Jonathan Lampe's Software
This page covers most of the software projects I've been involved in since I graduated college in 1998.
MOVEit (Managed File Transfer)
I created the MOVEit brand along with Standard Networks' Sales Director Scott Meeker and President Reid MacGuidwin in 2002. Over its life this file transfer software has been deployed at over a thousand companies worldwide and has generated revenues measured in the tens of millions of dollars. All MOVEit software and MOVEit registered trademark is now owned by Ipswitch, Inc.; I continue to serve as Vice President of Product Management for Ipswitch's File Transfer division.
I came up with the main idea behind MOVEit DMZ at a SANS security conference in San Diego, CA in 2001. There was session after session that covered the rapidly developing body of security best practices, but there were almost no applications or operating systems that followed the guidelines well (other than BSD). When I got home I compiled about forty of the best practices and started to play with web-based applications that followed core principles of least privilege, well-filtered and untrusted input and avoidance of information leakage.
Although this started as a project in search of customer, Standard Networks' Tom Pedersen found us a customer in a Wisconsin data center that had just had an unpleasant visit from the FDIC. To satisfy regulatory needs, my original file upload mechanism was jettisoned in favor of Mark Riordan's encrypt-a-buffer-at-a-time Rijndael implementation. Our second data center customer asked us to add an FTP/S interface and our fifth asked us to add an SFTP interface. Our first major health care customer asked us to add a "send message or file" interface on top of the secure file storage (next to the folder/file interface). With those improvements, plus Mark's now FIPS-valided cryptography implementation and several interations of web-based transfer (integrity checks, drag-and-drop, compression, etc.), web-based administration (delegation of authority, maturity of CSS, etc.) and high-availability deployment, the core features of MOVEit DMZ were set.
My favorite part of this project has probably been that it's contained a rich API (really a "POX" interface with COM and Java wrappers) from the very start. In addition to being an essential part of our automated tests from day 1, the ability to extend and connect to the underlying code has allowed MOVEit DMZ to involve itself in hundreds of interesting deployments that would have been off-limits if we only exposed a file-based interface.
My second favorite part of this project is that the core presentation-application-database architecture of XML/XSLT-ASP.NET-MySQL has held up, with periodic refactoring, to some pretty tough requirements over an eight year period.
Although it's the piece that puts "management" into MOVEit managed file transfer, MOVEit Central came a few months after MOVEit DMZ in the original development cycle. MOVEit Central began life as an open-source VB6 application that showed how to use MOVEit DMZ's COM-based API in scheduled workflow driven by a VB6 application. (Yes, VB6 - this was still 2001 after all!) However, our second MOVEit DMZ customer asked for additional transfer mechanisms such as FTP/S and the sample application was closed, discontinued and functionally split into two halves: the C++-based MOVEit Central service and a MOVEit Central Admin GUI client to configure the service remotely.
MOVEit Central continued to evolve over the years, adding SFTP, AS2, and HTTPS interfaces, many features dealing with duplicate files, retries, partial files and other peculiarities of enterprise file transfer, comprehensive audit databases, delegated administration features and its own API wrappers to mirror those already found in MOVEit DMZ.
My favorite part of this project has been MOVEit Central's ability to import and export entire sections of its configuration to permit intrepid programmers (or QA folks like me back in day) to easily make changes or test configurations. The follow-on API largely left this capability intact and added the ability to make these changes either permanently or temporarily to production systems.
Like MOVEit DMZ, MOVEit Central's core distributed communication mechanism has always been heavily based on POX, and MySQL has functioned well as MOVEit Central's default database for years, even at sites that process hundreds of thousands of files a day with this software.
MOVEit Freely is a free, Windows-based FTPS client. This product happened when a key customer asked us to create a scriptable, secure client application that they could distribute to hundreds of their customers. Mark Riordan had a sample FTP client application he created and we dressed it up and tested it for this purpose. In addition to testing, my contribution here was to designate MOVEit Freely as a "seed product" and release it (along with a PDF about the revolutionary new MOVEit system) as freeware to hundreds of thousands of users looking for a free Windows-based FTPS client. In the early days of MOVEit sales, this was wildly successful: although MOVEit Freely only constituted 10% of our sales by count, the sales we made to MOVEit Freely users were about twice the size of sales we made to other prospects.
Other MOVEit Clients
There have been other MOVEit clients developed under my watch over the years, each developed for a specific purpose (and often for a specific large opportunity). These clients are:
- MOVEit Buddy - an inexpensive FTPS GUI client for Windows. This was created for two purposes: to serve the specialized needs of Standard Networks' Unigate and OpenIT (Unisys-based) customers and to provide downward pricing pressure on competitors trying to sell desktop FTPS clients for more than $30 each. When FileZilla and similar free programs arrived, thus largely achieving Standard Networks' goal of making secure clients free, we backed off working on MOVEit Buddy except for special contract projects.
- MOVEit EZ - an inexpensive scheduled client for Windows that moves files between up to 15 designated local folders and MOVEit DMZ. This application was built to allow administrators to extert complete control over remotely scheduled secure file transfers without exposing the overhead or full power of MOVEit Central on individual desktops. This application was allow built so that purchasers could brand it as their own corporate application. (In fact, more copies of MOVEit EZ are probably deployed as "FileMover" or other corporate names than as "MOVEit EZ".)
- MOVEit Upload/Download Wizard - a pair of web-plugins for IE and browsers that could run Java applets. These plug-ins allowed web users to select multiple files or folders to upload and download, drag-and-drop from local file systems and view progress bars during both uploads and downloads. They also incorporated automatic compression, integrity checks and shot right past browser and server limitations of 2GB and 4GB.
- MOVEit Xfer - the HTTPS-based companion to MOVEit Freely that provides secure file transfer using just a single port (443). In fact, except for the lack of FTP-specific commands, MOVEit Xfer's command set was intentionally made nearly identical to both Microsoft's ftp.exe and MOVEit Freely to ensure that the migration bar from FTP-based scripts to MOVEit Xfer-based scripts was as low as possible.
Other Standard Networks Software
SiteSoap (Web Defacement - Never Released)
If MOVEit hadn't taken off, SiteSoap was my backup project in the early 2000's. My idea for this project was "Tripwire for web sites", and in the early era of "web defacement", it looked like this project might have more legs than the high-end FTP server that was MOVEit DMZ.
Generally, SiteSoap worked by checking a remote FTP site, remote web site (SSH was planned but not implemented) or local file system and making sure that MD5 hashes of posted files remained the same. SiteSoap contained a prioritization scheme that allowed key pages (like default.php) to be checked more frequently than other pages, printed comprehensive reports of all changes, and allowed administrators to mass-approve changes after site refreshes. It also contained an "auto-restore" capability that would copy known, good copies of defaced files over damaged files and would delete unauthorized additions on watched sites.
This project made it through three generations: my complete C-based command-line prototype, my intern's C++-based rewrite and a partial MOVEit Central-like client-server implementation. (Yes, somewhere in the codebanks of Standard Networks, there's an application that looks like MOVEit Central Admin but checks websites instead of file transfers.) However, it was delayed by the success of MOVEit and then killed when most hackers figured out that web defacement (and more interesting behavior) was easier to perform using XSS, SQL Server injection, DNS poisoning, etc. than by changing the source files that SiteSoap was designed to protect.
Unigate (PC-based Unisys Front-End Processor)
Unigate was the product that allowed Reid MacGuidwin and Dale Nickels to establish Standard Networks in 1989. This PC-based product appeared to be a specific type of Unisys tape drive to the mainframe system enabled terminal/telnet, PTOP and FTP access from remote poll-select and TCP/IP connected devices.
I performed technical and field support on this product for about my first three years at Standard Networks. Most of my product contributions here were either documentation-related or graphics-related. (I remember creating nifty blue-and-black 3.5" disk labels with "Unigate" and pictures of a Babbage machine on them.)
Unigate sales were already starting to dwindle when I came aboard, Unisys finally having figured out that hooking this new-fangled "TCP/IP" thing up to their mainframes might be a good idea after all. However, it was the gaps in between Unigate support calls in those late years that allowed me to have the free time to create test projects like MOVEit, SiteSoap and a couple of other nifty things that never saw the light of day (and will not be covered here).
OpenIT (Another PC-based Unisys Front-End Processor)
Think of OpenIT as a combination of DOS32-based Unigate and Windows NT. It was still a work in progress when I arrived at Standard Networks, but the major components of this system were already in place thanks to partnership with PNC in Chicago, IL.
As with Unigate, I performed technical and field support on this product for about my first three years at Standard Networks. I believe I wrote most of the documentation for this product and, under the wing of Tom Pederson, performed much of the grunt-work QA, some of it in the field thousands of miles from home. (The PNC folks, like many middleware vendors of yore, had a reputation for putting code compiled on their laptops right into production those days.) I also developed my first installation CDs in support of this product and developed my first web-based support portal for the same purpose.
HEAT, ActiveHEAT, InstantHEAT (Web-Based Mainframe Screen Scraping)
Mark Riordan's first major product for Standard Networks was the Host Enabling Authoring Tool, or "HEAT" for short, introduced in 1996. The idea of exposing mainframe data to the new-fangled web everyone was playing with was on a lot of people's minds in the mid-1990's, including mine as I slogged through ISPF screens on parallel IBM mainframe systems at Kemper Insurance. When I saw what Standard Networks had as I left college in 1998, I thought that HEAT was a killer product: right idea at the right time.
Architecturally, HEAT arrived at a interesting time: just after Microsoft's VB seemed to have won the battle for "application programmer" hearts and minds and just before IIS's ASP environment collected most Windows-based application programmers.
HEAT was made of two components: a core server and an authoring tool. The core service used TCP/IP terminal emulation to connect to mainframes and interact with them using predefined maps and scripts. It also exposed a web interface through Microsoft IIS that end users could interact with. In this way you could, for example, take a mainframe banking application and put it on the web using HEAT. (This is exactly what many banks did in those Wild-West days.) The authoring tool used a custom mapping definition but included a nifty WYSIWYG "authoring" tool to capture each mainframe in a library or use right-click functions to build more custom field handling. All code was written in VB, extended with custom HEAT extensions to fill in specific forms or perform other terminal emulation-specific functions. (The "extend VB" design Mark used in HEAT was similar to the same one he would use in the "extend VB" functions in the core MOVEit Central service seven years later.)
As with OpenIT I ended up writing much sample documentation and performing much of the QA around this product. I also deployed HEAT-based applications in a dozen or more sites as part of custom coding projects. However, as passionate as I was for this product to succeed, HEAT also provided me with my first taste of product management: trying to identify where the product was missing the market and adapting it to correct the differences.
My two main attempts to close the gaps were encapsulated in "InstantHEAT" and "ActiveHEAT". InstantHEAT was a simple-to-install, "no programming required" deployment of HEAT that turned a web browser into a page-by-page terminal emulator. (Additional coding could be used to customize the web-based terminal emulator; this project led to HEAT and later MOVEit's adoption by a large local bank.) ActiveHEAT was a reaction to the "ASP w/ COM object" push by Microsoft in the late 1990's; it refactored the core HEAT service as a COM/ActiveX object. (Almost all late HEAT deployments were really ActiveHEAT deployments.)
EMU (Terminal Emulator)
EMU began as a near-dare from Reid MacGuidwin during a rainy conversation at a far-flung airport. The dare was to tear the authoring environment off of HEAT and turn it into a free-standing terminal emulator. This dare I accepted, and over six painful weeks I took the powerful super-emulator authoring environment Mark Riordan created and turned it into a less-powerful terminal emulator with recordable macros, pretty buttons and a different help file. (Then Mark spend another few weeks cleaning up my your-undergrad-was-in-assembler-and-it-shows C++ code.)
Though it was never a major component of Standard Networks' revenue, EMU was nonetheless an unqualified hit in terms of profitability, and, like MOVEit Freely, extended Standard Networks' mindshare to some heretofore untouched customers (such as Wells Fargo).
Other Ipswitch Products
WS_FTP Professional was created by John Junod way back when I was still trying to build my first Linux box on a brand new DX66. By the time this product came under my wing in 2008, it had accumulated all the incremental debris and issues one might expect in a typical teenager. With the help of Standard Networks veteran Dale Nickels and new Ipswitch hire Mark Grandau, the codebase was refactored for Windows 7, features and interfaces were streamlined, and modern iconography was applied. (Compare versions 2007 and 12.2-3 to see the difference.) The resulting product helped avert falling client sales - perhaps even allowing Ipswitch to pick up share in the shrinking market for Windows desktop FTP clients. Future projects to further increase mind and market share with the WS_FTP client are now in the works.
I can take little credit for specific WS_FTP Server enhancements or changes though it's been under my wing for two years now. The recent Web Transfer Module and Ad Hoc Transfer Module additions were the result of previous efforts by Ipswitch's Kevin Gillis. So far, my most significant contributions to WS_FTP Server have been around security. Although I can't tell you what these changes have been, I can tell you that my chief collaborators in that area have been Ben Henderson (formerly of Ipswitch), Ipswitch's Regina Burton and fellow Standard Networks alum Steve Staden. However there is more in the works for WS_FTP Server than what I can talk about here, including initiatives to pull it closer to Ipswitch File Transfer's strategic direction.
Side Projects and Utilities
Standard Networks Corporate Web Sites 1998-2002
In my tenure with Standard Networks, I built the main corporate web site and/or the support portal application about three or four times. In keeping with late-1990's design principals, these web sites were typically optimized so folks with 800x600 monitors could see them well and all formatting was performed with tables. I made sparse use of animated GIFs to catch the eye and experimented with Java-based text scrollers to bring recent events to the fore. My annual web site rewrite practice was finally concluded when Standard Networks contracted its marketing site out to local Madison, WI firm in 2002 to shortly after the launch of the MOVEit brand.
My one regret here was not fighting hard enough for SEO in the early 2000's; we had been experimenting with search engines and their ability to parse plain sites better than table/graphic-heavy sites, but we didn't carry that knowledge into our outsourced rewrite and thus likely lost many sales until we tightened things up later in the decade.
Standard Networks Bugtracker
In the late 1990's there was an infamous incident where I accidentally walked on top of the existing OpenIT bug database, which was then stored in Access. To prevent a similar problem as the MOVEit and SiteSoap products ramped up I created a new web-based bugtracking system that was based on the same XML/XSL-ASP.NET-MySQL architecture that MOVEit DMZ used. In fact, the architecture was SO similar that I often used my internal bugtracking system to test new DB objects and ASP.NET concepts with live users (other developers) before the same code was introduced into MOVEit DMZ.
As a product manager, I tailored this system to show me which items were and were not in a release project, tied it into our related support system so I could see exactly which 10 customers wanted a particular feature and why, and bolted on parallel workflow tracking for documentation development for each item so they never fell through the cracks at release time. As of 2010, this system is still in use and currently tracks about 10,000 bug reports, feature requests and related "to-dos" for a geographically distributed team.
Personal, Organization or Small Business Web Sites
In my free time, I create a about one personal, organizational or small business web site each year. My favorite sites are those I have created for local municipal or school board candidates (www.melissalampe.com and www.vote4tbird.com - both won) and a memorial and fundraising site for the Stoughton tornado disaster (www.stoughtontornado.org). All these sites are simple, SEO-friendly and serve their intended purpose well.
From 1998 through 2002 I also ran an interactive web site called "www.woodstockalumni.org" which allowed several hundred Woodstock High School alumni to connect, share messages and subscribe to each other as a friend or not. As with Bugtracker, in the very early days there were some common code elements with MOVEit DMZ, and some concurrency trials were performed on this site before the same code was implemented in the earliest versions of MOVEit DMZ.
SNIMTA was used with the MTA facility of the Mail Enable email server to perform keyword matching on email messages and to delete or flag spam. This was Standard Networks first spam filter; I originally wrote this for the Windows-based Mail Enable server we deployed for several years. I sold about a hundred copies of this software for $25/each over the years; today this software is free.
AgentSay is a command-line application that makes any installed Microsoft Agent character say a phrase. It was principally used to annoy or amuse coworkers within earshot during business hours. This software is free.
MyQCache is a free command-line application that replays a MySQL database query log and gathers information about MySQL cache usage and execution time. I originally wrote this utility to optimize MOVEit and other database-based web application performance on MySQL databases.
MultiThreadWebSimulator is, as the name suggests, a multi-threaded web simulator. It is a free command-line, Windows-based application that I wrote at home in 2006 and then brought in to work to help load-test MOVEit DMZ.