Do and Dont's while getting your Home Renovated

DO's

1) Ask for a 3D design of the interior design

2) Look at actual laminates / colors and choose accordingly rather than rely on the render.

3) Things will not always go smoothly while implementation compared to the design,  some changes need to be done at site. Be patient and ask for all options / suggest some.

4) Ensure you have a maintenance clause in your contract for a year / two for defects.

5) Find a renovator who many not very very popular but has a decent track record of delivering projects on time and with good quality.

6) The popular renovators tend to pickup up more projects than what they can chew and end up spreading their workers thin, hence delaying delivery of the project.

7) You may need to co-ordinate worker's coming in and going to an extent, this is an overhead but will ensure things happen smoothly and under your watch.

DONT's

1) Find a designer and renovator who can work with max 40 - 50 % upfront payment, do not make all the payment unless project finishes to your satisfaction.

2) Dont get angry, this does not help you think straight.

The danger of outbound connections + insider threats

[WhiteHat]

I was working over the weekend to have my OrangePi PC (hence forth will be referred to as SBC) that sits in a DMZ on my network serve dynamic content. As I don't own a public ip. I resorted to having pwncat + AWS EC2 instance work for me to get me a http connection as well as reverse shell on my SBC.

And that got me thinking....

Over the years we have seen an increase in the importance of IT security. Its a welcome change from the simple firewall rules and default security settings that were once the standard.

One area which still does not get much importance OR even if it does, is not heard about or discussed much is the threat of outward connections and insider threats.

Run such connections over port 443+https and you have a connection that is usually very difficult to trace.

Exploiting an insider / piggy banking this using a trojan and you can very easily get into  a secure network and then work your way to elevating your privilege's on a host / expanding your footprint to further hosts.

The solution: HTTP inspection/SSL inspection, but it has its limitations and you can run all sorts of tricks to go around this. eg: Don't use SSH, instead run a http server that can accept specific keywords and perform tasks.

I hope to see much more organizations use an inspection solution so that this threat can be mitigated to quite an extent.

An unconventional way to prioritize work

Let me start off by saying "One size does not fit all OR everyone". Rock, Pebbles, Sand theory of Prioritization does work for some, but most people do not have a prioritization method at all and even if they do it may not necessarily work for them.

So, lets try something new!

Disclaimer: I know how to use this well and when not to use this method, it comes naturally and has worked very well for me and can greatly boost your productivity, but don't overdo it. Knowing the limits and pros and cons of every method is a must.

1) Lets say you have 3 types of tasks you need to do daily (ignore Impact for now)

Sr. No Priority    Time_Required(each task) No_of_Tasks

1         High          2 hrs                                        1

2        Medium     1 hr                                          3

3        Low          15 mins                                     6

most folks will pick up the the work considering descending order of Priority (High -> Medium -> Low). The reason is psychological, we tend to give a lot of importance to tasks with higher priority.

But is it the best way to do things?

I usually use a reverse psychology trick to get the brain to work more efficiently. The human brain subconsciously always thinks that more number of tasks done = more productive and less time required to think about what else needs to be done / less stress.

Hence I end up usually reversing the order. (Low -> Medium -> High) . Lets see how it helps

By the end of 3 hrs

following (High -> Medium -> Low) you would have completed only 2, tasks, your brain tells you that you still have 8 tasks to complete.

following (Low -> Medium -> High) you would have completed 7.5 tasks, now your brain tells you that you only have only 2.5 tasks remaining.

Even though the time required to complete the tasks is same regardless of order used, you will feel much more fresh and ready to tackle the remaining tasks.

Now what if I change the equation to say that there is 1 Critical task (the highest priority level) that takes 4 hrs. Would you still follow the same method? 

=> This is where I would not use the above process, most likely the Critical Task will take priority for me after which I will go back to (Low -> Medium -> High).

Again; understand the context and apply this method, as eventually we need to "Use the right tools/processes for the right job".

Quick and Lazy Ubuntu Docker Instance with OpenJDK

Java being my language of choice (even though I also know VB, Python, x86 Assembly, JavaScript), I always need a Docker instance with the latest JDK installed. Helps me also isolate my projects and make it deployable anywhere I need.

Contents of the Docker file to create a "Quick and Lazy Ubuntu Docker Instance with OpenJDK"

#Dockerfile starts here

FROM ubuntu:latest

MAINTAINER "Kedar Koppikar"

RUN apt-get update && apt-get upgrade -y && apt-get install -y default-jdk

#Dockerfile ends here

Practical Leadership: Delegate the right way

Delegation is a important aspect of Leadership, it also has a high chance of failure OR at best is done mediocrely without any innovation.

Some Leaders feel that if you just tell your reportee what to do, that is Delegating. Others feel that Delegating means micromanaging the engagement to death. But Delegating is more of a journey and less of a one time explanation.

The right way to Delegate for a Leader which has had a rather high rate of success is 

1) Check which of your reportees may be interested to get this task (eg: someone who wants in move to a management role in the future)

2) Explain the tasks related to the Delegated activity

3) Get the reportee introduced to the various stakeholders and inform the stakeholders of the delegation.

4) Show them how to do it once/couple of times as needed, yet encourage them to follow their own way / customize as needed.

5) Check in from time to time on Progress / solve any concerns. 

• Don't micromanage
• Frequently of checkin should be low to begin with and should reduce further as delegation activity matures.

6) Don't just give the task, give authority to perform the task.

7) Appreciate the reportee for taking up the task in a wider forum.

Docker Swarm or Kubernetes?

 Lately I have had 2 leader's come to me with this question "Docker Swarm or Kubernetes?". Their teams were divided on what to use and I was being asked what is your preference and why?

Firstly: Its good to know that Docker Swarm is finally getting mindshare.

Second: Competition is always good.

Short Answer : Kubernetes

Long Answer : Use what fits well. 

There is no doubt that Docker Swarm is super easy to setup and use and for a small team that just knows Docker and that wants to do a quick cluster of Docker instances. Also there are great Web UI's like Swarmpit and Portainer available that assist with the same.

But "Out of the box" Kubernetes gives you the above and some more but with has some complexity to it.

Eventually Kubernetes is used mostly with Docker containers so some might say that a comparison of Docker Swarm and Kubernetes is not really ideal. And I agree to some extent, when I look at those as products but when I look at an end to end solution they can be compared this way.

But from my perspective the single biggest factor for me to choose Kubernetes over Docker swarm is not a difference in capabilities , its more to do with trained personnel available to manage them as you will find a lot more engineers who know Kubernetes than Docker swarm.

But the lines are blurring between the capabilities of the two with time and I see that may be soon enough we will see them as strong competitor's to each other.

Practical Leadership: Take calculated risks

"Risk hai to Ishq hai"

How often do you see Manager's who are extremely risk averse.  I have had the chance to encounter many such Managers who were such risk averse that things would stay in status quo for years even though it would impact them and their teams every day.

But risk averse behavior is not just a behavior that is exhibited by individual's, I have seen entire organization's being risk averse. 

The culture of the organization is usually to blame. The reasons almost always were

1) If you get retaliated on for the risk you took that resulted in a failure.

2) Processes and Rules discourage any risk taking capability.

So what is the solution?

What you should do is to inculcate a culture of taking calculated risks and train / hire leader's who can not only take calculated risks but also get their reportees to take such risks.

Taking Risks is not bad till the time every possible problem it can bring in accounted for. Always have a plan in case things don't work out. 

Calculating Risk and taking them is not very difficult to work with if you follow these  simple steps

1) Research well on what you plan to do

2) Identify Stakeholder's and how it will impact them

3) Anticipate Mistakes 

4) Set Checkpoints and Goals to measure your changes the risk brings.

5) Be ready to course correct OR jump to an alternate Plan

6) Don't be afraid to cut your losses and revert from the Change

7) Learn from your successes and your failures

8) Repeat

and

Something that is not given its due importance but should be which is to "Learn from other people's mistakes"

and least I forget

Enjoy the benefits of the Risks you took when things go as planned.

FIN

Practical Leadership - ESI before CSI

ESI = Employee Satisfaction Index = How satisfied your employee is

CSI = Customer Satisfaction Index = How satisfied a customer is with your service / product

I had had the unique chance of working with Engineering as well as Support teams where CSI was fairly low as in the mid 20's or lower 30's. There were real issues that needed to be dealt with like

1) Processes too inefficient or too dependent on a single person / single team.

2) Lack of Product knowledge

3) Lack of support from Account Teams

4) Incorrectly set Customer expectations

5) Too little resources resulting in too much work

etc

but one area that would almost always get overlooked was how satisfied the Employee was.

The aspects that got invariably missed out were

Right fitment of the Role

Availability of the right resources

Right Mentors

Acting on Feedback from the team.

Conflict Management

Basic concerns about compensation and allowances

Quality of work (reducing monotonous work)

Good Leaders

Vision of the product

There were instances where despite a lot of changes teams would not go beyond 40% on the CSI score's consistently till the ESI aspects were taken care of. > 70% CSI was very much achievable in most cases after taking care of the ESI concerns.

Hence low CSI could very well be a symptom but the Root Cause could very well be low ESI. 

Moral of the Story: Fix the right problems to get the right results.

There is a 8086 processor in every modern x86/x64 processor

 Quick: Identify what this assembly language code does in a 'com' file on MS DOS

dec ax;

push ax;

push bx;

iret;

It restarts the machine!! But why?

A com file on dos is loaded with the AX, BX, CX and DX registers set to 0000h.

dec ax; --> Decrements AX register by 1, hence turning 0000h to FFFFh

push ax; --> Pushes AX register on to the stack which is FFFFh

push bx; --> Pushes BX register on to the stack which is 0000h

iret; --> Fire interrupt return which will grab FFFF:0000 off the stack and load it up in Program Counter

So what lies at FFFF:0000, a simple google search gives us this

" The reset vector is a pointer or address, where the CPU should always begin as soon as it is able to execute instructions."

Basically the CPU starts running code from the BIOS / UEFI , effectively restarting the computer.

BTW...this is not equivalent to int 19 which claims to restart the computer. Int 19 will most likely in some instances restart your boot loader than restart the x86/x64 machine.

This code was the basis of a shutdown/restart program I once wrote to enable dos based virus scanning.

and

This code works right since the 8086 processor.

Coming Soon...

The Impossible Release

ESI before CSI

There is a 8086 processor in every modern x86/x64 processor

How to Delegate work

Practical Leadership - Care for your reportees

 I still remember once when my Leader called me up as I was driving down to office to tell me that there is a huge crowd of people below the office protesting (my office was next to the Slum Rehabilitation Office) a change in some bylaws; he told me drive down to a different parking spot away from this chaos.

He did not have to do this, he could have simply ignored to let me know and it was not much but it showed my Leader cared. This got deeply imprinted in my mind and today still serves as a reminder as to why I take care of my reportees.

Simple things matter; showing you care matters. 

Today if one of my reportees falls ill, I call up OR drop a message and ask how he/she is doing. If someone's close family member is not in the best of health I ask my reportee to take some time off to tend to their near and dear ones. Fancy gifts, an award from the Office front etc are important, and will act as a short term feel good factor for your reportee  but those will be forgotten. 

What you will be remembered for will be that you genuinely cared, showed them you are human and eventually that's all that matters.

Pinaka - Basic Modules

Pinaka, would have some basic modules that would perform the following activity

DB, Authentication and Authorization and Workflow Layer:

The core of the product, this will run as one binary.

DB Layer: This module will act as the component that makes data available to the Rest API and Workflow for consumption and will use Hibernate to keep the solution DB independent.

Authentication Layer: The authentication and authorization layer , uses Spring Security modules to define authentication mechanisms (OAuth, DB, etc) and define what Forms, Data and Rest API's are accessible to which component/user.

Workflow Layer: Drools based workflow capability that will be fired for 5 triggers when a record is

Created
Updated/Merged
Retrieved
Multiple Records are Retrieved
Deleted

(CRUDM) = Create, Retrieve, Update and Delete operations

the record data will be available for the workflow to manipulate/use.

The rest of the services will run as Microservices

Email Service: This module will provide the capability to send a email notification via a workflow action.

Similarly it will also allow for CRUD operations of data just by sending a email to this module.

This module will be able to perform these actions by acting like a SMTP/IMAP/POP3/MAPI client.

Approval Service: A service that will allow for writing Approval rules to provide for Automated OR Manual routing of approvals based on predefined rules before a state/data of the record is modified. This will use Drools Rule engine  and a Visual interface to define rules.

Assignment Service: A service that determines who a record gets assigned to based on Assignment rules. This will use Drools Rule engine  and a Visual interface to define rules.

Reporting Service: A service that will allow for creating and running interactive reports and allow for export of the same to various targets like PDF, Doc etc.

This will also allow for exporting a report at the specified schedule.

This will use a ODA driver and BIRT for reporting.

Plugin Service: This will allow for writing ones own plugins in Java (and possibly other languages later) that can be called from the workflow engine to extend the capabilities of the solution.

Form and Workflow Designer: 

We would use grape.js to design a Form and Workflow Designer. The use of Angular UI components in the designer to show the final rendered UI will make it easier to have a standards based Designer.

More about UI Frontend and API gateway in the next post.

A minimalist Linux distribution "7KubeOS"

build.opensuse.org is a brilliant service that allows you to build your own Linux distribution based on openSUSE.

Support for X Windows, LightDM and Fluxbox will be added in v0.5.

Try it for yourself

VMWare vmx and vddk files for 7KubeOS 

(based on openSUSE 15.1 Leap)

https://ufile.io/wyb1s2rz

Pinaka, an open source Business Logic and Rapid Application Development platform

Yet another  Business Logic and Rapid Application Development platform!

It is said that "Necessity is the mother of invention", that is certainly true in this case.

One of my friends who runs a startup and has an Application that allows Medical Staff and Patients to schedule an appointment with a Doctor and provide real time information on delays in the appointment times has a been a boon for people who are busy as well as makes wait times bearable.

The other day a conversation with this friend went like this

Friend: Software Development requires time and is costly.
Me: But as you using Java + Spring Boot + React, that should be easy (that's the developer in me speaking)
Friend: Writing an app is Java + Spring Boot + React makes it  easier, but still it not easy enough as well as costs quite a bit.
For a small startup like ours its a big pain on the path to profitability.
Me: Have you tried Sales Force OR BMC Remedy.
Friend: Those solution's are very costly and require substantial training.
Me: What about Business Process Management tools, may be the open source ones?
Friend: It takes care of the cost, still have to learn a lot.
Me: hmm
Friend: I need something that is easy and open source at the same time, setup time should be minimal and should be intuitive enough. Yet powerful enough to allow us to write our business logic.

Thus was born this idea.

A Open Source Business Logic and Rapid Application Development platform that will be extremely easy, be usable on most OS's and Open Source yet not sacrificing flexibility or power.

Thus Pinaka was born.

More in my next post.