Coaching testers how to email and influence stakeholders

One of the ways Moolya is going to become a great organization is by attracting, hiring and retaining good testers. Sreenuraj Varma who won our heart for this blog post asked us if he could work for Moolya. We got him to test things out and send us test reports.  We found that we liked him to work with us and he liked to work with us. So, we hired him a couple of weeks ago.


Before the project work kicks off, I asked him, what he'd like to develop himself on and he made a list of things that impressed me. I then sat with him to get more specific and identified "writing influentially" as one of the things he wanted to develop. I created an exercise and got him to work on it. I have done this before so I knew what to expect.


I wrote down the goal he had to accomplish:

You are hired as a tester in a team and in your first week you discover that there are many important tests that the team is missing. Your objective is to send a mail to all test team members pointing out the tests they are missing and the impact it has on the project.

To consider:

·         You are new to the team

·         The team has lot of experienced testers and they know about the project more than you

·         You don’t know how they would take your advice

·         If your English is bad some people may not take your advice seriously

·         This email can help you build or break your credibility with the team

So, he worked on it and got back with the following:

Dear All,

For the last week I was going through the application and the important bugs reported on each module. I feel like there is a lack of concentration on the issues related to security, which I feel important because the application is meant to be used by common people and also the modules are designed to be getting in-cooperated with the bank API’s where there is a possibility that we may lead our users to compromise their valuable details.

As we are in the stage of completion of second round of testing I would suggest that it will be good if we can do a quick analysis in the area of security were our application have to be  checked for most common security issues.

Looking forward for your suggestions

-- Sreenuraj


I then reviewed the above email with him stating things that is causing me to not think of it as an influential email and provided specific feedback and asked him to work on it. After a couple of hours, he came back with the following

Dear All,

Last week I was going through the application and was learning the work flow happening in the important modules. I have also gone through the first and second phase test reports we have for the modules. But I think we have not done a security testing for our application. I feel it is important because of the following reasons.

a)      Loss of customer confidence

b)      Can increase the web sites down time (reinstalling services, restoring from backups etc)

c)       Harm to our brand

When I was in module “A” which is the most important one, I found that some basic validations missing for the text fields. No checking was found for validating the special characters. This is found repeated in almost every module I have gone through. Below I am mentioning some of the issues I have came across.

a)      Cross site scripting is possible in almost every module

b)       Data tampering is allowed

c)       The cookies which are used in one session can be used again

As we are in the stage of completion of second round of testing I would suggest that it will be good if we can do a quick analysis in the area of security were our application have to be  checked for most common issues.

Looking forward for your suggestions

Thanks&Regards

Sreenuraj Varma M

Yo, I again sat with him for the next set of feedback about why I still think the email is not influential enough and pointed him to links such as An open letter to the Prime Minister of India by Rajdeep Sardesai.

He read through it, gained some ideas and started to work on the next version of it.

Hi Team,

This is Sreenuraj recently recruited for the position Software tester for the organization. My last week assignment was to learn the project work flow and to refer the available documents which QA holds against each modules of the project like test plans, reports, bug reports etc.

As we are in the completion of second phase I think we have covered almost all the important things in functionality testing. Most of the bugs are fixed and retesting for the same is also done. But some of the bugs reported against the security testing done in important modules are found to be in open state. I have also noted that some of the bugs were raised in the first stage of testing. Because of that I think the number of issues reported against security testing in the second phase have gone down. Also there is no status report available for those bugs from the development side.

Below mentioned are some of the important issues I have came across in the application which was not found in the bug reports may be not reported because of the above said reasons:

a)      The validations for text boxes in the Login screen and the home page for special characters were missing.

b)      User is allowed to insert html scripts into the text fields for the above said pages.

c)       The data which is submitted for the module “A” can be tampered and user is able to alter the data which is transferred .(Bypass the client side validations)

d)      Data tampering was also success in the module “B” where file type can be changed and user is able to include a file with unsupported extension (like exe .. )

Some of the points I would like to suggest are

1.       - Before the completion of phase 2 of testing we should conduct a security testing in the application for the important modules and report the issues found.

2.       - Discussion with the development team in regards with the Issues reported and which are still in open stage, also record the status before second phase of testing ends.

3.      -  It will be good if we can conduct a workshop/training session for both the development & testing team where importance of security related matters in the project can be discussed. Also we can emphasis on client’s expectation in the area of security which is described in the requirement document.

Looking forward for your suggestions

Thanks & Regards

Sreenuraj Varma M

Nah Nah! Not good enough for me. After having coached many testers, I have gained wisdom to understand the point at which I have to step in and do something different than saying, "Not good. I hope you work on these points". So, I decided to send him, my version of the same.

Dear Team,

Greetings!

It is a pleasure to be starting to work with you. In just a week, I was glad to discover that there is great energy you people are bringing in. Its motivating for me to work with you. As I see that a new team member brings in fresh and different value, I'd like to present some kind of value addition I could do.

In this email, I'd like to bring a few points to your notice that might interest you. I am aware that some of the points I am going to bring up here might already be known to you all but I felt it is my responsibility to let you know of what I found.

Security issues for NNNCC Web App (Just an example)

• I found that the directory listing is enabled. As we hold confidential information with us and not all pages are exposed to all users, we might be in a position of risking our customers data.
• I found that there are error messages that can be customized at the URL. For example, I can make an error message saying, "As Pradeep is on leave, we can't service this" to appear from the page by editing the URL.
• I also found that there is a way to bypass the security by storing and using cookies of previous session. When our customers use a public machine to access their data, we are risking the customers data to be known to others who may discover cookies.

Based on the above, I'd like to make a few humble suggestions:

• I understand that the focus is on getting our software functionally right but on the effort of trying to get that, we appear to be sacrificing security.
• I would love your opinions on budgeting for security testing for every release henceforth. As I am a new hire to this project, I would take up the responsibility for testing security for the next couple of releases till I ramp up on other things.
• I would be extremely delighted to meet with you all on this, so am planning to setup a meeting on Friday 24th Feb 3 PM. I have looked into your calendars and have chosen the mutual free time. I am open to suggestions of other date and time.

Thanks and Regards,


-- Pradeep Soundararajan

This time, he came back with the notes he made about this exercise while continuing to work on the skill of writing influential emails. This is going to go to a point where he would learn to practice on his own. He in on the third exercise with me working on test strategy. Our clients are going to be happy to have him on the team. He is showing lots of enthusiasm, hard work and effort. We are happy.

At Moolya, we are going to lay emphasis on how people write and communicate. We might sound stupid but we have realized that people who can write well, get things done quicker and better. In my own consulting experience, I took an email which had not received a favorable response from the management and helped the test team re-write it. We waited for a day and there came a response to it and things got moving.

Add "influential emailing" to your wanna have skills if you are a tester. There's a good example to it in Michael Bolton's blog as well. I am working on a tutorial to help testers write and communicate influentially to stakeholders. Maybe I will take it Star East or Star West. 

Story of how a hang becomes a crash (because testers love reporting crashes)

I am doing my first exploratory testing workshop for 2011 and first from Moolya Software Testing Pvt Ltd. and I am excited about it. You can find the details by clicking on this link . If you are in India and plan to attend it, please do it quickly. I usually don't take a lot of participants although I know I'd gain more money out of more participants. Ever since I announced it yesterday, there are 4 seats that got filled within 5 hours.


Now, I am going to tell you a story that I had been hiding for quite a while. Not intentionally hiding but was planning to blog about it and the time is right now :)


I provide many applications to test in my workshop. At the end of a testing session, I check with the participants if they found any crashes with the application. Not to be surprised, a room full of testers, they do report crashes.


I ask them to reproduce it with me watching what they do and here is a shocking information; most of what they report as crash weren't crashes at all. What you are about to read is also a great example of confirmation bias that I have witnessed.


Here is what they are doing: They are performing an input constraint attack or providing a large set of characters as an input to a field and hits the "Submit" button. They wait for 10 seconds to see what the application does and on seeing the application in not responding state, kill the application and report that as a crash. 


Awesome! Isn't it?


Now, I got conscious of the fact that testers seem to be reporting a hang as a crash and was keen in looking at live projects during my consulting assignments. I get access to the bug tracking system during my consulting (wow) and I see patterns of such reports. 


I go filter out some of the crash reports from the bug tracking system and try to attempt what the tester did to report that type of a crash and bang, that's a hang.


I have made this point to testers who attend my workshop in order to help them be more conscious of what they are seeing versus what they are reporting versus what they are eager to report versus what they should be reporting. 


It seems to me that testers have an anxiety to report crashes. There's nothing wrong in it but it goes horribly wrong when you report a crash by fooling yourselves and the people around you. I recently blogged about the Obsessive Checking if being mentioned disorder that I was suffering from and here is a relevant excerpt from it, "Months later, I started replacing every word by my name till I saw my name on others post. So, I may have read a few posts without actually learning anything from it because all I saw is "Pradeep" & "Tester Tested" on those posts."


Now, why is that relevant to this post? I see that the testers I have witnessed who report hangs as crashes also appear to have a similar problem of obsession towards reporting crashes that they appear to not see a hang but see a crash. I would love if you ask if these testers ever report a hang? Yes, they do. If an application recovers before they kill, that's a hang.


I understand that an application might have hanged because it has crashed but how do you know? Oh yeah, allowing the GUI to fool you and me?


Here is an excerpt ( and tweaked to hide confidential information ) from an issue that I reported on Sep 30, 2010 @ 12: 13 PM IST (thank you Jira) while testing a new OS that is soon to be launched. No, not Chrome OS.


"I opened Media Player application and made an attempt to subscribe to a podcast. 
The application appeared to hang and it also did not allow me to close using the X mark on top right corner.


In an attempt to kill it, I navigated to XXXXX (product name masked) and tried closing it from there. However, the XXXX is open and Media player still seems to be remaining in the hung state.


From that point, I might be forced to reboot the system to get out of it or can escape by waiting for a longer time that I waited for Media Player to recover (>5 mins). No user to my knowledge would wait for more than 5 mins to see the Media Player function. Even a reboot appears to be a faster option" 

Now, if that was the Description, here is the summary :

"Unable to kill a XXXX when the application in it appears to hang or is busy"

• Why I posted the above? Is it because I wanted people to note the usage of the word "appears"?
• Why did I make a few words in it bold? Is it to highlight it?

Long ago, well, not so long ago, I blogged about how teaching testing is helping me test better. The above post and the bug report I posted, is another example of how teaching testers has helped me do it a lil better.


Now if you are going to be sitting at my workshop and be worried if you are going to make mistakes that I am going to highlight, please be informed that you are paying to my workshop to get into the safest environment to fail. No managers watching you. No clients frowning at you. No appraisals being done. Just your own dream of personal excellence aching you for not being there yet but being happy that you know why you are not there. Its a wonderful feeling.


Now, for some marketing again :) You can find the details of my upcoming exploratory testing workshop titled "Accountable & Manageable Exploratory Testing" by clicking on this link 


Happy Republic Day folks!

Overcoming "obsessive checking if being mentioned disorder"

Happy New Year to all my dear readers, followers, fans, bulbs & CFL Lamps. I wish you become a better tester and respect other (good) testers much better than what you did in 2010. I also wish to be what I wished you to be :-)

The support for the company I launched Moolya Software Testing Private Limited - Brainual Software Testing Services Company, from you all has been fantastic. We hope to keep the momentum and continue adding great value to our customers. I have had a real busy time answering lots of questions about the company from testers all over. Without being able to mention the names, we have had two outsourcing request for quote, two special testing requirement requests, one recovery-before-it-goes-down testing requests from top organizations ever since we launched this company. Added to that is the support from the testers all over. Great start for us and we wish to make Moolya a dream company for good testers and hence be the most preferred testing vendor of the world.


Now, what's the Obsessive Checking If Being Mentioned Disorder?

On this new year, I want to tell you some true stories that you have never heard before. I could have simply kept it with me but I want to be honest to you because you spend your time here. Its you who have made this a successful blog and not just me. I don't know if someone else is facing the same problem but I just hope they are not.

• 5 years ago when I entered into blogging, I also picked up the habit of reading blogs. The first time I was mentioned on someone's blog, I felt as though the world was under my feet. I guess its natural for a human being to feel so, for that moment. After a day, I returned to realizing the place I stand is the actual world under my feet. I am no special. Recognized I was a "normal" human being.

• When my name was mentioned again on another blog, I felt great. Some kind of juice flowed all over my body and I loved the way it tickled when it flowed. I was hoping that a lot more people would mention my name and my blog on their blogs so that I could keep experiencing the flow of that magical juice.

• When I was mentioned on James Bach's blog and followed by Michael Bolton's blog, I felt an extra dose of high concentration juice was flowing in me. It didn't just tickle me but had soothing effects on some painful areas of my life. I still feel, it is normal.

• I used to write blog posts and anxiously wait for a couple of days to see if someone mentioned or appreciated my recent post somewhere along with my name. At this point I was on the boundary of "normal". Fortunate for you, my dear readers, I haven't written a single post because it may likely be mentioned by someone but wrote my heart out and hoped it gets popular by other bloggers mentioning it.

• After sometime, I realized that some people had mentioned about me and my blog posts but I didn't come to know when they did it. I added a sitemeter to my blog to track where the hits are coming from. I became way too obsessive with sitemeter. I used to hit the Sitemeter refresh about 200 times a day. At least twice more than the hits I used to get. I was desperate. I worked way too hard to do good work and anxiously wait for an opportunity to blog about it. At this point, I was definitely thrown out from the "normal" category of human beings. I was addicted to the flow of the magical juice. Lucky for my readers, I enjoyed the "being ethical" juice which prevented me from using stupid tactics to attract readership and hence driving the opportunity of being mentioned. 

• Then people started just mentioning my name without the link, so I got a little nervous about it. Not that they didn't link to my blog but because I discovered them too late. So, I set up a Google Alert with my name. Later I found, many people don't get my second name right. Its "Pradeep Soundararajan" and not "Pradeep Soundarajan" as most people appear to write. So, I ended up setting up a Google Alert for all possible permutations of my name. I was obsessed to check reports of Google Alerts. I went crazy about it. Sitemeter and Google Alert made me go crazy. At this point, I assume, I threw myself very far from belonging to the "normal" category. The worst is yet to come.

• After a few months from being thrown far away from "normalcy", I was very excited when other bloggers post new entries. It gave me a hope that they would have mentioned my name. I used to pretend being surprised of being mentioned although I would have hoped for it. I guess its fair to call this phase as "starting to get worse".

• Here comes the beauty. Months later, I started replacing every word by my name till I saw my name on others post. So, I may have read a few posts without actually learning anything from it because all I saw is "Pradeep" & "Tester Tested" on those posts. I think you'd agree one hundred percent, if I call this phase as "Obsessive Checking If Being Mentioned Disorder", which of course is too fucking bad thing to happen. It is important for me to say that all these were subconscious driven stuff. I didn't plan for it, couldn't control it.

• The magical juice that tickled me and made me feel great was also making me uncontrollable to my own mind.

• Added to that is the Twitter era. When I got addicted to twitter, all I had to say was, "Oh no! Not again". I saw a few people showing traces of the symptoms of the disorder or maybe I started feeling so.

Then a small light showed up

At some point, the obsessive checking if being mentioned disorder showed itself up in front of my face when it interfered my learning. That's when I decided to knock it off completely. 

I could start ignoring the urge to do things that may bring back the magical flow of the invisible juice only because I feared if my learning will slip. You may think that I deleted the Sitemeter Account, Unsubscribed from Google Alerts and blah blah but I didn't do any of them. Having it there and not yielding to it is a way I tried coming out of it.

I tried reducing the frequency of me visiting sitemeter stats. Some days I get busy learning, testing or working that I forget to login or forget that I logged in and the tab is lying somewhere. I still do visit Sitemeter and Google Alerts because I don't want to go to the other extreme. Call it post traumatic stuff :)

I reduced the number of blogs and posts I read. I don't go to Google Reader anymore. I just go to the URL of the blog I want to read and avoid clicking blog post links on twitter. 

I have reduced the frequency of writing in forums, groups, LinkedIn,  Test Republic, STC...

Most important of all I said to myself, "Now that you know you are not good, why care if people mention you?" and ignored to going to places where I was mentioned in the past.

Then comes practice over time. I wanted to give myself at least an year of practice. Today, I have reached a stage where I don't care who mentions me or my blog posts, for my own good. That doesn't mean I don't respect them. Moreover, others mentioning me or my post is not in my control. 

Bothering about things that are not in my control is foolishness. Not bothering about things that are in my control is much more foolish.

Sometimes the community elevates me to the "guru" & "expert" status (OK, American, UK & European folks, not you, I am talking about Indians here) and I have learnt to treat myself as a student despite what others call me as. I have declined being interviewed for a testing magazine with the interview title, "Know your testing guru".

Its not been easy but its getting easier. I am in the "normal" ring now, making me eligible to post this. I don't care if people tweet this, don't tweet it or not. It is for my reference. When I look back after a couple of years, I will have some things to smile upon saying, "Look at how I was". Just in case, you can see some symptoms of the same disorder in you, trust me, we will have lots to talk about when we meet.

I am just out of a danger en route to success as a good student of this craft. I hope I can wade away other dangers that might be on the way, much faster.

Once again, a new year is not happy because you call it that way, you make it that way. I am having a happy new year and hope you have it too. I met Chandru today. The smile and confidence he had in his face is inspiring enough for me to push hard for good things.

News - Moolya Software Testing Private Limited launched

I have been patiently waiting to write this post. Many times I wanted to but then I postponed it to this moment and I would tell you why. The news is: Santhosh Tuppad and I have co-founded Moolya Software Testing Private Limited in Bangalore.

What this means to customers, you and the testing community?

That's an important question we'd like to answer. We are going to be offering testing services. Take a look at our logo and that would tell you the first part of the story. Do you know what Moolya means?

We wanted our name to depict what kind of testing we practice and offer our customers. The central theme of our testing is "cost versus value". Moolya is a Hindi word which has two meanings: cost & value. We simply loved it the moment we discovered it. Added to that was domain name availability. It was available and we just jumped on it. 

We crowd sourced the logo design and ITdude (as the designer likes to be called) from Philipines did this excellent logo for us that symbolizes what we wanted to depict as our next theme of testing than cost versus value - using brains - thinking skills & not rote procedures. My uncle who has been a logo designer himself, gave a little touch of his own to the logo to add a vibrant color and choose the font and design our business cards and letter heads.

Then on the services part, we choose to target people who value good testing. Fortunate for us, even before our incorporation, we had a customer wanting our services. Our first project was to test a Cloud Based Operating System. We felt blessed to have that kind of a start for our company. The client was and is happy. They have given us more business.

For those planning to outsource their testing work or seek consulting, the services we offer are

• Offshore testing services
• Exploratory Software Testing Services & Session Based Test Management
• Check (Test) Automation & Test Design Automation
• User Rejectance (Acceptance) Testing & Beta Testing
• Consulting & Training
• Staffing++

So what, everybody provides that? As every company says they are different, we'd like to say, we aren't just like those different folks out there. You should consider visiting the Services page for more details.

For testers  

We hire testers, isn't that good news? ;-) More than that, our interviewing isn't going to be traditional or easy. You don't send us your resume, you send us your test report, a contact number and an email id we could get in touch with you. We would discuss about your test report and get you to test software and put you in different contexts. That's our way of hiring. Even if we scale to thousand testers, maybe, in a couple of years, we will hire that way. Right from freshers to senior people, they should be good at testing. If in case you have a certification, we don't have a problem with that. We don't care about your certification because we care for you. We are working hard at planning and creating a women friendly organization. We are also going to be tapping a lot of hidden talent.

We believe and practice what Fiona Charles said, "Lousy customer service often comes from unhappy employees. Treat people well & they'll pass good will on." 

We will treat you well. You may like going through our Careers page

For the community

We are working on putting our office open to all testers during Sunday. We are going to be stocking lots of good books (The Weinberg, The Kaner, The Bach, The Koomey, The Guaspari, ...), providing you power and internet and you may make the best use of it. You may end up meeting other testers who have come in to read books or practice testing, and can enjoy what you enjoy the most - learning to test & continuing to be better at it. You might find Moolya employees on Sunday chilling out if they need with you folks. Wouldn't it be great if we provide free wi-fi to those who wouldn't download movies but use it to learn testing? Yes, it would be.

We currently have a 25 seater office and as our business expands, we'd like to care for more of you. We just hope to make this company a dream company for good testers. We know we will make it.  

Why we think Moolya Testing is special?

Moolya belongs to a very important time period in testing. It is started by those who started their career as a tester, have remained hands on & shall remain hands on. They may hold the designation as the Director or CEO but they can test good if not great. They have at least played a small role, if not big, to stir the beginning of Renaissance in Indian Testing. They know what customers want, they know what testers want. They are young yet experienced, with lots of energy & passion. Most important of all, they have nothing to loose, so they can be crazy, creative, sound jazzy, cool, and do things that other companies just isn't doing. They are the Microsoft & Apple of 1970's. They are the Google of the 1990's. This would probably be the first Indian services company that would not talk about "head count" but talk about "brain count" of their employees.

Our culture

Just because we are testers, it doesn't mean we haven't educated ourselves on anything else. We have put special emphasis on our culture. We have been working on things that can make a great culture to a company. What is that? We'd get our employees tell you those stories, than we letting all of it.

My wishes to Santhosh Tuppad

I'd also like to mention that by having co-founded Moolya with me, Santhosh Tuppad, must have become the youngest tester entrepreneur. Congratulations to him. You are a bravo.

Going forward, India might see more such. As I said, Moolya Testing is the first of its kind company from India that is aligned with the Indian Testing Renaissance. 

Thanks

A note of thanks to my colleagues Parimala, Sharath Byregowda, Manoj Nair, Dhanasekar S & Mohan Panguluri, Vipul Kocher, Nandan Pujar, Satish Thakur, James Bach & Michael Bolton for the support they have offered so far. Needless to say, without our parents, siblings & family help, we wouldn't have been able to achieve this. 

Follow Moolya Testing

Feel free to join us on Twitter, Facebook & LinkedIn. Peruse through our website. I postponed writing this post multiple times to be able to write this from the office of Moolya Software Testing Private Limited. We are in JP Nagar 2nd Phase, Bangalore. Feel free to contact us. The story of starting Moolya Software Testing Private Limited will be launched as a book in 2011. It's going to be self-published.

"Consider engaging Moolya for your testing needs, we'd like to put smiles on *your* customers face."