A Fabulous Coding Adventure

Contains No Spoilers

I've said it before; my favourite tech blog is Eric Lippert's Fabulous Adventures In Coding. There's simply no-one else out there bringing such regular, reliably lucid exposition of matters algorithmic, to the community of C# developers.

Today, however, Eric surpasses even himself, with the fifth and final piece in his (prerecorded) series ostensibly about functional techniques, and the mathematical process of graph colouring. Before going in to detail about it, let me just point to some of Eric's previous "greatest hits", as listed in this post from Jeff Atwood's Coding Horror, including the highly authoritative four-part series on security and encryption: You Want Salt With That? Eric is also probably the best person in the world to explain concepts like Idempotence and Orthogonality for you, whenever you need that done.

Drawing and Colouring In

Okay, back to today's adventure. Part One starts out innocuously enough, with the stated aim of using "a fairly straightforward problem" - map colouring - to investigate the applicability and the utility of certain techniques from the field of functional programming. Specifically, the interplay between imperative loops and declarative LINQ queries, and possible roles for immutable data structures. Here, Eric sticks to the stated program: weighing up the pros and cons of each design decision; enumerating, explaining and evaluating the many trade offs encountered. Ending with a well-considered data structure design, this opening article already marks the series as a classic, with the sheer width of his design considerations, and depth of their exposition. For example:

The class is internal, not public. I want this to be an implementation detail of my application, not a part of a general-purpose library. As we'll see, this decision has an effect on other implementation choices. (Tradeoff: again, potential code reuse by others vs increased design and maintenance costs)

(Eric always uses the purple crayon.) Part Two continues by applying the same highly detailed approach to complete the data structure design. Part Three, also continuing with the same cost-benefit analysis approach at each stage, presents the basic backtracking algorithm; weighs the expository power of recursion, against the performance benefits of eliminating it; and best of all, shows clearly the benefits of going with immutability in the data structure design, given that backtracking algorithm.

Just a Minute... Just a Minute...

Part Four tests the resultant solution on a map of South America. But then it takes an unexpected turn into a thinly disguised topological realm, where non-planar and non-global maps are considered. What's happening now? The solution turns out to be equally applicable to a toroidal world (think: Asteroids!) where seven regions are each connected to every other. Eric leaves us with the threat of more "particularly interesting graphs" with "lots of fully connected subsets" next time.

But next time, we'll find we're not in Kansas any more. We're on neither plane, nor sphere, nor torus. We're in a world of 16 countries. No wait, 81 countries. All fully edge-connected in little uniform alliances. We're in ... some kind of ... puzzle. Has anybody seen Part Five?

Happy Birthday To Me

♫ Good Morning To All ♫

Today marks the end of this little blog's first orbit around the sun. It was born shortly after my manager showed me this MSDN article, titled Security Briefs: A Conversation About Threat Modeling:

http://msdn.microsoft.com/en-us/magazine/dd727503.aspx

Written as a play, the piece is actually an "amalgam" of various computer security related conversations that its author Michael Howard, one of Microsoft's Principal Security Program Managers, has had with (non security specialist) software developers over many years.

The article struck me as interesting, easy on the eye and brain, even a little amusing. We agreed it might be possible to use such a light hearted approach to help and encourage the introduction of the subject of computer security into everyday conversation at work. Or if you'll forgive a brief overstatement: to use humour as a tool, to introduce Microsoft's Security Development Lifecycle (SDL) into our company, by the medium of blog.

Taking a cue from Raymond Chen's pattern of alternating technical and more personal, nontechnical items, my initial target was to produce about 8 articles in total each month, half of these technical, and half not. Further, the technical ones would be split into half security-related, and half not. Well, one year later I can honestly say that I've continued to hit this target reliably every month. That's a total of eleven months, including the 62-day annual marathon that is Decembuary...

Every article is written for an audience of one. The security stories are for my manager: my first, and still my most faithful, RSS subscriber. By extension, they're also intended for colleagues in Development and related areas. The remaining technical articles might be the result of a particular question or conversation I've had with someone, and that person becomes the perceived audience. Finally, the nontechnical stuff, being literally whatever is on my mind at any given moment, has an intended readership that is effectively random.

Has the experiment succeeded? Well, I do get comments about certain articles, and frequently enough to encourage me to keep going; but to be honest, the technical items appear to get least attention, and the security related items, least of all. Still, that suggests that if nothing else, some colleagues are being drawn to read the blog in the first place, and so are perhaps being brought a little closer to those security related stories than they might otherwise have been. And in any case, it is still an ongoing experiment...

Also, some work has been done towards consolidating a set of security coding standards, guidelines, best practices and related patterns, together with proposals for threat modelling, all based on the introduction of a Security Development Lifecycle into our company. These deliverables have come out of the research required for past, security-related blog articles, so in that sense, the experiment might be regarded as successful; at least, once these proposals are in a form suitable for internal publication.

And that's really all there is to say about that. In closing, here's an appropriately nostalgic link to the original, introductory article:

http://mycodehere.blogspot.com/2009/07/security-101-part-1.html

Happy birthday, little bloggie.

The Artichoke of Attack

They Shallot Pass

Onion, that steadfast, reliable, archetypal model of network security, was reportedly receiving therapy today, having broken down in tears after this stinging and allegedly unprovoked attack by Cisco network consulting engineer Kurt Grutzmacher: "You used to hear about hackers having to peel away at the network’s onion layers, but in the borderless environment, that analogy does not apply."

"We gave service for years, decades even, to modelling the typical network's defences against threats and vulnerabilities" said a tearful Onion, in an apparent reference to its ofttimes colleague, Wild Leek. "Suddenly Cisco's mid-year security report comes out, and this guy's all like, It's not onions any more, it's more of an artichoke. I mean, WTF? So we're being replaced... by a fucking thistle?"

A representative from the pair's legal firm, Scallions Garlic and Chives, was later quoted as saying "We are naturally disappointed by Cisco's decision. We have many members, far more capable of representing attack surfaces in this new, so-called borderless environment. This could all have been better handled without going outside the family. The new Artichoke guy, sure he sounds tough, but underneath it all, he's not that hard. We call him Cisco's Thistle. But he ain't even got no sting."

In other news, ogres are expected to continue to have layers; donkeys, not so much.

Book Review: Security Patterns

Integrating Security and Systems Engineering

From the excellent Wiley series in Software Design Patterns comes an impressively ambitious tome, claiming to cover "real-world knowledge and experience from international security experts." It uses the hugely successful paradigm of design patterns, an approach to provision of vocabulary and communication between software professionals, which has become the norm in recent years.

Like all the best software design patterns books, this one sports a handful of authors (in this case a gang of five), acting both as expert contributors in their own right, and also as editors / leaders of a much larger team of contributors (in this case 21). Such a spread of expertise and experience is understandably necessary, given the ambitious scope of this book.

Also in the tradition of the best patterns books, we find the articles categorised into functional groups. In particular, after five satisfyingly brief chapters of introduction, chapters 6 through 13 deal with the subfields of Risk, Authentication, Access Control, System Access, OS Access, Audits, Firewalls and Intetnet Apps, each of which can be studied almost independently of the others (though there are some cross references). The volume is rounded off with a substantial case study (IP Telephony) and finally some remarks on Antipatterns and Misuse Cases.

Within the main sequence of pattern-related chapters, adherence to a stencil or template aids digestion, as with the original Go4 book. In all, 46 instances are delivered. Each has a name, with possible alternative AKAs, and includes sections titled Example, Context, Problem, Solution, Dynamics, Implementation, Example Resolved, Variants, Known Uses and Consequences. Additional sections e.g. Structure are added as appropriate in the context of the individual pattern or family.

Examples are particularly well handled, and comprise an (inevitable, but) excellent compromise between the complexities of real life scenarios, and the conflicting constraints of abstraction and teachability.

Overall, the patterns approach works particularly well. Which is unsurprising; after all, it was originally applied with unprecedented success to the field of software design generally. But then, most software bugs are security bugs, in the sense that they expose something to the user that was not intended to be revealed by the developers. There is therefore a sizable intersection in the Venn Diagram of Software v Security, where the applicability of any given approach transfers seamlessly.

The scope of the book is enormous, extending often outwith the limits of software and IT. And just like the huge subject of security itself, the book is a part of its own ecosystem, rooted at its main website www.securitypatterns.org, and with an active forum at its (members only) Yahoo! Group, http://tech.groups.yahoo.com/group/securitypatterns/.

One reviewer at Amazon.com says, "this isn't a book you'd sit down and read from cover to cover"; but I'd respectfully disagree. It is exactly the kind of book readily consumed in that way by anyone appreciative of the patterns structure and approach - and, of course, with an accompanying interest in security.

Security Patterns: Integrating Security and Systems Engineering
Wiley Software Patterns Series [Hardcover]
Authors: Frank Buschmann, Eduardo Fernandez-Buglioni, Duane Hybertson, Peter Sommerlad, Markus Schumacher.
2006
ISBN-10: 0470858842
ISBN-13: 978-0470858844

Two Colours Red

It can get a little confusing when two of your favourite artists have movies coming out simultaneously, and both movies are called RED:



Above: Felicia Day's RED movie. Below: Warren Ellis's RED movie.



Not that I'm complaining, oh no. That I would never do, certainly not. This is not just another RED RED Whine.

I Voted for the Hugos!

And You Can Too!

SF (and by that I mean Science Fiction, quite tolerably with a latter day extension to include Fantasy, hence SF/F; but no, no indeed, not SciFi, and most assuredly, definitively, absolutely certainly, not SyFy) has always been an important part of my cultural life, and of the cultural lives of many of my friends. Ever since - depending upon your age and experience - the start, or the finish, of its golden age, namely the late 1950s and early 1960s. For that was when we bright and promising young future citizens were routinely winning school prizes such as Tom Swift and His Rocket Ship (1954, by John Almquist), or His Outpost in Space (1955, by James Duncan Lawrence); decades before it became politically incorrect to give out any kind of prize to anyone, for anything at all.

You might imagine, judging from these book titles, that Tom Swift was a kind of Harry Potter of his day, only with a somewhat more open-ended franchise. Well, no. The first book in series one was Tom Swift and his Motor Cycle; or, Fun and Adventure on the Road (1910); the last, in series 4 proper, Quantum Force (April 1993). By comparison, Potter is but an eye-blink in the geological epoch of Swift. But the "main sequence" of books all shared that familiar, SF genre-defining, characteristic of constrained speculation.

Subsequent schooldays supplied our spongiform minds with an apparently endless stream of this absorbing literature, whether Gollancz yellow jacket hardback from the school or local libraries, or pulp paperback from tobacconists, purveying Poul Anderson, James Blish (whom we discovered through his Star Trek script adaptations, but who then dazzled us like a doe in the road, with the last word in space opera - his sprawling, gutwrenching, Heinleinesque, eternity-spanning Cities In Flight quadrilogy), British supreme twistmeister John Brunner (who tragically died at the 1995 WorldCon event in my home town), L. Sprague de Camp, Harlan Ellison, Lester del Rey, Bob Shaw (remember Slow Glass?), Clifford D. Simak, or A. E. van Vogt.

Today, it is an almost unique privilege, to be able to read in the blog of one of the undisputed masters of SF, the nonagenarian Frederik Pohl, his reminiscences and firsthand personal memoirs and accounts of those other great enlighteners - those fearless imagineers - Isaac Asimov, John W. Campbell, Arthur C. Clarke, Robert A. Heinlein, Frank Herbert, E. E. "Doc" Smith, and still others. So the very fact alone, that Fred's website is up for a Hugo Award (Best Fan Writer) this year, would possibly have been enough to persuade me to part with the Aussiecon 4 Supporting Membership fee. As a member I'd be eligible, not only to vote in the final ballot of the 2010 Hugo Awards, but also to nominate in the 2011 Hugo Awards!

But Wait There's More

Now if enough isn't enough already, then note that Hugo winner John Scalzi, current SFWA President and creative consultant on TV's Stargate Universe, has recently been making a serious effort to get more people to vote, by personally persuading the many publishers involved to make available for download (only to voters), DRM-free, electronic copies of the nominated books. This year's is a truly bumper package, and the fact that it contains, amid much else, four full novels that I'd intended to buy anyway (oh! oh! oh! and a PDF of Batman: Whatever Happened to the Caped Crusader? written by Neil Gaiman, and illustrated by Andy Kubert and Scott Williams), pushed me over the edge with all the commitment of that van in Christopher Nolan's Inception.

Okay, so never mind that "the books balance". I'll probably end up buying these ones in dead tree format anyway, just as I still back up my music collection with dead plankton platters. Regardless...

Voting for the Hugo Awards means honouring both the genre and these great thinkers and writers, some of whose commitment and dedication to the public understanding of science rivals that of a Carl Sagan, Charles Simonyi, or Richard Dawkins. It advertises a contemporary interest in a viable SF/F scene outwith Hollywood. On the day when Amazon's ebook sales overtook their hardbacks, it carries the message that we still want to pay to keep this quality of writing alive. And we hope that it gives hope, stamina and encouragement, to the new torchbearers - Bear, Doctorow, Kowal, Miéville, Priest, Scalzi, Stephenson, Stross, Valente, and all the rest - thankfully, too numerous to enumerate!

At this self same time, voting for enlightened creativity, of the kind exemplified by the SF tradition, demonstrates our reluctant awareness of, and a longing for a life beyond, the electrochemical anaesthesia that today grips our children - exactly as it did the denizens of Arthur C. Clarke's The Lion of Comarre (1949). What do they know of their reality? It was thanks to SF alone that I left primary school, pre-teen, knowing already of such wonders as the predicate calculus, group theory, hypercomplex numbers, relativity and quantum electrodynamics; having met already the genius of Goldbach, de Fermat, Schopenhauer, Wittgenstein, Galois, Frege, Gödel, Turing, Schrödinger, Heisenberg. My debts of gratitude for such enlightenment and liberation are incalculable, even in principle.

Now Get Off Your Ass

Hey: it's still July. The deadline for voting in this year’s final ballot is: 31 July 2010 23:59 PDT (Sunday, August 1, 2010 02:59 EDT, 06:59 UTC/GMT, 16:59 AEST). So don't leave it until the last minute. Because, well you see, that particular minute is after the deadline, for some odd reason. There's still time to get a supporting membership, complete with access to the Hugo Voter’s Packet, which admittedly you'll have to read rather quickly. And you can still vote - I did!

~

Update [5 Sep]: Fred Wins!

I just enjoyed a relaxing Scottish Sunday morning, following the 2010 Hugo Award Ceremony live from Melbourne via the Cover It Live text feed provided by Cheryl Morgan and Mur Lafferty, at the Melbourne auditorium; and Mary Robinette Kowal, joining in from Dragon*Con. Neil Gaiman was online contributing too, and cheering with everybody else when Fred won. It's like Wil Wheaton often says: I love living in the future! Only the near future, mind you. The live video feed was unwatchable.

Not all of my top choices won their categories. But enough did, and enough of the remaining categories were won by my second choices, that I have to say I'm personally convinced, as in sold, on the merits of the hypercomplex vote counting and recounting system that WorldCon and The Hugo Awards have evolved for this event.

And the main result, the award for best novel, was a two-way tie. What better way can there be to prove to people that their votes matter? Despite the forementioned complexities of that voting system, I can say with certainty that China Miéville would not have a Hugo Award today, were it not for my own, personal vote. Guy owes me a Guinness.

Photo of Elizabeth Anne Hull, Fred, the Hugo, and Steven Silver, by Cathy Pizarro

Calling All Bounty Hunters

Upping The Anti

Almost five years ago, on August 15^th 2005, TippingPoint augmented its own research organisation DVLabs with the additional zero day research of a growing network of "extended researchers", through the launch of the Zero Day Initiative (ZDI). The main stated aims of the ZDI were to leverage "the methodologies, expertise, and time of others; encourage the reporting of zero day vulnerabilities responsibly to the affected vendors by financially rewarding researchers; [and] protect our customers through the TippingPoint Intrusion Prevention Systems (IPS) while the affected vendor is working on a patch."

This was a relatively novel approach at the time, although not entirely unheard of. Give or take a matter of some months, VeriSign's iDefense Vulnerability Contribution Program (VCP), an initiative that now "pays more for meaningful high-quality research than anyone", also dates back approximately that far. Their Contributor Portal allows researchers to submit vulnerabilities, then track progress as they are evaluated and processed, "simplifying the overall process and allowing faster response."

In more recent years, there has been a steady increase in the number of organisations buying vulnerabilities from researchers. While these initiatives have established a legitimate, public "market place" for bugs, there has also been a corresponding increase in pressure, from researchers in the field, upon vendors, to do the same thing: to offer bug bounties. In January of this year, for example, Google started a new program paying security researchers $500 for each security bug found either in the Google Chrome browser, or else in its open source code base, Chromium.

The Mozilla Bounty

The Mozilla Foundation, whose efforts in this direction originate an even more venerable six years ago - with the help of the start-up funding provided by Linspire and Mark Shuttleworth, in 2004 - has now announced, in its latest initiative to enlist more help finding bugs in its most popular software, an increase in the cash reward for reporting a valid, critical security bug. Your remote exploit will now bag you $3000 (and of course, one Mozilla T-shirt), a considerable hike from the original $500.

The new prize applies to original and previously unreported, critical or high severity remote exploit security bugs "present in the most recent supported, beta or release candidate version of Firefox, Thunderbird, Firefox Mobile, or in Mozilla services which could compromise users of those products."

Lucas Adamski, Mozilla's director of security engineering, wrote in a blog post, "A lot has changed in the 6 years since the Mozilla program was announced, and we believe that one of the best way to keep our users safe is to make it economically sustainable for security researchers to do the right thing when disclosing information [...] We hope other organizations will match our program and actively support constructive security research."

Meanwhile, such calls are also increasing for other vendors, for example Microsoft, who have seen some recent tailing off in the number of exploit research reports being submitted to them gratis; to redouble efforts, the better to engage with the community of researchers. Calls like this one, from Kaspersky's Threat Post.

Update, July 20: Google just updated their vulnerability disclosure policy, while on the Chromium blog, simultaneously increasing their maximum reward for single critical bugs to "eleet", i.e., $3,133.7 - is that seven cents, or seventy? - celebrating, they say, "approximately six months" of the Chromium Security Reward program. So, nothing whatsoever to do with the Mozilla announcement, then.

Update, July 22: the tremors continue, now with Microsoft reluctantly shifting policy away from the private reporting of vulnerabilities, and towards a new model labelled Coordinated Vulnerability Disclosure. What's new about this model: public recognition that the release of details about a bug before a patch is ready (in cases when attacks are already happening) may sometimes be "necessary". There are also persistent rumours that MS may pay bug bounties at a future point; an option they've always publicly discounted, and today denied again.