Applications Are People Too

Hoisted by my own petard: or why my app is number two (for now)

2012-01-09T23:10:00.007-05:00

I have to admit that I have taken some small pride in the fact that my app, Yoga-pedia, has been the number one yoga app on the Windows Phone marketplace since its debut over the summer. Imagine my surprise when I checked the marketplace today and found another yoga app in the lead!

Of course I had to know what made this app so special and so I clicked through to check out the competition. OK, the cover art shows a barely clad buxom brunette in some faux pose – “it’s one of those apps” I said to myself; those soft-core apps that are all about titillation and little else.

Needing to satisfy myself that I had this app pegged, I quickly scanned the description… what’s this!? “No matter what your issue, there is most probably a pose for that” – that’s my line (after all, my paid app is “A Pose for That”). My eyes dropped to the screen shots – no way! – Other than the home page, the screen shots were lifted right out of my app!

This free app included the four yoga instruction videos only included in my paid app. Just to be clear, these videos feature my wife as the instructor, I filmed the videos (and even composed and recorded the music).

I’d been beaten by my own content!

Two things happened in quick succession; first, I got really pissed; and then I was awash in a flood of questions…

Who the F#$! is behind this? (and please let me meet them one day)
How did they do this? (and is there something I could have done to prevent it?)
What can I do about it? (and how much of my time is this going to suck up?)
Is this a common problem (if so, why haven’t I heard about this before?)
Why did they do this? (they don’t show ads and the apps are free)
What other apps does this publisher have? (and are they also stolen?)
And do I tell my wife? (because she is going to be even more pissed than me)

Who’s behind it? Well, I can’t say for sure – the company name has no other reference on the web that I could find – but they’re out of China and I am working on a few leads…

How did they do it? I believe they downloaded the XAP from the marketplace and while they couldn't take my code (it’s not in their app), they definitely lifted my resources (they are named identically to mine including spelling mistakes). Obfuscation/encryption can protect the code – but did nothing to shield my external resources (like the videos).

What can I do about it? Microsoft has an established process that I have initiated – I’ve been led to believe that they will act swiftly given the unequivocal evidence I was able to develop. If this is all there is to it, Microsoft has made the process straightforward (I will post more if it’s more involved).

Is this a common problem? I have no idea – can someone else share?

Why did they do it? I really don’t know – BUT the pirated version of the app uses

music and video library
phone identity and
data services

There is no reason to use these services to play my four simple videos – is this malware? Phishing? What are they doing with this app? I’ll have to take a closer look – I expect (hope) Microsoft will too.

What other apps does this publisher have? Some over-the-top soft-core apps and a collection of language apps – I suspect all of these are “resource-heavy” with little or no exposed app logic (so they are all stolen) – they are driving adoption for sure – but to what end?

And, last but not least, do I tell my wife? Well, of course I did and, yes, she is pissed – especially when I explained that there is no way we are suing anyone in China for copyright infringement.

At the time of this posting, the offending app is still live - but to be fair, it’s been 5 hours since I discovered the app, 4 ½ hours since I first contact Microsoft, 3 ½ hours since Microsoft gave me the contacts and process to begin the take down process, and 2 hours since I initiated the process.

I’m coming for you Ryan! (and you'd better hope that I get to you before my wife does)

POSTSCRIPT

The offending app has been taken down by Microsoft. It took 24 hours and, as I tweeted earlier, given the legal hoops I'm sure Microsoft had to jump through, I think that's pretty good.

On the other hand, the bad actor, Ryan Lan AG, still has 10 apps on the marketplace. I think publishers who so blatantly abuse their fellow publishers should be blacklisted. ...but that's just me. Ryan - you want to man-up and identify yourself?

The Microsoft sponsored service for WP7 ends – the PreEmptive sponsored service debuts

2011-11-29T11:12:00.014-05:00

At 24:00 EST on December 9, 2011 the Microsoft sponsored protection and analytics service for Windows Phone 7 will be shut-off.

A different service fully and solely subsidized by PreEmptive Solutions will take its place. This service is materially different – please read the following notice carefully for information on how to continue to work with PreEmptive Solutions technology for Windows Phone.

Background

While Microsoft’s sponsorship expired on September 30, 2011, PreEmptive continued the service for an additional 60 days at our own expense while we explored a variety of options to continue our support for the Windows Phone development community. Microsoft’s sponsored service has ended, but our commitment and support for this community continues unabated.

PreEmptive’s challenge was to find an affordable means to support for the burgeoning WP7 development community without compromising the quality and capabilities unique to our protection and application analytics technologies; we believe the following provides both a valuable set of services at little and no cost for small WP7 development efforts with a smooth “on-ramp” for larger development projects and for organizations with more demanding service levels, governance or scalability requirements.

Summary

Obfuscation and Instrumentation continues at no cost through 12/31/2012.

Dotfuscator for Windows Phone, the post-compile tool that obfuscates and injects application instrumentation will continue to be offered to Windows Phone 7 developers at no cost through December 31, 2012.

Mobile analytics endpoint (wp7.runtimeintelligence.com) will be shut-off on 12/9/2011

The current analytics endpoint will be discontinued. However, developers have a number of options that they can consider;

· Subscribe to the PreEmptive Solutions commercial endpoint. This is a fee-based option that includes all of the features currently offered PLUS an advanced mobile portal, a RESTful API, and a higher service level (plus support beyond WP7). For more information, email sales@preemptive.com.

· License PreEmptive Analytics for TFS. This is also a fee-based option. This solution is an on-premises solution focused on exceptions rather than feature tracking. For more information, see Using Analytics for Windows Phone and Azure Exception Tracking - User Community Virtual Series and email sales@preemptive.com.

· Develop and host a homegrown endpoint. This is a no-fee option but development will be required. The CodePlex Runtime Intelligence Endpoint Starter Kit repository starter kit project may be of some help.

· Plan to migrate to the PreEmptive Analytics for TFS community edition to be included with Dev-11. This is a no-fee option but is NOT yet generally available from Microsoft. For more information, see the video A Lap Around PreEmptive Analytics for TFS with Justin Marks.

· Publish their app as a CodePlex project and utilize the CodePlex analytics endpoint (this is different than the option above). This is a no-fee option. For more information, see this tutorial (note that this assumes the developer is limited to the Community Edition of Dotfuscator – but the WP7 edition has full functionality).

The following feature summary table highlights the three principle options available to the Windows Phone 7 development community with a comparison to the discontinued Microsoft sponsored service. (click thumbnail to enlarge)

FAQ

Q: Will developers have to republish my WP7 app on or before December 9, 2011?

Q: Will users notice any difference in app behavior after December 9, 2011?

Q: Will I have to re-register my installation of Dotfuscator for Windows Phone 7?

Q: If I have only been using Dotfuscator for obfuscation, will I lose any functionality or will I have to do anything differently?

Q: Will developers have access to earlier runtime data generated by Runtime Intelligence for Windows Phone after December 9, 2011?

They will not.

Q: Where can developers ask additional questions regarding migration, upgrades or discontinuing use of PreEmptive Solutions technologies?

Post to the PreEmptive forum at http://www.preemptive.com/forum/index.php?f=26&sid=dfe90c2ba80de07692372dae962c58b2&rb_v=viewforum

PLEASE NOTE – this is NOT a moderated forum.

Q: Why would a development organization upgrade to a professional SKU of PreEmptive Analytics?

· Multi-platform (WP7, Android, JavaScript, all .NET and Java, native API…)

· Private endpoint (for large-scale enterprises with demanding scalability, governance, or other unique requirements).

· Analytics for TFS option (out-of-the-box integration with Microsoft Team Foundation Server).

· True application analytics such as custom data fields, development ownership of data, true SLA and support for developers, etc.

Conclusion

Of course we would have preferred that Microsoft had opted to extend their sponsorship for Runtime Intelligence for Windows Phone, but that was not the decision that they ultimately made. However, over the past 12 months, we had a front row seat watching a flood of innovative apps launch. We know that a good percentage of the WP7 development community relied upon PreEmptive Solutions for both analytics and protection (in a recent analysis of the marketplace, it was shown that 17% of all apps used either protection, analytics or both).

This experience combined with our confidence in the future of the Windows Phone platform has prompted us to extend free access to Dotfuscator for Windows Phone. We look forward to our continued support and participation in the growth and success of this exciting technology and marketplace.

60 days – déjà vu all over again?

2011-10-10T15:23:00.002-04:00

Hi all – today I sent out a notice to registered Runtime Intelligence for Windows Phone users letting them know that a change would be coming to our service on (or perhaps after) December 9^th. I have already received messages from some rather annoyed developers who feel like we are playing some kind of Machiavellian pricing game; the basic flaw in this view is that it presumes we sit in the Prince’s chair – which we do not.

First, let me start by stating categorically that we remain excited and committed to the Windows Phone platform.

Our approach to analytics has always been squarely focused on development organizations rather than on marketing; this is not a “spin,” rather, this approach informs and influences our product’s architecture and business model.

I’ll drill into this distinction in a moment, but first, I want to point out that it is this distinction coupled with our belief in WP7 as a platform and the value of our approach to application analytics in general that led us to invest in building out the WP7-specific service. While I cannot speak to Microsoft’s motivations (in any context, let alone this one), it is public knowledge that they funded this service so that it could be offered at no charge to the WP7 dev community (but now that’s no longer the case).

Why was this even necessary? Why couldn’t PreEmptive just give away our analytics and protection service like Google does?

“Marketing-centric” analytic services make their money off of your data – but first they have to cover their costs; the “back end” or analytics portal is where the majority of that “cost” sits. Today, Google or Flurry (or any other similar service) each rely upon web and other mobile platforms to generate the data volume that ultimately funds their backend service. At this early stage, WP7 app data can fund client API’s (perhaps) but is nowhere near the volume-levels required to pay for an entire service.

But there’s more – focusing exclusively on resalable content (and by extension, divesting from any requirements that do not) have profound feature and architecture implications.

Given a marketing-centric focus, you can readily understand why these solutions all share the following traits:

· Custom data fields and data types are limited in scope and volume (unique/heterogeneous data points cannot be easily rolled-up, sold or used to better target users)

· No built-in enforcement for opt-out policies – this is left entirely to the developer (if you do not provide user data to these services, you are of no value)

· No investment in analytics of software away from the presentation layer (this data has no relevance to advertising, profiling etc.)

· Software-specific data is only marginally supported – unhandled exceptions can be captured, caught and thrown exceptions are out of scope *same as above – does not contribute to monetization model.

· They own your data (privacy rules notwithstanding – the have full rights to monetize your data in any way they see fit). This is the entire reason they are in business – if they don’t own the data, how can they make money?

· They can provide their analytics software for free – since they have built a monetization strategy based on your data and do not invest in any development that does not directly contribute to that strategy, they can afford to give you the picks and shovels for free in exchange for the gold you produce for them (that’s big of them don’t you think?)

Conversely, focusing on application stakeholders as we do, we invest in features that do not contribute to a roll-up across companies and apps to monetize user preferences – in fact, some of these features can materially impede that objective – yet they are equally as important for developers who want to build better, faster and more effective software…

For example:

· Supporting custom data (app-specific fields and states) and data types (other than strings)

· Built-in exception tracking (unhandled, caught and thrown) to not only send you stack traces but provide insight into user experience and runtime environments (hostile or otherwise)

· Built-in opt-out policy enforcement (local, regional, cultural, legal and regulatory rules are so complex – serious development organizations need to centrally manage and reliably enforce compliance – could you sell a gun without a safety?!)

· Analytics away from the presentation layer (want to know how your Azure or other distributed services are performing and behaving?)

· AND LAST BUT NOT LEAST, you own your data. (given the heterogeneity and specificity of each application’s data – it’s value is exponentially higher to development stakeholders and proportionately lower in aggregate)

So what’s the takeaway?

With Microsoft, we invested in this mobile platform because we believed (and now we know) that it has significant value.

Given our focus on development rather than advertising, we have to innovate on both the technical and business ends.

We had hoped that our previous relationship with MSFT Windows Phone division had lasted a bit longer, but it is what it is.

We have a number of very interesting scenarios in mind that we think will prove to be both exciting technically and innovative from a business perspective – but we are not ready to discuss that yet (as soon as we can – we will).

If you don’t care about these added value features and don’t mind the strings that come with web/mobile analytics services like Google – then you should certainly use them. They are not flawed – they are just fundamentally different.

If you value the services we have been offering or have ideas on how we can improve them even further – PLEASE LET US KNOW…

Registered users will be getting a survey in the next 24-48 hours – please let us know what you think and what’s working (and not) for you.

As I've already said, we remain excited and committed to the Windows Phone platform.

(now i have to break to prepare my wp7 training materials; i've got a crew from my son's high school writing WP7 apps for independent study credit)

Runtime Intelligence and Dotfuscator for WP7 developers speak (Mikey likes it!)

2011-09-26T17:00:00.017-04:00

In my last post, I drew a correlation between apps that used Runtime Intelligence and their relative (positive) success as measured by user ratings and engagement. While it was fairly clear that developers who chose to use Runtime Intelligence built more successful apps than their counterparts, it really said nothing about a) Runtime Intelligence analytics’ contribution to their success or b) developer satisfaction with Runtime Intelligence overall.

Well, there’s really only one way to answer these questions …and that’s to ASK THEM.

I sent out an electronic survey starting on Monday of last week (September 19) and have received over 200 developer responses. Here is what they said…

Who is doing what?

32% indicated that they are only using Dotfuscator to protect their application
24.5% said they were only using Runtime Intelligence
And 43.4% indicated that they were using both.

Do these “smarter than the average bear” developers see the value?

In a word, YES.

Looking only at those developers who indicated that they already had their applications in the marketplace (representing over 100 development organizations):

60% indicated that analytics set the wp7 platform apart from all other platforms or added significant value to the platform.
68% indicated that protection set the wp7 platform apart from all other platforms or added significant value to the platform.

Analytics’ perceived value increases by 450% with developer experience

When looking at those developers that indicated that analytics and/or protection “set the WP7 development platform apart from all others,” analytics’ value actually increased by 450% (from 2% to 9%) as developers moved from no app, to less than four weeks to a ship date, to actually having an app in the marketplace (and getting analytics back). Interestingly, obfuscation (protection) peaked in value just prior to shipping.

So what’s the takeaway?

In my last post, we established the user of Runtime Intelligence were more successful than other WP7 developers. In this post, we see that these developers credit their success, to some material degree, to either Runtime Intelligence or Dotfuscator protection (or both).

In their own words

(selected - but unedited - responses to the open-ended question "what are you most excited about?")

I like being able to get crash reports without much additional work.

It gives the developer ability to know about usage patterns in an application. Obviously code obfuscation is a necessity, especially for paid apps.

It offers a unique way to see how users interact with the application, and with the latest release it also has error reporting. Awesome!

I'm an excitable person.

Fabulous data provided by RIS to analyze the performance, usage and app demographics.

So I can know what is happening in my app and protect my code.

Used correctly, the analytics really let me see how and by whom my application is being used. I get more insight into this information than I could if I set up a usability lab or just did extensive user testing. There is no better way to observe than to do so in production.

The concept of attaching runtime analytics after the compilation process is very useful for us (standard software development, single application in various customer-specific configurations), since we are able to attach this on a per-customer basis and don't have to manage it in code.

UI for parameterization

It gives detailed statistics about the usage of all parts of the software and helps to recognize the hot features of the software are and which parts are less used. This adds great value into the effort of making software better.

Really gives me insight into what my customers are doing with my applications. They help me to understand where I can enhance functionality and add value.

Quality of product

Analytics give me an idea on what I should work on next to improve my application

Runtime analytics is cool because there is no code to write.

I can collect the exact information i need.

It allows me to phase out or strengthen certain parts of my apps. I currently have seven apps and the instrumentation is crucial.

Because i can have a deep analysis of when and especially how my application is being used. If you add the fact that all these data are aggregated and presented in such a nice way by the portal, you end up with a great product

I produce libraries (DLL's) that are handed to third parties, hence the need for obfuscation.

Kickass obfuscator.

It helps me keep track of any bugs. And it allows feature tracking. And it gives me the cool world map that shows where some of the users are.

WP7 apps with Runtime Intelligence have higher ratings and engagement rates

2011-09-26T15:22:00.006-04:00

In my last post, I lamented that only %2.5 of the apps in the marketplace were actively using Runtime Intelligence (RI). This begged an obvious question; were these developers leaders or laggards? Were RI-enabled apps more successful and effective and, by extension, worth emulating?

The short answer appears to be yes – to be clear, I am NOT saying that merely turning Runtime Intelligence on increases an app’s success. What I think the following data does show is that the developers who chose to include Runtime Intelligence as a component of their development process are indeed more successful than those that did not.

I took a second look at the 26,469 apps that we downloaded from the marketplace and compared those apps that were instrumented with Runtime Intelligence with those that were not.

Specifically, apps with Runtime Intelligence (analytics) are:

Ranked 25% higher: RI-enabled apps averaged roughly 4 stars (8.02 out of 10). Non-RI apps came in at 3 ½ stars (7.6 out of 10). NB: apps with no ratings whatsoever were excluded from this calculation.

Have a 50% higher rate of engagement: 73% of the apps using RI had at least one rating while only 48% of non-RI apps had any rating whatsoever.

As I've already said, simply turning on RI will not get you a 1/2 star bump in your ratings - but clearly, the kinds of developers who are achieving higher user satisfaction are the kinds of developers who are choosing to use RI.

Coming next: Users of RI and Dotfuscator for WP7 make themselves heard!

WP7 Marketplace share (or how we became a victim of our own success)

2011-09-22T12:52:00.012-04:00

This post tells the story of how good faith estimates of our WP7 marketplace penetration were under-reported by 500%. This is not a “gotcha blog” – there are only good actors with the best of intentions in this story; but that’s why I think it’s a story worth telling.

You see, we don’t just obfuscate – we hide the fact that your app is obfuscated. We don’t just offer application instrumentation and monitoring, we inject that logic to simplify and streamline packaging and improve performance. …and therein lies the rub.

Something was in the air

While at Build soaking up the heady atmosphere of Windows 8 and all that’s coming with it, a few MVP’s and also the Lowdermilk brothers took a moment to ask me if I’d read this awesome blog post where a developer had downloaded and analyzed all of the XAPs in WP7 marketplace. Apparently the market insight was killer and covered everything from the most popular libraries to snagging cloned apps. No more guessing – the facts were all laid out. And they each mentioned to me how surprised and even a little worried they were by how few apps were being obfuscated. I didn’t think too much of it at the time as I am among the first to point out that not every app needs to be obfuscated – but I did make a mental note to be sure to check out the blog.

When I got back home, I finally had a chance to track this “all seeing blog” down – it was Justin Angel’s blog and the post was Windows Phone 7 Marketplace Statistics. And it really is a fascinating post with both initiative and insight; and then I got to the obfuscation section.

According to Justin’s analysis, only 3% of the apps in the market were obfuscated! And as I scanned down, there were comments to the effect of “gee, since no one else is doing it, perhaps I shouldn’t bother either.”

Even more surprising to me was the fact that our analytics (Runtime Intelligence) was not even listed in a very long list of third party tools – when I knew for a fact that we have nearly a thousand apps sending data.

This can’t be right! (and I was)

Given the nearly 6,000 downloads of Runtime Intelligence and Dotfuscator for WP7 and the activity that I had been seeing over the past year, these numbers just didn’t seem right. I wrote to Justin who was quick to share his detection logic (in fact he posted the source on his blog) and just as quick to invite any comments or refinements that I might have to offer.

To put a fine point on this, Justin was in no way defensive and was as interested in getting to the right answer as I was.

Hung by our own petard

Without going into a lot of detail, Justin’s approach was to bust open the XAP and examine the various files and manifests to separate Silverlight from XNA and to identify the presence of third party tools. This approach proved to be effective because frameworks, tools and components leave behind files and other telltale fingerprints as a matter of course. There is one limitation though; this approach cannot detect when an application is modified or extended through IL manipulation or injection. And that’s exactly what we do.

From Build to Bill’ed (new numbers and how)

As I like to say, my ideas only have to be good, they don’t have to be original (trademark and patent laws not withstanding) and so I did what I often do when confronted with a conundrum – I asked Bill Leach, our CTO, for help. He quickly (dare I say magically?) authored our own “marketplace crawler” that populated our own XAP repository. Rather than look at XAP contents at a component level, he wrote some code that examined the binaries themselves.

The first pass looked for the custom attribute DotfuscatorAttribute inside the binaries. This is a good way (but not an absolute way) to determine if a file has been processed by Dotfuscator (for either obfuscation or injection of analytics). It’s not infallible because developers can remove that attribute if they chose (to further cloak the fact that they have used Dotfuscator). Here is what we found:

We downloaded 26,159 XAP files and 14.5% to have been processed by Dotfuscator.

This is basically 5X as many apps as Justin’s analysis had found (and that does not include the developers who configured Dotfuscator to remove the attribute we were searching for – so the number is certainly a bit higher).

In fact, we were surprised that Justin had found any at all – where did his 3% come from? Upon inspection, we think it’s an unexpected side-effect of how XAP’s are assembled – there are some instances where the configuration file of Dotfuscator gets pulled into the XAP – this is unnecessary and should never happen. We will document this behavior and make sure that users know how to prevent this from happening. In short, his 3% showed the prevalence of a bug – not the use of Dotfuscator.

To determine if an application was instrumented (rather than obfuscated), we applied some heuristics that are less obvious but can be shared if someone is interested (we looked for the existence of some high-level classes).

2.6% of marketplace apps are instrumented.

From my perspective, this is a low number – but to put it in perspective (or let’s be honest – I’m looking for the silver lining) we have a larger share than Google Analytics and Admob but a slightly lower number than Flurry.

Attack of the clones

Just one more point to be made in this post. If one were to consider each family of cloned apps as essentially a single, re-skinned app – these numbers have the potential to change materially. We may take a look at that, but I think we have already gotten most of what we can from the static analysis of the marketplace.

So – is that the whole story? (Of course not)

Don’t give me (just) static

As interesting as the static analysis of the WP7 marketplace is (and it is), static analysis only gives us a backwards facing snapshot of what’s already been deployed. We get no insight into:

Best practices that we would want to replicate (which are different that common practices),
Developer motivations behind their development choices
Future trends especially when driven by new technology and market opportunities

In the context of Dotfuscator and Runtime Intelligence, I would want to know

If the developers who built the 14.5% of “Dotfuscator processed” apps leaders or laggards?
Do they have special requirements that set them apart?
In short, do they have anything to teach the rest of us?

Want to know more about the 14.5% apps and what they have to teach us?

Coming soon, WP7 Developer Survey Results. We’ve been running surveys since the WP7 launch last year (you can checkout survey 1 and survey 2). As part of this ongoing effort, we have just closed out our third survey in the series and I will be posting results in the next few days – stay tuned!

SCHNEL! Or why patience is a virtue except when testing on Windows Phone

2011-08-20T17:14:00.017-04:00

Mystery solved! As I had promised in my last blog entry, I added exception reporting to my two apps, A Pose for That and Yoga-pedia to determine exactly what was going on with the exceptions that the Microsoft Marketplace was reporting but I had never seen. I needed to know:

The cause of the exceptions (the stack traces were too cryptic for me to figure out)
How to fix the problem(s)
Solve the mystery as to why I have never seen a crash even though there is little doubt that they are indeed happening out there in the wild. If I can’t be confident that my testing is complete, I can never be confident that my app will behave when in matters most – in production.

Remember these three objectives because you will be tested later.

Now, I know that my entries are sometimes kind of long – so here are the conclusions…. And if you want to know how I back them up – then (hopefully) you will enjoy the rest of the post.

(PLUS, there’s a teaser at the very end).

Conclusions:

Always account for “loss of context” in WP7 apps – probably the try-catch is the best approach but I will defer to “real developers” for the specific strategy. At least with Silverlight, impatient users can always force your app into an invalidOperationException.
Culture matters in both user preferences and user expectations (and therefore user satisfaction). If at all possible, represent all relevant cultures in your test populations. How do you know what the relevant populations are? Analytics of course…
Software quality, user experience and user profile are all intimately connected. Systems that only monitor user behavior (marketing) or only profile software stability (debugging) or only profile runtime configurations (marketplaces) are inherently weaker than an approach that accounts for the influence that each has on the others.
Without Runtime Intelligence (or another comparable application analytics solution), no development team can be confident in either the quality of their app or their users’ experience.

And here’s the how and why I have come to these conclusions…

HOW – first I had to add my own exception reporting.

Exception Reporting: Adding exception reporting with Runtime Intelligence is very simple. All I had to do was add one exception reporting attribute as follows (from within Dotfuscator for Windows Phone)

Note that in the properties of this attribute I am asking that the method ExceptionExtendedData method be run. A Runtime Intelligence system probe attribute works fine during normal operations, but if I want custom data after an unhandled exception, this is a more reliable technique. Here is the method that I put in the App class:

As a side note, if I wanted to track thrown exceptions or handled, I could place the exception attribute down at the method level to get much more targeted data. Anyhow, after this simple step, I deployed the re-instrumented app to the marketplace and (sadly) watched the exceptions roll in…

Runtime Intelligence Exception reporting
Logging into my Runtime Intelligence portal account and selecting the date range I was interested in and then selecting “Exceptions”, presents me with the following:

I can see the total exceptions over time; the type of exceptions (I am only getting one – and that seems like it might be good news) and I have a list of all of the specific exceptions on the right. Clicking on any one of these shows me the detail as follows:

The graphic above shows screen captures from three different stack traces.

Good news item 1 is that (unlike the marketplace stack traces), I can see the diagnostic message. This may not mean much to the serious developers who enjoy offsets and cryptic traces – but I need these to go back to MSDN and other resources to see what is really going on and what I can do about them.

It turns out that there were seven different exceptions coming from my app – BUT ALL OF THEM HAD TO DO WITH TIMING – not some error in my general logic (in other words, I’m not dividing by zero or trying to display a non-existent image, etc.). For some reason my app is getting vertigo in my customers’ hands and losing track of what page was current resulting in any number of “InvalidOperationException.”

Good new item 2 is that there is a pretty standard way to manage this behavior; the try-catch statement. I’m in no position to explain how this works, but visit the link above for a great explanation.

So with basic Runtime Intelligence exception reporting I have addressed my first two requirements; to diagnose my app’s problem and identify a fix. BUT – I have not addressed the deeper and perhaps more troubling issue of why I have never seen this problem myself – what’s this all about? If I can’t improve my quality control, I can never feel comfortable that my app will perform in the wild as it does for me.

Good new item 3 is that I have Runtime Intelligence to give me EVEN MORE context on my app and my users. The fundamental flaw in almost every exception handling solution I have ever seen is that they (by necessity) can only look at the app when exceptions occur – they are too heavy-weight and/or too invasive to run all the time everywhere – no so with Runtime Intelligence.

If you ONLY have exception data, you are robbed of one of the most effective diagnostic heuristics available – the process of comparing populations in order to identify material differences between them and thus leading to a likely root cause. This is the fastest and cheapest way to figure out why I had never seen a crash.

What I did next was to compare the set of users who experienced exceptions with the general population of users and myself – was there something specific about their phones? Their software? Their behavior?

It turns out that the answers to these three questions are no, no and YES!

Process of elimination: First, I compared the system data of exception users and phone with the general population as defined in ExceptionExtendedData defined above… I won’t bore you with all of the metrics I was able to eliminate, but I will show one; manufacturer.

The two pie charts show the relative percentages of manufacturers in the general population of my users with the population that had exceptions – one can eyeball these and pretty quickly see that there is virtually no difference. The bar chart puts a fine point on this by showing the relative difference in share; Dell had only 1% of the total share and was not statistically significant – looking at the other three manufacturers, we can see that there is no more than a 20% variance between the two populations. This kind of range was consistent across all of the metrics I had been collecting except one.

Schnel!

In my last blog I had noted that there had appeared to be a disproportionate percentage of German speaking users in the exception population and it turns out that this was not a random blip – it showed up again in this latest exception data as follows:

The top bar chart shows the relative percentage of users by culture that experienced exceptions alongside the relative percentage of that culture in the general population. The second bar chart shows the relative difference in share by culture and it is truly surprising (at least to me).

Germans crashed my app 13X more often than norm, Austrians and the Dutch crashed the apps 4X what their relative share would suggest with the Malaysians right behind.

Given the relative distance between these populations and the different carriers and jurisdictions that these populations live under, it seems pretty clear that what these users have in common is their behavior. These users are simply more impatient than the rest of my users. They hit the “show pose” or “take me to the marketplace” or whatever more quickly and more often and so they are that much more likely to cause my app to lose its place.

Not only am I more patient (being an American and at one with the universe ;), but because I know my app and the areas where it may take a beat (or two) to respond – I naturally did not repeat my commands impatiently at those critical times – and therefore, I did not crash my app! Mysteries solved!

Conclusions: (AGAIN)

Always account for “loss of context” in WP7 apps – probably the try-catch is the best approach but I will defer to “real developers” for the specific strategy. At least with Silverlight, impatient users can always force your app into an invalidOperationException.
Culture matters in both user preferences and user expectations (and therefore user satisfaction). If at all possible, represent all relevant cultures in your test populations. How do you know what the relevant populations are? Analytics of course…
Software quality, user experience and user profile are all intimately connected. Systems that only monitor user behavior (marketing) or only profile software stability (debugging) or only profile runtime configurations (marketplaces) are inherently weaker than an approach that accounts for the influence that each has on the others.
Without Runtime Intelligence (or another comparable application analytics solution), no development team can be confident in either the quality of their app or their users’ experience.

TEASER – WOULDN’T BE AWESOME IF WE COULD DO ALL OF THIS PROFILING AND EXCEPTION ANALYSIS WITH HTML5/JAVASCRIPT TOO? STAY TUNED (IN)!

The new WP7 App Hub reporting is great – and it’s even better with analytics!

2011-07-19T16:26:00.013-04:00

Warning – this is a cliff hanger post. If you don’t like mysteries, come back in two weeks…

Like anyone else who has an app inside the WP7 App Marketplace, I noticed that the App Hub was down most of yesterday with the promise of a functional upgrade in the works – and today I was very pleasantly surprised to see the result; a streamlined experience with expanded capabilities.

One of the first things that caught my attention was the exception reporting by app and by date; very useful indeed. Of course, MSFT is quick to point out that (and I quote) “Crash count alone isn’t a direct measure of app quality. Popular apps may have higher crash counts due to higher usage.”

Well that seems self-evident, but without usage metrics how can I evaluate the severity of my exception report counts? …. (and now, unless this is the first post of mine that you have ever read, you must know what’s coming).

To the cloud! (Sorry, I couldn’t resist). Using Runtime Intelligence for Windows Phone, I’m able to measure total sessions – by extracting these counts by day and mashing it up with exception counts from the marketplace – I can now supply the missing ingredient to make the exception count on the App Hub meaningful. (NOTE – I had to manually transcribe exception counts from the App Hub as there is no tabular option and the detailed download drops the daily count as it de-dupes the exceptions).

The App Hub is careful to point out that only apps running NODO (or Mango) can report exceptions, so I first had to remove the Runtime Intelligence session data coming from earlier versions of WP7 (an interesting statistic on its own).

Here is what I see… (and a warning here – the numbers aren’t pretty)

I took two apps of mine; Yoga-pedia and A Pose for That and looked at their respective usage on NODO+ phones via Runtime Intelligence and exception reports from the App Hub and then calculated the ratio of sessions to exceptions.

The time period I used for this test was the two weeks from June 12 to June 25. During that time, this is what I observed:

66% of A Pose for That sessions were run on NODO.
58% of Yoga-pedia sessions were run on NODO.

Here is the ratio of exceptions reported by MSFT and sessions from Runtime Intelligence… (click to enlarge)

Ratio of session counts and exception counts by day

Now there are three likely scenarios here.

Over this two week period, both apps were crashing every 1 in 10 times they were run (HORRIBLE). I don’t think this is the case because I have run these apps myself on multiple phones hundreds of times and they have NEVER crashed.
The App Hub is over-reporting exceptions (or somehow incorrectly associating exceptions with these apps). This is a beta feature on the App Hub – it’s certainly possible.
Runtime Intelligence is way under-reporting the total number of sessions in a given day. Certainly possible, but given the unit testing I have done, I don’t see this as being a major contributing factor to these ratios – but certainly a possibility.

Now, I had already put a “feature tick” on the default unhandled exception handler to count how many times it was invoked during this same period. The counts I have are well below the App Hub numbers (which might suggest number 2 above is the culprit – BUT NOT SO FAST). It is more than likely that certain exceptions (perhaps a majority) would interrupt the normal feature tracking transmission mechanism so I would expect that count from Runtime Intelligence to be artificially LOW.

As is often the case when managing an application "in the wild", an unanticipated question has arisen and I find that I don’t have enough data. That’s why its ALWAYS so important to

plan in advance what data is worth collecting to minimize the likelihood that you will end up in this situation and
be sure that your analytic solution supports rapid and easy iterations and refinements to compensate for when your planning falls short.

So how am I going to determine if

my apps offer a LOUSY customer experience everywhere except for my personal phones or
one or both exception reporting counts and session tracking counts are flawed?

Easy - I’m going to post an update of my apps to the marketplace this weekend with Runtime Intelligence Exception reporting turned on. What?

Runtime Intelligence for Windows Phone includes its own exception tracking capabilities – it does require that the developer activate it (that’s why I don’t have that data now), but it offers a lot more data and it can be invoked for unhandled, handled, and thrown exceptions. Further, it can be configured to collect additional information (custom for the app), AND it can be extended to offer the user a dialogue to provide additional feedback if they like.

I will post my results over the next few weeks – meanwhile, if anyone has any suggestions or ideas – please let me know… I honestly have no idea how this little mystery will play itself out.

Before I sign off – here is one more tantalizing clue (although it may also be a red herring). When I look at the limited unhandled exception data currently being returned by Runtime Intelligence (I can see tower location, device manufacturer, OS, etc.), I see that well over 50% of the phones that had an exception were localized to a language OTHER THAN en-US – and that is way out of proportion to the actual usage trends that I have been tracking (and posted in earlier entries). Further, the localizations that had the greatest “disproportionate” number of unhandled exceptions were de-DE and de-AT. Coincidence? Conspiracy? We don’t need to guess – we will soon have the facts!

PS here are two links that may be of interest:

A developer survey (PDF) we did last year on exception reporting and developer best practices…
An article in this month's (July) Visual Studio Magazine on application analytics in the development process.

Enjoy!

A Webinar on Monetizing Mobile Apps with Analytics

2011-06-25T15:46:00.007-04:00

For those who want a little more detail on the specific coding steps as well as an update on the latest application of analytics to mobile app development, we've scheduled a webinar. Here's the info..... (the first timeslot of 100 filled up in a few hours - so this is a later date. We'll keep scheduling these as long as interest is there) Cheers.

Title: Monetize Mobile Apps with Analytics (August 4th at 11:30 EDT)
Registration: https://www3.gotomeeting.com/register/676857398

Description: In this 60 minute webinar, we will take a live WP7 app and use real-world analytics to illustrate:

The impact of try/buy scenarios on paid apps
The relationship between free and paid versions of an app
Strategies for ad-driven app design that consider page location, first time, occasional, and power user patterns, cultural trends, and other demographics including carrier and model profiling.

Preparation: NONE required. However, attendees are likely to get more from the presentation if they have already:
• Installed and are familiar with the Microsoft Windows Phone 7 development tools
• Installed and have some familiarity with PreEmptive Solutions Runtime Intelligence
• Installed and navigated around the free SKU of the sample application that will be referenced in the presentation. The free app is Yoga-pedia.

Improving Ad performance: Correlating ad activity with feature usage and user behavior

2011-06-24T11:30:00.039-04:00

In this third installment on application analytics patterns and practices I’m going to focus on how Runtime Intelligence can be used to shed light on Ad activity within the context of one or more applications. While the use cases covered here are nowhere near exhaustive, I’m going to show how to answer the following questions (and hopefully give some indication as to why you may care about the answers):

What are ad impression volumes across multiple apps?
What are the click-through rates (the ratio of users clicking on ads to the volume of impressions) across various pivots?
What influence does culture (country of origin) have on click-through rates, e.g. are Germans more or less likely to click on ads versus Italians?
What carriers/ISP providers are giving me the most business, e.g. where are my users most likely to be found?
Where are users spending most of their time inside an app? Does that usage pattern correlate with a user’s likelihood of clicking on an ad?
Do returning users interact with ads differently than first time users or power users?

Many of these metrics are valuable in scenarios other than ad effectiveness of course (knowing where users spend their time and understanding how power users behave are two obvious examples), but for this installment, I am going to focus exclusively on how Ad interaction can be viewed across these metrics.

Implementation
I'm using the same trusty one line method WhatPoseWhen that I described in the first installment – this time, I call the method on the New Ad event (to count impressions) and the Ad Engaged event (to count clicks on ads). I could just as easily collect data on any other ad-related event and grab any data that is available to the program at that point in its execution as well. Here is the code for that method in its entirety:

private void WhatPoseWhen (string page, string selection)
{ return; }

The first parameter tells me from which page the method is being called and the second parameter tells me why I might care, e.g. was a new ad displayed, etc.)

I pass the page name and the ad event into WhatPoseWhen and Runtime Intelligence grabs these parameters and sends them up to the repository (no programming for this). I can then correlate the ad activity within the context of sessions, feature usage, and runtime stack data that I am getting as a part of runtime intelligence.

For these metrics, I export my CSV data into a regular excel spreadsheet and then generate the pivot tables shown below.

App background
I always like to use data from true production apps rather than fabricate data sets; I am using two apps that I wrote and launched on the marketplace that are both ad driven, Yoga-pedia and A Free WPC Yogi – the former is a free version of a yoga app that (hopefully) helps to drive sales of a for an upgrade to A Pose for That. A Free WPC Yogi plays a similar role for The WPC Yogi, a tailored version of A Pose for That targeting WPC 2011 attendees.

The following post uses their Ad activity over the same one week period.

Impression counts
The following pie chart shows the “new ad” event count by application. As you can see, Yoga-pedia has roughly 4X the number of ad impressions and given the fact that these apps are very similar (but not identical) in their behavior, this also roughly correlates to the volume of usage as well.

Click-through rates
However, when I divide the total number of “ad engaged” events by the total number of “new ads,” I see that A Free WPC Yogi has a 28% higher click-through rate (1.78% versus 1.37). In point of fact the demographics of the app users are quite different (randomized consumers versus MSFT partners who are attending WPC 2011).

Advantage: This intelligence helps to segment users by differences in their behavior and to do a better job of targeting those differences across apps.

Impressions by country (or culture)
Runtime Intelligence can grab the IP address of the sending tower – this is not personally identifiable and cannot be used to locate an individual with any precision – but it is more than adequate to identify country, state, and city. In the following graph, I simply count new ad events by country and show the top 10 countries by impression volume.

Advantage: If your app has a cultural bias that would benefit from localization, understanding where your users are can help prioritize those localization efforts.

Click-through rates by country (or culture)
The following bar chart calculates the click-through rates for the top 10 countries listed above. What is interesting here is that there appears to be a significant difference in click through rates by country (culture).

Advantage: Understanding when/if users from specific cultures are significantly more likely to respond to (click on) ads can further help to prioritize localization or marketing investments.

Impressions by ISP provider (top 25)
To produce the next graph, I used an application to tell me who owned the IP addresses that my mobile clients are using (I used IP2Location – but there are many of them out there).

This is a nice way to see who my users favor in terms of their carrier. Here I only show the top 25.

Advantage: Understanding carrier popularity will help focus business development/marketing efforts and better manage potential risks associated with how your users may be negatively impacted by upgrade schedules (delays). Will your next app be dependent upon Mango?

Sessions per app page
In the raw CSV files that can be exported from the Runtime Intelligence portal, there is a column, ApplicationGroupId. The value in this column is unique for all signals (messages) that are sent from within a single app session. In other words, I can use this field to organize all user activity into the relative user sessions using this field. This is helpful for plotting specific user patterns.

The following graph simply counts the unique occurrences of ApplicationGroupId values by page name value (recall that this is the first parameter of the WhatPoseWhen method). This avoids counting multiple views of a single page within a single session and tells me how popular specific pages are across my user base. For this posting and for illustration, I’m only showing data for five specific pages.

FindAPoseDetail and BrowseSelectPose are central to the user experience (browsing for yoga poses and then drilling into a specific pose for detailed imagery and instruction). TellMeMore is the page where I describe what comes with the paid version of the app (nice to see that 10% of my users deliberately choose to investigate the upgrade possibility) and AppGuide and TopicList are essentially app documentation and I can see that these pages are not hit very often – and that’s not a bad thing – users should not need to use the documentation after their first use.

So – this graph is telling me that

a) My users are spending their time using the app rather than trying to use the app
b) I am at least getting my user’s attention regarding a possible upgrade – perhaps my content is not compelling enough if my conversion rate does not correlate.

Advantage: broad user proofing can be used to validate developer assumptions about user experience and effectiveness of pages for their specific purpose.

Ads shown per page compared to volume of times viewed
Next I calculate the average number of ads shows per page by dividing the total count of New Ad messages by page (this combines the two parameters, page name and the even New Ad) by the total count of the times the page is shown. TOTAL ADS SHOWN PER PAGE / TOTAL TIMES PAGE VISITED

I use the same ad duration interval across all of my pages – so this is actually another means of calculating how much time my users are spending on each page (this can be done with Runtime Intelligence alone, but in this case, I don’t have to do that).

The graph below shows the average number of ads shown per page and maps them to where they rank in terms of how often the page is visited.

Happily, the two core pages of my app also get the most ads (and are also where my users are stopping to spend time). I can also see that users spend more time on detailed pose descriptions than they do browsing – even though the browse more often than they drill down (which makes perfect sense).

Sadly, my upsell page is getting the least love – I definitely have to work on making this page more engaging.

Advantage: Ad frequency by page provides insight into where users spend their time. Calculating click-through rates by page identifies where users stop to look around and may be most open to suggestion.

Returning users and sessions per user
Another column in the CSV extract is the ANID – this is either the result of hashing the true ANID from a user’s phone (it is not the actual ANID value), or, if they opt-out of that, it will contain a GUID generated by our software and written to isolated storage. In either case, this value acts as a unique user identifier.

The ANID can be used to identify new and returning users. Dividing session count (ApplicationGroupId) by ANID gives the average number of sessions per user. The following bar chart takes the 10 ANIDs with the highest session counts and compares the resulting sessions per user value to the rest of the user base (whose count is roughly 500 other users).

What I see is that there is a core group of users that are heavily using my apps (YAY!). Now that I know who they are, I can zero in on their specific behaviors, how they relate to my ads, what features they use most heavily, etc.

Advantage: Segmenting users into new, returning, and power categories dramatically improves a developer’s ability to target, prioritize, and validate development, marketing, and support activities.

Conclusion

I hope to have shown how using Runtime Intelligence, developers can materially improve their ability to build more effective applications and refine their advertising strategy while coordinating that strategy with complimentary upsell strategies as well.

Advantage: Development!

Increasing App sales with Analytics: Free apps versus trials

2011-06-14T12:44:00.014-04:00

In my previous entry I introduced my app, A Pose for That, explained how I had instrumented my app with Runtime Intelligence to better track user experience and behavior. As a case in point, I illustrated how strategically placing upgrade opportunities in various locations inside my trial version, I was able to increase my conversion rates – perhaps by as much as 50%!

HOWEVER, when I was at MIX11, a very experienced developer (let’s call him David because that’s actually his name) told me that he had already established the optimal app blend to maximize revenue – it was to have a free app (not a trial version) that also offered ways to upgrade to the premium app. He pointed out that trial apps do not show up as free in the marketplace and are therefore almost always overlooked by most casual marketplace browsers. A free app gets the eyeballs that a trial misses.

For those who know me, they know one of my core principles is that my ideas never have to be original, they only have to be good – so is David’s idea really a good one?

To test it out, I created Yoga-pedia, a free app that included the browsing capabilities of A Pose for That with good imagery and instruction, but did not include the pairing of poses to real-world situations (a feature I believe is valuable) or flows (the stringing together of multiple poses). On the welcome page (and one or two other places) I give users a chance to learn more about our software and upgrade; Here is the welcome page and the “tell me more about why I should upgrade page.”

I instrumented the various points where users can upgrade in both the trial and the free app so that I can compare BOTH the usage levels of the two apps AND the upgrade requests that stem from that usage. So… let’s go to the video tape – or better yet, Runtime Intelligence. (Note – these specific graphs are built by extracting the data from the runtime intelligence repository into a spreadsheet and then generating a simply pivot table).

By looking at application starts (not downloads in the marketplace sense of the word), the graph showing App Runs seems to support David’s logic; my free version, Yoga-Pedia, takes off like a rocket and within 24 hours eclipses trial activity in dramatic fashion. …but, it also seems to be cannibalizing trial activity too – Should I care? (NOTE – I am combining usage of multiple applications – not always easy to do with canned dashboards)

I probably should care IF users are more likely to upgrade from A Pose for That trials versus from Yoga-pedia. In other words, are my sales going up because of the free app even though it is depressing my trial volume? Let’s go to Runtime Intelligence one more time…

What the graph above shows is that upgrades from my trials also decreased dramatically with the launch of Yoga-pedia, BUT the volume of upgrade requests from within Yoga-pedia more than made up for that shortfall. (NOTE – I am combining feature usage across multiple applications – not always easy to do with canned dashboards)

In the one week where both the free and the trial versions lived side-by-side, the free version generated 86% of the upgrades.

More important is the bottom line: I saw an 85% increase in the total number of upgrades when I had the combination of both a free and trial version of my app available.

Coming up next (I promise this time) will be a discussion of the last leg of David’s magic formula for success – making your free version ad-driven. What will Runtime Intelligence be able to tell us about that?

Implementing Customer Feedback Forms AND fine tuning try/buy strategies with Runtime Intelligence

2011-06-08T12:35:00.010-04:00

My Adventures in WP7 App Development: a beginner’s tale

I deployed my first WP7 app to the marketplace on May 13th. Prior to that, I had not written a line of code in nearly 20 years and so I think I can safely call myself a beginner. The fact that I might actually have something to share with the broader (and almost universally more experienced) development community shows how effective development tools have become and how wide-open the smartphone market is at this point in history.

My app (A Pose for That and the free alternative Yoga-pedia) pairs user situations and ailments with yoga poses – the app essentially uses the smartphone as an intelligent, just-in-time publishing platform.

USER SURVEY DATA TRANSPORT, MANAGEMENT, AND REPORTING

One of the capabilities I wanted to include in the app was a simple user survey form – I wanted to know how often users practiced yoga on their own and whether they hoped that this app would increase or improve their yoga practice – but I didn’t want to ask users to write an email (too much effort for them) and I did not want to incur the extra programming, setup, and expense of implementing my own content management store (too much effort for me).

Here’s what I did, for free, and with (virtually) no programming whatsoever…

I used Expression Blend to build my form (no programming), Dotfuscator for Windows Phone to inject the data collection transport logic (no programming), and the Runtime Intelligence Service for Windows Phone to store, manage, and publish user responses (again, no programming). I had to write one method (one that I actually reuse in a variety of ways including try/buy strategy tuning and ad monitoring that I will blog more on later).

That method (in its entirety) is:

private void WhatPoseWhen (string page, string selection)
{ return; }

…but I am getting ahead of myself. Here is a screen shot of the survey form:

It asks my two basic questions with two 3-way radio buttons to indicate true, false, or no comment. When the user leaves this page for any reason other than a tombstone event, I construct a single string that captures the user’s response. For example, if the user answered in the affirmative on both counts, the app assembles the string “I practice yoga 2X per week or more And I hope that this app will increase and/or improve my practice.” and puts it in a local variable UserFeedBack. If answer in the negative, I just assign the string “And.” Then, I call my custom method (above) like so:

WhatPoseWhen("feedback", UserFeedBack);

That’s it for my coding – I just build the app.

Now, I go to Dotfuscator for Windows Phone. It takes about 3 minutes to register for the service at www.preemptive.com/windowsphone7 (fill out the form at the bottom of the page) and another 5-10 minutes to point Dotfuscator to the XAP file in question, exclude third party assemblies (in my case, Telerik’s WP7 controls used elsewhere in my app), and tag the entry and exit points of my app inside the Dotfuscator UI.

The last step required to complete my user feedback form and service is to add one attribute for Dotfuscator, a feature attribute as follows:

I right-clicked on the method WhatPoseWhen (in the left pane) and selected Add Feature Attribute – all I needed to type into the form on the right-hand side of the screen was a name for the feature (WhatPoseWhen) and insert an * in the ExtendedKeyMethodArguments property. This tells Dotfuscator to grab any/all parameter values passed into this method whenever it is called and send it up to the Runtime Intelligence portal. In this case, I am identifying the context (feedback) and passing the string that I constructed based upon their responses inside the variable UserFeedBack.

This takes 2 minutes tops to configure and then I press the “build” button and out pops my new and enhanced XAP file. I submitted my app to the marketplace with no special handling required and then waiting for the numbers to roll in. This takes days between marketplace processing, user adoption, and Runtime Intelligence number crunching. Days is still much faster than the weekly marketplace statistics and obviously much more flexible but slower than the ad-server stats – it’s right in the middle.

The results can be seen (in part) in this screen capture – I can log into my Runtime Intelligence account and select custom data to see the following (note - alternatively, I can extract CSV files for further analysis)

The highlighted row “page” and “feedback” shows that 24 users went to the feedback page during the selected interval (I scratched out the actual interval because of the sales numbers that are reflected here too - it’s none of yur beeswax). In the last row shown here (also highlighted) you can see that of the 24 page views, 16 of these users indicated that they did NOT practice 2X per week and they did NOT expect this app to change that. (the more positive responses can be seen lower down on the page but are not shown here).

The bottom line is that I was able to implement a user survey mechanism including secure transmission, storage, and basic analysis with essentially no programming and no requirement to setup a hosted content management system - ALL IN LESS THAN AN HOUR.

FINE TUNING TRY/BUY STRATEGIES

I also call my trusty little method WhatPoseWhen throughout the app during trial periods. The screen capture above also shows basic try/buy behaviors. A Pose for That implements a Try/Buy mechanism. If a user is in Trial mode, they are presented with an opportunity to upgrade right on the main page of the app. That is the “UpgradeNow” option. Additionally, whenever a user selects functionality that is NOT included in the trial (say showing a large image of a pose with detailed instructions), they are presented with a screen letting them know that they have bumped up against the limits of the trial version and would they like to upgrade right then and there – more of an impulse upgrade.

What the screen capture above is telling me is the following:

1) Users were presented with the “impulse upgrade” option inside a trial 130 times during the selected time interval.

2) When presented with this choice, users chose to NOT upgrade and return to the previous page 111 times (or 85% of the time the said thanks but no thanks). However, it also shows that 19 times (15% of the time) they DID choose to upgrade on the spot.

3) During the same interval, 38 users selected the “Upgrade Now” button on the main page.

I have not chosen to do true A/B testing in this case, but one thing that I am almost certain about is that some of the 19 users who upgraded “inside” the app would NOT have gone back to the main page at a later time and upgraded via the standard menu choice.

My two-pronged upgrade pattern may have increased my conversion counts during this interval from 38 to 57 or an increase of 51%!

Using the CSV extracts, I can dive deeper to see what features are more likely to result in an upgrade and also get a sense of how much is too much, e.g. users that abandon the app and never come back. (Note, I am not EVER transmitting ANID or other PIID information).

COMING UP NEXT: USING RUNTIME INTELLIGENCE TO TRACK AND OPTIMIZE AD PLACEMENT STRATEGIES

It takes an ecosystem

2011-05-13T13:33:00.009-04:00

This is my simple tale of how two people with an idea and no programming skills conceived, developed and launched a smartphone app in just a few weeks’ time. …And how it would never have happened without development tools AND PEOPLE committed to helping others express themselves through code. Here goes…

My wife is a spectacular yoga teacher – and, in support of that, I have from time to time worked with her to produce DVD’s – typically planned to ship around her birthday, May 8 (you can see a sample of our handiwork on Amazon at Introduction to Qi-Yoga).

We had a lot of fun working on these and, while sales were modest, they were global and the reviews were universally positive – given the fact that I knew nothing at all about video/sound editing/production before our first project – we were happy with our results.

None of this would have been possible without the help of Apple who, with their FinalCut tools, broke the back of high-end (expensive, complex) video editing workstation vendors (like Avid). Apple made it possible for non-professionals (like me) to produce professional video content.

…but DVD’s are so 2008 – smartphones are where it’s at now – right?

My wife agreed - the world needed a yoga App for that!

And given Apple’s dominance of the smartphone market, this should be a snap – right?

Sadly, that proved to be very very wrong.

It turns out that Apple does not love the development world in the same way that they loved the design world. Ironically, Apple is actually the “Avid” of smartphone development. In point of fact, it’s been Microsoft that’s been having a long term love affair with development all these years…

…Enter Windows Phone 7.

A little over a month ago, I approached my wife with the idea for developing a yoga app that does more than push content – we wanted one that actually paired poses with everyday situations and delivered just the right amount of information at just the right time. She loved the idea and we went to work – she developed the knowledgebase and I was tasked with writing the code – but the fly in the ointment was that I had not written a line of code in over 20 years (and trust me, comparing 80’s programming tools to today’s is like comparing a cassette tape player to a MP3 player) – I was now an absolute beginner.

The only advantage that I had was that I was aware of the software, training, and social resources that Microsoft and their partners were pushing. Here is how we did it… (to be clear – I have made NO attempt to build a comprehensive list of WP7 resources – there are lots of those out there – the following are the specific steps and resources that I used. )

1) Download the development tools from Microsoft and join the App Hub. Go to http://create.msdn.com/en-US/

2) Download analytics from PreEmptive Solutions. Go to http://www.preemptive.com/windowsphone7.html

3) I signed up for a promotion from Telerik to get their controls for free. Their components were awesome and the support was fantastic (meaning patient with me). Go to http://www.telerik.com/products/windows-phone/getting-started/user-groups.aspx

Then I had to get started…. Remember, I had no C# or .NET development skills – so I began with

4) Windows Phone 7 Development for Absolute Beginners. http://channel9.msdn.com/Series/Windows-Phone-7-Development-for-Absolute-Beginners

While I did not go back to these videos once I got rolling (video is just too slow to navigate around), these were essential to getting me started.

5) The following specific links include lots of sample code and all levels of instruction (from step-by-step to technical reference manual level) – the ability to be spoon-fed and then drill down when you need a specific piece of detail is what made it possible for me to avoid having to learn what professional developers have to learn.

* Building a Windows Phone 7 Application from Start to Finish http://msdn.microsoft.com/en-us/library/gg680270(v=PandP.11).aspx?ppud=4

* MSDN Blogs > Silverlight SDK http://blogs.msdn.com/b/silverlight_sdk/

* The APP HUB blogs, community and resources http://create.msdn.com/en-US/

* Binary WasteLand materials on CSHARP and WP7 http://binarywasteland.com/category/programming/languages/csharp/

Where am I now?

I built and tested my app and submitted it to the Marketplace on May 10. On May 12th, my app officially hit the Microsoft Marketplace (it hasn’t even been 24 hours yet).

If you have a Windows Phone - check out A Pose for That now.

Now comes the next question – when it came to our DVD’s, Apple did nothing to help us promote our video – they only made it possible to produce it. I will be writing more to cover what works (and what doesn’t) when it comes to marketing a WP7 app.

The ecosystem is more than a platform and more than “a village” – It’s both

Before I end my tale, I must shout out to the people who helped us along the way (I am not giving full names since I have not asked permission). Everyone here helped me on their own time just because they are passionate about the platform. They were David and Bill from PreEmptive, Valio from Telerik, David from Wirestone, Pierre from VinoMatch, and Gergely from Cocktail flow. Their shared tribal knowledge shortened this project and improved the result - of course, I take full responsibility for all mistakes and hacks.

Microsoft has long understood the value of a development ecosystem, but I don’t think even they would have predicted how transformational a development-centered approach could become with the emergence of the smartphone. I know that there are lots of factors going into the success or failure of Windows Phone 7, but the value of Microsoft’s focus on helping non-professional developers produce professional-grade code cannot be overstated.

My wife and I already have our product roadmap down – there’s a lot more to come - look out!

Privacy and Security: if it’s your app, then it’s your @$$

2011-03-14T17:06:00.024-04:00

This is the first of a continuing series to help smartphone app developers make more informed design, development, and policy decisions. The objective is to raise material issues, options, and risks specific to mobile app development (but not to give legal advice).

Specific topics to come include;

PII: what definitions are out there and which ones can you not afford to ignore?
Opt-in Opt-out: what should your defaults be? How often must you ask? Do you need separate opt-ins per app? Per app version? For regular use AND exception reporting?
Data retention and reuse: do you own your own data? Do you need to care about partner data policies or only your own?
App hardening: what risks stem from app reverse engineering and/or tampering? How do you know if you should care?

This first entry will delve into the broader motivations behind this series and call out aspects of the mobile app development experience that set it apart from other platforms and markets.

It’s impossible to guarantee that an app will never do harm

Evolving technologies, emerging and divergent regulations, and evolving social and ethical mores have made it is simply impossible to define a concise, bullet-proof set of policies and development patterns that are guaranteed to do no harm to either user or developer. Effective risk management must, by necessity, be a practice governed, to a significant degree, by subjective guidelines.

When god wants to punish you, He answers your prayers

It’s no secret; the convergence of technical, social, economic, and market forces that we call “the smartphone” is a mega-opportunity for those who “get it right.” And what’s greasing the skids speeding this disruptive force of change? Apps of course. Apps are on the front-line hooking consumers and driving the smartphone revolution – pretty cool right? Most definitely.

Swimming in deep waters is always cool, but sometimes it can be deadly too.

The most powerful corporations, the smartest entrepreneurs, and the crème de la crème of investors are racing to meet exploding smartphone demand. And when that much money, information, and power are on the move, criminals (of all kinds), lawyers, regulators, law enforcement, and all genus of government will be right there with us.

These are deep waters indeed.

To serve an app: Is it a cookbook?
Do app developers need to care about this stuff? Consider that when a developer ships their first phone app, they will most likely have already entered into as many as five different (and almost certainly contradictory) binding legal agreements that include assignments of personal liability tied to the developer’s privacy policy and their app’s security. Each tool supplier, marketplace owner, platform provider, ad-server provider, and (last but not least) user demands this assurance.

As an app moves across platforms and international borders, the developer’s legal obligations multiply and, as such, so does their material risk.

To be clear, there is nothing inherently wrong or unreasonable here; but it IS unprecedented.

The list of potential concerns grows considerably when one stops to consider ethical considerations (what’s the right thing to do versus the legal thing) on one hand, and the technical/development security requirements on the other.

In order for a developer to ensure that both their users’ and their own interests are being addressed, application design and development priorities must account for operational and contractual requirements (in addition to market-driven feature functionality of course.)

What level of due diligence and development investment is appropriate?

The diversity of the interested parties and the number of governing agreements all covering essentially the same act (running a single app on a phone) make it especially important that the developer understand:

Definitions: For example, do all parties use the same definition for PII (personally identifiable information) and do they use it consistently (when defining the developer’s obligations versus their own)?
Obligations: For example, are you agreeing (and indemnifying the other party) to adhere to multi-national regulations – many of which you will have no knowledge of?
Rights and privileges: For example, what usage and commercial rights to application usage, user behavior, and other data are conveyed? Are these subject to change?
Notifications: Under what conditions, through what channels, and in what timeframes must which information be communicated? Does the developer have different special obligations?

Knowledge management versus risk management
Most people divide the world into things they know and things they don’t and then try to manage their risk within that “circle of knowledge.”

Knowledge management is not risk management and often misses a danger-zone where risk most often hides; in “the things we don’t know that we don’t know” and “the things we think we know, but we don’t.”

If you “don’t know you don’t know”, then you miss the chance to educate yourself or ask for expert advice.

Similarly, if you think you know something, but you’re wrong, you may find yourself exposed or missing an opportunity.

The single-minded objective of this series will be to shrink the “danger zone” for mobile app developers; to make sure that you don’t get bitten by security, regulatory, or social gotcha’s that you didn’t even know were out there.

The take away from today’s installment is a very simple one; if it’s your app that gets jammed up – rest assured; it’s going to be your @$$ on the line.

Survey sez!

2011-02-16T17:45:00.008-05:00

We are deep into two WP7 dev surveys, but I just love this stuff and so I'm going to leak some preliminary data out now – if you want me to send you a link to the final results, send me an email at sebastian at preemptive dot com.

The first survey we are doing goes back to the earliest group of WP7 developers, “first 300,” and asks how they have made out over the past two months.

The second survey targets roughly another 1,500 active wp7 devs who are using analytics and/or obfuscation but who began their work after the initial survey.

Here are a few tidbits that we see so far…

Analytics improves mobile development practices and app value

Going back to the original 300 and asking those who had deployed apps with analytics, we have found that:

82% of the devs say that using Runtime Intelligence (RI) has “helped them to establish for themselves the value of analytics for app development overall”

With regards to their specific WP7 app in the marketplace, the devs directly credited their use of RI as:

Increasing the value of their app (45%)
Improving their app’s user experience (36%)
Improving their app's quality (27%)

Mobile app devs migrating to WP7 4X’s faster than .NET devs

In the first 300, only 4% of the registered developers targeted two or more additional mobile platforms. This indicated to me at least that the very first developers to develop for WP7 were already MSFT devotees versus serious mobile app developers exploring WP7 as an alternative/incremental mobile platform.

However, in the latest wave of developers, that stat has more than quadrupled. There is no question that developers who identify themselves as mobile app developers first rather than iOS, .NET, or Android developers are building for WP7.

Platform share for those developers targeting multiple mobile platforms are (in addition to WP7):

iOS 69%
Android 67%
RIM 23%
Symbian 5%

There’s a lot more to come – so stay tuned (or shoot me an email). Cheers!

Do good while doing well: Build a Windows Phone 7 app and secure a $100 donation for your local user group.

2011-02-15T14:13:00.007-05:00

The only thing better than doing something good is when it also helps you do well – and so when we had the opportunity to join with Telerik, a fantastic ISV (that is also) focused on improving developer and application value, and with Microsoft on a campaign to help developers and their local user group chapters – there was no doubt that we were going to want in.

What’s the deal? Simply put, any developer who develops their own Windows Phone app using both Telerik controls and Runtime Intelligence will:

Have $100 donated to their local user group (that’s doing good), and
Have an app on the marketplace that combines a great user experience with the usage and adoption analytics to prove (and improve) it (that’s doing well).

Of course, nothing can be this simple right? – Wrong! To learn more, visit http://www.telerik.com/windowsphoneFTW

You still here? Not convinced yet? Here are some more details…..

All you need to do is:

Develop and deploy any WP7 application using Telerik RadControls for Windows Phone AND PreEmptive Runtime Intelligence for Windows Phone, AND
Get this done and certified before May 31st 2011

By the way, there is no limit to how many apps you and your user group can submit, but we will only recognize the first 500 qualifying applications – so build early and build often!

Also, needless to say, you are going to have free access to all of the required software. So go on – click through and do some good at http://www.telerik.com/windowsphoneFTW

Want to spread the news? Present at your next user group meeting? Here’s a PPT

Dotfuscator 4.9.6 to Ship February 11

2011-02-09T14:09:00.008-05:00

New features include:

10X performance improvement for Runtime Intelligence messaging on Silverlight and XNA apps (on and off of the phone)
Expanded XAML obfuscation further improves IP protection

For Windows Phone 7 users, perhaps the most significant new feature will be, in fact, an invisible one; V4.9.6 includes a new analytics messaging implementation that offers a 10X performance improvement on the phone with a proportionate improvement in battery life preservation thrown in. This implementation employs a multi-threaded, “batch and send” approach.

If you think your app is at all sensitive to our (or anyone else’s) analytics traffic, I would encourage you to download the new version and retest. If you haven’t downloaded Dotfuscator and Runtime Intelligence for Windows Phone yet, you can get it right now at http://www.preemptive.com/windowsphone7.html

This performance enhancement applies to any Silverlight app - not just WP7 apps. Please note: multi-threaded messaging and caching was already supported on all other .NET applications.

Also included in this release (for apps both on and off of the phone) are incremental enhancements in XAML renaming obfuscation. If you are obfuscating your XAML, Dotfuscator will now provide automatic support (meaning no manual configuration or exclusions) for the renaming of attached properties, dependency properties, routed events, and attached events. This feature applies to Silverlight (WP7 and .NET) and WPF applications.

How do you get the new version? Registered Dotfuscator users with active maintenance (all WP7 developers are automatically included) can simply open their installed version of Dotfuscator and select “Check for Updates Now” under the Help menu. The link provided will step you through a simple upgrade path.

How do you take advantage of the performance improvements? Simply run your app through Dotfuscator again; there are no configuration changes required.

How do you take advantage of the extended XAML renaming capabilities? If you have already excluded instances of these specific properties/events in an existing configuration file, then you will need to “uncheck” those exclusions. New applications will be able to take advantage of the improved XAML protection capabilities from the start. Please note: as is always the case, if there are dependencies on these events/properties that cannot be detected through static analysis, then they will always need to be excluded.

When obfuscating XAML, always check the “warnings” panel for potentially “ambiguous” XAML during the initial configuration phase (and always test your apps post-obfuscation).

Riddle me this! Where can French, Italians, and Germans all agree?

2011-02-01T17:14:00.055-05:00

Well, apparently, its in their tendency to pair wine with spicy Chinese food.

How did I come up with such a farfetched notion? The answer to “how” is “easily” when I started with a WP7 app like VinoMatch’s Mobile Sommelier that was instrumented with Runtime Intelligence for Windows Phone. But let me back-up a little.

On Nov 4, 2010 MSFT and LG announced that LG Owners Get Free Access to Popular Windows Phone 7 Applications. You can read more about the 10 premium apps and another 10 LG-specific apps on LG’s Facebook page here. They call the program “hAPPiness!”

Anyhow, it turns out that all 10 of the premium apps were instrumented with Runtime Intelligence and have been sending analytics since the January launch of the program.

Last week, Microsoft invited lead developers from all ten development teams on campus for three days to gather feedback as well as to hold some specialized training on a variety of technical topics – and I was fortunate enough to be invited to lead a discussion on best practices for incorporating mobile analytics into the development process. In support of this presentation, I was given permission to look into the runtime data that these 10 apps had been collecting to see what I could see.

The 10 premium apps that are free from LG through March 10th are:

1. Cocktail Flow by Gergely Orosz
2. Color Sprouts by Jarek Kowalski
3. Colorize by Kitron Software
4. Doodle God by JoyBits Ltd. (a Top 100 Paid App)
5. Envision by Dotnetfactory
6. Krashlander by Farseer Games (a Top 100 Paid App)
7. Mobile Sommelier by VinoMatch
8. Mr. Hat and the Magic Cube by BRAVO game studios
9. Talking Ragdoll by Spritehand LLC (a Top 100 Paid App)
10. Weave by Seles Games (a Top 100 Paid App)

While I can’t share the entire presentation here, VinoMatch and Gergely Orosz were kind enough to give me permission to include some of their mobile analytics in this discussion. I want to highlight two powerful analytical techniques using their real-world data.

Conversion feature analysis

Embedded within most apps are a few keystone features that drive conversion (from eval to paid, prospect to customer, fan to fanatic) and Cocktail Flow has one under development, Shopping Assistant. It does not yet connect directly to a store and, as a nascent feature, is not yet a centerpiece in their UX design. Here is what I was able to deduce from the Runtime Intelligence data:

Only 5.5% of all user sessions used the shopping assistant feature.
Of those, 49% used shopping assistant only once inside their session, and 51% used shopping assistant multiple times. Of those 51%, they used it for an average of 2.9 times per session. What were they doing?

With Runtime Intelligence, I am able to map out the full usage trail, feature-by-feature, session-by-session, and so I am also able to visualize:

Where in the sequence of features of each user session shopping assistance was being called.
And when it was used, was it a part of a “one use” session or one of those sessions where the user called the shopping assistant multiple times in a single session.

I can also see that the overwhelming number of Cocktail Flow users using this feature rarely used more than 10 features in their session and that virtually all lengthy sessions (taking more than 14 actions) were always churning (going back to the shopping assistant feature multiple times).

When this feature is functionally complete to the developer’s satisfaction, they will now have benchmarks to measure feature adoption (increase it over 5.5%) and session behaviors (when, how often, and under what circumstances the feature is used) all relating to what may ultimately be their most lucrative app feature.

Mutli-variable AB testing and cross-domain user profiling

In the Cocktail Flow example, we focused on a single feature. With Mobile Sommelier, we are going to add a few more dimensions.

The following graphic shows, as a relative percentage, how often ten selected features inside the Mobile Sommelier application were used over a 6 day period.

What we can see immediately is that there is very little variability over time. The population of users generally uses the application in the same way over time.

What can we do with this perspective?

If we were to release a new version of this App, we could immediately see any meta shift in behavior across the two versions (Runtime Intelligence will automatically roll-up multiple versions and then break them out when asked).

What CAN’T we do?

While we can see how often the “ShowTasteCard” feature has been used, we CAN’T readily determine which wine/food pairing users are most (or least) interested in. We can’t analyze custom, application specific data.

Luckily, Runtime Intelligence CAN grab this data – with no programming – all post-compile. For example, this (very busy) chart shows the how often (by percentage) users want to pair wine with specific foods (like BBQ or spicy Chinese) AND it is further broken out by country.

Of course, this is too busy to read in its current form, but the trend lines do immediately show that while all users may use the “ShowTasteCard” with generally the same frequency (as indicated in the last graphic), it is clear that they use the feature DIFFERENTLY, e.g. they care about different topics. Culture counts!

Let’s drill down.

Focusing in on just three countries (France, Germany, and Italy) and focusing on just a few of the food options (from AntiPasto through Chocolate Cake), we can see genuine differences in user behavior and preferences.

Perhaps it is not surprising that French are more interested in Caviar, Germans in apple pie, and the Italians in antipasto.

On the other hand, maybe we were not expecting Italians to show such a strong interest/preference for BBQ. Could this data point to a way to sell Zinfandel (a US export based on a grape that originated in Italy) into the Italian market? – as the US wine for US food (BBQ).

Some general best practices

At the end of the session, the developers generally agreed on the following developer patterns:

Instrument key usage and application milestones (Not just clicks and page views)
Capture user selections and preferences (Not just selection and preference setting events)

Other conventions and best practices

Implement exception reporting
Integrate runtime intelligence into your CRM, ALM, and Marketplace repositories

Application Analytics are not your older brother’s web clone for the phone!

These have been just a few small examples of the rich set of analytics that are now available (both on and off of the phone). So, if you think Runtime Intelligence is just another web analytic clone for the phone, think again – Runtime Intelligence provides application analytics – not web analytics (see my earlier blog Application analytics: a new game brings new rules).

In a nutshell, this means that these analytics include:

Custom data (including complex objects)
Session, feature, event, and method-level precision (not just event)
Exception reporting (unhandled, handled, and thrown)
Support for both Silverlight and XNA
Opt-in policy enforcement, SSL transmission, and caching
And were implemented using post-compile injection eliminating the requirement to change (or even recompile) source code.

Anyhow, I am ALWAYS eager to hear from developers who have employed analytics in cool and innovative ways – PLEASE reach out and share the wealth! Thanks

Pacquiao, Lebron, and ... Microsoft

2010-12-02T20:49:00.003-05:00

Is Microsoft more like Pacquiao or Lebron – and why should we care?

As a longtime Cavaliers season ticketholder, I have spent more time than I should have trying to divine what could possibly have been going through Lebron’s mind when he decided to “take his talents to South Beach.” Popular wisdom tells us that he wanted a ring – he was simply pursuing his longstanding professional goal. Recently though, I have come to believe that Wade did not attract Lebron with the promise of achieving his professional ambition– he actually gave Lebron an excuse to run away from something bigger still – an opportunity to transcend his sport and become a true leader.

For those of you who don’t know Manny (Pacman) Pacquiao, he is arguably the best professional boxer of all time. He is an eight-division world champion and the first boxer in history to win ten world titles in eight different weight divisions. …And, most notably, he has emerged as a national hero inside his native Philippines. In fact, he has parlayed his singular athletic success into a burgeoning political career – and was recently elected to congress in a landslide victory. Police report that there is a measurable drop in crime when Pacquiao fights; everyone watches. He has embraced his larger role as a transformational leader – in fact, in the lead up to his latest title bout, he confounded his trainers by jumping on a plane to campaign for Harry Reid’s reelection campaign – he wants it all and he is willing to take on the multitude of pressures of maintaining his world champion boxing status and serving as a societal role model, a cultural icon, and a political leader.

Consider this – if Pacquiao were to leave his homeland, his influence in the Philippines would be erased and could never be replicated (even if he returned). If “the Pacman,” in his secret inner heart, was afraid or unwilling to take on the mantle of true leadership that comes with transcending his sport; he could find a safe way out by manufacturing an excuse to immigrate from the Philippines – perhaps to focus on his boxing or some other myopic rationale.

Let’s go back to the one time “Chosen One,” Lebron James. He was born and raised in Northeast Ohio, went right from high school into the NBA, and had played (until “The Decision”) his entire career in Cleveland. The pride, the energy, and admiration that Lebron garnered in this part of the country was off the charts – not to mention the hundreds of millions of $$ he brought to this hard hit economy.

Now consider this – if Lebron’s decision had been to stay in Cleveland and commit to building both the Cavs and the region, he would have committed himself to Parcquiao’s journey – the expectation that he be more than an athlete would have been unavoidable (and inescapable). I think this young man could not hack it – he did not want to walk away – he wanted to run as fast as he could from this burden – a burden that he never wanted in the first place.

What’s this have to do with Microsoft? (stick with me here)

Microsoft is the world champion of business and desktop software. Their unparalleled success has fostered a large, dependent community of partners, developers, and consumers (a community that is in some ways analogous to Northeast Ohio or the Philippines). This community looks to Microsoft as more than just a software supplier – their personal and professional skills are highly dependent on their MSFT-centric skills – that means both revenue and self-worth are also tied up (dependent upon) MSFT. MSFT has transcended the role of software supplier (somewhat awkwardly in many cases one has to admit) to become a social/societal leader.

Now, it’s no secret that MSFT took a shellacking in the mobile phone market – but rather than cede this brave new world, they have come back hard with Windows Phone 7 and a strategy that includes a laser focus on the developer experience. With a steep hill to climb and their reputation on the line, Microsoft is not abandoning the faithful or the strengths that made them what they are.

No excuses – and no Lebron. Microsoft is the Pacman of the Smartphone.

300: Survey results from Runtime Intelligence for Windows Phone first movers

2010-11-19T15:55:00.004-05:00

I have been pouring over a just completed survey that targeted the first 300 developers who downloaded the new Runtime Intelligence for Windows Phone SKU (RI4WP) and I have to say that I am extremely jazzed by the results.

First, we had a 20% response rate which shows right away how engaged these developers already are with the software. I am not going to go into the entire survey here, but I do want to share a few nuggets.

Developers were 3 times more likely to want both analytics and protection versus wanting either one as a standalone function. This is great to see because it says 2 things; first that when you care about what you build – you will want to BOTH know how it’s doing in the wild AND protect your work; second, is shows that developers are getting how efficient it is when you can integrate and combine post-build functions into a single build step (even when those functions appear otherwise to be distinct).

9 out of 10 developers indicated that RI4WP materially improved their overall development experience – now, you might say that this is biased because we only surveyed developers who had downloaded our software – but every developer had been using our software for at least one week – most for the first time – and so there was no guarantee whatsoever that we would be getting such positive marks so soon after installation.

It was not all love and rainbows – we asked developers to share both what they were most excited about and what their greatest concerns were – and the developers certainly did not hold back.

We saw a lot of enthusiasm for analytics but also some genuine frustration that can only be attributed to a legitimate need for better training and/or support and/or product maturity. For those of you that gave us feedback, rest assured: we are working hard to further simplify, harden, and expand this exciting technology – and be sure to register for our upcoming Master Classes on 12/8 and 12/9.

I will end with a small sampling of the survey write-in comments (unedited).

I (respondent) am most excited because:

“The detailed feature reporting (and the ease at which it can be implemented) is extremely useful for gaining insight into how an application is used in the wild. Early results for my current marketplace application have been surprising - enough so that I will be added more detailed telemetry reporting to my next application.”

“I will have more insight into application usage trends”

“I can actually see how people are using the app”

“It gives me insight into what is happening with my apps and which ones are more popular so I can focus my efforts there”

“I am figuring out how my users use my app in the real world. Incredibly valuable.”

“Dotfuscator's obfuscation is better than any other product on the market today.”

You can’t see me, I’m obfuscating (on Windows Phone)

2010-11-16T11:03:00.003-05:00

Recent communications from Microsoft have resulted in a wave of interest (to put it mildly) in obfuscation. Obfuscation is not new; nor are most of the questions, concerns, and critiques that have started flying around the WP7 dev community – but some are (because there are some unique aspects to the wp7 environment).

I have included some resources and comments here – but also, please stay tuned as PreEmptive will be pushing out a collection of resources on this subject specifically targeting Windows Phone.

Quick resources available now:

Online Support: PreEmptive Solutions has two dedicated support forums for Windows Phone 7 developers. Like any forum, you can peruse it, post questions, and get/give answers. PreEmptive support is actively monitoring and contributing.

Obfuscation for Dotfuscator Windows Phone Edition

Instrumentation for Dotfuscator Windows Phone Edition

ISSA Journal: Assessing and Managing Security Risks Unique to Java and .NET (pdf). Tries to answer the questions “when and why should I worry?” and “then what can I do about it?” Specifically, this article “enumerates specific risks unique to managed code (.NET and Java), offers guidance on assessing organizational materiality of these risks, and lists broadly recognized risk mitigation technologies and practices.”

WP7 FAQ (short blog form)

Q: Why do I have to obfuscate my Windows Phone application? Has Microsoft dropped the ball?

Answer: You don’t have to – but if you want to prevent easy reverse engineering of your application, then you should. Managed code has always been easy to reverse engineer (see ISSA Article listed above), and WP7 is no better or worse. In fact, it may be helpful to compare Android’s policy and recommendations on obfuscation – see my earlier post on this for a detailed comparison.

Q: I just obfuscated my application and it’s broken! Is this a bug? Why can’t it just work like encryption?

Answer: Obfuscation is fundamentally different than encryption in that MEANING MATTERS.

Encryption is only half of the equation – the other half is DECRYPTION. Encryption algorithms do not need to preserve the meaning of content because the content will be DECRYPTED. Meaning is wiped out in the output (that is the intent of course) and a reconstituted at decryption time (that also means that encryption cannot be lossy).

Obfuscation is the entire equation – there is no “de-obfuscation” – in fact, that is its intent. Meaning must be preserved in the final output. When your program has tricky reflection, includes mixed-mode DLLs, incorporates 3rd party libraries, etc. – all of that must be accounted for. Some of this can be divined through static analysis – but some idioms/semantics cannot.

Q: I just want to keep Reflector from showing source code. Is that so hard?

Answer: That is actually easy. Turn-off renaming and turn-on “control flow.” The ISSA article defines these transforms, but the short answer is that renaming confuses humans and control flow confuses programs. Renaming is almost always the culprit when it comes to “breaking apps.”

Q: Where can I get the WP7-specific SKUs of Dotfuscator and Runtime Intelligence?

Answer: go to http://www.preemptive.com/windowsphone7.html On the right-hand side of the screen under “Get Started Now”, click on Contact Us Here and fill in the request form. BE SURE TO WRITE WP7 IN THE COMMENTS SECTION.

Q: Where can I go to learn about the latest resources to help me obfuscate my app?

Answer: Go to http://www.preemptive.com/windowsphone7.html - we will update this page regularly. Also, follow us on Twitter - @PreEmptive

Biting the hand in the gift horse's mouth

2010-11-12T14:52:00.014-05:00

I have been watching the growing “outrage” around the WP7 app reverse engineering controversy; outrage wrapped with an unmistakable implication that Microsoft has somehow dropped a ball and is trying to cover-up by recommending obfuscation to mitigate any risks.

I know that I have written that good developers should act like babies, but let’s take a reality check here.

First, let me say that reverse engineering managed code (and the risks that can stem from that) is not unique to .NET – it is common to all managed code platforms including Java (and Mono). For a solid overview on this topic, please see my 2009 article from the ISSA Journal: Assessing and Managing Security Risks Unique to Java and .NET (pdf).

The question is really how a WP7 developer’s experience compares to (for example) an Android developer’s (Google’s Android is Java and subject to all of the same issues and risks).

How many years has Android been out? Let’s compare Android's policy and recommendation to Microsoft's shall we? (click on image to enlarge)

Sources: Android policy and Windows Phone policy

This gets us to the real question that developers should be asking – how does Google’s ProGuard recommendation serve its developers as compared to Dotfuscator for Windows Phone? (again, click to enlarge)

Now call me crazy – but as far as I can tell, Microsoft has, in a few short weeks, served up a premier mobile development platform that is not only far more productive than any other, but includes dramatically superior monitoring, measurement, and protection technologies and services – this is not some defensive move to overcome some flaw or hole – it’s designed to further extend the unfair advantage Microsoft offers developers who target Windows Phone 7 first.

What am I missing here?

A phone by any other ‘nym is just as slick

2010-11-12T00:10:00.002-05:00

(…or, are smartphones also people too?)

One of my favorite words is retronym. A retronym is a new name for an existing (old) thing that becomes necessary because of progress. (what!?) Examples help – the term “acoustic guitar” was only necessary when electric guitars hit the scene. The term black and white TV was not born with the invention of TV – it was born with the invention of color TV.

But we don’t have color phones, we have SMARTphones!

And here is the twist – a smartphone is more than a new class of phone, its also an anthropomorphism (ascribing human attributes to a thing that is not human). Phones can't really be smart – people are smart (at least in theory).

As I've already written in some of my more verbose entries below, smartphones are important because they combine the best of computing, communication, content, and social forces – to become something entirely new.

And as one more piece of supporting evidence that the smartphone hype is real – not only do smartphones promise to disrupt markets, business operations, and social norms ... they have given us our very first anthropomorphic retronym – the dumbphone.

I didn't make this up – see Dumbphone. Its the first of its kind - and i think that's worth noting.

Can you hear me now?

Application analytics: a new game brings new rules

2010-10-12T16:45:00.014-04:00

Web analytics, application performance monitoring, runtime debuggers, security logging, and customer experience improvement programs each have, at their core, some flavor of application monitoring and analytics. Yet, this common thread has been a purely abstract one as the underlying technologies and their respective suppliers have been (up until recently) wholly separate.

These analytic solutions have been able to succeed as silos with a narrow focus on specific stakeholder (owner) objectives because the stakeholders themselves have also been mostly separate. The combination of role, objectives, and scope allow each analytics “silo category” to effectively satisfy the parochial requirements of each “stakeholder category” in happy isolation

Mobile and cloud computing force application analytics convergence

The early crop of application monitoring solutions for mobile and cloud applications have been equally myopic with mobile analytics services providing marketing performance analysis akin to traditional web analytics (sort of a web clone for the phone) and cloud analytics providing metering akin to application performance monitoring solutions – but the silo walls are cracking.

Smartphone applications are often native or managed binaries (Java or .NET framework) rather than simply HTML and JavaScript. And, multi-tenant cloud platforms have multiple stakeholders from ISVs, corporate IT organizations, and the platform suppliers themselves.

Smart mobile and cloud applications promise to end the segregation of application analytic solutions and force a convergence of analytics technologies into a broader application analytics category.

The following table illustrates the multiple mobile and cloud application analytics stakeholders and their diverse sets of requirements.

When, as described above, marketing, development, and App store stakeholders each have “selfish interests” in concurrently monitoring the production application usage of smartphone applications, practical performance and operational considerations dictate an analytics platform whose runtime monitoring capabilities have the breadth to support these diverse constituencies and the analytic depth to support their specific use cases and requirements.

Example: Customer activity and experience

Web analytics focuses primarily on user actions (activity) and customer experience focuses on a user’s entire experience.

Experience and activity are tightly connected, but are in fact, distinct.
In the new mobile world, the distinction between user experience and user activity will become increasingly important as the requirements to manage and optimize each diverge.

The following table defines these two categories and highlights some of their material differences.

The table above shows how the mobile application combines the objectives (and therefore the requirements) of on-premise application monitoring and web analytics.

Refactoring the existing web analytics approach is not sufficient as the customer experience improvement requirements will not be fully met – as the following table illustrates.

Mobile analytic vendors are already emerging that effectively offer the monitoring and reporting analog to web analytics (web analytics clones for the phones). Similarly, cloud platform providers offer varying degrees of resource and application activity metering.

These emerging vertical categories are likely to persist, but they also highlight the practical requirement for a common platform able to efficiently integrate these splinter categories to provide a holistic view of applications that span physical network layers, diverse surfaces, and distributed computing services.

NEXT – APPLICATION ANALYTICS – WHAT DOES IT LOOK LIKE?

HINT

You want the anaytics? You can't handle the analytics!

2010-05-09T12:33:00.003-04:00

I don’t know any other way to say it. I mean it’s just plain common sense. When developers know how their applications are really being used “in the wild,” they will build better software, more efficiently, and with greater confidence. I guess the rub here is that, historically, it has been virtually impossible to get this kind of real-world (or runtime) intelligence into the hands of developers and architects when they need it most – when they are deciding what to do next.

This is why Agile and all of the other “user-centered” practices have come to rely so heavily on proxies for the end-user, e.g. the product owner, etc. Make no mistake, “user proxies” are compensating for an inherent weakness in most of today’s development practices – that is, a lack of a consistent, reliable, or scalable means to capture runtime intelligence. ...but all is not lost.

Web site development – what can it teach us?

Let’s be honest – hardcore developers don’t consider website designers or the users of those “website builders” to be “real” developers. What do they know about algorithms, distributed architectures, or anything to do with the craft (dare I say art?) of engineering quality software? OK, but guess what? These “wannabe developers” focus on – and demand empirical evidence in support of – how their applications are really being used in the wild. In fact, the most remedial “drag and drop” web site developer not only expects to gather real-world usage statistics, they also know that this information will be a (the?) critical factor in future development iterations. They know that only a fool would build something with no way to measure BOTH adoption AND the business impact of that adoption.

Yes, that’s right; website developers actually correlate click-by-click behavior with financial results! Now riddle me this - how many non-web applications are developed with that kind of accountability built-in? The answer isn’t even 0 – it’s null.

You want the analytics? You can’t handle the analytics!

The website developer has even more to teach “real developers.” Website developers have long understood that analytics (when they are good) become, in their own right, bona fide assets – but, here’s the catch – this is only true when they are made public! Knowing something is popular makes it even more popular. So now comes the $64,000 question; if (and we already know it’s a big if) a development team is capturing usage information – how likely is it that they then turn around and share their results with their users, customers or sponsors? (Don’t laugh – it’s a serious question). Users want to benchmark themselves against their peers (usage patterns) and their applications against alternatives (the best tool for the job).

And now it gets a little awkward – if you don’t track usage, you can’t predict results, make corrections, or measure their impact. Developers that don’t incorporate real-world usage patterns into their development process are forced to treat this data as a potential liability. They must work to keep usage analytics confidential and cry foul when others ask to see that very information.

This cannot be healthy. The exclusion of runtime intelligence from traditional development methodologies not only handicaps development, it diminishes the value of their software to those that matter most – the users and sponsors who are denied empirical evidence of their application’s impact.

Open Analytics and CodePlex…

I am using the term “open analytics” here to mean usage analytics that are available simultaneously to all application stakeholders; developers, their sponsors, users, potential users, and (yes) potential competitors (I am not saying that this is an application whose source code is public – that would be open source – not open analytics).

As more and more projects opt-in to share their usage statistics with the rest of the CodePlex community, they will see their software improve in quality and users will have one more metric (in addition to downloads and page views) to help predict the value of CodePlex projects.

If your software is as good as you tell everyone it is – and if you want to make it even better – then open analytics should be a welcome addition to your development arsenal. …but if you secretly fear genuine accountability, well, I guess that’s another story.

old school social networking

2010-02-21T10:02:00.002-05:00

The intimate connection between form and function is nothing new. Lately, I have been reading my father’s stories out loud to my daughter (as they were always intended) and I am struck by how a form of writing unique to him seems purpose built for the Twitter/facebook world of tweets and status updates. I am referring to his – “Beginnings" or “Pleasures of the Imagination.”

Beginnings are first lines of works left unwritten. Long before the Internet emerged as a household appliance spawning today’s socially networked ADD community, my father actually used the term “virtual stories" to describe these tiny works.

But do not fall into to a revisionist trap. His work always strove for a higher standard – not just to be read – but to be read aloud – and that’s what we call old school social networking!

To see what I mean – follow me on Twitter… http://twitter.com/ssholst

Walter Cronkite for CIO!

2009-09-07T23:02:00.007-04:00

I keep six honest serving-men
(They taught me all I knew);
Their names are What and Why and When
And How and Where and Who.
Rudyard Kipling, Just So Stories

The "5 W’s" serves as one of the most basic formulas in journalism (police investigation and research too). The power of “Who? What? When? Where? Why? (And How?)" stems from the fact that each question requires a factual answer that cannot be answered with a simple “yes” or “no”.

How many botched projects, misinformed acquisitions, and over hyped technologies could have been nipped in the bud had the original proposals been subjected to this most basic journalistic benchmark?

Who specifically are the stakeholders? (people who care) Whose job responsibilities will change? (not at all the same as stakeholders)

What exactly will change for each of the stakeholders and those who will see their day-to-day tasks change?

When will these changes occur (as steps within a process flow and/or in what sequence)?

Why will any of the participants “opt-in” or cooperate? What’s in it for them?

How exactly will proposed changes be implemented? How will the proposed technology set all of this in motion?

New technology promises all kinds of life-changing opportunities – but the distance between technology and adoption is much more than “the last mile” of a vision – it’s the difference between vision and victory.

A case in point – we have been focusing on bringing “runtime intelligence” to market – a genuinely unique approach to application monitoring. What makes our approach unique is that it is designed to “serve the selfish interests” of two communities that have historically had very different priorities and worldviews. By serving a much larger constituency, we are able to drive higher adoption, increase collaboration, and solve “unsolvable” problems for the very first time.

Typically, applications are monitored by EITHER developers OR operations. Developers are mostly concerned with debugging and general usability issues. IT operations will often focus on performance, security, and licensing. In fact, BOTH groups of stakeholders suffer from their respective isolation from one another. For example, a software vendor wants to build features that are of value to the widest possible set of users – a single company (operations) only cares about their own parochial needs (and they don’t want to pay for “over engineering”). The software vendor worries about piracy and IP theft – operations worries about sensitive information loss and operational risk. This (and many other) inherent conflicts between developers and operations management undermine both groups' agendas and impede their success.

Runtime Intelligence may be the first solution that addresses application developer demand for near real-time visibility into adoption and usage in the field while simultaneously helping operations automate their IT policies and reconcile application investments with business performance.

Our breakthrough is, in large part, due to a our focus on making sure we have solid answers for the 5W’s (and 1 H).

"And that's the way it is."

Are developers just big babies? The good ones are!

2009-09-01T11:58:00.003-04:00

In her latest book, The Philosophical Baby, Alison Gopnik points out that babies are far from self-centered, myopic beings. In fact, they exhibit all of the characteristics (both good and bad) of adults. In fact, they are in some ways superior. Babies, Gopnik would assert, have malleable, complex minds and a drive for discovery, and are enthralled by every subtlety that surrounds them.

Gopnik compares babies to the research and development department of the human species, while adults take care of production and marketing. Like little computer scientists, babies draw accurate conclusions from data and statistical analysis, conduct experiments, and are even capable of counterfactual thinking (the ability to imagine different outcomes that might happen in the future or might have happened in the past).

In short, babies can
· Observe their environment and absorb salient facts,
· Connect consequences that stem from the events they have observed,
· Predict future outcomes based upon the previous observations and their consequences,
· Develop a vision for the future – develop predictions based upon “what if” scenarios based upon hypothetical (versus observed) events and consequences.

(The fact that babies have these innate characteristics is consistent with the evolutionary perspective on creativity that I already discussed in my earlier entry Software as Fiction)

So why are good developers just big babies?

Good developers move beyond the strict functionality of the code that they write – they move beyond higher order concepts of system quality – they even move beyond caring about and optimizing their work to maximize the value of the code they write. They have the ability to imagine wholly different worlds where the underlying assumptions, constraints and, by extension, their criteria for success may be completely different. This is what we call a “market disruption” like the Internet, cell phones, etc…

In short, good developers can
• Unit test (observe)
• Profile applications (consequences)
• Calculate business impact and mitigate security risk (predict)
• Develop a vision for the future – develop predictions based upon “what if” scenarios based upon hypothetical (versus observed) events and consequences.

This is why its always good to let developers have some play time (and some milk and cookies too)

How do I love thee? Let me count the ways.

2009-08-20T12:43:00.004-04:00

- Sonnet 43, Elizabeth Barrett Browning

What’s love got to do with people and software? (apologies to Tina Turner’s Private Dancer)

Hint: if people live for love, then (software) businesses live for money.

When all is as it should be – love is at the heart of our life and value drives our business. Both are vital – and both are very very hard to measure. Its figuring out WHAT to measure that is so difficult. What really matters? How many poems someone writes? How heavily software is being used? Measuring is easy – measuring the right stuff is what is so very very hard.

At PreEmptive, we have been focusing on Microsoft’s Azure. For those that are non-technical (or who think you are but live in a cave and can’t see the horizon), Azure is a massive Microsoft entry into “cloud computing” – an approach that takes all the worry, hassle and expense of managing computers away (into a cloud) making software very much like a phone service – all (or most) equipment is shared by massive numbers of people and managed for you. Cloud users simply pay to use the service.

Unlike phones, however, software builders and buyers are not all that used to this business model – technically – it’s not that big a deal – but from a business perspective – figuring out what you pay for, how its measured, and what the costs will actually be – this is all new! Ms Browning measures her love in "depth, breadth, and height" - could software value be harder to measure than love?

If wireless phone companies did not charge by the minute, no one would count minutes – we would just talk. Well, developers have just been “talking” for their entire professional careers – and now they have to start structuring their work around these new rules to avoid waste and expense. Azure (and other competitive cloud platforms) is not really a technology innovation as much as it is a major shift in business model.

So, whether you are a romantic (like Ms Browning “I love thee to the depth and breadth and height”) or perhaps more hardened like Papillon Soo in Stanley Kubrick’s Full Metal Jacket, one thing is for sure - Microsoft’s Azure wants to “love you long time.”

How deep, wide, high or long is the question.

Check out a this article in SD Times - PreEmptive's Dotfuscator instruments Azure applications By David Worthington – where Dave makes many of the very same points in a much more professional manner.

For a more commercially-centered view on all of this, read my preemptive blog entry.

Spread the love!

Sometimes even corporate giants do the right thing (who cares why).

2009-07-20T17:11:00.002-04:00

On July 12th I headed down to New Orleans for my 3rd Microsoft Worldwide Partner Conference (WPC). This is where all of the companies who sell Microsoft products or ancillary services come from all over the world to learn how they are all going to make more money next year. Each year, the WPC organizers offer up a variety of networking opportunities for that Sunday – golf, field trips, etc designed to encourage some professional bonding but also to make the attendees feel important – dare I say, elite.

Well, this year, Microsoft threw in another option – one that I was not expecting - but one I was grateful to see. Microsoft called it “a day of giving” and then broke it down into a bunch of options so that attendees could opt-in at their comfort level. For the timid, you could work next to local artists at the convention center where we would be spending our week to help finish out murals for schools. There were a number of other options leading up to taking a ride out into the 9th Ward to help build houses for habitat for humanity. Not that this took any kind of heroics or stoicism by any stretch – we were bused in and bused out and we were assigned very discrete tasks – virtually no skills required.

But we actually framed two homes in a day. We worked alongside some of the people that would be moving into those (or similar) homes. We saw firsthand how much more work still needs to be done. We saw homes that still bore the National Guard markings indicating dead bodies were found in the attic all these years later. The heat, the scale, the smells - it was real - not reality TV.

Did the computer geeks (us) make a material dent in this national tragedy? A tiny dent maybe – nothing more on that day (in my opinion). But I know that our collective consciousness was raised, the connections, however fleeting, were far more memorable than any round of golf, and I for one am actually grateful to Microsoft for setting this considerable project in motion.

Now having said this, I will not be at all surprised if I see MSFT PR trumpeting this project and promoting itself to some absurd degree – but that won’t change the experience of those that were there. I can’t believe I am writing this – but thank you Microsoft.

Update to last post... I hate to say i told you so...

2009-07-09T17:13:00.003-04:00

Right from the NY Times headlines - Cyberattacks Jam Government and Commercial Web Sites in U.S. and South Korea. The article in part reads "SEOUL, South Korea — A wave of cyberattacks aimed at 27 American and South Korean government agencies and commercial Web sites temporarily jammed more than a third of them over the past five days, and several sites in South Korea came under renewed attack on Thursday."

I have seen the list - it's more than 27 sites and it is more of a probe than a serious attack. The attackers are learning from our response and refining their strategy. The fact that these attacks are being characterized as primitive should not make us feel any more secure - sorry - i promise not to turn this blog into a paranoid rant... (unless it's already too late;) - the next few postings will be cheery and sunny (even if it kills me).

A daker side of application and human behavior

2009-06-30T09:32:00.004-04:00

In DC today at a security conference (Gartner) – and this has prompted the following - I use this blog explore the symmetry between applications and their human progenitors – today’s posting focuses on a darker side – the military, terrorism and war.

I have just left a presentation led by David Sanger, Chief Washington Correspondent for The New York Times. He focuses more broadly on foreign policy, globalization, nuclear proliferation, and the presidency – today’s discussion was on Cyber threats rather than nuclear or trade.

Applications are now soldiers, terrorists, saboteurs and secret agents.

Did you know that denial of service attacks (techniques for bringing down phone, power, broadcast and financial networks) are now a standard tactic in every army’s war book?

Just as air bombing is standard before a land battle begins, so are denial of service attacks.

Estonia experienced a devastating cyberattack in 2007 following a decision to move a statue memorializing Russian soldiers who fought during World War II. Pro-Russian hackers took down bank and school websites on Estonian networks.
Russia used denial of service attacks before attacking Georgia last year.
And earlier this week, Iranian news websites and those belonging to political organizations were hit following the contested re-election of President Mahmoud Ahmadinejad.

Did you know that the US power grids and financial markets are continuously probed searching for weaknesses to be exploited at some future date?

…and guess what? Unlike human terrorists, you cannot easily determine their origin. We have no borders to protect. And even when you find the source (computers) that are launching these attacks – they are rarely in the country of origin (Russia’s attack against Georgia emanated from Turkey). How do you think Turkey would feel if Georgia bombed Turkey to defend itself?

If you haven’t already heard, Obama will soon be appointing a “Cyber Czar” – and before you buy in to some hack (the media equivalent of a computer hacker) complaining that we should be focusing on “the real threats” overseas, our economy, etc. remember your history – think of The Maginot Line – and be grateful that we have a president that actually uses computers and understands their role as the literal “work horse” of the 21st century and, now, the emergence of an entirely new “military front.”

Stuff i took the time to post on LinkedIn that may be worth repeating

2009-06-12T15:19:00.005-04:00

I got caught up in a LinkedIn discussion thread on the influence of analysts on application vendors and software categories - i think it bears repeating... the original question was in part ...
Do industry analysts have too much influence on software vendors, who call their products GRC or CCM/T - terms used by analysts?

There were a few comments before i wrote...

I probably read way too much into this question – but it hit a nerve and so here is a rather lengthy reply (for a linkedin comment anyhow).

At the most abstract level – the etymology of terms like GRC are no different than any other phrase or term in natural language – like heat off of an engine, meanings are generated through usage (which often diverges substantially over time from first use). This means that even though careful and deep thinkers take the time to carefully craft a coherent and fully realized definition of GRC – this is not, at the end of the day, the actual meaning of GRC. There are two scenarios here – a) people using the term with a shallower or incomplete understanding and b) people intentionally reusing the term to mean something slightly (or entirely) different. In either case, whoever gets the most air time generally wins.

Looking at the second use case – intentional misuse – this is extremely common in the commercial world (not just hi-tech). What does “natural” mean? How about “fat free”? Hi-tech examples are numerous too – enterprise content management (ECM) is another good example. In fact, I wrote a short column on this way back in 2002 (before blogs were big) entitled “Enterprise: how long is a piece of string?” http://gilbane.com/columns.pl?view=5 …here I offer my own musings on the tension between vendors, consumers and analysts at length– but the topic was not GRC – it was ECM. Is it surprising that vendors like IBM, Oracle, EMC and others are players in both?

To be clear, motivations are not always malicious or deceptive – as long as analysts need to produce a body of work that is organized, integrated and expandable (and commercially valuable) – they will develop (and insist upon controlling) their own taxonomies.

As long as suppliers are most interested in solving problems competitively and profitably, they will emphasize and focus only on problem domains where they are effective (no vendor paints a worldview with a hole in the middle).

And as long as enterprise consumers are focusing their scarce resources on the most material/pressing challenges and opportunities in front of them, they will ignore skills, technologies and opportunities that do not address their selfish interests. Each group works to influence the other two – but the tension is natural – and I believe healthy.

In my view, all three players are correct to do this (in fact, this is more of an ideal than a common practice). So, I guess the short answer from my perspective is that mapping capabilities to features or categories is, by design, an imprecise means of communicating priorities and intentions – and should never be relied upon to replace detailed and deliberate assessments/evaluations/recommendations.

Buyer beware – or – he who controls the language, controls everything – or – meaningful ambiguity is a good thing…

A few complimentary notes were posted on the above :) and then an interesting post came from Michael Rasmussen - a very effective analyst and thought leader in his domain of governance, risk and compliance management....

Michael wrote "Yes, industry analysts do have too much influence on defining and categorizing software. Particularly in markets such as GRC. I left Forrester after seven years because I was continually frustrated - my definition and approach to GRC was broader than Forrester's audience. Forrester, Gartner, and their peers are good at reaching the IT audience - so GRC (as a software category) often gets trapped within IT. Occasionally it breaks out into other areas such as finance where they have some traction. They fail to understand GRC's role in EH&S, Quality, CSR, and many other areas. "

...and that's when i went a little overboard for a linkedin discussion (it took two posts to fit it in - here it is)

POST 1

Perhaps because I too have spent many years in this business (over 20 as an ISV and even 2 as an analyst), I cannot resist the temptation to connect Michael’s point of view with my earlier post. Sadly for all of you, because the post was too long, you will have to read this post AND THEN THE NEXT POST for the punchline...

The ISV-enterprise-analyst knot If you deconstruct the influence of analysts on software categories, you will see that ISVs are keenly focused on their customer needs (this is the ISVs primary focus). In the same fashion, the ISV customers’ primary focus stems from their target customers requirements (whoever they are). Since assessing IT options (or HR policy or tax law or…) is NOT the ISV customers’ primary focus, they look to outside support that is, ideally, expert and independent. With regard to IT, they look to IT analysts. IT analyst firms in this particular scenario have enterprise IT as their primary customers (focus) too. So – ISV sells to Enterprise who is then sold to by Analyst firms who provide “independent” guidance. The result is a tightly woven financial, professional and organizational knot. Leading to the following good, bad and twisted consequences

1) This dynamic discourages innovation and transformational solutions: The enterprise IT group is generally not incented to modernize or re-engineer their IT strategy on their own initiative – and so, typically, do not look to analysts for this kind of advice – they want guidance with minimal risk, a proven (therefore established) approach, using equally stable technologies and suppliers.

2) IT analyst firms deliver what their customer-base wants – That means a topology and best practices that emphasizes a “rear-view mirror” perspective. This is especially true for companies like Gartner and Forrester because of their enterprise client base. (Note that Michael appears to validate this when he writes that analyst firms are “good at reaching the IT audience.” That’s no accident or even handicap from a business perspective – that is their North Star to hitting their revenue goals. This is the high-order bit, the organizing principle, their raison d'etre. )

3) ISVs must “set the table” to win sales. ISV’s try to influence (or appease) analysts as a tactic to influence their shared customer-base. The influence on ISVs (who ultimately must label their software as “grc” or “ecm” or whatever) is, therefore, indirect. If the enterprise IT customer was willing to pay analysts to produce transformational business and operational re-engineering recommendations – then that’s what analyst firms would immediately start to focus on. But, to date, market forces rarely lean in that direction.

4) Sometime the market does demand transformation. Disruptive technologies like the Internet, regulations like Sarbanes-Oxley or economic forces like the rise of India and China may force businesses to place new demands on IT that get passed to analyst firms which then generate short bursts of transformational analyst output. NOTE - This is the exception and lasts just long enough to address the threat and never long enough to reap all of the potential value. This is why so many companies will stop GRC investments once individual regulatory obligations appear to be met but well before an integrated and effective GRC transformation is even in view. It is organizational and professional entropy.

5) In order to transform businesses, you must cut the knot – If the success of a new business practice or technology requires organizational change and/or a re-education of professionals (inside any of these three organizational threads) – the interlocking dependencies of the ISV-enterprise-analyst knot must be severed.

Is this inherently bad? Read my next post please.... (its WAY shorter)

POST 2

Is this inherently bad? Of course, if you’re a spirit who thrives on transformational change – this will be extremely frustrating (and I count myself among that number). But I have to say that this is not the only view.

As our founding fathers recognized – perhaps the greatest threat to our liberty stems not from dictatorship, but from “a tyranny of the masses.” Like the executive, legislative and judicial branches of government, our “knot” of enterprise IT, ISV and analyst may slow things down to a maddening degree – but it also protects us from swinging corporate strategy and operations too often or too far in any one direction. (hey, let’s throw out our computers and just use iphones!).

Now, I would never presume to speak for or represent Michael’s views – but I did have the good fortune to be one of Michael’s clients when he was at Forrester and have had some experience with him in his subsequent “expanded” and independent role as well. My experience of Michael is that he is a man who is not readily satisfied with the status quo and is energized when he sees a way to materially transform the way people work – and by extension – the way they live.

Ironically, as Michael succeeds in his almost evangelical mission to raise our collective consciousness as to what GRC SHOULD mean, organizational changes within enterprises to better align with good GRC practices will be one sure result. This will in turn lead to a spike in demand for more sophisticated/expansive analyst services around “true GRC” and this will in turn bring “the new GRC” into the analyst firm mainstream. …and in a decade or so, someone will rail against these firms for stifling the next dimension of business/social/operational/financial management. Who knows, perhaps it will still be Michael.

Remember – an “end-to-end solution” is just a silo seen from the inside. (…and apologies in advance to Michael if I have in any way misrepresented or dumb'ed down his outlook beyond recognition)…

Software as Fiction

2009-05-31T00:15:00.003-04:00

I caught an installment of The Bob Edwards Weekend on PRI this week where he was interviewing Denis Dutton, a philosopher and author of The Art Instinct – Beauty, Pleasure, and Human Evolution. Dutton is also the founder and editor of the website Arts & Letters Daily which was named by the Guardian as the “best Web site in the world.”

Anyhow, and to oversimplify, his premise is that art is much more than heat thrown off of a cultural engine – rather, art sits at the heart of our evolutionary advantage. Art provides a safe, effective means to learn life’s tough lessons without actually having to suffer the scars or take the risks inherent in the real world. As a species, fiction gave us the ability to adapt and survive better than our less creative Neanderthal competitors.

My first thought was of one of my father’s stories – “The Zebra Story Teller” –Checkout the following analysis from The Norton Introduction to Literature: “’The Zebra Storyteller’ suggests that the purpose of stories is to prepare us for the unexpected. Though the storyteller (a zebra in the story) thinks he is just spinning stories out of his own imagination in order to amuse, his stories prove to be practical. When the extraordinary occurs—like a Siamese cat speaking Zebraic—the storyteller is prepared because he has already imagined it, and he alone is able to protect his tribe against the unheard‐of.”

In the context of Dutton’s thesis, the Zebra Storyteller describes how fiction emulates the science that establishes fiction as an emulator!

The Zebra Storyteller is included here at the end of this post.

What’s this have to do with software? If fiction is a safe way to explore and grow – what are computer games? Simulators for airplanes or war games? Test cases that are a part of every application development cycle? We typically think of software as a means of automation that increases productivity, improves quality, etc. – but if Dutton is right, software plays an equally important (or even more important) role as a "low-cost, low-risk surrogate experience."

…and for me – this leaves room (establishes the permanent need) for the truly creative developer who is not chained to a formal spec…

Programmers as poets writing software sonnets - diggit!

The Zebra Storyteller
by Spencer Holst

Once upon a time there was a Siamese cat who pretended to be a lion and spoke inappropriate Zebraic.

That language is whinnied by the race of striped horses in Africa.

Here now: An innocent zebra is walking in a jungle, and approaching from another direction is the little cat; they meet.

“Hello there!” says the Siamese cat in perfectly pronounced Zebraic. “It certainly is a pleasant day, isn’t it? The sun is shining, the birds are singing, isn’t the world a lovely place to live today!”

The zebra is so astonished at hearing a Siamese cat speaking like a zebra, why, he’s just fit to be tied.

So the little cat quickly ties him up, kills him, and drags the better parts of the carcass back to his den.

The cat successfully hunted zebras many months in this manner, dining on filet mignon of zebra every night, and from the better hides he made bow neckties and wide belts after the fashion of the decadent princes of the Old Siamese court.

He began boasting to his friends he was a lion, and he gave them as proof the fact that he hunted zebras.

The delicate noses of the zebras told them there was really no lion in the neighborhood. The zebra deaths caused many to avoid the region. Superstitious, they decided the woods were haunted by the ghost of a lion.

One day the storyteller of the zebras was ambling, and through his mind ran plots for stories to amuse the other zebras, when suddenly his eyes brightened, and he said, “That’s it! I’ll tell a story about a Siamese cat who learns to speak our language! What an idea! That’ll make ’em laugh!”

Just then the Siamese cat appeared before him, and said, “Hello there! Pleasant day today, isn’t it!”

The zebra storyteller wasn’t fit to be tied at hearing a cat speaking his language, because he’d been thinking about that very thing.

He took a good look at the cat, and he didn’t know why, but there was something about his looks he didn’t like, so he kicked him with a hoof and killed him.

That is the function of the storyteller.
--------------------------------------------------------------------------------

©Spencer Holst. From THE ZEBRA STORYTELLER, Station Hill Press

Conference As A Service (Cloud Conferencing)?

2009-04-29T17:08:00.004-04:00

I have just returned from the RSA Conference in SF. RSA is a security conference, and, by most measures, computer security has remained relatively unscathed by the recent economic turmoil.

Not surprisingly though, attendance at this event was down – security budgets may be avoiding the scalpel, the same cannot be said for travel expenses. The organizers, while still doing everything that they could to fill seats, wisely (in my opinion) built in ways for “attendees” to get at content, keynotes, etc. remotely. …and once that cat is out of the bag, many of the same technologies were offered to physical attendees to essentially let them be in more than one place at the same time (twitter, etc.).

While the original motivation for some attendees opting out of travel may have been financial – I am guessing that a few of them will realize that they prefer this remote experience. Certainly, a percentage of the attendees took advantage of the complimentary online services and will now look for and expect this kind of value-add to any conference that they attend in the future.

Having said all of that, there is no doubt in my mind that there is no substitute for face-to-face networking – to build trust, to flesh out impressions of people and companies, to opportunistically (or in an ad hoc fashion) explore and discover unexpected topics…

Cloud conferences are cheaper, accessible to a broader population, and, in many cases, even preferable to real-world ones… but there will always be – in my view – a need and a demand for live events. …and the best conferences of the future will most likely offer a more seamless integration of online and in-person formats.

I may be projecting – but I suspect that nothing in this post so far is even remotely controversial. Why then, do we have such a hard time applying these concepts to applications rather than people?

Cloud-based application services are cheaper, accessible to a broader population, and, in many cases, even preferable to installed alternatives… but there will always be – in my view – a need and a demand for installed software. … and the best solutions of the future will most likely offer a more seamless integration of cloud-based services and installed (somewhere else) components.

New technology does not replace – it displaces – just as new social networking capabilities do not replace – they displace. Electronic documents cannot replace paper, clicks do not replace bricks, and clouds do not replace purpose-built, localized solutions. The optimal recipes integrate all available ingredients.

– Cloud conferencing services are here to stay – but destination events are never going to go away… The same can be said for cloud-based and installed application services.

PS - i will be traveling to LA, CA for TechEd in 2 weeks... go figure!

I will be presenting at the MIT SPAM Conference 2009

2009-03-12T16:18:00.003-04:00

Well, this is not really a posting about how applications are like people - its just an FYI that I will be presenting at The MIT Spam Conference 2009 being held at (surprise) MIT. It is a two day conference on March 26-27, 2009.

You can register (sponsor and MIT funded - no charge) by emailing the chair, Kathy Liszka Professor, Computer Science University of Akron, at mailto:liszka@uakron.edu?subject=SC2009

The agenda is reasonably technical and is as follows: (I hope to see you there!)

Thursday March 26, 2009
9:30 a.m. breakfast

10:00 a.m. chair opening
Kathy Liszka / Bill Yerazunis

10:15 a.m. keynote
Robert Bruen: ICANN Policy Enforcement

10:45 a.m. keynote
Garth Bruen: The Future of Anti-Spam: A Blueprint for New Internet Abuse Tools

11:15 a.m. paper
Adrian McElligott: Email Permission Keys

11:45 a.m. lunch

1:30 p.m. paper
Claudiu Musat: Spam Clustering Using Wave Oriented K Means

2:00 p.m. paper
Sebastian Holst: Account-free” Email Services to Combat Phishing, Brand Infringement, and Other Online Threats

2:45 p.m. paper
Nathan Friess: A Kosher Source of Ham

3:15 p.m. paper
Didier Colin: A Selective Learning Model For Spam Filtering

3:45 p.m. presentation
Rudi Vansnick: Is Spam in Europe easier to handle ?

6:00 p.m. reception
Courtesy of ComCast

Friday March 27, 2009
9:00 a.m. breakfast

9:30 a.m. paper
Tim Martin: Phishing for Answers: Exploring the Factors that Influence a Participant's Ability to Correctly Identify Email

10:00 a.m. paper
Reza Rajabiun: IPv6 and Spam

10:45 a.m. workshop
Adrian McElligott: How to integrate Email Permission Keys in to an existing Spam Filter in 5 easy steps

11:15 a.m. paper
Henry Stern: The Rise and Fall of Reactor Mailer

11:45 a.m. lunch

1:00 p.m. presentation
Andra Miloiu Costina: Do humans beat computers at pattern recognition?

1:30 p.m. paper
Cesar Fernandes: An Economic Approach to Reduce Commercial Spam

2:15 p.m. paper
Alexandru Catalin: Phishing 101

2:45 p.m. paper
Areej Al-Bataineh: Detection and Prevention Methods of Botnet-generated Spam

How many bones are in your software?

2008-12-20T19:28:00.002-05:00

How many bones are in the human body? Well, it turns out that it depends. You see, there are 206 bones in adults and up to 350 for infants. During the very early years, the architected for rapid growth and flexibility. As a child matures, some of the bones fuse together (like the skull and hip) to provide protection and stability required for the long haul – and the overall bone count drops to the 206 bones that most adults have.

Software solutions are not all that different. Early days, when a particular architecture or solution is first seeing the light of day – communication, authentication, workflow, information management, etc. have to be configured, optimized, and integrated to reconcile system capabilities with environmental constraints and operational requirements. As the solution stack matures, many of the underlying components, for all practical purposes, fuse.

When considering a prospective solution/architecture – make sure it has the flexibility to account for the rapid change that you know has to come as solutions are rolled out AND the adaptability to harden itself to optimize for stability and security – too many moving parts (which may be perfect as requirements are identified) will become a liability as protection and stability become overriding requirements for “the long haul."

Best of breed always looks most attractive “on paper” and perhaps even in early phases of deployment. Over time, there is a lot to be said for tightly integrated ecosystems that come “pre-certified” for interoperability.

Does that mean that we can look for “terrible two’s” and “adolescent rebellion” analogs in application development lifecycle management?

You bet.

It nice to be head of the curve (i suppose)

2008-10-08T12:37:00.004-04:00

I just noticed the following article in PC Magazine on candidates and spam…. entitled Palin Wins 'Spam Debate,' As Does Obama published on 10.03.08. In this article, they marvel at the fact that Palin got 5 to 6 times the spam as Biden.

Well, for those that read my previous posting on SEPTEMBER 13 - they would have learned the same thing (and a bit more about the likely origins of some of that spam.)

Here is another article - Be Especially Alert For Bank Phishing Attacks also in PC MAG that talks about increased phishing attacks on banks - now this information i do not publish as openly, but i will repost my comment on this article... I wrote

"We can track email traffic on a variety of financial institutions - we have seen 5 specific attacks on the banks listed here in the past 3 days - these generated many 100's of thousands of emails being sent from over 100 diferent IP addresses based in over 35 countries - again, all of this traffic stemmed from only 5 coordinated attacks."

Its nice to be ahead of the curve I suppose... but only if someone is listening.

Presidential SPAMPAIGN 2008

2008-09-13T22:52:00.015-04:00

Presidential Spampaign 2008

It turns out that the volume and character of spam can offer a kind of twisted view into the zeitgeist of this election season.

Using the qi-fense phishing-net service that combs through over 17 million emails every day, I took a look at the spam traffic for the week of September 6th.

That week was notable for a number of reasons. First, both presidential candidates hit the road with their newly anointed VP nominees. Second, both parties paused and then re-ignited their campaigns as part of their observance of 911. What can peering into the SPAMiverse tell us about all of this?

Is Biden irrelevant?

Of the roughly 40 thousand pieces of spam that referenced one or more of the nominees during the week of September 6th, only 4% of the traffic referenced Biden in any way. Whether the email was genuinely political in nature, positive or negative, or simply tried to hijack their name recognition to push a casino or a knock-off watch, 96% of the spam made no mention of Biden (as compared to Palin who was mentioned 5 times more often!).

McCain and Palin get equal billing?

McCain barely gets more attention than his running mate, Palin. Palin got over 10 thousand spams that userped her name - McCain just broke 11 thousand.

Obama is no celebrity

While Obama gets the lion’s share of spammers’ attention, the combined republican ticket gets 43% more references than their democratic rivals Obama and Biden compbined.

Political Campaigns dominate political spam

While there are plenty of sleazy spammers trying to capitalize on the election season, there is one trend that is hard to ascribe to typical spammers pushing casinos and mail order prescriptions – let's call it the 911 pause.

The 911 pause

A breakout of the volume of spam by day shows a curious pattern between September 9th and September 12th.

On September 11th, spam email for each of the candidates plummeted by between 36% and as much as 57% (for Palin). This is unlikely to be a coincidence, because the email blasts rebounded on the 12th again with spammer references more than making up for the one day pause.

It may be notable that McCain has somehow won an extended grace period – his spam volume only climbed 9% after the 11th versus Palin who spiked by over 100% on Sept 12.

So when the political parties claim to be completely removed from the email smears that clutter your email – don’t believe it. McCain and Obama gave a cease and desist order for 911 and their campaigns listened – even those elements that they deny as their own.

The soul of a new application

2008-09-05T09:43:00.002-04:00

Are some applications inherently good or evil - can that really be in their DNA?

Can exposure to toxins during an application's gestation cause defects? Are QA teams like pediatricians?

What about an application's environment? Can a good application go bad?

If so, can applications be rehabilitated or must they simply be quarantined or euthanized?

Can the company an application keeps be a good (or bad) influence on its behavior? Its 10PM - do you know where your application is?

What about diet? Do you know the appetite (for data) required to keep your application at its prime? What happens if your application eats too much – can an application get fat on content? Does it have a coronary or just get slow and lazy? Do your applications have built in restraint or are they fundamentally gluttonous?

What about corrective surgery? Are you against adding limbs post-partum (instrumentation)? Perhaps if it is for health reasons and not just for aesthetics? Are UI facelifts superficial – or do we treat pretty applications nicer than the ugly ones? If so, what’s wrong with a little nip and tuck as an application gets along in years? Would we tolerate the eccentricities of the iPhone if it looked like a motorola razor?

Enterprise Sales and 18 ways to be a better waiter

2008-07-31T16:14:00.005-04:00

I recently led some sales training for our team and stumbled across these tips on how to be a better waiter on wikihow.com - it fit so perfectly into how to be a great enterprise software sales person - i used the analogy throughout the day -

... (the italicized text are my little comments when i think one was necessary)

Learn everything you can (nuff said)
Never fight over tables with other waiting staff. (dont fight over territories)
Learn the menu as soon as possible (know what you are selling)
Learn your regular customers' names as soon as you can.
◦People love having a regular place to go to, where you know what they like to eat and you call them by name.
Develop a file system for your regular customers (learn the organization)
Do one thing at a time.
◦Don't count on finishing writing the order down as you walk to the order counter. Do it now! (stay organized)
Break down the "wall" between you and your customer.
◦Depending on the situation, sit down at the table to take an order, squat down to take a child's order, shake hands, …
Always be clear about your order.
Be tactful about questioning customers.
◦If you feel you must question why a customer is making a special request, be tactful
Remove the plates, glasses, and other used items from the table as they are finished. (follow-up on support and other commitments)
Don't just assume when the diner is finished and wants the check. Ask if there is anything more you can get for them (When the checkbook is open....)
Be polite in the face of irritable, difficult and unfriendly customers
Don't let a bad tip ruin your shift. (don't let one deal break your stride)
Happy service is infectious - Happy service is infectious
Check back often with your tables. You'll always have that table who always seems to need something extra. (stay in touch)
Leave drama, bad moods and personal issues at the door.
Never sit around. If you have nothing to do, clean! (cold call, research, etc.)
Be honest about the food/kitchen practices when asked by the customer. Serious consequences can result from mis-information. Allergies and intolerance to food products or practices could result in death. (overselling will kill a relationship)

So - a great waiter… (like a great enterprise salesperson)

◦Fits the menu to the diner - and not the other way around

◦Highlights appetizing and healthful options and ingredients

◦Offers irresistible side dishes

◦Is mindful of inventory and high margin options

◦Is attentive and inquisitive without being intrusive

◦Identifies who is paying early in the meal, communicates payment options and delivers the bill

◦Does not need to know how to cook!

◦Is rewarded with a gratuity that is proportionate to the bill and their level of service

The best defense is a good e-fense

2008-07-19T11:38:00.005-04:00

I'm advising on a new venture, qi-fense, an anti-phishing and reputation management service that filters a huge volume of real-time emails to provide early warning on phishing, reputation attacks, competitive tactics, etc. Check it out at http://www.qi-fense.com/.

I think it is very cool because of its low cost, low friction and potentially high value proposition - if you're interested in learning more (or have ideas) - LET ME KNOW (remember - ideas only have to be good - not original ;)

Thinking outside the box is no different than thinking inside

2008-07-19T11:34:00.003-04:00

Truly different approaches to problem solving erase the box - afterall, depending on on the size of your box (and the size of your universe - string theorists can relate) thinking outside the box might actually offer fewer options than the alternative.

Is it possible to unlearn - or forget - that the box ever existed?

The many faces of software

2008-06-27T09:45:00.002-04:00

Popular wisdom tells us that the more words a culture has for something, the more important that "thing" is to that culture. Whether its ice for the Inuit, rice for the Chinese or money to Americans - there are cross cultural examples to be found everywhere. Yet, I have always held a corollary to be that the more meanings a culture has for a single word - the poorer that culture understands the word - essentially rendering it meaningless in the most extreme examples. In fact, I wrote a collection of short stories where the title of each was derived from one of the many definitions for the word "natural" - but that is another matter all together.

What strikes me is that software is an example of both cultural importance and limited understanding. We have applications, components, widgets, binaries, executables, plug-ins... well - the list could go on for much longer and - candidly - is not at all surprising to discover that software has become an important element of our culture. What is, I think, telling, is the many meanings (and disagreements) on the definition of software. It is the disconnect and dissonance between people, organizations and processes that lead to financial, functional and operational software failure.

Software as currency – if you take a $10 bill and rip it in half – you don’t have two 5’s – you now have paper. There is an atomicity (or unit) to currency and a consensus on how it is valued – these are the essential characteristics of a currency – and the medium is truly irrelevant. Are applications simply executables? How do support, documentation and activation rights fit into the “currency of applications?” Software services, on demand application manifestation and content that encodes behavior further challenge even the basic notion of what are the ingredients of an application.

Software as a commodity – prospectors find gold and stake their claim – an assayer will assess its worth and a separate array of businesses will refine, package and ultimately monetize the gold (coins, leaf, jewelry, bullion, etc.). Well – this I think fits pretty neatly into the true life cycle of software – developers know where the interesting bits are that they develop within larger bodies of code and they know what needs protecting. The actual value of that work is typically best established by product management, line of business, etc. and the monetization is accomplished through sales and marketing - protect – analyze – monetize.

Software as an asset – tracking software is always been tough and it is getting tougher – but truly measuring the financial impact of software on a business (not based upon what was paid for the software – but on the change in value of the business that adopts said software) is so murky as to be meaningless on any general scale.

Imagine how much more efficient the software business might be if we could get all of the stakeholders in the development, consumption and adoption of software to agree on these three dimensions of software – we would move from the bartering economy of pre-history to a truly modern (and efficient) software economy…

Attention – this is not a metaphor or an analogy - application development and IT operations are really ecosystems

2008-06-07T23:52:00.003-04:00

Central to the ecosystem concept is an idea that living organisms are continually engaged in a set of relationships with every other element in their environment. Any situation where there is relationship between organisms and their environment can be legitimately described as an ecosystem.

A system as small as an office or as geographically disbursed as a collection of digitally connected workspaces can be described and studied as human ecosystems. Now, ecosystems are often treated as lucrative sources of goods and services. Forest ecosystems produce wood and maritime ecosystems produce fish and application development ecosystems produce software.

Among the most interesting and active regions within any ecosystem are its edges – between the sea and seashore and between a development ecosystem and the IT operations ecosystems that it abuts. The points on land that define a coastline constantly shift with the tides and currents as do the points of work where end-users and applications meet.

I think there is genuine insight to be mined as we try to navigate the constantly changing social, technological, regulatory, economic and organizational impact of applications across the biosphere. Ecosystem classifications, functionality and biodiversity topics, the edge effect in ecosystems, studies on invasive species and traits of invaded ecosystems, … all have striking – and I think useful – parallels worth exploring to better manage the health and vitality of the application-dependent ecosystems that we all inhabit.

...and perhaps i will have the patience to jot some of these down here in the coming months...

I have been studying the point-of-work in this light for a few years now - and it clearly holds a true duality of purpose and form (like a wave and particle - but that is another post). Does the point-of-work hold the key to transforming (and aligning) the application supplier and consumer ecosystems? Therein lies the mystery - and only mother nature knows for sure.

Technology is Never replaced - Technology is Always displaced

2008-06-07T20:55:00.004-04:00

in the early 80's IBM announced the arrival of the paperless office
in the early 90's databases were going to replace file systems
in the late 90's the clicks were replacing bricks
and today "clouds" are replacing installed applications

Well, electronic documents were transformational - but my office is still filled with paper
Databases are everywhere - but so are files
Lets not even talk about clicks and bricks
...and for the current cloud evangelists - well - look up a little quote from George Santayana...

Of course each of these developments were transformational - but new technology - like new culture - like the next layer of geological sediment - will always be additive.

An Application Security Haiku

2008-01-20T20:59:00.000-05:00

Footprints' reflection
Opportunities' shadow
Application Risk

Applications are people too - more examples

2007-10-21T21:52:00.000-04:00

I am on the plane on my way to RSA Europe in London and my skill of being able to sleep on any flight seems to have abandoned me. I’ve finished my airplane book (Hundred-Dollar Baby by Robert B Parker) and I can’t bear to watch the animated movie about surfing penguins in Hawaii – and so I have pulled the laptop down from the overhead to log some more musings on why applications are people too.

Applications are people too because…

Process, Technology and Value are to applications as Mind, Body and Spirit are to people. The ultimate goal is to achieve and sustain a perfect balance.

For wellness (process/technology or mind/body), the same mix of preventative, detective, monitoring and treatment strategies must be applied. Finding your way (spiritual/value) requires a view that is bigger than oneself.

It takes village to raise us properly. While it only takes a programmer and a machine to produce an application (like two parents…) – without context, guidance and support from the broader community (product mgmt, sales, etc) – what chance does an application have?

Our strongest characteristics are not inherently strengths or weaknesses – it is the environment or context that makes them so. An outgoing social personality can be someone’s greatest strength or their undoing depending on whether they are in sales or working for the NSA. An application that grabs all available memory to speed its processing is wonderful for a video editor and will create havoc for your background search indexer.

…and with security on my mind for this week’s conference…There are no good guys or bad guys – only supervised and unsupervised (this is an exact quote from a FBI agent that I still recall from a meeting in 1984 when I worked for IBM in their internal security group). The point here is that when you are thinking about security – do not have a double standard – one for the bad guys and one for the good guys – have a consistent approach that includes monitoring, verification and auditing.

Each of these examples just scratch the surface of course – it's the drilling down into these parallels that I think can provide some interesting heuristics that can help make the most of application investments and/or dependencies…

…gotta go, my lasagna bolognaise is coming down the aisle – yum – love that airline food!

Here's a quick example - the Peter Principle

2007-10-16T12:40:00.000-04:00

The Peter Principle

Many of you will be familiar with The Peter Principle. The Peter Principle reads:

"In a hierarchy every employee tends to rise to his (or her) level of incompetence."

Software companies package, promote and sell their products in the same way they promote their employees - to their level of incompetence! This is, by no small coincidence, the direct result of becoming too wedded to product lines.

My Corollary

In enterprise software markets, every vendor tends to market and license its existing products to their level of incompetence.

Of course, product incompetence manifests itself differently than the human kind. It starts out with reduced customer satisfaction, longer sales cycles, increased cost of sale, slimmer margins, and ultimately acquisition or liquidation of the company (which is ultimately the same ending as with the original Peter Principle).

The Peter Principle has many of its own corollaries, all of which have analogs in the enterprise software world.

Case One:

Peter Principle: According to Dr. Peter Drucker, work is accomplished by those employees who have not reached their level of incompetence. Thus organizations are able to function even as the Peter Principle causes some employees to accept one too many promotions.

Sebastian's Corollary: New revenue is generated primarily by lookalike customers, new products and/or custom code work arounds rather than the expansion of existing products into new markets. This does not prevent corporations from pushing outwards from core successes into new markets. In fact, Geoffrey A. Moore calls this the "Bowling Pin" strategy and it is an essential step in "Crossing the Chasm." In other words, from a hi tech marketing perspective, it is an imperative to carefully push a product to increasingly broad applications.

Case Two:

Peter Principle: Employees, as Dr. Drucker points out, do not want to be incompetent, but when management offers promotions that put the employees into their level of incompetence, the employees have no way of knowing that ahead of time. After all, if the offer is made it is because management knows the employee can do the job competently.

My Corollary: In today's economy, with the IT market flat and the expectations set back in the late 90's long since abandoned, the few successful product lines (and the product managers that shepherd them) are under increasing pressure to milk the cash cow to the very last drop. They can rationalize this because they have no way of knowing for sure that the technology has reached its level of incompetence. For example, I would argue that this is how document management became web content management became content management became enterprise content management!

Case Three:

Peter Principle: If struggling with incompetence is a way of learning, then from an organizational or a personal standpoint, it's just a matter of equilibrium between learning and performing. Struggling with outright debilitating incompetence is not the best environment for learning. Getting just the right degree out of a comfort zone to promote growth while avoiding incompetence is the ideal.

My Corollary: Applying existing technology into new solutions should create the same kind of tension and calls for the same kind of equilibrium. The tension is between the marketing imperative to drive toward the bowling pin strategy (or some other management construct - can you say "hedgehog"?) and the suitability of a given product for a new or revised application.

How can you tell if you have pushed a product too far? There are lots of signs, but two yardsticks that have worked for me in the past sound something like this...

You know your application has been promoted beyond its competence when...

The amount of professional services required to install and configure the application is growing rather than shrinking
The performance profile of your application is degrading rather than improving
The ratio between the time between releases is increasing while the number of new features is decreasing

This approach can be extended to application consumers as well - just like you would want to see resumes for consultants assigned to a mission critical project - I would recommend the following be included in an application selection process (in addition to basic functional requirements of course):

Assure yourself that the application supplier's direction is aligned with, but not irrationally wed to, the application being proposed
Recall the Peter Principle for applications - success is not necessarily transitive. Check references like you would a prospective employee - don't just ask about their satisfaction - verify skills and organizational fit.

I have to confess that in my rush to get at least one post out - i borrowed heavily from an earlier column I had authored for The Gilbane Report way back in 2002. The material here is fundimentally different, but if I had not been the original author - this would have qualified as plagerism.

I have not contributed to the site for sometime - but it is an awesome site - check it out at http://www.gilbane.com/. My old columns can be found at http://gilbane.com/columns.pl.

Hello world

2007-10-16T11:46:00.001-04:00

I spend a lot of time thinking about software – and luckily it’s actually something I like to do. What’s being built out there? Who needs what? Why is this “the next big thing”? What is wrong with these people? …and, I spend a lot of time trying build stuff that has genuine value – which I can loosely define as stuff that changes behavior for the better (people, organizations, whatever). But just how do you move from the aha! moment in the shower to changing the way people work and live?

When most people think genius, they think Einstein. Not to take anything away from The Great One, but I like to fall back on a second class of genius - one inspired, not by Einstein, but by the spirit of Marco Polo. Imagine his wonderment when he first came face to face with Chinese culture -15,000 years of religion, philosophy, science, medicine, fashion, cuisine, etc. Most would have been overwhelmed, but not my imaginary Polo - I envision him thinking, "hmmm, paper money - my friends in Venice could do something with this" or "gee, gunpowder - not just for fireworks." Polo did not invent paper money, understand the principles behind gunpowder, or even appreciate the value that the Chinese placed on them - Polo cherry picked specific artifacts and dramatically increase their value by transferring them across cultures and I would argue that the ability to pluck concepts out of their original context and into new contexts to generate new insights and improved value propositions is truly a special kind of genius. I would also argue that this second class of genius is woefully absent in the commercial software industry.

If this last paragraph was too obtuse – let me summarize it all with a mantra I take with me everywhere – to be effective, your ideas don’t have to be original – they only have to be good.

But what makes an idea “good”? Where is the most fertile ground to harvest these ideas? Without going in to why (at least right now) – my premise is that virtually all interesting and game changing insight ultimately stems from the study of people – how do we interact? how to best manage us in the workplace? how to measure and increase our quality of life? how to teach us to be more self-reliant? etc.

I am not yet entirely comfortable with the blogging format (I am afraid that I will make this read like a column or something) – but for now – I just want to put it out there that if we think of applications as "being people too" – Application Resources instead of Human Resources – we won’t have to be an Einstein to improve both an application's quality of life or longevity – and this will ultimately drive the right kind of adoption of much much “better stuff.”