The world without Visual SourceSafe

I am not here to bash Visual SourceSafe as I still believe that it is a great tool for simple development shop but to explore the world after leaving VSS. What are the possibilities on offer?

The primary aims are to keep as much cash in my pocket rather than putting them in some vendor's pocket and that it has to scale up.

What can scale up better than source control system that are routinely used by Internet Open-Source communities? Hence there are CVS and Subversion. I have used CVS and not at all impressed with it and since Subversion (SVN) is a replacement of CVS, I will concentrate on it instead.

The other on offer is VSTS with TFS from Microsoft. Since my MSDN subscription can let me use this and that it is a fairly common toolset, I will also explore this one too. The fact that it is becoming like a giant octopus reaching out and trying to be a tool for everything worries me. Others such as ClearCase, I can't afford and my dislike of it has subsided considerably after my discovery of TFS as revealed below.

There are enough centralised materials on TFS that need not be repeated but Subversion route is more interesting and is free!

One of the things that stunned me when looking at VSTS/TFS as a VCS is that it has taken away the facility of keyword substitution of things like $Revision:$, $Date:$ or $Log:$ (keywords available in VSS) in the source file to brand it. They are god-send when you have a few copies of them lying around.

In these days of ubiquitous USB memory drives, the chance of having a few copies of the same file is extremely high. Without any form of identification, you will be spending hours resolving the differences.

To me, this is a philosophy that someone is trying to ram that into the customer's throat and is a classic example of "Why Software Sucks...". The fact is that the repository has all these pieces of information and the software refuses to allow the users to use them as they see fit. Their developers should be reminded that "You are not the user" principle.

This is not just VSTS/TFS dogmatic approach in pursue of their philosophy but out of the box, ClearCase does not support this too. But at least in ClearCase, one can add a script that is called when one checks in a file to extract those information from the repository and injecting them into the source file. Microsoft, I hope you are listening.

It is also interesting to compare the philosophy used in Subversion in managing the versions.

• It is very similar to that used in TFS.
• It treats a set of files/folders as a tree rather than file by file as in CVS.
  
• It is also atomic - meaning that if one file in a set fails to check in, the whole set will not get in.
• The revision number applies to the entire tree not really to a file.

OK. I have left the best part last. Even though their versioning models are almost identical, SVN allows users to perform keyword substitution to inject revision number using $Revision: $, check in date using $Data: $, and the customary $Id: $ is also there too. For more information please see "Keyword Substitution" in Chapter 3 of the book, which is free. The only thing missing is to inject the change history into the file. For that I can live with it.

Good to see SVN developers that are considerate and not pushing one's philosophy down one's throat.

This alone wins me over immediately.

For Windows users, one of the disadvantage with early CVS was that there was no GUI client. SVN has fixed all that. The best is the Windows Explorer plug-in called TortoiseSVN.

For those that live day in day out inside Visual Studio, help is also available in the form of an add-in.

Finally, the Windows version of SVN with an installer can be downloaded from here free.

Armed with all the materials, I am off to explore the world without VSS. Stay tune.

RANU - Microsoft's advice

RANU is a new acronym that I have just discovered when installing SQL Server 2005 Express books online.

It stands for Run As Normal User. In other words, another acronym for LUA.

I was digging around looking for advice on this new concept called "User Instances" and this is where I discovered this acronym. Microsoft actually wants developers to RANU rather than as Administrator and has gone to great length to help by introducing this new concept called "User Instances".

On this topic, this is what Microsoft's advice to the development community:

Microsoft strongly recommends NOT running as an administrator because this reduces the amount of damage that can be inflicted by a virus.

This piece of advice can be found on the books online on "Users Instances":

Many Windows users have accounts with administrative privileges. Unfortunately, running as an Administrator makes it easy for malicious software to take over a user's computer. However, malicious software run by non-administrator users cannot make system-wide changes and therefore can do only limited damage.

It seems developers have a very poor idea of how to develop in non-admin account and they can found out the recipe from here.

Many developers thought that they are shackled down as a poor users and they all will tell you that developers need administrative rights. I was in that camp once.

I think they are very confused. No one denies that a developer need administrative rights but that rights are not required for the majority of time. There is a sharp distinction between having administrative access/privilege and running as an administrator. The latter means you have turned off the security infrastructure of Windows. The former means that you operate in LUA or RANU and gain the elevated privilege when you need it.

For example, as Keith said you do not need administrative rights to compile or debug a program. Visual Studio is quite happy RANU. The only time you need Admin rights is if you need to register COM server, restart IIS, etc.

In COM development, you do not need to register a COM component in order to build the client. All you need is their TLB. Similarly in .Net, you can generate the interop assembly manually in the build script for the server, thus avoiding the need to add a reference via the COM tab.

So if I were a developer who still insist on running everything as admin, I respectfully suggest he/she to visit Keith's instruction, give it a go and you will be amazed how little adjustment you have to make. It also sharpens your awareness of security issues when programming.

The benefit is that you can feel the security envelop within your debugger. So if there is any access violation, you will be told immediately.

On the topic of Users Instances, if you follows the example in that article to have a taste of it, rather invisible actually. You may not have user instances facility turned on by default and when you open a connection to the user instance, you will get a System.Data.SqlClient.SqlException saying that

Generating user instances in SQL Server is disabled. Use sp_configure 'user instances enabled' to generate user instances.

This is what you have to do to fix it:

1. Fire up the Sql Server Management Studio Express
2. Press New Query to compose a query
3. Follow the advice in the section for "sp_configure 'user instances enabled'" here.
   

Grep the tab - driving me mad

Most of the people would have heard of this great Unix tool called Grep. This is the authoritative site on the Grep and can be downloaded from here for Windows. This downloads the whole set of GNU tools, which are very good.

There appears to have a number of slight variants of Grep around, kind of like Linux/Unix and that the GNU Grep does not support the ability to find the TAB (0x9) character. For example, if you have a line like this:

<tab>Hello World

in a file file.txt and if you use this syntax

grep -E "\t+Hello" file.txt

You will get nothing. The reason is that according to GNU Grep, \t is not an acceptable special character. It simply looks for \ follows by t repeating one or more time followed by Hello, contrary to standard Regular Expression syntax. So grep does not use regular expression at all.

To search for white spaces, GNU Grep has this syntax: [:blank:] which indicates a space or tab. But it will not be just looking for TAB.

All is not lost! There is a variant of grep that supports the Perl Regular Expression mode. It is selected by -P or --Perl switch. You can download it from here for Windows version.

With this you can use this syntax to echo the above line:
grep -P "\t+Hello" file.txt

The only disadvantage of this version of grep is that it is not a single file program. It now requires the following DLL: libiconv2.dll, libintl3.dll, pcre3.dll and in addition, it requires MSVCP60.DLL.

It is nice to see this version of grep.exe also has the PE version information so that you can tell what version of software you have. It never amazes me why Unix/Linux never has anything like this. It is almost impossible to tell the vintage of the number of grep.exe in my machine and all of them have different MD5.

If you need to conceal the e-mail address from spammer

I have been updating my blog to improve communication but I do not want to plaster an e-mail address all over it for spammer to harvest it.

So I searched the BlogSpot help forum and found many valuable suggestions. Among them I have found using an e-mail encoder an easy way to accomplish this.

I followed one suggestion to edit this blog's layout to add a JavaScript/HTML page element to inject my contact e-mail address. According to the community is can prevent harvester. Time will tell I guess.

Agile Software Development

Many people thought agile software development is all about doing things fast and no need to do planning and design but let's not be too fast.

A recent report on Agile movement emphases that many have

mistaken belief by some adherents that no requirements planning or architecture should be devised before embarking on a project.

In Jim Highsmith's book "Agile Software Development Ecosystems", he said:

Agility means quickness, lightness, and nimbleness - the ability to act rapidly, the ability to do the minimum necessary to get a job done, and the ability to adapt to changing conditions.
[...]
They become skilled, and Agile, from long hours of training and effective mentoring. Sometimes their drills are repetitive and prescriptive, but only as part of learning.

Agility also requires discipline and skill. A skilled software designer can be more agile than a beginner because he or she has a better sense of quality.
[...]
"You need to have a very good discipline in place to be able to respond in turbulent times, yet simultaneously know when to be 'undisciplined.' I view anticipation to be actively seeking situations where the generally accepted guiding rules or principles no longer apply, or where shortcuts are the least risky approach to take to gaining some objective. To be able to understand when the rules don't apply, you need to completely understand when they do"..... He has to be skilled before he could be agile.

Agile individuals can improvise, they know the rules and boundaries, but they also know when the problem at hand has moved into uncharted areas. They know how to extend their knowledge into unforeseen realms, to experiment, and to learn.

These paragraphs in his book are so accurate in describing the agile software development that everyone considering adopting any agile approach should recite. I recommend this book to anyone serious about adopting Agile Software Development. This book lacks a lot of hypes that are frequently found in books trying to sell this movement.

However, far too many managers and developers only thought agile software development as a free ticket to experiment, and forgetting the to learn bit. Manager has forgotten about using skilled person who are more agile than a beginner and discipline to carry out the project. In turbulent times, they opt for 'undiscipline' approach rather than disciplined. No wonder so many managers have a bad run with Agile movement.

The conference pulled no punches and declared that "Transitioning to agile can be difficult". Don't try to introduce this if you have an important product to deliver on time when you have no experience in Agile Development.

How do you get skilled people? These paragraphs provide the answer. Sadly, managers have conveniently overlooked this.

These paragraphs also answer how 'pair-programming' works in agile movement. Often people would argue that you do not need to start the project with skilled people because pair-programming would lift the game. According to Jim, Agile developers are skilled "from long hours of training and effective mentoring". Otherwise, pair-programming would exploit human frailty by gyrating to a comfort zone, which may not produce the desirable result. Most likely, like many things in life, it is harder to develop virtuous habit than bad ones.

First look at MOKA5 - not impress

A colleague of mine drew my attention to this little seemingly cute piece of software called MOKA5, which was touted to allow you to carry the OS around in your portable devices, such a USB drive, etc.

It also has a familiar name called LivePC, which UBuntu uses to allow potential users to boot the machine up on a CD ROM to have a taste of UBuntu prior to committing oneself. This is a very nice feature but don't let the UBuntu's LivePC be confused with this LivePC.

To be a true portable piece of software for portable device, it has to

1. behave something like Torpark, Portable FileZilla, or anything from Portable.com that you do not need to install anything in a pc.
2. that, it must be able to run in LUA because you do not have administrative rights in Internet Cafe, public PC or corporate desktop.

These are my guidelines to evaluate this product.

So what better person to check this out than a LUA-devotee. To save you from the suspense, I can tell you that I am sorely disappointed because this thing will not run without administrator privileges. So it is wrong for calling this a piece of software for portable devices.

Below are some of the investigation into why it needs administrator's privilege and that it is not a software for portable device or portable software.

At the core of it, is that it demands administrative rights to start LivePC, even after installation. Hence it fails the above 2 conditions completely.

Evaluation of the product

The installation of the downloaded package livepcengine-setup-1.0.8949.exe proceeded fine in LUA because I was installing this to a portable device. However, it was stopped because I was installing this to a portable hard drive with NTFS and standard user did not have rights to create files in the root directory.

This program placed autorun.inf, m5launch.exe, m5launch.log, and m5uninstall.exe in the root directory. To help this program to install and to learn what else this needed, I decided to open up the ACL for this to allow user full rights to the root directory - dangerous but what the hack.

It also created the mok5 directory and placing "program files" and "document and settings" underneath it. Of course they did not possess the same ACLs as the real ones.

Since I'd developed a healthy distrust of autorun even prior to the Sony Rootkit saga, I did not have to eject and reattach that drive to fire up the autorun. It wouldn't work anyway.

When I ran m5launch.exe manually, it told me that it needed administrative rights to install VMWare Player. Oops! The penny dropped. Could this be just a dodgy way of running VMWare Player, which was free, and a way to hoodwink people into subscribing the VMWare images? What is the license implication of the OS in those images?

Anyway, of course it did not start and I thought it must be because I did not have VMWare Player installed. At this point it became very clear that this was not a portable software, even ignoring the security demands. Or even software for portable devices.

It should be 'installed' (almost like xcopy) onto a portable device, plugged that device into any machine and it should run without any problem, even in LUA. But this thing would not meet this demand.

Since I was interested to see what it was doing, I ran the m5launch.exe from an administrator's account and this triggered the installation of VMWare Player. I could watch before my eyes with Process Explorer the installation and starting of the following services:

• VMNet.exe
• VMNetDhcp.exe
• VMWare-authd.exe

They were required to provide internet connectivity. Without them started LivePC would still start, of course in administrator's account, albeit without network connectivity.

Eventually, LivePC fearless browser came up and inviting me to participate to a survey. Of course why would I miss an opportunity to provide some truly garbage!

The other thing that I dislike LivePC's installation was that it forcefully installed the VMWare Player to my C:\.

The other area that I thought LivePC did poorly was that it could not run in LUA. There did not appear to have good reason requiring administrative rights after everything was installed. VMWare Player ran fine in LUA. Streaming down image from their server should work in LUA, if you avoided writing to the real "Program Files" or updating HKLM.

I did not have any trouble running VPC or VMWare to host OS in my standard user account, including creating images. Perhaps the LivePC developers should try to develop this in non-admin account and it might then be able to run in LUA.

When I finally terminated the LivePC it asked me if I wanted to uninstall VMWare Player. I presumed it would do that cleanly if I said yes but I did not.

The bottom line is that, it is no different than you carrying around VMWare images on a memory stick and run it on a PC with VMWare player installed. It is NOT a portable solution or solution for mobile warrior.

Time to uninstall this thing.

Using NUnit without installation

I have been using NUnit 2.2.6 for quite some time now and want to upgrade. The fact that I have to remove my NUnit 2.2.6 and install the new version and then to choose which version, .Net 1 or .Net 2, sort of put me off.

Then I came across this discussion thread on the NUnit forum with a lot of recommendations from Charlie Poole, the key developer/architect of NUnit that completely dispelled my concern and worry. It shows how to 'install' NUnit without installation and supporting both versions.

Essentially, you can use NUnit without installation and you can also have NUnit 2.4.1 for .Net 1.1 and .Net 2 co-existing on your machine without conflict.

This is how to do it:

1. Download from NUnit project on SourceForge the version you want. Let say NUnit 2.4.1 for .Net 1.1. Instead of downloading the msi version, take the ZIP file (not the source). In this case, it will be NUnit-2.4.1-net-1.1.zip
2. Create a distinct directory for this file, say NUnit-2.4.1-1.1 and unzip the content to it preserving the folder structure.
3. Create a short-cut on the desktop to bin\NUnit.exe and label it accordingly.
4. Then go to the Visual Studio Command prompt and in the bin directory run the GacUtil /I to install the nunit.framework.dll to the GAC.
5. Repeat steps 1-4 for NUnit 2.4.1 for .Net 2 making sure that this version is placeed in a separate directory.

Because the nunit.framework.dll is in the GAC, as Charlie recommends, VS will not perform local copy.

If you have to develop the project at different places, say at work and at home, where the locations of the NUnit are different, then you are recommended to define the location of the NUnit's bin directory to VS project using the "Reference Path" setting.

Reference Path settings are not saved with the csproj file but is in a user file, csproj.user, and this is not source controlled either. Hence moving the csproj around will not require one to change the csproj file.

Now on my work station I have NUnit 2.2.6 so that old projects continue to work and NUnit 2.4.1 for .Net 1 and .Net 2. The only trouble with this arrangement is that your project source control does not contain a version of the nuit.framework.dll.

This blog message explains why there are two versions of NUnit. In fact, one can simply lauch NUnit.exe with the /framework switch instead of changing the .config file.

Ungreyed the OK button in Firefox's download dialog box

Firefox is a great product and I use it wherever a web site does not spill out FF-unfriendly pages.

However, there is a bug in FF (version 2.0.0.3) that calls for some radical way to deal with it. Do not apply this technique to other Windows applications.

In a normal FF, it is set to download to the desktop and that for a file type (more correctly MIME Type) of say PDF, it is set to invoke the viewer automatically. This kind of setting is stored in a file in your Windows profile area under the tree
"Application Data\Mozilla\Firefox\Profiles\[a unique FF profile directory]". For those .Net Programmers, it is kind of like Isolated Storage. FF generates a unique directory name for your FF profile.

In there you will find a file called mimeTypes.rdf.

Now, here are the steps to reproduce the bug. Since this is an experiment and that you may like to restore to the original state, you should take a copy of the file mimeTypes.rdf to a safe place. When you have finished with this experiment, simply overwrite the mimeTypes.rdf with the original copy and you would not know that you have mucked around with FF.

Now open FF and go to the Tools | Options... to bring up the Options dialog box.

• In the Main section, set the download option to "Always ask me where to save files".
• In the Content section, click the "Manage..." button for the File Types. You should see a list of types in Download Actions dialog box. Look for PDF type and click on it. The "Remove Action" button is then ungreyed. Click it to delete the PDF from the list.

Now close that dialog box to return to FF. Navigate to a web site where you find a PDF to download.

If you simply click on that link for the PDF, FF will bring up a dialog box asking you what action you would like and it looks like this. If you do not get this, restart FF.


I have actually find this dialog box extremely handy. See the greyed out "OK" button circled in red. According to Mozilla, this is a bug and is caused by some kind of corrupted mimeTypes.rdf file.

Don't be fooled by this greyed button, which in normal Windows UI indicating that it has been disabled. Far from it, in FF-land and is very much alive and kicking.

I do not believe that this is caused by a corrupted mimeTypes.rdf file. I have successfully demonstrated with a brand new installation in an environment that I have manually cleaned up every scrap of Mozilla stuff. By following my steps above, I could reproduce this.

I have further proof that it is most likely a coding or logic bug inside Mozilla's GUI engine in dealing with button and activation process. Here are the ways to ungrey that button to get to that PDF file you want.

1. The simplest of the lot is alt-tab away from FF and alt-tab back. The greyed OK button now become ungreyed and you can select it.
   
2. For those using tablet PC, it can be very inconvenient to perform alt-tab. So tap or click on the greyed OK button (didn't I say radical way before as you would be a fool to do that to a Windows application?) once and it will become ungreyed. A second tap or click on the OK button select the action.

In Windows, if a button is greyed (disabled) your program will not receive any button click message. Hence clicking it will not do anything at all. Since I am not familiar with the internals of FF and in particular its GUI engine, I wouldn't know where the fault actually is.

As demonstrated, it is not random and it can be reproduced consistently. So Mozilla engineer should be able to home in to the trouble.

IE7 Uptake stagnant - that's obvious.

Recently PC World reports that the uptake of IE7 has stagnant even with the release of Vista.

It does not really need much to work out exactly why. If MS wants everyone to move over to IE7, all it has to do is to remove the WGA check on installation. The slimy thing is that its Windows update downloads IE7 first before asserting if the Windows is WGA compliant.

To me it seems like a deliberate act of wasting people's Internet bandwidth.

Removing that check may restore some fondness to upgrade to IE7. Besides who needs IE7, those failing WGA check are mightily happy with Firefox and I am sure that they are promoting Firefox willingly rather than IE7.

Even on my WGA compliant machine, I do not install IE7 for good reason.

Full mark for thinking outside the box (or rather inside?)

In the cat-and-mouse game of defeating the HD DVD protection reminiscence of the cold war, nice to see some application of thinking outside the square approach:

The latest attack vector bypasses the encryption performed by the Device Keys—the same keys that were revoked by the WinDVD update—and the so-called "Host Private Key," which as yet has not been found. This was accomplished by de-soldering the HD DVD drive's firmware chip, reading its contents, and then patching it. Once that was done, the firmware was soldered back onto the drive.
[...]
"They cannot revoke this hack," said forum member arnezami, who has been at the center of much of the AACS cracking recently. "No matter how many Private Host Keys they revoke we will still be able to get Volume IDs using patched xbox 360 HD DVD drives."

Well done!

Microsoft's UAC & Sudo

Mackenzie recently blogged about the history of Sudo and the similarity to Vista's UAC

What makes this whole thing funny, though, is something I saw a couple days ago. Head over to Builder-AU and listen to Peter Watson from Microsoft. He says, User Account Control is a great idea and strategically a direction that sort of all operating systems and all technology should be heading down Excuse me

My brief encounter with Ubuntu and the chanced encounter of the dialog box seeking my root password stunned me of the close resemblance to ME II's UAC.

All about a GUID

What's such a big deal for a GUID that every COM programmer is so used to?

What's such a big deal with this particular GUID:
09f91102-9d74-e35b-d841-56c5635688c0

Apparently someone, very touchy organisation like AACS LA causes a storm in Digg when someone rewrote the GUID by removing the separators and posted it on the Internet.

If someone like say AACS LA finds publication of a GUlD offensive, every com programmer should better check their GUID with AACS LA before they publish it in the type library or IDL. I suggest every com programmer just sends e-mail to AACS LM requesting permission to publish the GUID in the IDL.

This is stupid. As Ed Fulton rightly says, no one should be allowed to own an integer - a GUID is just a 128 bit integer!

Would they get upset if these special "AACS offensive" numbers were published in the form of a COM type library?

As Bruce Schneier once said in relation to using DRM to protect digital materials: it is like "making water not wet"

Some one is touchy! If they try to take down this kind of stuff, smart people can write materials carrying double, triple or n-possible meaning to conceal the true meaning or intend. How can anyone police that? The Chinese were doing this centuries ago before computer were even in the vocabulary.

"Why Software sucks... and what you can do about it"

This happens to be the title of the book by David S. Platt that I have just finished reading. The book's web site is here.

David is an accomplished software developer and authors of many books. He has even been designated by Microsoft a Software Legend in 2002.

The book is written in a light-hearted manner with David wearing the hat of a user of software, who has no a care of the inner working of the software he is interacting with. He has provided several commonly used commercial software packages, including web applications, to illustrate his point that "you're being forced to think like a programmer, even though you're not one and you don't want to be one".

The first chapter sets out the many reasons why user interfaces are so bad and so many software are so hard to use. "Instead of the programmer adjusting her user interface to the user's thought process she forces the user to adjust to hers". He considers this lazy programming. He uses the too-frequently used confirmation dialog box to illustrate the point.

I fully agree with his assessment of the landscape. This sentence at the conclusion of chapter 1 pretty much sums up why:

They suck because they're designed by programmers, who don't realize that their users aren't like themselves.

On his attempt to explain why developer do not use tools/technique to address this problem, David has this to offer:

Unfortunately, usability testing often gets left until late in the development process, just before the product ships.... Usability testing needs to be done early, ideally before any programming takes place.
[...]
... Eating your own dog food before releasing it to users helps your dog food taste slightly better than it otherwise would. But it won't change it into cat food.

For those that scan this book rather than reading it, do not write to David to correct his spelling of Idoit. He has not made any spelling mistake throughout his book. The definition of Idoit is given on page 14 as

...idoit, pronounced ID-oyt (or eed-WAH if you're French), to designate someone so clueless that he doesn't even know how to spell idiot.

So now I have learned one new word!

He called this frequent usage of confirmation dialog box "crying wolf" and I tend to agree with him. It is a pity that he does not cite examples using firewall programs that frequently pop up this dialog box seeking users permission or denial of a transmission. I use the Comodo Firewall and it has this dialog box that pops up so frequently despise my instruction that certain software package is considered safe and trusted.

Just because a user clicks on the "allow" button does it ever make the action any safer or that the firewall is doing the job? If the user does not possess the necessary skill to work through all the highly technical information in the dialog, his action, whether allow or disallow is suspect. Even I have trouble understand the materials.

It is the duty of the program to work that out and advise! That would be a much better example of "Crying Wolf". What happen is that the user becoming so used to clicking the "allow" button just to get work done yet without much harm that he/she would do the same in the presence of a real harmful attack.

He also uses the Web to illustrate that "the web designers don't know their users, and thus they think that by extension, they must be like themselves". David throughout this book constantly reminds the developer that "Your User Is Not You". Another similar saying that I have come across is that "there are more users than developers".

On the web, he points out two very important points that are not in the desktop software packages:

"...viewing a Web site is a very casual interaction.... home page needs to visually explain this in the first two or three seconds they'll spend there before ... go to the next link in the search engine list.
[...]
... The site's navigation structure .... needs to be obvious to the user within a two- or three-second glance, and too few of them are"

I also share his objection to those distracting dancing advertisement or time wastage splash screen. Far too many web designers have been lost their way distracted by the colour & graphics!

The book also touches on issues that are not interacting with user directly but still required to serve a purpose. He examines the issue of developing secure software requiring highly specialised skill by people ill-trained for the job.

I initially thought giving a full chapter devoted to describing the Geek's habitats - the conference and in particular Tech Ed is a bit of a waste of space. I am wondering how that compares with PDC (Profession Developers' Conference). But later on I realise that he is contrasting the behaviour of Geek in groups (in conferences) with Geek as individual.

All in all, this is a very entertaining book from someone that has experiences on both side of the camp and David's knowledge as a developer is found in a number of example in offering counter-arguments that frequently are used to brush off user's complains.

I have also learned one thing unrelated to user interface design or why software sucks and that is that the backdoor to warn user of the presence of a mine in Mine Sweeper game is still alive and kicking.

If you are looking for a recipe on how to avoid making software sucks, you would be disappointed, not so much as the materials are not there but they are not organised in a recipe format!