18 Haziran 2019 Salı

Scrum - Definition of Done

Giriş
Kurumlar kendilerine göre "Definition of Done" nedir tanımlamalıdır. Hatta gerekirse bir checklist bile oluşturulabilir.

Genellikle
Genellikle hikayenin bitmesi yazılı olan tüm testlerini geçmesi ve bilinen hatası olmaması anlamına gelir.

Halen hata varsa story bitmiş kabul edilmez. Yarım bitmiş hikayeden de point alınmaz!

Testler Konusunda İki Farklı Yöntem Var
1. Continuous Delivery
2. Continuous Deployment

Continuous Delivery
Açıklaması şöyle
Continuous delivery is a software engineering concept where software is delivered in short sequences, making sure that software can be released at any time. The goals of continuous delivery are to build, test, and release software faster and more often.
...
Continuous delivery is what happens when a new code goes to QA for testing. It occurs in a production-like staging environment, and changes are being manually released into production when the code is reviewed.
Continuous Deployment
Açıklaması şöyle
 ... continuous deployment doesn’t happen in a production-like staging environment. In this case, the code isn’t manually reviewed — automated testing is integrated and goes through the entire release process. There’s no waiting for the code to pass the testing phase before it moves into live production.


Redis Kurulum

Kubernetes
Örnek
Şöyle yaparız
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
  labels:
    component: redis
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: redis
  template:
    metadata:
      labels:
        component: redis
    spec:
      containers:
        - name: redis
          image: redis
          ports:
            - containerPort: 6379
Servis için şöyle yaparız
apiVersion: v1
kind: Service
metadata:
  name: redis
  labels:
    component: redis
spec:
  selector:
    component: redis
  ports:
    - port: 6379
Linux Kurulum
Şöyle yaparız
sudo apt install redis-server
Kurulumdan sonra redis'i servis haline getirmek ve şifre koymak iyi bir fikir. Redis konfigürasyon dosyası şu dizinde. Redis'i mutlaka TLS ve şifre ister halde kullanmak gerekiyor, yoksa container içinde çalışsa bile "remote code execution" yaptırılıp örneğin crypto-mining yapan kötü amaçlı yazılım (malware) çalıştırması sağlanabilir.
- /etc/redis/redis.conf veya
- /usr/local/etc/redis.conf 
Port
Şöyle yaparız
port 6379
ReplicaOf
Şöyle yaparız
port 6380
replicaof 127.0.0.1 6379
Servis Haline Getirmek

/etc/redis/redis.conf dosyasındaki supervised alanına systemd değeri yazılır

Şifre
/etc/redis/redis.conf dosyasındaki requirepass alanına şifre yazılır

Enable Remote Connection to Redis
Açıklaması şöyle
By default, Redis is accessible only from localhost. To enable remote connection to our Redis server, update the bind-address in Redis configuration to 0.0.0.0:

bind 0.0.0.0 ::1

Once updated, restart it:
$ systemctl restart redis

Windows Kurulum
- Redis zip dosyası indirilir ve açılır.
redis-server.exe çalıştırılır


14 Haziran 2019 Cuma

Distinguished Encoding Rules (DER) Kodek

Giriş
Distinguished Encoding Rules (DER) formatı certifikanın veya private key'in binary olarak dosyaya yazılmış hali demek. PEM genellikle DER'in Base64 haline çevrilmişidir diye düşünülebilir.

Yani PEM ASCII tabanlı bir kodek. DER ise binary bir kodek.

13 Haziran 2019 Perşembe

Scrum Başarısızlıkları

Giriş
Scrum'da başarısız olan projeleri şöyle sınıflandırmak mümkün.

Önce Neden Agile
Agile yönteme geçişin bir gerekçesi olmalı. Açıklaması şöyle. Yani mevcut süreçlerde (eğer varsa) ipin ucun kaçtıysa haydi çevik süreçlere geçelim fikri de yemeyebilir :)
So when someone starts to explain to me that they adopted the Spotify model, my first question is: are you an online audio streaming company? And if not, why do you think this will be successful? In most of the cases, it turns out to be just another reorganization driven by an urge to get control over what is happening in the organization. And trying to do that by a way of organizing instead of a way of working.

- Pseudo Agile
Yalancıktan agile. Agile başlayıp her şeyin eski haline yavaş yavaş kaydığı yöntem

- Superficial Agile
Yüzeysel agile. Agile olmadığını bildiği halde biliyormuş gibi yapılan yöntem

- We Also Know Agile
"Biz de yaptıh biz de biliyoh" deyip hiç bir şey dinlememe yöntemi

- Do Agile
Yönetimden gelen emirle "acil" yöntemine geçiş :)
Örnek
Açıklaması şöyle. Bankalar için uygun değil.
Companies that introduce full blown Scrum -- including self-organizing teams -- risk destroying themselves. In traditional, top-down, hierarchical companies, Agile and self-organizing teams must be contained, otherwise it will destroy the whole hierarchy. That is why banks struggle with Agile.




DO-178B - Object Oriented Technology in Aviation

Giriş
DO-178B ile Object Oriented Teknology kullanılması düşünülüyorsa Handbook for Object Oriented Technology in Aviation kitapları mutlaka okunmalı.

Hanbook for Object Oriented Technology in Aviation Nedir?
4 ciltten oluşur. Ciltleri okuduktan sonra resmen OOT kullanmak istediğinize pişman olacağınızı hissedersiniz.

  • Cilt 1 : Handbook Overview - OOT Background anlatılır
  • Cilt 2 : Considerations and Issues - OOT Kullanmadan Önce Dikkate Alınması Gereken Noktalar ve Sıkıntıları özetler
  • Cilt 3: Best Practices - Önerileri içerir
  • Cilt 4: Certification Process
Bir de tüm problemlerin listelendiği Issues and Comments About Object Oriented Technology in Aviation (IL) dosyası var.

Bazı Maddeler
Multiple Inheritance
Özet olarak Multiple Inheritance kullanılması tavsiye edilmiyor. Sebeplerini aşağıda açıklamaya çalıştım.

Cilt 3'te Multiple Inheriance 3 başlık altında inceleniyor.
  1. Multiple Interface Inheritance
  2. Multiple Implementation Inheritance
  3. Mixed Multiple Inheritance
1 numaralı Multiple Interface Inheritance daha masum görünse de IL'de kullanılması unclear intent gerekçesiyle tavsiye edilmiyor.

IL dosyasında şu maddeler var.
* Multpile Inheritance should be avoided in safety critical certified systems (IL 38) -> Yani multiple Inheritance kullanılması tavsiye edilmiyor
* How can we enforce the rules that restrict the use of specific OO features (IL 58)-> Yani multiple inheritance kullanılmadığı static analiz yapılarak doğrulanmalı.
Multiple Inheritance ile gelen belirsizliğin (ambiguity) sebepleri şunlar:
The ambiguity shows up in a few different ways:
  1. If you have two base classes with the same field x, and the derived type asks for x, what does it get? 
    • If the two x variables have incongruent types, you could infer it.
    • If they're the same type, you could try to merge them into the same variable.
    • You could always expose them as weird fully qualified names.
  2. If you have two base classes with the same function f with identical signatures, and someone calls f, which gets called?
    • What if the two base classes share another common virtual ancestor (the diamond problem).
    • What if the function has different, but compatible signatures?
  3. When you construct a class with two base classes, which of the base classes' constructor is called first? When you destroy the object, which is killed?
  4. When you lay out the object in memory, how do you do it consistently?
  5. How do you handle all of these cases with 3 base classes? 10?
STL Container
STL container'ları zaten kullanılmıyor. Bir sebep şöyle. Yani dynamic memory allocation yapılması.
Think of it: you are coding some safety-critical embedded software (e.g. for train braking, autonomous vehicles, autonomous drones, big oil platform or oil refinery, missiles, etc...). You naively use some C++ standard container, e.g. some std::map<std::string,long>. What should happen for out of memory conditions? How do you "prove", or at least "convince", to the people working in organizations funding a 100M€ space rocket, that your embedded software (including the compiler used to build it) is good enough? A decade-year old rule was to forbid any kind of dynamic heap allocation.
Template Kod
Normal template kodlarda ise bir sebep kodun varlığını izah etmek. Elimizde şöyle bir kod olsun
template<class T>  fun(T t){
   do_some_thing(t);
}
Açıklaması şöyle. Sanırım kast edilen şey template kod ile kullanılan tüm tipler için ayrı ayrı gereksinim ve test yazmak.
In the classic way to specify a safety system you have to provide a complete description of each and every function and structure of your code. That means you are not allowed to have any code without specification. That means you have to give a complete description of the functionality of the template in its general form. For obviously reasons that is not possible. That is btw. the same reason why function-like macros are also forbidden. If you change the idea in a way that you describe all actual instantiation of this template you overcome this limitation but you need a proper tooling to prove that you really described all of them.


11 Haziran 2019 Salı

Yazılım Mimarisi - Layered Architecture

Giriş
Bu yazılım mimari benim en sık gördüğüm örnek. Genellikle 3-Tier Design olarak karşımıza çıkar. Açıklaması şöyle
There are different flavors of Layered Architectures and there’s no rule that determines how many layers should exist. The most common pattern is the 3 tier architecture, where the application is split into Presentation Layer, Logic Layer, and Data Layer.
Katmanlar
Açıklaması şöyle. Uygulama yatay (horizontal) katmanlara bölünür.
Presentation -> Business Logic -> Persistence olarak ayrılıyor.
The basic idea of the Layered Architecture is to split the application into at least three distinct areas of code: Presentation, Business Logic and Persistence, where Presentation can access Business Logic and Business Logic code can access Persistence, but not the other way around.
Tipik bir akış şöyle
Event fired in UI, traverse to a method in the BLL, perform logic (possibly in multiple parts of the BLL), eventually to the DAL, back to the BLL (where likely more logic) and then return some value to the UI.
Bu mimari ilk olarak 1990'larda ortaya çıkmış. Açıklaması şöyle.
When modern enterprise development took off in the 90s, it was quite normal to develop “everything” the enterprise needed in one or at most a few monolithic applications. The Waterfall Model was the de-facto process for software development.

Of course the development team necessary for such projects became too big eventually to work properly, so people thought about how to scale organizationally. Having the mindset described above, they came up with the idea of splitting up the application based on technology. There was a “frontend” team, a “backend” team, maybe even a “middleware” or “database” team.

In this setting the Layered Architecture fits very well, because the interfaces between the layers could be more or less changed to remote calls. So the different “horizontal slices” of the application could be “independently” developed.
Katmanlar Arasında Data Transfer Object (DTO) Kullanılır
Açıklaması şöyle. Buna aslında Data Oriented API deniliyor.
This design became prevalent in the late 90s, when a lot of developers transitioned from traditional procedural languages like C, Pascal, and Basic to Java. Sometimes, the DTOs were called Value Objects at the time, but regardless of what they were called, they were the familiar data structures we've grown accustomed to previously. It was a popular approach and easy to understand because it didn't really require a change of mindset.

Eleştiriler

1. Business Logic Katmanının Her Tarafa Bulaşması
Business Logic Katmanının GUI katmanından bağımsız olması gerektiği varsayımının yanlış olduğu söyleniyor. Varsayım şöyle.
One of the more practical arguments for a layered design is, that it creates a Separation of Concerns. It means that the business logic to transfer money from one account to the other should not concern itself with what color it will have on the Web GUI.

This argument sounds reasonable on the surface, however it implies more than what it says. It is almost always interpreted as all presentation-related logic should be separated out of “business logic”. Not just colors and font-sizes, but everything. 
Bu varsayımı çürüten açıklama şöyle.
This obviously does not reflect reality, as business-related things do tend to have a UI and do tend to have persistence. An Account, Amount, Transfer, etc. does need to be presented in addition to fulfilling other functions. How does Layered Architecture address this apparent conflict? It doesn’t really. It usually uses anemic objects to push the data of an Account, Amount, etc. to other layers, so it can be presented or used. It smears business related knowledge all over the application, because everything has to understand the data for themselves. The Presentation needs to understand what an account is, how to ask for it from the user, how to create the object and with what parameters. Repeat for all other layers.
Yani BL ile UI arasında aslında BL tarafında kalması gereken ancak UI katmanını işlemesi için gerekli bir sürü nesne/bilgi daha ister istemez, UI katmanına gönderiliyor.

Bu yüzden de uygulamayı idame ettirmek zorlaşıyor. Açıklaması şöyle. Yani aslında katmanlar iç içe geçmeye başlıyor.
Many applications have two ends: a user-side and server-side, often designed in two, three, or n-layers architecture. The main problem with n-layered architecture is the layer lines are not taken seriously, causing application logic to leaks across the boundaries. This entanglement between the business logic and the interaction makes it impossible or difficult to extend or maintain the application.
Örneğin uygulamamız konsoldan kullanılıyor olsun. Eğer Web'den de kullanılıyor olsun istersek işler karışabilir.

Hexagonal Mimari uygulamayı kullanabilen/sürebilen bir başka arayüz takılmasını bir nebze kolaylaştırabiliyor

2.1 Sebep Data Transfer Object Kullanılması mı ?
Buradaki eleştiri katmanlar arasında Data Transfer Object'lerin olması değil. Eleştiri bu nesnelerin  klasik Object Oriented kodlar olmaması. Açıklaması şöyle.
One of the core principles of Functional Programming is pure functions.

One of the core principles of Object Oriented Programming is putting functions together with the data they act on.

Both of these core principles fall away when your application has to communicate with the outside world. Indeed you can only be true to these ideals in a specially prepared space in your system. Not every line of your code must meet these ideals. But if no line of your code meets these ideals you can't really claim to be using OOP or FP.

So it's OK to have data only "objects" that you fling around because you need them to cross a boundary that you simply can't refactor to move the interested code across. Just know that isn't OOP. That's reality. OOP is when, once inside that boundary you gather all the logic that acts on that data into one place.
Dolayısıyla DTO eğer ekranda gösterilecekse display(), displayEditable() gibi metodlarının olması gerekiyor deniliyor. Böylece BL değişince, UI etkilenmez çıkarımı yapılıyor.

3. Çünkü Data Transfer Object'in BL ve UI Tarafından Ayrı Ayrı Yorumlanıyor
Açıklaması şöyle.
The biggest problem with data-oriented interfaces is that they share meaning implicitly. This is not the good kind of sharing either. It means that because the communication is reduced to data, both sides must have the appropriate interpretation for that data, which might include anything from simple things like what values it could have (can it be null?) to complex interrelations between different parts (like the 1/100th flag above).

If both sides must possess this knowledge then it follows that both sides have to change when this interpretation changes. To make it worse, the interpretation is implicitly shared, because there is no way to detect if suddenly other rules or interactions apply to the data, so there will be very limited language and IDE support for implementing the change. The only way to prevent this outcome is to keep this knowledge localized and hidden as much as possible.
Sonuç - Katmanlar Arasında Mantıksal ve Gözle Görünmeyen Bağımlılıkların Olması
UI'daki herhangi bir değişikliğin BL katmanından başlayarak her yeri etkilemesi. Açıklaması şöyle.
The Business Logic defines the data the Presentation receives, usually in the form of Data Transfer Objects, which are pure data structures. Any modification on the Presentation side other than trivial color changes will need additional (or less) data or data that is structured differently, or paged differently, etc. In other words the Business Logic will respond to Presentation changes. Although there will be no physical dependency seen in code, there will be an invisible semantic dependency that runs from Presentation to Business Logic.

The same with Persistence. The Business Logic can only use things which the Persistence Layer offers. So if a new query is needed or a new update statement for a new use-case, the usual approach is to just implement it in the Persistence and use it in the Business Logic Layer. Again, no physical dependencies are there, but there are always changes in Persistence happening because of Business Logic changes or needs.
Basit bir örnek şöyle.
If you want to change an Account, for example introduce a “known/unknown”-flag or change the account number to an IBAN, or even support a different Account type, you’ll have to hunt down and change each and every piece of code that receives any data associated with the Account. You’ll have to change the “UI” of the Account for sure, the Business Logic how to handle it, and of course the Persistence to store it. You will very likely have changes in all layers. This amount of work seems to be surprisingly large, when the actual change only seems to involve a single business concept.

Everyone who had the unfortunate task to “simply add a new field to this page” in such an architecture already knows how difficult this task can be.
İyileştirme Denemesi - İlişkiyi Anlamak İçin Package By Feature
Package By Feature yazısına taşıdım.

Çözüm Denemesi - Pure Object Oriented Yaklaşım
Layered Architecture'a karşı çıkanlar genellikle pure OO yaklaşımı savunuyor. Bu yaklaşım EJB 2 ile denendi ancak başarısız oldu. Açıklaması şöyle.
The best example of this is the failed design of the EJB 2 entity beans. An entity bean represents a business model. Typically models have to be persistent and EJB 2 entity beans tried to support this behavior. That looked fine from a OO point of view but not from a Separation of Concerns point of view. In order to support this behavior over the wire, each EJB 2 Entity Bean was in fact a RMI stub with its own RMI connection to the backend server. You can imagine how badly that scaled when in a typical screen of a typical application you are dealing with hundreds of entities at any time (think a simple data table).

What happened was that entities have narrow scope. Most of the times they are request scoped. They also processed in large numbers, they can typically scale up to millions of records in the database and up to hundreds at a single use case.

28 Mayıs 2019 Salı

DevOps

DevOps Aslında Çevik (Agile) Süreçlerin Devamı
Açıklaması şöyle. Amaç devir işlemlerini ve birbirini bekleyen birbirine muhtaç insanları en aza indirmek.
In order to do small batch releases central to Lean and Agile best practices, you need to find a way to reduce handoffs and make releasing to production seamless and easy. Out of this necessity naturally flow many of the DevOps practices. The concept of the full stack engineer popularized in DevOps is a natural answer to this need. To reduce handoffs engineers must be conscious of all portions of the system so that any member of the team can understand and integrate QA, security, and operational requirements without handing off to other teams. Similarly, cross-functional teams must become the norm so that small, self-contained team can deliver fully functional products without additional hand-offs to operations teams.
DevOps Ne Olarak Anlaşılıyor
Sanırım en çok bir şeylerin otomasyona geçirilmesi olarak anlaşılıyor.

Denetimli (Regulated) Ortamlar
Finans gibi denetimli ortamlarda bile DevOps kullanılıyor. Açıklaması şöyle
Challenges of implementing DevOps in the finance industry
Unlike other industries, regulated industries imply several challenges 

- Strong restrictions on secured networks 

- Fine-grained audit trails 

- Strong ACLs models 

- Full lifecycle governance 

- Integration with 3rd parties
Governance
Governance için bir yazı burada.