Hidden Features of Windows 10 Install That You Should Worry About and Fix

There is a new "feature" in Windows 10 that you'll want to know abut (and fix) on Day One.  That's on top of the little security challenge noted in the previous post which notes a key action you will need to take before the roll-out happens.  If you haven't done it yet, please do so immediately.

A separate post addresses the actual roll-out experience, but the summary is: pretty painless.

What I want to let you know about today is a whole new security wrinkle you need to consider: the Windows 10 defaults.

Yup, that's a vulture sitting there, looking over your shoulder.


(Image: Audubon)

Let me say first, and not for the first time, that I am a Microsoftie at heart. And I trust the NSA with my information a heck of a lot more than I would trust the Washington Post (in case you are reading this, hi guys!)

Still, you can't help but be surprised by the default settings.  They go a long way to explain Rand Paul's apparent paranoia.  If someone really is watching your every move, are you really paranoid?

So, when the actual install cycles end and the system asks whether you want to customize: YES, you do!

Read the settings carefully. Your choices may be a bit more aggressive or cautious than mine for various reasons.

Here are the ones that jumped out at me:

In the basic Customization table, the key settings are almost the reverse of what I wanted.  I disabled:

• Content and calculation details: no, Microsoft does not need to know that
• Typing data: ditto
• Advertiser information: no, thanks.  I get enough of that already.
• Location (since this computer doesn't travel much and when it does I use the phone for "near me" sorts of things). Google seems to know the answer anyway; that's probably a whole other topic!
• Page prediction. This one is not so much a security and privacy issue as it does cut down the background processing.  Yes, it probably would speed up the actual transition from on page to another but Verizon's FIOS service and (let's admit it)Windows 10 are pretty fast for most purposes.
• Suggested hot-spots: more ads
• Auto-connect to content-suggested networks: Really?  "Yes" by default?

That is 8 out of 10 that I chose to reverse.  What is left?

• Smart scanning: protects against known or likely threats while in Windows browser: seems like a good idea, although I will likely not be using Windows Edge until all the sites that don't support Internet Explorer reverse themselves.
• Send errors and diagnostics to Microsoft: sure, let them identify and fix problems. Of couse, I have no idea how much data gets sucked out of the machine when i doe that, and it may well undo all of the concerns noted above.  Oh, well.

After the customization appears, you will get an opportunity to go through the "Getting Started" page. At first I thought it did not work, but it came to life eventually.  Then I thought that the audio drivers has been killed, as the getting started videos were playing but without sound.  That too was restored after a bit.  I suspect that the system was busy finishing up some other tasks in background.

The system now advises that it includes several new applications:

• Photos (the old Microsoft Office Photo Manager turned into a tile; actually this happened in Windows 8)
• Music (I can't help you much here as I don't have much to do with music)
• Microsoft Edge (new new name for the browser), and
• Movies and TV (Windows Media Manager turned into a tablet app)

Since they are tablet-style applications, if you haven't had this pleasure before you'll have to get used to dragging them down and off the screen when you are done with them.  Yecch.  And it makes it quite hard to multitask with them, i.e to have them and another applications on the screen at the same time. There's probably a way to do that but frankly nothing about tile-world is intuitive to me and for the most part it disgusts me so much that I just don't use the apps.  There's a reason why I have a PC as well as a phone, which is specifically that I want to to be able to use information from more than one program at a time.  I assume that was also the reason hardly anybody liked Windows 8 either.

Once you've registered changes to your defaults and taken about 10 minutes to go through the Get Started set of tutorials (they are pretty lean, and more motivational than instructional, so it does not take long), you get a restart.

Up comes a nice new screen and to my surprise the system displays some customer screen-savers you may have saved earlier rather than the standard Windows displays.  Thus far, AVG Tune-up has not complained of the dag on system resources that those screen-savers cause.  When it does, Windows has some defaults available.

Also, fortunately, the Microsoft ID (the outlook.com address you were forced to create is you bought a computer with Windows 8 on it) and the PIN you had to set up for Windows 8 still work.

Then the system will take another recycle for applications setup; this one is only about 5 minutes.

Once it has finished with that, you get the opportunity to do more customization and again you may want to do just that.

The next area with some security implications is the Notifications.

• Tips about Windows: You may want to shift this to "on" for a while until you get the feel of your new toy.  You can get back to the notifications dialogue from the Start menu [did I tell you that as back?  Thank goodness it is.  Although you may want to consider re-installing your own, as the Windows 10 version still does not show Recent History].
• Application notification: Of course yes. You should decide on this at the application level.
• Notifications on the lock screen: The point of the lock is that you are away from the computer. Why show your notifications to anyone else?
• Alarms, reminders and incoming VIP call while locked: same reasoning
• Hide notifications while presenting: yes, that would be a good idea. You cannot rely on this, however, as I assume it only works if you have a projector plugged in, or perhaps if you are using PowerPoint.  So if you are doing a webinar-type event through a web service, it may or may not pick up on that. If you're going to share your desktop, you should assume that people will see what you have on your desktop.

There are other settings but they are pretty much the usual choices, with one exception: under Multi-tasking, there are "Virtual desktop" options for showing desktops other than yours.  Whether you want to do that or not depends on your situation, of course, but there is no provision for declining to show your desktop to anyone else.  Until I learn more about how this works (as usual, there is zero documentation for the system), I am going to assume that anyone in your connected work-group can see your desktop.  And of course the people in Redmond, if you did not turn off the customizations noted above!  And the NSA.  And the Chinese.  Well, heck, you might as well not worry about it.  Just stay off the porn sites.

That's about it from a security perspective - as far as I know!

Microsoft seems to have a bit better information as there has been a patch install daily so far. Presumably they are fixing holes.

Oh, yes: one more thing.  When all this is done, if you have not done so already, check the "hidden icons" tray.  It's in the status bar at the bottom-right of the screen.   If your antivirus of choice is not up and running, then you'll need to decide whether to adopt Windows Defender or go back and re-install your preferred flavor. Which is where the "key step" from before the install comes in.

As always, comments are welcome.

How to Survive the Transition to Windows 10 - Fact versus Fiction

Well, the great day has finally arrived.  Or maybe not.
All of us will have the opportunity to see one of the most amazing projects of our time as it unfolds.
Microsoft is going to replace the operating system on hundreds of millions of computers with basically no user involvement needed.  Hopefully.

Naturally they have a story as to how this will work: here's a link to their FAQ page.  It's pretty detailed and informative.  Still it is what architects cal this the "rosy path" - everything goes as planned.
I never did get the Apple craze, I guess I'm just a Microsoft sort of person.  So I hope it does go well.  This post will be the first of several that comment on what really happens.

Everybody will be working through this at a different pace.
If you have any insights to share, please do comment and it will become part of the thread.
If you have a lot of knowledge to share, let's talk offline about a guest post or a webinar.

The announcement

Some months back, Microsoft advised me that I would be getting Windows 10.  I needed to sign up for the deferred program or else it might just appear right now.  Well, duh.  Of course I am going to wait until I learn more about this beast. It was hard enough trying to get past Windows 8 and keep using Windows 7.

I still haven't learned how to use Windows 8, nor have I figured out why anybody would want to.  The whole point of Windows computers is to do useful things on them , which usually requires more than one window being open, and that is something you cannot in Tile-world.  Apparently nobody else figured it out either, hence the arrival of Windows 10, with, we are assured, much more customer validation and totally complete testing. Hopefully I learn to love it.

The deferral process required a small download to my system.  Did I trust that?  Since they built about 4 GB of code that already sits on my machine now, and I get who knows how many updates a week in the background, of course yes.  If they were going to attack my system, it would have been done long ago. The little app sat quietly in some corner waiting for its master to awaken it, with no apparent impact on the system at all.

The Prelaunch

This week I received a popup notification that the window for Windows 10 downloads is now open.  There is a phased roll-out.  It does not say which phase I am in.  I hope I am last.

Even the deferred program has a deferral option.  I can even choose not to get it, and stay on Windows 7. If I get it and do not like it, I can roll back to Windows 7.  However, if I do that, I'm on my own, and I will have to pay market price for Windows 10 once I realize what a terrible mistake I made.  But I could go ahead and do it (or, really, not do it).

As it happened I went by a Microsoft store where I met a very knowledgeable representative.  He says they have really tested it a lot. There have been very few complaints about apps not working, although it is true that for some that come in OS-specific versions, it may be necessary to get the Windows 10 drivers, plugins or whatever from the application vendor.

One of the features of Windows 10 that he showed me is that tile-world does not occupy the entire screen, so you can get at the rest of the screen without having to shut down your current app.  So you can in fact work with two applications open at once, even in Tile mode.  That is great because .some of the Windows tile-based apps are really pretty nice but until now I have never used them because of the one-app-at-a-time approach.  Now maybe I can use them.

What Do I Do Right Now?

Go through your Control Panel and work out what applications you have installed.  I have at least four that I don't remember what the heck they were and had to go to the internet to find out.  If you don't need them any more, get rid of them altogether. If you do need them, write down your license keys, user ID and password for each app that you use, and keep it somewhere other than your computer - just in case.

Updated: after the install did upload itself, most of the major applications seemed to be in order. There are some that Windows removed altogether, which revealed themselves fairly quickly in normal operations because they were mostly freeware that supplements the Windows capability (or, perhaps, turns it back to the way Windows 2000 did it - old fuddy-duddy!)  Examples include Classic Shell (the Start button tool) and 7-zip (zip compression utility that didn't collapse the way the Windows 7/8 versions did).

The most serious problem was the disappearance of AVG (various security packages). Microsoft understandably inserts Windows Defender as a default to make sure that the user has some security present, but did you really have blow the other package away without a trace?

Since I use the paid version rather than the free version, it was a good thing I had the e-mails with the key codes. I do note, though, that if you have forgotten to record your keys, AVG will send them to the e-mail address from which you purchased the licenses in the first lace.  And if you have any of your AVG keys then you can access your AVG account and get the rest of them.

In a separate post I will go over some of the installation quirks.  There are not that many, but what you find may surprise you.

I have no doubt whatever that many people are more knowledgeable than me on this topic.  Please leave comments!!

LeSS SAFe is more - events coming up right now

Another installment looking at different ways to adapt Agile to enterprise scale.  Inflating it, as it were ...





Photo credit: Gerald Pereira and License

• First, some comments on LeSS given that you have the opportunity to go see for yourself (if you can afford it).
• Then opportunities to learn about SAFe.

What is with these mixed-case acronyms?  I guess there are some people pedantic enough to complain that you cannot use a capital E in SAFE because the words has a lower-case "e".  It would be if we YELLED IT LOUD ENOUGH :-)
Worrying about that sort of thing is very un-Agile.

LeSS Materials and events

H/T to Brian Sjoberg at Excella Consulting (a company that has impressed me over the past 2 years), although in this case Brian is representing the DC Scrum Users Group (DCSUG)for this heads-up.  If you have interest in Agile I can thoroughly recommend DSUG's meetups.

• A course on Large-Scale Scrum (LeSS)in the DC area from August 10-12 (registration page)
• LeSS SAFe Comparison by Gosei
• Blog post comparing Waterfall, SCRUM, SAFe and LeSS here.

LeSS Seems to be Just Less

As noted in an earlier post, I have not quite got the drift of LeSS.

The folks who are leading proponents of it in the US describe the integrative processes as "whatever the self-defining teams define it to be".  One could make a case that a pyramiding schema of scrum-of-scrums and product owners would be able to establish integration in terms of cross-component integration.   I don't see that as alleviating the organization's concerns over scalability and security.

I do note that in the most recent framework picture (at the LeSS link above), architecture and security now have a specific place.

A Turn for SAFe

H/T here to Net Objectives for the following information:

• Conference: Agile2015, in Washington DC - next week (August 3-7).  $2400.

• Net Objectives' 3rd Day of SAFe: Elaborating SAFe  (you have to give up your e-mail address but it gets you access to tones of material).

• SAFe in an Hour. A quick introduction to SAFe.

• Driving from Business Value in SAFe. Introducing minimum business increments and why they improve SAFe's portfolio management.

• Rapid Implementation of SAFe. Rapid is the new method we'll be discussing in the open space.  This was a pre-look at it. 

• Introducing Leanban. A first look at our new team-level Agile process that is more than an integration of Scrum and Kanban. [This link here is further updated since the presentation date].

• Using SAFe in Small & Mid-Scale Organizations. SAFe is intended for development groups of more than 50 people.  This webinar presents methods of coordinating multiple teams which total fewer than the 50 required for SAFe.

Agile Enthusiasts and Professionals

Beware the agile enthusiast who has only worked on one project at a time and does not get why the enterprise doesn't get Agile. Enterprise Agile often fails because Agile enthusiasts do not really understand it either.

I distinguish here "agile enthusiasts" from true agilist professionals who absolutely do get the issues around Agile at scale, indeed I defer absolutely to their vast experience.  You know who they are.  I hope not to offend the many others who fall into that category by naming those I've had the most interaction with and therefore admire tremendously include David Anderson, Ron Jeffries and Jeff Sutherland.   How do you tell the enthusiast from the true professionals? Ask them a couple of questions:

Where did the money came from to do their agile project in the first place? Where did the themes and epics came from?  Do we really rely solely on the product manager's brilliance? Where did the networks come from that you're going to build your solution on? Deer in the headlights [sorry for not attributing, but the hosting page didn't either].

The question isn't really why enterprises won't adopt agile; the real question is why agile enthusiasts don't understand some key things:

• the processes at work in their own enterprise
• how their projects came to be in the first place
• how to fit their little piece of the world into a bigger picture. 

Here's a post that explains how Agile fits very well into the enterprise - if you understand how both of them work. Understanding one and not the other leads to misunderstandings and outright hostility.  Not unlike the rest of the world.

They are  not alone, of course; lots of people on the more traditional side of project, portfolio and program management don't understand it either.  Which is why I write this blog.

Agile artifacts - low-tech solutions in a high-tech field

Isn't it ironic that Agile is the latest thing used to drive our most high-tech field but it seems to be most effective to carry it out using really old-school tools: wallboards and spreadsheets.



I would have started with the credit for the inspiration but it wouldn't have made a very appealing thumbnail on Linked-In or Google. This post was inspired by a tweet from Andrew Yochum (@Yochum) which in turn leads to a blog posting which is absolutely the least self-promotional ever -- no author credits anywhere. So now you have his Twitter information and a link to the post . As you will see from the link, I used his kanban picture too, as that helps to drive readership, but since I'm promoting his post that seems fair.

Back to the topic: I've taken a look at several automated tools that support Agile processes (Rally, Mingle, Jira) and they all have the same weakness: real estate.   Unless you have a humongous monitor, it's pretty hard to see what's going on in a screen-rendered version of the wallboard, and if the metaphor converts everything to lists then at least for me the whole flavor of Agile is lost.

So what about the low-tech options?

I've used SharePoint to try and track stories and progress.  It works, after a fashion.  It has the advantage over Excel in that everyone can see it and work on it at the same time.  The disadvantage is that you can't see the cards laid out; you have to use each story as an item in a list.  By creating the progress points as discrete options in a single column (fields), you can get SharePoint to generate views, using the list-type format and the power of the "group by" function, to show you such information as:
You can also use the calculation function (sum) to show you the number of story points planned and completed in each sprint, and that of course is the information you need to construct velocity charts - in Excel!

Excel, of course, lends itself to the charting.  It is also very handy for tracking the stories in the form of a requirements matrix (I know the purists are gagging, stop that).

What about using the Excel as the board itself?   No problem!  With its columns-and-rows display, Excel is of course capable of acting as the board.  In fact, in the example shown above, we could and did extend the columns to the right because we are tracking the stories anyway). But it gets to be a pretty big sheet.  For group purposes, Excel's drawbacks as the primary tool is that only one person can edit it at a time and it must be maintained on a shared drive, which means everyone must have access to that drive. For some reason office shared drives seem to be a bit more persnickety than things hat live on a web site if you're coming to them remotely.  And of course Excel doesn't do versions, so if one person trashes up the sheet the only way to fix it is go back to the last version that was saved separately.

And of course there is the wallboard. The problem with that is the demise of the concept "wall".  With open-plan offices increasingly the rage, there are no walls. Withe remote workers, there is nobody there to look at the wall anyway.  And people seem to get upset if they have the work-space right next to a spot (e.g a space along one of the rare walls) where a half-dozen people will cluster and jabber, even if it is work-related.

In a related post on Linked-In Pulse, I also note that the same problem arises with the traditional waterfall tool (MS-Project).

Please feel free to share your workarounds for using electronic methods of replicating a physical collaboration that hardly exists in the real world any more.

Scrum as a Teenager: A Retrospective from Jeff Sutherland

Getting to Done

This post is a summary of Jeff Sutherland's presentation to the DC Scrum Users Group, 21 May 2015.
The slide deck is available at Jeff's company's website.
The entire presentation can be seen on the DC Scrum Users Group Meetup site which may require you to join the group, as well you should if you are in the DC area and interested in Scrum.

Reminder: the goal of Scrum is to produce working software at the end of each sprint.

The Agile Manifesto did not spring from the blue.  The group drew its conclusions from over 20 years' of data compiled by Bell Laboratories. Those records showed conclusively that:

• Communications drive production effectiveness
• Specialization cripples production

Quite aside from the speed aspect, the data also showed  (and current data continues to show) that a bug (or failed test) that escapes from a sprint costs 24x the original development effort and time to find it and fix it.  Keep track of these events is important: in his experience, as soon as management get hard data on it, the problem of whether software needs to work at the end of a sprint is dealt with immediately.

Jeff provided references to a second data source (the Chaos Manifesto) which found that the long-standing problem with delivery of IT projects documented by the  Standish Group over the years has not changed much for Scrum-managed projects.

He also noted that for small projects, waterfall is just about as effective as Agile, probably because the timing and scope don't offer much risk anyway.

What are the blockers to success with Agile?  Success being defined as ready and done.

• Teams trying to drive features out at maximum velocity are buried in technical debt.  You can't dig your way out of that hole with continuous improvement efforts later on.
• There is organizational debt.  This is what Kik Piney calls "anti-maturity"; you can learn more about it in this post. 
• Organizations are stuck in "old way" thinking: press the developers harder, and compile more reports.

How bad is it?  At Microsoft, as much as 85% of the effort is classified as "non-tool" (a euphemism for "rework").  But at least they have recognized it and are doing something about it.  Something quite scary-sounding, in fact: they are abolishing all testing outside the main sprints. [Audience gasps]. At Nokia, the company's Agile process got so bureaucratic they were completely unable to react to the invention of the smartphone.  Ironically, Microsoft returns to the story - it bought Nokia and killed off the company.

Some bad news for those consultants who have gone in on the credential mania: Silicon Valley is now divesting itself of Agile Coaches, replacing them with internal assets because they already understand how the company actually works and they can be held accountable to deliver working software.

One of the big new topics is Agile at  Scale.  The consensus seems to be that it does not work.  That isn't really true.  Consider the Internet itself, the world's largest and longest Agile effort! Scaling Agile and Scrum, like the one-project versions, depends heavily on competence for success. It is best done by scaling out, not up, though coordination rather than developing policies.  Consider the 24-hour car-building project.

So why are we not getting to done?

• Done is not well-defined.  Done must include "working".  Product owners are sometimes pressured to accept work that is not truly done in order to maintain an appearance of "no problems".  That's not the point of Agile. Accepting incomplete work also provides a distorted view of velocity (well, that is rather the point, isn't it) that just makes subsequent estimates even worse.
• Stories are not ready.  Estimates are bad; stories are not broken down to minimal bites.  Failing to understand true velocity causes the team to take on too much work, and then they just start shaving the work even more. 
• Dysfunctional leadership.  Often, they can't stick with their priorities long enough to get through a sprint.  Worse, when things run into issues, they are willing to paper over it to provide the illusion of velocity for reporting purposes.
• Technical debt (already discussed)
• Organizational debt (already mentioned)
• Last but not least, bad Agile Coaching.

What can we do about it?

• Use a defined Scrum model. That would include the definition of done.  If effectively defined, it may not be necessary to test every feature on every build or sprint.
• Have stories ready.  They need to be defined effectively, and trying to get it all done in a few Spring Planning meeting hours is simply not possible.  So you have to front-load that effort.
• Major shifts in the corporate supporting processes.
• Establish goals and work to them
• Establish a viable business plans before starting development
• Remove barriers and wastes
• Hold the Product Owner accountable for the value delivered per story point
• Hold the Scrum Master accountable for ... well, that is the key question.
• Eliminate Technical Debt.
• Identify and fix blocks
• Use cross-functional feature teams
• Train and hire "T-shaped people" - people with the ability to contribute in several areas (wide) and solid skills in one or more particular areas (deep).
• Build out an object-oriented architecture to permit re-use
• Monitor the value streams
• Queues
• Wait status
• Other metrics

This summary didn't capture all of the nuances - many of the pearls are in the one-liners!  See the live presentation, you will enjoy it.

Earned Value EVM and Level of Effort - Yes You Can

Oscar Wilde would have made a great program manager.

"Nowadays, people know the price of everything and the value of nothing" - Oscar Wilde.

We saw in an earlier post that you can do EVM with Fixed Price after all. In a true fixed price contract, the number of resources and working arrangements are not under the buyer's control; the vendor just gets the job done somehow.  You can still work EVM into it (see the prior post at the link above).

It is ironic that so much of the contract work for the government, which advocates very strongly for using EVM has migrated very rapidly from the much-maligned cost basis to LOE. Why is this a problem?  Because it appears to be unaccountable.  The team comes aboard to ... well, to do what?  Whatever needs to be done, meaning whatever the contract monitor wants done, which of course is a personal services contract and would therefore be illegal (in government), which no doubt explains why so many of them are in place in Washington.  But there they are, and we have to deal with it.

People think you cannot use EVM with LOE because there are no real deliverables and the planned and actual costs are always the same.  The "official" solution is that level-of-effort activities don't contribute to specific work packages and should be held in a separate line of accounting from the work packages.  Then they just accrue costs as the calendar passes; but they do not earn value. They are part of the project cost baseline but not the performance baseline. This is a good way to account for project-wide overhead costs, which contribute more or less equally to all ongoing work packages (or impede them, depending on your point of view!)

What happens if the level-of-effort people are working on the actual deliverables?  You can't exempt 95% of the project labor from the EVM metrics.  For true LOE contracts, whether on their face or disguised as fixed-price contracts, the people just show up to work ... and do what?.  Since it is illegal to award an actual personal services contract, you don't often see one that actually says "just give us xx bodies and we'll tell them what to do". What you see instead is a "fixed price" contract that is really level-of-effort: the vendor is to deliver a defined number of hours (conveniently 1980) of various labor categories, with a statement of work that is either very vague or quite specific but will be completely ignored.

At a very basic level, if the vendor fails to provide the agreed resources (a common occurrence), then you can show a delta between planned cost and actual cost.  The philosophical problem here is that no backlog of work builds up: customers may be poorly served at the time, but there is no way to go back and serve them later when the resource does show up.  That, of course, raises the uncomfortable question of what value was lost by the work not done, and if you use that math then you have to extend it to question whether any much more value is gained from the work that was done.

As to the so-called "fixed price" contracts to provide labor-hours, that's no different at all from other cost-based contracts; there's just less paperwork needed to establish the actual cost.  Many contract monitors prefer not to crack the whip, or don't know how, but since it is nothing but a typical cost-based contract you can give guidance on the deliverables to be produced and the hours (costs) needed to do it.  If it gets done sooner or cheaper, you are ahead of the game; if it takes longer or more work, then you are behind the plan.  Voila: we have EVM!

Let's suppose that the contract does provide for a real LOE and real (if vague) deliverables.  The very latest thing in this arena is agile-type work (especially Scrum, the most popular brand) in which a team assembles on a near-full-time basis to do whatever work they can get done to deliver for each sprint.  Despite the popular impression that Agile is just a license to throw all oversight away, there is actually a rich body of knowledge on Agile metrics.  Just as with a true fixed price effort, it is entirely possible to establish intermediate milestones for longer-term efforts (such as a release) in which the earned value might be as simple as a completed sprint and may be more complex to address the planned and actual velocity.  an even more sophistical scoring method can address the velocity at which delivered features are meeting value priorities.

Just as with the true fixed price scenario, the important thing is to separate the concepts of "value" and "cost".