Hopefully Intuit Won't Shelve Mint.com

Intuit, the makers of Quicken, announced they are buying web 2.0 darling Mint.com. I wrote about my concerns for Mint.com last year, and apparently Mint.com did a good job answering those. Congrats to Mint!

My concern now is that Intuit bought them just to shelve the Mint technology and eliminate a promising competitor. I use Quicken for all my finances, and love it for what it does: give me immediate insight into total net worth, track spending by category, and manage my rental properties. Nothing else out there can do that.

But there are some things about Quicken that just plain suck. They are infamous for regularly launching buggy software. For example, I'm running the latest release of Quicken Rental Property Manager on 64 bit Vista Home Premium, and the software never remembers my preferences. And it says I have 3 reminders, with a "View Reminders" button that, when clicked, brings me to a calendar view with no reminders on it.

I just tried to use Intuit's live chat for tech support for assistance with the above, and after forcing me to pick a support category even though my problem didn't fit any of them, it launched an IE window (even though Firefox is my default browser) that did not connect to anything. Support for Quicken is typically done through its user forums, which can be hit or miss.

So although it is the best thing out there for my specific needs, it is still an unsatisfying user experience, and I'd love for something better to come along. Apparently that won't be Mint.com. Hopefully Intuit will incorporate the best of Mint's quality technology into their own, instead of smugly shelving it.

How to Survive Authorize.Net Outages

I was inspired to write this by the recent heavily reported Authorize.net outage. Credit card processing is one aspect of web site development that you have no choice but to out-source (unless you happen to be a bank). There are several out there, and Authorize.net is one of the biggest. No matter how robust the system is, there are bound to be periodic problems. Over nine years of business, and multiple processors, we saw many of them. Some outages were over in minutes, some lasted hours. Your customers, ready to make a purchase, don't want to hear that your credit card processor is having problems. It is possible to code your website to stay in business during an outage.

At RegionalHelpWanted.com (RHW), we were doing tens of thousands of dollars a day in credit card sales of help wanted advertising, none of which we wanted to lose during an outage by the processor. In the US, our credit card processor was Authorize.net. In Canada, it was Verisign. (We used separate services because we ran the businesses as separate companies.)

On Cupid.com, the problem was similar: we were selling online dating subscriptions; I think our processor was iPay.

In both cases, we were selling electronic services, but the method we used to survive a payment gateway outage with minimum business interruption is applicable to online businesses that are shipping tangible goods.

On your website, your customer should not receive any kind of error message saying that there is a problem with the payment system. The customer does not care about your problems, even if you are not to blame.

When Authorize.net is down, typically your web application will time out when trying to connect to them to make a sale. In a minority of cases, the connection will not time out but will give an invalid response, one that does not fit the normal specification. I don't remember any cases where a processor outage occurred and the processor sent back a valid response with a valid error code like "We're down! Try agin later!" In all of these cases, your web application should behave the same way:

- Capture the order information, and store it for later processing.
- Give the customer a success message
- Use an asynchronous process to retry these transaction until they are completed.

Capture the order information
On RHW, we let users opt-in to storing their credit card information to speed future orders, so we had already done the work necessary to do this safely and securely. On Cupid.com, the whole business was built on reoccurring billing, so same deal there. Your Terms of Use must allow you to always retain order information for enough time to process that order, even if the user does not opt in to longer information retention. While your at it, log any response that you did get from the payment gateway, scrubbed of any security sensitive info like credit card number, as it might help with forensics later.

Give the customer a success message
Error messages are the opposite of user friendly. Tell the customer that you have the order information, that it typically only takes a moment to process and that they will receive an email its done. And then let them be on their way.

On Cupid.com, we'd let the user start using the site with all the privileges of a paying member. If they sent any messages to other members, those messages would be queued until their order was successful.

On RHW, we would post the help wanted advertising. If it later turned out that the credit card was rejected, the ad would be removed. But this also could have been setup so that the ad was not posted until the credit card was accepted.

Process the transactions asynchronously
Queuing is a great way to handle any work that the user should not have to wait around for. You could use it just when there is a connection timeout or for every single transaction.

Cupid.com was a .net application, so it made sense to use Microsoft Message Queqing (MSMQ) for this functionality. The web application writes a message containing the order ID. A queue runner reads the queue, using the order ID to select the order and payment info from the database. It attempts to process the order. If Auth.net times out or returns an unexpected response, the message is sent to back of the queue. It is trivial to build a time delay into the queue runner, otherwise you may find yourself making hundreds of attempts per minute for the same transaction. And it's not nice to kick your credit card processor THAT often when they are down.

RHW was a ColdFusion application, and now it is very easy to do queuing in ColdFusuion too. Our need pre-existed this functionality, so we used MSMQ. We wrote the queue runner in VisualBasic, and the connection to Authorize.net was done as a CF web service.

Once the payment is either accepted or rejected, do make sure you follow up with the customer. On RHW, if a card was declined after waiting in the queue because of a gateway outage, we would call the customer and try to receive alternate payment before we removed their posting.

The queue runner needs to also delete the payment info unless the customer authorized retaining it.

That's it. Once we had that coding in place, Authorize.net outages (or Verisign or iPay) were non-events to the development team. There was some alerting built in so that we'd know if the queue was building up, otherwise we might not even know that Auth.net was down. That is, until the accounting department came over and complained that they couldn't log into the payment gateway.

Dell still doesn't grok Ubuntu

I'm selecting a laptop for my kids. Mostly because they keep pestering my wife for her laptop. I'd love to get them Ubuntu because I'd love to teach them computer programming, and I like Ubuntu as an environment for that. I also like if for kids as it is less succeptible to spyware, viruses, and malware in general. My kids play Wizard 101 online, and according to one user, that works well under Wine.

So I'm configuring a laptop on Dell, going through their twenty page configuration process. On page one I specify Ubuntu. Eight or so pages later, Dell is asking me if I want Norton Internet Security 2009, Computer Associates Internet Security Plus 2009, and QuickBooks Pro 2009. Hello, none of them run on Ubuntu as installed. I'd love it if Intuit offered Linux software, especially Quicken which I use religously. So unless Dell is going to be including Wine configurations for each of these Windows applications they are selling with Ubuntu, they really are doing a disservice to their customer. An uniformed purchaser is going to assume the apps run on the computer they are purchasing, right out of the box. After purchase, do you think Dell is going to let the customer "return" this software?

Audible.com Web Site is Lousy (To Be Polite)

My wife was surprised this week when I told her Audible.com has been charging her $14.95 every month for almost a year. She checked into it and realized she had signed up for a monthly subscription without even know it. That's a problem right there. Before closing the account, she wanted to redeem six book credits her account had accumulated. We decided to divide them evenly.

When it was my turn to select books, I was expecting an experience similar to Amazon.com. First of all, the Audible.com web site is very slow. Not snappy like Amazon.com, or any other website I use by choice for that matter. Seconds lagged each time I clicked a link.

Secondly, the category navigation is not very intuitive.

Thirdly, it looks like the site is quite different depending on if you are signed in or not. The site is more appealing when they are trying to lure you into registration, and frankly it's faster too. Tolerably fast. Audible.com offers fewer categories, perhaps to remove clutter and reduce load times.

Once you log in, its the slow site. Clicking on "Science Fiction & Fantasy" now and you can feel the delay before the page loads. You get to a page that displays, among other sub-categories for fantasy etc:

# Sci-Fi: Classic (217)
# Sci-Fi: Contemporary (555)

That is not a great number of titles. It gets more frustrating after clicking around twenty pages or so, the amount it took me to figure out "Contemporary" means anything since 1980. There is no way to browse with multiple filters, for example all "contemporary" sci-fi that was also on the New York Times best sellers list. The closest thing Audible.com offers is all 555 titles, sorted by how often they are sold on Audible.com.

I clicked on that link, got frustrated at how long the page was taking to load and was able to type "I'm composing this" before the page loaded.

Suffice it to say, Audible.com: now that Amazon.com has entered the audio book market place, you web site needs a huge overhaul to be competitive:

1) Speed. The competition is a click away.
2) Breadth of content: I understand sci-fi may be your weak area, but if you don't have what I want for all my audio book needs, I'll go elsewhere.
3) Navigation. Browsing a book store is easy and pleasurable. You're website needs to be even easier. Let me go to sci-fi, and then narrow down to New York Times best sellers. Then let me sort by newest first. By letting me narrow in, and showing me what path I am on, you would let me feel like I am getting closer to the perfect purchase. Otherwise I'm lost in the woods, and leave.

No ESAPI in Python yet?

I'm considering Python for my next big project. I've been doing ColdFusion for the last 10 years but am liking the karma from open source. So I've been digging into the Python documentation, finished reviewing the Python Standard Library and the Django tutorials.

Next, I wanted to look at some reference implementations in Python as a way of further familiarizing myself with coding best practices. I had stumbled across an implementation of OAuth in Python last week but wasn't ready yet. Specifically, I wanted to look an a reference implementation of ESAPI, the Enterprise Security API from the brilliant folks at OWASP.

Surprisingly, all OWASP offered was the referece implementation in Java, plus some "under construction" pages for .Net and ColdFusion. Elsewhere on the web I found an implementation in pHp, but nothing in Python.

So I know the whole idea of open source depends on the community effort, but I'm not thinking ESAPI can be my first Python app. I'll work on gaining l33t Python skills, but in the mean time it'd be great to see ESAPI in Python. Django community, I nominate you guys!