Twice, I’ve joined new sites and they have sent me my password in the email in plain text (thank goodness I used my insecure password for both accounts) and then today I got a letter in the post from T-Mobile, my mobile company.

“Your monthly bill is moving online”, they announce. “To make things as easy as possible, we’ve already set up your T-Mobile account for you.
Your login details are: Username: ROSSKB72EC Password: jGDYH874368″ [Note: Password changed for obvious reasons, but kept to similar format]

Sorry, my username is WHAT?! This is a mobile company, mobile numbers are unique – you’d think they’d at least set your username to your mobile number which is something meaningful to you that you already remember. -1 to T-Mobile

So now as I am writing this, I’m testing the site for usability. Firstly, I did not receive an email copy of this letter so wham, I typo the address I need to go to. -1 to T-Mobile. Next, the Username field is prepopulated with “Enter username”. Ok, I don’t mind this so much as long as when I click in the field, the field is blanked or the text is highlighted so I can simply type my details. Nope – I have to manually delete “Enter username” before I can input my lovely user-friendly username. Another -1 to T-Mobile. The “Go” button is in the middle of the username and password fields (WTF!): -1

On the next screen they give me an option of entering a new username and checking it is acceptable/available. +1 to T-Mobile. I enter username and click check: “Incorrect format – MTM User name should be between 8 and 15 characters and contain no special characters”
I don’t even know where to begin with this. Firstly MTM means nothing to us, the user. Sure, it might mean a lot to those developing the system but to us? My guess is My T-Mobile, but really – it should be spelled out or left out! -1. There is no indication of this username requirement on the initial screen: -1. The arbitrary 15 character cutoff: -1. I reuse a number of usernames as unfortunately it’s almost impossible for 1 username to be user-friendly (*important for accounts like gmail where you need a username that’s acceptable to pass to people as your email address) and available across all sites. My more obscure username involves my maiden surname and is pretty damn long. 15 characters just cuts it but I imagine for many people it doesn’t.

Next up they request a new password and have a “strength meter” below it. Great – except the strength meter doesn’t register anything for any password I input: -1. Oh, and then there are the password requirements: “This must be between 8 and 15 characters, contain at least 1 number and may not contain any symbols or spaces.” Once again the arbitrary 15 character cut-off (-1) and then it can not contain any symbols?? All my secure passwords DO contain symbols as that pretty much makes them a lot more secure than if they didn’t. So once again I have to think of a -new- password to remember… Luckily my old semi-secure one that I was moving all my accounts off will suffice. (-1 and they’re getting off lightly!)

Now there is a new set of Terms and Conditions I need to accept. They will no longer send me my bill in the post so basically they are FORCING me to accept these new terms and conditions – which of course includes the term “T-Mobile may change these terms and conditions at any time without prior notice.” I’m not happy about it but I do understand there are legal implications so they have to include further online terms and conditions but I would have preferred the choice of being able to continue with paper-based bills, even if it were at an extra cost.

First line of their privacy policy:
“We share information with other members of the Deutsche Telekom group (our parent company) and other companies with which we have a business relationship. If we have to send your details to countries without proper data protection laws, we remain responsible for keeping this information secure.”
No option to opt out of them sending your details to other companies: -1

At the end of all that I click submit and BANG! “Sorry, the system is currently unavailable. Please try again later.” -1

Let’s be kind and give them a +1 for trying to help the environment (though I’m sure they were mainly thinking of their profits)

Total -10

That’s a pretty bad impression! I can’t help but think maybe they’re doing it on purpose. If they make it difficult for you to check your bill then you will check it less frequently and not notice discrepancies or perhaps increases in charges. I am always suspicious when a company decides to make my life harder.

Interaction design is one of my favourite interests after discovering a bit of the science in one of my courses at uni. In fact, if I were to change career I would love to train up and become and interaction design specialist. If you’re interested or if you design any kind of user interface, please look it up. My favourite book on the subject is The Design of Everyday Things – it is well worth a read! In fact I’m adding Norman’s more recent book, Emotional Design: Why We Love (or Hate) Everyday Things to my wishlist now and will definitely give it a review when I’ve finished reading it. Another great book which is more specific to web usability is Don’t Make Me Think!. Perhaps I should send a copy to T-Mobile?

I was working on a Java app that used a really weird combination of technologies:  a mix of straight servlets, Struts, a tiny bit of Spring, some Hibernate and some straight SQL via JDBC.  It was a mess of different styles and technologies which reflected the numerous different programmers who had hacked on another little piece through the years and the tight deadlines and pressure they had to do it under.  Luckily, the company had realised that this was not the best way of doing things and had started rebuilding the system from scratch using Spring and ensuring there was good test coverage.  When I joined the company I was assigned to the creaky old system, fixing bugs and adding small bits of functionality.  Business then made the decision to add auction functionality to the broker system (which was under my beady eye).   Rather than hack on yet another piece to this behemoth, we decided to move the entire broker system on to the nice and shiny Spring system.  Of course, Business doesn’t care about this technie stuff and the deadline remained fixed.

Never having used Spring before, I was sent home with Pro Spring (if you’re going to buy it, rather wait for Pro Spring 3) and the very next work day, I started coding.   A similar experience followed just over a year later when I was moved on to the Ruby on Rails team.   I had one day to go through rails tutorials, took home Programming Ruby (The Pickaxe book) and the next morning, after a short introduction to the code by the team lead, it was back to work as usual.  I think this is a pretty typical experience for a developer, but it does beg the question – Are we neglecting our technical foundation? I know I’m guilty of it.  Many companies don’t understand the value of reading a good technical book or surfing the web and so we are left to solidy our knowledge at home when we are supposed to be having a life.  The opportunity came up for me to attend a Rails course (if I chipped in with some of my own money) and I jumped at it, finding out all the necessarily hoops to jump through from HR.  My team lead (whose approval it required), looked at it and said “Don’t you think this is a bit basic for you, Kim?”  Sure, it was a beginner’s course and I had been doing some pretty technically challenging stuff on our system but I couldn’t stop the nagging feeling that there were gaps in my basic knowledge.

I tend to find technical books to be a little dry, and let’s be honest, after a long day at work would you choose to dredge through a thick tome or watch Private Practice?  That was of course until I saw that Head First had released a Rails book.  For those of you who have never read one, Head First are not your normal technical  manual but have been written by people who have taken the time to look at how the brain learns.  You might find their books a bit frivilous with funny pictures with captions, nice fonts and cheeky humour but the ones I have read have all been technically sound.  There is no need to study them – you simply work through them, doing the exercises provided and you’ll find the important snippets are repeated to ensure you don’t forget them.  The Head First books are NOT a technical reference, but rather the cement for your technical foundation.

• telephone numbers (your cell, home, work, partner, family…)
• pin numbers (debit card, credit card, cell phone, telephone banking…)
• addresses & postcodes (home, work and the all the addresses you have stayed at for the past 5 years…)
• dates (birthdays, anniversaries, concert dates, pet vaccinations, bills due…)
• others (balance available, bus numbers, groceries…)

However, the most overwhelming thing to remember is passwords.  There’s your work password, server passwords, database passwords, home computer passwords and then there are also offline passwords like your Sky password.  When phoning my mobile provider, not only did I have to answer the security question, BUT I also had to remember what the security question was!  I never did remember or manage to turn my roaming on, and after all that frustration, I discovered on holiday that it was on by default.   Then there are all the usernames and passwords for our various online accounts – email, facebook, ebay, amazon …

My pet hate however, are those passwords that need to be changed every month, have to be between 10 and 12 characters, must include special characters and can not be the same as any of your last 12 passwords.  These “security” rules are normally implemented on work computers.  I understand the need for security on company accounts, but by making it so difficult, companies are actually decreasing their security.  I would guess about 90% of employees at these companies write their passwords down somewhere and keep it by their desk.  I’ve done it!  There’s just no way you can remember your 8th random secure password.

So what can we (as developers) do to help?  Many of the web applications we write require user login – an account name and password.  Here are some tips that will make life easier for the user:

• Don’t assign a username – a user will generally have a couple of usernames they use which will be easier for them to remember.  This also avoids possibly assigning embarrassing or offensive usernames.  My sister’s randomly generated ISP username is sex-01.  No jokes!  She loathes having to phone them about her account and will avoid it if possible.  Do you want people to have that stigma associated with the service you are offering?
• When possible, use email addresses as usernames.  A person’s email address is their own unique value they will remember.  If your site becomes popular and people choose their own usernames, they will have to choose a new username if theirs has already been taken – yet another piece of information people don’t need to remember.
• If using an email address as a username, label the login form as “Email Address” and “Password” rather than “Username”.  It’s a nice prompt for the user.
• Email the username to the user once the account has been created.  Be sure to include keywords in the email which they would use when searching for the account details at a later date
• Let the user choose their own password (a simple one that makes a big difference yet some sites will only assign you their own randomly generated password)
• Do not email the password or store it in plain text.  As soon as I receive an email with my password in it, I consider the password as compromised and will only use “insecure” passwords on this account.  Generally people only have a couple of passwords which they reuse so be sure to keep their information safe.
• The one case you can email a password is if you offer a reset password functionality.  You should then generate a new password, email it to the user and on the next login, prompt the user for a new password.
• Do not be too restrictive on your password conditions.  If your site stores sensitive data, by all means run validation to make sure the password is secure enough but don’t be too restrictive on attributes like max length.  It has been the case where some of my personal passwords are too long to be accepted by the app (and we’re only talking about a length of approx 14 characters here!)
• As mentioned before (but it’s worth repeating) – Make sure passwords are encrypted!

So lets be nice to the users and try make their lives easier.  After all, we’re users too.

Interviewing a candidate for a technical role, or in fact any role which requires some sort of brain function, is an art.  Just because a guy is good at his job, it does not mean he will be good at finding other good people.  To start with, let us consider what makes a good employee. There are two main kinds of ‘good’ employees – those that do what they know well and those that can do anything well.  The former have an abundance of what I call “book knowledge”.  The stereotype went to university, graduated with good marks and enjoys debating on topics they are well read on.  The latter are adaptable and are able to figure out an elegant solution rather than rely on something they read.  They are open to new ideas, not scared to explore new possibilities and can think a problem through.  They often had to learn what they know themselves and may not have a formal education or score well in tests.  There are a people that fall into both categories.  The important thing to decide is which kind of guy do you want to employ?  The former typically do really well in interviews whilst the latter excel on the job.

One of my first mentors was absolutely brilliant yet he failed his Sun certification (SCJP) multiple times – even after I had passed it!  There could be a number of reasons for this – English was his second language, he didn’t do well at school so lacked confidence when it came to tests etc… but I would rather work with him than a number of people I have met who have aced their certifications.

It is easy to figure out if someone has book knowledge.  Set up an interview and ask them a couple of questions like “How do you implement a hash map?” or “Name and compare the standard implementations of a List in Java”.  Generally these questions you can google and find the answer in under 5 seconds.  A person who can answer these is as useful is a 5 year old who has learnt to use a search engine. I’m not saying that the people who can answer these questions are bad candidates – I’m saying they are bad questions which test nothing of the candidate’s actual abilities.

A good question is a question that the candidate has to think through and show you some of their thought process.  At a previous company we regularly asked candidates to implement a double-linked list.  However, we never said “Please implement a double-linked list” – in fact the word “List” was never mentioned.  We provided the candidate with the following pseudocode:

class Node {

Node prev;

Node next;

Object data;

}

We would then ask them to implement a method in Node perhaps last() which returns the last Node (ie. the Node where next == null).  If they seemed a bit apprehensive, we’d often draw a diagram (or encourage them to draw one) to show how the nodes were linked.  We ignored the little stuff (“Oh My Word! That guy left out a ;!! How could he!”) and sometimes even help out with the coding.  If we helped out a lot or wanted to further evaluate the candidate, we might then ask a slightly more difficult question like to implement the method reverse() which reverses the order of all the nodes and returns the new first node.  We could then tell if they learnt anything from the help we gave them on the first question.  Another common question was asking the candidate to reverse a String.

Perfectly acceptable answers in our interviews were “I would check the Javadocs” or “I would google it”.  If it was a little info they were missing that they could easily find online that was stopping them answering a question then we would give it to them – in the real world they would always be able to find that info – it’s what they do with it that’s important.

This is also why I honestly believe that face-to-face interviews for technical assessment is crucial! You can draw diagrams and interact in a way that is impossible over the phone.  Phone interviews should be kept strictly for getting a feel of the person and perhaps trying to suss out good questions to ask them in a face-to-face.  I was asked in the hash map phone interview (see previous post) to discuss one of the most complex problems I had worked on.  If the most complex problem I had worked on could be easily explained over the phone, then it really wouldn’t be that complex would it?

It is also important that the interviewer does not have a definite answer to their question in mind.  So often there are multiple solutions but because the interviewer is so keen on hearing their specific keywords or solution that they dismiss any other answer.  Often the question is ambiguous but the interviewer is so focused on guiding the candidate to their answer that they are not evaluating what the candidate is saying.

Think about what knowledge the candidate can bring to the team.  Interviewers generally are so focussed on providing the perfect match for their role that they look for a clone of their current employees rather than adding a fresh dimension to the team.  The candidate may not have experience in what you currently work with but your current employees can easily pass that knowledge on and the candidate might just have some other tidbits that help with some of the less common functionality.  Don’t forget that anyone’s knowledge will be outdated within a few years and it is more important to find someone who is intelligent enough to learn new things and adapt with the latest technology.  Use the opportunity of a new hire to expand the expertise of the team as a whole.

Don’t judge a candidate by their interview manner.  I am the perfect example of this.  I am an introvert (hello, geeky computer person ) and get very nervous in situations where I need to meet a lot of new people – even more nervous when I know they are meeting me purely to judge me and how they judge me might seriously affect my future (though to be honest if they can’t see my brilliance then their loss and I probably wouldn’t want to work for them anyway ).  I have studied Linguistics at a university level yet somehow when I enter an interview room, I lose words and can barely pronounce my own name.  I have very little confidence in the interview situation but some people equate this to not having confidence in my work or abilities.  If you want to see if a person is a good fit then organise another more informal interview – best way is out of the office.  Chat over coffee or a beer – perhaps bring up some controversial topic for a bit of lively technical debate.

My first thought was that it was a very mean question to ask a Java applicant as you never need to implement your own hash map, rather using Java’s implementation of a HashMap.  My second thought was “Whooopeee – I’ve done this stuff in a C++ module at Uni a few years back”.  I then launched into a rambling explanation of hash functions and ways to deal with collisions.  I wasn’t prepared for that question and the fact I was trying to dredge up memories from a few years ago left me less coherent than I would like.  The voices at the other end of the telephone seemed a little confused and after a couple more questions about my answer, I finally gave up and asked them what they were looking for.  Their answer: a collection of key value pairs.

Well, yup – that’s what a hash map is and if they had asked for a definition, that is what I would have provided.  While they thought they were sliding into the interview the easy way, I had jumped into the technical deep end and splashed around until ultimately drowning on the easiest of questions…

Which leads me straight into one of my pet hates – technical vocabulary!  The amount of technical jargon that is thrown around in interviews is astounding, yet so often the terms are really general whilst the person using it is thinking of something specific.  One example that springs to mind is “Agile” – a term used to describe a group of different software methodologies, yet you can be sure the person using it is thinking purely of the methodology they use.  Half the time people aren’t even using the terms correctly anyway.

I once went for an interview and was immediately given a 22 page technical quiz to complete.  One page consisted purely of acronyms that I had to expand (Oh wow, I know what JMS stands for, I must be a real good programmer).  The rest of the questions consisted mainly of definitions and other “book knowledge” questions.  I was really disappointed not to find a single question where you had to think about a problem and solve it (even in pseudocode).  To make things even better, I could hear the interviewer & friend talking about me just outside the paper thin walls of the interview room.  I was ready to walk out of there right then but for the sake of politeness (and pride – I didn’t want them to think their quiz had got the better of me), I completed the interview.

This last interview has helped me realise I am sabotaging myself.  I am so nervous during the interview that I am always looking for the trick or diving into the technical deep end without covering the Oh-Duh! stuff, which just might happen to be what they are looking for.  I can clearly imagine the discussion on my last interview “Oh my word! She didn’t even know what a HashMap was! …And she calls herself a developer! *tut.tut* …the candidates these days!”