Lessons Learned From Going on My Own

I have been "on my own" as a freelancer for the last 2.5 months and I wanted to record some of the lessons and observations I have had in that time. My situation is a bit different (although I am sure I am not in an absolutely unique situation) than from what I have read in related articles. First off what makes mine a bit different? Two things:
1) I was moonlighting for the past 5 years so I had time to build up some recurring clients
2) I focus on development and application security (instead of one or the other)

So what have I learned?

1) Cash flow is king - very common saying but when you are on it really hits home. If you don't have enough money saved up to take on a longer-term project you can miss out opportunities (yep, I didn't have enough saved, sigh).

2) People don't give a crap how busy you are - People just want their stuff done and they don't care if you have been thriving on 4 hours of sleep and have 50,000 other projects going on you should have scheduled better. This is something I knew already but once again it really hit home when I went on my own. There is a bit of truth in both sides of the coin on this, scheduling your work load is important but clients can also be pretty demanding (if you let them be).

3) Plan for 4 to 5 hours of billable time a day - I heard this but I thought people were full of crap. I planned out my hourly rate for working 8 billable hours. This was stupid! Like head slamming against the desk stupid. I would even say plan your billable rate for 3-4 hours a day and be done with it. I work more than 3-4 hours a day but that cushion for crap days and other shit is just a good idea, imho. So, how long does it normally take me to work 8 true billable hours [note: composing an email, reading RSS feeds, facebooking or researching that one project is usually not billable]? Usually 10-12 hours depending on if I am on-site or off-site.

4) Working from home rocks and sucks all at the same time - I love working from home but sometimes it sucks. The dogs want attention, your significant other wants attention and then there is always that movie you have been meaning to watch :). Anyway, over all I enjoy it but taking a break and working at a coffee shop for a few hours or grabbing some lunch with a bud is a great way to break up the solitude.

5) Remember to take a break - For awhile I was just busting ass and feeling like I was never getting stuff done. I think taking a break to read a book, watch some TV, hang with humans, etc.. Whatever it is, is just a wise idea or else you get burnt out way too quickly. I mean really does that project need to get done right now? I highly doubt it, even if the client says it needs to most of them won't notice an hour difference from my experience.

6) People won't be immediately pounding on your door - It took about three weeks for me to get fully booked. Granted this was with business relationships already started and people knowing I was going on my own. I could only imagine that it would take a lot longer if business relationships had to be formed, etc...

I am sure I have tons more lessons learned but those are the ones I can think of and I need to get back to work :). Going on my own has been great but it isn't easy that is for sure. As I have said to people before I traded a job working from 7Am-4PM and having weekends off to working from 7AMish to 10PM with no time-off. The trade-off though is I get to help a lot more companies and learn a lot more which is what I enjoy.

Well off to refill my coffee cup and start slinging some code!

What do you suck at when you develop code?

Everyone has a weak spot or a place they suck when doing any task, hence catch-all phrases like "no ones perfect". Since I am a developer I tend to look at development practices in general to see what could be improved or things that constantly happen to other developers. One thing I find interesting is how people cope with the thing they suck at the most. For instance I tend to rush things. Sure I get the code done quickly but usually it comes at the price of not fully testing the code I have written and bringing bugs into the system. If I remind myself to slow down then less bugs show up, shocking I know :). But what about other developers and the issues they have? I have seen all sorts of things like:
- Not seeing the forest from the trees
- Not taking the time to think of code maintenance down the road
- Not caring about usability

So, how have different people coped with the issues? I feel there are a few different ways you can cope with any short-coming you may have they are:
- Use a tool that helps you gain strength in a given weakness
- Find a buddy that is strong in your weak area
- Avoid the area like the plague
- Ignore that you have a weakness and think you are perfect :)
- Try to improve in that area

Use a tool that helps you gain strength in a given weakness:
This is a pretty good way to solve the problem if a tool actually exists and it works with your workflow. It is pretty rare to find such a tool for your given problem though but since we are a developers you can always just write a tool. For example if you tend to create lower quality code that is sloppy using a tool like FxCop could help increase your overall quality.

Find a buddy that is strong in your weak area:
What we can't just do stuff in a vacuum? Having this as a solution rocks but can also be difficult since you have to find someone that also meshes with your personality and has the time and want to help you. Hopefully their weakness is your strength so both of you can tradeoff in helping each other out. I have seen this work before but it seems fairly rare. Also, besides finding a buddy you can always hire someone to cover your weakness. For instance in my case it would be possible to hire a software tester to find issues on my code to minimize bugs that get sent to clients.

Avoid the area like the plague:
This is one of the simplest way to fix an issue you suck at. But it is also not always possible or it could be very self-limiting. For example if you create very poor UIs then maybe hand that off to the weird design dude that loves his mac and prefers doppios over that tall skinny soy latte.

Ignore that you have a weakness and think you are perfect:
This is like buying a mirror to make you look slim when you weigh 600+ pounds. Sure it makes you feel better but it can be annoying and disastrous. Sadly this seems to happen with a lot of people.

Try to improve in the area you suck at:
I personally believe this is the best solution but it is also the toughest. Trying to fix the issue you might have will take awhile and you have to remember to get back on the horse when you fall off. Some things I have read and done to fix pitfalls is by reading about the topic, consciously remembering the issue and catching yourself when you get into your old ways and having someone there remind you when you mess up.

I am sure there are other ways to fix being sucky at certain things so if you have a few ideas feel free to chime in :).

Do you care what you are doing?

I have had this exact phrase being bounced around in my head for the last month or so. As I am out in the working world more it seems that the people who go farther and have a better attitude have one similar thing in common. That thing in common is caring about the work they are doing. Sure, they might not exactly like the task they are currently doing but over all they care about the overall goal of their work. It is very easy to just get a job and not move it forward and complain about how it is and not improve anything. It is another thing to try and push it forward or bring some positive influence into what you are doing. I know people who even think the profession they are in is B.S. but they want to change the field. Sure it might take them 10+ years but even moving one little step closer will keep them energized. I get this way at my day job, the development environment sucks and I will have my bad days where I am cynical but the majority of days I try and remember to improve it in some little way. I don't even think technical skills are as important as actually caring in a field, however, I have a hunch anyone who cares is not lacking in the technical area as well.

I am not saying everyone has to care about their job I am just saying this seems to be what I have noticed for the people who draw people together, seem to create the "cool" things and are known as being very good. Maybe this is what some people use the term "passion" for but I feel they are different. Passion to me seems more like someone who won't give up on an idea and that is the only thing they are focused on and will talk about it all of the time. Whereas caring just means you want to improve a specific thing and don't want to see it get any worse.

Well, it is just a thought that I have had for a bit it might be crap or it might be good, I am sure it isn't original but I figure I would write about it any ways :). Time for another coffee!

TED Talk - Why we should play

If you are stuck up or just need an excuse to play around watch this video:


Maybe I should show this video to my boss when he looks at me funny for doing cart wheels or skipping down the hall. But it is sure fun :). I know you can't play / goof off all of the time but I find that people are way too damn serious all the time. It is like most people think they should be conservative and not goof off once they leave high school and/or college give me a break. Especially in this day and age we should all laugh at stuff and goof off. Ok enough of my personal philosophy :).

Back to work..

Article on Solitude

I just finished reading this article on solitude. I found it gave me something to chew on for a bit. I am still trying to figure out if I completely agree with his ideas or not. I can understand where he makes his conclusions from. Well if you have a few minutes it might be worth the read.

Twitter + Me == Hour suckage

In case any of the few people who read my site wish to follow me on twitter go for it.  My twitter url is http://twitter.com/noskillz not sure how long I will keep doing it.  It is not like I have enough distractions to keep me from doing meaningful work :).  

And I am out...

Most people that know me, know that my last day at Microsoft was this past Friday (9/5/08).  Why?  Well there are many reasons some I might write about others I probably won't :).  Anyways, I am going back to my past employer TransGroup where I will once again be joining the development team to kick ass, take names and try not to hose their live systems.  Will I still be doing security, hell yea, shit I might even get more done.  Working at Microsoft was an interesting experience and I met some cool people.  I didn't learn much sadly though.  Was it a wasted opportunity? Probably. Could I have done better?  Yea.  Could I have done worse?  Yea. 

I will miss a few things though:

• The coffee machines (best work coffee I have had yet)
• Bluehat 
• Access to all of MS's software 
• Some of the people I worked with (but then again I will probably keep in touch with them)

Things I won't miss:

• The slowness & process
• The crappy paycheck and monetary rewards
• The political environment
• The slowness (did I already mention that?? :P)

Many might wonder why I didn't go be a developer at Microsoft.  Could I have cut it there?  From what I saw the answer would be "of course :)".  However, since I was brought in at a low level I would have stayed there even if I switched to being a developer, now I maybe be a little slow in the head but I am not that idiotic.  I don't want to go through years of being under-paid to maybe some year make up for it (and that would be doubtful).  Plus, the way software was created isn't how I want to work.  I finally came to the conclusion that the only way for me to write software the way I want is to go my own way.  While I work on that, I plan on keeping a paycheck though, so, you know, I can like pay my bills :P.  Who knows maybe I can do both and make lots of money, only time will tell.  I like the environment at TransGroup but I also know that my true dream is to run my own business and work for myself and my clients.  

On that note, I am off to go work on some projects (more about that later).

But what would I have to offer?

This weekend I said to a guy I know that he should start moonlighting.  Why?  Because he complains about not having money and/or he says he could never beat the amount of money I make.  Of course I think that is utter bullshit, but, I recognize this as more of a self-defeating attitude.  But I was musing on the excuse given which is the title of this post "but what would I have to offer," that has more ramifications than I expect most people to realize.  The simplest one is this, if you have no idea how people on a free market would use your services, why would an employer hire you?  Anyone can be a grunt, so what sets you apart?  My guess is that these same people also have a hard time getting a job or always feel they couldn't get a specific job.  Because really even if we are a wage-slave we are just internal consultants to all of the other employees.  We need to provide some type of value that few people can deliver.  Sure, that takes a little bit to figure out (shit I am still figuring it out) but it is something to keep in mind.  

Funny Amazon Recommendation

I was sent this today by Heather Burgess (who would I link to if she got her blog up and running :P). I thought it was a great example of when software goes bad, very very bad/naughty.

Well if that doesn't make you smirk at least, you might want to check your pulse.

P.S. Dang two posts in a day a new PR

Idleness / busyness article

I read this good blog post on slow leadership titled "The Bustle of Idleness".  I can think of a few people who this applies to, including me.  Well go read and have something to think about over your coffee :). 

Frameworks for SaaS

I am seeing a new business emerge which I think is kind of cool.  Basically it is frameworks/providers for building Software-As-A-Service applications.  I have been a fan of SaaS before it was called that, so, it is cool to see it get some hype.  

Two examples of these frameworks are:

SaaS Rails Kit

Bungee Labs (Provider-As-A-Service)

Both of these are very interesting ideas and I think we will see many developers and business people take advantage of this.  Although I am a bit worried about SaaS becoming way too over-hyped but that is another blog post all on its own.  

What does this mean for the future?  I see two things happening.

1) There is going to be more and more SaaS applications built, which will be great for cost.  Harder to differentiate yourself (think of blogs right now).

2) There is some good money in getting into this framework niche now.  

Well back to work....

OSX == coffee house fun

I am sitting at my favorite coffee shop working while my girlfriend studies and every time I come here I see all of these macs showing up in my finder. Since I am not in that big of a mood to work I figured I would blog about this as it cracks me up every time. Here is what I see from iTunes and Finder (OSX's version of Windows Explorer).

Look at all of those computers! Most of them I can't read from (well without some work) but most of them I can write too, that isn't too big of a problem is it :P? I mean if I was a real dick I could just pump porn onto their hard drives or... I can steal their music, etc... This reminds me of the late 90s early 2000s with Windows 98 and the XP where sharing was on by default and you could get all sorts of goodies from people's machines.

Alright, back to work, but next time you are in a coffee house and have a mac see how many other computers pop-up in your Finder :).

We only have one shot...

For the past 1 year and 2.5 months I have worked for a large company and it has been a trying experience for me.  Of the many things that I get annoyed with one tops the charts.  It is the "we only have one shot" type of mentatilty.  I don't mean that there is only one shot and the company will go broke rather we can only ask people to do something that is intensive one time or we only get a six or three month cycle for software and if isn't good then it isn't going to be good but it will be released.  Well I don't know about you but I rarely never get anything semi-complex correct the first time.  Either I work for unrealistic people, unrealistic management, super-stars, my IQ is deficient or ???.  Why can't large companies overall use a process like sprints.  Sure people could say it randomizes them, but you know what?  Getting an email every 2-5 minutes randomizes you too but people love that because it makes them feel important.  I know some groups do sprints and it works well for them.  I also realize it is hard to manage large teams (anything over 12) but there has to be a balancing act that gets fast iterations and still get the main goal done.  

Password Stupidity

I was setting up a WordPress install for a client part of which was setting up a new database. I go into their crappy ass management tool and setup the database, as usual I put in some non-alphanumeric characters for part of the password and I get the following message:

Your password can not contain any of the following characters: question mark, space, caret, single quote, double quote, colon, backslash, dollar sign, ampersand, greater than, less than, tilde, semi-colon, accent.

All I can say is WTF! If that doesn't smell like there is come crappy code I don't know what does. Let alone that it lowers the security of the password, argh! It is like putting a maximum limit of 15 characters for a password, give me a break! At least put in upper limit at something most people wouldn't use like say 100 :). Well before I really get on my soapbox I better get back to working on client stuff.

Being the Leader is Better

Photo by Christian Løverås

Today I went mountain bike riding and whenever I go I always remember, being first is better. There are a few good reasons:

• You don't get mud splattered in your face (unless you fly over the handlebars into a mud pit)


• You get to take breathers while other people are catching up


• You get to figure out the route


• You don't get held back if someone else can't make it up/over/around/through/down an obstacle

There are also a few bad things about being in the lead:

• You don't know what is coming ahead


• You are the one that could be holding someone faster back


• If a really bad obstacle is ahead you have to deal with it first


• No one is there to give you advice or pointers on issues (slippery roots, mossy rocks, that little drop, that big drop, etc..)


• You are the one who gets to find the land minds on the trail (horse crap sucks, but I really hate it when dogs [or humans] shit on the trail!)

So, besides me blathering away at stuff I normally don't talk about do I have a point? Yup :). A lot of these advantages and disadvantages also play out in business. In business if you are the first or at least an early adopter it is a lot easier to keep ahead of everyone as long as you don't tucker out or get distracted. If you are not leading it is harder to catch and pass them but it is easier to learn from their mistakes. So, the next time ask yourself do you want to lead and hit the shit first or follow the leader and get mud flung in your eye.

The Application Security Silo

People get used to a certain way of thinking and accepted "truths" when they are around a certain set of people. I have seen this time and time again and of course I have fallen into it myself. I have always heard this being called "being in your own bubble" or being in a "silo", hence the title of this post. Recently I have been thinking that the application security industry is very much in its own bubble.

Don't get me wrong there are a lot of bad bugs that can and have been found. I see value in people finding these types of bugs - of course since that is my job and I still want it - but how severe these bugs are seems to get inflated inside of the industry. This is one reason why I think business people don't always take the security industry seriously. Lets take a specific application as an example, in this case I am going to focus on Wordpress.

To give everyone a short background Wordpress is a well known and well used piece of blogging software. It is widely deployed and very popular.  However, this piece of software is very insecure at least in the eyes of the application security profession.  There is even a site focused solely on Wordpress security, this site is ran by people who know quite a bit.  But yet even with this Wordpress still stays popular and keeps being used.  Why?  There are better alternatives.  The blog-o-sphere hasn't imploded because of this insecure software and the biggest issue is with spammers.  So, with all of these bugs and the software being "insecure by design" why is it still being used?  Because it works and the chances of your personal blog being attacked is pretty slim.  Sure there are bugs and if someone really wanted to they could cause pain to a Wordpress user.  But here in lies the rub, it is a common belief that any piece of software has big enough holes that if you are doing a targeted attack you can get the person, period.  It might take a bit, but it is possible.  I am sure there are exceptions to this belief but so far I have not found one.  

The only reasonable goal people have for software is just to make it more secure than alternatives so attackers attack the easier targets :).  However, it seems odd to me that application security people really get into how a bug can be soooo dangerous yet it rarely gets used or even more likely they find a bug say it is really dangerous and in the end it just isn't.  I guess my main point is this.  

Application security people are like Chicken Little's always saying the sky is falling when it isn't.

Sometimes the sky is really falling, however, most of the time the bug is small and is best used in very targeted attacks and most people are really not important enough for that type of effort. Although I wonder if anyone ever tries to take over the President's computer or what happens when he gets malware :).  

Yet another thing to distract people in public places....

The other night I was watching TV while I ate dinner and a commercial for some cell phone company came on advertising a new service. Not all that interesting I know, except that it was for TV over cell phones. Yes, they have offered this type of service for the past few years but I don't remember seeing a commercial for it (of course I could just be totally out of it because I live in a f'ing geeky cave :)). Even though this reminds of the 80s (or early 90s) when they tried to put TVs on your watch and have hand-held TVs this scares me more. I can just imagine some yokel driving down the highway busting a gut at something that Stewey from the Family Guy just did and not see the other SUV up a head of him stop for a squirrel in the road.

So, lets add this to all the distractions people can have while in public places: texting, cell phone calls, advertisements, other people, other objects, personal music devices (iPods and the like), gaming devices, computers, email and now TV shows.

I didn't know being in public places could be so boring as to need all of these distractions :). I guess we do like to wrap ourselves in what we find comfortable but this seems extreme or maybe I am just getting old.

Well back to consuming my morning coffee, thank god for caffeine!

Life is Strange

Okay, now that I have made my obvious statement of the day I guess I should explain :). Many things in my life have happened even though I said it wouldn't be my preferred choice. No, I am not talking about stupid shit like not wanting to get shot with an AK-47 or slinging crack on the corner. I will give you some examples.

Statement: "I don't want to be a stupid coder/bithead" ~ 1998-2001
Result: I still code to this day and was a coder for a few years (all though not a great one).

Statement: "Macs are stupid" ~ 2002 thru 2004
Result: My main machine is a 17" macbook pro

Statement: "I don't want to blog" ~ 2005
Result: I have two blogs and maintain the blogs for OWASP

Statement: "I don't want a girlfriend until I get to college" ~ 1999-2000
Result: Senior year in High School got a girlfriend and I am still with her

Statement: "I don't want to go work for company XXXXXX" ~ 2001-2006
Result: I now work for company XXXXXX

I could go on and on. Some people say positive thinking is a good thing and it will get you far. Maybe they are wrong and everyone should do negative thinking :P or maybe I am just more f'ed up than I thought and should be removed from the gene pool, only time will tell.

Well back to work I go.

Over the holidays I was at my girlfriends house and her parents were talking to their son over Skype. It got me thinking about video phones. Remember video phones? If not here is a picture to refresh your memory. Video phones were touted as the next generation of communication technology. Sadly they never caught on. The funny thing is Skype and other services like it have made the dream of video phones come true, granted in a different package. Well I thought it was interesting. Back to work and more coffee!