Spearchucker

"... the disaster that was Healthcare.gov"

OMG you worked on that? The blame for this one (and Universal Credit) sits with GDS. Their approach at the time was agile or die, and then try to develop an enterprise system like they did the Guardian's CMS (GDS was staffed initally by ex-Guardian devs).

I had the misfortune of reviewing their Government Gateway replacement, which at the time focused singularly on identity federation. GDS was hugely anti-Microsoft, who built the Govrernment Gateway. And so they chose the SAML protocol over the incumbent ADFS, breaking every dependency.

GDS was way out of its league. An inexperienced 25y/o will draft exactly the kind of architecture document you describe.

I feel for you, and I now understand the cyncism.

Critical outcomes are defined by quality objectives (I mentioned some above, others are reliability, robustness and portability).

People don't consider using my project. There's a client with a business problem, there's a vendor who solves problems for clients. The vendor produces an architecture document that describes how technology will achieve a solution †.

There is no noping the fuck out, as this is a hospital asking you for a one-off to manage/settle insurance payments. Or an electoral district asking you to merge three emergency response systems into one. Or Nokia asking you to tariff calls going through a switch in real time.

† This is nuanced. Often a client's procurement department invites a number of candidate vendors to submit proposals including a design proposal/architecture and associated cost estimates. Vendors range from the high end (McKinsey, Bain & Co, Ernst & Young) to the mid-tier (Wipro, Accenture and so on) to the niche.

Thanks for putting that out there. It's super interesting to see what we consider architecture to be. Your approach appears operational, focused on how the completed system functions, i.e. getting a new team member up to speed on the codebase.

Typically I try to start with tiers (1, 2, n-tiers...?) that show how the system might be deployed. I then list list layers (user/facade/business/data), interfaces between these layers, and components within each layer. I do that for each tier.

After that maybe something about quality objectives and how they might be met, eg: availability (MTTF / (MTTF + MTTR) * 100), efficiency, flexibility, integrity, interop, usability and so on.

This leads to a physical delpoyment model, which shows layers deployed to tiers. And yes, I'm rather fond of Visio.

Then a bit about approach (dev/deployment and operational management) risk and stakeholder management, technical reviews (change control board maybe?), and project reviews.

To be fair I come from a predominantly critical systems world (telecoms OSS and BSS, healthcare, transport and some fintech. And in that world architecture is very far removed from actual code until eventually.

Psychologically the enterprise software industry is actively discouraged from creating secure code. The most-heard mantra is to not do it because it’s difficult, making it a pointless exercise. Another is that security testing is too disruptive to production systems. The software industry is good at recommending specific design ciphers and algorithms, and ignoring symmetric and public key protocols (Alice and Bob).

Also, many attacks today target security protocols rather than, for example, cracking passwords.

Another huge impediment to creating secure systems is agile, which discourages up-front design. The average sprint duration of two weeks is too short for meaningful security testing. Testing is not feasible with nightly builds or pre-release sanity checks, either.

Product owners or customer representatives are too often non-technical stakeholders that have the authority to make technical design decisions. While never a good idea, this has bad consequences on architecture and particularly on security.

Defense in depth suggests using controls to protect each individual resource. This includes individual apps, individual servers and individual user devices. A firewall is a single control, but never the only control. This from experience working with... government things.

Please not the latter. There are sooo many apps out there where you wonder if it's a honeypot, has more or less functionality, or is a completely different product. All because the name is similar, and the app icon the same or imperceptibly different.

First, respect for taking the time to teach her. Second, I have difficulty writing this exctly because of the last sentence, will do so anyway -

I taught myself to program in 1984, two years before finishing high school. That and being on the chess team pretty much killed my social life and any chance at carnal activities until I turned 21 (high school was followed by compulsory consription for 2 years). I struggled with that.

Today I note that impressing friends and strangers has become very big business. Influencers. Looked at one this morning on Instagram. This dude had muscles, gave thed impression of owning a Bently, a curvy girlfriend and a house in Majorca. No clue as to how he eant a living or obtained that wealth. Assuming those material posessions are his.

These things are the antithesis of what I went through, even though today I have the means to aquire everything from the Bently to the large-breatsed blonde in a house on the Costa Del Sol.

And yet that prospect fills me with dread because it's vacuous. There's no meaning or value behind it. Same goes for teaching someone something for the purpose of becoming popular or impressing others. Seriously please don't take this as criticism. ANY time spent with kids is time well spent.

I guess where I'm going with all of this is that I hope to teach my 8y/o boy to seek out meaningful, rewarding relationships and experiences that build him up. Without a need for others' approval. And I have vague ideas how I might do that but in a practical sense I'm at a loss and that scares me. And I would LOVE to teach him how to program but so far I've made no progress.

Part of being a dad I guess. Happily I've discovered that if I want a thing enough I find a way. Patience...

I use Office365. Yes it costs money, and yes they provide good support. I also use Outlook so ALL my mail, both sent and received are stored locally and remotely. If my mail bombs I lose max a couple hours' worth of email.

So today, if I want reliable messaging, I use asynchronous, non-blocking functions. Like async/await in .NET. If I want guaranteed delivery I write logic to provide that. Again, using .NET. If in-order delivery is required, again, .NET.

Of course .NET can be replaced by anything that supports async, non-blocking functions.

If instead I used message queuing instead of writing the code myself I'm adding yet another configuration item to my system, replete with security holes, patches, operational management, and sourcing the skills to procure, install and run it. Of course each has idiosyncracies you need to learn and understand - like Rabbit's memory-based queues. When the instance goes, so potentially does reliable messaging.

I'm very much not a fan of message queues. Haven't been for a good many years.

Yeah... not quite. From the article -

"Anger treats its target as someone capable of recognizing that she has done wrong... "

This is true in some cases, but not all. Had a girlfriend once who used anger to get what she wanted. It was like cash to her - a simple means to an end.

When I pushed back it spiraled into abuse. She became ever more hurtful instead of being conciliatory tory. Blew my mind.

I'm firmly in the camp that seeks to eliminate all anger from my life, and avoid it in others. Like the plague.

I will find a copy of the book to see what I can learn from it. Until now I've learnt that one cannot attain happiness as a state. It's fleeting. I stumble across it in moments, and it's gone again. And so I try to be content, which is much more persistent.

Note I said "possible". Your link specifically states "During the transition period the GDPR will continue to apply in the UK".

That said, apparently they've just reached a deal, and the transition period ends in 7 days, so lets see what they decided about with data protection.

This is possible now that Brexit has happened. Whether the UK will need to comply with GDPR or not is dependent on the deal Boris strikes with the EU, if indeed he ever does.