Priorities

When using any issue tracking software, it's important to know which issues should take priority. Issues that are high priority should, obviously, be dealt with first. Issues of lower priority can wait.

Usually, this means assigning a number to a particular issue, perhaps with a descriptor of some sort. Some go from one to ten, some go from one to seven. They might go from "Must fix" to "Don't Fix". This is, however, not always intuitive. What does a six mean? What does a one mean? Are people just going to mark everything as a 10? Does the description of the issue say "Not a huge priority", but the rank says "Must fix"?

If you couldn't tell, I've had some bad experiences with priority systems.

Solved Problems

Recently, I read an interview with Tim O'Reilly, founder and CEO of O'Reilly Media, Inc., the company that puts out the ubiquitous tech books with the animals on the front (and, oddly enough, a great cookbook). O'Reilly facilitated the open-source movement, as well as the "maker" movement, through publishing technical manuals, and through hosting conferences and summits. In short, he gave us a way to talk about community engineering, programming, and creating in general. A banner under which "makers" can unite.

I consider myself a maker. I enjoy problem solving, especially in concrete ways. When I come up with a website, a service, or even just some snippet of code that people can use (even if they don't), it's a rush. I've written about this "superhero" feeling before.

Not How, But What

A happy developer is a productive developer. That fact should be obvious to everybody who interacts with a developer of any sort.

Developer happiness is affected by a lot of things. The work environment, the projects they are given, their managers, the flexibility of their schedules, and the quality of their tools. This last one is very important. If a developer doesn't like the tools they are using, it's a safe bet they won't be happy, and thus won't be as productive as they could be.

Skipfish

I've recently been contracted to improve security on a couple different sites. One of them has been targeted by SQL Injection and Cross-Site Scripting (XSS) attacks. There was a lot of code to go through, and a lot of possible entry points to secure. I was able to do most of it efficiently, and I felt that the code was very much more secure than it was. However, the site was compromised again.

I was moaning about it on Twitter, and a friend of mine (Twitter) informed me about tool called Skipfish (Google code). It claims to scan sites for security issues, including SQL injection vectors and XSS possibilities. And as far as I can tell, it does so fairly well. It's informed me of vulnerabilities and security issues on this site, and it helped me out with my client's site as well.