3

Risks Digest 34.36

Posted by RISKS List Owner on Jul 21

RISKS-LIST: Risks-Forum Digest Sunday 21 Jul 2024 Volume 34 : Issue 36

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.36>
The current issue can also be found at
<...




3

Risks Digest 34.37

Posted by RISKS List Owner on Jul 25

RISKS-LIST: Risks-Forum Digest Thursday 25 Jul 2024 Volume 34 : Issue 37

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.37>
The current issue can also be found at
<...




3

Risks Digest 34.38

Posted by RISKS List Owner on Jul 29

RISKS-LIST: Risks-Forum Digest Monday 29 Jul 2024 Volume 34 : Issue 38

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.38>
The current issue can also be found at
<...




3

Risks Digest 34.39

Posted by RISKS List Owner on Aug 03

RISKS-LIST: Risks-Forum Digest Saturday 3 Aug 2024 Volume 34 : Issue 39

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.39>
The current issue can also be found at
<...




3

Risks Digest 34.40

Posted by RISKS List Owner on Aug 14

RISKS-LIST: Risks-Forum Digest Wednesday 14 Aug 2024 Volume 34 : Issue 40

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.40>
The current issue can also be found at
<...




3

Risks Digest 34.41

Posted by RISKS List Owner on Aug 24

RISKS-LIST: Risks-Forum Digest Saturday 24 Aug 2024 Volume 34 : Issue 41

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS
(comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats,
etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.41>
The current issue can also be found at
<...




3

Risks Digest 34.42

Posted by RISKS List Owner on Aug 26

RISKS-LIST: Risks-Forum Digest Monday 26 Aug 2024 Volume 34 : Issue 42

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.42>
The current issue can also be found at
<...




3

Risks Digest 34.43

Posted by RISKS List Owner on Aug 29

RISKS-LIST: Risks-Forum Digest Thursday 29 Aug 2024 Volume 34 : Issue 43

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.43>
The current issue can also be found at
<...




3

Risks Digest 34.44

Posted by RISKS List Owner on Sep 08

RISKS-LIST: Risks-Forum Digest Sunday 8 Sep 2024 Volume 34 : Issue 44

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.44>
The current issue can also be found at
<...




3

Risks Digest 34.45

Posted by RISKS List Owner on Sep 14

RISKS-LIST: Risks-Forum Digest Saturday 14 Sep 2024 Volume 34 : Issue 45

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.45>
The current issue can also be found at
<...




3

Risks Digest 34.46

Posted by RISKS List Owner on Oct 01

RISKS-LIST: Risks-Forum Digest Tuesday 1 Oct 2024 Volume 34 : Issue 46

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.46>
The current issue can also be found at
<...




3

Risks Digest 34.47

Posted by RISKS List Owner on Oct 17

RISKS-LIST: Risks-Forum Digest Thursday 17 Oct 2024 Volume 34 : Issue 47

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.47>
The current issue can also be found at
<...




3

Risks Digest 34.48

Posted by RISKS List Owner on Nov 08

RISKS-LIST: Risks-Forum Digest Friday 8 Nov 2024 Volume 34 : Issue 48

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.48>
The current issue can also be found at
<...




3

NSE scripts for SNMPv3?

Posted by Johan Kuuse on Oct 03

Hi, my first mail to this list,

I have used (and modified) quite a few NSE scripts for SNMP.
Anyhow, AFAIK, all SNMP scripts (except "snmp-info") are limited to SNMPv1
and SNMPv2c:

nmap --script-help=snmp* | grep -B3 -A1 -i v3
----------------------------------
snmp-info
Categories: default version safe
https://nmap.org/nsedoc/scripts/snmp-info.html
Extracts basic information from an SNMPv3 GET request. The same probe is
used
here...




3

Old Infosec Talks: Metlstorm's Take on Hacky Hacking

Posted by Dave Aitel via Dailydave on Oct 31

The Anatomy of Compromise

One of my demented hobbies is watching old infosec talks and then seeing
how well they hold up to modern times. Recently I excavated Metlstorm's
2017 BSides Canberra
<https://www.youtube.com/watch?v=OjgvP9UB9GI&list=TLGGvAY1CcIr-AcyNjEwMjAyNA>
talk on "How people get hacked" - a pretty generic topic that gives a lot
of room for opinion, and one a lot of people have opined on, but the talk
itself...




3

Episode 3: Interview Doug Schmidt

In this episode we talk with Doug Schmidt. Doug is a professor of computer science at Vanderbilt University and a well-respected authority in the fields of middleware, patterns and model-driven development. In this interview we talk about these topics in the context of distributed, realtime embedded (DRE) systems.




3

Episode 13: Ruby in Practice

Ruby has been getting more and more attention by the developer community over the last couple of years. Nevertheless Ruby as language and as a plattform is not too widespread. Most developers don't know people who have actually done commercial Ruby projects. Therefore it is sometimes hard to judge if Ruby is just a hype topic or if Ruby can be used for serious projects today. In this episode Alexander speaks with Thomas Quas about a commercial Ruby project Thomas finished a while ago. Thomas shares his insights and practical experiences with Ruby doing a project under strong time pressure. As Thomas has many years experience doing Java projects we also do some high level comparisons between both platforms.




3

Episode 16: MDSD Pt. 3, Hands-On

This episode provides a hands-on guided tour through a simple model-driven software project. It is based on an actual code sample (see link below) and takes a look at the typical steps of real-life code generation: prototypical implementation, defining the metamodel, reading a model into a metamodel instance, writing templates and validating the model. The example for the episode uses openArchitectureWare as a generator environment, but the overall approach is tool independent. This episode is the first in a new category "code/technology" that discusses technical concepts based on actual code. Please give feedback whether you find this format useful or not.




3

Episode 23: Architecture Pt. 1

This is the first of a series of Episodes on Software Architecture. Alex, Michael and Markus talk about rather fundamental topics in this episode, we'll go into much more detail in subsequent episodes in that series. Topics in this episode include:

  • What is architecture, how is it different from design
  • what different kinds of architecture are there in addition to software architecture
  • the role of the architect, do we have one or more?
  • architecture in agile software development
  • tasks of the architect
  • architect vs. the technical project lead
  • architecture and project politics
  • architecture requirements, estimating, team assembling
There aren't too many good references for this general architecture discussion. You might want to take a look at Software Architecture in Practice by Len Bass, or, if you speak German, at the book Software-Architektur by Vogel, Arnold, Chugtai, Ihler, Mehlig, Neumann, Voelter and Zdun.




3

Episode 29: Concurrency Pt.3

The third part of our concurrency series by Michael and Alexander discusses how to build highly scalable servers. The discussion focusses especially on event-driven servers. As possible solution patterns a reactor-based design is suggested along-side several patterns for multi-threading issues: Reader/Writers Locks, Thread Pools, and Leader/Followers.




3

Episode 30: Architecture Pt.3

In this third Episode on software architecture, Michael and Markus talk about the basic tools that an architect uses when architecting systems. These tools include things like separation, abstraction, compression and sharing. We also relate these tools to the quality attributes we introduced in previous archtecture episodes.




3

Episode 31: Agile Documentation

In this episode, our guest Andreas Rueping and Markus talk about documenting software. While this is a topic that many people don't like or consider fun, it is nonetheless very important. Based on his book, Agile Documentation, we talk about various aspects documenting software such as what to document, when to document, which media to use as well as specifically a number of layouting tips for nice documents.




3

Episode 32: Service Oriented Architecture, Pt.2a

In this, as well as in the next episode Eberhard and Markus continue their discussion about SOA (the episode got too long, so we had to split it into two ... SOA 2a and SOA 2b). In this episode, we talk about the various perspectives on SOA (CBD, EAI, BPM), about fundamental requirements towards an SOA, and we discuss the role of models in defining sustainable architectures. We also discuss how a programming model based on the described approach typically looks like. We then discuss a number of issues any large-scale SOA faces (and for which the SOA paradigm does not really provide an out-of-the-box solution: In this episode we discuss data type ownership and (weak) typing of data types.




3

Episode 33: Service Oriented Architecture, Pt.2b

This is the second snippet of the SOA 2 double-episode. Eberhard and Markus continue the discussion with the issue of service reuse and a couple of development process issues. We also look at the duality between infrastructure development and application development in the context of an SOA. We then discuss the great spaghetti misunderstanding :-). We conclude this episode with a look at how to integrate BPM into the conceptual SOA framework we've built up to now, and we'll also briefly skim over a number of technologies related to SOA. Note that this episode, as well as the last one, is based on a set of slides; these can be downloaded from here. This episode covers slides 39 through 74.




3

Episode 34: Enterprise Architecture

In this episode Markus and our Guest Andy Longshaw talk about enterprise architecture. More specifically, we talk about some of the patterns in Andy Longshaw's and Paul Dyson's book Architecting Enterprise Solutions: Patterns for High-Capability Internet-based Systems. These includes things like replication, load balancing, monitoring and application management.




3

Episode 35: Roadmap

This episode mainly outlines the upcoming programming and interviews.




3

Episode 36: Interview Guy Steele

This episode is an interview with Guy L. Steele Jr.. Guy is a Sun Fellow and heads the Programming Language Research Group within Sun, and a generally well known "programming language guy" (see here for details). We briefly talk about Lisp and the resurgence of dynamic languages before we delve into the main topic, the Fortress programming language he is working on. Fortress is a language intended to replace Fortran as a scientific computing language. We talk about how mathematical notations, syntax extensio and built-in support for parallelism are crucial properties of such a language. We then briefly talk about potentials for compiler optimization before taking a closer look at the type system (static typing, type inference), traits and contract specification as well as first-class support for hierarchical components. We conclude the discussion with a look at automatic partitioning and distribuion of concurrent algorithms and a brief look at the future roadmap for the Fortress language.




3

Episode 37: eXtreme Programming Pt.1

This is the first of two episodes where Arno and Alex discuss eXtreme Programming in se-radio's development process track. eXtreme Programming (XP) revolutionized the way of thinking about software development methodologies and helped to make the agile movement popular. In this episode they discuss the very basics of XP, its value system, principles and the basic practices used in an XP project. The second episode will continue the introduction adding the missing practices and how to introduce XP into projects.




3

Episode 38: Interview James Noble

Designers, programmers, engineers, we must all return to programming! Very few programmers tend to see their (sometimes rather general) difficulties as the core of the subject and as a result there is a widely held consensus as to what programming is really about. If these notes prove to be a source of recognition or to give you the appreciation that we have simply written down what you already know about the programmer's trade, some of our goals will have been reached.




3

Episode 39: Interview Steve Vinoski

This episode is an interview with Steve Vinoski. Steve works as the Chief Engineer for IONA. He's what you'd call a middleware guru, he was for example deeply involved with CORBA. So, this interview centers mainly around middleware. We begin by talking about his own history wrt. middleare and ORBs and how ORBs evolved over time. We then talked about whether coarse-grained, stateless components might be a better abstraction for distributed systems than "objects". We then covered the future of CORBA, it's use in ethe embedded space as well as the practical relevance of the POSA patterns when building ORBs. Then we switched topics and addressed the role of web services as a "middleware middleware" and the maturity of WS-* specifications. We then looked at what Steve is working on these days, which is e.g. the Advanced Message Queueing Protocol (AMQP) as well as dynamic languages. We concluded the interwiew with his view on SOA.




3

Episode 43: eXtreme Programming Pt.2

This is the second part of our two part discussion of the eXtreme Programming development methodology. While the first part introduced the values, principles and basic practices, this time Arno and Alex speak about the practices that set the context for an XP project and how to get started, and they discuss some FAQs they often get when introducing XP.




3

Episode 53: Product Line Engineering Pt. 1

Michael Kircher and Markus Voelter introduce the topic of software product line engineering. They motivate when and why product lines are important to consider and what makes them so special. Further, they introduce some key terminology, such as platform, core asset, feature model, commonality, and variability.




3

Episode 63: A Pattern Language for Distributed Systems with Henney and Buschmann

In this Episode we talked about the new POSA 4 book which has recently been published. We talk to two of the authors, Kevlin Henney and Frank Buschmann (the third author, Doug Schmidt was not available - and he had also been on the podcast a couple of times :-)). The book contains a pattern language for distributed systems. It contains 114 patterns that had been published before by many different other authors. The patterns have been rewritten to form a consistent language. We basically talked through the different sections of the book, which gives a really good overview over the challenges and the solutions of building distributed systems. These sections include From Mud to Structure, Distribution Infrastructure, Event Demultiplexing and Dispatching, Interface Partitioning, Component Patitioning, Application Contrl, Concurrency, Synchronization, Object Interaction, Adaptazion and Extension, Modal Behaviour, Resource Management and finally, Database Access. The book references several other previous works (as listed below). Interestingly, many of these referenced works and authors have also been discussed previously on the podcast. Here are the back references:




3

Episode 69: Nico Josuttis on SOA (SOA Pt. 3)

This Episode is part five in our (probably ongoing) series on service oriented architecture. In this episode we talk to Nico Josuttis, who has recently published a book on this topic. As its title "SOA in Practice" suggests, it is a very pragmatic book based on Nico's experience as architect and project lead in a number of enterprise-level projects - not all of them had been called SOA, since they at the time the term was not yet coined. The episode discusses some technical aspects of SOA (such as loose coupling, messaging and ESBs), but mainly focusses on non-technical aspects of implementing an SOA.




3

Episode 73: Real Time Systems with Bruce Powel Douglass

This episode is a conversation with Bruce Powel Douglass on real time systems. We started by discussing what real time software is, and explored the difference between hard and soft real time. We then looked at different scheduling strategies, and the meaning of terms like urgency and importance in the context of scheduling. Next was a discussion of typical architectural styles for real time systems and how architectures are described in this context. This led us to a discussion about the importance of modeling, formalisms and languages as well as the role of automatic code generation from those models. We then looked at how to model QoS aspects and the role of SysML for modeling real time systems. We then had a brief look at which programming languages are used these days for real time systems and the role of static analysis to determine various properties of those programs in advance. The last part of the discussion focused on some best practices for building real time systems, the challenges in distributed real time systems and how real time systems can be tested effectively.




3

Episode 83: Jeff DeLuca on Feature Driven Development

In this episode we talk with Jeff DeLuca about Feature Driven Development (FDD). As one member of the agile methods family FDD is not so famous as Scrum or Extreme Programming but is becoming more and more popular, especially for situations where you have fixed price contracts. As the inventor of FDD Jeff gives short introduction to the method itself, talks about the basic ideas behind FDD and discusses with us how FDD relates to other members of the agile family.




3

Episode 90: Product Line Engineering, Pt. 3, with Charles Krueger

In this episode Charles Krueger, a well-known member of the product line engineering community, talks about his long term experiences in the field. Charles is also the founder and CEO of a company that provides tooling for variability management and product derivation. Besides some clarifications on terms like product line architecture and reference architecture, you also learn what kind of preconditions need to exist before product line engineering can be applied successfully.




3

Episode 93: Lessons Learned From Architecture Reviews with Rebecca Wirfs-Brock

In this episode, Markus talks to Rebecca Wirfs-Brock on what she has learned from architecture reviews. This is a very complement to the earlier episode on architecture evaluation.




3

Episode 103: 10 years of Agile Experiences

In this episode we're talking to Jens Coldewey about his experiences in 10 years of introducing agile techniques to project teams. We discuss real-world examples and the lessons learned and strategies derived from them.




3

Episode 113: Building Platforms with Jeff McAffer

In this episode we talk with Jeff McAffer about building platforms. We start with a brief discussion about what a platform is in contrast to a framework or an application. Drawing from his experiences working on the Eclipse platform for years, Jeff talks with us about how to develop platforms, why developing a platform is different from developing an application, what makes a good platform great, and why API design becomes so extremely important for platforms. He provides us with some insights on how the development process and the client collaboration for platform development could look like and what has and has not worked in the past.




3

Episode 123: Microsoft OSLO with Don Box and Doug Purdy

In this episode we discuss Microsoft's OSLO platform with Doug Purdy and Don Box. We briefly discuss what OSLO is in general and then look at the various components of OSLO. We also look at how OSLO fits in with the general Microsoft strategy and how it compares to other DSL/Model-driven approaches. We then look at language modularization and composition and discuss the similarities with XML and Smalltalk. Finally, we discuss possible integrations of OSLO with other MD* approaches and technologies.




3

Episode 130: Code Visualization with Michele Lanza

This episode is a discussion about code and metrics visualization with Michele Lanza. Michele invented the Code Cities idea about which he talks in this episode.




3

Episode 131: Adrenaline Junkies with DeMarco and Hruschka

This episode is an interview with Tom DeMarco and Peter Hruschka about the new book of the Altantic Systems Guild: Adrenaline Junkies and Template Zombies: Understanding Patterns of Project Behavior. This is a session recorded live at OOP 2009. SE Radio thanks Tom and Peter, SIGS Datacom and the programme chair, Frances Paulisch, for their great support!




3

Episode 132: Top 10 Architecture Mistakes with Eoin Woods

This is a discussion with Eoin Woods about his collection of top 10 software architecture mistakes. Looking at things that don't work is always a good way to learn what you should actually do.




3

Episode 133: Continuous Integration with Chris Read

In this episode Markus discusses with Chris Read basics and some advanced topics in the space of continuous integration. We cover concepts, some tools, as well as a number of best practices.




3

Episode 134: Release It with Michael Nygard

This episode is a discussion with Michael Nygard about his book "Release It" which covers aspects of software architecture you often don't think of initially when starting to build a system. Some of the points we discussed were capacity planning, recovery as well as making the system suitable for operation in a data center.




3

Episode 135: Introduction to Software Configuration Management with Petri Ahonen

In this episode Michael interviews one of our regular listeners: Petri Ahonen. Petri introduces Software Configuration Management by defining key terms and describing relevant concepts.




3

Episode 136: Past Present and Future of MDA with David Frankel

In this episode, Dirk talks with David Frankel, resident Metamodeller and MDA expert at SAP Labs LLC, SAP's subsidiary in the Silicon Valley. Dave's extensive experience provides a big picture, from the early days of CORBA all the way to current issues that are bugging most enterprise architects' work with MDA.




3

Episode 137: SQL with Jim Melton

In this episode, Arno talks to Jim Melton about the SQL programming language. In addition to covering the concepts and ideas behind SQL, Jim shares stories and insights based on his many years' experience as SQL specification lead.




3

Episode 138: Learning as a Part of Development with Allan Kelly

In this episode, Allan shares his insights about how learning is a necessary part of software development. He covers the personal as well as the team and the organizational level and offers practical advice.