IT Dependencies

Lately at a customer I got introduced to an application written by an employee which should be replaced. There were some special features that have been implemented for the exact needs of the company. After a while I began to wonder why they want to replace it. I thought by myself: "What could be better than an application written exactly for their needs by a person who is actually in that company for a long time now?"

Finally at the end of the meeting after the others left, I asked the project manager at the company what the real reason is that they want to replace that program. The answer was: They want to get rid of dependency of that piece of individual software development and dependency of a particular person. They want to use a standard software.

While this sounds quite reasonable, I want to clear-up potential misunderstandings:

1. Even betting on the biggest companies and their products does not save you from the risk of software being discontinued or services shutting down.
   For example here is a list of software products discontinued by Microsoft. And this does not seem to be a complete list because from the first look I already miss the Visual Basic Classic which is also dead (and I have A LOT of experience with that which will be dead know-how in a few years).
    
2. Even the largest company-group sends you individuals that do the work and guess what: In most bigger IT projects (even when using standard-software) you usually end up with an individually customized piece of software and often with several project specific extensions. And who knows best your system? - The one who has done it! Change the person and the person needs time to analyse and get into it.
    
3. As time goes by most companies, when they start to buy external know-how or services, they begin to loose control. To reduce dependency you would need the source code, the know-how and the access. One effect of extreme outsourcing often comes with loosing your privacy and security.

So by switching to a standard product it is not very likely that you are reducing dependency. Often you save internal IT manpower for other things but you trade it for dependency or for privacy. Paying a developer for permanently being ready for implementing your business needs may not be the cheapest solution but you get flexibility and often reduce communication flows.

For many very tiny companies it might be perfectly ok, accepting the dependency from external services when they don't have to bother about their server-backup etc then. And so privacy is also traded (e.g. free web service for providing your personal data).

It is a matter of your values, your priorities, your time and budget etc. if you better have a server in-house or use some online-service in the web.

So what can you do?

• Be aware of your values
• Be aware of your business focus
• Be aware of your (human) resources
• Remove resolvable dependencies
  which means: Prefer forward-looking software products and plattform-agnostic open-source software over more limited alternatives.
• Distribute work and risk (e.g. have an external partner helping you but also have an internal administrator/developer who can do the work).

Related posts:  Priceless Developers, Surveillance, Privacy (NSA, PRISM, ...) and encryption, The truth about software.

Surveillance, privacy (NSA, PRISM, ...) and encryption

It's been now a while that the "whistle-blower" Edward Snowden caused heated discussions about the NSA and it's PRISM program. Privacy since then got a big issue for many.

Some of my friends consider to close down their Facebook accounts, their Google Accounts and think of refusing many other internet activity.

That could be a good idea - if you want to have more spare time with your children, your family or your hobby - but to avoid being spied out they ignore a root problem:

• Most of them use Windows: As long as you are using Windows and that machine somehow is connected to the internet you are at risk. As long as there is a feature in the operating system kernel to harvest your data that can be done already before encryption happens. Linux is Open Source and can be checked by everybody who understands the programming language (C). And indeed nations are interested in having an operating system that is secure so even the NSA has contributed code to Linux (SELinux). They want to spy out others but they are not interested in getting spied out themselves by others. ;-)
   
  
• They don't refuse email: EMail is like sending a post card. Everybody (postman or IT guy) that sits between the sender and the receipient can see the content/text of the letter/mail.
  OK: Now, the more informed people are not thinking of using PGP. They usually find out after a while that while I can help them setting up their PGP encryption they need to have their peers also having the required software. While it is very easy to get started using PGP in Thunderbird using enigmail it might get a little more difficult to get Gpg4win to run smoothly not to talk about webmail <your favourite product here>. Oh, on Android you can use K-9 Mail and APG to send and read encrypted mails on the go.
  Apart from that even less people know that using PGP only the email content is encrypted, but not the header information like sender, recipient or subject. So when sending private encrypted mail it makes sense using a nonsense subject like "Thank you for the fish" ;-).

In many cases it is not a practical short-term solution to ditch Windows completely and switch to Thunderbird + encrypt all your mails. And you should also stop using your mobile phone (you can be tracked not only via GPS but also via antenna mast your mobile phone connects to). But as long as you don't do that and also do not encrypt any other data that you have saved somewhere in the cloud, it is quite irrelevant if you close down some of those accounts. Sincerely: Are you writing serious stuff in Facebook or Twitter that may really hurt your privacy if it would be made public for everybody?

There is always a tradeoff in having security and so is in having privacy. To avoid beeing hacked you can close down as many ports and sites as you want, but in the same time you loose access to features that might boost your productivity. We can be private and secure but then you wouldn't be able to use the benefits that the technical solutions offer.

Related posts: Pros and cons of cloud solutions, Administrator ethics, Social networking sites, Your holy machine, IT Dependencies.