<?xml version="1.0" encoding="utf-8"?>

			<rss version="2.0" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:cc="http://web.resource.org/cc/" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd">

			<channel>
			<title>Blog of Shaun McCran - Architecting robust, elegant technical and business solutions - Software Architecture</title>
			<link>http://www.mccran.co.uk/index.cfm</link>
			<description>I write about Architecture and Design, Architectural patterns, Architectural Principles and Architectural policies. This includes TOGAF, Zachman, Business Architecture, SOA and Process and tools such as the IBM Rational software and Adobe products. I also write about my previous life as a mobile and web developer.</description>
			<language>en-gb</language>
			<pubDate>Tue, 09 Jun 2026 06:47:43 -0000</pubDate>
			<lastBuildDate>Tue, 13 Sep 2016 03:01:00 -0000</lastBuildDate>
			<generator>BlogCFC</generator>
			<docs>http://blogs.law.harvard.edu/tech/rss</docs>
			<managingEditor>shaun@mccran.co.uk</managingEditor>
			<webMaster>shaun@mccran.co.uk</webMaster>
			<itunes:subtitle></itunes:subtitle>
			<itunes:summary></itunes:summary>
			<itunes:category text="Technology" />
			<itunes:category text="Technology">
				<itunes:category text="Podcasting" />
			</itunes:category>
			<itunes:category text="Technology">
				<itunes:category text="Tech News" />
			</itunes:category>
			<itunes:keywords></itunes:keywords>
			<itunes:author></itunes:author>
			<itunes:owner>
				<itunes:email>shaun@mccran.co.uk</itunes:email>
				<itunes:name></itunes:name>
			</itunes:owner>
			
			<itunes:explicit>no</itunes:explicit>
			
			
			
			
			
			<item>
				<title>Conceptual, Logical &amp; Physical views of solutions</title>
				<link>http://www.mccran.co.uk/index.cfm/2016/9/13/Conceptual-Logical--Physical-views-of-solutions</link>
				<description>
				
				There is a common sets of views that architects have to be able articulate, typically for different audiences, each of which describes the same solution but at a different level of detail. Anyone prescribing to be an architect should be able to clearly articulate these three common views, why they are necessary and how they link together, as there is a strong traceable model between them.
&lt;p&gt;
A while back I took a role in mentoring some less experienced architects with an aim to solidifying their architectural thinking and moving them out of a Business analysis and design way of thinking. As part of this in-house upskilling programme I started writing an example of the &apos;Conceptual-Logical-Physical&apos; views and their relationship. Whilst researching it online I found the example below, from the Zachman site. This is a great example, and clearly shows why the three views exist, and how they convey the right level of information to the correct audience, allowing each role to perform in its own space with, aiming at the same solution, but not restricted by any of the other roles around them.
&lt;p&gt;
&lt;h2&gt;Conceptual, Logical, Physical architecture example&lt;/h2&gt;
The &quot;Owner&quot;:  CONCEPTUALLY .....   &quot;I would like a pot of flowers in the center of my patio about 10 feet off the ground.  They would be purely for ascetic reasons, but I want the pot to be BIG and the flowers to be real.&quot;&lt;p&gt;

The &quot;Designer&quot;:  &quot;Let me see now ... the physics of this situation would suggest that there are two LOGICAL alternatives ... either 1) you would have to have a pedestal about 10 feet high, the weight it would have to sustain is max of 100 pounds so if it was 10 square inches in area (cross-section) the material would have to hold 10 lbs per sq. inch.  You&apos;re second alternative 2) would be to hang it from something above the pot ... do you have a roof over the patio??  If not, that would mean we would have to construct a tripod to suspend the pot from the apex.  Do you care if you see the tripod? I recommend you go with the pedestal.&quot;
&lt;p&gt;
The &quot;Builder:&quot;  &quot;The Architect is suggesting a pedestal that would be 10 feet high and sustain 10 pounds per square inch.  That Architect wouldn&apos;t recognize a lathe if he fell on one ... but here&apos;s what we could do ... we could PHYSICALLY build the thing in three pieces and then glue it together with superglue ... just in case, we could make flanges on the pieces so we could bolt the pieces together to make sure they don&apos;t come apart.  Your other alternative is to have it made in Japan and ship it in one piece and then we could install it by drilling a hole in the patio, sinking the base down 2 feet and filling in the hole with cement.
&lt;p&gt;
For full disclosure, I have republished this from the Zachman site, the original is &lt;a href=&quot;https://www.zachman.com/ea-articles-reference/58-conceptual-logical-physical-it-is-simple-by-john-a-zachman&quot; target=&quot;_blank&quot;&gt;here&lt;/a&gt;
&lt;img src=&quot;http://www.mccran.co.uk/images/arch-views.png&quot; width=&quot;552&quot; height=&quot;521&quot;&gt;
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Architecure principles</category>
				
				<category>Architecture</category>
				
				<category>IT Architecture</category>
				
				<pubDate>Tue, 13 Sep 2016 03:01:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2016/9/13/Conceptual-Logical--Physical-views-of-solutions</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Can an Innovation lab fit into the classic Corporate model?</title>
				<link>http://www.mccran.co.uk/index.cfm/2015/5/12/Can-an-Innovation-lab-fit-into-the-classic-Corporate-model</link>
				<description>
				
				At a recent company event one of the leaders in my division presented his thoughts on designing and implementing an Innovation lab. The presenter, Daryl Wilkinson, Head of Group Innovation at Nationwide (Link: &lt;a href=&quot;https://twitter.com/darylandhobbes&quot; target=&quot;_blank&quot;&gt;@DarylAndHobbes&lt;/a&gt;) put forward the idea of creating a digital Agency style innovation lab. This would allow a select group of Thinkers, Strategist and Developers to rapidly wireframe up services and applications/widgets and quickly prototype them into working, running applications.

I think this is a very interesting opportunity, but I think the radically different approaches between operating an Innovation Lab and a large-scale UK Corporate company may pose some interesting issues.

Having worked in a few smaller companies, particularly digital and marketing agencies I can see the value in this. The benefits of this sort of approach are many, including increased flexibility, ability to change direction quickly and a more open way of communicating and moving ideas around. A key principle that allows this way of working to be productive for smaller companies is the removal of barriers. These barriers might be Company rigidity, Governance rules, formulaic team structures and employee ego. By removing all of these things, you can take away, or minimise their impact on the way people think about opportunities and problems. By removing traditional working barriers, you encourage people to open up to new ways of thinking that is not constrained by traditional learnt behaviour. (This is often referred to as disruptive thinking). The two fold acts of giving them literal authority to become unconstrained in approach, and the removal of these business rules allows for a different, more agile operational model. 

This also results in the blurring of responsibilities and roles within the team. Team members are far more inclined to own their own space, and stretch out into other member&apos;s spaces, as the boundaries between them are blurred, in a far more collaborative working approach.

Let us contrast that with the traditional UK corporate model. Typically, they have a far more rigid structure, with defined lines between departments and responsibilities. Employees have a role to play and generally, because of the luxury of scale, people are kept in that role, and find it difficult to venture too far into other roles without encountering resistance.

Add into the corporate mix a defined, constrictive Governance model, security policies, hard-wired policies and processes and a corporate operating model, and the attitudes that brings with it. These elements are in direct conflict with the outline described above, that not only enables but also drives an Innovation lab. How this newfound Innovation lab will integrate into a corporate environment, working its way through the barriers described here, will either enable or contain its success. It will be a tricky journey implementing, then maturing a lab like this into a working state. It could become an interesting bubble of productivity, living inside the corporate structure, creating ripples that disrupt the usual state of thinking within traditional departments. What better way to introduce change into your organisation than by having a department like this forge new ways of thinking and approaches to solutions.

I&apos;ll certainly keep an eye on how it develops, and see if any of these conflicts arise.
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Development</category>
				
				<category>Best practices</category>
				
				<category>Mobile</category>
				
				<pubDate>Tue, 12 May 2015 16:38:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2015/5/12/Can-an-Innovation-lab-fit-into-the-classic-Corporate-model</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Micro transaction madness with Marvel Puzzle Quest</title>
				<link>http://www.mccran.co.uk/index.cfm/2014/7/21/Micro-transaction-madness-with-Marvel-Puzzle-Quest</link>
				<description>
				
				&lt;p align=&quot;justify&quot;&gt;

I&apos;m a big fan of Puzzle games, and Marvel, so what could be better than a Marvel themed puzzle game?
&lt;p align=&quot;justify&quot;&gt;

The game itself is a classic three-in-a-row puzzle game just like the previous versions of Puzzle Quest games. It&apos;s the now &apos;classic&apos; model of free-to-play but with in-game micro transactions through it. There are several resources used in the game, Iso-8 which is used to upgrade your hero&apos;s level and hero points, which are basically coins that you can use to but team slots to hold more characters, or to buy skills for characters.
&lt;p align=&quot;justify&quot;&gt;

&lt;table width=&quot;100%&quot;&gt;
&lt;tr&gt;
&lt;td&gt;&lt;p align=&quot;justify&quot;&gt;
You can play the game without purchasing anything at all, which is my preference or you can spend upwards of £80.00 on all the extras. Personally if it was priced at a sensible mobile price point I would have happily purchased it, it&apos;s the sheer volume of micro transactions present that is annoying. I don&apos;t know how or why the trend for Micro transactions started but the model is abhorrent.
&lt;p align=&quot;justify&quot;&gt;

This whole game feels like a vehicle for micro transactions. Every way you try and play it you are faced with a transaction. The only other option is such soul crushing repetition that the game is almost unplayable. You really have to purchase a wealth of content if you want to even see half of the characters and powers in this game.


&lt;/td&gt;
&lt;td width=&quot;50px&quot;&gt; &lt;/td&gt;
&lt;td&gt;&lt;img src=&quot;http://www.mccran.co.uk/images/Marvel_Puzzle_Quest_Icon.png&quot; /&gt;&lt;/td&gt;

&lt;/tr&gt;
&lt;/table&gt;

Looking at this from a design perspective it is obvious that the design started with user journeys arriving at micro transactions. For me, if a games design is being driven by the purchasing functions in it then you&apos;ve lost the plot. I appreciate that games have to make money, that&apos;s just the modern games industry but they shouldn&apos;t be the driving design principle in the product! 
&lt;p align=&quot;justify&quot;&gt;

This is a real shame as the game is quite enjoyable, its just that the constant barrage of &apos;purchase me&apos; advertising really starts to intrude on your enjoyment of actually playing the game. It feels like there is more &apos;purchasing advertisements&apos; than puzzle matching.
&lt;p align=&quot;justify&quot;&gt;

So, I&apos;d stay away from this game. Marvel should release a non &apos;free to play&apos; version at £9.99 or £14.99 with all the content unlocked. I&apos;d be happy to purchase in that model. Micro Transactions hidden in the &apos;free to play&apos; games are a blight on the games industry. Its false advertising, plain and simple. There needs to be a change in policy, and a change in terminology, as this terms is just lies.
&lt;/p&gt;
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Android</category>
				
				<category>Mobile</category>
				
				<category>Comics</category>
				
				<pubDate>Mon, 21 Jul 2014 16:17:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2014/7/21/Micro-transaction-madness-with-Marvel-Puzzle-Quest</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>The problem with Agency life (PT1)</title>
				<link>http://www.mccran.co.uk/index.cfm/2013/2/1/The-problem-with-Agency-life-PT1</link>
				<description>
				
				I&apos;ve recently been discussing some of the aspects of Agency life with friends that have moved into that kind of environment and having some experience in it myself I thought I&apos;d comment on what I consider to be some of the major differences between Agencies and more traditional working environments.

I found it quite an interesting, if challenging transition when I moved from a &apos;normal&apos; office environment into an Agency space. There are several key differences that result in a distinctly different atmosphere. I think it&apos;s a combination of these differences that lead to the overall difference in the atmosphere and working practices.

For this first article I&apos;m looking in more depth at the product and pricing models.

&lt;b&gt;Products:&lt;/b&gt;

If you take a traditional office based working environment, the product they sell is a tangible, physical product or service. They occupy a specific market place, with a clearly defined remit and product to market and sell. This means they are an easily identified quantity. Think of the companies you know, at a brand level. Chances are you also know their associated product set.

For example:

Cadburys = Chocolate products&lt;br&gt;
BT = Telephone products and services&lt;br&gt;
GSK = Pharmaceuticals&lt;br&gt;

There is a pretty clear relationship between the company and the product set / service. This leads to a situation internally where everyone is clear on the company vision, and more importantly knows what they are selling. It is clearly defined.

Now take an Agency model, where the product they are selling is themselves, and the services they bring to the table. This is a lot more ambiguous than a product set, and also results in quite a heavy marketing focus on the company as a commodity. I lost count of the number of times there were guided tours around the office that were trying to establish various individuals as credible experts in their field.

Think about that key difference for a second. When you go into the supermarket and pick up a product off the shelf you don&apos;t ask to see the product designer&apos;s credentials before you make that purchase, you are confident that the product is fit for purpose. In an Agency you are constantly selling yourself.

&lt;b&gt;Pricing:&lt;/b&gt;

Consider the other side of the product &apos;Coin&apos;,  the pricing model. If you have clearly defined products / services then you typically also have a clearly defined pricing model. Item &apos;X&apos; costs &apos;Y&apos; price, potentially with additional levels of pricing scale based on premium products.

Now look at the Agency model. Typically they have common offerings based on market sector and channel. If a client wants a DM campaign or a website then there are generally &apos;cookie cutter&apos; processes for the Agency to go through. Obviously they don&apos;t like advertising this to clients as every client is special and receives a bespoke service (sic!) along with bespoke pricing.

The issue here is that the scope of the product varies considerably, which leads to the pricing varying considerably. This tends to be for two reasons.

1.	Elements being resized during the project.&lt;br&gt;
2.	Some aspects of the project being prioritised over other aspects because they are deemed more important, or vice versa.&lt;br&gt;

The tricky aspect to these two points is that a client has come to the Agency because they are the experts in their field. They are established best practice practitioners, and as such should be listened to. As is always the case in these things though, the people in charge of the money tend to control things. So where there is a push back on budget, the scope tends to change. Its at this point that the less tangible aspects of a project, often the most crucial aspects in my view, tend to get downsized or dropped altogether.

For a client it is very obvious to see if a graphic designer has built a header banner on a page. It is a large visible element, that to them justifies financial outlay. It&apos;s tangible. Look at the less tangible disciplines of Information architecture, User Interface design or User Experience planning. You cannot &apos;see&apos; any of those project elements. Yet they contribute considerably more to the success of the project than the font choice or banner imagery.

This is a common conflict within Agency life. The push from the client to reduce the budget, but not the scope, and the push from the Agency to deliver on time and to budget, whilst accommodating (and compromising) on principles of the project.

This was the situation I found myself in frequently. Being an expert in the field, but being driven to compromise things you know, and have communicated, would affect the successful outcome of the project. Due to financial aspects that really shouldn&apos;t be up for discussion in the first place.
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Careers</category>
				
				<category>Project Management</category>
				
				<pubDate>Fri, 01 Feb 2013 04:26:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2013/2/1/The-problem-with-Agency-life-PT1</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>My natural development pattern - software layer-ification</title>
				<link>http://www.mccran.co.uk/index.cfm/2012/1/6/My-natural-development-pattern--software-layerification</link>
				<description>
				
				Whilst reflecting on some of the projects I&apos;d been through in 2011 I noticed a pattern that became more and more prominent as the year wore on.

All of my project functionality was naturally splitting itself into independent service layers.
				 [More]
				</description>
				
				
				<category>Software Architecture</category>
				
				<pubDate>Fri, 06 Jan 2012 09:33:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2012/1/6/My-natural-development-pattern--software-layerification</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Web Accessibility 101 - Compliance and Standards</title>
				<link>http://www.mccran.co.uk/index.cfm/2011/2/13/Web-Accessibility-101--Compliance-and-Standards</link>
				<description>
				
				This article will discuss UK based Accessibility Compliance and the development standards around ensuring that your project will pass Accessibility testing and validation.

This is the second in a series of planned articles dealing with Web Accessibility. In this series I will cover what is Accessibility, how to build Accessibility into web projects, how to test and validate for Accessible users and a few other factors to keep in mind when dealing with Accessibly minded projects.
				 [More]
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Accessibility</category>
				
				<category>Web technologies</category>
				
				<pubDate>Sun, 13 Feb 2011 21:33:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2011/2/13/Web-Accessibility-101--Compliance-and-Standards</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Lionhead studios launches GPS based fable 3 mobile App - Kingmaker</title>
				<link>http://www.mccran.co.uk/index.cfm/2010/10/9/Lionhead-studios-launches-GPS-based-fable-3-mobile-App--Kingmaker</link>
				<description>
				
				Lionhead studios have just launched &apos;Kingmaker&apos;, a mobile application that uses your GPS data to mark locations as &apos;owned&apos; by you. You work on behalf of one of two teams, and receive gold coins to be spent within the game, every time you log a location in the application.
&lt;p&gt;
&lt;a href=&quot;http://www.fable3kingmaker.com/Default.aspx&quot; target=&quot;_blank&quot;&gt; http://www.fable3kingmaker.com/Default.aspx &lt;/a&gt;
&lt;p&gt;
From a technology point of view this is an interesting example of many different platforms all converging to drive people towards pre ordering and buying a game.
&lt;p&gt;
The initial interaction is through several different mobile platforms (iPhone, Android, Blackberry and Windows 7 mobile). Each GPS &apos;tagging&apos; posts to social media platforms, such as Facebook and Twitter, and the virtual gold is credit to your account. The account itself is an Xbox 360 account (windows live account), which will interface with the game, and you&apos;re in-game character ends out with the gold you have accrued.
&lt;p&gt;
It&apos;s an interesting proposition, and is trying to integrate several differing data platforms into one cohesive direction. It really is joined up thinking.
&lt;p&gt;

&lt;img src=&quot;http://www.mccran.co.uk/images/fable3-logo-white.jpg&quot; width=&quot;600px&quot; /&gt;
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>XBox360</category>
				
				<category>General Interest</category>
				
				<category>Mobile</category>
				
				<pubDate>Sat, 09 Oct 2010 18:48:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2010/10/9/Lionhead-studios-launches-GPS-based-fable-3-mobile-App--Kingmaker</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Pre loading object (CFC) references in your Application.cfc</title>
				<link>http://www.mccran.co.uk/index.cfm/2010/3/25/Pre-loading-object-CFC-references-in-your-Applicationcfc</link>
				<description>
				
				One of the best practices that I&apos;ve been using more and more is ColdFusion&apos;s ability to add CFC object references to scopes. By this I mean that it is possible to create a shorter friendlier scoped variable that you use to reference your CFC&apos;s. 

In your Application.cfc you can map out all your CFC references, this gives you a much shorter variable name to type each time, and it caches the CFC.

&lt;code&gt;

&lt;cffunction name=&quot;onApplicationStart&quot;&gt;

&lt;!--- scope out all the objects as application level vars ---&gt;
&lt;cfset application.formObj= createObject(&apos;component&apos;,&apos;dir.objName &apos;)&gt;
&lt;cfset application.siteObj= createObject(&apos;component&apos;,&apos;dir.objName&apos;)&gt;
&lt;cfset application.mailObj= createObject(&apos;component&apos;,&apos;dir.objName&apos;)&gt;
&lt;cfset application.config=createObject(&apos;component&apos;,&apos;dir.objName&apos;).getConfig(id=N)&gt;

&lt;/cffunction&gt;

&lt;/code&gt;

Put any references like this in the &apos;onApplicationStart&apos; function. You do not need to lock the scope in this function, and if the code within it does not run successfully then it does not continue running the application. It will try again on the next page request.

The caching functionality here is great, not only will Coldfusion create a handy short name for CFC, but it will actually run through the code, and stop on any errors. If you deliberately introduce a code error into one of your objects you will see the Application halt and show you the error. For me this is reason enough to move all my business logic into CFC&apos;s. This essentially means that it is not possible for a user to get part of the way through a application and find an object based error.

Using this in conjunction with a framework such as FuseBox allows you to load, parse and cache the CFC object, all before your actual display layer has been invoked.

The example below uses the FuseBox function &apos;onFuseboxApplicationStart&apos; of starting an Application. 

&lt;code&gt;

&lt;cffunction name=&quot;onFuseboxApplicationStart&quot;&gt;
	&lt;cfset super.onFuseboxApplicationStart() /&gt;
&lt;!--- scope out all the objects as application level vars ---&gt;

&lt;cfset application.formObj= createObject(&apos;component&apos;,&apos;dir.objName &apos;)&gt;
&lt;cfset application.siteObj= createObject(&apos;component&apos;,&apos;dir.objName&apos;)&gt;
&lt;cfset application.mailObj= createObject(&apos;component&apos;,&apos;dir.objName&apos;)&gt;
&lt;cfset application.config=createObject(&apos;component&apos;,&apos;dir.objName&apos;).getConfig(id=N)&gt;


&lt;/cffunction&gt;

&lt;/code&gt;

Changing the &apos;fusebox_parameters.mode&apos; value allows you to set this caching at an environmental level, so no caching for development, or caching for live

&lt;code&gt;

&lt;cfset FUSEBOX_PARAMETERS.mode = &quot;development-full-load&quot;&gt;
Or
&lt;cfset FUSEBOX_PARAMETERS.mode = &quot;production&quot;&gt;

&lt;/code&gt;
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Development</category>
				
				<category>Coldfusion</category>
				
				<category>Best practices</category>
				
				<pubDate>Thu, 25 Mar 2010 15:23:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2010/3/25/Pre-loading-object-CFC-references-in-your-Applicationcfc</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Using Isapi / Apache rewriting to mask URL strings, for cosmetics and security</title>
				<link>http://www.mccran.co.uk/index.cfm/2009/12/22/Using-Isapi--Apache-rewriting-to-mask-URL-strings-for-cosmetics-and-security</link>
				<description>
				
				One of the more recent additions to my Coldfusion frameworks is masking the more ugly URL&apos;s using Isapi rewrite.  In this article I&apos;ll be using Helicon&apos;s Isapi ReWrite, but Apache re write works in much the same way.

Usually in your Coldfusion frameworks, most other technologies as well, you are passing around a variable or two to control the page content, and more often than not it is in the url. It never looks particularly clean if your URL has a long name value query string behind it, like this:

&lt;code&gt;
http://www.mysite.com/index.cfm?variable1=pagename&amp;location=england&amp;value=7
&lt;/code&gt;

&lt;h3&gt;Cosmetic reasons&lt;/h3&gt;

So for two reasons URL rewriting seems like a good idea.

Firstly to mask those ugly URLS with a url rewriter. On a basic level this will re write specified request to the URL you tell it to, taking your ugly list of name value pairs and changing it into a user friend URL. If you are pitching this to a client this looks a lot more professional.

&lt;h3&gt;Security reasons&lt;/h3&gt;

Secondly there is an added security benefit here. The URL gives a lot away about a website, like what the code base is, and is potentially a window on the internal workings of a website. Take a normal FuseBox application for example. The normal URL might be:

&lt;code&gt;
www.mysite.com/index.cfm?fuseaction=controller.action&amp;othervalues=values
&lt;/code&gt;

From here it is very easy to start messing around with the controller names, trying to dig out an &apos;admin&apos; controller, or other common function controller. Similarly adding values to pages where it is obvious a Query has been fired is an easy way of testing of the developer is using &apos;cfQueryParam&apos;, with potentially disastrous results.

Along the same lines it is quite simple to inject form values into the URL (like this &lt;a href=&quot;http://www.mccran.co.uk/index.cfm/2009/7/30/Cross-site-Script-hacking-using-the-GET-method&quot;&gt;http://www.mccran.co.uk/index.cfm/2009/7/30/Cross-site-Script-hacking-using-the-GET-method&lt;/a&gt;). By masking the URL and the values you make it considerably more difficult to do this, after all if you can see or get to the URL, how can you fool around with it?

So far I am implementing a rewrite script that will rewrite URLs into friendly strings, here is a modified version of the .htaccess file I&apos;m using.

&lt;code&gt;
# Helicon ISAPI_Rewrite configuration file
# Version 3.1.0.68

RewriteEngine on
RewriteBase /wwwroot/

#generic
RewriteRule requestID/(.*)/(.*)/ index.cfm?decryptURL=$1&amp;params=$2

# site pages
RewriteRule home(/)? index.cfm?go=controller.home
RewriteRule contact(/)? index.cfm?go=controller.contact
RewriteRule login(/)? index.cfm?go=controller.login
RewriteRule privacy(/)? index.cfm?go=controller.privacy
RewriteRule about(/)? index.cfm?go=controller.about
RewriteRule faqs(/)? index.cfm?go=controller.faqs
RewriteRule search(/)? index.cfm?go=controller.search
&lt;/code&gt;

This code starts off by turning the rewriteEngine on, then setting the rewriteBase, this is typically your webroot, or the root of the site the file is for. Then it rewrites any URL params to the URL string.

The main part of the code is where we set individual rewriteRule&apos;s for each URL. The first example (home) looks for any URL requests to the &apos;home&apos; string, and re writes this to the URL in the regular expression (index.cfm?go=controller.home).  
Pretty straight forward really. 

There is a lot more you can do with this, and hopefully I&apos;ll get to explore rewriting in more depth in the future.
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Security</category>
				
				<category>Development</category>
				
				<pubDate>Tue, 22 Dec 2009 22:44:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2009/12/22/Using-Isapi--Apache-rewriting-to-mask-URL-strings-for-cosmetics-and-security</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Using Isapi rewrite to serve up non existing templates</title>
				<link>http://www.mccran.co.uk/index.cfm/2009/12/16/Using-Isapi-rewrite-to-serve-up-non-existing-templates</link>
				<description>
				
				I was discussing some ideas for an application framework this morning with the team, and one of the issues we hit upon was having a common directory for templates, but serving them up as if they were from a different directory. 

The idea is to have one instance of a reusable skinnable template, that appears to live on several sites.

IE all the content lives in &quot;webroot/content/templateName.cfm&quot;, but is actually served up by many sites, IE &quot;127.0.0.1/site1/template1.cfm&quot;, &quot;127.0.0.1/site2/template1.cfm&quot; ... etc

In this way they can be re skinned or adapted as needed, and they aren&apos;t database driven. The main stumbling block for the discussion was the need to actually create blank versions of each of the named templates, in each of the sites, as ColdFusion server would error on the request. 

I spent twenty minutes trying to work it so that my Application.cfc&apos;s onRequest or onRequestStart method would intercept the request before it was actually made, but that just wasn&apos;t working. My other idea was to use the onMissingTemplate method, but the server is only running ColdFusion 7, so that was a no go (I figured I could catch the missing template request and just re path it, although I&apos;d have to assess if that was really inefficient due to almost every page request logging as failed).

My eventual solution was Isapi rewrite. I am re writing all the requests to the same template, and just passing in the template variable. In that way I can request pages that don&apos;t actually exist, but they appear in the url.

Create an index.cfm template like this:

&lt;code&gt;
&lt;h1&gt;I am the index page&lt;/h1&gt;
&lt;ul&gt;
	&lt;li&gt;&lt;a href=&quot;page1&quot;&gt;Page 1&lt;/a&gt;&lt;/li&gt;
	&lt;li&gt;&lt;a href=&quot;page2&quot;&gt;Page 2&lt;/a&gt;&lt;/li&gt;
	&lt;li&gt;&lt;a href=&quot;page3&quot;&gt;Page 3&lt;/a&gt;&lt;/li&gt;
	&lt;li&gt;&lt;a href=&quot;page4&quot;&gt;Page 4&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;cfdump var=&quot;#url#&quot;&gt;
&lt;!--- write a handler to go get the url var passed in ---&gt;
&lt;/code&gt;

For this example I am using the free version of Helicon&apos;s Isapi rewrite, you can get it here: &lt;a href=http://www.helicontech.com/download-isapi_rewrite.htm target=&quot;new_win&quot;&gt;Link to Helicons Isapi re write&lt;/a&gt;

In the example below I have altered the first page link to look like it is actually a .cfm template request, just in case you want the url string to have a .fileextension look to it.

&lt;code&gt;
# Helicon ISAPI_Rewrite configuration file
# Version 3.1.0.68

RewriteEngine on
RewriteBase /mywebroot

#no physical page testing
RewriteRule page1.cfm(/)? isapitest/index.cfm?p=page1 
RewriteRule page2(/)? /index.cfm?p=page2
RewriteRule page3(/)? /index.cfm?p=page3
RewriteRule page4(/)? /index.cfm?p=page4

&lt;/code&gt;

So when you fire it up and test it you just see /page1, /page2 etc, and the pages don&apos;t actually exist.

I&apos;m not experienced enough with Isapi rewrite to know if there is a downside to this, but bookmarking in  a browser still works correctly, so I can&apos;t see an issues at present.
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Coldfusion</category>
				
				<category>Frameworks</category>
				
				<category>Isapi rewrite</category>
				
				<category>Web technologies</category>
				
				<pubDate>Wed, 16 Dec 2009 13:19:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2009/12/16/Using-Isapi-rewrite-to-serve-up-non-existing-templates</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Exploring the variations in email UN subscription methods</title>
				<link>http://www.mccran.co.uk/index.cfm/2009/11/20/Exploring-the-variations-in-email-UN-subscription-methods</link>
				<description>
				
				If you are anything like me, everyday you are smothered in a stack of emails from various companies all delivering html formatted, image heavy flyers persuading you to buy whatever dead horse they are flogging. I know it is my own fault, after all I signed up to them in the first place, I&apos;ve only got myself to blame. As I find myself checking (and deleting) these email on an Android mobile device now it has become hassle-some.  So I set out to unsubscribe from the majority of them, which is where the inspiration for this article came from.

In a short period of time I have unsubscribed from around a dozen different email newsletters, and because of this the differences in the methods used to accomplish this have become glaringly obvious. I was very surprised at the variations in the methods used, some are very user friendly, and others are very much not. I won&apos;t name the companies involved.

&lt;b&gt;Case one: &lt;/b&gt;

By far the easiest user interaction, this is a simple link from an email that provides you with a screen confirming your UN subscription. No prompt is required from the user, you are simply unsubscribed. All the data is passed seamlessly behind the scenes.

&lt;b&gt;Case two: &lt;/b&gt;

Almost the same as above except that you are taken to a screen where you have to commit an action. You are presented with a screen displaying your email address, and prompted to click a button to confirm the UN subscribe action. This may be a handy safety net to step errors from the casual clicker.

&lt;b&gt;Case three: &lt;/b&gt;

Clicking on the link from an email takes you to a generic page with a form on it. They have not transferred any form of token from the email so you are prompted to enter the email address you want to UN subscribe. Entering your email address takes you to a screen confirming your action. This additional step is unnecessary, and doesn&apos;t add any value at all.

&lt;b&gt;Case four: &lt;/b&gt;

In this scenario we are passed to a page where we have to login. The subscription details are attached to an account application, and as such your credentials need to be verified. Based on passing an encrypted token from the email a user could easily be logged in automatically. Actually requiring a username and password adds an additional level of complexity. Once I logged in I then had to navigate to the subscription settings and choose to unsubscribe with a form similar to the ones mentioned above.

&lt;b&gt;Case five: &lt;/b&gt;

In the most convoluted example I have come across so far I actually had to create an account. I arrived at the UN subscribe page and found that to subscribe did not require an account, but to change my subscription options did! This was a very strange scenario, requiring a user to create an account to stop emails. Once you have created an account the subscription options were managed through a form like the ones mention above.

&lt;b&gt;Conclusions&lt;/b&gt;

I think the thing to keep in mind with functionality like this is the balance between usability and the business objectives. An obvious point to note is that businesses do not want their users to UN subscribe to their emails. This is their user base and they do not want to lose it. Still it is worth considering just how you interact with your customers, even when providing functionality you do not want them to use.

After all you can always just &apos;Mark as Spam&apos;.
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Best practices</category>
				
				<category>Web technologies</category>
				
				<pubDate>Fri, 20 Nov 2009 16:20:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2009/11/20/Exploring-the-variations-in-email-UN-subscription-methods</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Testing methodologies - Regression testing</title>
				<link>http://www.mccran.co.uk/index.cfm/2009/11/7/Testing-methodologies--Regression-testing</link>
				<description>
				
				One of the more overlooked forms of testing (you do test don&apos;t you?) is regression testing. I&apos;m a big fan of scripted testing using both scripted tests to actually run against your code base (think cfUnit or Junit) and scripted testing as in a basic word doc of testing instructions. 

This word doc can be as simple as &apos;click button N&apos; - what displayed on screen? You can literally just list the actions, expected consequences and actual conqequences.

Regression testing is the practice of going back after a release and testing the functionality that was already present. IE did you break anything by releasing your new functionality. Often the business and IT focus is on the shiny new development, not the integrity of the existing application.

Developers in particular are guilty of zoning in on the specifc area that they are directly involved with. This can sometimes lead to other areas suffering, especially if you have an OO application layer. In just how many places is each individual object referenced? A change to it may work in one area, but have devastating consequences in another. 

I&apos;ve seen cases of this where its been months later before an error has reared its head, and without an accurate change log it can be difficult to track the root cause down. Needless error tracking and bug fixes take developers away from actually developing, and essentially cost the business money due to bad practice.

I mentioned scripted testing above as it has had unforseen beneficial consequences. If you have done anything like this in the past, your regression testing will be very easy. You will have a handy library of repeatable scripted tests, so it is very easy for you to measure the previous results against any new tests you might perform. Thus making it instantly obvious wether your functionality is still behaving as it was before the release.
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Best practices</category>
				
				<category>Project Management</category>
				
				<pubDate>Sat, 07 Nov 2009 17:50:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2009/11/7/Testing-methodologies--Regression-testing</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Introducing third party applications into your frameworks, good practice?</title>
				<link>http://www.mccran.co.uk/index.cfm/2009/10/1/Introducing-third-party-applications-into-your-frameworks-good-practice</link>
				<description>
				
				A recent development involved some changes to a large script that was using a product called ImageMagick (&lt;a href=www.imagemagick.org/ target=&quot;new&quot;&gt;link&lt;/a&gt;). It is an image manipulation tool that allows you to perform transformations and other actions on image files. The product seems stable enough, and can be executed from a web interface using cfexecute, in a kind of command line prompt method.

It got me thinking as to why the application wasn&apos;t using cfimage, and then lead me to examine the wider topic of whether to use ColdFusion&apos;s in built functionality, or opt for other third party products.

I can think of a few obvious deciding factors for both pro and con, the first that springs to mind is performance. 

Is there a marked performance difference between a ColdFusion function, and the third party application? Is it better to pass the load of to the operating system, rather than have ColdFusion perform whatever processing function it is supposed to do? In this case it would be a race between cfexecute, and cfimage, so there may be very little difference in it.

The second major point that springs to mind is the knowledge base of the developer, and the structure of whatever framework you are using. What I really mean by this is &apos;if your chosen technology can perform a function, why not utilise it to its full potential?&apos; . It seems a bizarre choice indeed to deliberately not harness a function that your platform can already provide, and instead introduce another code base or application into the framework. 

It also introduces another hurdle for the development staff, they may well be familiar with how an existing Tag works, but be totally unaware of the third party application, as was my case here.

A long winded intro, but here is the code I used:

&lt;code&gt;
&lt;!--- setup vars ---&gt;
&lt;cfset variables.destination = &quot;C:\dev\images\testimage.jpg&quot;&gt;
&lt;cfset variables.source = &quot;C:\dev\images\testimage.jpg&quot;&gt;
&lt;cfset variables.width = &quot;100&quot;&gt;
&lt;cfset variables.height = &quot;100&quot;&gt;
&lt;cfset variables.exec = &quot;C:\dev\apps\imageMagick\convert.exe&quot;&gt;

&lt;!--- executing an external application version ---&gt;
&lt;cfexecute name=&quot;#variables.exec#&quot; arguments=&quot;-size #variables.width# #variables.source# -geometry #variables.height# -strip #variables.destination#&quot; variable=&quot;imageinfo&quot; timeout=&quot;3&quot; /&gt;

&lt;!--- CFimage version ---&gt;
&lt;cfimage source=&quot;#variables.source#&quot; action=&quot;resize&quot; width=&quot;#variables.width#&quot; height=&quot;#variables.height#&quot; destination=&quot;#variables.destination#&quot;&gt;
&lt;/code&gt;
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Coldfusion</category>
				
				<category>Recommended Apps</category>
				
				<category>Best practices</category>
				
				<category>File Interactions</category>
				
				<pubDate>Thu, 01 Oct 2009 13:18:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2009/10/1/Introducing-third-party-applications-into-your-frameworks-good-practice</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>A simple Fusebox reset function</title>
				<link>http://www.mccran.co.uk/index.cfm/2009/9/30/A-simple-Fusebox-reset-function</link>
				<description>
				
				A simple Fusebox reset function

I am always forgetting the application URL for resetting fusebox frameworks, so instead of having to type out the entire fuseaction url, and appending the load variables, and the parsing variables you can create a fuse action for it.


&lt;code&gt;

	&lt;cffunction name=&quot;rebuild&quot;&gt;
		&lt;cfargument name=&quot;myFusebox&quot; /&gt;
		&lt;cfargument name=&quot;event&quot; /&gt;

		&lt;cfset xfa.reinit = &quot;index.cfm?&quot; &amp;  FUSEBOX_PARAMETERS.fuseactionVariable &amp; &quot;=&quot; &amp; &quot;&amp;fusebox.loadclean=true&amp;fusebox.parseall=false&amp;fusebox.execute=true&amp;fusebox.password=&quot; &amp; FUSEBOX_PARAMETERS.password&gt;
		&lt;cflocation url=&quot;#xfa.reinit#&quot; addtoken=&quot;false&quot;&gt;
	&lt;/cffunction&gt;
&lt;/code&gt;

The code above will build the URL using the fuse action variable (IE &apos;action=&apos; or whatever you have specified). It also uses the fusebox password set in your Application.cfc. 

There may be a small security risk involved with this, so don&apos;t use an obvious name for the function. Also they would need your fusebox password. 

Even then thought the only potential issue I can see with this is that someone may empty your framework cache and rebuild your application. Which isn&apos;t all that bad?
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Development</category>
				
				<category>Coldfusion</category>
				
				<pubDate>Wed, 30 Sep 2009 13:55:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2009/9/30/A-simple-Fusebox-reset-function</guid>
				
				
			</item>
			
		 	
			
			
			<item>
				<title>Example of inserting a Struct() into a database using keys</title>
				<link>http://www.mccran.co.uk/index.cfm/2009/8/26/Example-of-inserting-a-Struct-into-a-database-using-keys</link>
				<description>
				
				A while ago a colleague and I were working on a timesheet application in Flex. The idea was that you could commit a custom timebar object, generated in flex, and it would update the dataset in the back end using the ColdFusion flex gateway. 

I came across the code recently, and decided to tidy it up a bit, and make the query dynamic, based on the Struct contents. The obvious limitation to this is that your Struct and your database schema have to match exactly.

I won&apos;t go into the Flex application here, but I&apos;ve emulated its input arguments here with a pre-populated structure.

&lt;code&gt;
&lt;cfscript&gt;
      timesheetTask = StructNew();
      StructInsert(timesheetTask, &quot;employeeid&quot;, &apos;36&apos;);
      StructInsert(timesheetTask, &quot;timesheetDT&quot;, &apos;0&apos;);
      StructInsert(timesheetTask, &quot;projectid&quot;, &apos;6&apos;);
      StructInsert(timesheetTask, &quot;weekid&quot;, &apos;25&apos;);
      StructInsert(timesheetTask, &quot;taskid&quot;, &apos;39&apos;);
      StructInsert(timesheetTask, &quot;hours&quot;, &apos;8&apos;);
      StructInsert(timesheetTask, &quot;comment&quot;, &apos;Comments for this task live here&apos;);
      StructInsert(timesheetTask, &quot;szStatus&quot;, &apos;1&apos;);
      StructInsert(timesheetTask, &quot;iFirstLineApproval&quot;, &apos;23&apos;);
      StructInsert(timesheetTask, &quot;iSecondLineApproval&quot;, &apos;34&apos;);
      StructInsert(timesheetTask, &quot;iCurrentApprover&quot;, &apos;&apos;);
      StructInsert(timesheetTask, &quot;szRejectReason&quot;, &apos;&apos;);
      StructInsert(timesheetTask, &quot;szDescription&quot;, &apos;&apos;);
 
      updateTimesheet = createObject(&quot;component&quot;, &quot;timesheet&quot;);
      updateTimesheet.updateTask(timesheetTask);
&lt;/cfscript&gt;
&lt;/code&gt;

Notice that this code also calls the CFC object at the end. The data itself isn&apos;t massively important, it&apos;s a time object for recording tasks.

Next we have the function, which accepts a Struct() argument called &apos;taskStruct&apos;. I then loop through the structure, and populate a SQL query using the keys from a collection. The only logic is a check to see if it is the last structure element, as this controls the &apos;,&apos; placement.

 &lt;code&gt;
      &lt;cffunction name=&quot;updateTask&quot; access=&quot;remote&quot; returntype=&quot;string&quot; hint=&quot;Creates a record for timesheet tasks&quot;&gt;
            &lt;cfargument name=&quot;taskStruct&quot; type=&quot;struct&quot; required=&quot;yes&quot;&gt;
      &lt;cfset var count = 0&gt;

            &lt;cfdump var=&quot;#arguments.taskStruct#&quot;&gt;
      &lt;cfset variables.structSize = structCount(arguments.taskStruct)&gt;
 
      &lt;cfquery datasource=&quot;#application.dsn#&quot;&gt;
            INSERT INTO [dbo].[timesheet]
           (&lt;cfloop collection=&quot;#arguments.taskStruct#&quot; item=&quot;key&quot;&gt;
                        [#key#]
                        &lt;cfset count = count + 1&gt;
                        &lt;cfif count LT variables.structSize&gt;,&lt;/cfif&gt;
                  &lt;/cfloop&gt;)
    
      &lt;cfset count = 0&gt; 
      
      VALUES(&lt;cfloop collection=&quot;#arguments.taskStruct#&quot; item=&quot;key&quot;&gt;
                  &apos;#arguments.taskStruct[key]#&apos;
               &lt;cfset count = count + 1&gt;
               &lt;cfif count LT variables.structSize&gt;,&lt;/cfif&gt;
               &lt;/cfloop&gt;)
            &lt;/cfquery&gt;
 
            &lt;cfreturn true&gt;
      &lt;/cffunction&gt;
&lt;/code&gt;

That will insert your Struct into a database, in small and tidy manner. It was somewhere around here that we started using cfproperty tags, and creating strongly typed objects for Flex.
				
				</description>
				
				
				<category>Software Architecture</category>
				
				<category>Flex Remoting</category>
				
				<category>Coldfusion</category>
				
				<category>SQL</category>
				
				<pubDate>Wed, 26 Aug 2009 16:42:00 -0000</pubDate>
				<guid>http://www.mccran.co.uk/index.cfm/2009/8/26/Example-of-inserting-a-Struct-into-a-database-using-keys</guid>
				
				
			</item>
			
		 	
			</channel></rss>