Bill Li

Move

Posted Wednesday, July 29, 2009 1:20 PM by Bali | 0 Comments

My PM talk in SJTU

Finally, I delivered my first talk. Kind of excited, you can imagine. :-)

PPT can be found @

http://cid-0c5963e0b1a0be5d.skydrive.live.com/self.aspx/Public/PM%20Talk.ppt 

Let me know what you think of it.

Update 7/30/2009

This post has been moved to http://www.balionweb.com/my-pm-talk-in-sjtu.html

Posted Tuesday, June 02, 2009 12:44 AM by Bali | 10 Comments

If I were designing a new email service, I would…

All great designs come from deep understanding to customers. In my case, I'd like to design the email service for information workers(IW) as I am one of them. Basically they are hired to get things done. Modern projects, or tasks in smaller granularity, are getting too complex to be accomplished individually. So people have to work together – we call it collaboration. Consequently they have to communicate. They are forced to communicate. Email solves the problem of logistics and synchronization so that communication could happen between different time frames and locations, so it is still indispensable currently. But it is far from perfect, sometimes it is a trouble. Can it be done any better? Let us have a try. This new thing is called Pmail.

Entities

First of all, let us keep in mind that tasks are actually what IWs really care about. They are much happier if they can complete assigned task without touching emails. Right? Completion of tasks is what they are trying to achieve. Second, when they have to communicate, they care about distilled information they are expecting while writing/reading emails. You will not get any additional credit through presenting your idea by writing a poem. Senders and recipients come last. Without them, communication can't happen. These two entities get lower priorities because if distilled information can be gained by other means, say search engine or anonymous DL, who cares them?

Again - email for IWs is all about tasks, not messages. This is the most fundamental philosophy differentiating Pmail's design from others.

Problems - an abused tool in workplace

By nature, current email systems allow one sends anything to any number of persons at anytime anywhere. Gradually it turns out true that something that can be anything can do nothing actually. Theoretically any email should be of your interest; otherwise sender will not send it to you. Realistically it is so easy to be over-used:

• Email overload. You might probably find everyone around you is complaining about too many emails. Doubt? Open you email clients, see how many unread mails you have. NY Times reports, E-MAIL has become the bane of some people's professional lives. This occurs likely because of complicated job nature, but I'd say often it is actually because of poor email prioritization. Can you easily tell which email is much more important than others? Or emails tell its priority to you?
• Hard to map emails to one's day-to-day jobs. How many times you have to search your emails to dig certain messages out because you need something?
• Mail thread discussions often go wild. Do you find you are in trouble figuring out what is going on when suddenly looped in a thread?

At a glance

Pmail's primary design goal is to help team get jobs done efficiently – under right timing, priorities, order and resources. Everyone would have a clear picture about how his work contributes to team success.

Pmail would also aim to minimize communications as much as possible. Leave users alone please. In task-centered email design, all emails will fall into one of below four categories:

Building Global Development Team

Nowadays software is getting so complex that it needs incredibly more and more people to build it. For example, there are 9000 engineers working on Vista simultaneously. In certain sense, you can call that it is a labor-intensive industry. Ideally, it would be best to put all people in one place; however there are also lots of sound reasons to build global development teams.

Pros and Cons

Why bother to build global development team?

• New talents pool – Software development needs so many persons with similar attributes. In Microsoft Company wide, top 3 hiring criteria are smart, passion for technology and fit to company values such as openness, continual self-improvement and mutual respect, etc. From various studies, supply of talented IT staffers isn't keeping up with demand. And it won't change anytime soon. Even when Microsoft is cutting 5000 jobs now, we still have another 2000~3000 job openings there. What to do if enough qualified hires can be not found within US? Go outside.
• Lower cost – let us straightly go to data. Annual pay for Level "59" is about $74,000 in US, while same level is paid about $20,000(~RMB150K equally) in China. Another slight fact - It costs about $1.5 to go most common places in Shanghai…
• Close to market – Most innovative ideas often comes out of interactions with customers. And customers' requirements vary from country to country. So best way to serve a local market is to be in the market.
• Specific knowledge – Cross-nation acquisition for specific technologies is another reason to build global development. You can't(or not able to) move all folks to HQ.

Like many other things, challenges always go with benefits hand in hand. You can't take only part of it. Fair enough.

1. Distance – People who work on the same software can't work alone, they have to exchange information and make decisions. Less than 3 minutes conversation is often enough for slight but frequently arising communication needs, for example, "Could you show me the bug in your environment?" Distance makes it impossible to stop by one's office. Network bandwidth is another issue introduced by distance. Why it matters? Suppose one team has to copy large file sets from another remote team daily, it would be a problem. The file sets can be growing amazingly big – for example, daily SQL Server build is about 300GB.
2. Time zone – Would communication a real headache since modern technologies such as email and telephone have been there for quite a long time? But the things are no one is there when you are working due to time zone. You have to wait another day to get an email response. When you rush to office to check it, the most frustrating but concise reply could be - "What do you mean by <insert anything you assume others should understand>? How can I help you?"
3. Culture/Language – Master level of English is unbalanced in global teams. There are dozens of ways to say "A beats B" in English, but only several of them are understandable for general public; dialect is another obstacle. For example, Chinese folks often have hard time pronouncing letter "L", as a result, words like "girl" might sound weird sometimes.
4. Junior team – In my organization, most hires right come out of college. We are raw smart, but less experienced. It is hard to deny that some key ingredients for great engineers just take time – design skills, debugging techniques, influencing capabilities. This is not a cutting-corner example.
5. Conflicts between hierarchical management and local branding – By organization hierarchy definition, many business units have existence in China. STB, Live, Online Service, etc. They functions nearly independently of each other and reports to US. But from the perspective of customers/partners/talents, it looks a bit confusing because there are so many Microsoft's. 
6. People development – folks in remote sites are not equally exposed to development resources such as face-to-face training, library, mentors, etc.
7. Governing issue – due to well known concerns, something confidential can't be moved out of US.

How-to

There are several factors playing critical role in deciding appropriate distributed development model. At least you should consider project type, team seniority, team size, team culture, communication cost and history.

• Build trust first. No matter how adaptable a new team is, it always takes time to fit into a specific team culture. So starting with easy jobs to build team moral and credibility is the safest steps before moving forward. Beyond this, the new team can target increased ownership.
• Decide on team coupling level. From highest to lowest, the level could be: pseudo random assignment, same branch same feature/component, same branch different feature/component, different sub branch but same main branch, different main branch & clearly defined data contract. Avoid circular dependency.
• Come up with communication plan. Minimized communication is not always the best, especially for relatively junior teams. The best way to develop people is to work with senior folks on daily basis as much as possible. So you have to make tradeoffs here based on various inputs.
• Shared lab if possible. If you have to copy large files across the ocean frequently, consider doing your job on a lab down in remote team. If you have to do copying, make sure the files meet most critical quality requirements before doing so, for example, a build verification test.
• People development plan. Regular staff exchanging plan such as Marco Polo and Silk Road program, getting a mentor, record trainings, etc.
• Local brand management. Externally shown as one image; internally run by functionality as usual.

Posted Saturday, March 07, 2009 5:58 PM by Bali | 1 Comments

#3, Hulu, Why?

Fast Company recently published its version of the world’s top 50 most innovative companies. Although I would question why Intel is among top10, what surprised me most is the fact that Hulu is listed #3.  I know there might be political things about the particular order, as it goes with most ranking, but it would be also interesting to find out “why Hulu, not others”.

Origin

Hulu, an online video streaming company, managed to do something which YouTube failed to do. Copyright is one of YouTube’s headaches, but it is incredible positive thing for Hulu, because it is built intentionally aimed to server property content by two major stream media dogs, NBC Universal and Fox.

{YouTube, watch someone’s DIY video} VS { Hulu, watch TV & Movies online legally} -> Similar but different market niche.

People might be asking, why NBC and Fox executives don’t rely on YouTube to serve their plays? You can imagine following conversation which probably happened behind the scene:

This is the first site who delivers property video to your computer for free.  Traditional Media Company gradually realized that they have to embrace the changes if they are not able to prevent them. It is online streaming, in this case. Hulu has more than 120 sources now.

Key is property content sources are nonrenewable rare resources.

Independence

Hulu’s CEO said to capital angels, “I don't think you'll be seeing the name Fox or NBC on the site hardly at all, Hulu is about the shows, not the networks. The shows are the brands that users care about." Another quote, “the key to Hulu's success is its freedom to operate essentially as a stand-alone company…”

From startup’s perspective, captical can be good thing, or bad thing. It can help you grow much faster, but it can also easily enable you miss your initial goals. Capital often appoints some seemingly smart guy, who is with XYZ MBA degree or n years of experience in ABC company, to take over the company as one of its investment agreements.

That is indeed one of the worst investment risk controls, although it happens again and again. Give money to most passionate guys, and letting them be passionate always is the only way to maximize the probability of getting most out of your investment.

Feature?Solution? Experience!

Question: If you are given a task to build a video streaming site within less than 3 months, what would you do?

We were taught this way:

1)      Identify who will be using your site

2)      Draw use case diagram

3)      List scenarios for each user role

4)      To support each scenarios, figure out needed features

5)      Design/Code/test your features

6)      Go live

7)      Yeah! Party! :- )

If you follow this in your next interview, I can almost guarantee a pass. Do we miss anything? Actually we missed most critical one – Experience! Experience is a combination of brand/feeling/easy-to-use/enjoyable process. For example, given below requirement:

"Design something which is used to sit on, commonly for use by one person. It often has the seat raised above floor level, supported by legs."

People will respond immediately, "Chair!". You may notice that there are at least hundreds of types of chairs in the world, if not thousands of, if not millions of. Only most imaginative ones who deeply understand that particular set of users’ needs, care about their feelings and eventually apply those into product designs can do the best work. Let us take a look at "art of chair".

Be COOL, in show time, although you might have the similar hard time figuring out what some of them really are. :-) Just like someone said about iTune – “iTune is not selling features. iTune is selling experience.”

Hulu’s key experiences:

1)      Simple

2)      Larger screen

3)      High-resolution video

4)      Clutter-free

5)      Quality control

6)      Free to users

7)      No download

8)      Obsessed with users

Posted Monday, February 23, 2009 4:10 PM by Bali | 1 Comments

Lead Without Authority

As to the complexity level of problems, developers in Microsoft, who deal with coding, are probably taking one of the most challenging jobs in the world. But another engineering role, program manager, is not easier in any sense. Before I explain why, let me illustrate what typical product teams look like.

In the diagram, group manager often runs a team owning individual components or feature areas, say, one spell checker DLL in office; a product unit manager owns a product, say Outlook; while a general manager runs a product family, say Office. One compelling advantage Microsoft possesses is that its products are designed to work together seamlessly. For example, in a recent CIO.com article, 10 Reasons to Use Microsoft Outlook for Your Company's E-Mail, 8 of 10 points is actually about interoperability with other software.

Managers define strategy, Developers write code, testers test code, what do PMs do? Well, it is really hard to define - there is even no consensus within Microsoft. However, one thing is clear – PMs do anything except coding(unless they have to :-) to drive projects meeting strategic goals. Enable right things get done right. Figure out gaps and fill them. The role is something like concrete among brick walls. (cartoons on the right)

If you take a look at PM's position, blocks with black bold border, in the organization hierarchy, you will get the challenges here. PMs are supposed to lead their peers to work towards the right direction.

"You are not my boss. Why do I have to listen to you?"

This question gets down the topic of "Lead without Authority". Before you read along, I have to clarify that I am not a PM expert, but I (0) I've been a PM for quite a while, (1) work with great PMs, (2) learn and try most fundamental things which work well, (3) I faced similar situations for many many times, either in schools, or various organizations. Here is my sharing.

• Charisma. You might be incredibly raw smart – you can optimize an algorithm from O(N*N*N) down to O(logN), or you might be able to design a system of .9999 availability, extremely secure, and super cheap compared with competitors… That doesn't mean you can be a good leader. Instead, many of the best leaders, however, will point to the fact that they were "C" students(From Source). 
• Credibility. It is the key to make people follow you. It works like stock value – hard to build, easy to lose. Be careful of it always. Do right things right. Bring something valuable to the team. Your credibility will accumulate gradually. Do what you say, and say what you mean.
• Consistency. People hated to be randomized. Don't always change directions. Clear goal.
• Partnership mentality. Low ego.
• Help others great. Most influences are indirect. People often complain about "over-managed, but less supported". (Check out photo on the right)
• Lead by showing, not lead by talking only. Get your hands a bit dirty. Leaders should be willing to do anything they tell their reports to do. Show domo, mock UI, prototypes to other when presenting a new way to do things.
• Has sense of people. Most basic thing is How to Win Friends and Influence People. Learn to inspire people. Always be positive in every aspect.
• Communicate. Communicate. Communicate. Listen. Ask questions. You can be introverts, but have to be proactive. Be transparent. Understand your audience – strength, weakness, style, and figure out most effective approaches.
• Relationships enhance communication. Invest time in talking to people interactively. When you need to request advice, an opinion, or a task, you can talk to people from a healthy and positive place.
• Sharpen your vision. Look around. Look ahead. This helps in making sound decisions.
• Start to drive teams with strong pseudo leaders
  • Talk to them especially leaders or submarine leaders, get to know what are their likes/dislikes, Ask: How can I help you guys? Win their support.
  • Build credibility. Bring something invaluable to the team, for example, build up strong relationships with a partner team, present a competitor research report, improve team visibility
  • Before making changes, present it to the leaders in private, say 1on1, to reach rough consensus before it goes public.
  • Help others great. Let them get the credit.
• Conflict Management
  • Focus on goals, not conflicts themselves. Not a question of smart or dumb. 
  • If you can control your emotion well enough, 25% of conflicts will go away.
  • Overwhelming majority of conflicts is just because of perspectives and different values. Try to figure out stories of other people's side. People often come to the same solution when presented same set of information. Use negotiation tips. Keep win-win in mind.
  • In worst case – when you have to resolve unavoidable conflicts, say 5 pies for 10 kids, make sure put a fair decision-making system in place, which is often a engineering way.
• You can reward desired performance even without authority
  • Promotions, raises, bonuses are not in your list, but you can affect them in indirect ways
  • Fame. Complimenting an employee on a job well done at a staff meeting or in front of company officers can be extremely rewarding
  • Increased trust. For example, give top performers the freedom to work in a more self-directed manner.

Posted Friday, February 20, 2009 3:56 PM by Bali | 1 Comments

My AD Fun Experiment

Today I got a mail from lakequincy.com, saying:

“Hi Bill,

I noticed that you were never able to plug the Lake Quincy Media ad tags into your site. Are you still interested in earning revenue from displaying ads targeted to Microsoft developers? If so, you can get your tags from here: <certain link> 

Let me know if you have any questions or if you’ve decided against running the ads and I’ll set your account to inactive for you.”

I even forgot that I resgistered in their site. To encourage such great customer service, I go ahead to try how the AD really works for me; finally decide to put a small square in the side bar. You can easily find it now if you scroll down a bit and pay attention to the left side bar. Let us see how many dollars I can make after one or two quarters. By putting an AD to the blog, it looks more of-the-business, doesn’t it? Of course, you can bid for that AD position. :- )

Update(2/26/2009)

The AD is disabled temporarily due to security alert.

Posted Wednesday, February 18, 2009 11:28 PM by Bali | 2 Comments

P2P Backup System w/o SPOF for Work Group

This is also one of my half-completed ideas years ago. It was recalled recently by two stories:

Stories 

#1: One of my team mates lost his Outlook email archive due to a mistaken operation. He is very upset because all of his emails in past two years are gone, unrecoverablly. Suggested Outlook mail file is 2GB, but people can easily drive it up to 10GB and often notice this too late. As what he said in MSN signature, “my archive, 555…”

#2: While I was browsing one of my favorite bloggers – Brad Abrams’s blog, ran into a shocking post, Help! My hard disk crashed. He can afford a new disk, but he need the data – especially “the pictures of the kids recent birthday party”. In the comments, people suggested various ways to recover it, unfortunately looks like no luck.

This leads to the most basic questions: why people don’t backup data even if they know they are in the risk of losing them? Probably because of:

1)      The chance is very tiny

2)      Current backup solutions are not “good enough”

For 1), although it might be true, but remember the result might be cataclysmic. Let us take a look at what is going on about 2).

Existing Backup Solutions

Traditional C/S – Most of current backup solutions are based on traditional C/S architecture. Assume one use 40% of 500GB disk drive on average; it is still a big capacity for enterprise with thousands of staff. Backup time is also another concern. Let me illustrate this with some math. For a backup server with two 1-Gbit NICs, its max throughput is about 200MB. If backup window(people are sleeping) is 10 hours, it means it can back up about 7.2TB(2*100*3600*10MB) data. Obviously it is hardly scalable along with business expansion.

Online backup – People can turn to AWS S3, or Azure SQL Data Services to simplify things on their own side. But this doesn’t make things even better if you look at current network speed. Calculating data is much easier than moving data around.

My P2P Backup System

p2p backup comes with several inherent advantages in handy:

1)      No additional hardware expense. People often have at least 30% capacity left; we can leverage that for backup space.

2)      No obvious network bottleneck.

Some people might also list “no single point of failure”, but that is not true. Let us take a look at how BT works, a general P2P network.

Basically here are what happens in P2P network - peers need talk to a central coordination server(i.e., Tracker in BT system) to get info about other peers, and then talk to individual peers about real data exchange. These two steps are essential. Single Point of Failure(SPOF) can happen in the coordination server. You may argue that you can enhance its reliability by techniques like mirroring, but does it look like over-heavyweight? We have many reliable services running by full time IT guys, why do we bother to re-invent the wheel? Several services can be utilized, such as AD, Sharepoint, exchange, which allow customized data writing. Data needed written into a central place would be:

1)      Peer list by <IP, port>

2)      Other meta data such as backup network name, Software RAID level

Of course, we need do compression, encryption, incremental backup, scheduled backup in the solution. I may do investigation later and update the post.

Also see other backup solutions

http://www.storegrid.com/index.html - select a folder, then backup, traditional

www.streamload.com - Large net disk, Upload your files to streamload, then view it, or email it to someone else.

http://www.beinsync.com/ - Access you computer: install a mini PHP web server onto it.

http://base.google.com/base/about.html - In about 15 minutes, your item will have a unique web address and be visible to the world.

Posted Sunday, February 15, 2009 11:23 PM by Bali | 2 Comments

Memory Leaks Demo & Detection in .NET Application

Memory leaks are always headache of developers. Do .NET developers no longer bother to worry about memory leaks because of garbage collection? Yes and NO. GC periodically find objects that cannot be accessed in the future and then reclaim the resources used by the objects. GC achieves this by maintaining a list of references to live objects. When this mechanism is broken, memory leak happens.

There are many reasons to leak memory. In addition to calling unmanaged code from managed code, another one of general cases is about event handler. If you do this:

     Foo.FooEvent += new EventHandler(MemoryLeaksHere.Method);

When you complete using MemoryLeaksHere, but you are still using Foo, then MemoryLeaksHere will still remain alive as well. MemoryLeaksHere object will leak memory as a result of failing to GC.

Let us take a look at one simple example first.

In MemoryLeaksHere object’s constructor, Foo starts to hold a reference to MemoryLeaksHere by registering event handler. In MemoryLeaksHere.TryQuit(), if we don't unregister, memory leak will happen.

To be more intuitive, you can copy/paste sample code to VS2008, and then enable unmanged code debugging by following:

Project->Properties->Debug->Enable Unmanaged Code debugging

Now set a breakpoint at “Check memory leak here”, and start build/debug. When being asked leak me or not, you can choose either yes or no. For example:

Here, looks like we leak two of them. Finally app will hit the breakpoint and stop. At this point, we can go to VS immedate window to load sos.dll, and then check how many objects in the heap:

So now we know there are two object instances are not recycled. Why are they not GC-ed? Because someone has a reference to them. Choose one of them, and use gcroot command.

Now we can see that MemoryLeakSample.Foo is still referencing MemoryLeakSample.MemoryLeaksHere via event handler. If it is not 5 iterations, image what would happen if every incoming request results in a slice of memory leak... Soon or later, you online service will be down.

See also:

http://www.codeproject.com/KB/dotnet/Memory_Leak_Detection.aspx

http://blogs.msdn.com/jgoldb/archive/2008/02/04/finding-memory-leaks-in-wpf-based-applications.aspx

http://blogs.msdn.com/calvin_hsia/archive/2008/04/11/8381838.aspx

http://www.automatedqa.com/techpapers/net_allocation_profiler.asp

http://blogs.msdn.com/greg_schechter/archive/2004/05/27/143605.aspx

Posted Wednesday, February 11, 2009 12:32 PM by Bali | 8 Comments

Designing Your Own Recent Posts Widget for MSDN Blog

In my MSDN blog, I need “Recent Posts”, but I don’t need archive side bar. After having played with template for a while, still no luck. Hmmm, looks like I have to DIY it. Fortunately in News sidebar, you can fill in raw html including JavaScript. Then next question is where we can retrieve post tiles. The immediate idea is from current DOM document. Through experiments, I found this is impossible because the DOM is not fully loaded yet when the script is executed. Later, I figured it out that all posts title can be gotten from RSS. For my blog, the address is http://blogs.msdn.com/bali_msft/rss.xml. One thing worth noticing is the fact that RSS in MSDN blog is not up to date - Your post will not instantly appear in the RSS. After I get all posts in RSS format, things became much easier. And then I go ahead to add more interesting things:

• Posts background use two colors in turn
• Show a new tag for posts less than 3 days old
• Show latest 8 posts only
• Show posts' age

So, the final thing will look like this:

Posted Saturday, February 07, 2009 9:42 PM by Bali | 1 Comments

Searching For a Number in Shifted Sorted Array within O(log(n)) time

Run into the algorithm problem long time ago. Now post my answer here. A sorted array, say: {1,2,3,4,5,6,7,8,9,10,11,12}, do right rotate through carry unknown times, and then it might become: {6,7,8,9,10,11,12,1,2,3,4,5}. Now we need get the index of a given number, say 4, from the array within O(log(n)) time. Apparently a 8-year-old can get it done with O(n) time.

We can think of it this way: take the middle element of array, if target is found, fine; if not, and then array become two parts, one is sorted array, the other is shifted sorted array. As illustrated as below diagram:

If the target falls into the sorted array half, we can simple do a binary search; otherwise, repeat this operation in the other half in recursive way. You can see this is divide-and-conquer algorithm. Obviously this is O(log(n)).

Code

Test cases

 One more interesting thing is the statement that “only about 10 percent of the professional programmers implemented binary search correctly.” Do you know why? Check this.

Posted Tuesday, February 03, 2009 11:50 PM by Bali | 1 Comments

To Next Cuil

Cuil, another so-called Google killer, is at its last gasp. I just knew it. I am not predicting present. Cuil is not the first one, and apparently not the last. For upcoming cuils, here are my words.

Brand. Brand. Brand.

For many people, word of Google has close sentimental connection with bunch of splendid words such as cool, innovation, unselfish, impartial, revolution, and powerful, etc… With brand, Google claims that “People don’t work at Google for the money. They work at Google because they want to change the world!”. With brand, debut of Google’s every new service always arouses buzzes, but seldom notices that Live also has compelling equivalence. With brand, people think only Google can provide best results, but often they can’t tell who is search provider when presented anonymous results set. It is very interesting to take a look at curve of Cuil’s daily unique visitors:

At launch momentum, people rushed to see what this Google killer looks like because of Google’s brand. Ridiculous? Not actually. It is everyone’s inherent attributes as people love to check out events of small probability such as Shoes thrown at Bush, one crazy million-dollar idea. As part of branding strategy, naming is essential. Cuil might not a good name actually. Let me share a story of mine. Back to several years ago, a group of my friends decided to build a website aimed to provide 3^rd service for franchising, called JiaMeng in Chinese. The guys with solid academic management background came with the domain name of 51franchise.com. It turned out a real trouble – hard to explain to customers, not localized. Even ordinary college students don’t know the word franchise, not to mention clients with much less schooling. So, ditu.live.com for Chinese is much better than chinamap.live.com if you take a look at average education level of internet users. All in all, BRAND works like religion, and it takes lifetime to build.

"A Google approach to email" - see how brand helps product marketing.

Infrastructure

 GFS. BigTable. MapReduce. They can be competitive advantages. With these put in place, Google can roll out new internet services faster, cheaper, and at scale at few others can compete with. They are designed solely for Internet services. Users quit quickly after dissatisfied performance experience in Cuil. Microsoft software is mainly for an enterprise, supporting 100K concurrent users is “good enough”, but it is far more perfect in internet scenario.

Culture

Per Wikipedia, culture means the set of shared attitudes, values, goals, and practices that characterizes an institution, organization or group. Google’s business is built on top of internet, so its organization/knowledge base is built for the internet, just like Microsoft is built for software, mainly enterprise software. I met strong feature PM with deep knowledge needed for enterprise software, say reporting, admin UI, DB admin UI, and information work flow. They understand their customers so much after years of interactions with them. It takes time to accumulate. Top-down hierarchy, heavyweight development process, years of in-house development can hardly catch up with the pace of internet evolution. The same thing is applied to Google – I am equally not optimistic if Google step into enterprise software because of the same reason – culture, enterprise’s DNA.

Web Competition Strategy

What is Cuil’s selling point? (1) Fancy UI. UI is critical for adoption and usage, but it hardly provides a moat. This is provided by two case studies of Apple computer of the nineties and the “X window” system on *nix OS. Both these systems with more attractive UI couldn’t beat windows OS with lower cost and rich applications available. (2) More relevant result. This is an ambiguous area which lacks of widely accepted measure criteria. (3) Cheaper solution. There is a question of sunk cost, of course you can claim you are 1/10 cheaper once reaching Google’s current scale. None of these is compelling from users’ point of view. Why do users bother to go to your site instead? One of the significant differences between web service (say, search) and traditional software business(say, DB) is purchasing decision making process. DB vendors can send to salesmen to target customers’ office and argue the deal. Only quite a few key persons have the final call. They are more analytical, love data. As comparison, everyone can be customers of search, we are more emotional. If I don’t miss anything, looks like the best strategy to monetize Cuil is to be acquired by Google.

No chance to win in search?

Definitely No. But you are doomed to fail if following essential parts are missed:

1. Remember brand. Remember “winners take all”.
2. Build your DNA towards internet. DNA = SUM(people, team arch, process, knowledge, …)
3. Put infrastructure in place. This is the way to help turn your idea into profitable traffic. Not scale-up, scale-out instead.
4. One thumb rule to compete with dominant market leader
• Avoid playing games whose rules are set by opponents. You can hardly win. In this case, better search engine defined by Google are faster, relevant results, simple UI, magic algorithm, PB of data, … Let us think of solving same problems with different approaches. Why search? Help explore and share information. If someone tries to solve this problem by following Yahoo’s tail light to build yet another portal, he has little change to take off. Another example is download - P2P technology solved the download problem without adding more expensive servers/bandwidth.
• Attack opponents’ weak points. Google is designed to search everything, but it may not be good at all vertical industries, say shopping. Nibble at its market share if we can’t win in head-to-head way.
5. Before rolling up sleeves, why we have to win? Why not step away and go find next big thing? Let Google be Google.

Posted Monday, February 02, 2009 4:02 PM by Bali | 3 Comments

Principles for Building Secure Database Applications in Action

What I am talking about in this post might be well known to many people(too simple, sometimes naive?), but often most basic things make a difference. OK, get down to business. Thumbs rules for DB security might be:

• Define your security boundary(or attack surface)
• All input is evil! Evaluate them with whitelist
• Don't store blank password, even hard-coded in the source
• Put DB in a dedicated server and access it with accounts with least privilege
• Put connection string in registry and read it out from code
• Use stored procedure
• The attacker is told nothing
• Save your resources
• Specify least assembly permission requirements with attributes

FxCop is obviously a “must-have” for .NET developer, but we have to eliminate complaints one by one. Instead of remembering all “bad behavior” in various tutorials, why not make them our built-in features towards great developers? (if you are still developers, why not much better? ) Let us put most significant principles into simple sample lines of code. Pay special attention to highlighted words.

The data in registry key is the connection string.

In stead of storing plain text, we can encrypt above connetion string. Keep in mind that I don’t say that they are necessarily the best choice at all times, but many times they are. 

Reference: Write Secure Code

Posted Thursday, January 29, 2009 11:10 PM by Bali | 2 Comments

Happy New Year of the OX!

Hi, my dear friends, Happy New Chinese Year! First of all, a small quiz to you:

Can you guess what it means? Let me explain it a bit. The pic is actually a Chinese word 福 written in a piece of square-shaped paper, and then rotate 180 degree. 福means happiness, “stand-upside-down” and “come” have the same pronunciation in Chinese. So by putting them together, the pic means my best wishes to you. Do you get it? J

During the holiday, I ran into a wiki page saying that the world cattle population is estimated to be about 995,838,000 head. How do they get that number? That is next challenge to you.

I will post my answer when I get one moment.

Posted Wednesday, January 28, 2009 12:17 PM by Bali | 1 Comments

An AD System to Pay Content Generators

Back to not too long ago, I had a half-completed advertising idea related to social shopping. Now I post it here to collect more feedbacks. I call it HappyDog. (Just a name, not related to that DogFood widely used within Microsoft J)

Problems

As everybody knows, ‘YOU’ is named Time’s person of 2006 for the growth and influence of user-generated content on the internet.  Why? In Wikipedia’s words:

“… chose the millions of anonymous contributors of user-generated content to Wikipedia, YouTube, MySpace, Facebook, Digg, Second Life, the Linux Operating System, and other providers, as Person of the Year, personified simply as You.”

But on the other hand, if we carefully think of people’s motives of generating contents we can easily find that people do this mostly out of curiosity, self-achievement or volunteerism. Problem #1: Per basic economy principles, these efforts can hardly stand long. Content quality is another downside in such circumstances.

Another awkward problem around current most successful business model, online ad, is the fact that people get tired of spammed AD when they use certain online service for free. Problem #2: But interesting enough, people often have trouble in making the right purchasing decision given even exposed to so much AD, probably because: (1) AD timing is not good, (2) they don't trust the publisher, (3) AD is not carefully targeted. This looks pretty twisted, doesn’t?

At a glance

Taking above problems into consideration, HappyDog is an innovative advertising system which provides following unique values:

• For general content generator – get cash paid by sharing your experience with the world, even if you does not own a website.
• For shopper – make your shopping decision more smartly
• For business, either online or offline – market your product more directly to the most potential customers

Let us take a look at below diagram first: