Mark Curphey - SecurityBuddha.com

Yes it’s Tuesday and I am manipulating the date stamp on the blog so it looks like this was posted last Friday. I told you I would be honest! Last week was incredibly busy and we learnt some good lessons.

• Superhuman Activity is for Superhuman’s
• .NET was the Right Choice
• Tortoise and Hare Syndrome
• AGILE Development and Product Management
• Never Under Estimate the Amount of Time you Spend with your Sleeves Rolled Up

Superhuman Activity is for Super-Humans - For the last few weeks we have been putting in over 80 hours a week. Well over that number in fact last week. That means getting up at 8am and sometimes not crawling into bed until 4am, only breaking for lunch and dinner and ready to be up again after 4-5 hours sleep for the next day. We are committed to making this work and will do what ever it takes but there is a law of diminishing returns. When you want something bad enough your mind will overcome your body and you can stay awake as long as it takes. It reminds me of when I was at University and I burnt the candle at both ends. I went back at the age of 24 after a misspent youth of “sex, drugs and roll’n'roll“. If you grow up in England its hard not to!  So at University I partied like a freshman but worked like a mature student. I would be at the student union bar until it closed but always up for lectures in the morning. I managed to train my body to only need a few hours a night much like Margaret Thatcher (British Prime Minister from 1979 to 1990). I think Sir Winston Churchill did it as well.  By Friday of last week we were quite simply exhausted and started making mistakes. I am getting old. This week we are 9am to 10pm and no more. So far its much more manageable and we are still as productive overall.

Bonus True Trivia: Winston Churchill had twin beds. When he failed to fall asleep in one, he would simply move over and try the other.

.NET was the Right Choice - We continue to speak to a number of Influencers and “friendlies”. We are starting to get the paperwork in place so we can start discussing more formal specs and not just high level product plans however so far we have had a lot of validation about what we plan to build. What this means for us is that the choice of .NET 3.0 was the right one. One of the common themes we hear is integration into existing business infrastructure like Exchange, document management systems and the likes of SAP. The .NET platform combined with the likes of BizTalk gives us some scaleable and neat scaffolding on which to build our Oxygen Security Platform™ and the Security Life Suite™.

Tortoise and Hare Syndrome - This leads me to a engineering mantra we have adopted at SourceClear. We are building the hard things first and solving the tough problems whenever possible. Wherever and whenever we are faced with an easy problem or a tough problem we choose the tough option and do it right.  By doing the heavy lifting up front not only do we and our future customers get to benefit from the hard work with the platform and SDK but if anyone wants to copy us they have to run up a very steep hill to try and catch us. In business its called a moat. Warren Buffet loves moats. A moat plus fast legs is now the bet we are making.

Last week when building the security group management application (now called Security FaceTime™) we realized that the right way to build our authentication is to allow users to be authenticated at a 3rd party and to flow tokens to our back-end SOA. This is not a trivial thing to build and get right but will enable our customers to provision hundreds of thousands of users very easily and very quickly. We decided to do a simple hosted authentication for the FaceTime beta (now next Weds) and build the right infrastructure into the Oxygen Platform. Image from MSDN.

Ruby on Rails would have meant we could have built some very fast CRUD (Create, Read, Update, Delete) applications; in fact we could have had a hosted FaceTime up in next to no time at all, but considering what we know about the requirements of our customers it would have been soon outgrown RoR and we couldn’t adapt the architecture for the future. Its the right tool for the job syndrome. We also would have to build the adapters to business infrastructure like SAP, PeopleSoft, BMC, ID Management systems using PML etc. I plan to use RoR for my personal site as its the right tool for that.

AGILE Development and Product Management  - A few weeks ago I blogged some thoughts on product management and got the attention of the CrankyPM. I think I know who she is! Did she used to work at Schwab? Or is her alto-ego so good that she is indeed everywhere. My comments to her blog are here and I think sums out what we are adopting. The important bits are below.

My point was there is a balance between old school PM’ing (the stick) and modern development (the carrot). Building software is not a science and if you can find a balance between creativity and business you have a killer blend that is better than anything. Nathan Myrvold the old MSFT CTO used to say that a good developer can create 10,000 more software than an average one. I think its spot on. Our jobs is to bring out the best in developers. Its like the music industry. A good artist without a good manager will produce good music that may not sell, a good manager alone is just plain lonely but the combination of the two is killer.

Don’t get me wrong we are in learning mode (as we all our in life) and coming out of the gate at a sprint, but with the right attitude and the right amount of flexibility and understanding, we intend to not only record the killer debut album but be long term recording artists

Never Under Estimate the Amount of Time you Spend with your Sleeves Rolled Up - We are spending a fair amount of time on our corporate web site. We still don’t have our Exchange server running (it runs internally but not over SMTP) and our VSTS box is not even whirring. We have set aside two days next week to get that done. It’s all time. If you are bootstrapping you are the IT guys. Debugging some weird DNS in MSFT’s SBS takes time and it’s only down to us to fix. To build a good corporate web site takes time. Making sure the authentication and user management works well, making sure the text is accurate and the design is one that you are proud to represent you is all time. We are shooting for mid-next week to push it out but it all takes time. However much like the Tortoise and Hare Syndrome above its worth the effort. Using VSTS we can manage our product development with feature priority and tracking, scheduling and automated build tests as well as simple code versioning. Its the right thing to do in order to plan to scale. Via our web site we can build customer infrastructure so they can login and see their support requests, SOW’s, get product keys etc. It’s eating our own dog food as my friend JD Meier says.

So this week is guess what….as busy as the proverbial whatever.

I have to flesh out the additional angel funding plans. The reaction to what we are building doesn’t come as a surprise but as a dose of healthy reality as to what that it means to move from an idea to a product.

Look for Security FaceTime next week and lobby your security community groups to consider using it!