Every business has "shrinkage". Stock levels mysteriously reduce. Inventories decline overnight. Products grow legs.

You'd think that the software business is different. "There's nothing physical to lift!" you say. Not true. If you're thinking of selling software via the web, take note: you're going to get dodgy orders. It's just a fact of life.

So how exactly does it work? Well you get an order in, same as usual. Now what I do for each order is check the IP address against the credit card address. You can use a site such as maxmind to do this. Unfortunately this is can only happen after the order is processed. And then you get one. An order where the IP address is from a very different country than the credit card address. A stolen card. In these cases, the email is also usually from a free email service, and is usually one of those numbered emails, as the account has been created just for the purposes of fraud. You do get the occasional sad individual who will use a traceable email address. It will show up on gaming and script-kiddie websites.

When you get one of these orders you're stuck. The perpetrator already has your product downloaded. And you have to put through a refund asap, otherwise you'll get hit with callback charges. And you should put through the refund as soon as you can so that you don't offend the poor eejit whose credit card number was stolen.

As a software company, it's not too bad — at least you don't loose money shipping out physical goods. On the other hand it makes you more vulnerable to this sort of thing, as the fraudster doesn't need a physical address for pick-up, just an email address.

Now there are a few things you can do to prevent or reduce this type of fraud. You can block certain countries from purchasing. This works, but it's not something I want to do. First, some of the dodgy orders may come from people who genuinely can't afford the products (hey – just ask me for a free copy guys! I'm reasonable). I grew up in a developing nation (South Africa), so I can understand that. Second, other folks from those countries want to do legitimate business, and they should have the chance to do so. I just don't like the idea of blanket bans.

Another thing you can do is have more stringent automated checks, based on IP and email address. Given the relatively low level of this problem, I'm not sure it's worth it. It's not like the bad guys would suddenly decide to play by the rules as a result. They'd probably just try to hack the trial download instead (Hint to bad guys: please hack the download instead of using fraudulent credit cards). So I'll put the time into coding features for my products instead.

Finally you might want to sign up with a fraud detection service. Never used one so don't know how well they work. Maybe I'll do this if the problem ever becomes really bad.

If you sell stuff on the web, you will get credit card fraud. It's a cost of doing business with the entire planet. And hey, doing business with the entire planet is a much bigger win than losing a few sales. So I guess my final advice would have to come from Tony: "Suck it up!"

One other thing to note, if you are developing a software product for download via the web: really strong copy protection is useless and a waste of time. It seems to be really easy for certain groups of people to get hold of stolen credit cards, so they'll just buy a copy. A nice, easy way to get around your oh-so-clever copy protection. And then you loose anyway. You could opt for "phone home" protection, but that has it's own issues, like customer privacy. (And don't even think about using a dongle! How sad.)

This interwebnet thing is no bed of roses. The rules are different and you'd better leave your outrage at home.

tag-gen: Technorati Tags: credit card fraud software web download Del.icio.us Tags: credit card fraud software web download

When you find a bug in a purchased Ricebridge product, you will get a $15 ThinkGeek Gift Certificate.

A lot of software shops talk about quality. A lot of people really want to build quality software. But nobody wants to take the hit for bugs. "Of course you'll have bugs," they say. "Bugs can't be avoided!" "Bugs are a quantum necessity!" (OK, I don't know what a quantum necessity is, but it sounds pretty final.)

So there are very few who will step up and say. "Sure, if you give me cash for my code, there should be no bugs. At all." Now there was this little-known guy, (Knuth, or something like that) who did hand out cheques when you found a bug in his stuff. I believe his code has been bug-free for years.

But let's be honest here. The human animal responds to incentives. Plain and simple. We do what gratifies us, and we avoid danger and negative outcomes. Now Ricebridge is a pretty agile shop, so I've got all the gratification I can handle, software development-wise. But it just isn't enough to get rid of the bugs. And there are a lot of people throwing all sorts of development practices at bugs, in the hope that happy, gratified, developers, will code perfect code and perfect products. Ain't gonna happen. We humans are too stoopid.

So we need a new tack. A bit of danger. Some thrills. There's nothing like a kick up the arse to get you moving. I'm deadly serious about bugs at Ricebridge, so let's up the ante. Let's go for broke. Bugs have to hurt. As coders, they have to hurt us, not just our users.

So here’s the deal. If you invest in my products, and you find a bug, I will give you a ThinkGeek Gift Certificate for $15 dollars. It's real money — you can buy cool nerd stuff with it. Specifically I chose ThinkGeek so that you could get some fun out of my mess ups.

So it's time to get serious. I'm going to make 100% bug free software. It's not just a goal, not just an intention. It's something that is going to happen, no matter how many Swiss Memory USBs it takes!

(Note: I'm a ThinkGeek affiliate, but I reckon it would take a year to earn even $15 that way, so the $15 comes right out of my pocket.)

Running a Java 1.5 SAX XML parser on the UltraSparc T1 is five times slower than running it on my Athlon 2800+.

That's about right. Five times slower. Now when I got delivery of my new T2000, I thought, "Hey, this baby's gonna rock!". Then weird stuff happened.

First, I ran the performance tests for my Java CSV Component. Twice as fast. Okaaay. Well, fair enough, it is faster. Would have expected more though.

Then, I ran the performance tests for my Java XML Component. Five times slower. Eek!

Alright, I thought, slow disks! Nope. Doing the tests in memory led to the same performance. And the disks were slow, in case you're wondering.

OK. Maybe my code is to blame. Let's do a pure and simple SAX parse, with no actions. Still five times slower! So now I was getting depressed. My lovely new T2000. Broken! Or worse: Crap!

So I went out for lunch.

And then it hit me. Duh! 32 hardware threads over 4 CPUs (and that's just the minimum config). And I was only exercising one of them! My performance test only runs in one thread. You see, the T2000 is designed for throughput. Serving lots of web requests all at the same time. That sort of thing.
[Update: I wrote the original post from memory — the are only 16 hardware threads. But I'll leave the rest of this post the way it is, so you can have a few laughs. The final conclusion still holds as you can get higher spec T2000s with more CPUs].

So I run a really brain-dead test. I opened up a whole load of consoles and started the test on all of them, all at the same time.

Pay Dirt!

Not a wince. Not a whine. Cool as a breeze. Same speed on all consoles! The T2000 just laughed at me. A few samples from mpstat, and I was a happy camper again. You see, each thread may be a bit on the slow side, but you do have 32 of 'em. So if each one is five times slower, you need five threads to do the same work. But: five into 32 total threads gives you six or so. Which means:

Six Times Faster! Baby!

So what you get with the T2000 is a big old scalability lever, and a fairly small performance lever. Same old story really. There's always a trade-off.

Now maybe I was doing some wrong. I don't know. You tell me. I've been out of the game for a while when it comes to Solaris.

Here are the performance tests I was running, in case you're interested: XML Manager, CSV Manager.

So I don't know what this means for my report on the T2000. The single thread numbers suck, but the concurrency rocks. Guess I'll need some new charts!

I've just put up a new release of CSV Manager, my CSV file parsing Java component. This release adds the ability to handle comments in CSV files.

I should explain how the Ricebridge versioning system works. It's pretty standard in fact. The first number is the major version. All releases with the same major version are forwards and backwards compatible with each other. And when you buy into a major version, you get all releases in that version. I don't believe in making customers constantly pay for upgrades. A major version bump occurs when there is a really big change in functionality.

The second number is the minor version. This indicates a release series with a stable feature set. No major structural changes occur within a minor version. The minor version is bumped whenever there is a reasonable increase in functionality. Compatibility with earlier minor versions is retained.

The third number is the build number within the minor release. This is incremented each time there is a bug-fix release. It is also sometimes used for small features, such as, oh…, comment support, say. All bugs, by the way, are documented. You know exactly what you're getting when you buy a Ricebridge component.

The only thing I haven't got quite sorted just yet is a proper change log for the components. But hey, it's on the to-do list!

So now you know how I work. Just to repeat, if you buy the 1.1 version of any of our products, you'll get all the versions up to 1.9 (or 1.whatever we get to), as free upgrades.

Technorati Tags: java csv file component release Del.icio.us Tags: java csv file component release

The worst thing you can do as a website owner is to constantly make lots of little changes.

The best thing you can do as a website owner is to constantly make lots of little changes.

You need to know what works on your website, and what doesn't. And your visitor statistics will help you find out. But if you keep making changes on an ongoing basis, you'll never know for sure. I've just put up a change on my own site, and I've realised that it will be really hard to tell if it's going to work or not.

Unless you just love multivariate analysis, it's much better to let things run for a few weeks to really find out what fires up your visitors. Statistics are strange things, and you can get really big swings from one week to the next. The standard deviation is bigger than you think.

So before you panic, and jump around the place changing stuff on your site, just take a deep breath and make sure you know what's happening right now. Measure twice, cut once. Make lots of changes, but make each change deliberately, in a way you can measure. Try to space things out, or makes changes that are independent. Lots of little improvements over time add up to big sales, but you don't want to go for a random walk either.

So be zen about your site. You may know something is wrong. You may have seen someone try to use your site and flounder. You may think you need a new colour scheme. You may even think you need an onsite avatar (no, don't go there!). But make sure you can tell the difference between before and after.

(And the change I made? I put links to my solution-focused tutorials on the top left, above the boring standard navigation menu. I'm sure it'll work, but I've mixed it in with other changes and it'll all be too hard to untangle.)

Here's a technorati tag generator written in JavaScript and using the Dojo Toolkit. A while back I was moaning about the lack of documentation for Dojo, so I thought I would do something about it.

I decided to reinvent the wheel Tag generation is a great little thing for a JavaScript web application. It has very focused functionality and it's not a very big piece of code. So if you want to get into Dojo, you can just look at the JavaScript that I wrote, and see how I use bits and pieces of Dojo to implement stuff.

Now what I did not do was use any widgets. Dojo widgets are a whole other ball game. I have written about them before — see my post about implementing a progress bar widget. This bit of example code is more about all the other cool stuff that Dojo lets you do.

The full source code for the tag generator is available in the tags.js file. The code is fairly direct, there's a bit too much repetition and stuff like that. But I thought I would try to not to "architect" it too much, as it is meant to be easy to understand.

Events

The event handling uses the dojo.event.connect function. I also use the convenient $ function convention, instead of the far too verbose document.getElementById, to pick out the HTML elements I want to attach events too. All the event connection code is at the end of the tags.js file.

Transparency

The links on the side bar bring up semi-transparent divs. This is done with the dojo.style.setOpacity function, which hides all the browser specific stuff. I fade in the transparency over a few seconds using the dojo.lang.setTimeout function, which works properly with JavaScript objects, so it's better than the native setTimeout function.

Escaping

Dojo also provides a full suite of escaping functions. I use dojo.string.escapeXml and dojo.string.encodeAscii for formatting the tag text correctly. These are great little functions that "just work".

Dynamic HTML

Various HTML elements are shown and hidden using the dojo.html.show and dojo.html.hide functions. These work fine so long as the element is display:block. It the element is inline, they won't work.

AJAX

And, of course, AJAX. You knew it was coming. The comment form submits the comment data to the server using AJAX and pops up an alert to let you know it was saved. Look for the dojo.io.bind function to handle all this for you. A really big win. Totally cross-browser and another "just works" feature for Dojo.

I should mention that I use JSON for the data encoding, just in case you were wondering how I did that. It's by far the best method for AJAX data exchange. Yeah, I know, the X is for XML. Well, honestly, JSON is better and much easier to work with, it’s just that AJAJ is crappy acronym.

So there you go. If you're an old hand at Dojo, then this post is probably a bit pointless, but if you're just starting out, hopefully you'll find some of it useful. It's meant to highlight things that Dojo can help you with, even if you aren't building the next GMail, Flickr or Web 2.0 Wonder Site.

Feel free to ask questions in the comments…

Technorati Tags: dojo javascript example tutorial sample tag generator technorati

Literally. This thing is so loud I now have a headache. No more benchmarking for me today.

I've decided to introduce free trials for my two main products. As a micro-ISV, these types of decisions are always a bit tricky. I've done pretty well up to now sticking to online demos. By their nature, the products (a csv parser and an xml parser), are not that suited to downloadable demos. They are API-based components, after all, so there's nothing to see, as such.

But I've decided the time is right to experiment. You don't get anywhere in business if you stick to the same old strategy regardless. Based on visitor comments and usage of the online demos, I think that the lack of a downloadable trial for the products is hurting my sales. By how much is hard to say. But we'll soon find out!

One reason that people do not offer a downloadable trial is fear of copying. Well, to be frank, this is just not a problem for me. I don't know why people are so afraid of copying. To my mind, those who copy could probably not afford to buy anyway, so you've lost nothing, and gained a user. I already offer my products free to charities and public bodies, so this is an extension of that line of thinking. Sure, some will never buy, but down the line, quite a few will. Maybe that's terribly innocent, but hey, I believe in people!

The other question about demos is how to structure them — time-limited or function-limited. I don't really like function-limited. It makes a bad impression. And it mucks about with basic functionality. So I've gone time-limited. You'll get your standard 30 days. That should be enough time to see if the components work on your CSV or XML file.

So check back here in a month or two and we'll see how this little experiment goes.

Well, you've got hand it to Jonathan Schwarz (Sun CTO), when he says "free server", he means "free server".

A while back I decided to apply for this "free server" promotion that Sun Microsystems is running. You get a free server if you can run some benchmarks and if you blog about it. It seemed way too good to be true, but hey, I'll try anything once. So off I went to their online application form, filled out the details, and thought; "there's no way they'll go for a micro-ISV!"

But they did — I got a call from Sun a while back and was told it was on. A Sun reseller, Horizon Open Systems, are looking after the details. I still can't quite believe it! Way to go Sun. I know Sun bashing is a bit of a sport, and they have done some silly things, but I doubt you'll find a opportunity like this with any other vendor.

Here are the benchmarks I'm going to be running: CSV Manager Performance Report, and XML Manager performance report. Let's just say I expect significant speed increases.

So what is the server anyway? It's a Sun Fire T2000. Here's a picture of the box. It sure is purty. It has a 4-core ULTRASparc T1 Processor, 4Gb of memory and two 73Gb SAS disks. And that's just the starter kit. Makes you want to cry if you've been living in x86-land.

There is one tiny fly in the ointment though. Sun sort of forgot to pack an RJ-45 to DB9 adapter, which you need to access the machine controller, so that you can actually boot Solaris. Oops. So at the moment it just a big lump of metal and silicon sitting in my office. The Frustration! Anyway, Horizon are getting me sorted with the cable, so we should be up and running next week. It's gonna be a long weekend.

Congratulations to Roman Nowak, winner of last week's Ricebridge Java Components Competition! A free XML Manager for you sir!

So this week, let's get pay homage to our descendants: grab those HTML anchors! All you have to do is figure out some simple XPath expressions to get at the data in the document, and a free copy of our XML Manager Java component is yours.

Alright people, don't just stand there! ... Go!

...

Uh, begin, commence, start moving… theoretically you have been racing for about forty seconds now, and so far Mr. Schaffer is winning because he's nearest to the door.

CSV Manager, our Java CSV file component, has just got a JARS TOP 5% rating!

Previously we had a TOP 25% rating, but now we've been moved up! Here is the mail I got this morning:

Resource Name  : CSV Manager
Developer ID   : RR22
Resource  ID   : RR22-1

-------------------------------------------
Presentation : 400
Function     : 300
Originality  : 250
-------------------------------------------
Total        : 950 (out of a possible 1000.)

JARS - The Java Applet Rating Service 
- http://jars.developer.com/

Not bad. The presentation score is really great. We put a ton of work into our documentation (there's loads of it for a start). We really are pretty obsessive when it comes to good documentation. It's the one thing that lets great components down. Document or die. That's the way it is.

Right. Next job: a TOP 5% Rating for XML Manager. Here we go...

Congratulations to A. Luepke, winner of last weeks Ricebridge Java Components Competition!. A free XML Manager license is on it's way.

And on to this weeks competition. Just get your head around a simple address book XML document. All you have to do is figure out some simple XPath expressions to get at the data in the document.

And thanks to all of last weeks entrants — let's see what you can do with this week's challenge.

Good Luck!

I haven't given up on the tragic typing. Still plugging away on goodtyping.com:

Very good Richard! You have made only 1 error (0.42%).
You can proceed to lesson 9.

Seconds: 112

Keystrokes Per Minute (KPM): 127.50

Perhaps not the greatest progress in the world, but hey! Overall I am pretty happy with the goodtyping.com site and would recommed it if you are trying to learn touch-typing.

Now if only they would let me turn off CAPS LOCK…

Competition time! Just to make life interesting I'm starting a series of weekly competitions to win a free XML Manager or CSV Manager license. All you have to do is come up with some simple XPath expressions.

As this is a new idea for me, I'm interested to hear what you think, especially from a business perspective. Will I get a "YES" out of this idea?

The New York Java Consultant (Solomon Duskis) notes that we seem to be starting businesses pretty young in Ireland. That's quite ironic since all the "I sold stuff as a kid before I made my millions" stories that I've ever read in business books have always been American stories. It's kind of an archetype: young American male with nothing but guts starts business against the odds and makes it big. And of course he earned his stripes selling lemonade and cookies.

Maybe it's a sign of the times — we're just starting to develop the do-your-own-thing mentality over here. For so long in Ireland, the pinnacle of success was a civil service job with a state pension. And just maybe you could be a doctor if you were really good. Most people with any sense left the country (of course, they're all back now starting companies!). I think it's not just about the economic climate — it's about a psychology of liberation. You need to give yourself permission to succeed. Note that I said succeed, not fail. Irish people have been giving themselves permission to fail for far to long. Success, on the other hand, is scary.

And it is true that lots of young people in Ireland are quite open to starting businesses, straight out of school or college. Last year I was on a business startup program, and there were two graduates on it. It makes sense to have a go at starting a business at that age — nothing to hold you back.