Authentication vs. Authorization

These aren’t just “10 dollar words” that both start with the letter “A”. If you have an application, you need to understand the difference between these two things.

Let me try to explain this way. Not too far from where I live is a semi-famous (infamous?) bar called the Flora-Bama, so named because it’s on the state line between Florida and Alabama. For purposes of this, imagine that the drinking age in Florida is 18 (it’s not) and that the drinking age in Alabama is 21 (it is). (The Flora-Bama is pretty big and I think there are bars on both sides of the state line. Let’s assume that’s true.) In this scenario, if you’re 19 – you can buy a beer from the bar on the Florida side, but not from one on the Alabama side.

Imagine the doorman out front is checking IDs and putting wristbands on everyone – yellow if you’re 18-20 and green if you’re 21+. That’s authentication. He checked your ID and identified you but didn’t make any decisions about what you could and couldn’t do.

If a yellow-banded 20 year old walks up to an Alabama-side bar, the bartender there will refuse to serve the patron based on the color of the wrist band. This is authorization. The bartender doesn’t check the ID again, but just makes an authorization decision based on the previous authentication.

You can (and in many cases probably should) outsource your application’s authentication function. When you see sites let you “Login with Google” or “Login with Facebook”, that’s what’s happening. They are letting Google or Facebook handle the authentication, but the actual site still has to decide what the user is permitted to do.

The simplest ramification of “outsourcing authentication” is – one less password for your site’s users to remember. More importantly, if you aren’t storing passwords – they can’t be stolen if your data is breached. Of course, you’ll need to decide if all of your users are likely to have a Google or Facebook account (or whatever service you choose to trust to authenticate).

Comfort Zones

A few days ago, I was walking into the downtown Chick-fil-A close to where I work. Outside was a man in a wheelchair. At first, I thought he was a panhandler, but then I realized he had a sign hanging on his wheelchair with a web address. This caught my attention.

His name is Donnie. Turns out – he has cerebral palsy and sells candy to support himself. (This is his web address if you want to find out more about him. If you’re so inclined, consider supporting him.) I was very inspired by his story.

As I was thinking about his story and how he probably got started selling candy, one of the things I was struck by was “he doesn’t really get to have a comfort zone”.

It made me realize what a luxury having a comfort zone is. A luxury is something that’s nice to have, but that you don’t need. I wonder what we all (especially I) could accomplish if we realized that we don’t have to stay in our comfort zones.

Pronouns

I’ve noticed that frequently when communication is unclear, the problem is pronouns. More specifically, the pronoun not having a clear antecedent.

“It’s not letting me …”

I work in technology and many times, clients and end users don’t know the correct name to call something, so I hear a lot of “it” used to describe something without it being clear what “it” refers to.

I understand not knowing the correct names of things. When I take my car to the mechanic, the shoe is on the other foot. I try to make up a term (“the curvy thing”). Even if it’s not the technical name, that’s a better antecedent than just saying “it” without context of what you’re referring to. Frequently, there have been several things mentioned earlier in the discussion and “it” isn’t clear enough.

Reaction to Transparency

I caught myself having (what I thought was) an interesting reaction to some online posts recently. I’m telling the story here because I think there might be a little insight into human reaction.

Someone (I don’t remember who) posted a book recommendation on Twitter a few days ago. Apparently by the time I saw the post, it had “gone viral”. The author subsequently posted something along the lines of “If I would have known what kind of reaction that was going to get, I would have added an Amazon Affiliates tag to that link”.

If you don’t know, Amazon’s Affiliate program is basically a commission program. If enough people that click on your special link buy something, you’ll get a little bit of a commission.

At this point, I specifically looked to see if the link had an affiliate tag in it. I don’t know why, but I had a feeling of “you’re not going to sneak one past me.” I was interested in the book but didn’t decide to buy it at that point.

A couple of minutes later, I saw a subsequent post from the same author that also linked to the book on Amazon, but this time he said something like “Here’s one with an affiliate tag included. It won’t cost you any more and why should we give Bezos all the money?” My reaction was completely different this time. I clicked the link and bought the book immediately. I think the decision was more about wanting to participate in the fun (like now we were working together to put one over on them) than because my desire for the book had changed.

It was interesting to me how blatant transparency completely changed my reaction.

Keeping up with time (Just do it)

For most of my adult life, I’ve worked in professional services where billing was done by the hour, so tracking time was a necessity – which doesn’t change the fact that I’ve always hated doing it.

Even when I was tracking my time, I almost always did it after the fact, meaning – I did the work and then when it was time to complete the timesheet – I figured out how I had spent my time for the previous day (or week).

I’ve been making a conscious effort to track my time in real time. (I’m using the timer in Toggl.) The first barrier to this for me has been that I have to figure out how to categorize this particular block of time, and I want to get started on doing the thing I’m about to. Tracking time is almost never done to just have a log of how you spent your time, but to accumulate time into “buckets” to be analyzed and tracked (and frequently – billed). In the past, I ran into similar issues when trying to start budgeting money in Quicken.

I’ve learned that there is value to getting in the habit of tracking your time even before you’ve figured out how you’re going to categorize it. In not much time at all, I’ve starting thinking – just before starting a new task – “I’m starting something new” and click the button to start the timer.

My Team Won so I’m Better than You

It’s the morning of the Iron Bowl 2018. For those that don’t know this is when my alma mater (Auburn University) plays their arch-rival (The University of Alabama) in football. In the state of Alabama, this is a really big deal. Bragging rights are at stake for a whole year.  If my team wins, I get to give the other teams fans a hard time about it all year. And really (if I’m completely honest about things), it means I’m better than them – at least for a little while.

When you think logically about it, it’s really strange that how one group of young (typically 18-22 years old) men (that I don’t know) do on a football field today compared to another group will affect how I feel about myself. (Full disclosure – my team is predicted to lose badly today, so that could lead to my philosophic frame of mind about this.)

This isn’t limited to just sports fans. Unfortunately, for many of us, which political party you identify with has become your “team”. Self worth is tightly linked to how your side does compared to the other side. The other “team” is the enemy. Their supporters are evil and must be defeated – not just on the athletic field or at the ballot, but in life.

It’s much easier to claim “our team’s” victories for our own (“We won! We won!”) than to actually get in the arena and win your own battles. Confession – when Auburn won the National Championship a few years ago, I paid a lot of money to be in the stadium and was overwhelmed with joy when the game ended. (“We finally did it!”) But – I had nothing to do with it.

Enjoy the games today. Good luck to your team. But – after the game, I’ll be working on my own game plan that will actually affect my life. I hope you’ll join me.

More thoughts on Gratitude

Several years ago, I took my kids to see Diary of a Wimpy Kid at the movie theater. The way that the main character ranks himself in comparison with the other kids at school really hit me between the eyes. I thought “I do that”. I’m not proud of it, but I do. (If you haven’t seen the movie, you can see what I’m talking about here.)

A few months ago it occurred to me that – wherever we put ourselves on the list – most of us spend a lot of time looking “up” at the people we’ve ranked higher than us and plotting on how we can climb higher, when we should “look down” and try to figure out how we can help those that we perceive as below us.

I was trying to explain this to someone and they (correctly) pointed out “you shouldn’t think you’re better than some people and not as good as some others”. I tried to explain that I knew I shouldn’t, but if I was going to have this bad habit, at least changing my focus from “looking up” to “looking down” might produce some good out of it.

I recently realized that – I don’t think this inner monologue of ranking myself in comparison to others was really about “better” or “worse”, but about who I perceive as having more than me, and who has less. There are definitely people that have more than I do, and people that have less than I do. When I look “up”, I focus on what they have that I don’t. That’s called “coveting” and it’s not a good feeling. When I look “down”, it makes me grateful for what I have and (hopefully) makes me to want to help those with less.

Grateful for the New Year

Happy New Year!

2017 was a year of changes for me. My oldest child graduated from high school and went off to college. In my work life, I finished the project I had been working on for a couple of years and, for the first time in about 20 years, felt like I had a little time to breathe and not have to put out fires constantly. At the end of August, I was able to go on a mission trip to Honduras that was eye-opening and provided a great opportunity for reflection.

At this point, I’ve started a couple of new work projects and plan to hit the ground running as 2018 starts. My New Year’s resolution is – to work on having an attitude of gratitude.

I’m reading a great book by Brene Brown – The Gifts of Imperfection (Let Go of Who You Think You’re Supposed to Be and Embrace Who You Are). She says: “Without exception, every person I interviewed who described living a joyful life or who described themselves as joyful, actively practiced gratitude and attributed their joyfulness to their gratitude practice.”

That sounds pretty good to me, so that’s my resolution – count my blessings and practice gratitude.

I hope you have a joyful (and grateful) New Year.

Forest and Trees for Projects

When you’re doing a non-trivial project, it’s basically impossible to focus on the forest and the trees at the same time. You have to get down into the details (trees) to get the project done, but while you’re doing the work:

  • you may lose track of time
  • you may not realize that the project requirements have changed (or that it no longer needs to be done)
  • you may not be doing a good job of communicating with stakeholders

I think you have to have different people focused on the forest than the trees. The waiter/cook analogy comes to mind here. The cook is focused on the tree of cooking Table 7’s meal, while the waiter is communicating with Table 7. “I just checked and it’s going to be right out.”

A few years ago, I was fortunate enough to attend a Disney Institute seminar. (I’m a huge fan of theirs.) I was recently going back through the material and came across something that I think is relevant to this: “People don’t separate their wants and needs – so if you meet their needs but not their wants, they may react as if you didn’t meet their needs.” In the case of the restaurant, the cook is working on their need (food). The waiter is paying attention to their wants while they wait for their food.

It’s tempting to think that you can do both at the same time. (I’ve frequently tried to do this myself.) I don’t think you can. You’ll have happier customers if you meet their needs, and their wants.

Tuition at The University of Life Experiences

When you’re about to spend some money on a service (hiring a new lawyer to help you form an entity, hiring a web designer to help with a new site, etc.) – it’s easy to get bogged down with thoughts of “Am I paying too much?” or “Is that the best rate I can get?”

Instead of spending a lot of time worrying about this kind of thing, I’ve decided to spend a reasonable amount of time making a good decision, but then to proceed and think of the money spent as tuition. There’s always going to be a cheaper lawyer (or cheaper web developer, etc.) but every time I proceed with one of the activities, I learn and get experience to help make a better decision the next time. I think that’s called education.

When I think of it like that, it seems like money well spent. I can live with that.