Land of Zoho Creator

Note: This is the last in a series of three interviews with senior members of the Zoho Creator software engineering team. Previous interviews with Suganya and Sriram, conducted this past August, are also available.

It took some time before Charles could fully respond to our interview questions but I think you’ll agree it was worth the wait.

For those paying attention there have been a couple upgrades and some hasty bug fixing over the past months. It was therefore timely (but perhaps also a little annoying) that several of the questions we asked Charles essentially revolve around the growing complexity of ZC’s code base. Below he responds to all the probes in depth, discussing his team’s current approach to developing an increasingly intricate site, how their interaction with users is evolving, and what’s in store down the road.

Read on to learn much more from Charles’, including some info on an upcoming defensive strategy for dealing with XSS security issues…

LoZC: In my estimation Zoho Creator has come a long way since it was released near the middle of 2006. Can you tell us a little about how you came to be its Chief Engineer and what your favorite features of the platform are today?

On a related note, about how many people are working on ZC now and in general terms how is your team organized to handle the design, new development, bug fixes, and support? As I see you are a Chief Engineer who also seems to provide frequent support via the forum and blog comments, do a lot of people on your team end up wearing several hats?

Charles: Zoho Creator was primarily started with a focus on catering our internal needs. Initially it was not a full fledged service. It was merely a form builder. When we decided to put the service live, we wanted to get as many early feedback as possible from real users. And I can tell, we have had a long journey from implementing so many features that you see today, apart from unnoticed ones like single sign on, Zoho Creator grid, and performance improvements.

As far as the roles that we play, yes you are correct. We do wear several hats. Supporting customers comes as the first priority before development and it is very important for the team to understand users’ requirement and develop accordingly. All our developers actively participate in the forums and also provide email support.

We learn a lot from our users. We first understand and appreciate what the users require. Apart from users’ requirement, we have to take care of usability and be innovative in its class. We then validate the requirements if it is in line with the vision of Zoho Creator. Such requirements will eventually be included in the plan immediately or postponed for a future update. A lot of feature requests also come from the internal users of AdventNet.

LoZC: I am so used to using Zoho Creator 2.0 now that I can barely remember what 1.0 was like. What compelled Zoho to perform this major front-end upgrade and what do you perceive to be the main differences and progressions when you look at 1.0 vs. 2.0? Is your team already envisioning a 3.0?

Charles: Zoho Creator 1.0 or the early version of Zoho Creator was good but not at the best in terms of productivity and usability. It was simply packed with so many features without paying much attention to usability. While no one complained, we still thought it could be done in a better way. We wanted to enhance the usage of Zoho Creator and decrease the time taken to build an application. Main theme of Zoho Creator 2.0 was “Build your application in minutes”. We wanted to make sure that each and every feature was well reachable and organized in a better way. Apart from these, we concentrated on Usability, Scalability and Speed. Users were really happy and we got a lot of positive feedback.

Next, we are indeed thinking/working on Zoho Creator 3.0. Stay tuned.

LoZC: A few months after ZC was released you personally collaborated with user Craig Cmehil in creating a roadmap for ZC features where Cmehil said he’d like to “see some dates, some thoughts…Where’s the Beef?“.

Now that we’re in the middle of 2007 and ZC development has arguably advanced beyond an ability to pay attention to user-driven road map requests, how has your team evolved its approach to user collaboration and what do you think works best in terms of keeping hundreds of eager application developers happy with what ZC offers? Even though ZC is not an open source project per se, it is a development platform for users so I’m wondering if your team has ever considered following the practice of more traditional development projects by publishing an official roadmap or a list of outstanding bugs?

Charles: Craig is one of our passionate users from the beginning. He volunteered to list the features requirements then. As of today, we have completed most of the features in the list and I can fairly say that we have done even more than that. Internally we do maintain a list of bugs and features. We have our own project plan. During the course of the plan, sometimes we drop a few, include a few and there will also be slips on target dates.

Today we have that little freedom of what we can do with the list of features. It may be necessary since we are in the early days. Give us few more months. First we want to cover some of the “must to do features” that are pending in Zoho Creator. We will then publish such a document in public. At this stage of development, we really cannot predict which feature will come first and which will come next. May be in short terms, it is possible to tell that. You can find them specifically in the forums. As I mentioned earlier, we take users’ requirement very seriously and if there is a real demand for a particular feature, then the chance of getting it inside is very high.

LoZC: Let’s talk about the increasing sophistication of Zoho Creator’s front-end for a moment, and the increasing complexity of the code base that I assume must accompany it. Recent projects like the wmii window manager eschew code complexity as the “mother of bloated, hard to use, and totally inconsistent software” and articles like Cynthia Rettig’s recent publication in MIT Sloan Management Review argue that software complexity creates an environment where developers “cannot test or even anticipate every possible usage path”.

So do you think ZC’s existence as a web-based application insulates it from these sorts of indictments or do you think there’s a limit to how much feature addition and user-requested customization ZC will be able to accommodate? Do you ever worry that your team’s development and test processes might eventually be outstripped by a front-end that seems to steadily add more features and capabilities month after month?

Charles: Today the amount of code that we have written is definitely huge. We do have our own internal practices for development. Being in the product business for more than 10 years has made us strong in that arena. I must also say that what might work for one team may not work for another team. However we have a very good process of maintaining a well structured code base. So that helps us in the development.

If you were to ask me, whether we think of each and every possible use cases before implementing a feature, the answer is no. Initially we may leave out some of the use cases. That will be done intentionally to make sure that we release the feature early and get those precious early feedback from users. They help in shaping the service and taking it to the next level.

If we were to think and implement of all possible use cases, we would never release the feature and most of the features that you see in Creator might not have been there. But there are some exceptions also. For example, when we did Zoho Creator 2.0, almost 99% of the Edit mode feature was done only by internal discussions. There were so many brain storming sessions. How much of the use cases in a feature will go inside will vary vastly from feature to feature.

LoZC: “Will there ever be a point where your team must say “No” to new front-end features for ZC?”

Charles: We cannot predict it. Definitely we never want our service to be bloated. But at the same time, we would like to add as many features as possible. When we add a feature, we make sure that it is intuitive enough to be reached by a new user and, it is not intrusive to an existing user. But if we were to choose between the two, we would give more weightage to existing users. Sometimes there could be some features that are heavy for Zoho Creator. For such features, we may decide to expose it subtly and suppress the majority of the configuration for a novice user. If we feel it is really too heavy, it could even be started as a separate service. And at a later stage, we would go for a tighter integration, as and when required.

LoZC: The forum and individual blogs both seem to be great places for users to post their questions and problems regarding Zoho Creator, someone on your team often replies the same day or even hours after a request or bug is posted. Can you describe your team’s approach to addressing bugs and prioritizing feature requests from users and explain how you are able and why you choose to deploy fixes and feature additions so quickly?

Charles: We love to assist our users. Be it in the forums or through email support, AdventNet’s policy is to give the best support even for free users. We really learn a lot from our users it helps us to shape the service better. With such interaction, it will be easy for us to understand and implement features. Whenever users come up with bugs, we understand the pain users undergo and the amount of time spent by them. We are indeed grateful to all such users who turn up and report bugs. Ideally we would like to keep the service bug free which we are striving hard to achieve.

LoZC: I personally don’t use a mobile device for web access at this time but understand one of your areas of focus is Zoho Creator’s support for mobile access. What kinds of challenges were involved in making Zoho Creator available on mobile devices, what particular advantages does Zoho see in particular for accessing a ZC application away from the desktop, and do you have any indication of what percentage of Zoho Creator access current occurs via a mobile browser as opposed to desktop? Has the recent presence of the iPhone in the marketplace lead to users accessing ZC applications via that device?

Charles: There is a huge potential for accessing Zoho Creator forms and views on mobile devices. Imagine you can track your personal health records or track your travel details from your mobile. You need to simply login to Zoho Creator from your mobile and fill your form and view the records as you travel. Your data is automatically stored in Creator DB and you can view the reports later in a PC or in the mobile itself. Basically it is the convenience. We want to project Mobile as another medium to access your forms and views on the move. It is almost due for the release.

LoZC: There have been a few mentions in the forum and even in a previous LoZC interview of a soon-to-be released feature where users will be able to better customize the layout of the forms they design. Can you tell us a bit more about what kinds and levels of control are planned and discuss some of the inherent trade offs between application stability/usability and application user-customizability?

As users are given more power and control over how their application is laid out, aren’t they by definition given more opportunity to introduce bugs, cripple certain browser configurations, or even effectively break their own applications by making poor or ill-informed UI decisions? On a related note, as users are given more power to configure their ZC creations in any number of ways, do you think there might be a need for the publication of “Zoho Creator Best Practices” in the near future?

Charles: As long as defaults are set properly, which we give a detailed attention to, users need not worry much about configurations. For example, we are planning to bring templates for applications. A novice user will be provided with options to choose in his capacity and will get what he wants. It will never be intimidating. And there will also be options for a power user to dirty his hands deep down in CSS and layout. Ultimately the power user will also get what he wants. We are confident of satisfying both the users.

LoZC: A couple months ago pdp at GnuCitizen pointed out some XSS vulnerabilities in Zoho Creator, which your team quickly addressed through some experimental site changes that eventually resulted in the ability for ZC users to set the XSS security level of any application to either High or Low. Do you think the Low setting still presents a security risk for users of ZC applications and, keeping in mind your expertise in the export formats, do you think the combination of relaxed XSS settings and JSON-encoded exports holds the potential for future security exploits?

Charles: In future, web applications will have to be prepared for even more XSS exploits. We have fixed most of the exploits in all Zoho services. As far as Zoho Creator is concerned, it is best to leave XSS setting to the default which is high. Usually it is for a personal user or an advanced user who will like to have the setting as low and make use of the html formatting. For example we saw how Douglas Lockwood had done. But to make sure that it does not affect a visiting/shared user, we are planning to ask the visiting users if we can load applications that are with XSS setting as low.

LoZC: In the public applications I haven’t seen many examples of people using the charts functionality recently introduced into Zoho Creator. Was this a feature in high demand from a certain user or certain group of users, or did you just decide it was a logical addition to the platform? Perhaps it is used more in private applications? Are there any plans to enrich this feature to give it some unique capabilities, say beyond what people expect from Excel, or plans for more chart types/customizations?

Charles: I agree it is still a kind of hidden feature. But this is just the beginning and we will soon start integrating with Zoho DB, the newest service from Zoho which specializes in extensive reporting capability. The current chart feature will complement Zoho DB integration.

LoZC: This last question is a two-parter. Raffic hinted to me in an email that I could ask you what’s next for Zoho Creator, so tell us, tell us!! Will ZC 3.0 perhaps feature an immersive environment like Second Life? Also in a recent post on the Zoho Blog, Raffic alluded to the fact that you have a hard time staying at your desk for very long. You’re a software engineer, right? What’s up with that?

Charles: We have the API and the mobile launch coming soon. Internationalization, Layout customization, SSL support, backup of application with data will follow them.

Regarding my timings, yes, I don’t follow a definite pattern. May be things could change once I get married