and

Industry Reacts to Gas Furnace Mandate

This winter, HVAC contractors might be dealing with a wetter winter than years past, coupled with more snowfall than maybe most people would like.




and

Improving Home Comfort and Energy Efficiency with the Navien NPF Series Hydro-furnace

A homeowner in Pickering, Ontario works with an experienced HVAC pro to improve comfort, efficiency, and energy savings with a high-efficiency hydronic forced-air furnace upgrade.




and

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management

Posted by CISA on Mar 21

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management [...




and

Re: LLMs and refusals

Posted by Jason Ross via Dailydave on Jul 25

It's likely this is going to happen anyway, the new Mistral just dropped
and seems to perform roughly on par with llama3 and gpt4o, so the next wave
of fine tuned versions like dolphin are almost certainly coming soon.

OpenAI also has announced free fine tuning of gpt4o mini until late
September (up to 2m tokens/day) so it may be possible to fine tune around
some of its guardrails for a reasonable cost.




and

Re: LLMs and refusals

Posted by David Manouchehri via Dailydave on Jul 28

Breaking down a prompt into multiple steps works pretty well for us. e.g.
first we get generic mean reasons:

[image: image.png]

Then I just shove the mean reasons into the system message (you can do this
with another LLM call instead in real life, I just cheated by copy pasting
since there's already too many screenshots in this email):

[image: image.png]

This is with gpt-4o-2024-05-13 above, but you can see below it works with
Llama 3.1...




and

PRANA Hack and Leak Report Release

Posted by Dave Aitel via Dailydave on Aug 02

Cordyceps Analysis Report on PRANA Network Hack and Leak Operation:
https://docs.google.com/document/d/1oOJbBTUwyK85ZKYAAdwWqxk-sMvqrBqzJYX1oziTFu4/edit?usp=sharing

Lately I've been reading a lot of academic papers, mostly the Research
Handbook on Cyberwarfare
<https://www.elgaronline.com/edcollchap/book/9781803924854/book-part-9781803924854-6.xml>.
Some of them are good papers! JD Work has a paper in it! But also some of
them get...




and

Persistence and Strategic Effects

Posted by Dave Aitel via Dailydave on Aug 15

Before there were words, calculated as the softmax of a list of possible
tokens, there were just vectors of nano-electrical potential in cells
soaked in a hormonal brew of electrolytes, operating on a clock cycle of
"slow, but fast enough". In this sense, as we now know
<https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10472538/>, we generate words
and we know, in our heads, what we are, in the same way as we generate
limbs, with each...




and

Re: Persistence and Strategic Effects

Posted by the grugq via Dailydave on Aug 16

Cyber is Calvinball.

I gave a talk back in 2015 [1] which I think has held up rather well. My argument was that cyber is evolving in
unpredictable ways as we learn more about the domain. That the current state of the art has huge blind spots we aren’t
even thinking about. The next year was, of course, the 2016 disinformation campaign fed by cyber loot.

I feel that a great deal of cyber war literature is based on knowledge derived from...




and

sboms and LLMs

Posted by Dave Aitel via Dailydave on Sep 11

People doing software security often use LLMs more as orchestrators than
anything else. But there's so many more complicated ways to use them in our
space coming down the pipe. Obviously the next evolution of SBOMs
<https://www.cisa.gov/resources-tools/resources/cisa-sbom-rama> is that
they represent not just what is contained in the code as some static tree
of library dependencies, but also what that code does in a summary fashion...




and

Re: sboms and LLMs

Posted by Isaac Dawson via Dailydave on Sep 12

Well this is rather timely! Although I'm not sure using an LLM for the
behavioral aspect is entirely necessary. I've been working on an
experimental system that does just what you talk about for dependencies (
https://docs.gitlab.com/ee/user/application_security/dependency_scanning/experiment_libbehave_dependency.html,
pre-alpha!). My solution uses static analysis because I'm a fan of
determinism.

Snark aside, looking at behaviors...




and

Re: sboms and LLMs

Posted by Adrian Sanabria via Dailydave on Sep 12

We've been talking about and giving "Beyond the SBOM" presentations for a
while now, but to your point, I don't see anyone actually doing it.

If Solarwinds said "here's a script that will lock down your host firewall
to just the outbound access our tools need to update themselves", that
would be amazing, and would have saved everyone some time and trouble a few
years ago.

[image: image.png]
And Biden's EO...




and

Grace Hopper and the Rebirth of US Conferences

Posted by Dave Aitel via Dailydave on Oct 10

I spent some time watching all the Grace Hopper videos on the youtubes, as
I prepared for what up North is a horrible storm, but here in Miami is, so
far, a breezy and clear day. You can hear her talk about how subroutines
used to be literal handwritten pages of instructions in notebooks. When you
wanted SIN or COS you would go over to whoever had the notebook with the
working version, and copy it out into your code.

It was this experience that...




and

Hacking the Edges of Knowledge: LLMs, Vulnerabilities, and the Quest for Understanding

Posted by Dave Aitel via Dailydave on Nov 02

[image: image.png]

It's impossible not to notice that we live in an age of technological
wonders, stretching back to the primitive hominids who dared to ask "Why?"
but also continually accelerating and pulling everything apart while it
does, in the exact same manner as the Universe at large. It is why all the
hackers you know are invested so heavily in Deep Learning right now, as if
someone got on a megaphone at Chaos...




and

Episode 7: Error Handling

This week, Arno and Markus take a look at error handling at the architectural level. They discuss the different kinds of errors, the groups of people who need to know about them and proven high-level approaches. Later episodes will investigate more technical aspects of error handling, such as idioms for using exceptions or a discussion of checked vs. unchecked exceptions.




and

Episode 9: Remoting Pt.1 and Listener Feedback

This Episode as well as the next one take a look at remoting infrastructures such as CORBA, .NET Remoting or Webservices. In this first part we will take a look at why remote communication is necessary in the first place, what remoting middleware can do for you as well as which other middleware technologies exist in addition to OO-RPC systems, such as messaging middleware. Finally, we conclude with a brief overview of what the broker pattern can do for us in the context of remoting middleware.




and

Episode 16: MDSD Pt. 3, Hands-On

This episode provides a hands-on guided tour through a simple model-driven software project. It is based on an actual code sample (see link below) and takes a look at the typical steps of real-life code generation: prototypical implementation, defining the metamodel, reading a model into a metamodel instance, writing templates and validating the model. The example for the episode uses openArchitectureWare as a generator environment, but the overall approach is tool independent. This episode is the first in a new category "code/technology" that discusses technical concepts based on actual code. Please give feedback whether you find this format useful or not.




and

Episode 17: Feedback and Roadmap

This is a short episode that outlines the upcoming episodes and interviews, as well as reports on some listener feedback.




and

Episode 21: Error Handling Pt. 2

In this Episode, Arno and Michael take a closer look at Exceptions and Error conditions, how to categorize them and how to deal with them. We look at the different levels of guarantee that a piece of code can provide with regard to exceptional condition and finish with a discussion of a number of best practices and their respective trade-offs.




and

Episode 44: Interview Brian Goetz and David Holmes

This is another episode on concurrency. We talk to two experts in the field, Brian Goetz and David Holmes about aspects of concurrency we hadn't really covered before. We start out by discussing liveness and safety and then continue to talk about synchronizers (latches, barriers, semaphores) as well as the importance of agreeing on protocols when developing concurrent applications. We then talked about thread confinement as a way of building thread-safe programs, as well as using functional programming and immutable data. The next set of topics covers various ways of how compilers can optimize the performance wrt. to concurrency, talking about techniques such as escape analysis as well as lock elision and coarsening. We then covered how to test concurrent programs and the consequences of the Java memory model on concurrency. We then went on to look at some more advanced topics, namely, lock-free programming and atomic variables. We also briefly discussed the idea of transactional memory. Finally, we looked at how better language support - specifically, a more declarative style of concurrent programming as e.g. in the Fortress language - can aid in improving the quality of concurrent programs.




and

Episode 50: Announcements and Requests

This is another episode where we mainly announce topics related to the podcast itself.




and

Episode 63: A Pattern Language for Distributed Systems with Henney and Buschmann

In this Episode we talked about the new POSA 4 book which has recently been published. We talk to two of the authors, Kevlin Henney and Frank Buschmann (the third author, Doug Schmidt was not available - and he had also been on the podcast a couple of times :-)). The book contains a pattern language for distributed systems. It contains 114 patterns that had been published before by many different other authors. The patterns have been rewritten to form a consistent language. We basically talked through the different sections of the book, which gives a really good overview over the challenges and the solutions of building distributed systems. These sections include From Mud to Structure, Distribution Infrastructure, Event Demultiplexing and Dispatching, Interface Partitioning, Component Patitioning, Application Contrl, Concurrency, Synchronization, Object Interaction, Adaptazion and Extension, Modal Behaviour, Resource Management and finally, Database Access. The book references several other previous works (as listed below). Interestingly, many of these referenced works and authors have also been discussed previously on the podcast. Here are the back references:




and

Episode 64: Luke Hohmann on Architecture and Business

In this episode we talk about the relationship between software architecture and the business. Based on his book, Beyond Software Architecture we discuss how things such as branding, licensing, updating or different deployment scenarios influence the technical architecture of a system. We also discuss issues such as portability that add a huge amount of complexity, although from a business perspective it often does not make much sense. In the second part of the interview we discuss how the technical team and the business team can improve the way they work together. We look at some of the games (such as Buy a Feature or Give them a Hot Tub) from his new book Innovation Games, which discusses how to use collaborative play to be more creative and innovative in product creation.




and

Episode 67: Roundtable on MDSD and PLE

This is a roundtable discussion on model-driven software develoment and product line engineering. It was recorded at the Model-Driven Development and Product Lines: Synergies and Experience conference in October 2006 in Leipzig. The panelists are:




and

Episode 68: Dan Grossman on Garbage Collection and Transactional Memory

This episode features a discussion with Dan Grossman about an essay paper he wrote for this year's OOPSLA conference. The paper is about an analogy between garbage collection and transactional memory. In addition to seeing the beauty of the analogy, the discussion also serves as a good introduction to transactional memory (which was mentioned in the Goetz/Holmes episode) and - to some extent - to garbage collection.




and

Episode 79: Small Memory Software with Weir and Noble

In this Episode we're discussing patterns for small memory software with the authors of the like-named book Charles Weir and James Noble. We look at various aspects of the small memory problem: How can you manage memory use across a whole system? What can you do when you have run out of primary storage? How can you fit a quart of data into a pint pot of memory? How can you reduce the memory needed for your data? How do you allocate memory to store your data structures? Answers to all those questions are provided in this Episode, and of course in their book.




and

Episode 80: OSGi with Peter Kriens and BJ Hargrave

This episode is about OSGi, the dynamic module system for Java. Our guests are Peter Kriens (OSGI's Technical Director) and BJ Hargrave (OSGI's CTO). We'll discuss what OSGi is all about and why and in which contexts it is useful. Additionally we are having a look at the different layers of OSGI and where and how they are used. Other questions discussed are: What means dynamicity in an OSGI environment? Where is OSGI used? What’s the future of OSGI? How does OSGI interact with existing middleware solutions? How can I run several versions of the same JAR at the same time? Where are OSGI’s problems?




and

Episode 95: The New Guardian.co.uk website with Matt Wall and Erik DoernenBurg

In this episode we talk to Matthew Wall (Guardian News and Media) and Erik Doernenburg (Thoughtworks) about their work on the new guardian.co.uk website. We discuss the challenge of scalability and interactivity, their use of Domain Driven Design, some of the technical building blocks as well as the approaches they use for performance measuring and scalability tuning.




and

Episode 97: Interview Anders Hejlsberg

In this episode we have the pleasure of talking to Anders Hejlsberg, Chief Language Strategist at Microsoft. We started by discussing his more distant past, namely, his involvement with Turbo Pascal and Borland's Delphi. We then looked at the influences Delphi had on C# and how C# evolved from Delphi. In the next section we discussed a couple of general language design issues, among them components and checked vs. unchecked exceptions. Next, we discussed interesting issues about languages of the future, static vs. dynamic typing, functional programming, meta programming as well as the importance of good support for concurrency. We concluded the discussion by looking at the interplay between languages and IDEs.




and

Episode 101: Andreas Zeller on Debugging

In this episode we're talking to Andreas Zeller. about debugging. We started the discussion with an explanation of what debugging and how it works in principle. We then briefly discussed the relationship between debugging and testing. Next was the importance of the scientific method for debugging. We then looked as debugging as a search problem, leading to a discussion about delta debugging, the main topic of this discussion. We concluded the discussion by looking at the practical usability of delta debugging and the relationship to other means of automatically finding problems in software.




and

Episode 107: Andrew Watson on the OMG

This episode is a discussion with Andrew Watson, Technical Director of the Object Management Group. The episode is structured into five parts. We start with the history of the OMG and its early work. Then we look at the set of standards it has been (or is currently) working on. Next is a discussion of the standardization process used by the OMG, including the much-debated topic of compliance testing. We then look at OMG's relationship to other standards bodies (W3C, OASIS). Finally Andrew and I briefly discuss our common passion, gliding :-)




and

Episode 108: Simon Peyton Jones on Functional Programming and Haskell

We start our discussion with a brief look at what Haskell is and how a pure functional language is different from non-pure languages. We then look at the basic building blocks and the philosophy of the language, discussing concepts such as the lambda calculus, closures, currying, immutability, lazy evaluation, memoization, and the role of data types in functional languages. A significant part of the discussion is then spent on the management of side effects in a pure language - in other words, the importance of monads. We conclude the episode with a look at Haskell's importance and community today.




and

Episode 109: eBay’s Architecture Principles with Randy Shoup

In this episode we discuss with Randy Shoup, Distinguished Architect at eBay, about architectural pinciples and patterns used for building the highly scalable eBay infrastructure. The discussion is structured into four main ideas: partition everything, use asynchrony everywhere, automate everything, and design the system keeping in mind that everything fails at some point in a large distributed system.




and

Episode 123: Microsoft OSLO with Don Box and Doug Purdy

In this episode we discuss Microsoft's OSLO platform with Doug Purdy and Don Box. We briefly discuss what OSLO is in general and then look at the various components of OSLO. We also look at how OSLO fits in with the general Microsoft strategy and how it compares to other DSL/Model-driven approaches. We then look at language modularization and composition and discuss the similarities with XML and Smalltalk. Finally, we discuss possible integrations of OSLO with other MD* approaches and technologies.




and

Episode 131: Adrenaline Junkies with DeMarco and Hruschka

This episode is an interview with Tom DeMarco and Peter Hruschka about the new book of the Altantic Systems Guild: Adrenaline Junkies and Template Zombies: Understanding Patterns of Project Behavior. This is a session recorded live at OOP 2009. SE Radio thanks Tom and Peter, SIGS Datacom and the programme chair, Frances Paulisch, for their great support!




and

Episode 136: Past Present and Future of MDA with David Frankel

In this episode, Dirk talks with David Frankel, resident Metamodeller and MDA expert at SAP Labs LLC, SAP's subsidiary in the Silicon Valley. Dave's extensive experience provides a big picture, from the early days of CORBA all the way to current issues that are bugging most enterprise architects' work with MDA.




and

Episode 140: Newspeak and Pluggable Types with Gilad Bracha

This episode is a conversation with Gilad Bracha about Newspeak, type systems in general and optional/pluggable types in particular. It was recorded during DSL Devcon in the gardens of the Microsoft campus, and thanks to Gilad's "speaking like a book" way of talking it is published completely unedited :-)




and

Episode 141: Second Life and Mono with Jim Purbrick

In the first part of this episode we discuss a couple of basics about SecondLife (scaling, partitioning, etc). The second part specifically looks at how the dev team tackled a number of interesting problems in the context of executing their own LSL scripting language on top of Mono.




and

Episode 142: Sustainable Architecture with Kevlin Henney and Klaus Marquardt

This is another episode recorded at OOP 2009, thanks to SIGS Datacom and programme chair Frances Paulisch for making this possible. Here is the abstract from the conference program: Many software systems have fragile architectures that are based on brittle assumptions or rigid architectures that reduce options and make change difficult. On the one hand, an architecture needs to be fit for the present day, suitable for immediate use, and on the other it needs to accommodate the future, absorbing reasonable uncertainty. However, an approach that is overly focused on today's needs and nothing more can create an inflexible architecture. An approach that becomes obsessed with possible future changes creates an overly complex architecture that is unfit for both today's and tomorrow's needs. Both approaches encourage an early descent into legacy for a system. The considerations presented in this talk reflect an approach that is more about thinking in the continuous present tense than just the present or the future tense. This includes principles from lean thinking, practices common in agile processes and techniques for loosely coupled design.




and

Episode 149: Difference between Software Engineering and Computer Science with Chuck Connell

Michael discusses with his guest Chuck Connell the differences between software engineering and computer science. What makes software engineering so unpredictable, with so few formal results? And how can we advance the field of software engineering without these results?




and

Episode 153: Jan Bosch on Product Lines and Software Ecosystems

This episode is a conversation with Jan Bosch about product line engineering (PLE). Jan has worked in various roles and industries and academia in the context of product lines. In this episode we look at Jan's view of what is next for product lines: software ecosystems. What is their relationship to PLE and how should PLE change to remain relevant?




and

Episode 156: Kanban with David Anderson

This episode is part of our series on agile software development. We talk with David Anderson about Kanban, an agile software development method that is quite different from most of the other agile methods out there. We discuss the basic ideas behind Kanban, the differences between Kanban and Scrum and when and why projects can benefit from using Kanban. This episode is done in cooperation with the German magazine ObjektSpektrum (thanks for sharing this interview with us).




and

Episode 160: AspectJ and Spring AOP with Ramnivas Laddad

This episode is a conversation with Ramnivas Laddad about aspect-oriented programming (AOP), Aspect J, and Spring AOP. We review the fundamental concepts of AOP, discuss AspectJ (an open source compiler that extends java with support for AOP), and cover the Spring Framework's proxy-based AOP system. Laddad also gives his thoughts on the use cases for AOP and where we are in the technology adoption curve, and updates on the state of the AspectJ project itself.




and

Episode 165: NoSQL and MongoDB with Dwight Merriman

Dwight Merriman talks with Robert about the emerging NoSQL movement, the three types of non-relational data stores, Brewer's CAP theorem, the weaker consistency guarantees that can be made in a distributed database, document-oriented data stores, the data storage needs of modern web applications, and the open source MongoDB.




and

Episode 166: Living Architectures with John Wiegand

This time we have John Wiegand on the mic for an episode on architectures and agile software development. We talk about the role of architectures in an agile world and why architectures change and need to change over time. We discuss the characteristics of those living architectures, using the Eclipse and the Jazz projects as examples, and the surrounding development methods for such environments.




and

Episode 167: The History of JUnit and the Future of Testing with Kent Beck

In this episode we talk with Kent Beck about automated unit testing and JUnit.




and

Episode 174: Chip Manufacturing and Waferscanners

Guest: Wilbert Albers Host: Markus In this episode we take a look at microchip production, with a special focus on waferscanners. To do this, we talked with Wilbert Albers of ASML, the leading waferscanner manufacturer in the world. In the episode, we talk about the overall chip production process (from silicon sand over wafer cutting […]




and

Episode 175: Game Development with Andrew Brownsword

We discuss characteristics and performance properties of modern games and outline the challenges for software development.




and

Episode 179: Cassandra with Jonathan Ellis

Cassandra is a distributed, scalable non-relational data store influenced by the Google BigTable project and many of the distributed systems techniques pioneered by the Amazon Dynamo paper.




and

Episode 182: Domain-Specific Languages with Martin Fowler and Rebecca Parsons

In this episode, Markus talk with Martin Fowler and Rebecca Parsons about domain-specific languages.




and

Episode 186: Martin Fowler and Pramod Sadalage on Agile Database Development

Recording Venue: Skype Guest: Martin Fowler and Pramod Sadalage In this episode, we talk with Pramod Sadalage and Martin Fowler about database evolution and agile database development. We discuss the basic challenges for working with a database in an agile development culture and how to include database design and most of all, database evolution, in […]