Saturday, March 3, 2012

Search Engine Optimization(SEO) Best Practices

Understanding what is Search Engine Optimization is essential especially when you want to run an online business. SEO is all about increasing the visibility of your website. There are certain guidelines if followed make your website popular. Before even you start putting your content on your website, its highly recommended to understand how search engines work and what they like in your website. I was just going through various SEO guidelines that Google was suggesting and thought of putting some interesting ones that I like in this post which I can refer often and also other internet users.
  • Accurate Page titles: The webpage titles are displayed in the search results and internet users read them. If the page titles describe what the page is all about, its likely that users will click on it to see more. So give attention while creating your page titles. The page title is created using <title> HTML tag of your html file. Example <title> Search Engine Optimization Techniques </title>,  <title> How to create a website</title> etc                                                                                                                 
  • Accurate Page Content Descriptions: There will be description meta tag in HTML and this is where you need to put the page content descriptions that describes what exactly is your page all about. Make the description as accurate as possible. Just next to your title tag, you can define the meta tag called description as <meta name="description" content="Techno ladder blog is to share technical articles, best practices, learnings, tips and tricks in information technology"> etc. Make the description unique per page. The description meta tags are the ones that internet users and search engines love to see.                                                                                                                                         
  •  Web URL Structuring : The web URL is the one that is displayed in the address bar of the browsers when the page is being viewed. These have to be simple. Lengthier URLs are not recommended. Use meaningful words in your URLS.  Simple and meaningful URL structures make it easier for search engine crawlers to crawl your page easily without the crawl errors. I have seen, there can be crawl errors because a page was not reachable due its complex url structure. Learn More about URL structures on Google Webmaster Tools help
  •  
  • Easier Site Navigation: This is another important aspects in search engine optimizations. Navigating your website has to be a nice experience for the internet users. Otherwise its likely that users leaving your website and jumping on searching another one. Breadcrumbs are very useful and widely used that make the navigation of your site easy for the users. It may so happen that you might remove certain page during your site update, its important to remove all its links that other pages can have. This will avoid users reaching 404 Page Not Found error. Or else, redirect the yours into a custom error page from which the users can again come back to your site.Create sitemaps and make it available in the home page.                                                                                                                 
  • Quality Content and Services: This is the heart of any website. Users may not look how you have created the website but the information that they need. If the content on the website is not interesting and satisfying users navigate away from the website! Make it clear that how your website content and services are going to benefit for the users. Once you define the structure of the website, its required to just concentrate on writing quality content and services and search engines do the rest for you.             
  • Easy to understand Anchor Texts : The HTML anchor is used to have a link to another web URL and it has got a name. The anchor tag in HTML looks like <a href="web_url_link"> Anchor Text </a>. Here the Anchor Text has to carry the meaning of the linking page. This is the text that users are going to click. It must be easy to understand for the users to click it. Websites will have many links to other websites, only meaningful and easy to understand anchor texts are likely to be clicked.                
  • Image Optimization: Avoid having text links in the images, if its done use alt text to have the image text. Search engine crawlers does not understand the text contained in an image and this is the reason why there is alt tag for all images.                                                                                                        
  • Use of robots.txt: Google provides a text file called robots.txt which can be edited by the website owners to specify what needs to be crawled and pages should not crawled. This is required because you may not want certain sensitive data on your website to be crawled and make it available for the internet users. Or if you feel certain page contents are not of useful to the users, you can have Google not to crawl that page.You can also have certain links on your site not to follow using "nofollow" word in robots.txt file. Learn more about robots.txt                                                                                      
  •  Enable your site for mobile viewing:  Today the internet users are moving to mobiles phones and surf the internet using their mobiles. So it becomes crucial for website owners to enable their site for mobile viewing. Verify your mobile site is also indexed by the search engines. Search engines are already available to be used in the mobile phones and so mobile sties can be verified whether or not the website is viewable in the mobile phones. To verify if your website is indexed or not, use "site" keyword followed by your website. If there are search results, then your site is indexed. For example: site:technoladder.blogspot.com, site:example etc.                                                                                         
  • Promote your website: I personally believe that you need deliberately do advertise your website in social networking sites or online communities. If your website is unique and quality content, it automatically gets promoted. Word of mouth is what the strongest way to spread a word about a site and it multiplies. If internet users find your site helpful to them or helped to solve their problems in some way, then they will definitely come back to the site and even better they spread the word.
There are many aspects yet on search engine optimizations. There are many SEO companies today who 'promise' you to optimize your site and get better ranking in the search results. We'll have to be little careful here. What they claim might be proud. The truths are the truths. We just have to following above guidelines than having a someone to this for you which is not guaranteed. There are also guidelines to avoid spams which we need to study more and understand. 

How to prepare for SSLC Exams?

SSLC is very important phase in your education carrier in Karnataka, India. Its also called as 10th Standard Exam. This is the basic exam for how you want to perform better in your future and what you want to be in your future. The good score in SSLC exam decides the base of strong education background for you. In this article, I would like to share some of the important study objectives to prepare for the SSLC exams. I believe its really simple, the SSLC examinees need not worry much about the exam and getting tensed about the same. My name stands as the first rank student in my high school for SSLC which I had not even thought for. Here are some tips & tricks on how you can tackle the SSLC exams.

Learn How the Exam Questions Papers are prepared

This is very important, you must see several sample exam papers before few months of your exam start date. Your study must be carried out the way the the exam questions are carried out. Once you finish studying the syllabus, you have to collect as many as question papers of previous exams. Prepare in the exact sequence how the question papers are prepared. For Example, as a first question you may have 'Match the following; kind of questions. Think about the questions in hand. Prepare 100's of match the following kind of questions in your notebook. I encourage you to have a  preparation notebook per subject. Say for example there is a question about fill in the opposite words given, for this question you need to create around 200 such words and their opposite words. This is how I prepared and managed to score 94 marks out of 100 marks in English Language Subject.

Write Essays of your interest often

There will definitely be a essay question. The essay topic will be presented to you and you need to write an essay about the topic given in the exam question paper. To prepare for this, in your academics, just start writing as many essays as you can choosing the topics of your interest or choosing the topics that previous exam question papers asked. Essay writing is a just writing skill, I believe that every one knows at least something about any essay topic. What is more important is that, you need too structure it very well and illustrate properly.

Understand all the Lessons

Pay attention when your teacher is teaching the subject to understand better the subjects being tought to you.
Ask sufficient questions that you may have on the subject. This will facilitate  understanding the subject more thoroughly and precisely. Its just that you take interest on each and every subject which is there for your exams.

Study in the morning

Morning time is the best time to study and grasp the subjects because, your mind will be free from any other activities. Just stop thinking about anything but just study early in the morning. Studying in in the morning has got many advantages such as you can concentrate more on the topics that you are studying, there will not be any disturbance for you to study etc.

Eat healthy food

Eating healthy food helps you avoid from many diseases that you may capture and put more concentration on your study stuff. Drink lots of water while studying, which will facilitate good blood circulation in your body and will help you relax from the tension that you may have about your exam.The food that you consume matters a lot while studying. Avoid junk food.

Exercise 

Make a habit of getting up early in the morning and exercise. This will help in two ways. This helps to be very healthy as well as avoid all your tensions about the exam and bring more concentration for studying.

Do not study just for the shake of scoring Good Marks

Understand the intent of the subject. Do not just study for the shaking of scoring good marks in your exams but to understand a lot about the topic that you are studying. Remember the objective of the education system is not just scoring good marks in the examination but to understand why you are learning the subject. Most of the students tend to ignore this fact as I have seen. A person who scores good marks in the exam does not mean that he/she has studied well. Not at all until he/she has studied the subject to understand the subject that can help in their day to day lives and acts as basis for further studies.

Build Good Relationships with your teachers

This helps a lot. I remember my teacher calling me to his house and explaining me what I'm lacking in the subject and what I need to improve. Talk to your teachers very often, ask questions a lot to them. Surely the teachers are happy to answer your questions and plus provide some guidelines for you as to how to understand the subject better.

Do not burn midnight Oils 

When your exam dates are nearing do not study overnight and destroy your health. Do not ever do that. You have studied well throughout the academic year and be confident about that.  When your exam dates are nearing, its just that you need to revise on whatever you have studied and not to study from scratch. Be confident on yourselves that you studied enough to make it to your exams.

On the exam day

On your exam days, you must very well be relaxed and not tensed at all. Have good sleep in the previous night. If you have good sleep, you can think better on your exam days and write good answers for the exam questions. Just treat your exam days as your usual days, that's all, no difference. Its likely that your friends will scare by saying several things that they have not done in their academics, do not ever be discouraged by their words. You have to be just you and do well in the exams.

Conclusion

These are my ideas and how actually I prepared for SSLC exams and had a first rank in the school. There are no thumb rules that you need to follow to get good marks. Its all has to be done at your comfort level. Each one will have different thoughts about the same. General advise that I would like to make is that don't be just bookish, study for the shake of scoring marks in exams. But instead, think through the subjects. Understand why the subjects are being tought to us and how we can benefit from studying those subjects. The real intent of studying a subject is to apply somewhere in your lives which we need to understand very well. According to me, don't get discouraged by that fact that you got low marks exams, but be proud that you have learned the subjects well which will really be helpful for your future.

Friday, March 2, 2012

How to benefit from Six Sigma Training and Certification?

Six Sigma is a proven process that strives to lead towards the accuracy. These days many organizations are claiming that they are six sigma certified. This has several advantages for the organization as well as the six sigma certified engineers. Certain organizations that are more process oriented have made it mandatory for all the employees that the Six Sigma Certification is mandatory. Of course the organization claiming that it is six sigma certified has many advantage which I will be explaining here such as quality benefits and reputation of the organization and many more. Being a part of such an organization, I would like to share some of the aspects and benefits of being Six Sigma Certification in simple way in this short article.

Before proceeding further with Six Sigma, its essential to understand the meaning of of the term Six Sigma. You will find good definitions for this process everywhere. According to me, the Six Sigma is set of standard and proven Six Sigma tools that we should make use of while dealing with during the project. Six Sigma applies to any software development firms or manufacturing industries.Six Sigma is more of a business process strategy. Six Sigma is a big topic to discuss and cannot be explained in a page, however, I am trying to give a brief overview of Six Sigma.

To best understand the Six Sigma Process, a Six Sigma Project has to be executed initially to understand what is involved in the Six Sigma process. There will be something called a Six Sigma Charter that the people who are going for six sigma certification have to fill up. The project charter comprises of the problem statement and defines the proposed solution.The proposed solution is then implemented using a set of six sigma tools. The six sigma project that you choose could be of a new process (IDDOV- Identify, Define, Develop, Optimize and Verify)  or change in the existing process or a new design or change in the existing design of a software (DMAIC- Define Measure Analyze, Improve and Control)

The real intent of six sigma training is to understand the proven tools and the actual project that you've chosen gets the least attention. However it is equally important to choose a better project to learn Six Sigma tools with accurately defined CTQs (Critical To Cusotmers).

The Six Sigma Tools

The six sigma tools vary as per the kind of the six sigma project that you have chosen either IDDOV or DMAIC. However, I will explain the most important tools involved in both the kind of six sigma project.

Though Process Map

The first and foremost tool is the Thought Process Map (TPM or TMAP). The TPM involves drawing a bubble diagram putting all your analysis thoughts on the problem in hand. The diagram comprises of the bubbles where you will write all your thoughts. This is the diagram where you can capture all the thoughts that come to your mind about the problem you are solving.

Suppliers, Inputs, Process, Outputs and Clients (SIPOC).

The second Six Sigma tool that we learnt was SIPOC which involves diagrammatic analysis of the suppliers, Inputs, Process, Outputs and Clients. This tool is used to identify the supplier-customer relationships, the customers here could be your internal customers or the external customers

Cause and Effective Analysis

The cause and effective analysis (C & E) tool is used to find the causes of the problems that may occur in your projects. This tool helps you to find out the causes of the problem. There are set of proposed diagrams to draw that aid the analysis of the cause of the problem. This is also called as Root Cause Analysis (RCA) of the problem. The RCA is done by asking the question 'Why?' five (5) times usually to get to the root of the cause. The Root Cause Analysis is not only true for Software Issues, but also for your personal lives, just ask the question 'Why?' to yourselves five times, you are likely to get the cause the problem you are facing.

Quality Functional Deployment (QFD)  

QFD stands for Quality Function Deployment. This tool is applied to transform your customer requirements to design by using some deployment techniques to achieve design excellence.QFD involves drawing a diagram that maps customer requirements to map the design.

Failure Mode Effects Analysis (FMEA)

This tool plays an important role in any project management activities. We used it a lot especially when were taking up design changes and addressing new requirements of our customers. This involves writing up an excel sheet that identifies the what could be the potential failure mode for each change that we are going to do in an existing product design change. A great tool to identify the risks in executing certain user requirements or the design change and more importantly how the identified risks can be mitigated.

Pareto Chart

Pareto chart was not of much help in our projects. Pareto Chart is a frequency of occurrence of an event. This diagram is usually represented by a bar chart.

There are other tools such as Histogram, Value Chain Map etc in Six Sigma process. If needed you may want to explore those too.

The organizational benefits of Six Sigma are
  • Quality Standard of an Organization - Helps to gain the customer confidence and increase the reputation of organization claiming Six Sigma Quality product delivery
  • High Quality products coming out of an organization
  • Employee Motivation
  • Strategic Planning
  • Effective Supply Chain Management Process
  •  Competitive Advantage etc
Conclusion

Six Sigma is a practice that every team has to understand and acknowledge its importance and successfully execute the six sigma tools in the projects. It does really have advantages if used properly. Six Sigma addresses almost all the project management issues in a precise and professional manner. So learning six sigma is easy, but applying it to the work that we do is bit challenging unless we strictly impose six sigma rules in the organization. The basic level of six sigma certification is called as Green Belt Certification (GB) and advanced one is called Black Belt (BB) Certification.

How to handle Non Reproducible Software Bugs/issues

This task has been a challenging one for both developers and testers.  Once the tester observes an issue, he/she will try the same steps again to see the issue again, however  it might so happen that  the issue can’t be seen when tested second time or after subsequent trials. However tester logs the issue as non reproducible and tester is on safer side.  In order for non reproducible issues to be fixed, it requires a lot of time. The developer ends up spending time to reproduce the issue and to get the exact steps.  When I had a talk with a tester who logged a non reproducible issue, he said “I observed the issue once and the  exact steps are not known”.  After spending some more time reproducing it, he said “Out of 10 times, 3 times the issue was seen”.  These kind of responses will never help developers to debug the issue. If issue is there, definitely its there, the only problem is that we don't know the exact steps to capture. 

So, what did go wrong here? Why is the software behaving differently at different times? I think it does not make sense to keep wondering about these but to think several parameters involved while testing. There are certainly some things that we need to take care while testing. Basing on my experiences in dealing with non reproducible bugs/issues in a Software Product, I would like to share some good  practices that we including testing  team should consider before arriving at the decision that a particular bug/issue is not reproducible.

Some Guidelines dealing with non reproducible Issues
  • If a certain bug/issue is non-reproducible on one system and the same is reproducible on another system, then the possibility of going wrong is in Test Bed or the test environment where the software is being tested.
  • People can't capture the exact steps that they performed while testing because they may have some assumptions. Avoid all the assumptions while testing the software. Every parameter while testing the software matters such as Test bed, the operating system, what was the CPU and memory usage while testing the software etc
  • Capture the logs, logs are very important inputs to developers to debug the issue and find out the possible cause for it. I believe every software will have logs enabled for debugging purposes, if not its highly recommended that you enable the logs in your software. Sometimes the logs help developers to find the exact root cause of the bug with no time.
  • Think out of the box: I remember one issue was because the Windows Firewall was turned off while testing the software but if the firewall is turned the issue wasn't there. There could be lot of such parameters to consider that no one will usually think. So all the initial computer settings may also matter. So think out of the box. Test the software in multiple computers before concluding the bug is non reproducible.
  • Keeping the test bed (the test environment) as one thing, if you are not confident of finding out the exact steps to perform to reproduce the issue, its highly recommended to use the desktop recording software. Start the desktop recording software before you start testing, this helps a lot. In fact it helped our team to find out the exact steps to reproduce the issue that was observed once. There are many free software available which can record your entire testing activities. The one we used was WebEx Recorder. Its normal tendency of human beings that they tend to forget to capture certain steps that they actually performed while testing. The recording software can be used to resolve these issues. Turn on recording software while testing all the time. You always have the option of deleting the recording if you do not need it. In case of non reproducible bugs or issues, you always have the option of going back and watching what are the steps you were performing when the bug was seen.
  • It may so happen that the test bed being used itself is wrong while testing the software, so it does make sense to define the test bed first before even start testing the software.
  •  Developer has to talk to the testing team to get more details of the issue. It may so happen that the testers will not capture each and every details of the issues that they raise though its not recommended.  
  • Discuss sufficiently: Especially for non reproducible issues, we need to discuss a lot with Software product testing team or the testing team has to discuss a lot with developers. This might give some insights as to what is going wrong.
I have seen many people mentioning in the bugs/issue that they raise that the issue is 'Sometimes' observed. This is simply not acceptable. I remember if you see a bug being raised as 'Sometimes'  as frequency of the bug/issue I encourage you to simply reject the issue, do not even accept it, because its not going to lead us anywhere. Its expected that the person who is testing the software has to provide all the possible details.

Conclusion

It is true that if the so called non reproducible issues are not much analyzed and fixed, its certain that today or tomorrow the same bug/issue comes from our customers. Its also equally important to understand the software deployment scenarios. In-fact this should go as part of the software requirements. Its very much essential to understand in what conditions the customers are going to use the product. Testers must always think from this perspective and prepare their test bed according to the end user scenarios.
If you've faced such issues, you can share with me and we can learn from each other.

Thursday, March 1, 2012

Knowledge Management Guidelines

Organizing and maintaining the knowledge in any organizations is very essential to make sure the knowledge is easy to access. There can be tons of knowledge but if it’s not accessible to people, its in-vain. It is like an informative website which is not indexed by the search engines and not available for everyone to access.
Knowledge can be in different forms such as documents like presentation files, word documents, text files, audio video files etc.  Knowledge also resides in people’s head. Basically the term the knowledge management (KM) refers to how all the available knowledge can be organized such that it is very convenient for everybody’s access making use of certain best practices and strategies. Knowledge Management involves creation, validation, storage and share the knowledge.

There can be different strategies and practices by different organizations and even there are tools to manage the knowledge.  In this article I would like to share what practices helped us achieve the standards in knowledge management and sustain the same. Knowledge management is a challenge because people give least importance to this activity and the activity will be out of your daily work. The organizations have to impose mandatory rules for all the employees to achieve this or have a dedicated team for this activity.. Unless the activity is made mandatory, there is less chance for effective knowledge management and miss the advantages of better knowledge management. Based on my real experiences, following are the guidelines in Knowledge Management Activities.

Identify the existing knowledge

If you are newly starting to manage the knowledge in your organizations, then the first step would be to identify the existing knowledge and make a list of them including what is the form of that knowledge for example, is a audio, video or a word document, presentation file, a wiki, basically all knowledge artifacts be it in any form.

Categorize the knowledge into different topics

Once the all the existing knowledge is identified, categorize them into different buckets. Knowledge can be categorized as Domain, Technical articles, Training Programs, Products Knowledge etc.  Organize the knowledge according to their categorization.

Identify the Gaps

Once the existing knowledge is listed down, you can then understand what information is missing. Create the missing information. Improve the knowledge artifacts to be very self explanatory. Consider always a new person while creating knowledge such as training materials, videos, audios of your domain.

Decide a location for placing the knowledge information

There can be different places where you can place all your knowledge, for example the location could your SVN repository, or in separate dedicated server, etc. The idea is that the knowledge artifacts must be accessible fast to have good user experience. Selecting repositories can be little slow than having a dedicated server and lunching a web page that displays the categorizations and hyperlinks to reach a particular one.

Index the Knowledge Artifacts

This is very important and critical action required in any Knowledge Management Activities. Some knowledge is never accessed because there is no way to access it or there is no one to say that the knowledge exists. How I did was after completing identifying the existing knowledge artifacts, created a file called ‘Master Index File’. The master index file contained hyperlinks to each and every knowledge artifacts. The master index file was structured alphabetically under each categorization and published the index file to everyone. It is equally important to see that the index file and actual knowledge artifacts will not go out of sync. This happens when the knowledge artifacts are modified or new artifacts are added and the index file is not updated with new changes. Making it mandatory rule and have the person who changes the knowledge documents to update index file will keep index file in synchronization with the artifacts.

Create a Knowledge Transfer Template

The explicit knowledge like documents, audios, and videos can be managed very well, however what about the knowledge present in people’s head? Another important objective of the knowledge management is that knowledge should not be lost at any time. Knowledge is usually lost when a person leaves the current company. To make sure the no knowledge is lost in this process, the best practice is to create a Knowledge Transfer Template where the all the transition information is captured the template acts as reference for knowledge transfer details such as what is the kind of knowledge and the person whom the knowledge was transferred etc. In my view, even the experience the people have is also knowledge which cannot transfer or store somewhere else. This kind of knowledge is referred as Tacit Knowledge.

Take User Feedbacks on the Knowledge Management

There has to be continuous rhythm of improving the quality of the knowledge artifacts. To do this, take surveys on existing management processes. Feedbacks are the only way to continuously improvise and sustain the knowledge management activities effectively.  

Advantages of Knowledge Management

To understand the importance of the knowledge management, consider for example a new employee joins the organization and since everything is new for the new joinee, the employee requires lot of information to get started with. The knowledge management plays an important role here. Properly indexed information is quicker to access.
  1. Saves everyone’s time and avoids chained contacts to seek the knowledge
  2. Reduce the training time required for new joinees in the company.
  3. Information can be presented hierarchically organization wide.
  4.  Productivity Improvements – The people can always go back to the knowledge store and read that again as brush up. The developers want information as quickly as possible and if all the knowledge is made available to them, there will be less time taken to build a software product. 
Conclusion 

Knowledge Management is handled differently in different organizations. Certain teams create Wiki for discussing day today problems and solutions. Wiki’s are a great help to share the knowledge among different people in a team. There are also open source tools that help knowledge management. Have a look at http://www.knowledge-management-tools.net. The full potential of knowledge management can be realized after implementing and start seeing the results.

Tuesday, February 28, 2012

How to Evaluate UI Technologies

Selecting a User Interface(UI) technology for developing rich and interactive web-based software products is challenging job these days. The UI technologies have to be studied and evaluated before choosing the one. This is because, the cost of changing the UI technology later in the project is more. As I have seen the user interface never satisfies the customers 100% because there is always a scope for improvement in the UI and different customers would have different opinions on the UI screens. Another key fact is that we have got lots of choices in UI technologies to select from and these UI technologies keep evolving time to time with more and more features.

Before selecting and finalizing  an UI technology for your software product, it’s very much essential that we need to evaluate all the available UI technologies based on certain parameters such as ease of use, performance, richness of UI, Security, Browsers supported, Learning Curve, Debugging Ease etc and more importantly how well a particular UI technology fits into your product lines and meets the product user interface requirements.

Parameters to consider while evaluating the UI technologies

The parameters differ based on the kind of the product and kind of customers you are dealing with. There are no thumb rules and fixed parameters to consider while evaluating UI technologies. To measure each of the parameters that you have defined on a particular UI technology, the prototypes need to be tried out if the documentation of a UI technology is not adequate or not much informative enough to understand the technology.  The following evaluation matrix is the result of trying out prototypes on different UI technologies Flex, SilverLight2.0, LWUT , JavaFX, GWT and SWT.

UI Technology Evaluation Matrix Example

S.No
Parameters/Technologies
Flex
SilverLight2.0
LWUIT
JavaFX
GWT
SWT
1
Security
9
9
9
9
9
9
2
Browsers supported
9
7
7
7
9
9
3
Tool/IDE Support
9
5
5
7
5
5
4
Licensing/Cost
5
7
9
7
9
9
5
Platforms supported
7
7
7
7
9
9
6
Learning Curve
9
7
7
5
5
5
7
UI Richness
9
9
7
7
9
7
8
Performance
9
7
9
7
7
9
9
Debugging Ease
7
7
7
5
7
7
10
Extendible
9
9
9
9
7
5
11
Design Flexibility
7
9
9
9
9
5

Total
89
83
85
79
80
79
  
The above table can be taken as an example as to how to define parameters and evaluate UI technologies for your product and product deployment requirements. User interface parameters are very much customized. If certain parameters get high importance for some products, the same parameters can get low importance for another product depending on the type of the product and customers. And hence it makes sense to define an "importance" column also for each identified parameters.

References

Flex - http://www.adobe.com/products/flex.html
SilverLight2.0 - http://www.infoq.com/articles/silverlight-java-interop
LWUIT - http://lwuit.java.net/
JavaFX - http://javafx.com/
GWT - http://technoladder.blogspot.in/2012/01/ajax-and-gwt.html
SWT - http://www.eclipse.org/swt/ 

Monday, February 27, 2012

Software protection through code obfuscation

Obfuscation is the process of making software program code difficult for understanding by applying various obfuscation methods without affecting the program logic.  The obfuscated code is difficult to understand by human beings and also makes it difficult for de-compilers to reverse engineer the code. This is basically done to prevent the competitors or hackers from cracking your code and get into underlying software design.  Byte code obfuscation refers to obfuscation of java byte code so that it becomes difficult to understand the code or difficult to reverse engineer the byte code by de-compilers. There are many byte code obfuscation tools that various software organizations are using today. As everyone knows java byte code is easily reverse engineered to produce the exact source code. This is possibly because of the java programming language promise that "Write once and Run Anywhere".

I dealt with Byte Code Obfuscation for many years for Java Software Products, using the obfuscation tool called Zelix KlassMaster. Thought of sharing some experiences with obfuscation. Let’s understand in depth what exactly the obfuscation tools do to make the code difficult to understand, reverse engineer, to what extent the obfuscation protects your software and what are the difficulties that can arise out of obfuscating your java byte code and some best practices while doing so in this short article with regards to Java programs.

What does exactly obfuscation do?

The basic operations that every obfuscation tools do is they change all the understandable string literals to non-understandable string literals. In other terms, the obfuscation tools encrypt the class/method/variable names of you Java byte code as an example to some other names that are meaningless. The obfuscation can also change the control flow of the program making it difficult to understand and trace out the program execution. The obfuscation tools provide users the option of configuring what to change and what not to change. This gives flexibility for the users to what extent they are wanting to obfuscate the code. Obfuscation can do following things:
  • Change your class names: What happens when a java class name gets changed? Obviously all its references have to be updated with new name, obfuscation tools take care of updating all the references. All the referenced classes must be on the obfuscation tool's class path. These tools must be able to find out all the referenced classes, if a referenced class is not found in the obfuscator class path, you can expect an error. Obfuscation can not  continue.                                                             
  • Change the java package: Imagine the amount of changes required throughout your java project if you change the package name. The classes may be in different jar files and might be referring to the class who's package name is being changed. The obfuscation tools take care of modifying all the import statements in the referencing java files. I found this feature useful especially when I had to change the package name for software branding purposes. Yes, certain branding requirements require java package name to be changed to include different company name in the package name. For example, my original package is say "com.companyabc", and branding requires the package to be "com.companyxyz". You can achieve this by using this feature of obfuscation.                                                                                                
  • Trim the method/String literal names: You've an option to tell the obfuscation tool that methods with what access modifiers have to be trimmed. This is very important especially when your obfuscated java jar file is going to be used by some one else. To be more specific, you are developing a reusable library. In this case you need skip public and protected methods from being renamed unless the other java classes that are going to use your library are being obfuscated with the same obfuscation tool. The tools provide an option for you to do this                                                           
  • Change the Control Flow: You can have obfuscation tools change the control flow of your program. You can choose from moderate flow obfuscation to aggressive flow obfuscation. Usually the aggressive flow obfuscation is not recommended if you want to have your byte code run on several JVMs.                                                                                                                                               
  • Other: Apart from above, obfuscation can delete deprecated/unknown attributes, line number information from your class files. Removal of line number information from byte code poses difficulty in debugging your java programs. Some tools provide the ability to debug the obfuscated code by providing the line number information, this is done by using the change log information. The obfuscation tools provide you a log of changes that are applied to the code which can be used to map obfuscated code to original non obfuscated code for debugging purposes. Its good practice to know upfront whether the obfuscation tool that you are choosing provides this ability.
Some thumb rules to remember in order for obfuscated code to work. Say for example you have 20 jar files which should "work together". You can not obfuscate few of them and keep other non obfuscated. The obfuscated and non obfuscated combination will never work unless you have obfuscated the jar files with extensible library option. If you choose to obfuscate as extensible library, the obfuscation takes care of not modifying the public/protected method names and public class names. We need to pay an extra attention in this case.

Does obfuscation really protect your software?

The answer is no sadly. Even obfuscated code can be reverse engineered! And hence obfuscation is not THE only means to protect your software. If you use obfuscation carefully utilizing all the obfuscation features, it will pose some difficulties while reverse engineering the code. This is the reason to use obfuscation.

Conclusion

It is good to think that is it really worth obfuscating the code? Because as I said, obfuscation can bring problems for developers when it comes to debug the code. The customer are going to send the exception traces that your program threw and obfuscated code will not have line numbers unlike non obfuscated. Though you have an option to map the exception trace to exact line numbers using the obfuscation change log, it demands extra time for debugging. If you have other means of protecting your software such as End User License Agreement (EULA) or some other means, it good to rethink on using obfuscation.

Related Posts Plugin for WordPress, Blogger...