The Insider News

Code Arcana[^]:

Format string vulnerabilities are a pretty silly class of bug that take advantage of an easily avoidable programmer error. If the programmer passes an attacker-controlled buffer as the argument to a printf (or any of the related functions, including sprintf, fprintf, etc), the attacker can perform writes to arbitrary memory addresses.

Entrepreneurial Seduction[^]:

The problem with talking about functionality not in the current release sets expectations and distracts from marketing what’s already wonderful about what you’re selling. All you’re doing is diminishing the product you’re selling. You are also making a promise to your customers that you may need to break down the road if priorities change (or Apple implements new OS features that force your hand).

Wired.com[^]:

In the dark old days of the late 1990s and early 2000s, debates would rage about whether open source software is as good as proprietary software. And it was all a matter of opinion. Then, in 2006, the Department of Homeland Security partnered with a software code analysis company called Coverity to examine open source code for security vulnerabilities and software defects. Each year since, Coverity has published a report on the quality of open source code.... But the latest report, published on Wednesday, found something new: the code quality of open source projects tends to suffer when they surpass 1 million lines of code, whereas proprietary code bases continue improve when they pass that mark.

Network Wrangler[^]:

With a nod to Vivek Gite and his popular 20 Linux System Monitoring Tools Every SysAdmin Should Know article, we present "20 Windows Tools Every SysAdmin Should Know". Many of the programs listed below are included with Windows and provide all kinds of information about what is happening on the computer. Some you've probably heard of, and hopefully a few will be new to you.

Gamasutra[^]:

[I] recently came upon magazine called "Video Games", published between 1982 and 1983. Within a lot of these issues were well written articles on a lot of things at the time -- and they're absolutely fascinating. Being around before and after the crash makes it quite unique. Starting off with Issue 8, March 1983 - Welcome to the Club! An amazing article written by Ann Kreuger about the role of Women in developing video games. Here’s a good start: "In my research, I turned up 15 women in positions that are not related to promotion, publicity or advertising." In the article she talks with Dona Bailey, one of the creators of Centipede, Sue Forner, an artist on Professor Pac-Man, Janice Hendricks who designed the art for Joust, Lynda Avarett, Sue Currier and Roberta Williams. Fascinating!

The H Security[^]:

Anyone who uses Skype has consented to the company reading everything they write. The H's associates in Germany at heise Security have now discovered that the Microsoft subsidiary does in fact make use of this privilege in practice. Shortly after sending HTTPS URLs over the instant messaging service, those URLs receive an unannounced visit from Microsoft HQ in Redmond.

Quartz[^]:

Big data! If you don’t have it, you better get yourself some. Your competition has it, after all. Bottom line: If your data is little, your rivals are going to kick sand in your face and steal your girlfriend. There are many problems with the assumptions behind the “big data” narrative (above, in a reductive form) being pushed, primarily, by consultants and IT firms that want to sell businesses the next big thing. Fortunately, honest practitioners of big data—aka data scientists—are by nature highly skeptical, and they’ve provided us with a litany of reasons to be weary of many of the claims made for this field.

High Scalability[^]:

Now that we have the C10K concurrent connection problem licked, how do we level up and support 10 million concurrent connections? Impossible you say. Nope, systems right now are delivering 10 million concurrent connections using techniques that are as radical as they may be unfamiliar.

ZDNet[^]:

As many expected and hoped, Microsoft is going to make the coming Windows Blue update to Windows 8 free for existing Windows 8 and Windows RT users. Microsoft's Windows Chief Financial Officer Tami Reller, during an appearance at the May 14 JP Morgan Technology, Media & Telecom Conference, shared the pricing news. Reller also acknowledged what those who've downloaded leaked builds of Blue have known for a while: Windows Blue is Windows 8.1.

Troy Hunt[^]:

XSS protection: check! No SQL injection: check! Proper use of HTTPS: check! Clickjacking defences: uh, click what now?! This is one of those risks which doesn’t tend to get a lot of coverage but it can be a malicious little bugger when exploited by an attacker. Originally described by Jeremiah Grossman of WhiteHat Security fame back in 2008, a clickjacking attack relies on creating a veneer of authenticity under which lies a more sinister objective.

Matt Gemmell[^]:

We forget that physical objects are also just specific embodiments – or presentations – of their content and function. A paperback book and an ebook file are two embodiments of the text they each contain; the ebook isn’t descended from the paperback. They’re siblings, from different media spheres, one of which happens to have been invented more recently. The biggest intellectual stumbling-block we’re facing is the fallacy that just because physical embodiments came first, they’re also somehow canonical.

Haacked![^]:

In some recent talks I make a reference to Conway’s Law named after Melvin Conway (not to be confused with British Mathematician John Horton Conway famous for Conway’s Game of Life nor to be confused with Conway Twitty) which states: Any organization that designs a system (defined broadly) will produce a design whose structure is a copy of the organization's communication structure. Many interpret this as a cynical jibe at software management dysfunction. But this was not Melvin’s intent. At least it wasn’t his only intent.

Visual F# Team Blog[^]:

Through Jack Pappas, the F# Software Foundation (the F# community group also known as fsharp.org) has recently made F# more readily available on FreeBSD. Some details below, taken from the discussion on the F# Open Source Google Group....

End Your If[^]:

Entity framework is a great ORM provided by Microsoft. There are a ton of examples of how to get up and running with it really quickly. The only problem with all of them, is the get you off on the wrong foot. In all of the EF example guides, the DbContext class is typically deeply embedded into the core of your code. This of course is great for Entity framework because the effort to change will be next to impossible – speaking from experience of course here. Instead, by making some subtle changes we can integrate Entity framework in a separate layer in case at some later date you wish to replace it.

MIT Technology Review[^]:

You probably haven’t heard of HD Moore, but up to a few weeks ago every Internet device in the world, perhaps including some in your own home, was contacted roughly three times a day by a stack of computers that sit overheating his spare room. “I have a lot of cooling equipment to make sure my house doesn’t catch on fire,” says Moore, who leads research at computer security company Rapid7. In February last year he decided to carry out a personal census of every device on the Internet as a hobby. “This is not my day job; it’s what I do for fun,” he says.