|
|
|
| Related Articles |
| Qantas admits to illegal activity and does a deal with the US Government |
28 November 2007 |
| agreeing to pay a fine of US$61 million for illegal conduct related to fuel surcharges in the international air cargo market |
| |
| Korean Air hit by state ruling |
28 November 2007 |
| The South Korean government introduced a rule stipulating that all budget airlines must operate domestic routes for two years before they are allowed rights to fly abroad |
| |
| Korean Air to launch budget offshoot in May |
26 November 2007 |
| The South Korean flag carrier will invest Won20bn to establish a discount carrier in May next year, launching "Air Korea" to compete with the likes of Singapore's Tiger Air in the low-cost Asian travel market |
| |
| Gun amnesty after air rifle death |
28 November 2007 |
| Residents ask for a gun amnesty after a 17-year-old boy died when he was shot with an air rifle. |
| |
| Nato bomb 'kills Afghan workers' |
28 November 2007 |
| A Nato air strike kills 12 men working on a road in Afghanistan's north-east, a provincial governor says. |
| |
| Programming less |
28 November 2007 |
| A programming lesson I keep relearning.
The design of the central data structure of an app determines the quality of the app, in every way.
Any extra thought that goes into this, will pay off in:
1. Maintainability of the code.
2. Size of the code (you'll write less code with a well thought-out central data structure).
3. Simplicity of the user interface (the structure inevitably shows through in the UI).
4. Ability to respond to feature requests.
5. Adapt to new hardware, OS changes, other apps.
6. More "it just works" experiences.
This is why it's sometimes the right thing to start over from scratch. Programmers often want to start over because they look at the code and it looks complicated, and they think they can make it simpler if they start over. They're right, of course, it will be simpler when they start over, because it won't do nearly as much as the mature product does. Once they finish building out the feature set, it may well be just as complicated.
It's a judgement call. I remember looking at the source of Unix kernel for the first time as a grad student in Wisconsin, and being amazed at the simplicity and obviousness of the code. I couldn't believe something so simple actually worked. Your code at its kernel level must have this simplicity. But at the edges, where you're accomdating the minds of users, inevitably it gets a little messy. The key thing to look for is how hard is it to add a completely new feature. It should be easy to do that. If it's not, it's likely because of a poorly organized (and therefore not well-understood) central data structure.
I've rewritten apps many times, over many years, because when I wrote the first or second versions, I didn't understand the problem well enough, and the code had turned into a morass of patches and workarounds.
Right now I'm recoding the internals of a special-purpose aggregator. I've written many of these, over the years, always quickly, trying to get something running fast, and then lived with data structures that resulted. This time I'm going slowly and carefully, with an installed base of one (me) and ripping up the pavement whenever I find even a slightly better way of doing something. I have other users who are waiting, but that's life.
5/7/97: "When a programmer catches fire it's because he or she groks the system, its underlying truth has been revealed." |
| |
| Google: Jolly green giant? |
28 November 2007 |
| The search and advertising company is a force to be reckoned with across the Web. Now it's looking to do the same in alternative energy (along with many others, large and small). |
| |
| Client-side vulnerabilities loom large |
28 November 2007 |
| Critical vulnerabilities in common PC software, including both applications and operating systems, continue to grow in number and stand as the leading cause for concern in the IT security landscape today, according to training experts at the SANS Institute.Holes in so-called client-side applications, including Web browsers, e-mail clients, productivity suites, and media players, have become particularly worrisome over the last year, according to SANS, which highlighted the issue as part of its annual report on the top 20 Internet security risks for 2007.As hackers have shifted their attention further away from operating system flaws and drilled down to applications-layer vulnerabilities they have found a seemingly endless wealth of possibilities for infecting PCs with everything from spyware to botnet programs, SANS researchers contend.Unless something can be done to improve software developers' coding habits or better test popular applications for such issues before they land on end-users' machines, attackers will be able to continue their successful assaults against enterprise networks and devices for the foreseeable future, said Rohit Dhamankar, project manager for the Top 20 report at SANS and a senior manager of security research for TippingPoint.?"There's just been such a dramatic rise in the numbers of vulnerabilities found in applications like Internet Explorer and Microsoft Office and a number of media players that attackers are having their way," said Dhamankar. "Enterprises are bolstering security, but desktop users still pose a massive risk if they can download anything they want from the Web; the attacks are also growing in sophistication to the extent that many can defeat antivirus and other security systems primarily by obfuscating their code."Some of the most powerful tools that hackers have adopted in hunting for potential targets are the same industrial-strength applications fuzzing tools that software vendors themselves are using to search for holes in their products, said the expert.Enterprises could do themselves a favor by enforcing stricter policies that dictate the types of applications that end-users are allowed to put on their work machines and using technical means to ensure that those rules are being followed, Dhamankar said.Other SANS researchers noted that while companies may not want to tell end-users that they cannot utilize media players, messaging clients, and other applications that have moved into the business world from the consumer sector, they could help themselves out by limiting the variety of client-side applications that people may choose from."IT departments can't focus on all the applications of the world, but they can choose several and keep their eye on those while allowing end-users some freedom," said Amol Sarwate, research manager at Qualys who studies vulnerability patterns for SANS. "What companies need to do is enforce standards for applications usage and utilize technical means to block unwanted software, devices, and even wireless access points."While many businesses have already realized that they need to shift more of their efforts toward defending client-side vulnerabilities, most have failed to embrace a proactive approach versus simply keeping track of publicly-reported flaws and patching those issues said Sarwate.Enterprises need to think about future security issues
It will be particularly important for firms to examine the additional security issues that will be introduced in the coming years with broader adoption of technologies including VoIP (Voice over IP), according to the expert."The key is for people to start thinking ahead of these client-side vulnerabilities to understand what the next big thing may be. Things like VoIP need to be examined for their security implications," said Sarwate. "Many companies are already adopting these tools because of all the advantages they offer, but there will be many attacks carried out against these systems as well."Among the advice that SANS is offering organizations hoping to improve their client-side security coverage is to mandate secure configurations at installation time for all applications, to constantly verify patching and upgrading of both applications and system software, to scan for new vulnerabilities frequently, and to keep their security systems up to date.Other leading areas of concern highlighted by SANS in its report included critical vulnerabilities in Web applications that allow for cross-site scripting attacks or for computers to be otherwise compromised simply by pointing their browsers at poisoned URLs."Gullible, busy, accommodating computer users," including executives, IT staff, and others with privileged access also remain a major weak point for enterprise security, according to SANS, as these seemingly more seasoned users of computers and software are still falling for increasingly targeted spear-phishing campaigns in large numbers.One of the best ways to educate users about the problem is for organizations to create fake spear-phishing threats and send them out to internal users to determine which individuals might be most likely to fall for the schemes and follow up with additional training, the group said.Critical vulnerabilities in the software and systems that provide the operating environment and primary services to computer users, or server-side software, remain another area of leading concern, according to SANS.Problems in Microsoft Windows services, Unix and Mac OS services, back-up and AV programs, management servers, database software, and VoIP technologies in particular are proving troublesome, according to the report.Many of those issues can be addressed by following the same advice offered for solving client-side vulnerabilities, SANS said in the research. |
| |
 |
|
|
|