Late last month, I received some bad news about web2project...

It turns out that web2project was vulnerable to a handful of select Cross Site Scripting (XSS: definition) vulnerabilities. While the attack vector was pretty specific to being an already authenticated user, it had the potential to be a major problem in a poorly configured system.

On the positive side, I say "was" because within 10 days of being notified of the problem - and the same day the vulnerability became public - we had a patched release out the door and available to users. We've spent the past month since encouraging them to upgrade. Of course, we further benefit from the fact that although the vulnerability does affect us, we're not named in the report.

Recently, I realized that despite talking about Karl Fogel's book - "Producing Open Source Software" - numerous times over the past year[1][2][3], I've never written a review of it. So without further ado, here we go.

I originally picked up my copy in mid-2007. It took me a couple months to get to it, but once I did, it rocked my professional world. To be clear, Karl Fogel is an early (founding?) member of the Subversion Version Control System.

A few weeks ago, I wrote a post about Joining a Startup. In it, I discussed some of the important things to consider before joining a startup including responsibilities, career path, v1.0 vs the Vision, and funding. The post itself got a great response but more importantly, it generated some questions about funding. Apparently, many geeks don't know how startups are funded, so here's some perspective.

There are a variety of ways that a company can be funded. One route - bootstrapping - involves building revneues to take the next step, building those revenues to take the next step, lather, rinse, repeat. While this can work, it tends to be slow and plodding and it's not what I'm talking about here. When a company needs a certain critical mass (Eg. Ebay, Amazon, Twitter), this doesn't work very well. The alternative is Funding.

Since the v1.2 release in early December, it's been a bit of an adventure... in the first week after the release, we got a couple major bug reports. Another few days resulted in a few more. Another day, another bug. In the first two weeks, we received a total of 7 bugs that ranked from major to critical. All in all, it was a bad time. Conveniently enough, none of the bugs were particularly complicated or deep, so we were able to quickly resolve each of them and eventually release a v1.2.1. And after receiving word of a small issue requiring another merge, v1.2.2 shortly after the New Year.

While a few members of our community were understandably upset, I was impressed that the bugs were found so quickly and resolves just as quickly. I couldn't put words to this well until I read Karl Fogel's post "Bug Growth is Proportional to User Growth, and Bugs are not Technical Debt." Wow, that Karl is a smart guy. More on that topic later.

For v1.3 we have quite a few features and fixes on the way:

As many do this time of year, I'm taking a few moments to review last years' goals and set new ones for this year. I don't do this lightly. I simply share them here as a form of public accountability. Without further ado...

In the last few weeks, I've talked with a number of friends about career changes. Some are feeling antsy and just want to move, others are starting their own consulting, and others are starting and joining startups.  While I've done all the above - to varying levels of failure success - I thought I'd share the things I've learned along the way.

Under no circumstances am I being critical of any friend or associate's startup, this is about patterns.

First, everyone does everything. Check your ego at the door. In the first startup I was with, I was in charge of adding reporting to the eCommerce application and taking the garbage out. Was it an effective use of my time? Not at all. Did it have to be done? Yes. Did we have the money to hire someone else? Nope. If your startup is renting office space, you probably won't have to worry about this... but who signs for packages? Who re-orders coffee? On the flip side, you could be the one taking technical questions at the next investor pitch or invited to the big customer Christmas party.

Twas the night before Christmas and all through the house,
Not a peripheral was stirring, not even my mouse.

I with my Xbox and wife with the same
had just settled down to a nice co-op game.
I covered the front, she took the rear
our enemies had a dynamic duo to fear.

At a loud crash, I arose from the chair
wondering "what could be happening down there?"
We entered the room and what did we see,
but two surprised cats and a sad Christmas tree.

"But wait, what is that in the paws of the kitten?"
Something unexpected, something unbidden.
A gift certificate for Amazon, another for Fry's,
both looked like glittering gold in my geek eyes.

My imagination went wild, it just wouldn't stop,
so many ideas, my head might just pop.
But then I wondered "from where did this appear?"
and the wife agreed "this wasn't just here."