Skip to main content

Fire Alarms and Software


Some years ago, I got into the habit of using fire alarms as a metaphor for continuous integration and automated tests. My take was that organizations were always holding back resources to get servers for continuous integration, especially where project funding was provided by the business side. Simple reason: the management didn't really grasp concepts like automated tests and CI. I know that the metaphor doesn't completely fit in many ways, but it's a nice way to communicate the urgency and importance of having this security around. So I started using terms like "security net" and fire-safety to illustrate our need for a build-server.


It also is a handy metaphor when convincing developers to write tests for their code. Many developers fail to see the immediate benefits of practicing TDD, for example, but everyone has the fear of fire, or letting a bug slip by and into production.

I like comparing the team to the fire squad in a small city. The more fire alarms we've got distributed throughout buildings in the city, the bigger chance there is that we will get there in time to put out the fire and prevent any serious damage. For software, the more unit tests we've got distributed throughout the components in the code base, the bigger the chance that any bug-causing commit will break the build, and we can "move out" out and fix it.

Even though a smoke detector is not a guarantee that fire will be discovered in your apartment, having one in every room will drastically increase the chances that fire is detected. You could say the same for unit tests, and stopping bugs from getting into production.

You can use the metaphor to explain some related (mal)practices as well:
  • Having bad code is like having lots of flammable material lying around.
  • You can passively enforce safety by building fire-resistant material. This could be good code.
  • Your production error logs and exception handling are like fire alarms.
  • I might be stretching it a bit far here, but sprinklers could be like fail-early systems. Components that shut down in case of bugs, preventing any more damaging usage.
  • 30% of smoke detectors are said to be non-operating (faulty, batteries, etc). You could use this to explain that your tests need maintenance as well.
Well, like any metaphor, it can be taken too far, so I'll stop there.

PS: A funny thing about apartments here in Germany is that there aren't so many smoke detectors around. I'm sure that there are plenty of smart people who get these for their own safety, but it's not required by law. In Norway you are required to have at least one smoke detector in every house or apartment.

Popular posts from this blog

Encrypting and Decrypting with Spring

I was recently working with protecting some sensitive data in a typical Java application with a database underneath. We convert the data on its way out of the application using Spring Security Crypto Utilities. It "was decided" that we'd be doing AES with a key-length of 256, and this just happens to be the kind of encryption Spring crypto does out of the box. Sweet!

The big aber is that whatever JRE is running the application has to be patched with Oracle's JCE in order to do 256 bits. It's a fascinating story, the short version being that U.S. companies are restricted from exporting various encryption algorithms to certain countries, and some countries are restricted from importing them.

Once I had patched my JRE with the JCE, I found it fascinating how straight forward it was to encrypt and decrypt using the Spring Encryptors. So just for fun at the weekend, I threw together a little desktop app that will encrypt and decrypt stuff for the given password and sa…

Always use git-svn with --prefix

TLDR: I've recently been forced back into using git-svn, and while I was at it, I noticed that git-svn generally behaves a lot better when it is initialized using the --prefix option.

Frankly, I can't see any reason why you would ever want to use git-svn without --prefix. It even added some major simplifications to my old git-svn mirror setup.

Update: Some of the advantages of this solution will disappear in newer versions of Git.

For example, make a standard-layout svn clone:

$ git svn clone -s https://svn.company.com/repos/project-foo/

You'll get this .git/config:

[svn-remote "svn"]
        url = https://svn.company.com/repos/
        fetch = project-foo/trunk:refs/remotes/trunk
        branches = project-foo/branches/*:refs/remotes/*
        tags = project-foo/tags/*:refs/remotes/tags/*

And the remote branches looks like this (git branch -a):
    remotes/trunk
    remotes/feat-bar

(Compared to regular remote branches, they look very odd because there is no remote name i…

Managing dot-files with vcsh and myrepos

Say I want to get my dot-files out on a new computer. Here's what I do:

# install vcsh & myrepos via apt/brew/etc
vcsh clone https://github.com/tfnico/config-mr.git mr
mr update

Done! All dot-files are ready to use and in place. No deploy command, no linking up symlinks to the files. No checking/out in my entire home directory as a Git repository. Yet, all my dot-files are neatly kept in fine-grained repositories, and any changes I make are immediately ready to be committed:

config-atom.git
    -> ~/.atom/*

config-mr.git
    -> ~/.mrconfig
    -> ~/.config/mr/*

config-tmuxinator.git  
    -> ~/.tmuxinator/*

config-vim.git
    -> ~/.vimrc
    -> ~/.vim/*

config-bin.git   
    -> ~/bin/*

config-git.git          
    -> ~/.gitconfig

config-tmux.git  
    -> ~/.tmux.conf    

config-zsh.git
    -> ~/.zshrc

How can this be? The key here is to use vcsh to keep track of your dot-files, and its partner myrepos/mr for operating on many repositories at the same time.

I discovere…

Joining eyeo: A Year in Review

It's been well over a year since I joined eyeo. And 'tis the season for yearly reviews, so...

It's been pretty wild. So many times I thought "this stuff really deserves a bloggin", but then it was too inviting to grab onto the next thing and get that rolling.

Instead of taking a deep dive into some topic already, I want to scan through that year in review and think for myself, what were the big things, the important things, the things I achieved, and the things I learned. And then later on, if I ever get around to it, grab one of these topics and elaborate in a dedicated blog-post. Like a bucket-list of the blog posts that I should have written. Here goes:
How given no other structures, silos will grow by themselves This was my initial shock after joining the company. Only a few years after taking off as a startup, the hedges began growing, seemingly almost by themselves, and against the will of the founders. I've worked in silos, and in companies without the…

Automating Computer Setup with Boxen

I just finished setting up a new laptop at work, and in doing so I revamped my personal computer automation quite a bit. I set up Boxen for installing software, and I improved my handling of dot-files using vcsh, which I'll cover in the next blog-post after this one.

Since it's a Mac, it doesn't come with any reasonable package manager built in. A lot of people get along with a combination of homebrew or MacPorts plus manual installs, but this time I took it a step further and decided to install all the "desktop" tools like VLC and Spotify using GitHub's Boxen:

  include vlc
  include cyberduck
  include pgadmin3
  include spotify
  include jumpcut
  include googledrive
  include virtualbox

If the above excerpt looks like Puppet to you, it's because it is. The nice thing about this is that I can apply the same puppet scripts on my Ubuntu machines as well. Boxen is Mac-specific, Puppet is not.

It was a little weird to get started with Boxen, as you're offered…