Categories
Entrepreneurship Software

How to build a successful app without an in-house development team

In order to build a successful app, you do not necessarily need your own development team. There are numerous app development companies out there that provide outsourcing services for premium rates. However, in order to ensure that you get the most out of the collaboration, it’s important to keep a few things in mind. In this article, we’re going to take a look at how you can outsource your app development needs, and ensure that the entire process is a success.

Your company’s role when outsourcing

Depending on the development company you choose, your role can range from minimal to heavily involved. The decision is ultimately up to you, but if you do choose to be heavily involved you will need an experienced product manager or two in order to be able to steer the project. In Espeo Software we often meet business owners who are willing to learn a project leader role and take over this responsibility. We’re very open to this approach and can easily set up a development model which is suited to such a project management matrix.

However, even if you have no experience at all with software development within your team and you’re not willing to take on this kind of responsibility, you still have an important role to play in your app’s ultimate success.

Download our checklist and learn what are the best questions to ask your potential software provider before you start a cooperation.

To start, you will have to develop the idea behind the app as much as possible, and provide all the relevant documentation to backup your decision making processes. This means taking a look at the market, your competition, your business goals, your marketing strategy post-release, your budget, and even possible future updates and releases. Most of this information can be found in your business plan or business model canvas. It’s also very helpful at this point if you craft a request-for-proposal and share it with prospective developers.

Developing the app idea itself can be a very complex process. In some cases, when you have experience in an industry, you have already identified the pain points of your target customers. In others, you might want to work with a prototype or MVP (minimum viable product) model, in order to test the market, and calibrate the product through iterative improvements.

Outsourcing is also a great learning opportunity and it can help your company develop the framework and methodology for future projects. You can also work with the outsourcing company in order to build your own development team. Some vendors are very keen to cooperate with their clients, and you can position staff members looking to develop project management skills in a way which allows them to overview the development process and gather best practices that you can use within your own company.

Working with a development company that has its own project managers is usually the best option for startups. The project will be handled from start to finish with a high level of professionalism and, as mentioned previously, all you have to do is provide the app idea and its business objectives. The rest will be handled by the dev team, and in some cases the vendor will help you fully flesh out your idea ensuring that the end product will be a perfect market fit.

Time and time again companies have trusted us as a software development provider. Read more about some of our projects and find out why.

In-house vs. Outsourcing: Cost Comparision

How to build a successful app without an in-house development team

When considering whether to develop in-house, or outsource software development, cost plays a big part in the final decision. We’ve already covered the costs of outsourcing in-depth in this article , so we will focus more on the average costs of building an in-house development team.

To start, it’s important to note that app developer positions are notoriously hard to fill. The demand for the skills involved is growing daily. In fact, according to research from Opinion Matters and OutSystems, 63% of survey respondents had anywhere from 11% to 25% of their development team unstaffed. On top of that, research from Deloitte shows that US companies need 52 days on average to fill an open app developer position, with an average cost of $4,000 per hired individual in on-boarding and recruiting costs (creating job postings, running interviews, training, and running background checks).

Now, let’s take a look at the costs and various factors that will come in to play based on the size of your team. The following salary averages have been sourced from Indeed.

Small, startup team (1-4 employees)

Small, startup teams usually consist of a group of friends and acquaintances looking to enter the app development market. These teams may be funded by investors, but in most cases, they are comprised of people willing to invest free time and energy into a project they believe in. The employees involved will have multiple, hybrid roles, where developers will handle design, project management, QA, and other aspects of development. For the most part, this is the lowest cost option, but it is also the riskiest one.

Small, agile team (3-5 employees)

These teams are usually found in mid-size companies that have an in-house development team. They consist of salaried employees, both independent contractors and full-time staff. If you are located in the US or Western Europe you can expect to pay the following in salaries:

  • Developers: $83,937/year
  • Designers: $84,255/year
  • Project managers: $91,681/year
  • Senior developers hired on a part time contract: $47,133/year

Thatbeing said, your in-house development team will run on $307,006/year.

Full development team (5-8 employees)

This is the ideal development team composition for large app releases, where you want to have a very smooth rollout, and you want to be able to routinely release updates for your app. With a team of this size and composition, you can build consumer and enterprise apps, both native and cross-platform. The salaries for developers, designers, project managers, and part time senior developers remain the same, but you will also have to hire:

  • Backend developers: $120,861/year
  • Lead UX designers: $92,331/year
  • Quality assurance engineers on a part time contract: $37,739/year

This type of team will cost you around $557,757/year.

Additional costs

Besides the salaries of your team members, you will also have to pay taxes, and account for healthcare and unemployment insurance. These costs will vary from area to area so it’s important to check with your local government in order to get a full picture of the costs involved.

On top of that, you will also have to take into account a variety of overhead costs. There are hardware requirements such as desktop computers, and mobile devices that will be used for testing. You will also have to foot the bill for a variety of licensed software such as Photoshop, operating systems and others. Finally, your team will need office space, and office supplies.

The costs of outsourcing

As mentioned previously, we have covered this topic in-depth before, but in order to provide a complete picture, we will also try to outline the costs of outsourcing here.

The media cost for developing an app using a third-party developer usually ranges from $10,000-$500,000. However, complex apps developed by certain near-shore companies can cost over $500,000. Many factors will come into play when deciding the cost of an app, including the experience of the agency, their team size, the complexity of the app, the scalability of the backend, and the location of the agency. Some companies will also take into account your client profile. If you are able to provide a project oversight, and you have experience with app development, your costs could be up to 30% lower.

How to build a successful app without an in-house development team

With 14 years on the market, we have gained valuable expertise in various areas. Read more about what we excel at.

Risks

It’s also important to know the risks involved with each option before making a decision. To start, there is a potential risk involved with hiring new tech employees, especially if you do not have tech experience yourself. Junior developers come in all shapes and sizes, and you will need a wide variety of skills and talents from each one of your team members.

The best course of action at this early stage of your team building effort is to bring in someone who has tech experience, and who especially has experience with developing a software product. They will be able to tell which candidates have the right skillset, attitude and experience to ensure that your development efforts have the best chance of success.
Once you’ve hired your team members however, you are still not out of the woods. High turnover is a big risk for tech companies, especially if they are smaller. IT talent is in high demand, and it is not uncommon for companies to come knocking with better offers in an effort to hire one of your team members. If this ends up happening, not only will you have to put the project on hold, or seriously delay it until you find a new team member, you will also have to wait until they are on-boarded as well.

When outsourcing, you also face several risks. However, these risks can be mitigated with proper market research, and by doing thorough background checks on your list of candidates. If you end up making a bad hire, the vendor might:

  • Run out of business.
  • Not deliver a quality product.
  • Run up costs unexpectedly.

Benefits of outsourcing

To sum it all up, let’s take a look at the benefits you can expect when outsourcing your app development process:

  1. You will receive a project estimation based on the scope of your project and you will be able to work with your tech partner in a time and material model where you decide on your priorities.
  2. You will be able to start the development process as soon as the contract is signed.
  3. You will work with a development team that is comprised of members who have a working relationship that spans multiple projects and several years.
  4. You will be able to hold the firm accountable for any delays or mistakes, based on the terms of your contract.
  5. You will have access to a large library of previously developed features and modules that can be added to your app right away, greatly speeding up the development process.
  6. You will work with a team that has extensive experience, and is on top of the latest technological developments.
  7. You will have several options at your disposal when it comes to the service package you choose. You can hire individual team members, you can outsource a part of your project, or you can hire a full team that is supervised by a project manager. You can tailor the service to suit your needs.

See also:

Categories
Entrepreneurship Software

MVP Development for Startups and Mature Enterprises

Developing an app can be a time-consuming, expensive endeavor. As such, it’s important to work with a methodology that will deliver on ROI and business objectives. Many companies however choose the wrong approach. You have numerous startups which have failed because they took an idea, developed it for months, or even years, and never market tested it until launch. The results from taking this approach can range from disappointing to disastrous. To address this, companies have started working with MVPs, or Minimum Viable Products.

How to Develop an MVP

The methodology starts with identifying a problem and then building a bare bones product known as the MVP, in order to test assumptions and customer reactions to it.With each iteration of the MVP, the company gathers actionable data and metrics in order to determine various cause and effect relationships. 

If everything goes as expected, the MVP is developed further by adding new features and functionalities. However, if at a certain point, it becomes clear that the product idea is not viable, the company can pivot at a relatively low cost, and revert to a previous functional step of the development process. For example, if it becomes clear that the current development path will lead to a product that will not be financially viable for the current marketplace, the company can rollback changes easily, or even scrap the project in its entirety. However, the latter option is fairly rare when working with an MVP.

How to Develop an MVP

The process of developing an MVP starts with a planning phase. During this phase, you will want to map out the long-term goals of the product, identify the reasoning behind its development, and the criteria which will indicate whether the product is successful or not.You then need to take a look at your users. This is where you create user personas, identify use cases, and map out the journey each user needs to undertake in order to achieve their end goal with the product. 

Once the conceptual framework is in place, it’s time to start thinking about features. In an MVP, features are ranked according to importance, and the most important features relate to your user map and your end business goals. For example, if you own a chain of coffee shops, and you would like to build an app that reduces the number of time people wait in line for their coffee, you might be looking to implement features that allow customers to pre-order coffee online before they reach the coffee shop.

In this case, you will need several essential features: clients have to be able to pay through the app, they will have to be registered in a database, and they will need to receive a proof-of-payment on their phone, in order to redeem their order when they reach the coffee-shop. At this point, we’ve identified three essential features for your app. In order to build an MVP, we will have to break these features down even further, and perhaps only market test one or two of them, so that we can reduce costs and development time

Let’s say we’ve decided to test the concept: are clients really interested in pre-ordering coffee? The MVP will perhaps allow customers to simply pre-order coffee without paying for it, and the app will log their order into a database. The experiment can be run for a couple of days with a handful of loyal customers, in order to test results. If everything looks good, the mobile payment feature can be added and tested next.

[contact-form-7 id=”13387″ title=”Contact download_8_reasons”]

Features to avoid in an MVP

That said, there are features which are almost universally poorly suited for an MVP. Features that are completely aesthetic in nature, for example, do not have to be added to the MVP, because they provide very little quantifiable value. These features should be added only after the core functionality has been tested. Other features such as social media integration also fall into this category. 

You then have copycat features. Adding features that are similar to more established apps will extend your timeline and budget, but they will not provide new insights into the usefulness of your product. Copycat features have already been tested by the larger, more successful app, and as such, they can be added at a later stage of the product development.

MVP Development for Startups and Mature Enterprises

Finally, you have features which are requested by early users. This may seem a little counter intuitive because one of the main purposes of the MVP is to test the users’ response to a product. However, features requested by early users might not actually be a good fit for your business goals. For example, some users may request social media integration at a very early stage of the product, which would take time and resources to implement, without providing any quantifiable value to the MVP. These requested features should be noted down and kept in mind for later versions of the product.

The Most Common MVP Development Pitfall

The main purpose of the MVP is to provide validated learning. Validated learning is the iterative process which measures the effectiveness of a product in reaching the set business goals. As such, it’s important to keep in mind that any feature added to the MVP has to have a measurable impact across relevant metrics. Some companies will make the mistake of not taking this into account, and they will go on to view the MVP as the most stripped down version of a product, removing essential features in the process. 

To avoid this mistake, always keep the business goal in mind, as this will help you reach a balance between cost-effectiveness, and validated learning. However, balance is the key word here. Some companies will go overboard with the initial features of the MVP, to the tune of the MVP occupying 97% of their backlog which contradicts the whole idea of an MVP. The MVP should have several key features that will be tested, with the rest of the functionality being implemented once the market responds positively to the concept behind your product.

The Benefits of Developing an MVP

So what are the benefits of developing an MVP? The first benefit would be a rapid development process. It usually takes one or two months to have a market ready MVP. You will also need a much smaller budget to develop an MVP since most features will not make it into the product. 

Since the MVP is a lightweight version of a larger final product, the risk for investors is much smaller. With a reduced development timeframe and budget, investors are much more willing to test an idea and see if it is well received by the market. And, once the concept has proven itself within the market, stakeholders and investors will be much more willing to buy in.

Finally, the MVP development process itself builds an audience. At first, the MVP may be used to test market reactions, and see if a product is welcome by users. But once the MVP starts to gain traction, some users will become early adopters, and develop loyalty towards the product. This means that by the time you get to market, not only will your basic assumptions about the user base be validated, you will have a core set of users ready to support the product.

See also:

Categories
Software Technology

App Security: Why is it worth it to implement JWT based authentication in your app?

App speed and security are of huge importance. Our main goal aligned with our customer’s goal is to deliver a satisfactory product as quickly as possible and within budget. There are a number of practices, recommendations and even proposals on how to run projects, but implementation details are extremely important – small changes that allow us to write competitive applications.

When creating a web service one of the most important things is choosing the right authorization method.There are a number of choices: OpenID, SAML, Kerberos and OAuth2 which is the most popular open standard authorization framework. The authorization process for OAuth2 consists of sending the client an authorization request with credentials to issue a random token from the authorization server. This is sent to the resource server to verify if the client is authorized to use the resource and perform specific operations.

The framework is supported by Microsoft (for several APIs and Azure Active Directory service), Facebook (only GraphAPI –
the primary way for apps to read and write to the Facebook social graph) and Google (authorization mechanism for every their APIs). The fact that OAuth2 is used by such important companies in the IT market, vouches for the quality and benefits of this method. In most cases a username and token are required in OAuth2, and additionally it specifies the way in which the tokens are to be sent… and this is where JWT (JSON Web Token)comes forward. JWT is not a protocol or an authorization framework, but it determines the format of the authorization token, which, as it turns out, can have a measurable impact on the functionality of the entire mechanism.

Why is JWT gaining so many supporters

JWT became an open standard in 2015, and in the same year RFC was also created for JSON Web Token Profile for OAuth 2.0 Client Authentication and Authorization Grants, suggesting the possibility of using the OAuth2 protocol with the JWT format for tokens. It gained many fans because of its simplicity and ease to use. As the name suggests, the format of the token is presented in JavaScript Object Notation (JSON). It is a very common data format used for communication between the browser and the server. Thus giving the opportunity for a concise and clear way of transferring information between the two parties in a JSON object.

Further, thanks to the huge amount of parsers available in the programming languages, we can directly convert the received token into an object. It is also worth comparing it to other popular formats such as SAML, SWT or even ordinary string UUID. As for the structure, it is more concise, we do not need to convert a huge token presented in the form of XML as in the case of SAML (obviously the problem concerns front-end site). However, the biggest advantage is the possibility of transferring a large amount of additional information in one token, a so-called claimsy. Support in the form of a huge number of token signing and token verification libraries for virtually any programming language suggests the usability of JWT on a large scale while maintaining an adequate level of security.

What can we pass

A big advantage is the ability to format JWT claims transfer in a token. Claims are statements about an entity (typically, the user) and additional data. Additional token content allows you to limit the number of database queries. Only basic information about the user is collected at the moment of logging in. It should also be noted that the format works well in the context of microservices. It is possible to transfer data between microservices without having to ask for data from a central session microservice. As such if the signature is correct, then the received data is also reliable and we can be trusted.

App Security: Why is it worth it to implement JWT based authentication in your app?

Let’s analyze the content of individual elements of a JWT token, in particular the Payload, which contains our additional information:
Header – informs about the algorithm that was used to generate the token (the standard defines algorithms such as HMAC SHA256 RSA)
Signature – is the digital signature of our token, encrypted in Base64 and calculated from combination of the Header and Payload together with the secret key – in our case the hash function is HMAC-SHA256.
Payload – the content looks familiar to a typical response in JSON format to a specific resource in REST services. Creating claims can be compared to the preparation of a DTO (Data Transfer Object). Set of information to be returned within the token is defined in the server code.

As you can see in the example above – information about the user’s hobby, country of residence, the currency in which he performs his transactions and standard user’s information of the system – id, username and its roles will circulate in the token. It is not a coincidence that I pointed out the types of claims … it is worth stressing that you have to use your own claim names carefully because they may already be registered in iana.org and cause name conflicts. In the example, we’re using two reserved claims – exp (token expiration time) and jti (token id to prevent repetition).

Security

Security is often associated with hiding all data. The JWT standard does not encrypt data, but only converts it to Base64. The creators’ assumption is to be sure that the data being sent to the authorization server is created by a reliable source, thus – preventing unauthorized access. This is why it’s also worth to encrypt the data using SSL protocol to prevent theft of the token. The most important thing is that we are sure about the sender’s identity and that the data received has not been compromised in any way. Verification of the token is quite simple.

App Security: Why is it worth it to implement JWT based authentication in your app?

Servers have secret keys and use them to generate a JWT token. This is of great importance, as because of this they are able to verify its correctness. If the credentials match a JWT token is generated at the request of the client. Thanks to the fact that the application server knows the secret key, it can generate a signature for the JWT token received from the user and compare it with the signature. If everything goes correctly, the user is authenticated and can accesses certain data. Otherwise it may indicate some kind of attack. Thanks to this, access to resources on the server is safer, particularly because authentication with user credentials is a one-time process.

Microservices

It would be a sin not to mention microservices. Especially that JWT is doing so well within this architecture. At this point, it is worth distinguishing between two approaches: writing monolithic applications and those based on microservices that are independent of each other.

Protection for monolithic applications is quite simple. There is an application server that manages user authorization and authentication in advance. In addition, we are sure that all services on which we perform queries are implemented on one and the same server. We do not need to worry about whether each service has authenticated the user separately. It is fully decentralized.
Microservices are different and the main problems are the communication between them and the answer to the question: How can we authenticate the user and be sure that other microservices know about it? As it turns out, JWT ensures that we send information between all microservices about the fact that a given user has access to specific resources.

We use the OAuth2 credential grant (client credential grant) that allows clients to obtain access tokens by providing their client id and secret. As a result, each microservice receives its own client identity and credentials. Then, this data is sent along with the request for token access to the authorization server.

The advantage of this solution is that you can withdraw access to the microservices at any time if we verify the user’s password has been compromised. In addition, the management of scopes, roles, and credentials of microservices are completely controlled. Thanks to JWT claims (more precisely the permissions contained in the token) we know exactly to which resources the user has access, which makes JWT a perfect fit for such architecture.

App Security: Why is it worth it to implement JWT based authentication in your app?

Summary

The JSON Web Token is an increasingly popular format for representing tokens; it is slowly becoming a standard token format and the number of users is growing every day. Thanks to its compact size, lightness and independence, it offers great customization possibilities. The token containing all the information needed for verification without a continuous query of the database is amazingly useful. Of course, we can implement a unique solution based on traditional user’s session but this is unnecessary when such a popular solution is in place. Thanks to JWT, we can easily identify the user between particular sites, and the unique session model could not do it better.

Sources:

Categories
Software Technology

Web Application Testing: Terms of Quality in Web Applications

The development of modern web applications is a complex process that requires the coordination of many different specialists working to achieve a common goal. One might think that all you need is a developer and some code in order to make a webpage work. And one would be correct to some extent, however, there are other aspects that have to be taken into consideration, such as quality, which is possibly the most important example.

“Quality is not an act, it is a habit” Aristole

 How to define quality in terms of web applications? This is a very wide term covering everything from the basics and particularly the importance of testing: functional checks, usability tests, requirements testing or performance testing to more in-depth subjects like accessibility testing, security tests and fully-automated tests.

To examine the subject further let us have a look at the most common test areas.

Types of Web Application tests

Manual tests are the cornerstone of each successful project, each functionality has to be tested –and often for many devices/browsers – whether it meets the specification requirements, each edge case needs to be tested thoroughly to prevent an end user from exploiting any security threats or causing a web page crash. Many of those manual tests can and should be automated in order to reduce the amount of time required for testing. Test automation is a development branch that requires special tools and frameworks where each test is fundamentally a script, so a skilled automation engineer should also follow all good code practices and standards.

Another area are performance tests which can be divided into several subareas and strategies. A very common approach is to just test the application response times, however, more detailed tests check things like: How does an application respond if there is high traffic? How many users can enter the page simultaneously before it crashes?

Does application performance degrade over time which implies some memory leaks? What is the page load time in Hong Kong in comparison to Atlanta? Thorough performance tests can provide answers to those questions and help find potential problems and bottlenecks.

Security tests are meant to find as many potential security issues as possible. They are conducted in order to locate and fix security vulnerabilities which could result in hacking the site, sensitive data being stolen or crashing the servers. They usually consist of the use of various automated tools that check for the most common threats but may also need some manual tests which require the tester to think as a hacker and predict possible issues.

There are some other testing approaches as well, accessibility testing focuses on adjusting the application so it is usable by people with issues like hearing impairment, color blindness, infirmity and old age or other problems; usability testing focuses on testing how easy and intuitive the page is; and regressions tests which constantly ensure that none of the already existing functionalities breaks and that quality does not deteriorate.

Requirements for successful Quality Assurance

As you can see testing web pages consists of many areas that often require a specialist to be able to prepare and conduct a valuable set of tests. In order to test application security one has to be up to date with current threats, be an expert in the area of system architecture and proficient as a developer as well. In order to provide a successful test automation a skilled developer with test experience and devops knowledge is a must.

Finally the testing requires effort from the whole team in order to be successful. This is very often overlooked and people think that simply adding the testers to the team is enough to improve application quality. However what everyone needs to be aware of is that it also slows down the development process due to the fact that it now incorporates testing.

So every new feature has to be manually tested, all defects need to be documented and fixed, also the automated tests need to be recorded and maintained as well as regularly updated to match the latest changes in order to produce benefits. Any additional testing activities will also usually require new testing environments and will further delay the release date. However, there is a huge advantage of doing these kinds of tests and I will discuss this in the next part of this article.

The Benefits of Testing

So what are the actual benefits of testing and should it be done? Well, let me give you an example. Let’s say that you have ordered a brand new car that you expected to be the best in all areas and you have just received it. At first glance everything looks fine but after one day of using it you notice that the top speed and acceleration is actually much worse than with your old car.

Moreover the door only occasionally locks which makes it very prone to theft. There are also a few issues inside the car, the gear box does not work properly, the radio is broken and in order to use the turn-signal you need to press 2 buttons that are located on the backseat of the car because someone thought that this may have been a good idea despite of what the standard is.

In fact this is not an extreme example, because some web pages look more like a car that could never even start its engine, never mind drive and yet there they stand, proud members of the online community. The benefits of testing affects both the team and the business-side. Testers will increase the team’s confidence before release and test automation constantly ensures the developers that their code changes do not introduce new issues.

Testers also make sure that the new functionalities are consistent with requirements and make it much easier to introduce all kinds of bigger changes in the application (technology stack updates or application changes) due to automated tests. From the business perspective the end-product is of higher quality, the risk of introducing a defect into the production environment is much lower, which is the same as the possibility of weak performance or security issues.
 

Summing up

If you don’t have time to do it right, when will you have time to do it over?

Without proper tests development costs rise over time as many features have to be done again or completely changed due to bad design decisions. Moreover software becomes more bug-prone, the usability suffers and the overall quality deteriorates which in some cases may lead to huge exodus of the application users.

To sum up quality assurance is crucial in web application development and it has been present in the industry almost since its beginning and is growing each year, being present in all informed companies development processes.

See also: