- almost 10 billion lines of code. (read full article) 

posted by: gqjournal

Gartner: Next Five Years

Forbes:

In 2014, CEOs are most relying on digital marketing, e-commerce, customer experience management, business analytics and cloud business  to improve performance over the next five years.  These five technology areas are expected to deliver the most business value by CEOs and senior executives through 2019.

The report  2014 Gartner CEO and Senior Executive Survey: ‘Risk-On’ Attitudes Will Accelerate Digital Business  written Mark Raskino, provides additional insights into these investment areas.   You can find the 2013 edition of the study, CEO and Senior Executive Survey 2013: As Uncertainty Recedes, the Digital Future Emerges, written by Mark Raskino and Jorge Lopez, published on March 25, 2013 here (free PDF, no opt-in).

The following graphic, posted by Tiffani Bova, Vice President and Distinguished Analyst at Gartner, provides an overview of the top technology investments from 2014 to 2019.

 (read full article)

posted by: gqjournal