While I was on vacation the other week I was talking to my father-in-law, who works for a company that makes transmissions that go in transfer trucks.  He mentioned that he always asks people this question when they are interviewing for a designer position (i.e. mechanical engineer):  How much do you work on your own car?  I thought this was a pretty good question.  If someone is a mechanical engineer, but never spends any time working with their own car, they probably aren’t going to design things as well.  They may design things that work from a technical standpoint and meet specifications, but they’ll have lots of quirks because they simply aren’t thinking about how it will be used.  For instance, they may put some bolts in a place that would require an extra two hours of labor to get to, when they could have just as easily been somewhere accessible by just opening the hood. That may not be the best example, since I’m not a mechanical engineer, but you get the gist.

I was thinking that if I am ever interviewing programmers, I might ask a similar question.  The most obvious modification, “how much time do you spend working on your own computer,” doesn’t really apply to a programming position.  Sure lots of programmers take their computers apart and tinker with them, but so do a lot of people who think a hash table is something you smoke.

I came up with two alterations that I think would work:

1. In an industry where some say fifty percent of what you know is obsolete in five years, what do you do to stay current?
2. How much code do you write in your spare time?

I’m not saying by any means that a hiring decision should be based on either of these questions, but I do think a candidate’s responses would be telling.  I think it would also be pretty simple to identify whether you are getting BS or a legitimate response.  I think the first question is especially important, because most of the people I know who I don’t think are very good programmers probably have no idea what Ruby or AJAX are.  They’ve barely heard of C#.  You’re lucky if they’ve heard of Firefox.  True, they don’t work in web development, but that’s not the point.  Most good programmers I know tend to follow geek news and they are familiar with the “latest and greatest” technologies, even if they aren’t using them.  You may have been a pretty good COBOL programmer back in the day, but if you didn’t try to keep up with newer stuff, you’re not going to make a good Java programmer.  You’ll be stuck maintaining thirty-year-old COBOL code.  And if you are stuck working on thirty-year-old COBOL code, that’s your own fault.  In the last ten years the internet tubes have been filling up with tons of information:  you don’t have to subscribe to trade magazines or anything like that.  Just reading Slashdot or Digg or Endgadget from time to time goes a long way.  Of course, you’d have to watch out for the person who has heard of Ruby (for example), and lists it as a skill, when all they’ve really done is read the Wikipedia page on it.  I think one of the best pieces of resume advice anyone told me was to separate languages you have a strong proficiency in from those you just have a little experience with or haven’t used in years (thanks Peter).  If someone lists fifty programming languages, they are probably only proficient in maybe three or four of them.  And there are also those who memorize lots of buzzwords and sound smart but really aren’t.  You would need to have a pretty good BS detector.  But I think that is a prerequisite for conducting interviews anyway.

As for the second question, most of the people I would consider to be good programmers can’t just work on code at work.  Most of them have side-projects or a website or something sort of code related that they spend some of their spare time on.  The thing I don’t like about the question (at least the way I phrased it) is that it is too leading.  A candidate might think “uh oh, they want someone who writes Linux kernels for fun” and might give a BS response, even if they don’t intend to.  Incidentally, if you find someone who writes Linux kernels for fun, and they are telling the truth, you should probably hire them even if they drop racial slurs and/or their pants during the interview.

So whadda y’all think?  Good idea/bad idea?  Am I way off-base?  I’ve only been on the interviewee side of an interview before, so I don’t really know what I’m talking about here.  In any case, I think these are better questions than “What is your greatest weakness?”

PS: If they answer, “I’m a perfectionist,” they are probably lying.

I recently was asked to come into work on a Saturday at my place of employ.  I have no problem with coming in to work on a Saturday if my work requires that I come in to finish something that has not fully been completed during normal business hours.  However, this day was a mandatory work day for the entire company, and the area in which I work had nothing pressing to accomplish that day.  Instead, the upstairs lab came in to work solely to clean the lab from top to bottom.  True, it needed this scrub down terribly, but still not badly enough to make us come in on a Saturday.  And that isn’t even the worst of the situation.  We were required to come into work at 5:30 am!!!  On a normal day I don’t go into work until 7:30 am, but on mandatory Saturday workdays, we have to go in two hours earlier, to clean.  We were also in no way compensated for coming into work that day.  Normally I would expect to receive time off back in place for this extra time we were putting in, but no that didn’t happen.  Also, if I decided not to come in on Saturday, they would take a day of vacation from me, even though I already put forty full hours that week.

There were about three other problems I had with coming to work this particular Saturday.  Shall I tell you about them??   I think I will even if you don’t like it.  The first being that I acquired a small chemical burn from the chemical cleaner that we were using to clean the lab.  I accidentally sprayed some of the cleaner on my forearm and about thirty minutes later, I had four or five nickel sized whelps on my arm.  They are now just a few red spots on my arm, but it has been over a week since it happened.  The second thing I had a problem with was that one of the other people I work with somehow managed to do practically no cleaning at all in a full eight hours.  He spent most of the day sitting at his desk chatting with everyone else in the lab while they cleaned around him.  When our bosses came back up to the lab, he continues to simply talk to them instead of clean while the rest of us cleaned our little tooshies off.  Well, needless to say, we cleaned and cleaned and he got the credit for it.  He has made procrastination a true art form.

I know this wasn’t exactly a fun or exciting post, but hey, at least I finally got around to making one!!!  Have a great day!!

About a year ago my company hired a new Chief Executive Officer (what the kids are calling a C.E.O.).  One of the things he started doing is taking five randomly selected people from the company out to lunch every month.  I was randomly selected for this month, so I get to have lunch with the CEO tomorrow (presumably at his expense, since he probably makes more than my annual salary every month).  I don’t really have any hard-hitting questions.  I suppose I could ask if we plan on hiring any more programmers in not-India.. but I probably won’t.  Or I could ask something completely irrelevant, like what his opinions are on British literature from the early eighteenth century.  But I probably won’t do that either.  I might post an update later this week, if there is anything worth blogging about.  I do think it’s a pretty cool thing for a CEO to do, even if he’s not exactly Bill Gates or Larry Page (we are something like a two billion dollar company though... I think).  He also has a rule that none of the people invited to lunch can be the boss of any of the other people (so I guess it isn’t purely random).  Which is good, I’d say.

At work, several people have left in the last year or so, and no one has been hired (at least, no one in not-India) to replace them.  This has resulted in several empty cubicles with equipment sitting in them going unused.  So a few weeks ago, just before Christmas, I took an extra monitor that was just lying around and set up my computer for a two-screen display.  You may recall from a previous post that I have four computers under my desk.  Well I came up with a way to use two switch boxes to give myself access to three of the four machines (the other I’ll still use remote administration for), while still keeping my main machine outputting on two screens.  Check out my schematic (blue lines are video, black are keyboard/mouse):

If that seems a little complicated, that’s because it is. :)  Here is a table of which switch box needs to be switched to what in order to use different arrangements:

The only problem I’m running into is from daisy-chaining the keyboard from one switchbox to another.  The mouse seems to work okay though.  Maybe it’s because the mouse is natively USB, but the keyboard runs through a PS/2->USB adapter (these are USB-only switch boxes).  I suppose a four-way switch box would be a much better option, then I could just have one screen run straight to my main computer and run the switchbox on the other.  But I wanted to do this without having to ask IT for any stuff that isn’t lying around in empty cubes.

I’m currently using the top half of this image as my two-screen display (as seen below).

So I mentioned quite a while back that I had been reading The Daily WTF.  Well a little over a year ago I sent something in.  Not bad code, but a funny story about an interview experience I had.  Last Friday (on my birthday, ironically), Alex (who runs the site) decided to run my story along with four other interview stories.  He also decided to take a poll of which story was the best, and the submitter of the winning story would win a bean bag chair from Sumo Lounge.  Well my story won (seen here, the one titled “Are You An Astronaut?”).  Be forewarned:  the version of the story shown on the site has been edited a little bit from what I sent in (which will be faithfully reproduced at the end of this post).  I kinda feel bad that I stopped reading the site a few months ago because I got bored with it.. but I got an e-mail this week saying that I won an Omni bean bag chair, I just needed to pick a color (I went with Charcoal Green).  These things are supposed to be pretty nice (and at $150, they’d better be!); I’ll be sure to let you, o faithful reader of my blog, know what I think of it.  Hopefully the blonde comes with it.

As promised, here is the original version of the story that I sent in:

Fresh out of college, I was interviewing for a junior programming job at a company that develops software for aerospace/automotive companies.  So far the day was going well.  I interviewed for about an hour with someone from HR, then interviewed for another hour with the person who might be my manager, and that interview went really well.  Then to close the day I interviewed with the project manager (the previous manager’s manager).  Again, things were going well.  There was a lull in the interview where the guy was looking up something on his computer, so I started looking at the things he had up around his office.  On one wall he had a collage of NASA stuff.  Without thinking, I guess to make conversation or something, I asked him if he was an astronaut!  It was one of those situations where I was regretting it even as it was coming out of my mouth.  He looked at me like I was retarded, then said “no, I was a project manager at NASA.”

As it turns out, I was somehow still offered that job, and it’s where I’m working now (a little over a year later).  I don’t know if the guy remembers me asking that or not, but he’s my manager’s manager so I don’t really see him that often.

Here is a database query that has a potentially huge problem:

  select * from users where username = '$username' and password = '$password'

If you’re not a programmer, bear with me, I’m sure you can still follow the problem here.  In the line above, $username contains the value the user gave for their username, and $password contains the value given for their password.  Let’s say my username is “kip” and my password is “12345”.  That gives us:

  select * from users where username = 'kip' and password = '12345'

So far so good, a database can execute that just fine.  But what if my password is “My dog’s name is spot”?  That gives us this:

  select * from users where username = 'kip' and password = 'My dog's name is spot'

See the problem?  The database will think the password is just “My dog”, since there is a single-quote in the password.  It will additionally not know how to handle the rest of the statement and probably return an error, preventing the user from ever logging in.

Nothing I’ve said here of this should be news to a programmer.  In introductory programming courses, students are often asked to write a program where the user is asked for input (let’s say, a number from 1-10), and the program must not fail if the user enters something entirely different (let’s say, “judicious”).  What is happening in my example is in no way fundamentally different.

If you’re thinking to yourself, “Hey Kip... you’re not writing this post because you just figured this out.. are you?”, rest assured that I am not.  I am writing this because (a) I like to pretend that my blog has more than a dozen readers; and (b) because I have seen several sites discussing this type of bug lately.  The implication is that many programmers—presumably the paid, professional types (not just amateurs)—would put user input inside single-quotes without entertaining the possibility that the user might enter text with single quotes in it.  It seems like one of those things that you shouldn’t need to be taught—you should logically know to validate user input, even if you have never received formal training in programming.

Thus far, I haven’t even talked about the security hole caused by this code:  someone could intentionally use a single-quote in their password to exploit this bad code.  For just one of many examples, giving a password of “‘ or ‘abc’ = ‘abc” will let you into any existing user’s account (this is called SQL Injection).  I can understand why a programmer might not see that security hole immediately.  But the security hole is just an abuse of a bug that a logical human being should have seen in the first place.

</soapbox>

A few weeks ago, I had to explain inheritance to someone who has been working with software for over a decade.  Sure, he may not have learned about inheritance back when he got his degree, and he may have spent some of his career in sales traveling around the world without writing code.  But for the last three or four years, his job—you know, the thing that pays for his kids’ food—has been to write and maintain Java code.  I expected him to have picked up on this whole object-oriented thing by now.  Since it’s a fundamental concept of Java and all.

Here’s a very simplified version of the code in question, formatted to be as brief as possible:

class A {
  protected boolean isFooRequired() {  return true;  }
  public void doSomething() {
    if (isFooRequired())
      foo();
  }
}

I suggested he fix a bug by adding isFooRequired() to a subclass:

class B extends A {
  protected boolean isFooRequired() {  return false;  }
}

He didn’t understand how the line “if (isFooRequired())” would know to call the isFooRequired() method in class B for an instance of B.  It’s called polymorphism.  Look it up.

That got me thinking about my own software development knowledge.  I work in a field where half of my technical knowledge will be obsolete in five years, and I have probably learned almost as much since graduating as I did in school, so how much good did my degree really do me?  A lot of what I know I have learned from websites and blogs for developers.  I guess they are kinda filling the niche that industry magazines used to fill.  In ascending order of usefulness, the sites I visit most would be The Old New Thing, The Daily WTF, A List Apart, and especially Joel On Software.  And please let me know if I’m missing out on any good ones.  So anyway I’ve learned a lot of things that they just don’t teach you at school, or that you would never want to learn in a classroom (i.e. having a test where they ask if you should require developers to write code in the interview would be dumb).  But there are many things that I wasn’t really taught, or that I was taught only through an elective.  Regular expressions have been extremely useful in my two years of professional programming, yet I only learned them in a one-hour Perl course.  I was never taught closures, and I only learned a functional programming language (Lisp) in an elective (Artificial Intelligence).  Not that I have ever used Lisp in the real world, but closures are nice and allow programmers to do some powerful things very easily.  Java and PHP kinda have things that are sort of like closures, but not really.  Perl has them, but I never write any code in Perl complex enough to need them.  I was never taught databases—I strayed from the databases elective since I knew that if I took it, I would list it on my resume, and I was afraid that listing the course would land me a job as a database administrator.  And I did not want to be a DBA.  In my software engineering course, we went over some concepts that are very important, but don’t really make sense to be tested on—it might have been more effective as a required series of lectures or something, provided the lecturers did a half-decent job.  I know I would have payed more attention that way.  Design patterns were covered in that course very briefly, although knowledge of them has been invaluable to me in the real world, and I was asked about them on nearly every job interview I went through.

I guess where I’m going with this rant is that I make an effort keep up with the latest and greatest.  It is something I am interested in (which is one of the reasons I chose to major in Computer Science in the first place), and it is vital to me being good at what I do.  Shouldn’t I expect others in this field to make at least a minimal effort to do the same?

For today’s installment I figured I’d give you guys an idea of where I work.  And if you’re someone from work, don’t worry—I have blurred out anything that might possibly be confidential.

Above you can see a pretty wide shot of my desk.

• Airplane:  This is a promotional poster that they gave us, one of a set of four, showing something that a customer has actually designed using our software.

• Rubik’s Tetrahedron:  I think this is actually a knock-off, not made by Rubik’s.  I picked it up at Stephanie’s family’s yard sale for a quarter.  It is pretty simple to solve, I can do it in like five minutes and I never had to look up any “strategy” to figure it out.

• Decoy pen:  I am very protective of my pens.  It seems that whatever pen is located on the edge of my desk is always the one that is borrowed “for just a second” and never returned.  So I keep a cheap pen there as a decoy.  Even though both types of pen are available in the supply room.. they might stop stocking the good ones right when I need one.

• Post-it notes:  Post-it notes with Unix commands I use frequently enough that I need to keep them handy, but infrequently enough that I haven’t memorized them.

• vi cheat sheets:  The vi cheat sheets that I have mentioned before.

• Chair:  My chair.  Not much to it.

• Three boxen:  Three out of four computers I manage.  The fourth is actually in the corner, under the desk.  You can see it behind the chair but I didn’t label it.  One is my main workstation, two are only used to run test scripts overnight, and one is used for collection and overnight builds of our team’s code.

Here you have the other side of my cube.

• Trash can:  I think that is self-explanatory.

• Good pens:  This is where I keep the non-decoy pens.

• Chess board:  The chessboard I mentioned in my second blog post.

• Simpsons quotes:  These quotes from a Simpsons calendar were once on my dorm room door.  Some of them are very politically incorrect, but no one has said anything in two years.

• White board:  I have blurred out the only information that could get me into trouble for putting on the web, the rest is just notes from two different conversations.  Oh, it is sitting sideways because I have nothing to hang it from the wall with.

Last but not least, we have a closer view of what I am looking at for eight hours a day.

• Watch:  I cannot use a keyboard with my watch on, so as soon as I get to work it comes off.

• Wedding photo:  A picture from our wedding that is not on this site because I have never gotten around to scanning the pictures that we got from the photographer.  It is Stephanie next to our getaway car.  The other picture (obscured by an apple juice bottle) is one that Meredith took on the day we got engaged.

• Double-pen:  A double-headed pen that makes me uneasy.  Highlighter end is neon-greenish-yellow, pen end is black.

• Binary clock:  The binary clock that my mother-in-law gave me at a wedding shower.  Ten points to the first person who can correctly tell me what time it reads.
  Hint:  it is in BCD mode, and the MSB is the top-most light in each column.
  Update:  Jonah gets the ten points for correctly identifying the time as 08:21:50.

• Black keyboard:  I spray painted my keyboard black four years ago (an idea I have to admit I copied from Garrison… imitation is the sincerest form of flattery though, right?).  I decided I’d bring it in to work.  If you work for a software company and need to see the labels on the keys, I don’t want you anywhere near my computer.

• Rear-view mirror:  I hate it when people sneak up behind me.  There was an episode of Seinfeld about this.  I got this two dollar mirror, which I think is more effective than giving all my sidling coworkers boxes of Tic-Tacs.

• telnet session:  I spend a lot of time in telnet.  I think my orange on black color scheme is easy on the eyes, and delightfully old school.

• “Curly”:  You can’t see him very well (in fact, you can see him better in the first picture), but there is this little alien-like figurine with a magnet on his head that holds paperclips (like this, only in red).  I got this in Fort Lauderdale when we were visiting Stephanie’s sister last spring.

• Apple juice:  Coke products (including Minute Maid juices) are provided for us for free.  I always drink a bottle of apple juice in the morning.  Each bottle contains 250% of your daily requirement of Vitamin C!

• Calendar:  A calendar layout I came up with.  There are no breaks between the months except an extra-bold line, and no weekends, but there is the week number.  On the left side of my monitor I also have a one-inch-wide version of the calendar that is invaluable.

Well that’s my crib!  Goodbye, MTV!

It’s a “Jump To Conclusions” mat.

Someone at work just came around asking if anyone wanted to be a model for some kind of brochures we’re putting together.  I volunteered. They had me stand in front of a whiteboard, while three other people sat at a desk, and we pretended to be in a meeting.  You know, the important kind of meeting, where proactive synergy leverages best-in-class paradigm solutions.  I’ll try to get ahold of one of the brochures and put a scan up here as soon as I can.

As of yesterday afternoon, I became a member of the working class of America.  It only took the company three and a half weeks to realize I was the best person for the job and offer it to me.  I start Monday morning, and I’m very excited and very nervous.  I can’t believe that after all this time i will actually have a real grown-up job.  I’ve never had one before that I had real responsibilities.  I’ve always been just an intern where what I did didn’t really effect anything else.  Let’s all hope and pray that it goes well and that I like it.  I won’t be doing anything to extreme my first few days, just getting orientated and reading a bunch of SOP’s (standard operating procedures for those who aren’t familiar with the acronym).  Then I get to shadow a veteran employee until I get the hang of what they do exactly.  But I will be getting paid and not sitting home all day eating my self into obesity.  So congrats to me for landing a job.  I’ll keep you posted on how it goes.