Highlighting Lines of Code in Github

Ever needed to share some code with somebody and point them to the lines of interest?

Here's how to do that if the code is in github:

Summary

Just add

#L[STARTING_LINE_NO]-[ENDING_LINE_NO]

to the end of the original url.

Example

https://github.com/angular/angular.js/blob/master/test/ApiSpecs.js#L6-16

21 CFR Part 11 and the SDLC

In this posting, I will attempt to address the challenges posed by the FDA 21 CFR Part 11, which is a law aimed at ensuring that companies implement good business practices, in their developing software efforts to meet said requirements.

Background Definitions

21 CFR Part 11

Title 21 is the portion of the Code of Federal Regulations (CFR) that governs food and drugs within the United States for the Food and Drug Administration (FDA), the Drug Enforcement Administration (DEA), and the Office of National Drug Control Policy (ONDCP).

21 CFR Part 11 addresses Standard Operating Procedures (SOPs), Medical Device Quality Standards Regulation (QSR), Good Clinical Practices and Good Manufacturing Practices.

SDLC

The systems life cycle (SLC) is a methodology used to describe the process for building information systems.

The Systems development life cycle (SDLC) is a process used by a systems analyst to develop an information system, training, and user (stakeholder) ownership. The SDLC aims to produce a high quality system that meets or exceeds customer expectations, reaches completion within times and cost estimates, works effectively and efficiently in the current and planned Information Technology infrastructure, and is inexpensive to maintain and cost-effective to enhance.

Following a SLDC in order to develop a 21 CFR Part 11 regulated software application is essential because its very intent is to provide a very deliberate, structured and methodical way, reiterating each stage of the life cycle. The SDLC describes the different stages involved in the software development project from the drawing board/planning, implementation, testing, deployment, through the completion of the project.

Project managers benefit from the process, tools and project artifacts generated as a result of following an SDLC. The project life cycle integrates the project management and SDLC cycles with the activities directly associated with system deployment and operation.

The Hurtle

The FDA recommends that application development teams take an integrated approach to their software development lifecycle (SDLC), which combines risk management strategies with principles for software validation.

But developing software for medical devices that complies with the FDA's Quality System regulation is necessary hurtle for companies that want to compete in the medical/FDA-regulated industry.

This hurtle is not near as "complicated" as some make it seem.

It basically means that your software needs to be engineered properly with complete access control and audit capabilities.

Experience Matters

Since I have well over 10 years of enterprise application security software development experience and have worked with some of the most talented software engineers in the world, these requirements seem easy/natural to me.

I enjoyed over 10 years of hard core software application development prior to joining IBM.

In my first project at IBM, I researched and developed security components for SmartCard LifeCycle Management System using IBM's flagship e-business security software, Tivoli Policy Director (TPD), which allows organizations to create secure relationships among customers, partners, suppliers and employees.

I focused on enterprise-security-related software application development projects, such as:

• Software Engineer I architected and implemented various design patterns for Web Identity (formerly IBM Registration) is the standard service for IBM external applications that register, authenticate, or profile external web-based customers, business partners, suppliers, and other users of ibm.com. WI performs Single Sign On, Global Session Persistence, and User Identity and Profiling and Access Control functions.
• Security Consultant Implemented IBM.COM Single Sign On (SSO) prototype for IBM’s BT/CIO office and the Tivoli PDT.
• Security Architect & Lead Developer Designed and implemented Voice over IP (VoIP) security architecture for a fortune 5 telecommunications company. System components (order entry, billing and account management ) were presented to users (customer facing and a customer service rep (CSR)) via web based portal application. Designed corporate messaging infrastructure to manage application entitlements (user creation and role management).
• Lead Security Application Developer Performed analysis, design and implementation phase of enterprise Authentication and Authorization infrastructure replacement project for fortune 5 financial corporation.
• SOA Security Architect Produced detailed SOA Security Architecture deliverable for Service Oriented Architecture Methodology (SOMA) engagement focused on contract, pricing and rebate functionality for a distributor of medical products, equipment, billing services and pharmaceuticals.

I later transferred from IBM Global Business Services to the IBM Software group to help develop the administrative UI for the IBM Next Generation Intrusion Protection Appliance.

Software Development Methodologies

Waterfall Methodology

Early in my programming career, I worked for several fortune 500 companies that followed the Waterfall software development methodology:

What always happened on those projects was the business analysts would take in inordinate amount of time to fully define everything about the system, even though none of them had any relevant software development experience, and produced a tome of a design document, which was supposed to serve as a reference for developers' requirements.

At that point, the project was always behind schedule and my team took over.

I would spend a day or two reading through that wordy tome and make my own (useful) design documents.

Next, I would find the subject matter experts (SMEs) to validate my designs and begin a series of design/implement/evaluate sessions, very much like the Agile process, but light on testing. (The need for testing, especially in a team environment that uses a constant integration (CI) server is a topic for another day :-)

The fact was that the project management office would be freaking out as the customer began to tighten the rope of leniency as they began to get concerned that the project was falling behind since they had not "seen" anything.

Process and methodology at that moment was always thrown out the door as the project manager (PM) would scream, "Just get 'er done."

Rational Unified Process

Prior to joining IBM I worked at an internet consulting company iXL where we followed the Rational Unified Process (RUP) of software development.

The purpose of following RUP software engineering methodology is to provide a disciplined approach to assigning tasks and responsibilities within a development organization. Its goal is to ensure the production of high-quality software that meets the needs of its end-users, within a predictable schedule and budget. RUP is “use-case driven, architecture-centric, and incremental and iterative”.

RUP Phases

Here's a high level view of what the RUP phases:

Here's what a typical RUP plan would look like:

Objectives

• Improve the integrity of the commitments made by SDLC by defining the business process by which decisions are made.
• Minimize product changes (churn) once the decision is made to initiate a project.
• Define a common framework for communicating project status in terms of business commitments
• Enforce appropriate minimum standards on entry and exit criteria for each applicable project lifecycle phase.
• Define milestones for project process metrics: Cycle Time & Quality

RUP was a big improvement over the Waterfall methodology, but many software development projects would still fall behind schedule, leaving PM's standing in the lurch. Then, along came Agile...

Agile software development

In 2001, the Agile software development methodology became popular, which is based on the Agile Manifesto:

We are uncovering better ways of developing software by doing it and 
helping others do it. Through this work we have come to value:

Individuals and interactions over processes and tools
Working software over comprehensive documentation
Customer collaboration over contract negotiation
Responding to change over following a plan

That is, while there is value in the items on the right, 
we value the items on the left more.

Agile software development is a group of software development methods based on iterative and incremental development, where requirements and solutions evolve through collaboration between self-organizing, cross-functional teams.

Agile provides well-defined planning events and a "time-boxed", iterative approach to development that project managers like.

The trouble with many Agile projects is that the focus is on cranking out stories (aka Use Cases in RUP parlance) and their associated features with less emphasis on code quality.

However, the 21 CFR Part 11 and the FDA, in general, is all about quality...

... and that's a problem.

Some Software requirements for 21 CFR Part 11

• System validation to make sure performance of the system is accurate and reliable.
• System should be able to produce accurate/complete record copies that are readable both in human and electronic forms.
• Record protection to ensure they are accurate and able to be retrieved easily.
• System access should have strong controls to prevent unauthorized access.
• Must have time stamped audit trails.
• Operational system checks must be in place to ensure proper sequencing of steps and events.
• Authority checks must be in place to make sure that only the authorized personnel can get into the system.
• Proper controls on system documentation
• Complete and accurate record retention practices
• Written policies must be produced that hold everyone accountable for any actions via their electronic signature.

Other Systems Impacted By 21 CFR Part 11 Requirements

• Employee Training
• Document Management
• Change Control

Out of Compliance

If you get audited and found wanting, you will get a 483 (FDA violation) citation.

A 483 is issued when investigators observe any significant objectionable conditions. FDA investigators are trained to ensure that each observation noted on the 483 is clear, specific and significant. The observations are cited when in an investigator’s judgment these conditions or practices observed indicate that an FDA-regulated target is in violation of FDA’s requirements.

Example 483 violations

http://www.fda.gov/Food/RecallsOutbreaksEmergencies/Outbreaks/ucm224855.htm
http://www.fda.gov/AboutFDA/CentersOffices/OfficeofGlobalRegulatoryOperationsandPolicy/ORA/ORAElectronicReadingRoom/ucm061813.htm
http://www.fda.gov/downloads/ICECI/EnforcementActions/WarningLetters/1999/UCM067262.pdf
http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2005/ucm075385.htm

I think it's safe to say that no business owner would ever want to receive one of those.

Summary

All projects need to be performed and delivered under certain constraints. Traditionally, these constraints have been listed as "scope," "time," and "cost". These are also referred to as the "Project Management Triangle". You cannot change any one constraint without affecting the other two.

These three constraints are often competing constraints: increased scope typically means increased time and increased cost, a tight time constraint could mean increased costs and reduced scope, and a tight budget could mean increased time and reduced scope.

Quality is of utmost importance in projects that intend to meet 21 CFR Part 11 requirements.

Therefore, unless the technical resources that implement the application care a lot about the quality of their code, are seasoned enough to understand what good code means, and are willing to enforce coding standards and stand up to PM's that are always pushing to "get 'er done", the risk of delivering software that complies with FDA regulations will always exceed an acceptable level, regardless of the chosen software development methodology (and some form of agile is the way to go).

lexsheehan.blogspot.com has over 25,000 page views!

Started blogging less than a year ago and now have over 25,000 page views ...

Thank you for reading my stuff!

Lex

A Predictable Reaction to a Software Development Estimation with Full Disclosure

I was recently asked, by a close friend, to look at a simple web application that starts with a large page of nicely styled questions, followed by another page of questions and a results page, full of analysis and a well designed summary pie chart graphic.

Here was my response:

If your question is how "hard", I'd say "not hard".

If your question is how much would it cost and how long would it take? ... then how "hard" it is depends.

As you know, delivering software involves the interaction between business policy/process, data, technology and people.

Consider:

1. Is the algorithm for determining the scores well defined?

(Would the question/answer > bucket be provided in the form of a spreadsheet file (or would the programmer be given written descriptions and have to type everything in from scratch?)

2. How much flexibility is there on the final graph image?

(Looks like they have created a whole lot of static images, one for each possible answer. Another solution would be to have a javascript driven/dynamic graph, which would likely be the way I'd lean.)

3. Are you storing the results or simply generating the resulting score for display on the web site at the end of the survey?

(This is a big one. If the answer is just generate the answer and not record anything, other than possibly an email then this could all be done in javascript, i.e., in the web browser...no backend database required.)

4. Is deployment infrastructure in place?

(Do you have a server for this application to run on already?)

5. Is this part of a bigger solution?

(Need to integrate this with other systems? Do you need to share the responses or "customers" with other systems? Do you need to automate emails to these customers? Etc.)

6. How engineered does the solution need to be?

(Most apps are developed using and agile methodology, which requires a continuous integration server that monitors for code updates, validates that new coded does not break the build, which implies all work has test code (unit, functional, integration)... I would not think this would not require multiple developers, which greatly simplifies things.

7. How many change requests will be involved?

(Will the user acceptance testing be reasonable or will there with a lot of "I know that's what you thought I said, but I was thinking of something more like this here...So, do it over, again."

8. Has a technology and/or development toolset been pre chosen?

(Does it matter what language is written in or what tools are used to develop the web app?)

[SUMMARY]

The result you get when developing software is largely dependent on the team doing the work.

I would say you're looking at any where from 4 hours to 4 weeks [or more], depending on your answers above, whether requirements will change and the experience of who's doing the work.

... [ some discussion of cost ] ...

I also included one of my favorite comic strips:

Response to full-disclosure-estimation

I think I have figured out how to do this through excel.

Strategy Design Pattern Using Ruby

Back when I worked in Global Business Services at IBM, I participated in a Design Patterns user group.

It was moderated by a super smart dude, "Coop".

We studied the patterns found in the Gang of Four book and worked through coding examples in Java each time we met.

Ends up most of us had been using proven patterns in our code, but didn't realize they had names.

Object oriented programming (OOP) is great when used properly and that's where design patterns come in...

A day ago during an interview, I was asked to implement a Ten Pin Bowling Game Scoring Algorithm using Ruby. So, I put the Strategy Pattern to work to solve it and landed an awesome job.

I was given the following rules...

1. 10 Frames
2. Each frame throw the ball 2 times *
3. 10 pins
4. Each pin is worth 1 point


# Spare

7 3 -> Frame 1: 15
5 0 -> Frame 2: 15 + 5 -> 20


# Strike

10 0 -> Frame 1: 18
5 3 -> Frame 2: 18 + 8 -> 26

... and asked to code that along with Rspec test cases, which I will cover in another blog posting.

After a short pair programming session I was able to take some time to look at the problem and saw that Objects involved:

• BowlingGame (Client)
• Frame (StrategyBase)
• Spare (ConcreteStrategy)
• Strike (ConcreteStrategy)

A Spare Is A Frame, ditto for a Strike.

How to Play

After the BowlingGame is initialized with the Frame, Spare and Strike classes you call the roll method from 12 to 22 times, depending on what was rolled and then finally call the score method to find out how well you did.

Sample Code

class BowlingGame
    NUMBER_OF_FRAMES = 10

    # BowlingGame.new(Strike, Spare, Frame)
    def initialize(*policies)
        @policies = policies  # Each Frame type has different policies used for scoring
        @rolls = []           # Array of rolls (number of pins knocked down)
    end

    # Add number of pins knocked down to @rolls array
    def roll(pins_knocked_down)
        @rolls << pins_knocked_down
    end

    # Sum each frame's score for total
    # See: http://lexsheehan.blogspot.com/search?q=functional+programming
    def score
        frames.reduce(0) { |sum, frame| sum + frame.score }
    end

    # A frame consists of two rolls, unless first roll is a Strike (special rules for last frame)
    def frames
        roll_index = 0
        frames = []
        NUMBER_OF_FRAMES.times do |i|
            frames << frame(roll_index)
            # Polymorphism: Frames could be a Strike or a Spare, both of which have a number_of_rolls method
            # Spare has 2 rolls and Strike has 1 roll
            is_last_frame = i.eql?(NUMBER_OF_FRAMES - 1)  # Last frame gets bonus roll(s)
            roll_index += frames.last.number_of_rolls(is_last_frame)
        end
        frames
    end

    # Use strategy pattern to select appropriate Frame type (regular Frame, Spare or Strike)
    # See:  http://en.wikipedia.org/wiki/Strategy_pattern
    def frame(roll_index)
        @policies.each do |policy|
            # Select frame based on policy in found? methods
            return policy.new(@rolls, roll_index) if policy.found?(@rolls, roll_index)
        end
    end

end

class Frame
    def initialize(rolls, roll_index)
        @rolls = rolls            # Array of rolls, where each equates to number of pins knocked down in that roll
        @roll_index = roll_index  # The first roll index in this frame
    end

    def score
        @rolls[@roll_index] + @rolls[@roll_index + 1]  # Sum of both rolls in frame
    end

    def self.found?(rolls, roll_index)
        true  # If neither Spare or Strike then this is a regular Frame
    end

    def number_of_rolls(is_last_frame)
        2  # Default to 2 rolls (regardless of whether it's last frame)
    end
end

class Strike < Frame
    # In the frame where strike is rolled, add 10 to number of pins knocked down in next two rolls
    def score
        10 + @rolls[@roll_index + 1] + @rolls[@roll_index + 2]
    end

    # Strike strategy found when number of pins knocked down in first rolls of frame equals 10
    def self.found?(rolls, roll_index)
        rolls[roll_index].eql?(10)
    end

    # Override Frame type's number_of_rolls method
    def number_of_rolls(is_last_frame)
        # If the last frame starts with a strike, we get 2 bonus rolls
        is_last_frame ? 3 : 1
    end
end

A Few Test Cases

    it "scores 0 with a gutter ball game" do
        20.times { game.roll 0 }
        expect(game.score).to eq(0)
    end

    it "scores 300 with all strikes" do
        12.times { game.roll 10 }
        expect(game.score).to eq(300)
    end

    it "scores 150 with all 5's" do
        21.times { game.roll 5 }
        expect(game.score).to eq(150)
    end

References

Get the code and a nice README with more references here: https://github.com/l3x/lex-dp-strategy-ruby

Credit Card Data Storage and PCI Compliance

Some credit card data can be stored by an e-commerce site assuming adequate security measures are implemented.

	Data Element	Storage Permitted	Protection Required	PCI DSS Req. 3.4
Cardholder Data	Primary Account Number (PAN)	Yes	Yes	Yes
	Cardholder Name	Yes	Yes 1	No
	Service Code 1	Yes	Yes 1	No
	Expiration Date 1	Yes	Yes 1	No
Sensitive Authentication Data 2	Full Magnetic Stripe Data 3	No	N/A	N/A
	CAV2/CVC2/CVV2/CID	No	N/A	N/A
	PIN/PIN Block	No	N/A	N/A

1 These data elements must be protected if stored in conjunction with the PAN. This protection should be per PCI DSS requirements for general protection of the cardholder data environment. Additionally, other legislation (for example, related to consumer personal data protection, privacy, identity theft, or data security) may require specific protection of this data, or proper disclosure of a company's practices if consumer-related personal data is being collected during the course of business. PCI DSS, however, does not apply if PANs are not stored, processed, or transmitted.

2 Sensitive authentication data must not be stored after authorization (even if encrypted).

3 Full track data from the magnetic stripe, magnetic stripe image on the chip, or elsewhere.

Summary

The card holder data where storage is permitted must be encrypted per PCI requirements.

Furthermore, the entire system hosting the data store must adhere to PCI requirements.

If your site stores credit card information, then your site is a target.

Alternatives include storing credit card information at your processing gateway or using a Tokenization service to actually store the credit card information.

References

https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf

https://www.pcisecuritystandards.org/documents/pci_ssc_quick_guide.pdf

http://en.wikipedia.org/wiki/Tokenization_(data_security)

Better Coding Techniques Lower RubyMine's Runtime Memory Requirements

For some coding tasks, I use RubyMine.

RubyMine has great features, but is known for being sluggish and hogging RAM.

Sometimes, tweaking RubyMine's memory configuration file will improve your performance.

RubyMine Memory Configuration

Here're the configurations that typically work well for me:

-Xms128m
-Xmx1024m
-XX:MaxPermSize=500m
-XX:ReservedCodeCacheSize=128m
-XX:+UseCodeCacheFlushing
-XX:+UseCompressedOops

If you have installed previous versions of RubyMine be sure that you're configuring the correct idea.vmoptions file

Search your file system with something like this:

sudo find / -maxdepth 15 -name "idea.vmoptions" -type f 2>/dev/null)

If RubyMine starts to run out of memory it will warn you and give you a dialog window that will directly modify the correct .vmoptions file.

And as with just about everything, what you should set yours to depends...

Impact of Coding Techniques

Your coding techniques will also affect your requirements.

For example, if your code is littered with Model.each do ... constructs, then RubyMine will appear to be a memory hog.

However, if you simply replace your Model.each do's with Model.find_each do's then you'll likely see that RubyMine (or whatever Rails runtime you're using) is no longer gobbling up so much of your computer's memory.

The reason is that the Model.each do ... construct, ActiveRecord will run a query for all the records and load the results in memory; Whereas, User.find_each(:batch_size => number_of_records_in_batch) do ... only loads number_of_records_in_batch at a time.

Verification

Don't take my word for it; Rather, open up the Rails console and try it out yourself:

Using .find_each

>> User.find_each(:batch_size => 100) do |user| end
  User Load (9.3ms)  SELECT "users".* FROM "users" WHERE ("users"."id" >= 0) ORDER BY "users"."id" ASC LIMIT 100
  User Load (5.3ms)  SELECT "users".* FROM "users" WHERE ("users"."id" > 100) ORDER BY "users"."id" ASC LIMIT 100
  User Load (6.2ms)  SELECT "users".* FROM "users" WHERE ("users"."id" > 200) ORDER BY "users"."id" ASC LIMIT 100
  User Load (4.6ms)  SELECT "users".* FROM "users" WHERE ("users"."id" > 300) ORDER BY "users"."id" ASC LIMIT 100
  User Load (4.0ms)  SELECT "users".* FROM "users" WHERE ("users"."id" > 400) ORDER BY "users"."id" ASC LIMIT 100
  User Load (4.1ms)  SELECT "users".* FROM "users" WHERE ("users"."id" > 500) ORDER BY "users"."id" ASC LIMIT 100
  . . .

Using .each

>> User.all.each do |user| end
  User Load (416.9ms)  SELECT "users".* FROM "users"
  EXPLAIN (0.6ms)  EXPLAIN SELECT "users".* FROM "users"
EXPLAIN for: SELECT "users".* FROM "users"
                               QUERY PLAN
------------------------------------------------------------------------
 Seq Scan on users  (cost=0.00..1253.72 rows=7372 width=2726)
(1 row)

Your first clue that using .each could be a performance bottleneck is the fact that the RDBMS felt like it was necessary to EXPLAIN why that query was taking so long.

So, take it easy on RubyMine and write better code.