Category Archives: Security

The Pain of Fixing Code

I’ve been dealing with bugs galore lately; memory leaks, overflows, etc. and it has brought forward some discussion about the difficulty in finding developers who are able to recognize flawed code, let alone make the time to repair it. I was looking for some data on quantifying the source of the problem (yes, metrics) and found this insightful article from a 1998 IEEE journal:

In the first study on the subject, Sackman, Erikson, and Grant found differences of more than 20 to 1 in the time required by different developers to debug the same problem (“Exploratory Experimental Studies Comparing Online and Offline Programming Performance.” Communications of the ACM, January 1968). This was among a group of programmers who each had at least 7 years of professional experience.

Productivity issues are certainly a concern. Managers often time-box release of code to the point where beta is production. In fact, companies like Google make beta sound so good you have to wonder if people care anymore about the concept of “finished” products. To their credit, and from a historical perspective, IBM had a similar approach and used to include an engineer with their high-end processing platforms to monitor and resolve issues on the fly (e.g. the systems were too complex for anyone to try and manage without pre-qualified professional help). I was always surprised by this and wondered if someone had investigated how to pack an engineer in the crate so she/he would just pop out and start working on the system as soon as it was plugged in. Similarly, the big V12 power-plants of the luxury cars perhaps were not really expensive because of the quality of the build, but because the things never truly had independence from the mechanics (go for a drive, go get a tuning…repeat).

Tom DeMarco and Timothy Lister conducted a coding war game in which 166 programmers were tasked to complete the same assignment (“Programmer Performance and the Effects of the Workplace,” in Proceedings of the 8th International Conference on Software Engineering, August 1985). They found that the different programmers exhibited differences in productivity of about 5 to 1 on the same small project. From a problem employee point of view, the most interesting result of the study is that 13 of the 166 programmers didn’t finish the project at all—that’s almost 10 percent of the programmers in the sample.

So maybe this is a stupid question, but do humans really classify dependability and repeatability as value/benefit worthy of expense? I think the answer is that we spend when we are confident in the return, and we only look for quality when we are in fear of the unknown. Fast food restaurants, for example, can spend on infrastructure because it is the obvious way to reduce cost for a volume of deployed meals that covers that investment. Ford thought this way, as did Edison. People look for the symbols of the industrialized product not for dependability or quality in an absolute sense, but only in relative terms to the other options (that depend on their point of reference). I could continue down this line of reasoning, but in a nutshell I guess my point is that I am finding it is reasonable to expect improvements in code quality only in development environments that understand defect tracking and resolution; the same as expecting quality of life in governments that understand justice and liberty.

Elderly Ex-Paratrooper Disarms American Terrorist

Sensational title? Well, this is a sensational story. Apparently an incarcerated member of the Aryan Nation terrorist group, based in the US, was armed and on the loose today.

At about 7:45 a.m. Monday, an inmate accompanied by a corrections officer arrived at the center to for medical treatment. While they were in an exam room, some type of altercation took place and the suspect was able to get the officer’s gun.

Officer Stephen Anderson, 60, was shot and died from his injuries.

There are some obvious lingering questions about why a terrorist called Utah’s “public enemy #1” was essentially left unguarded. After shooting the corrections officer in the head he carjacked a vehicle. Police gave chase but it ended when the inmate climbed through a drive-in window of a fast food restaurant and tried to attack the people inside:

At least one shot was fired inside Arby’s and if not for the quick action of a former military paratrooper who happened to be inside the restaurant, there could have been more shots fired.

A 59-year-old Salt Lake City resident named Eric is credited with getting the gun away from the armed suspect. He says the gunman threatened others inside the restaurant.

“He was going to kill that guy and I wasn’t going to let him kill him,” he said.

Eric would seem to be a true hero, having intercepted a terrorist and disarmed him before he could do further harm. I wonder if the attack on civilians will be labeled as a terrorist act. Or more to the point I wonder how this will reflect on the national security debate as police departments unable to recruit new hires and the guard are said to be missing essential equipment?

History of the PIN

The BBC has a cute story about the man who supposedly invented the ATM, and the reason for a 4-digit PIN:

One by-product of inventing the first cash machine was the concept of the Pin number.

Mr Shepherd-Barron came up with the idea when he realised that he could remember his six-figure army number. But he decided to check that with his wife, Caroline.

“Over the kitchen table, she said she could only remember four figures, so because of her, four figures became the world standard,” he laughs.

Could only remember four figures? Is that not grounds for divorce?

But seriously, I find it strange the reporter wrote “Pin number”. I read that as the personal identification number number, which makes me suspicious of the research that went into the story.

So the PIN came first, or later? Would be interesting to know what event actually prompted the need for a PIN.

OS Bloat and History Repeating Itself

Chalk this Infoworld writer up as yet another victim of history:

Twenty yeas from now a new generation of computer users will look back on the operating systems of today with the same bemused smile we look back at the cars of the late 1950s and early 60s. They had huge fins, were the size of a small yacht and burned up just about as much gas.

That’s right, I’m comparing Apple OS X 10.5, or Leopard, and Microsoft’s Windows Vista to those old behemoths — big and flashy and totally unnecessary.

Sorry, cars today are bigger and just as inefficient. Who needs fins when you can carry hundreds of pounds of roof-rack rails around. Hello, chrome spinners?

Conversely, as I’ve mentioned before, in raw terms cars of a hundred years ago were more efficient than those today:

“In 1908 Ford autos got 28 miles per gallon and today fuel efficiency for automobiles averages 25 miles per gallon. Is that progress?� asked Allen Hershkowitz, PhD, a senior scientist with the Natural Resources Defense Council during a Nov. 9 lecture at the New Jersey Institute of Technology (NJIT).

So what does that tell you about the future of OS design? America needs Vista like a soccer mom needs an SUV, but we’re talking want here. Want is a whole different ballgame.

A Microsoft security executive released data Thursday showing that, six months after shipping Windows Vista, his company has left more publicly disclosed Vista bugs unpatched than it did with Windows XP.

Can we assume the unnamed executive is looking back with a bemused smile?