In this episode, I interview Sven Schleier and  Jeroen Willemsen about how to drive improvement to your mobile app security, the OWASP Mobile Application Security Verification Standard (MASVS).=============Bio===============Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security. With a love for mobile security, he enjoys sharing knowledge on various security topics.LinkedIn https://www.linkedin.com/in/jeroen-willemsen/OWASP's Slack: https://owasp.org/slack/inviteSven Schleier is specialized in Application Security and has supported and guided software development projects for Mobile and Web Applications during the whole SDLC. Besides his day job, he is one of the core project leaders and authors of the OWASP Mobile Security Testing Guide and OWASP Mobile Application Security Verification Standard. Sven is giving talks and workshops about Mobile Security worldwide to different audiences, ranging from developers to penetration testers and students.Linkedin: https://www.linkedin.com/in/sven-schleier/ Twitter: https://twitter.com/bsd_daemon OWASP's Slack: https://owasp.org/slack/invite=============Links==============OWASP MASVS: https://github.com/OWASP/owasp-masvs

In this episode, I interview Jeremy Paul about UI design for mobile apps. We talked about the difference between UX design and UI design, atomic design and whether you'll want a visual designer who specializes in mobile apps or not.=============Bio===============Jeremy's job consists of fighting chaos so humans can enjoy using the products he designs. To achieve this, he carefully crafts mobile & web user interfaces with simplicity and consistency in mind, using atomic design — a component-based method. Specialized in mobile app design since 2011, he also explores various techniques such as 3D and motion design, influencing his workflow in a very personal way.Twitter: @jrmypaulLinkedIn: https://www.linkedin.com/in/jrmypaul/=============Links==============Jeremy's online portfolio: https://jeremypaul.meMonoqle website: https://monoqle.frAudrey Hacq's conference: PreviewPreview30:39Atomic Design - Audrey Hacq - WEB2DAY 2017YouTube · Web2dayJun 28, 2017

In this episode, I talked with Michael Blood about mobile app monetization. We cover topics like how to pick the best monetization, some of the latest trends and when do you have to pay Apple's and Google's cut.=============Bio===============Michael Blood is a serial entrepreneur and President of Matraex, a software development company located in Boise Idaho. With 20+ years of experience in computer software and developing websites and applications, Michael is a true industry leader and innovator. When he's not running Matraex or working on his entrepreneurial efforts, Michael can be found spending time with his family, mountain biking, or volunteering at local organizations.Twitter: @michaelbloodLinkedIn: https://www.linkedin.com/in/mrblood/

In this episode, I interview Robi Ganguly about how to make an app that customers love.=============Quotes============On how to create an app that customer love in the early days of an audio based fitness app:  "I'd be focused on:  did you get through this like the first step of listening to one of these workouts? Did you do understand it? Did it makes sense what I was trying to get you to do, you know, and if people tell you along the way that it wasn't clear to them or didn't make sense and they didn't get that aha moment of getting into what you thought was going to be good, you got to unpack that and that, I mean, I, I see this over and over again, apps of all nature that don't really help you understand what you're supposed to do and they don't get you that aha moment So I think that would be the first place I would start. But then assuming that a group of your customers is actually using it, you start looking for not just did you understand it, it's did you enjoy it. Did you really? What was it about? You were drawn to that you liked, and so this is different, I think sometimes from how people in the early stages well will go through. And I say, OK, people are supposed to use it this way.  They're not using it or they are using it. Here are these metrics. And how do we funnel? I think a lot of times people will say, OK, let's go figure out all the problems. And I would say as soon as you have 10, 15, 20 people who are using what is the thing that draws you like what are you really attached to? What are you. Is something working there? And so, for example, if again, with your app, if you're talking about 10 or 15 people, they're like, oh, yeah, this is this is great, Just honing on what's great about it, oh, I love the audio cues. Oh, I love the time, it's only ten minutes. Oh I love that there's this type of workout. Oh I love the way that you express this thing and make it reasonably coachable, whatever it is. If you can pull out those themes and then say, OK, that's that's a strength, you can build on that. Right. Then your problems maybe in the onboarding, not getting everybody to get to be solved when they get into that. "=============Bio===============Robi Ganguly is the CEO and Co-founder of Apptentive, which recently made Deloitte's Technology Fast 500 list for the second year in a row. Founded in 2011, Apptentive's solution measures shifts in sentiment from customer experience to win back consumers and activate fans. Using intelligent tools and precise targeting, Apptentive helps enterprise brands capture actionable emotions and feedback from the 90 percent of consumer voices typically missed, and quickly turns that feedback into action. Apptentive gives marketers, product managers, and customer experience leaders the keys to their customers' hearts through historical insights into brand loyalty and shifting emotions to support customer-centric decisions. Twitter: https://twitter.com/rgangulyLinkedIn: https://www.linkedin.com/in/robiganguly/

In this episode, I interview Anastasiia Voitova about mobile security and the trade-offs it involves (cost, user experience, team collaboration). She has some great advice about how much to invest in your project. We talk about early start-up and try to give a good rule about how much to invest in security.=============Bio===============Anastasiia Voitova, Head of customer solutions, security software engineer at Cossack Labs,  is a software engineer with 10+ experience years. She builds security tools for protecting data during the whole lifecycle (encrypt everything!). Anastasiia shares a lot about "boring cryptography", end-to-end encryption, data security, zero-knowledge & zero trust systems, software security architecture. She speaks at international conferences, conducts workshops and training for developers, and co-organizes cybersec events. Twitter: https://twitter.com/vixentael=============Quotes============"Security is a process and this is a very long process. And there is not this and like table and ribbon, finish ribbon that says, yeah, you're done. Sorry, you're not done. You can do it all the time like month after month, year after year. So the question with security engineering is a question of tradeoff. How to put just enough money into security to have a secure application not to get into, you know, super paranoia mode, not to create applications that is very secure, but no one will use it. At the same time still invest money, because if you don't invest money and in security, it won't happen magically right now. So it's like a game with trade-offs.""However, really scary things happen when it's not only about money, but it's more related to our physical life. For example, those mobile applications that can control automobiles, controlled cars. And now,  especially electric or hybrid car. They have a mobile app that controls this car. And there were cases with Nissan Leaf, for example, where you can just get the application check the network connection from the app to the backend. Go to the Nissan Leaf parking lot and enumerate, like find a Nissan Leaf car ID, just by enumeration and you might be lucky. And there is this car in this parking lot with this ID and suddenly you can control someone else's car.""Well, you know, like no one really aims to create insecure applications. So I don't know a lot of people whose goal was to create bad applications. OK, so it's not something that happens intentionally and it's not something that we can fix. And that's something that we can say to someone else, just like some person on our team, "Hey stop doing that". To do more secure applications, we need some kind of process that will integrate security into the life of our team, basically like day by day, week by week, as in a process that they can't run away from."=============Links==============Themis crypto lib: https://github.com/cossacklabs/themisCossack Labs blog: https://www.cossacklabs.com/blogSecurity Workshop for devs: https://github.com/vixentael/security-data-management-for-app-devs-workshopOWASP (Open Web Application Security Project) MASVS (Mobile Application Security Verification Standard): https://github.com/OWASP/owasp-masvsNIST guidelines for passwords: https://pages.nist.gov/800-63-3/sp800-63-3.html

In this episode, I talk with Maks about his experience with multiple mobile app technologies (Ionic, Flutter, React Native, and native) and how that intersects with his experience as a recruiter. He has some interesting thoughts on how your recruiting should impact your technology choice for your project. =============Quotes============"... the biggest difference is that Flutter doesn't allow you to update your application without going through the whole AppStore approval process and Ionic and React Native both have that capability. And this can be a big benefit of using those.""Pick the right technology for what they are building, and the right technology usually should also have the right talent availability. If you pick something that's really niche and I've seen that happening a lot of times, then in the end you can end up with a very small and narrow talent pool. Then if you don't look outside of your geography, you might not be able to find anyone.""Ionic, obviously React Native. These are things where you don't really need to be an expert in mobile development. You can hire a good web developer who will get up to speed with those really fast. And, this is a huge benefit because it means that even if you have a more senior team, you want to add someone because you don't have the right velocity, you can hire a web developer, you can hire a regular or a mid-level developer, train them to work with React Native or Ionic React or Ionic angular. And basically, they will be up to speed within like days really, to be honest.""If you don't get demos of what someone is building, if they're sitting behind the curtain and then waiting for this big opening of what they've built, that's going to end up really badly.""... on this journey, you might need to pivot several times. So if you come to this mindset that you're going to hire a freelancer or even an agency that will develop this MVP for you, if you haven't thought about having a budget for the next iteration and the third iteration, then you might end up with a product that you paid for and nobody is going to use. So whether are you need a co-founder or not? Or a CTO? Or you can use a freelancer agency? I think it's not the it isn't necessarily the right question. You just make sure that with the choice that you go, you have the budget to go for a longer period of time because building a product is going to take pivoting is going to take learning. And during the first phase, like building your early product MVP or even a proof of concept, you need to maximize the learning. So you need to at least as fast as possible to be able to iterate fast.""And you can with a reasonable budget, you can create a small team that's a mix between part-time people and a full-time person that will be really productive and that will expand your budget compared to, for instance, working with agencies that will charge you premium rates for setting up the whole team. And what they'll do and what they will do under the hood is putting the tech lead for 5 to 10 hours, putting the PO to QA, and [...] then adding this junior developer where they can really optimize their profit margin and the junior or the mid-level person is going to do the bulk of the work because otherwise it just wouldn't make the business sense for them."=============Bio===============Maksymilian is a software engineer, technical lead, and entrepreneur. During his 16+ year career, he was building digital products ranging from early-stage startups to multinational corporations within telecom, pharma, and financial environments. For the past 6 years, he has been primarily engaged in hybrid mobile development. He also co-founded ITCraftship – tech-focused recruitment and staff augmentation agency, that uses agile in its recruitment processes.