The goal of OAuth is to create a more secure authentication system by limiting who has access to your username and password. By authenticating with a system external to your application, the idea is that your data is more secure. Unfortunately, OAuth was clearly developed without much regard real-world problems. Here are a few reasons why OAuth is destined to fail:

1. Horrible User Experience - In a world where doing something as simple as changing a font or button color can create noticable changes in user behavior, asking a user to jump over the hurdles required by OAuth is just unrealistic. For web apps, it adds multiple steps to the authentication process and the experience is even worse for desktop apps. The experience also closely resembles the phising sites that we desperately warn our non-tech friends to watch out for. Also, keep in mind that the applications that poeple consider most secure (online banking, tax software, email, etc) NEVER redirect the user to a different site to enter login info.
2. No Consideration for Desktop Applications - While web-based apps are growing in popularity, desktop apps still dominate in most industries. The OAuth experience is completely focused on web applications. Whether it’s an app on your home PC or an app on your iPhone, the OAuth experience sucks.
3. OAuth is far from perfect - An ambitious hacker can get information via OAuth without much more effort than other athentication methods. There’s nothing to stop an application from collecting additional data in the background withour your knowledge after you’ve logged in. There’s also nothing to prevent an attack against or data breach with the OAuth provider.
4. It takes power from vendors, but not from hackers - The main goal of OAuth is to prevent nefarious people from having your precious login credentials. However, most OAuth providers still transmit your credentials over an insecure connection. So, rather than having my app send you credentials via Basic Auth, the browser sends it via an HTTP post. In the end, the chances of a request being intercepted from a browser or an app are about the same.

While I completely understand the concept behind OAuth, it’s just never going to catch on. There is no such thing as a 100% secure system and there a plenty of approaches that are just as secure as OAuth. In the end, OAuth doesn’t solve any real security problems and shifts a lot of work onto developers. I don’t mind putting in the extra work, but OAuth is replacing a few lines of code with 1MB of dlls and a bunch of UX headaches for an illusion of security.

There are 2 things that are generally considered part of this trophy idea. The first is that everybody deserves a reward, even if they fail. The second is that every minor success should be rewarded. Based on the opinions of older generations on the web and in print, these are both ideals that every member of Gen Y holds dear. However, a lot of this is based on a misinterpretation of what’s really going on in our heads and I’ve found that many of us only believe the second part.

Nobody likes the Participant ribbon.

Let’s tackle the idea that even failure deserves a reward. Of the people I surveyed, most addressed this. Of the people surveyed, all of them felt that this was inaccurate. I think the idea started because of how my generation was treated in elementary school. In just about every competition, everybody who participates gets some sort of reward. This has clearly led my generation to accept and even embrace failure right? The people I surveyed disagree; here are a few of their responses:

“Boy Scouts, Marching Band, Tae Kwon Do and Academic Decathlon all had a lot of competition in them and they had clear winners and losers. Games where everybody wins were usually the province of corny church youth group games and were the butt of jokes among my friends and me.”

Jason W, Pembroke, NH

“… At sports tournaments, my brothers and I would sometimes receive trophies even for placing in last. My parents were proud of us and put it with our other awards. However, my brothers and I treated them more like a daily reminder of our failure and it drove us to work harder.”

Anonymous

There were a variety of similar responses, but I think these two represent the ideas shared by all. We’ve never viewed rewards for failure as a good thing. I never took home a “participant” ribbon and showed it off to my friends and family. That being said, I think that many companies are far too concerned with failure and fear of failure can cripple a team. Innovation and creativity are rarely the result of continuous success.

Failure is unavoidable. Many of the companies founded by Gen Y are successful because they recognize small failures as necessary steps in the process of innovation.

Rewarding Success is a Good Thing

The other part of this Trophy idea is that Gen Y expects rewards for small successes. I would agree with this 100% and most of the people surveyed agree too.

The general consensus amongst my fellow Gen Y members is that the current corporate culture favors job title and longevity over productivity. I’ve been in many situations where I’ve put in extra hours, travelled over holidays and gone above and beyond only to see a manager get a pat on the back. In one case, my supervisor didn’t even know why he was being congratulated. While this instance is rather anecdotal, nobody can argue against the obscene bonuses executives have received while the companies they run fall apart and destroy our economy. What company do you think would be more successful, the one that rewards the extra effort of individuals or the one that provides a fat bonus for executives?

The issue I have with this aversion to recognizing success is that in most cases it’s very simple and cheap to do. I don’t expect a huge bonus for doing my job, but when my team puts in extra hours every night for a week, maybe a lunch is in order or possibly even just an email saying thanks. Why would having a group of young, ambitious professionals that are easily motivated by small rewards and recognition be a bad thing? I would think that having employees that will work extra hours for a nicer desk chair or bagels once a week would be a c-level executive’s wet dream.

[FYI, for those that doubt Gen Y employees can be motivated by weekly bagels and the occasional beer, take a look at one of my former employers CustomScoop. When a company with less than 20 people is building better products than Google, you know they’re doing something right.]

Summary

Overall, the feeling in the survey could be summarized in the following points:

• We don’t expect rewards for failure.
• We will be rightfully upset when others are credited for our hard work.
• Not every reward has to be cash, a thank you or kind gesture is often more meaningful.

To wrap up, here are a few more quotes:

“Failure is much more important than success and I do not want trophies that I do not earn.”

Matt G, Senior Public Affairs Analyst - Washington DC

“I want recognition, but not necessarily a trophy… I don’t see this as a negative because it just motivates me to strive to do more good.”

Kelley Muir, Manchester, NH

“Actually it really annoys me when people feel like they should be treated like special snowflakes because they exist.”

Courtney, Attorney, Concord, NH

“That is not the way I was raised. In rec soccer, I was terrible, and knew I didn’t deserve a trophy. To this day, I haven’t seen a good argument for rewarding poor performance.”

Anonymous

Why Piehead?

A lot of people have asked why I chose Piehead. Mostly because I have expressed a lot of interest in moving away from web agencies and also because I’ve got some sort of connection with just about every agency in the state. In the end, there were a few reasons I chose Piehead. So, here they are:

1. I’ve known a few of the people at Piehead, Jeremy and Clint, for a few years and have done some work with them in the past.
2. Piehead is new to the web development scene, but financially stable. This provides a unique oppotunity to be part of the technical decisions that shape the compay without the fear of getting laid off again.
3. I can telecommute a fair amount, giving me the opportunity to work from the Sunder Fortress of Awesomeness.
4. Quite possibly most important is that Piehead supports my ambitious side. Some past companies have frowned on my open source work or felt that be an active member of the geek community was a waste of time. Piehead understands the value of having community leaders at the company and has been encouraging of my after-hours geekiness.

What will happen to Sunder?

Have no fear about Sunder Media. Since January, Kelley has been the largest contributor and done the majority of the work. While Sunder has always been a side-project for me, Kelley has turned it into a functioning and profitable entity. I will still be doing some after-hours work for Sunder as needed, but rest assured that there will be no major changes for existing Sunder clients. As always Sunder will be happy to help small businesses that can’t afford a big agency or projects that are too wierd and/or risky for more traditional web shops to handle.

One More Thing

On a slightly related topic, I will no longer being leading/contributing to the AmpForms project. It was a fun way for me to get into open source and learn some new techniques, but has not really gained a following or much interest. I’m planning to shift my free-time to working on the Orchard project. Orchard looks to be a tool that Piehead will be able to use on a variety of projects and allows me to put my CMS background to use.

In Closing

Thanks to all of my family, friends and colleagues who’ve helped me out over the past few months. It’s been tough, but thanks to groups like BarCampManchester and Geek Lunch, I’ve always had a good professional support network. Finally, a big thanks to my wonderful wife Kelley for putting up with my grumpiness and supporting my fake plastic rock habit.

Rather than assume I was some strange anomaly, I put the word out on Twitter to see if my fellow Generation Y friends would be interested in answering some questions. I received 14 responses to the following questions:

1.       In what year were you born?
2.       Are you well employed, underemployed or unemployed?
3.       How would you like to be identified in the post?
4.       Would you consider yourself Civic minded?
5.       Do you believe that the US government is effectively representing the US people?
6.       A common stated trait of Generation Y is the “Everybody Gets a Trophy” philosophy. Do you think this applies to you and is it a good thing?
7.       As employees, Generation Y often chooses jobs that provide opportunities for growth over jobs that provide purely financial rewards. Would you agree? Has this influenced your career decisions?
8.       Are you comfortable sharing personal information publicly or with people within internet-based communities? Do you feel that you are more open about your opinions and personal life than previous generations?
9.       Do you assertively seek more feedback, responsibility, and involvement in decision making in your career? Would you rather have feedback on a frequent informal basis or within a formal review structure?

The best part of the responses is that they are surprisingly diverse given the small sample size. The respondents included almost the entire age range of the generation, included a range of political affiliations and included an almost even gender balance. The surprise is that every question has at least 9 similar answers and 1 question was unanimous.

My original plan was to write a single post covering all of the results, but my new plan is to write several posts focusing on specific topics. Stay tuned for the results and analysis. I will probably tackle #5 or #6 first.

While there are many various anti-IE movements, most of them have an overly aggressive and often juvenile approach to the problem. A quick look at current browser usage statistics shows that this isn’t working. In many cases, these groups are just preaching to the choir and rarely make a solid case for those entrenched in IE6.

Who Uses IE Anyway?

While using a modern browser is an obvious choice for most tech savvy individuals, for many IE6 users upgrading becomes a cost-benefit analysis. The vast majority of sites on the internet still support IE6, so there isn’t a huge drawback for many users. They don’t care about CSS support because the sites still render correctly and performance is still rarely an issue for most sites. Also consider that there are a rather large number of older applications that rely on IE6’s broken rendering. Combine these together and you get a large number of corporate IT departments that are facing a huge cost to upgrade older software with a minimal benefit to their organizations.

How to Kill IE6

The biggest thing that our industry can do to eliminate IE6 is to stop supporting it. While some major sites like YouTube and Digg have already started pulling support, these aren’t likely the sites that employees at big corporations are visiting at work. If Salesforce and Constant Contact dropped IE6 support, I wouldn’t be surprised to see a huge drop in IE6 usage almost overnight. Unfortunately, we can’t really expect these big business companies to take the risk. Hell, even 37 signals still supports IE6 for their apps and they’ve been some of the most vocal Microsoft haters out their.

The next thing that we can do as a web professionals is to make sure our clients are aware of IE6 problems. In general, I would recommend avoiding discussion about CSS and instead focus on security issues. Most clients would view CSS rendering as a tech problem and point to other sites that work fine in IE6. However, there is a huge amount of literature around regarding IE6 security flaws. Remind them that while they likely aren’t legally responsible for security flaws in their users’ browsers, people are quick to blame any issues on the site their visiting rather than their own browser. Finally, if you’re building a site that needs to be secure, consider creating a waiver of liability for issues caused by IE6 security flaws. In most cases you wouldn’t be liable anyway, but having a document that clients sign helps it sink in that this is a real concern.

The last thing, and the one I will most likely get crap for, is to recommend upgrades to IE8. I know that things would be much easier if everybody was using Webkit and Gecko browsers, but requesting that users switch “brands” often comes across as a sales pitch. If you’re really dead-set against all IE versions, at least take the time to explain how Firefox or Chrome is better. I frequently hear developers say things like “It’s just better, trust me”, but this doesn’t really provide a compelling argument to users. Tell somebody that new browsers can use transparent pngs, and they won’t care; tell them their credit card number could be ganked and they’ll be more likely to pay attention. It’s about finding the issues that are relevant to your clients and users, even if they aren’t the issues that are relevant to you.

How not to Kill IE6

Don’t expect Microsoft to make IE6 magically disappear. For the most part, everybody at Microsoft hates IE6 as much as the rest of us, but their hands are essentially tied. They can’t force people to upgrade anymore than I can randomly upgrade old client sites from PHP4 to PHP5. Most of the companies hung up on IE6 pay for some other software from Microsoft. You can’t really expect any company to risk losing paying customers by forcing them to upgrade a free product. Even with that in mind, Microsoft has had newer versions of IE listed as critical updates for years, so I doubt most IT departments really care what Microsoft says.

Don’t forget to be an adult. If you make a huge deal about spending 2 hours fixing a CSS glitch, people will just think you’re whining. Our clients and users don’t understand the issues and likely won’t be receptive to hyperbolic statements about how much time you spend fixing IE6 issues. Present your case in a professional manner and people will respect your opinion.

Feel free to post any other ideas on how to effectively eliminate IE6 in the comments.

$6k per founder is not enough to be the sole source of seed money. Based on a few quick exchanges with David Cohen at Techstars, it’s clear that this is intended. The capital provided is to help, but not sustain a company. While I agree that Techstars shouldn’t be fully funding their companies for a long period of time, I think that covering the cost of living for the founders for the 3 month course wouldn’t be unreasonable.

On a separate note, part of my concerns are clearly a result of my misunderstanding about the purpose of seed money. Most of the events I’ve attended are focused on companies that have already started and are looking for Angel or VC funding. At these events, it’s always been implied that seed funding is generally enough to get the company running and ideally have a first product ready to ship. Based on what I’ve been reading, it looks like most organizations that provide seed funding are more focused on providing connections and expecting the founders to front the capital.

In the end, there are really 2 core problems:

1. Organizations like Techstars work best for founders who already have some capital, rather than founders who are just starting.
2. There is a lot of confusion and mis-information around about how start-ups get going before they receive Angel or VC funding.

Based on these problems, there could be a variety of solutions.

For companies like Techstars and Y-Combinator, it would be interesting if the system would still work if founders recieved $10k-$12k. This would cover cost of living for the founders for the 3 month program, but is still low enough to encourage them to keep moving forward. Based on the potential gains, this seems like a relatively inconsequential amount and it would open the doors to a lot of talented people who don’t have access to capital.

It would also be great to see a few events targeted at pre-seed entrepreneurs. It’s clear that Techstars and similar groups have worked for lots of companies. It would be interesting to have  day to hear from organizations like TechStars, CRV, Y-Combinator and some of their companies to hear how others have made it work. It would also be great to give people an  idea of what it really takes to get though the seed phase. There are a lot of people like me, sitting around with prototypes and plans with no idea how to get that first beta to market or prepare for Angel or VC funding.

I owe the people at Techstars an apology. While their program doesn’t seem like a good fit for me in my current situation, it’s clear that they’re doing a lot of things right. It’s just frustrating to see great ideas that could become multi-million dollar companies fail because the founders can’t borrow that first $30k. It’s tough to walk through BarCampBoston or Ignite and see dozens of great ideas that will never see the light of day.

EDIT:  The tone of this post was clearly a bit off from my original intent. My main point was that it seems that the founders involved here are pretty much going all in by quitting their jobs for 3 months, whereas the investors are taking an incredibly small risk compared to other investment routes. Most of the other funding sources I’ve seen (Angel, VC, Bank Loans) at least provide some protection for the founders. (End of Edited Text)

As a developer whose participated in a few business plan / start-up competitions, it seems like everybody and their brother tells me to look into Techstars. I was pretty excited at first. Seed capital to get started and access to mentors, seems like a good idea right? After reading through the details, it’s definitely something I have no interest in. In all honesty, I think they’re misrepresenting themselves for a few reasons.

First of all, they prominently display $18,000 as the available seed amount in several locations. The amount is actually $6k per founder. Again, at first it seems like a great deal, but this is $6k/founder over 3 months. In the Greater Boston area, $2k per month is barely enough to cover rent and utilities and only slightly more than Wal-Mart pays. There is one difference though, Wal-Mart doesn’t ask for equity in your ideas. This leads to the second point.

Techstars requires 6% equity in your company. This seems a bit steep for a $6k investment. I know it’s very early seed money, but valuating the company at only $100k seems pretty lame given their rigorous entry process.  Since 60% of the companies have received Angel or VC funding at the end of the program, which was likely at least $1,000,000, Techstars must me pretty damn lucrative.

Keep in mind that the Manchester Young Professionals group managed to scrounge up $25k per business plus another $25k in services.  A small professional group in Manchester can front more than a group of investors in Cambridge?

I’m not expecting that Techstars should give money without gaining equity in the company. Trading equity for seed funding is common. However, this seems less like an organization that wants to help business get started and more like an organization that charges 6% equity to give you a meeting with some Angel and VC funding sources. Many of these investors are also likely at various start-up events that cost only a few hundred bucks. (See Speed Venture)

In the end, Techstars isn’t all bad; they’re just not representing themselves accurately. If you need $6k to get your company started, there are better places to get it. In the end, you’re not really getting seed money as much as you’re trading equity in your company for a few good networking opportunities.

I may be completely off-base here, and I’d be happy to hear from anybody at Techstars or their companies if I’m wrong.

Xenu Link Slueth is a great tool for checking a site for broken links and images. It also shows that a good tools can last, this thing has been out forever and I still find it to be one of my most used tools.

It rocks for several key reasons:

1. It’s crazy fast compared to most of the web-based tools.
2. The report it generates is incredibly detailed. It lists broken links by page, link and error code as well as providing a basic site map.
3. It allows you to scan sites that are password protected.
4. Above all else, it’s free.

Download it and show Tilman Hausherr some love.

Developers, I’ve got some good news. Turn off YSlow and leave your javascript readable!  Stop debating between concatenating strings or using stringbuilders! BLAME SQL!

In many cases, I see developers ignoring SQL optimization. It may be because they’re more familiar with client-side tech or it could be the years of memorizing every design pattern they can, but almost every web application can benefit from a little TLC. Here are a few quick pointers.

1. Know what your SQL looks like.

Web developers rely on a lot of different tools and applications. Whether you’re using a large application like a CMS or a smaller ORM tool, it’s important to know what SQL your code is generating. In many cases, the SQL generated is optimized with only the most common use cases in mind or in some cases barely optimized at all. Don’t be afraid to peak at the stored procs your apps are using or do some logging to what your code is actually doing to your poor database. Just because you didn’t write it, doesn’t mean you shouldn’t know what it does.

2. Add some indexes

Having a basic understanding of indexes can help improve performance immensely.  To start off, make sure your tables have at least a Primary Key. Next, look at any columns you regularly use to filter selects or join on. Unless these column contain a lot of similar values, it’s a good idea to index them. Finally, if you frequently select a subset of data from a table, such as first and last name from a contacts table, you can create a covering index that will usually speed up these queries.

3. Look at your joins

 If you need a map to find your way through the maze of nasty joins in your queries, it’s time to optimize. First of all, make sure that you’re only joining to get data that you’re actually using. Joins can exponentially increase the time it takes to perform a query, so joining to get data that isn’t used wastes a lot. Also, when joining, it’s best to join on indexes. It’s also better join on numeric types than non-numeric types.

4. Subqueries are usually bad

This is a short one. If you’ve got subqueries, figure out how to make them joins. There are almost no cases when a subquery is more efficient than a join, and if you know those cases, you probably don’t need to take SQL advice from me.

5. Use stored procs for common queries

Stored procedures provide several performance improvements. Stored procs are partially compiled at creation and don’t need to generate a new execution plan at runtime. Additionally, combining statements into a stored proc can provide details to SQL Server that allow it to create a more efficient execution plan than passing individual queries. It may be tempting to just sling SQL at the database, but even a few stored procs can do wonders.

1. We should expect better than IE6.
2. Microsoft can’t afford to have a crappy browser anymore.

So, with the help of the wonderful Molly Holzschlag and several other web standards gurus, Microsoft started to turn things around. IE7 was much less crappy than IE6, and IE8 is actually downright ok. However, with each improvement, the IE team seemed to get more flak rather than less.

Criticism focused in 4 areas:

1. Poor CSS support (limited to CSS3, since IE8 has better CSS2.1 support than any other major browser)
2. Slow Javascript performance
3. Slow page rendering 
4. Bad text aliasing

Today, the IE team released some early details on IE9.  Based on the early builds, the team has made massive headway in all 4 areas. Clearly the masses of developers that have nothing to do but complain about IE should be happy right?

Unfortunately, almost all of the comments are negative. They even include some great references to pngs (fixed in IE7) ,  Box Model (fixed in IE8) and IE6 (already addressed here). I would love to meet these “developers”. As a web developer, I’m expected to have a basic understanding of what browsers people are using and what features they support. However, it’s clear that these web developers are somehow still employed while being completely oblivious to 70% of the users on the web.

In the end, most of the people commenting on the IE blog are completely ignorant. The IE team is busting their ass to make a quality browser, and unlike most other browser vendors, they get shit on every time they make an improvement. I know that older versions of IE are a bitch, but crucifying the very people trying to fix things isn’t going to make things better and in the end may make things worse.

In closing, I want to thank everybody on the IE Team. You guys are working everyday to make my life as a web developer easier and you should know that many of us appreciate it.

To Dean, Ali, Bruce, Justin, Tony, Chris, Eric, Dave and the rest of the crew:

Thank you for you hard work and I look forward to IE9!

NOTE: Comments on this blog are moderated. If your comment doesn’t show up instantly, please refrain from sending me hate mail. I’m not blocking your comments unless they contain excessive profanity or derogatory statements.